[Mimedefang] Need help with virus notifications

[Ronald Vazquez NLM]

Hello:

I have been tasked with configuring MIMEDefang to allow a virus to come in thru the first instance, tag it with X-RrestrictedAttachment to allow our virus scanner to process it.  The idea is that once Trend Micro drops the attachment, we can scan the body with the second instance of MD and drop the virus notification.

Why?  There are some extensions that even though they are stripped, we do notify our users of the action so they can take appropriate action.  This means that we only want to stop notifications for uncleanable attachments.

Do anybody know a better way to accomplish this?  The goal is to avoid notifying our users of every virus-infected email we drop while still notifying them about a VBA file they were waiting for.

Thanks in advance,
Ronald Vazquez