[Mimedefang] ClamAV's Worm/Trojan/Joke/W97M classifications

[Matthew.van.Eerde at hbinc.com]

WBrown wrote:
> mimedefang-bounces at lists.roaringpenguin.com wrote on 06/29/2005
> 09:47:03 AM:
> 
>> I believe, and have implemented this policy: All viruses should be
>> silently dropped, no exceptions. Bouncing or notifying just increases
>> the amount of noise your users and other people have to deal with.
> 
> For me it was a toss up to silently drop, or 550 reject.  The later
> won out in the rare case of a legit message having a word macro
> virus.  They would get notified.  In most other cases the mail will
> die, but in any case, I'm not generating bounce/virus notifications.

Where it really makes a difference is false-positives.  Silent drop is lost data (the sender thinks it was delivered, the recipient doesn't get it.)  550 reject at least lets the sender know that the receiving MTA is under the impression that the mail is a virus.

-- 
Matthew.van.Eerde (at) hbinc.com                 805.964.4554 x902
Hispanic Business Inc./HireDiversity.com         Software Engineer
perl -e"map{y/a-z/l-za-k/;print}shift" "Jjhi pcdiwtg Ptga wprztg,"