[Mimedefang] When to do Virus checks

[Steffen Kaiser]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 30 Nov 2006, Johan Sleeuwenhoek wrote:

> I think it is worth the extra CPU time to stop a virus at the earliest
> time possible. This makes it less dangerous, since the virus does not
> pass all the components of your emailscanning system.

I wonder what a virus can do when the mail is processed by MIMEDefang.
The message is already broken up into MIME parts, so to reject the mail in 
filter_begin does not skip this work.

I think John is right. When you can reject the mail because of other 
means, it seems to be cheaper (except SpamAssassin). And you shouldn't 
scan the individual parts of the mail for viruses in order to remove 
infected parts only.

Bye,

- -- 
Steffen Kaiser
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iQEVAwUBRW73BugJIbZtwg6XAQItCAf/e2PhNu9JPpGrNlaQKuDoYo0DIvy53S/4
gCro4hTUR6IkC+XCNfq+2DquDosUuUYRBq6hHbL1geOSidHaNiA7rmAxzXT5EUjP
wnzOukMCWy4OHdHOGPZEtSDUDAVlLVvP7ME/ojbFTjco3+0EWnLlNLnGmKooO7WD
MaJNkt630OU1yJ98sj1q0Gdi9NfNmxdv+px+Qz4U9OqLXLyV+3LijHlHVD9dyKRm
bhqNsu8MzgWBxHsKJgoMhaZZEQqfJOeG2ewyCYqIDXGUdlBcynh8+NMH9yjTKEBS
aVhp5EnHLfoI0asLM45YvtTzJqhWz8TpOAgNqslQ7s3Zpwt9X43oyg==
=Mv9J
-----END PGP SIGNATURE-----