I'm seeing a large problem where spam getting caight in the database is simply virus. So instead of getting caught by the attachment it's getting caught by the ip. Since the rules order isn't going to be changed anytime soon, I need to find a way to delete all messages out of the quaruntine that have been blocked by IP and have attachment extentions that are common to virus' IE. .htm .bat .scr etc

Any suggestions?

Kevin,

I too have some quarantined stuff that was caught by other filters an is, in fact, a virus but if the customer reies to send it, my virus gateway will catch it.  For example:

147

Text OR HTML    llucas@lauraltonhall.org

hostmaster@aol.com

Confirmation

12/28/2004 9:16:18 AM

SPF Sender Policy Framework match

550 The sender did not meet Sender Policy Framework rules. Please see http://spf.pobox.com

SID=11 Razor

This actually has an email virus but was trapped by SPF.

Did the forum already have a discussion on the attachment BL order?  SF-ISP is not (yet) intended to be an anti-virus gateway but I can see that quarantining the above, while not causing any issues in my setup, is less than desireable.

Question ... Does MS-SQL have any options to do a virus scan on a per-field basis?  I have not ever seen anything like that but it may be possible.

Dan

Kevin,

Having SpamFilter search for IP and domain blocks first allows SpamFilter to be very efficient, as it does not have to scan thru an email's content to look for attachments/keywords. Furthermore, the IP/domains are available as soon as the remote servers connect, *before* any email content is even sent thru the network. SpamFilter's speed is one of the features we're very happy with, and changing the filter order will have large impact on performance.

To prevent banned-attachment files from being displayed in the web interface, an option could be to use ASP to filter out/hide/unlink emails that have the attachment in the email body. The Msg field in the tblMsgs table would have a section similar to the following for an attachment of joe.txt:

------=_NextPart_000_003B_01C4ED2F.4D510E20 Content-Type: text/plain; name="joe.txt" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="joe.txt"

Some ASP could be developed to look for that extension(s).

Roberto F. LogSat Software

If emails are quarantined, as it's for a major part of the installs, yes, bandwidth is still used because the message is still being received. However my statements about the efficiency still hold true, as the message does not have to be scanned and text searches be performed against it if the other filters have already tagged it. Performance is impacted not as much by SpamFilter receiving the messages, but in SpamFilter having to parse its contents.

We have been working to implement an antivirus solution, but technical issues have hampered the process. When they are overcome, I believe that will take care of your concerns as well.

Roberto F. LogSat Software

The attachment filter is embedded within the keywords filter, they can't be separated. Moving one would also mean moving the other, sorry.

Roberto F. LogSat Software

Matt. Let's not put our foot in our mouth again shall we?

Most people do use the quaruntine.

Who said anything about hardcoding it? Generally every feature request roberto adds is configured via the ini file.

There is also a fine line between efficiency and how well and how convienient a product works. Right now, it's a pain in the ass because 90% of the spam is caught by ip. 80% of that is files caught because of their attachment. So now all my users have to sift through all of this spam to delete a bunch of useless messages that are deemed spam but I have no method to delete them. You explsin to all my customers that they have to deal with deleting all of that spam because the spam software I use is efficient instead of co-operative.

Ok. So why do I need this antivirus plugin? I'm already blocking most of my virus' with spamfilter already. anything that gets past is scanned by norton and/or mcafee.

But let's say for examply people don't have norton or mcafee. Most likely they have something on their server right?

Now by going by your theory Matt, the antivirus plugin would help us to find virus' right?

But we already know what most of them are, because we blocked them by fileattachment.

So instead of having the file attachment before the ip scan. we now have an antivirus plug in as well.

I want you to explain to me how THIS is going to help efficiency. All this can do is slow down the process, due the fact that now the entire message needs to be scanned for virus'.

Kevin,

SpamFilter's job is to catch spam and all unwanted emails and block them so the end user does not see it. If your customers comlain because SpamFilter blocked too much spam and now their quarantine is full of junk... sorry, but this is *exactly* what SpamFilter is supposed to do. We tried to add features and options to allow in flexibility for administrators to have some control of what is quarantined and what is instead deleted right away, but we are not inclined to sacrifice performance for functionality that is extra to the ability to block spam.

As a side note, this is our own opinion, but end users usually do not "routinely" go in their quarantine and check it for emails. At this point one may as well eliminate a spam filter since the users end up looking at all the blocked emails anyhow. But again this is our opinion and you may have requirements that we are not aware of.

The order of the filter will be made user-defineable in future versions, but whether the IP-based rules will be processed before all others or not is still not decided. In any case, this is a major change that cannot be made using simple ini file parameters, it will require a lot of development (and discalimers for loss of performance if used improperly).

Roberto F. LogSat Software

Kevin,

For this I'd go back to my 1st reply in this thread:

==============
The Msg field in the tblMsgs table would have a section similar to the following for an attachment of joe.txt:

------=_NextPart_000_003B_01C4ED2F.4D510E20
Content-Type: text/plain;
	name="joe.txt"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename="joe.txt"

==============

If as you ask for in this last posting you wish to only be able to delete all emails blocked by IP that have any attachment, you could construct a SQL query that looks for the string "Content-Disposition: attachment;", as follows:

UPDATE    tblQuarantine
SET              tblQuarantine.Expire = 1
FROM         tblQuarantine, tblMsgs
WHERE     (tblQuarantine.MsgID = tblMsgs.MsgID) AND (tblMsgs.Msg LIKE '%Content-Disposition: attacdment;%') AND (tblQuarantine.RejectID = 12)

This will cause all messages with RejectID=12 and the attachment string to be tagged for deletion by SpamFilter. Please note that RejectID 12 includes both blacklisted IPs and rejects caused by the MAPS RBL servers. SpamFilter makes no distinctions between the two. If that is not satisfactory, the query could be modified to also look at the RejectDetails field in the tblQuarantine table to look for "is Blacklisted" (a subset of "The IP aa.bb.cc.dd is Blacklisted").

DISCLAIMER - This SQL statement was thought of while responding to this post, it is in no way supported/guaranteed to work by LogSat!

Roberto F.
LogSat Software