Re: [Exim] Administrivia: Stop sending EICAR test strings

Top Page
Delete this message
Reply to this message
Author: Pat Lashley
Date:  
To: Nigel Metheringham, Exim Users Mailing List
CC: exim-users
Subject: Re: [Exim] Administrivia: Stop sending EICAR test strings
--On Friday, September 12, 2003 10:04:26 +0100 Nigel Metheringham
<Nigel.Metheringham@???> wrote:

> Two reasons:-
>      1. I don't run virus checking on any of my boxes, because all the
>         end users are configured in a virus avoiding fashion.  However I
>         do kill messages with executable extentions.  [The EICAR problem
>         is that it doesn't need to be in an attachment for most virus
>         scanners to pick it up.]  I'm not keen on running finickity
>         software that I don't have experience with on a box providing
>         real service.  Previous reasons for not doing so were that there
>         was no free AV software and no budget.

>
>      2. exim.org is seriously overloaded.  Until it gets new hardware I
>         am not putting additional services on to it.  Thats why
>         SpamAssassin isn't in the mailing list chain either.


Fair enough. Sounds a lot like the reasons I had for not using AV or
spam filtering on my old server. (Just replaced with major upgrades
last tuesday.) And let me say how happy I was to find a free and
apparently quite competent AV package in clamav.


> Having said that I added a regexp rule to the exiscan acls to kill EICAR
> stuff.


Sounds like a good cheap fix. Between that and the executable file
blocking you've probably got the vast majority of viri stopped.



-Pat