Should You Disinfect?
Lately we have come across a few cases where the use of disinfect as an action for virus infections causes problems with MPP. Tangentially related, we are coming across issues with clamav or clamd that make it dangerous to use discard with these scanners if you are not careful. I want to make you aware of the particulars of these issues.
First of all, using disinfect as an action for email virus scanners is not very useful since the majority of email borne viruses are worms. Since a worm generated email only contains the worm itself there is nothing to disinfect. Disinfect presupposes that there is a real file that has been infected and that disinfecting will help use the file again. Fortunately virus scanners have become defacto standards on email servers so the incidence of actual email borne viruses has become statistically low, especially when compared against the prevalence of spam and phishing emails.
For a while customers were asking for MPP to have different actions for worms and real viruses but since we use so many different scanners and they all report differently, combined with the fact that both worms and email borne viruses have been largely held in check, we opted not to do this. Additionally, and this leads to the next point, spam scanners started detecting and reporting email worms while virus scanners, and clamav in particular, have started to report phishing emails as viruses.
While Clam’s detection of phishing emails sounded like a great idea it has become problematic in practice. We are getting many reports of false positives from ClamAV, something unheard of in the past, and it is no surprise that all of the false positives are from phishing signatures. Phishing signatures can be disabled by setting “PhishingScanURLs no” in the clamd config file and I highly recommend avoiding Clam’s experiment in your production network.
One important point is that disinfect is not supported with either the clamd or clamav scanner within MPP.
My recommendation is that if you really care about not losing legitimate email then you must quarantine. My recommendation is to discard virus infected emails altogether as the incidence of false positives without clamav phisihing signatures is minute with the current antivirus technology.
Comments
Leave a Reply
You must be logged in to post a comment.