Outlook and spam (Re: Av - spam filter)

[Chuck <chuck+obsd_(_at_)_2003_(_dot_)_snew_(_dot_)_com>]

Quoting David Norman (norny_(_at_)_yahoo_(_dot_)_com):
> --- Ron Nicholson <ronn_(_at_)_dolese_(_dot_)_com> wrote:
> > I need to be able
> > to have some type of spam filtering and AV software running on this
> > pc.  I
> > was wondering what everybody else is using or what is recommended.  
> > I will have the following setup when it is done.  
> > Internet<->Firewall Pc<->ISA Server<->Exchange Server.
> 
> Our organization has found that if you want to abolutely make sure
> viruses don't make it on our network from email, don't let most
> attachments be delivered (MIMEDefang). I don't know if Exchange lets
> you do that or not.

MIME defang, AFAIK, will only stop MIME messages.
Outlook, cleverly, will also use (down decode and execute) it's
own attachment format.  Undocumented (thanks MS) and changing
(thanks MS).  Tnef jumps to mind as the name of it.

I've found it you want to absolutely make sure viruses don't
come in via mail, don't use outlook.  At one very large bank
I know of, they decided that the costs of Outlook outweighed
the benefits and it became verbotten.  Guy there kicked up
Outlook to check his mail, managed to set lose a virus on his
machine which affected a server.  Security came the next day
with a couple boxes to help him pack his stuff.  He'd ignored
repeated warnings.  There are many POP/IMAP clients out there.
They are not the danger to your business or IT infrastructure
that Outlook has shown itself to be.

> SpamAssassin with razor-agents and OpenBSD 3.3's spamd is my favorite
> anti-spam combo. I haven't had spam get through since spamd was first
> committed to CVS.

Yup.  I filter lots to 'likelyspam" boxes with few false positives.