We do the following when a virus is found:

The script file does a logical name lookup on the virus name in a
VIRUS_DISPOSAL name table. This returns one of the following:

A: Remove the infected portion and replace with warning (default action).
R: Reject message (PMDF__FORCERETURN), bouncing it to sender.
H: Hold message (PMDF__FORCEHOLD)
D: Discard message (PMDF__FORCEDISCARD) and save headers.
T: Trash message completely (PMDF__FORCEDISCARD and save nothing).

This allows us to set different actions for different viruses. The default
action is to forward the message with the virus removed, and this is the
most appropriate action when viruses get attached to legitimate mail (such
as Word viruses). Where the whole message is being generated by the virus,
there is no point delivering it, so D or T are appropriate. The actions
are controlled by the conversion script by returning the appropriate PMDF__
code.

If the lookup fails, the message is forwarded with the infected attachment
replaced by a warning. Thus we add entries such as MYDOOM to the table as
they arise, once we know that this particular virus does not infect
genuine messages.

As for the legal issues, I can't comment on the German situation, but Irish
law does not mandate the delivery of e-mail, so I don't believe this is
an EU wide thing.

-------------------------------------------------------------------
Tom Wade | EMail: tee dot wade at eurokom dot ie
EuroKom | X400: g=tom;s=wade;o=eurokom;p=eurokom;
Unit A2 | a=eirmail400;c=ie
Nutgrove Office Park | Tel: +353 (1) 296-9696
Rathfarnham | Fax: +353 (1) 296-9697
Dublin 14 | Disclaimer: This is not a disclaimer
Ireland | Tip: "Friends don't let friends do Unix !"