VOF dilemma - will stripping EXE's etc. hurt VOF?

Question

Dilemma - since VOF (Virus Outbreak Filters) are the last step in the message pipeline, do you hurt VOF performance by stripping attachments with filters? Specifically for attachment types you never would allow in anyway (EXE, COM, etc)?
Scenario One
Message or Content filter removes EXE
Outbreak occurs, VOF rule set to trigger on specific size EXE
Since a filter removed EXE, VOF has nothing look for, and you get pounded with thousands of "remnants" - virus messages without attachment. No virus attachment therefore no client damage, but helpdesk buried with support calls/complaints about suspicious but harmless messages.
Scenario Two
No filter to remove EXE
Outbreak occurs, VOF kicks in and stops most messages.
But before VOF kicks in, 15 messages with EXE's get through and infect clients. You are at greater risk since you didn't stop EXE's in the first place with a filter.
Are these scenarios correct? Any best practice suggestions?

Answer 1

Add a content filter to strip the exes.
This way, you can check for viruses and only take action if the message remains - it won't get to vof. Not a perfect solution but might be more of what you are looking for.
Where I work there are a whole batch of file extensions that are not allowed. We don't strip them in message filters since if they are a virus then the virus checker wouldn't find them. We have a content filter that looks for dictionary match in the X-IronPort-AV header for a dictionary of mass mailers that we know of and drop the message. If it gets past that content filter and still has a prohibited attachment, we drop the attachment.
NOTE: if you are doing it with scenario 1 and don't have some spare capacity then I wouldn't recommend letting them go to brightmail/ipas, and virus scanning.
You can configure in the cli with policyconfig->filters or in the gui under mail policies - incoming content filters. After adding the filters in the guii, you need to goto incoming mail policies to enable it for the for the default policy.
Filter Name: Drop_Mass_Mailers
Conditions:
header-dictionary-match("MassMailers","X-IronPort-AV")
Actions:
drop()
Description:
Drop mass mailers from the system
Filter Name: Drop_Prohibited_Attachments
Conditions (All of the following must match):
attachment-filename ==
"(?i)\\.(com|exe)$"
Actions:
drop-attachments-by-name("(?i)\\.(com|exe)$", "Attachment not allowed")
strip-header("Subject")
insert-header("Subject", "[Content Warning - Attachments Removed] $Subject")