[Mimedefang] New virus out, how do I confirm no errors?
dbruyne at uia.ua.ac.be
Wed Dec 5 02:46:23 EST 2001
My (little) experience here tells me you've probably got some users
reading their hotmail from one of the pc's, and the contamination
came in that way.
On Tue, 4 Dec 2001, David F. Skoll wrote:
> On Tue, 4 Dec 2001, Fox, Randy wrote:
> > A new virus came out today with an attachment gone.scr. MIMEDefang has
> > stripped several of these as expected. However, while working with the
> > users, it is evident that some got through and were then cleaned by the
> > virus scanner on our internal Exchange servers.
> That is very bad. A couple of thoughts:
> 1) Is there any way mail could come in and bypass the MIMEDefang server?
> Since they all have the X-Scanned-By: header, that's unlikely, but it
> may be possible.
> 2) Do any of the failed messages have an X-MIMEDefang-Warning: header?
> 3) Can you post your filter code? Maybe there's something wrong there.
> 4) Could you post the headers and MIME part headers for a message which
> I've been monitoring a few MIMEDefang installations, and they all seem
> to have caught everything.
> MIMEDefang mailing list
> MIMEDefang at lists.roaringpenguin.com
Karel De Bruyne
System/Network Manager phone + 32 3 820 22 04
UIA - Network Service fax + 32 71 83 43 00
Universiteitsplein 1 - B0.12 email dbruyne at uia.ua.ac.be
B 2610 Wilrijk - Belgium http://www.uia.ua.ac.be/u/dbruyne
More information about the MIMEDefang