OK..
I think you hit it Scott.
The one that was missed, is the only one so far, that has come through
with the .doc.com extension. Everything else has come with the .pif. My
guess would be that Mcaffee saw the .doc extension and just quit
scanning.
Just goes to show that even with all the best/updated virus protection
in the world, a smart user can make all the difference!
Of course, that doesn't explain why my firewall let it through, since
it's supposed to be stripping .com extensions, but that, obviously,
isn't your problem. :)
Thanks for your help!
Sharyn
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Monday, July 30, 2001 9:40 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] OSDUL:sir cam
>Yes! I checked the log and everything seems to be working fine. The
>email came through as "virus free", however, the day before Declude
>nabbed it, and has been nabbing it.
There's a chance that McAfee may not be recognizing it in certain
forms. Virus scanners actually won't scan an entire file sometimes, but
use logic to determine what part(s) to scan. For example, in an .EXE
file,
there are parts marked as data segments, that shouldn't be able to
contain
a virus. It might be that there is some sort of logic like that that is
missing the virus (perhaps when a certain file extension combination is
used).
The "Virus Free" message should only appear if the scanner reported that
no
virus was present.
>I'm not sure what Roger means by this..
>
>We had one sneak in for the first time this last week as well. We know
>it happened because the header info identified it. With the increase in
>virus activity during the last week maybe we reached
>the MAXATONCE 4 and it didn't 'wait' for the 5th?
He is using the MAXATONCE configuration option, which lets you limit the
maximum number of virus scanners that can run at the same time. This is
useful if you have a high volume server, or occasionally someone sends a
lot of mail at the same time, or your licensing only allows you to run a
certain number of concurrent scanner processes.
The default for this is "MAXATONCE 0", which will not limit the number
of
simultaneous scanner processes.
-Scott
This E-mail came from the Declude.Virus mailing list. To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance.
You can visit our web site at http://www.declude.com .
We are the worldwide producer and marketer of the award winning Cruzan
Single Barrel Rum, judged "Best in the World" at the annual
San Francisco Wine and Spirits Championships, and the
artisan tequilas of Porfidio 100% Agave Tequilas, judged "Best
Tequila" four years running by the Wine Enthusiast magazine. For
more information, please click (go to) <html><a
href="http://www.cruzanrums.com";>http://</a><a
href="http://www.cruzanrums";>www.cruzanrums.com</a></html>
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
