Declude has been installed for months, BUT you are right, these e-mails were delivered two days and a month before it seems that declude was installed (respectively). The weird thing is that the full system scan only reported them recently... one last week and another this week. Strange.
Thanks - Marc -----Original Message----- From: [EMAIL PROTECTED] [mailto:Declude.Virus-owner@;declude.com]On Behalf Of R. Scott Perry Sent: Wednesday, November 06, 2002 05:47 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Declude letting viruses through? >I do a weekly scan with of my Imail sever with F-protect and disturbingly >enough it found two viruses in the main.mbx files of two of my >users. F-protect 3.12a reported them as <mailto:klez.E@;mm>klez.E@mm and >the attachment was called logon [2].pif. I copied the MBX file to a test >user to see if I could find the attachment via web mail. There were no >suspicious attachments but there was an e-mail titled "colspan". Once >that was deleted, I re-ran the F-protect scan and it was clear. My >questions are, if I'm running Declude and F-protect how did this file get >though to my end user? The key here is to check the date/time of the E-mail, and then check the IMail and Declude log files to see what happened. There are a few possibilities that come to mind: o Scanning was turned off for that user/domain o The E-mail arrived before Declude Virus was installed o The E-mail arrived after Declude Virus was installed, but before the F-Prot virus definitions included the Klez virus o Declude Virus was temporarily disabled the log files should help narrow down what happened. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
