Re: [Declude.Virus] Lentin virus passing declude and f-prot but caught by local f-prot but caught by local f-prot

[Lenny Bauman]

Scott,     I am running v1.53.  I will look into getting the .mbx file from the billing managers mail box if I can.                                                       Lenny Bauman ----- Original Message ----- From: R. Scott Perry To: [EMAIL PROTECTED] Sent: Friday, January 10, 2003 6:38 PM Subject: Re: [Declude.Virus] Lentin virus passing declude and f-prot but caught by local f-prot but caught by local f-prot >     I have a customer that is infected with the > <mailto:w32/Lentin.H@mm>w32/Lentin.H@mm virus.  He is sending messages to > my Billing manger and they are going through.  I should point out at this > time that to message does not set off f-prot on her computer.  She has > forwaeded the message to me as an attchment.  As soon as I open the > message that is attched it sets off my f-prot.  The message still opens > and I can see the attchment of *.scr.  I have saved the attched file and > sent it to my billing mangers e-mail address and declude and f-prot stop > it at the imail server.  I don't understand why the message get through > when it is sent from the infected computer but is caught when I send > it.  I would all so thing that the message shoulf be stop when it is > forwarded as an attachment to me.   I still have the forwarded email if > you want to see it or if you think I should send it to f-prot.     I am > lost as to why this is happening and am looking for a good answer. What version of Declude Virus are you running ("\IMail\Declude -diag" from a command prompt will show you)?  Some older versions (a year old or older typically) may not catch all variants of some modern viruses, as some new viruses now spread in non-RFC-compliant ways. The best way to determine the problem is if you can get one of the viruses in an .mbx file before it is downloaded, you can send it to us for analysis (if the original E-mail is still in the .mbx file, it will have the raw E-mail headers, and we can test it here).                                    -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".    The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by LRBCG.COM, Inc.]