IMail 7.15 HF3
Declude 1.78
Virus PRO
Junkmail PRO
F-Prot 3.14b
We use IMail as a gateway server, processing around 120,000-180,000
messages per day. We have been catching Netsky.C with F-Prot since
last Wednesday, 02-25-2004. However, a small number of infected
messages are getting through. See below for relevant information on one
such case. After extracting the ZIP file from the message that got
through and moving it back to the IMail server, I scanned it with
F-Prot using the same command line as in virus.cfg, and it found the
virus.
I receive several reports per day from users that they have received
infected messages.
Has anyone else had this happen?
-Frank
----------------
Message headers:
Received: from gemini.tntech.edu ([149.149.11.7]) by hub.tntech.edu with Microsoft
SMTPSVC(6.0.3790.0);
Sat, 28 Feb 2004 08:41:07 -0600
Received: from raptor.tntech.edu ([149.149.11.199])
by tntech.edu (PMDF V6.1-1 #30784)
with ESMTP id <[EMAIL PROTECTED]> for [EMAIL PROTECTED]
(ORCPT [EMAIL PROTECTED]); Sat, 28 Feb 2004 08:41:07 -0600 (CST)
Received: from tntech.edu [66.64.141.166] by raptor.tntech.edu with ESMTP
(SMTPD32-7.15) id A879ED000E2; Sat, 28 Feb 2004 08:40:57 -0600
Date: Sat, 28 Feb 2004 09:35:57 -0500
From: [EMAIL PROTECTED]
Subject: notice!
To: [EMAIL PROTECTED]
Message-id: <[EMAIL PROTECTED]>
MIME-version: 1.0
Content-type: multipart/mixed;
boundary="----=_NextPart_000_0014_00002F3B.00000175"
X-Priority: 3
X-MSMail-priority: Normal
X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command .
X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam
[4000020e].
X-Declude-Sender: [EMAIL PROTECTED] [66.64.141.166]
X-Declude-Spoolname: Da8790ed000e24e40.SMD
X-Note: This E-mail was scanned by Declude 1.78 for viruses and spam.
X-Spam-Tests-Failed: CMDSPACE, SPAMHEADERS [8]
Return-Path: [EMAIL PROTECTED]
X-OriginalArrivalTime: 28 Feb 2004 14:41:07.0858 (UTC) FILETIME=[E69A6F20:01C3FE08]
----------------
sys0228.txt:
02:28 08:40 SMTPD(0ED000E2) [149.149.11.199] connect 66.64.141.166 port 65324
02:28 08:40 SMTPD(0ED000E2) [66.64.141.166] EHLO tntech.edu
02:28 08:40 SMTPD(0ED000E2) [66.64.141.166] MAIL FROM: <[EMAIL PROTECTED]>
02:28 08:40 SMTPD(0ED000E2) [66.64.141.166] RCPT TO: <[EMAIL PROTECTED]>
02:28 08:41 SMTPD(0ED000E2) [66.64.141.166] D:\IMail\spool\Da8790ed000e24e40.SMD 35819
----------------
vir0228.log:
02/28/2004 08:41:00 Qa8790ed000e24e40 Scanned: Virus Free [MIME: 2 25639]
----------------
virus.cfg:
SCANFILE C:\Progra~1\FSI\F-Prot\fpcmd.exe /TYPE /SILENT /NOMEM /NOBOOT /ARCHIVE
/PACKED /DUMB /REPORT=report.txt
----------------
report.txt from a manual scan using same switches as in virus.cfg
Virus scanning report - 1 March 2004 @ 9:16
F-PROT ANTIVIRUS
Program version: 3.14b
Engine version: 3.14.7
VIRUS SIGNATURE FILES
SIGN.DEF created 1 March 2004
SIGN2.DEF created 1 March 2004
MACRO.DEF created 23 February 2004
Search: release.zip
Action: Report only
Files: "Dumb" scan of all files
Switches: /ARCHIVE /PACKED /REPORT=report.txt /SILENT /NOBOOT /NOMEM
Memory was not scanned.
Hard disk boot sectors were not scanned.
C:\Download\release.zip->release.exe Infection: W32/[EMAIL PROTECTED]
Results of virus scanning:
Files: 1
MBRs: 0
Boot sectors: 0
Objects scanned: 2
Infected: 1
Suspicious: 0
Disinfected: 0
Deleted: 0
Renamed: 0
Time: 0:00
----------------
Email Summary for 0228:
Messages Processed
139795
Spam Caught
125651
Viruses Caught
1929
1137 W32/[EMAIL PROTECTED]
317 W32/[EMAIL PROTECTED]
173 W32/[EMAIL PROTECTED]
122 W32/[EMAIL PROTECTED]
82 W32/[EMAIL PROTECTED]
47 W32/[EMAIL PROTECTED]
14 W32/[EMAIL PROTECTED]
9 W32/[EMAIL PROTECTED]
9 W32/[EMAIL PROTECTED]
8 W32/[EMAIL PROTECTED]
5 W32/[EMAIL PROTECTED]
2 W32/[EMAIL PROTECTED]
1 W32/[EMAIL PROTECTED]
1 W32/Hybris.worm.B
1 W32/[EMAIL PROTECTED]
1 JS/[EMAIL PROTECTED]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
