Hello,
Yes, so far this is the only copy that has come through. I haven't
heard from any of my clients of them saying the virus has come through.
I didn't even think about EZIP. That didn't catch it either when
it should have, correct? I'll have to see if I can restore the attachment.
It's still sitting in NAV quarantine.
Anyway, here's what's listed in my VIRUS.CFG file (truncated):
#
LOGLEVEL MID
#
SCANFILE C:\Progra~1\FSI\F-Prot\FPcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE
/DUMB /REPORT=report.txt
VIRUSCODE 3
VIRUSCODE 6
REPORT Infection:
#
SKIPEXT GIF
SKIPEXT TXT
SKIPEXT JPG
SKIPEXT MPG
SKIPEXT PNG
#
BANEXT scr
BANEXT pif
BANEXT exe
BANEXT com
BANEXT EZIP
#
BANNAME photo.zip
BANNAME private.zip
BANNAME Wendy.zip
BANNAME p_usb.zip
BANNAME Attach.rar
BANNAME Details.rar
BANNAME details.rar
BANNAME Document.rar
BANNAME Encrypted.rar
BANNAME first_part.rar
BANNAME Gift.rar
BANNAME Info.rar
BANNAME Information.rar
BANNAME Message.rar
BANNAME MoreInfo.rar
BANNAME pub_document.rar
BANNAME Readme.rar
BANNAME Text.rar
BANNAME text_document.rar
BANNAME TextDocument.rar
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Friday, April 23, 2004 9:45 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] W32.Netsky.Q got through..
> This morning when receiving message from our spam account (I
>hold everything instead of deleting then review), I received a message
>and attachment that Norton AV on my local machine caught as a Netsky.Q
virus.
>This would have been delivered to the client had it not failed the spam
>tests.
> I'm running Declude v1.79 and F-Prot 3.14e with latest defs.
>Anyone else seeing Netsky.Q's getting through? Luckily I haven't seen
>anymore come through, but if you look at the virus logs, it sees it as
virus free. UGH!
>Wish I could have caught it on my Linux VM so I could continue sending
>the message to the server to see when it finally catches it.
Are other copies of Netsky.Q getting caught? Do you have a line "BANEXT
EZIP" in your virus.cfg file?
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list. To unsubscribe, just
send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
