In both cases the viruses were inside zipped attachments. I used to ban those, but I was eventually outvoted.
Keith Purtell, Web/Network Administrator VantageMed Corporation (Kansas City office) Voice: (816) 801-5200 Fax: (816) 880-4776 Toll-free: (800) 525-1101 CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Jeff Maze > Sent: Tuesday, June 15, 2004 12:07 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.Virus] F-prot missing viruses > > > Do you know what the file extensions where? Just curious.. > > If you don't have file banned file extensions turn on and > configured in your > virus.cfg file, you may want to do just that. Declude > (Standard and Pro > versions only) will block certain file extensions whether > they're legit or > not. Good security practice in that it won't be delivered to > the user if > the virus definitions on the server haven't been updated to > catch the virus. > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Keith Purtell > Sent: Tuesday, June 15, 2004 10:54 AM > To: [EMAIL PROTECTED] > Subject: [Declude.Virus] F-prot missing viruses > > We've had two incidents where a virus got through our mail server, > apparently during the time lag while F-Prot was > writing/distributing a new > virus definition. (We update every hour.) In both cases a > subsequent virus > definition update caught the virus. But only after a > half-dozen users got > infected emails. In the most recent case, one of those users > had their local > anti-virus software misconfigured, and I had to spend more > than hour on a > long-distance call explaining to her how to clean Gaobot off > her laptop. > I've reviewed our Declude/F-prot configuration (standard > version) and can't > find anything wrong. But management is asking questions about > how this could > happen, and why are we using software developed by companies > they never > heard of. Tips? > > Keith Purtell, Web/Network Administrator VantageMed > Corporation (Kansas City > office) > Voice: (816) 801-5200 > Fax: (816) 880-4776 > Toll-free: (800) 525-1101 > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
