I was up until one of my customers and then one of my Engineers could not receive firmware updates from Linksys.
We are still reviewing that decision. Do you think this MyDoom is a result of removing that block? Since adding the /ARCHIVE=5 this afternoon, I have seen it catch 2 of the rapidsys.com.zip attachments destined for the same customer that earlier reported the trouble. Thanks, Chris Patterson, CCNA Network Engineer -----Original Message----- From: John Tolmachoff (Lists) [mailto:[EMAIL PROTECTED] Sent: Thursday, October 21, 2004 4:12 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] MyDoom.o's slipping through. Why are you not banning executable files within zip files? John Tolmachoff Engineer/Consultant/Owner eServices For You > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > On Behalf Of Chris Patterson > Sent: Thursday, October 21, 2004 12:42 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.Virus] MyDoom.o's slipping through. > > Thanks, I was not aware of the /ARCHIVE=5. I have adjusted that, here > is my current cfg line: > > C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 > /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt > > If there is something I am missing, please let me know. > > Thanks, > > Chris Patterson, CCNA > Network Engineer > > > > -----Original Message----- > From: R. Scott Perry [mailto:[EMAIL PROTECTED] > Sent: Thursday, October 21, 2004 3:25 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.Virus] MyDoom.o's slipping through. > > > >I have had two reports in the last 2 days about a virus coming through. > > > >The customer forwarded these to me on an Exchange mailbox using Mcaffee > >which identified them as MyDoom.o. Tracing the Logs, they were scanned > >and Deemed Virus Free using Prescan. > > Given that it is in a .ZIP file, and you are using F-Prot, do you have > "/ARCHIVE=5 " in the SCANFILE line in the \IMail\Declude\virus.cfg > file? If it is just "/ARCHIVE ", you should change it to "/ARCHIVE=5 ", > > due to a bug in the latest version of F-Prot. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers > since 2000. > Declude Virus: Ultra reliable virus detection and the leader in > mailserver > vulnerability detection. > Find out what you've been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
