10/22/2004 10:23:08 Q17c7227e008410aa MIME file: archives.doc .exe [base64; Length=156891 Checksum=20055617]
10/22/2004 10:23:08 Q17c7227e008410aa Banning file with exe extension [application/x-msdownload].
10/22/2004 10:23:08 Q17c7227e008410aa Warning: EOF in middle of MIME segment [] [----------bound--]
10/22/2004 10:23:08 Q17c7227e008410aa WARNING: EOF in multipart processing.
10/22/2004 10:23:08 Q17c7227e008410aa Scanned: Banned file extension. [MIME: 3 157090]
10/22/2004 10:23:08 Q17c7227e008410aa From: [EMAIL PROTECTED] To: [EMAIL PROTECTED]
10/22/2004 10:23:08 Q17c7227e008410aa Subject: Hello
i sent this D file to the virustrap
Rick Davidson
National Systems Manager
North American Title Group
-
----- Original Message ----- From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, October 22, 2004 10:48 AM
Subject: Re: [Declude.Virus] Seeing Virus Activity getting past AV scanner
I am seeing exe files getting by Fprot and triggering my banned EXE rule
the attachments are archive.doc <lots of spaces> .exe
what is the declude virus submission addy?
What does the Declude Virus log file say for one of those?
You can send it to the declude.com virustrap@ address, although it is likely that if you just forward it, it will be seen properly as an .exe file here (my guess is that there is an issue with the MIME headers). If you happen to have a copy in an .mbx file on the server (or .SMD file), you can send the .mbx file, which would have everything necessary for us to determine why it was not blocked.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
