How are you doing the scan? MAPI, AVAPI, or ESE. This sounds like MAPI. When doing MAPI scans, the scanner can become overloaded and pass virii. Also, what version of Trend, what Exch SP, and what file types are you blocking
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Chinnery Paul Sent: Monday, October 22, 2001 7:27 AM To: Exchange Discussions Subject: Infect file slips thru Trend Antivirus Today, we had a virus outbreak with the "homepage" virus (released in the wild 5/9). We use TrendMicro's AV on our Exchange server (5.5) along with the desktop version. >From the infected computer, I received 9 emails of the virus. With the first 4 emails, Trend caught and stripped the attachment. However, the subsequent 5 emails had the attachment with them. (And, btw, I also have it set up to block exe, vbs, bat and cmd files.) Even more, when two more computers got infected opening the attachment from the original pc, Trend didn't catch those subsequent emails at all. I understand, of course, Ed's rule of thumb about technological solutions but I'm mostly just curious (and concerned to a degree) why our AV didn't protect us that much. I've contacted Trend support and asked them why this happened but I'm simply throwing it out here for comment. I just find it rather perplexing that Trend only catches half of them. Paul Chinnery Network Administrator Mem Med Ctr _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
