One last update on the Scanmail issue. I shut down the single IMC in the site, removed 3.8 from the IMC machine, installed 3.52, started up 3.52 (IMC still shut down), and upon enabling file blocking and AVAPI it discovered a message with Sircam. This would seem to indicate that it had gotten through at some point when ESE scanning was in place, but with AVAPI being what it is I am unable to easily determine the where/what/when of the message.
Maybe it was in transit when Trend was uninstalled after the IMC was shutdown but I now have some additional concerns about ESE scanning reliability. Did a final test with 3 attachment, exe, bat, vbs. My home server with 3.7 caught the exe only and the gateway server with 3.52 got the other two. Thanks -----Original Message----- From: Soysal, Serdar [mailto:[EMAIL PROTECTED]] Sent: Friday, January 25, 2002 4:58 PM To: Exchange Discussions Subject: RE: Fix from Trend for Exchange 2000 Attachment blocking I guess I lucked out then. Good luck to you buddy. Hopefully Trend will address this pretty soon. S. -----Original Message----- From: Mood, Steve [mailto:[EMAIL PROTECTED]] Sent: Friday, January 25, 2002 4:54 PM To: Exchange Discussions Subject: RE: Fix from Trend for Exchange 2000 Attachment blocking That's how it's configured. Not working for bat and not working for vbs, either internal to the site or outbound. It is still pulling off known viruses however (all of them I hope). Guess I'm staying late and dropping back to 3.52 AVAPI as I just don't believe that I need to "reinstall" to fix a problem with 2 separate software versions on 2 different servers. -----Original Message----- From: Soysal, Serdar [mailto:[EMAIL PROTECTED]] Sent: Friday, January 25, 2002 4:40 PM To: Exchange Discussions Subject: RE: Fix from Trend for Exchange 2000 Attachment blocking Just to be clear, you need to include both the attachment extensions and names. The attachment blocking settings should look like: [ ] All attachments [x] Specified attachments Attachments with specified extensions: ade;adp;bas;..... Attachments with specified names: *.ade;*.adp;*.bas;..... S. -----Original Message----- From: Mood, Steve [mailto:[EMAIL PROTECTED]] Sent: Friday, January 25, 2002 4:36 PM To: Exchange Discussions Subject: RE: Fix from Trend for Exchange 2000 Attachment blocking On Exch 5.5 with Scanmail 3.8 and Scan engine 5.630-1025. *. is in place and it is not blocking batch or vbs files. -----Original Message----- From: Soysal, Serdar [mailto:[EMAIL PROTECTED]] Sent: Friday, January 25, 2002 4:32 PM To: Exchange Discussions Subject: RE: Fix from Trend for Exchange 2000 Attachment blocking Well, it worked for me. I put a *. In front of every attachment type I had and boom it started blocking. You are using the same scan engine right? S. -----Original Message----- From: Mood, Steve [mailto:[EMAIL PROTECTED]] Sent: Friday, January 25, 2002 4:25 PM To: Exchange Discussions Subject: RE: Fix from Trend for Exchange 2000 Attachment blocking Suggested change does not seem to be working for Version 3.8 or 3.7. Am I missing something, another check box maybe? (on the phone to Trend now BTW) -----Original Message----- From: Soysal, Serdar [mailto:[EMAIL PROTECTED]] Sent: Friday, January 25, 2002 3:23 PM To: Exchange Discussions Subject: RE: Fix from Trend for Exchange 2000 Attachment blocking Damn! Same on Exchange 5.5 version as well. Version 3.8, pattern 207. I was able to create vbs files in notepad and happily pass them along. Good catch Tim. I'll go ahead and implement the change here as well. S. -----Original Message----- From: Hooks, Tim [mailto:[EMAIL PROTECTED]] Sent: Friday, January 25, 2002 3:07 PM To: Exchange Discussions Subject: Fix from Trend for Exchange 2000 Attachment blocking Just got off the phone with Trend. I noticed .bat files were not being blocked even though they were on my list of attachments to block by file extension. Trend indicates that blocking by file extension interprets by "true file type," meaning a .bat is a .txt file! The fix is to put in the "Attachments with specified file names:" entries like *.bat, *.scr, *.vbs, etc. I added almost my entire list minus a few like gif, jpg, mov, etc that being blocked correctly now. Exchange 2000 SP2 on Windows 2000 SP2 Scan engine version is: 5.630-1025 Pattern is 207 All Product version are: 6.00 Here are my entries: Attachments with specified extensions: bat;gif;jpg;jpeg;386;acm;asp;avb;bin;cla;class;cnv;com;cs;dll;drv;gms;hlp;ht a;htt;inf;ini;lnk;mpd;ocx;sys;tlb;tsp;vxd;wbt;wiz;exe;vbs;avi;mov;mp3;mpg;mp eg;wsh;js;reg;ins;wsf;vbe;jse;pif;wsc;sct;hta;shs;scr;cmd;mht*;ov*; Attachments with specified file names: *.bat;*.386;*.acm;*.asp;*.avb;*.bin;*.cla;*.class;*.cnv;*.com;*.cs;*.dll;*.d rv;*.gms;*.hlp;*.hta;*.htt;*.inf;*.ini;*.lnk;*.mpd;*.ocx;*.sys;*.tlb;*.tsp;* .vxd;*.wbt;*.wiz;*.vbs;*.wsh;*.js;*.reg;*.ins;*.wsf;*.vbe;*.jse;*.pif;*.wsc; *.sct;*.hta;*.shs;*.scr;*.cmd;*.mht*;*.ov*; Timothy J. Hooks, MCSE KBHR Columbus, Ohio _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
