Re: [IMail Forum] removing virus from user mailfolder

[Darin Cox]

You should use the 32-bit command line scanner with Declude instead of F-Prot's realtime protector. Darin.     ----- Original Message ----- From: Bonno Bloksma To: IMail_Forum@list.ipswitch.com Sent: Friday, October 21, 2005 9:31 AM Subject: Re: [IMail Forum] removing virus from user mailfolder Hi,   Of course I stop all virusses on incoming mail as soon as either F-Prot or Sophos recognises it. However, before that happens some will slip through and end up in a mailbox.   For a while I could not block exe files as those were used internally to send autoinstalling updates for our scheduling program to acomodate certain less computer able collegues. ;-) I now block exe's as we have a new update mechanism in place.   But still.... I want to remove those old virusses from the mail.   About that other "problem"? Any idea how I can exclude a directory from scanning in F-Prot?   Met vriendelijke groet, Bonno Bloksma hoofd systeembeheer   tio hogeschool toerisme en hospitality julianalaan 9 / 7553 ab hengelo t 074 255 06 10 / f 074 255 06 16 [EMAIL PROTECTED] / www.tio.nl ----- Original Message ----- From: John T (Lists) To: IMail_Forum@list.ipswitch.com Sent: Friday, October 21, 2005 11:12 AM Subject: RE: [IMail Forum] removing virus from user mailfolder Scanning and acting against any mbx file is problematic.   Since you already have Declude, use that to stop the viruses, including banning extensions.   John T eServices For You   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bonno Bloksma Sent: Friday, October 21, 2005 1:48 AM To: imail_forum Subject: [IMail Forum] removing virus from user mailfolder   Hi,   Once a week I scan all mailfolders for virusses. Just scanning with f-prot and reporting. For a while I have identified some mailboxes with old mail and some old Bagle stuff. The virus was faster that the scanner updae so some came innto the mailbox As our students read all mail via the webinterface these mails will never be removed from the mailserver unles someone intentionally deletes them.   Here is part of a scan report: C:\IMail\spool\virus\VirusDay1\D017601BC0000045B.SMD->patch3425.zip->details.txt                                                      Infection: W32/[EMAIL PROTECTED] (exact) C:\IMail\spool\virus\VirusDay1\D409E032D00000CA6.SMD->your_picture.pif  Infection: W32/[EMAIL PROTECTED] (exact) C:\IMail\spool\virus\VirusDay1\D4325032300000CE6.SMD->your_document.pif  Infection: W32/[EMAIL PROTECTED] (exact) [....] D:\Imail_Domains\student_tio_nl\users\a.kleinikkink\Main.mbx->ltrtwd.exe  Infection: W32/[EMAIL PROTECTED] (exact) D:\Imail_Domains\student_tio_nl\users\a.rijkhoff\Main.mbx->ltrtwd.exe  Infection: W32/[EMAIL PROTECTED] (exact) D:\Imail_Domains\student_tio_nl\users\a.zeeman\Main.mbx->ltrtwd.exe  Infection: W32/[EMAIL PROTECTED] (exact) Two things I want to do 1) I want to exclude the C:\IMail\Spool\Virus direcory from this scan. I allready know that these files contain a virus.   2) I want to delete the mails conaining a virus from the users mailboxes. What is a easy way to do this. The hard way is for me log in as that user, wade through a few hundred mails to find the offending one and delete it. As I only know the name of the attachment.... that's a lot of work. :-(   Can anybody give me some hints as to how? Groetjes,   Bonno Bloksma