At 09:22 AM 10/21/2005, you wrote:
Hi,
I think some of you don't realise what I do and want. Of course I do normal email scanning with the commandline version of F-Prot and Sophos. Both real time scanners are disabled. However, in order to find out if we missed anything there are two sceduled scans each week, one by F-Prot, one by Sophos. Both set to report only in order to avoid deleting complete mailboxes. ;-)
But.... what to do after a virus is found in a mailbox, what is an easy way to delete it?
And how do I exclude the \spool\virus directories from the schedules F-Prot scan?
Met vriendelijke groet,
Bonno Bloksma
hoofd systeembeheer
tio hogeschool toerisme en hospitality
julianalaan 9 / 7553 ab hengelo
t 074 255 06 10 / f 074 255 06 16
[EMAIL PROTECTED] / www.tio.nl
- ----- Original Message -----
- From: Darin Cox
- To: [email protected]
- Sent: Friday, October 21, 2005 3:49 PM
- Subject: Re: [IMail Forum] removing virus from user mailfolder
- You should use the 32-bit command line scanner with Declude instead of F-Prot's realtime protector.
- Darin.
- ----- Original Message -----
- From: Bonno Bloksma
- To: [email protected]
- Sent: Friday, October 21, 2005 9:31 AM
- Subject: Re: [IMail Forum] removing virus from user mailfolder
- Hi,
- Of course I stop all virusses on incoming mail as soon as either F-Prot or Sophos recognises it. However, before that happens some will slip through and end up in a mailbox.
- For a while I could not block exe files as those were used internally to send autoinstalling updates for our scheduling program to acomodate certain less computer able collegues. ;-) I now block exe's as we have a new update mechanism in place.
- But still.... I want to remove those old virusses from the mail.
- About that other "problem"? Any idea how I can exclude a directory from scanning in F-Prot?
- Met vriendelijke groet,
- Bonno Bloksma
- hoofd systeembeheer
- tio hogeschool toerisme en hospitality
- julianalaan 9 / 7553 ab hengelo
- t 074 255 06 10 / f 074 255 06 16
/ www.tio.nl
- [EMAIL PROTECTED]
- ----- Original Message -----
- From: John T (Lists)
- To: [email protected]
- Sent: Friday, October 21, 2005 11:12 AM
- Subject: RE: [IMail Forum] removing virus from user mailfolder
- Scanning and acting against any mbx file is problematic.
- Since you already have Declude, use that to stop the viruses, including banning extensions.
- John T
- eServices For You
- -----Original Message-----
- From: [EMAIL PROTECTED] [ mailto:[EMAIL PROTECTED]] On Behalf Of Bonno Bloksma
- Sent: Friday, October 21, 2005 1:48 AM
- To: imail_forum
- Subject: [IMail Forum] removing virus from user mailfolder
- Hi,
- Once a week I scan all mailfolders for virusses. Just scanning with f-prot and reporting. For a while I have identified some mailboxes with old mail and some old Bagle stuff. The virus was faster that the scanner updae so some came innto the mailbox As our students read all mail via the webinterface these mails will never be removed from the mailserver unles someone intentionally deletes them.
- Here is part of a scan report:
- C:\IMail\spool\virus\VirusDay1\D017601BC0000045B.SMD->patch3425.zip->details.txt Infection: W32/[EMAIL PROTECTED] (exact)
- C:\IMail\spool\virus\VirusDay1\D409E032D00000CA6.SMD->your_picture.pif Infection: W32/[EMAIL PROTECTED] (exact)
- C:\IMail\spool\virus\VirusDay1\D4325032300000CE6.SMD->your_document.pif Infection: W32/[EMAIL PROTECTED] (exact)
- [....]
- D:\Imail_Domains\student_tio_nl\users\a.kleinikkink\Main.mbx->ltrtwd.exe Infection: W32/[EMAIL PROTECTED] (exact)
- D:\Imail_Domains\student_tio_nl\users\a.rijkhoff\Main.mbx->ltrtwd.exe Infection: W32/[EMAIL PROTECTED] (exact)
- D:\Imail_Domains\student_tio_nl\users\a.zeeman\Main.mbx->ltrtwd.exe Infection: W32/[EMAIL PROTECTED] (exact)
- Two things I want to do
- 1) I want to exclude the C:\IMail\Spool\Virus direcory from this scan. I allready know that these files contain a virus.
- 2) I want to delete the mails conaining a virus from the users mailboxes. What is a easy way to do this. The hard way is for me log in as that user, wade through a few hundred mails to find the offending one and delete it. As I only know the name of the attachment.... that's a lot of work. :-(
- Can anybody give me some hints as to how?
- Groetjes,
- Bonno Bloksma
No virus found in this incoming message.
Checked by AVG Anti-Virus.
Version: 7.0.344 / Virus Database: 267.12.4/143 - Release Date: 10/19/2005
No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.344 / Virus Database: 267.12.4/143 - Release Date: 10/19/2005
