Re: [IMail Forum] removing virus from user mailfolder

Fri, 21 Oct 2005 09:22:26 -0700

I see.  As far as I know you cannot remove an individual message from an .mbx file, except through the provided utility to remove messages older than a certain date.
 
The only thing I can think of is to use a utility to pop the mailboxes and resend them back to the recipient in order to have them go through scanning again.  This doesn't scale well, though.
 
You may be able to write a utility to do it safely, though, with appropriate locking to avoid corruption.  Not sure what IMail would do if it needed to access the .mbx while you had it locked, so that might require turning off the Queue Manager and POP3 services during the .mbx processing.
 
I can't comment on F-Prot directory exclusion as we do not use the real-time scanner.

Darin.
 
 
----- Original Message -----
Sent: Friday, October 21, 2005 10:22 AM
Subject: Re: [IMail Forum] removing virus from user mailfolder

Hi,
 
I think some of you don't realise what I do and want. Of course I do normal email scanning with the commandline version of F-Prot and Sophos. Both real time scanners are disabled. However, in order to find out if we missed anything there are two sceduled scans each week, one by F-Prot, one by Sophos. Both set to report only in order to avoid deleting complete mailboxes. ;-)
 
But.... what to do after a virus is found in a mailbox, what is an easy way to delete it?
And how do I exclude the \spool\virus directories from the schedules F-Prot scan?
 
 
Met vriendelijke groet,
Bonno Bloksma
hoofd systeembeheer
 
tio hogeschool toerisme en hospitality
julianalaan 9 / 7553 ab hengelo
t 074 255 06 10 / f 074 255 06 16
----- Original Message -----
From: Darin Cox
Sent: Friday, October 21, 2005 3:49 PM
Subject: Re: [IMail Forum] removing virus from user mailfolder

You should use the 32-bit command line scanner with Declude instead of F-Prot's realtime protector.

Darin.
 
 
----- Original Message -----
Sent: Friday, October 21, 2005 9:31 AM
Subject: Re: [IMail Forum] removing virus from user mailfolder

Hi,
 
Of course I stop all virusses on incoming mail as soon as either F-Prot or Sophos recognises it. However, before that happens some will slip through and end up in a mailbox.
 
For a while I could not block exe files as those were used internally to send autoinstalling updates for our scheduling program to acomodate certain less computer able collegues. ;-) I now block exe's as we have a new update mechanism in place.
 
But still.... I want to remove those old virusses from the mail.
 
About that other "problem"? Any idea how I can exclude a directory from scanning in F-Prot?
 
Met vriendelijke groet,
Bonno Bloksma
hoofd systeembeheer
 
tio hogeschool toerisme en hospitality
julianalaan 9 / 7553 ab hengelo
t 074 255 06 10 / f 074 255 06 16
----- Original Message -----
Sent: Friday, October 21, 2005 11:12 AM
Subject: RE: [IMail Forum] removing virus from user mailfolder

Scanning and acting against any mbx file is problematic.

 

Since you already have Declude, use that to stop the viruses, including banning extensions.

 

John T

eServices For You

 

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bonno Bloksma
Sent: Friday, October 21, 2005 1:48 AM
To: imail_forum
Subject: [IMail Forum] removing virus from user mailfolder

 

Hi,

 

Once a week I scan all mailfolders for virusses. Just scanning with f-prot and reporting. For a while I have identified some mailboxes with old mail and some old Bagle stuff. The virus was faster that the scanner updae so some came innto the mailbox As our students read all mail via the webinterface these mails will never be removed from the mailserver unles someone intentionally deletes them.

 

Here is part of a scan report:

C:\IMail\spool\virus\VirusDay1\D017601BC0000045B.SMD->patch3425.zip->details.txt                                                      Infection: W32/[EMAIL PROTECTED] (exact)
C:\IMail\spool\virus\VirusDay1\D409E032D00000CA6.SMD->your_picture.pif  Infection: W32/[EMAIL PROTECTED] (exact)
C:\IMail\spool\virus\VirusDay1\D4325032300000CE6.SMD->your_document.pif  Infection: W32/[EMAIL PROTECTED] (exact)
[....]

D:\Imail_Domains\student_tio_nl\users\a.kleinikkink\Main.mbx->ltrtwd.exe  Infection: W32/[EMAIL PROTECTED] (exact)
D:\Imail_Domains\student_tio_nl\users\a.rijkhoff\Main.mbx->ltrtwd.exe  Infection: W32/[EMAIL PROTECTED] (exact)
D:\Imail_Domains\student_tio_nl\users\a.zeeman\Main.mbx->ltrtwd.exe  Infection: W32/[EMAIL PROTECTED] (exact)

Two things I want to do

1) I want to exclude the C:\IMail\Spool\Virus direcory from this scan. I allready know that these files contain a virus.

 

2) I want to delete the mails conaining a virus from the users mailboxes. What is a easy way to do this. The hard way is for me log in as that user, wade through a few hundred mails to find the offending one and delete it. As I only know the name of the attachment.... that's a lot of work. :-(

 

Can anybody give me some hints as to how?


Groetjes,

 


Bonno Bloksma

Reply via email to