Hmmm. I double checked the Norton Quarantine logs and that is what it shows as the filename. I know that it was not the main.mbx file since it was still in tacked after the scan. I have seen Norton catching virus during website usage but that was before we started using Declude.
According to McAfee this is what they have it posted as Backdoor.Trojan (Symantec) and BackDoor.Trojan (NAV). Backdoor.Trojan (Symantec) forwards to the page on Backdoor-JZ BackDoor.Trojan (NAV) forwards to the page on BackDoor-ABH Strangely enough, when the virus is caught, it is across several different email accounts over different domains and always over an 8 hour period. Then there is nothing for several days. Steve -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: May 16, 2002 1:51 PM To: [EMAIL PROTECTED] Subject: RE: [IMail Forum] Web Messaging & Backdoor.Trojan >Interesting enough, the file that it is finding it in is not the main.mbx >file. It seems to be catching the virus after declude but before the >message is appended to the mail.mbx file when it is main.mbx.1. This way it >seems to be caught without the user needing to log in with the web >interface. I don't know of any case where IMail has a main.mbx.1 file -- I haven't seen that one before. Are you sure that is the correct name of the file? IMail does use a temporary filename ("main.~bx", I think) when it is changing the main.mbx file, could that have been it? "Backdoor.Trojan" sounds like a generic name used if a suspicious file is found, so it may be that there is something legitimate (such as a .VBS script that accesses the registry) that Norton thinks could be a virus, but isn't. -Scott --- Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for IMail. http://www.declude.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit the Knowledge Base for answers to frequently asked questions: http://www.ipswitch.com/support/IMail/ --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit the Knowledge Base for answers to frequently asked questions: http://www.ipswitch.com/support/IMail/
