If this is Symantec AV for Gateways, another thing that will cause this to happen is if you have file attachment scanning/deleting enabled. If, lets say, all .exe attachments you have set to remove. Then you would never get an instance of any virus that carries a .exe attachment. However, people who get the e-mail will see odd e-mails with an attachment that should say the attachment deleted and what the name of the attachment was.
Travis > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of R. > Scott Perry > Sent: Monday, January 26, 2004 4:28 AM > To: [EMAIL PROTECTED] > Subject: Re: [IMail Forum] Symantec AntiVirus and IMail > > > > >I wouldn't pretend to do anywhere near the number of email a day as > >most of you do. 1,000 a day would be a heavy day well over > 50% of that > >is spam. Yet in months of using the Symantec AntiVirus, I > have yet to > >see a single virus caught. Now on the flipside, I have yet > to have one > >pass through either. I have the system setup to notify me > and the user > >if a virus is detected, but it's never triggered. Logs don't > show any > >detection either. > > Although it is technically possible that no viruses were > sent, it's highly > unlikely. Viruses now get E-mail addresses from a wide > enough variety of > sources that it is extremely rare for a domain not to receive > any viruses > over long periods of time. > > However, the *first* thing you should do after installing an > AV program is > test it. Otherwise, you're wasting your money. There are a > lot of ways > any AV program can not work properly. You can go to > http://www.declude.com/tools and use the Test Virus Sender to > send the test > eicar.com file to see if your server blocks it (yes, it works > even if you > are not running Declude Virus <G>). I'm guessing that you > won't receive > the eicar.com file, but will get one of those "NULL body" notices. > > >In the last several weeks I have all the sudden seen a > number of emails > >come in with NULL Bodies, or no attached messaged. In most > cases, the > >header isn't even complete. I can find nothing in the logs > that lead me > >to believe this was a virus incoming, but I am wondering why I see > >several of these a day now when I never saw them a month ago (8.05?). > > It sounds like you have an on-access virus scanner doing something it > shouldn't. If you are running an on-access virus scanner on > the IMail > server, it should be set up not to scan the spool directory > or any user > directories. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail > mailservers. Declude Virus: Catches known viruses and is the > leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask about our free 30-day > evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > To Unsubscribe: > http://www.ipswitch.com/support/mailing-lists.html > List Archive: > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
