Re: [Declude.JunkMail] Virus and Spam checking order
> Declude Virus will run before Declude JunkMail -- except if you use an > "AVAFTERJM" option in your virus.cfg file. I've checked our config file and we're not using the option. > If you check the time/date of the E-mail that was held, you'll probably see > that it was held before the virus definitions were updated to be able to > catch that variant of Bugbear. The odd thing is that the extension was Resume.doc.pif. We have pif as one of our BANEXT options, so really Declude Virus should have picked up the .pif and automatically quarantined it. Whether or not it was updated to detect any new variant of Bugbear (is there a new variant out there now?), it should have moved the email to our virus folder. James Alan Young Assistant Network Administrator D.Armstrong Moving & Storage Ltd. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Virus and Spam checking order
We've recently been having a lot of Bugbear virus emails hitting our virus scanner. We've done a lot of scanning for the virus on our workstations and servers and so far we're clean (except for the ones that Declude pick up). This morning, while going through the email holds, I noticed an email with an attachment that was 99K... the typical size of infected Bugbear virus emails. So luckily we didn't send it through... According to the docs (and my boss), the virus scanner should be picking up any messages before it gets detected as spam. However, this time it looks like it didn't happen. Is there any known reason for this? Or are the docs wrong? Does a message get detected as spam first and then is checked for virii? Has anyone else had this happen to them before? Any assistance is appreciated. James Alan Young Assistant Network Administrator D. Armstrong Moving & Storage --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
