Re: [Declude.Virus] Where do they come from??

2004-02-03 Thread R. Scott Perry
Pardon my language... butDAM... Where are all these virus-infected emails coming from?? Are they coming from home computers, servers or what?? We went through a list of about 60,000 different IPs that were sending Mydoom, and got reverse DNS entries for them, to figure out who was sending

Re: [Declude.Virus] Virus report and log entry question

2004-02-03 Thread R. Scott Perry
Would it be possible to E-mail one of the quarantined D*.SMD files to our virustrap@ account? We can then analyze it and should be able to get a better idea of why this is happening. I sent sample d*.smd virus files and postmaster and log file txt to the virustrap account. It looks like

Re: [Declude.Virus] Virus report and log entry question

2004-02-03 Thread R. Scott Perry
I'm using Grisoft's AVG 7.0 professional, and I've been getting this a lot: 02/03/2004 08:44:02 Qb395000802285220 Error 6 in virus scanner 1. 02/03/2004 08:44:02 Qb395000802285220 Scanned: Error in virus scanner. [MIME: 2 800] I already emailed AVG, but haven't heard back. Anyone have any idea

Re: [Declude.Virus] Virus report and log entry question

2004-02-03 Thread Bill Landry
- Original Message - From: R. Scott Perry [EMAIL PROTECTED] Would it be possible to E-mail one of the quarantined D*.SMD files to our virustrap@ account? We can then analyze it and should be able to get a better idea of why this is happening. I sent sample d*.smd virus files

Re: [Declude.Virus] Virus report and log entry question

2004-02-03 Thread R. Scott Perry
I resent it last night from my yahoo account. Did you receive it at the virustrap address? No -- the only E-mail to arrive there was the one from GroupShield for Exchange. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail

Re: [Declude.Virus] Virus report and log entry question

2004-02-03 Thread Bill Landry
- Original Message - From: R. Scott Perry [EMAIL PROTECTED] I resent it last night from my yahoo account. Did you receive it at the virustrap address? No -- the only E-mail to arrive there was the one from GroupShield for Exchange. Please check the virustrap mailbox again,

Re: [Declude.Virus] Virus report and log entry question

2004-02-03 Thread R. Scott Perry
Please check the virustrap mailbox again, hopefully third attempt is a charm... It came through -- it looks like the one from last night probably did as well, but got caught here. Are you running 3 virus scanners with Declude Virus? The only thing that I can think of that could account for

[Declude.Virus] F-Prot and viruses

2004-02-03 Thread Daniel Ivey
I am using F-Prot with Declude Virus and have had something interesting happen today. I currently have Declude Virus set to delete emails with viruses. However, somehow a user was using webmail on my Imail server and sent a message that contained a virus to a user that has his account on our

Re: [Declude.Virus] F-Prot and viruses

2004-02-03 Thread R. Scott Perry
I am using F-Prot with Declude Virus and have had something interesting happen today. I currently have Declude Virus set to delete emails with viruses. However, somehow a user was using webmail on my Imail server and sent a message that contained a virus to a user that has his account on our

Re: [Declude.Virus] Virus report and log entry question

2004-02-03 Thread Bill Landry
- Original Message - From: R. Scott Perry [EMAIL PROTECTED] Please check the virustrap mailbox again, hopefully third attempt is a charm... It came through -- it looks like the one from last night probably did as well, but got caught here. Are you running 3 virus scanners with

Re: [Declude.Virus] Virus report and log entry question

2004-02-03 Thread R. Scott Perry
Are you running 3 virus scanners with Declude Virus? The only thing that I can think of that could account for this happening is if there are 3 or more virus scanners being used with Declude Virus. No, just two. We replaced McAfee with TrendMicro. Here are the actual virus scanner config

RE: [Declude.Virus] F-Prot and viruses

2004-02-03 Thread Daniel Ivey
Scott, Thanks for the information. Now that I take a closer look at the subject of the email in question, I don't see FW: in front, meaning that it might not have been forwarded. However, the body of the message in question is just a bunch of garbage, so I would think that it was sent