Oops, may to say do NOT get held.
Bill
- Original Message -
From: Bill Landry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, March 16, 2004 10:42 PM
Subject: [Declude.Virus] Question about virus log entries
Scott, I am see a bunch on the following type entries in my virus
Scott, I am see a bunch on the following type entries in my virus logs:
Found potentially dangerous stuff in
M:\IMail\spool\Dc62d3de40042810d.vir\0.!
I see that these messages do get held, but rather get delivered. However,
Declude is holding viruses. Is this something I should be concerned
We always thought that it depended on whether Real-Time protector and/or
Scheduler was updated. Guess some more experimentation is called for,
although we're scanning on an NT4 server.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Panda Consulting S.A.
Thanks. The mail server is W2K server.
Appreciate the input.
Doug
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Panda Consulting S.A.
Luis Alberto Arango
Sent: Tuesday, March 16, 2004 11:03 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus]
I am running it locally on W2K Pro without rebooting and did get some error
recently but was with the On demand Scanner which is not used. But it
clearly stated reboot required.
I will test on W2K Server and will soon know. The real issue is if it saus
reboot do I need to.
-Original
I asked f-prot support about this and all they've told me so far is:
This option was added to counteract the flow of worms inside password
protected zip archives.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Fritz Squib
Sent: Tuesday, March 16, 2004
They could easily look for any email with a encrypted zip
attachment, and the word password followed on the same line by a CID sourced
image in the body and very safely assume it is the virus. It should have a
negligible false positive rate, how likely is this to be a standard
practice?
