RE: SCanmail and MTA
Ron, My guess would be that some of your users are using .pst files to store their mail they need archived. If so, then they must have gotten that virus prior to you implementing a good virus scanning policy. Our users still run into an occasional Marker infected attachment, along with a couple of other real early macro virii, because of this particular scenario. James H (Jim) Blunt Network / Microsoft Exchange Admin. Network Infrastructure Group Bechtel Hanford, Inc. 509-372-9188 -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 9:10 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Well, that worked. I sent it through, and it blocked the extension .com. I renamed it to no extension, and it said it couldn't be cleaned, and moved it to my quarantine folder. Wonder if my server hiccupped during that huge DL email? Well, I learned about using eicar today...so I can go home now. :) -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:51 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Exactly!! -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 8:38 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Try sending through a copy of eicar.com. Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:38 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Ok, thanks. I'm confused as to how that Marker virus to go to our users. -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:31 AM To: Exchange Discussions Subject: RE: SCanmail and MTA If you are using 3.52 then you are using the AVAPI, this would cause the message to be scanned as it is written to the store (in this case it would be as it is going into the outbox), so it would be scanned before being sent (so who the message is addressed to wouldn't matter). Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:29 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Ya..I called the tech line, and it said they were closed until Jan 2nd! *shrug* I have the 3.52 version, and its being sent as #1 described. Would that internal email be scanned? -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 9:57 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Trend is /closed/ for the holidays?! What version of ScanMail are you running and how is the message being sent?[1] [1] Via Outlook with the Exchange service? Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 9:53 AM To: Exchange Discussions Subject: SCanmail and MTA Quick question for you all, as Trend is closed for the holidays. Scan mail scans all emails coming from the IMC. What if a user inside the company sends a virus (marker-gen in this case) to a DL. Will/should scan mail pick up that virus when its used by the IS or MTA? Or will this only be detected by the client AV solution? Thanks! Ron _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm
RE: SCanmail and MTA
Trend is /closed/ for the holidays?! What version of ScanMail are you running and how is the message being sent?[1] [1] Via Outlook with the Exchange service? Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 9:53 AM To: Exchange Discussions Subject: SCanmail and MTA Quick question for you all, as Trend is closed for the holidays. Scan mail scans all emails coming from the IMC. What if a user inside the company sends a virus (marker-gen in this case) to a DL. Will/should scan mail pick up that virus when its used by the IS or MTA? Or will this only be detected by the client AV solution? Thanks! Ron _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: SCanmail and MTA
Ya..I called the tech line, and it said they were closed until Jan 2nd! *shrug* I have the 3.52 version, and its being sent as #1 described. Would that internal email be scanned? -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 9:57 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Trend is /closed/ for the holidays?! What version of ScanMail are you running and how is the message being sent?[1] [1] Via Outlook with the Exchange service? Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 9:53 AM To: Exchange Discussions Subject: SCanmail and MTA Quick question for you all, as Trend is closed for the holidays. Scan mail scans all emails coming from the IMC. What if a user inside the company sends a virus (marker-gen in this case) to a DL. Will/should scan mail pick up that virus when its used by the IS or MTA? Or will this only be detected by the client AV solution? Thanks! Ron _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: SCanmail and MTA
If you are using 3.52 then you are using the AVAPI, this would cause the message to be scanned as it is written to the store (in this case it would be as it is going into the outbox), so it would be scanned before being sent (so who the message is addressed to wouldn't matter). Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:29 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Ya..I called the tech line, and it said they were closed until Jan 2nd! *shrug* I have the 3.52 version, and its being sent as #1 described. Would that internal email be scanned? -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 9:57 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Trend is /closed/ for the holidays?! What version of ScanMail are you running and how is the message being sent?[1] [1] Via Outlook with the Exchange service? Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 9:53 AM To: Exchange Discussions Subject: SCanmail and MTA Quick question for you all, as Trend is closed for the holidays. Scan mail scans all emails coming from the IMC. What if a user inside the company sends a virus (marker-gen in this case) to a DL. Will/should scan mail pick up that virus when its used by the IS or MTA? Or will this only be detected by the client AV solution? Thanks! Ron _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: SCanmail and MTA
Ok, thanks. I'm confused as to how that Marker virus to go to our users. -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:31 AM To: Exchange Discussions Subject: RE: SCanmail and MTA If you are using 3.52 then you are using the AVAPI, this would cause the message to be scanned as it is written to the store (in this case it would be as it is going into the outbox), so it would be scanned before being sent (so who the message is addressed to wouldn't matter). Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:29 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Ya..I called the tech line, and it said they were closed until Jan 2nd! *shrug* I have the 3.52 version, and its being sent as #1 described. Would that internal email be scanned? -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 9:57 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Trend is /closed/ for the holidays?! What version of ScanMail are you running and how is the message being sent?[1] [1] Via Outlook with the Exchange service? Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 9:53 AM To: Exchange Discussions Subject: SCanmail and MTA Quick question for you all, as Trend is closed for the holidays. Scan mail scans all emails coming from the IMC. What if a user inside the company sends a virus (marker-gen in this case) to a DL. Will/should scan mail pick up that virus when its used by the IS or MTA? Or will this only be detected by the client AV solution? Thanks! Ron _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: SCanmail and MTA
Have you checked to make sure the software is functioning properly? Try sending through a copy of eicar.com. Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:38 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Ok, thanks. I'm confused as to how that Marker virus to go to our users. -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:31 AM To: Exchange Discussions Subject: RE: SCanmail and MTA If you are using 3.52 then you are using the AVAPI, this would cause the message to be scanned as it is written to the store (in this case it would be as it is going into the outbox), so it would be scanned before being sent (so who the message is addressed to wouldn't matter). Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:29 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Ya..I called the tech line, and it said they were closed until Jan 2nd! *shrug* I have the 3.52 version, and its being sent as #1 described. Would that internal email be scanned? -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 9:57 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Trend is /closed/ for the holidays?! What version of ScanMail are you running and how is the message being sent?[1] [1] Via Outlook with the Exchange service? Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 9:53 AM To: Exchange Discussions Subject: SCanmail and MTA Quick question for you all, as Trend is closed for the holidays. Scan mail scans all emails coming from the IMC. What if a user inside the company sends a virus (marker-gen in this case) to a DL. Will/should scan mail pick up that virus when its used by the IS or MTA? Or will this only be detected by the client AV solution? Thanks! Ron _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: SCanmail and MTA
Exactly!! -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 8:38 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Try sending through a copy of eicar.com. Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:38 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Ok, thanks. I'm confused as to how that Marker virus to go to our users. -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:31 AM To: Exchange Discussions Subject: RE: SCanmail and MTA If you are using 3.52 then you are using the AVAPI, this would cause the message to be scanned as it is written to the store (in this case it would be as it is going into the outbox), so it would be scanned before being sent (so who the message is addressed to wouldn't matter). Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:29 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Ya..I called the tech line, and it said they were closed until Jan 2nd! *shrug* I have the 3.52 version, and its being sent as #1 described. Would that internal email be scanned? -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 9:57 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Trend is /closed/ for the holidays?! What version of ScanMail are you running and how is the message being sent?[1] [1] Via Outlook with the Exchange service? Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 9:53 AM To: Exchange Discussions Subject: SCanmail and MTA Quick question for you all, as Trend is closed for the holidays. Scan mail scans all emails coming from the IMC. What if a user inside the company sends a virus (marker-gen in this case) to a DL. Will/should scan mail pick up that virus when its used by the IS or MTA? Or will this only be detected by the client AV solution? Thanks! Ron _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: SCanmail and MTA
Well, that worked. I sent it through, and it blocked the extension .com. I renamed it to no extension, and it said it couldn't be cleaned, and moved it to my quarantine folder. Wonder if my server hiccupped during that huge DL email? Well, I learned about using eicar today...so I can go home now. :) -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:51 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Exactly!! -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 8:38 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Try sending through a copy of eicar.com. Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:38 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Ok, thanks. I'm confused as to how that Marker virus to go to our users. -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:31 AM To: Exchange Discussions Subject: RE: SCanmail and MTA If you are using 3.52 then you are using the AVAPI, this would cause the message to be scanned as it is written to the store (in this case it would be as it is going into the outbox), so it would be scanned before being sent (so who the message is addressed to wouldn't matter). Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:29 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Ya..I called the tech line, and it said they were closed until Jan 2nd! *shrug* I have the 3.52 version, and its being sent as #1 described. Would that internal email be scanned? -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 9:57 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Trend is /closed/ for the holidays?! What version of ScanMail are you running and how is the message being sent?[1] [1] Via Outlook with the Exchange service? Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 9:53 AM To: Exchange Discussions Subject: SCanmail and MTA Quick question for you all, as Trend is closed for the holidays. Scan mail scans all emails coming from the IMC. What if a user inside the company sends a virus (marker-gen in this case) to a DL. Will/should scan mail pick up that virus when its used by the IS or MTA? Or will this only be detected by the client AV solution? Thanks! Ron _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: SCanmail and MTA
Does 3.52 have the option to disable the avapi? I could see the mapi scanning alone failing under DL load. -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 11:10 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Well, that worked. I sent it through, and it blocked the extension .com. I renamed it to no extension, and it said it couldn't be cleaned, and moved it to my quarantine folder. Wonder if my server hiccupped during that huge DL email? Well, I learned about using eicar today...so I can go home now. :) -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:51 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Exactly!! -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 8:38 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Try sending through a copy of eicar.com. Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:38 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Ok, thanks. I'm confused as to how that Marker virus to go to our users. -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:31 AM To: Exchange Discussions Subject: RE: SCanmail and MTA If you are using 3.52 then you are using the AVAPI, this would cause the message to be scanned as it is written to the store (in this case it would be as it is going into the outbox), so it would be scanned before being sent (so who the message is addressed to wouldn't matter). Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:29 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Ya..I called the tech line, and it said they were closed until Jan 2nd! *shrug* I have the 3.52 version, and its being sent as #1 described. Would that internal email be scanned? -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 9:57 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Trend is /closed/ for the holidays?! What version of ScanMail are you running and how is the message being sent?[1] [1] Via Outlook with the Exchange service? Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 9:53 AM To: Exchange Discussions Subject: SCanmail and MTA Quick question for you all, as Trend is closed for the holidays. Scan mail scans all emails coming from the IMC. What if a user inside the company sends a virus (marker-gen in this case) to a DL. Will/should scan mail pick up that virus when its used by the IS or MTA? Or will this only be detected by the client AV solution? Thanks! Ron _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: SCanmail and MTA
Yes, it does. I just unchecked it. The DL was our Global DL, that has all 600 employees in it. Probably gave scanmail a sucker punch. :) -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 11:12 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Does 3.52 have the option to disable the avapi? I could see the mapi scanning alone failing under DL load. -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 11:10 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Well, that worked. I sent it through, and it blocked the extension .com. I renamed it to no extension, and it said it couldn't be cleaned, and moved it to my quarantine folder. Wonder if my server hiccupped during that huge DL email? Well, I learned about using eicar today...so I can go home now. :) -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:51 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Exactly!! -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 8:38 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Try sending through a copy of eicar.com. Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:38 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Ok, thanks. I'm confused as to how that Marker virus to go to our users. -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:31 AM To: Exchange Discussions Subject: RE: SCanmail and MTA If you are using 3.52 then you are using the AVAPI, this would cause the message to be scanned as it is written to the store (in this case it would be as it is going into the outbox), so it would be scanned before being sent (so who the message is addressed to wouldn't matter). Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:29 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Ya..I called the tech line, and it said they were closed until Jan 2nd! *shrug* I have the 3.52 version, and its being sent as #1 described. Would that internal email be scanned? -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 9:57 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Trend is /closed/ for the holidays?! What version of ScanMail are you running and how is the message being sent?[1] [1] Via Outlook with the Exchange service? Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 9:53 AM To: Exchange Discussions Subject: SCanmail and MTA Quick question for you all, as Trend is closed for the holidays. Scan mail scans all emails coming from the IMC. What if a user inside the company sends a virus (marker-gen in this case) to a DL. Will/should scan mail pick up that virus when its used by the IS or MTA? Or will this only be detected by the client AV solution? Thanks! Ron _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: SCanmail and MTA
Don't turn off AVAPI, or you will really be screwed the next time that happens. PERSONALLY, I would use AVAPI, MAPI, and Message Body Scanning, along with Ext blocking. -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 9:19 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Yes, it does. I just unchecked it. The DL was our Global DL, that has all 600 employees in it. Probably gave scanmail a sucker punch. :) -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 11:12 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Does 3.52 have the option to disable the avapi? I could see the mapi scanning alone failing under DL load. -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 11:10 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Well, that worked. I sent it through, and it blocked the extension .com. I renamed it to no extension, and it said it couldn't be cleaned, and moved it to my quarantine folder. Wonder if my server hiccupped during that huge DL email? Well, I learned about using eicar today...so I can go home now. :) -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:51 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Exactly!! -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 8:38 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Try sending through a copy of eicar.com. Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:38 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Ok, thanks. I'm confused as to how that Marker virus to go to our users. -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:31 AM To: Exchange Discussions Subject: RE: SCanmail and MTA If you are using 3.52 then you are using the AVAPI, this would cause the message to be scanned as it is written to the store (in this case it would be as it is going into the outbox), so it would be scanned before being sent (so who the message is addressed to wouldn't matter). Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:29 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Ya..I called the tech line, and it said they were closed until Jan 2nd! *shrug* I have the 3.52 version, and its being sent as #1 described. Would that internal email be scanned? -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 9:57 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Trend is /closed/ for the holidays?! What version of ScanMail are you running and how is the message being sent?[1] [1] Via Outlook with the Exchange service? Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! -Original Message- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 9:53 AM To: Exchange Discussions Subject: SCanmail and MTA Quick question for you all, as Trend is closed for the holidays. Scan mail scans all emails coming from the IMC. What if a user inside the company sends a virus (marker-gen in this case) to a DL. Will/should scan mail pick up that virus when its used by the IS or MTA? Or will this only be detected by the client AV solution? Thanks! Ron _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
