I do a weekly scan with of my Imail sever with F-protect and disturbingly enough it found two viruses in the main.mbx files of two of my users. F-protect 3.12a reported them as <mailto:klez.E@;mm>klez.E@mm and the attachment was called logon [2].pif. I copied the MBX file to a test user to see if I could find the attachment via web mail. There were no suspicious attachments but there was an e-mail titled "colspan". Once that was deleted, I re-ran the F-protect scan and it was clear. My questions are, if I'm running Declude and F-protect how did this file get though to my end user?The key here is to check the date/time of the E-mail, and then check the IMail and Declude log files to see what happened.
There are a few possibilities that come to mind:
o Scanning was turned off for that user/domain
o The E-mail arrived before Declude Virus was installed
o The E-mail arrived after Declude Virus was installed, but before the F-Prot virus definitions included the Klez virus
o Declude Virus was temporarily disabled
the log files should help narrow down what happened.
-Scott
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
