Twice today I have been sitting at local users machines for unrelated tasks, and in both cases I noticed notifications in their local email inboxes warning about inbound sobig messages. I didn't give it a lot of notice at the time, I knew we got a zillion of them already. The problem is that I have had "SKIPIFVIRUSNAMEHAS Sobig" in both recip.eml and sender.eml for a long time now, long enough that several other entries are in there now under the Sobig lines. Something's wacky, but I haven't had a spare moment to do any log investigation yet.
The first thing to do is make sure that there is only one space (or tab) anywhere on the line.
The second thing to do is make sure that there aren't any blank lines before that line (that the first blank line in the file is after the SKIPIF... lines and the To:/From:/Subject: lines).
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
