Ron, My guess would be that some of your users are using .pst files to store their mail they need archived. If so, then they must have gotten that virus prior to you implementing a good virus scanning policy. Our users still run into an occasional Marker infected attachment, along with a couple of other real early macro virii, because of this particular scenario.
James H (Jim) Blunt Network / Microsoft Exchange Admin. Network & Infrastructure Group Bechtel Hanford, Inc. 509-372-9188 -----Original Message----- From: Ron Grant [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 9:10 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Well, that worked. I sent it through, and it blocked the extension .com. I renamed it to no extension, and it said it couldn't be cleaned, and moved it to my quarantine folder. Wonder if my server hiccupped during that huge DL email? Well, I learned about using eicar today...so I can go home now. :) -----Original Message----- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 10:51 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Exactly!! -----Original Message----- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Monday, December 31, 2001 8:38 AM To: Exchange Discussions Subject: RE: SCanmail and MTA Try sending through a copy of eicar.com. Chris -- Chris Scharff Senior Sales Engineer MessageOne If you can't measure, you can't manage! > -----Original Message----- > From: Ron Grant [mailto:[EMAIL PROTECTED]] > Sent: Monday, December 31, 2001 10:38 AM > To: Exchange Discussions > Subject: RE: SCanmail and MTA > > > Ok, thanks. I'm confused as to how that Marker virus to go to our > users. > > -----Original Message----- > From: Chris Scharff [mailto:[EMAIL PROTECTED]] > Sent: Monday, December 31, 2001 10:31 AM > To: Exchange Discussions > Subject: RE: SCanmail and MTA > > If you are using 3.52 then you are using the AVAPI, this would cause > the message to be scanned as it is written to the store (in this case > it would be as it is going into the outbox), so it would be scanned > before being sent (so who the message is addressed to wouldn't > matter). > > Chris > -- > Chris Scharff > Senior Sales Engineer > MessageOne > If you can't measure, you can't manage! > > > > -----Original Message----- > > From: Ron Grant [mailto:[EMAIL PROTECTED]] > > Sent: Monday, December 31, 2001 10:29 AM > > To: Exchange Discussions > > Subject: RE: SCanmail and MTA > > > > > > Ya..I called the tech line, and it said they were closed until Jan > > 2nd! > > *shrug* > > I have the 3.52 version, and its being sent as #1 described. > > Would that internal email be scanned? > > > > -----Original Message----- > > From: Chris Scharff [mailto:[EMAIL PROTECTED]] > > Sent: Monday, December 31, 2001 9:57 AM > > To: Exchange Discussions > > Subject: RE: SCanmail and MTA > > > > Trend is /closed/ for the holidays?! What version of ScanMail are > > you running and how is the message being sent?[1] > > > > [1] Via Outlook with the Exchange service? > > > > Chris > > -- > > Chris Scharff > > Senior Sales Engineer > > MessageOne > > If you can't measure, you can't manage! > > > > > > > -----Original Message----- > > > From: Ron Grant [mailto:[EMAIL PROTECTED]] > > > Sent: Monday, December 31, 2001 9:53 AM > > > To: Exchange Discussions > > > Subject: SCanmail and MTA > > > > > > > > > Quick question for you all, as Trend is closed for the holidays. > > > Scan mail scans all emails coming from the IMC. What if a user > > > inside the company sends a virus (marker-gen in this > case) to a DL. > > > Will/should scan mail pick up that virus when its used by the IS > > > or MTA? Or will this only be detected by the client AV solution? > > > Thanks! Ron > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
