I have noticed that this virus always has 'To: undisclosed-recipient:'
without the quotes. You could filter on that but you will catch some bulk
mail in addition to the virus and this bulk mail is not necessarily spam in
that your users may have left their email address at the sites which send
the bulk mail.
Hope this helps,
Barbara
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of airNwire
DEVELOPMENT TEAM
Sent: Wednesday, June 27, 2001 11:43 AM
To: [EMAIL PROTECTED]
Subject: Re: [IMail Forum] Virus coming through...any suggestions?
AS a Temporary measure, is there a RULE that I could add to IMail to stop
this virus from coming through?
Keith Broshears
----- Original Message -----
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, June 27, 2001 9:41 AM
Subject: Re: [IMail Forum] Virus coming through...any suggestions?
>
> >I am using Declude Virus (latest version) along with F-Prot (updated
> >nightly) and the W32.magister.24876@mm still is making it through our
> >defenses. What can I do to stop it?
>
> If you can get the raw E-mail (from a .mbx file), and send it to
> "[EMAIL PROTECTED]" (then send us an E-mail letting us know you sent
> it; we don't monitor that address), we can examine it further. In order
to
> find out why it wasn't caught (assuming that F-Prot knows of the virus,
> which it should), we need the raw E-mail (not a copy of it, or the
> attachment; we need the actual raw E-mail as it was received complete with
> the MIME headers and such). Then, we can run some tests here to make sure
> that it is decoded properly and if not, we can find out why not.
>
> -Scott
>
> Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for
> IMail. http://www.declude.com
>
>
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
