Then I did some checking and it turned out, that McAfee did catch all Sobig, but because the action rule in McAfee was not to DELETE the infected emails but CLEAN them, McAfee deleted the content of the file attachment, made the size of the file zero, and let the remaining of the message through.
FYI, it is STRONGLY recommended that mailserver AV programs do NOT deliver E-mails that have/had viruses. This can spread confidential information! For example, some viruses pick a file from the hard drive to send along with the attachment.
I have McAfee webshield to scan for viruses only in INCOMING mail, so all messages that are forwaded to Imail spam filter will end up either deleted or delivered to one of our employees.
Our outgoing mail is not scanned for viruses on the server level, so I don't think there is a security risk here, am I right?
Since I changed the rules in Mcafee to delete(quarantine) all infected files, the messages still come through but without attachment, because the DELETE option in McAfee will delete only the attachment but not the whole message.
That's very odd. You should check the settings in McAfee. Unless you're running a really old version, it should be able to block them.
4.51R1 is the latest version, but it was not upgraded by mcAfee for a while now, we just renewed our licenses with them and the same version came on CD.
But I am going to call their support to find out about this specific issue.
> For the sake of people who hasn't looked at IPswitch's support pages recently, here is the link to a solution for filtering out Sobig virus
> infected emails and the similar return messages with Imail Spam Filter: http://support.ipswitch.com/kb/IM-20030820-DF01.htm
FYI, beware that that URL says "THESE STEPS WILL BLOCK ALL SCR AND PIF FILE ATTACHMENTS" -- but that is *NOT* the case. It will block many, but not all (depending on both the encoding method used and the formatting of the headers).
You're right, I forgot to mention that there is another support link on IPswitch, that covers this subject near the bottom of the page, that I did use when I set things up:
http://support.ipswitch.com/kb/IM-19980116-DD08.htm
Geza
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
