Thanks again Eric, that was a nice wakeup call showing me what I was doing wrong and why the need for a real email scanner. It does catch a lot of Viruses in the spool directory and most of what it catches seems to end up being quarantined.
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Eric Shanbrom [Ipswitch] Sent: Thursday, November 11, 2004 1:04 PM To: [EMAIL PROTECTED] Subject: Re: [IMail Forum] Empty Messages You are correct...If Trend detects what it thinks is a virus in an mbx file then whatever action you have set will happen to the whole mailbox since the messages are all in one file....I would exclude the IMail user's directory(ies) and the spool directory from any real time file scan. If you are using an AV scanner that is built to handle email I would also exclude its work directory from any RTFS as well Eric S ----- Original Message ----- From: "Ted Galerneau" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, November 11, 2004 3:52 PM Subject: RE: [IMail Forum] Empty Messages > Dang, that does help and now I get it. Doh! I guess that means that this > type of AV is definitely not good for an email scanner. If a person already > has email in the .mbx file and Trend Server Protect detects a virus in one > it will quarantine the whole file. Unless I tell it do nothing if it can't > clean it and just let it go through to the client. I guess that would be an > option, since everyone should have an AV anyway. Thanks for helping me > understand that better Eric. > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Eric Shanbrom > [Ipswitch] > Sent: Thursday, November 11, 2004 5:43 AM > To: [EMAIL PROTECTED] > Subject: Re: [IMail Forum] Empty Messages > > Ted, > > The danger in running the On Access Scanner on the spool directory is the > messages are still encoded. You are risking some viruses getting through and > false positives due to the encoding...The files that do get caught (most > likely the D*.SMD) will get quarantined and break messages (hence the blank > message delivery). In IMail a message is made up of 2 files, a "Q" and a "D" > file. The "Q" is the envelope and the "D" is the body. When the "D" file > gets quarantined and/or deleted the "Q" is still around. On the next queue > Run the Queue Manager sees the "Q" file and delivers a blank message. The > UID value is assigned as it's being delivered to the mailbox which gives you > a message that only contains this. > > Hope this helps > > Eric S > ----- Original Message ----- > From: "Ted Galerneau" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Thursday, November 11, 2004 8:19 AM > Subject: RE: [IMail Forum] Empty Messages > > > > Curious to see what you think Scott, if that is all we have for AV what > > would you suggest? > > > > Trend Server Protect generally wants to quarantine the whole file although > I > > to get a blank message here and there. I have ours doing the spool only in > > case it gets too busy and doesn't catch one until it gets into the mbx > > formant where I am fear it would quarantine that whole file with possibly > > multiple emails. > > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry > > Sent: Thursday, November 11, 2004 3:48 AM > > To: [EMAIL PROTECTED] > > Subject: Re: [IMail Forum] Empty Messages > > > > > > >Been getting a lot of messages that are completely empty with maybe a > > >single line in the header, but without any other info at all, it looks > > >very weird and we can not nail it down. Once client is complaining as > > >well that when she sends and email with HTML as the type that she is also > > >getting this result, but I cannot replicate that one either&. > > > > Are you running an on-access virus scanner on the mailserver? If so, it > > needs to be disabled or set not to scan the \IMail\spool directory. > > > > -Scott > > --- > > Declude JunkMail: The advanced anti-spam solution for IMail mailservers > > since 2000. > > Declude Virus: Ultra reliable virus detection and the leader in mailserver > > vulnerability detection. > > Find out what you've been missing: Ask for a free 30-day evaluation. > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > > > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
