This sure does sound familiar... Sounds like its a difference in the
mail attachment info being in the header v/s the body...
Currently the routing rules have some issues with these types of
messages because the body does not contain the attachment information,
only the encoded data..
I am not familiar with the nuts and bolts of Sonias scanner. Is it
checking the entire message, or just the body of the message as
the routing rules do. Not sure what the routercgi is passing?
Also note on the routing rules(not Sonias scanner):
Tod is currently working on correcting this with
new rules for header/body combinations..
Danny
On 11/Oct/2002 08:30:51, A Werntz wrote:
> Danny,
>
> A person with a hotmail account, manually forwarded a klez infected email to
> a Sambar account. It was not detected. It was detected when trying to
> forward it to Sonia.
>
> Alan
>
> ----- Original Message -----
> From: <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Thursday, October 10, 2002 5:31 PM
> Subject: [sambar] Virus got through {02}
>
>
> > Alan,
> > Are you saying that the end result was the virus landed on a sambar server
> or that a virus was forwarded through a sambar server to another.. If the
> later then I don't think the virus scanner would catch it just as routing
> rules would not.. I believe they are only based on when the router has
> control of the email and is delivering to an internal mailbox.. I believe
> the exception to this rule in forwarding is setting up a real mailbox
> forwarder... Let me know if I am way off here.
> >
> > Danny
> >
> > On 10/Oct/2002 14:27:07, A Werntz wrote:
> > > Sonia,
> > First, I just want to say THANK YOU!!!
> > I will be sleeping better at night because of your integrated virus
> checker.
> > But, I have a problem.
> > An email was just forwarded to this server with the W32 Klez H virus. This
> email was forwarded from a third user. And the virus was forwarded to the
> recipient undetected.
> > The EICAR Test String was detected.
> > Please help!!!
> > TIA,
> > Alan
> > P.S. I tried to submit this in the form on your web page. But I kept
> getting a bad character message.
> > Protection By The Ya-Right Network Virus Protection Team.
> > Last Updated: Mon, Oct 07 10:06:01 PM EST 2002 -500 (GMT)
> > Scanning for, 107,611 viruses, trojans and many variants.
> > -------------------------------------------------------
> > To unsubscribe please go to <A TARGET="_blank"
> HREF="http://www.sambar.ch/list/";>http://www.sambar.ch/list/</A>
> > -------------------------------------------------------
> > To unsubscribe please go to <A TARGET="_blank"
>HREF="http://www.sambar.ch/list/";>http://www.sambar.ch/list/</a>
> >
> >
> >
> -------------------------------------------------------
> To unsubscribe please go to <A TARGET="_blank"
>HREF="http://www.sambar.ch/list/";>http://www.sambar.ch/list/</a>
>
>
>
-------------------------------------------------------
To unsubscribe please go to http://www.sambar.ch/list/
