What version of Declude?
What version/scan engine rev/signature rev of Netshield?
Do you know the source and message format of the incoming message?
Jerry
- Original Message -
From: "Sharyn Schmidt" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, September 12, 2001 10:49 AM
Subject: [Declude.Virus] AnnaKournikova
> Hi Everyone,
>
> Earlier this week we were infected with the Anna virus. I am running
> Declude and McAfee Netshield on my mail server. After looking at the
> logs, it appears that Declude did not recognize this as a virus and let
> it on through, both in the original email from the outside, and each
> time it replicated and sent itself out to others on my network. For
> some reason (Murphy's Law perhaps), the desktop VirusScan software on
> this particular user's machine didn't catch it either.
>
> Fortunately, the desktop VirusScan software on everyone else's machines
> did catch it and no other machine was infected except the original one.
>
> I am, however, at a loss as to why Declude missed it. The only thing I
> can think of is that the attachment was .jpg.vbs and the software quit
> after seeing the .jpg extension. As an aside, my firewall missed it too.
> Any input would be appreciated. Both the Netshield on the mail server
> and the all the desktop VirusScan Software are running the same latest
> and greatest DAT file.
>
> Thanks in advance for your help! I am VERY satisfied with Declude but,
> of course, like any network administrator, I want perfection :)
>
> Sharyn Schmidt
> Network Specialist
> Florida Distillers Company
> (863) 956-1116 x139
>
>
> We are the worldwide producer and marketer of the award winning Cruzan
> Single Barrel Rum, judged "Best in the World" at the annual
> San Francisco Wine and Spirits Championships, and the
> artisan tequilas of Porfidio 100% Agave Tequilas, judged "Best
> Tequila" four years running by the Wine Enthusiast magazine. For
> more information, please click (go to) http://www.cruzanrums.com";>http://http://www.cruzanrums";>www.cruzanrums.com
> This E-mail came from the Declude.Virus mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.Virus". You can E-mail
> [EMAIL PROTECTED] for assistance. You can visit our web
> site at http://www.declude.com .
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
