RE: virus scan
I've had this with Groupshield, it's a feature. You need to configure the on demand scan to not block the attachment '_??' Also, you'll need hotfix 7 and need to configure the options regarding macros - don't select 'enable macro heuristics' and 'find all macros'. I can't remember the article off the top of my head but it was in the NAI knowledgebase Hopefully that should resolve the problem -Original Message- From: aci [mailto:[EMAIL PROTECTED]] Sent: 18 January 2002 03:17 To: MS-Exchange Admin Issues Subject: virus scan I was told that this was not a virus and that it was a problem with the detection message where no detection name is given, is an error message that is given by the engine and misinterpreted by the GUI product, not a detection by the DAT files. The files are now in quarantine, so can i send out the file or is it infected with a virus? I am running groupshield exchange. This is the message we received in the event viewer: The file testing.doc is infected with '_'. Detected with scan engine 4.1.60 DAT version 4.1.4181 from user Exchange running groupshield 4.5.572.182 OAS List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm This message is intended only for the use of the individual or entity to which it is addressed and may contain information that is private and confidential. If you are not the intended recipient, employee or agent responsible for delivering the message to the intended recipient you are hereby notified that any dissemination, distribution or copying of this communication and its attachments are strictly prohibited. If this communication and its attachments contain any commercial, technical or capability related information you should be aware that this may reflect the genuine opinion of the sender but does not in any way, constitute an offer or representation made by or on behalf of Quintek Systems Ltd. Quintek Systems Limited Registered in England No: 1845626 Vat Reg. No: 442412386 List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: virus scan
You also need 5 Golden Rings 4 Calling Birds 3 French Hens (you can substitute whole fryers from your market) 2 Turtle Doves And a Partridge in a Pear Tree (SP2) -Original Message- From: Neil Ferguson [mailto:[EMAIL PROTECTED]] Sent: Friday, January 18, 2002 2:33 AM To: MS-Exchange Admin Issues Subject: RE: virus scan I've had this with Groupshield, it's a feature. You need to configure the on demand scan to not block the attachment '_??' Also, you'll need hotfix 7 and need to configure the options regarding macros - don't select 'enable macro heuristics' and 'find all macros'. I can't remember the article off the top of my head but it was in the NAI knowledgebase Hopefully that should resolve the problem -Original Message- From: aci [mailto:[EMAIL PROTECTED]] Sent: 18 January 2002 03:17 To: MS-Exchange Admin Issues Subject: virus scan I was told that this was not a virus and that it was a problem with the detection message where no detection name is given, is an error message that is given by the engine and misinterpreted by the GUI product, not a detection by the DAT files. The files are now in quarantine, so can i send out the file or is it infected with a virus? I am running groupshield exchange. This is the message we received in the event viewer: The file testing.doc is infected with '_'. Detected with scan engine 4.1.60 DAT version 4.1.4181 from user Exchange running groupshield 4.5.572.182 OAS List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm This message is intended only for the use of the individual or entity to which it is addressed and may contain information that is private and confidential. If you are not the intended recipient, employee or agent responsible for delivering the message to the intended recipient you are hereby notified that any dissemination, distribution or copying of this communication and its attachments are strictly prohibited. If this communication and its attachments contain any commercial, technical or capability related information you should be aware that this may reflect the genuine opinion of the sender but does not in any way, constitute an offer or representation made by or on behalf of Quintek Systems Ltd. Quintek Systems Limited Registered in England No: 1845626 Vat Reg. No: 442412386 List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: virus scan
Another reason this message shows up is if you have the checkmark made for Find all macros and the word document has a macro in it. -Original Message- From: Neil Ferguson [mailto:[EMAIL PROTECTED]] Sent: Friday, January 18, 2002 4:33 AM To: MS-Exchange Admin Issues Subject: RE: virus scan I've had this with Groupshield, it's a feature. You need to configure the on demand scan to not block the attachment '_??' Also, you'll need hotfix 7 and need to configure the options regarding macros - don't select 'enable macro heuristics' and 'find all macros'. I can't remember the article off the top of my head but it was in the NAI knowledgebase Hopefully that should resolve the problem -Original Message- From: aci [mailto:[EMAIL PROTECTED]] Sent: 18 January 2002 03:17 To: MS-Exchange Admin Issues Subject: virus scan I was told that this was not a virus and that it was a problem with the detection message where no detection name is given, is an error message that is given by the engine and misinterpreted by the GUI product, not a detection by the DAT files. The files are now in quarantine, so can i send out the file or is it infected with a virus? I am running groupshield exchange. This is the message we received in the event viewer: The file testing.doc is infected with '_'. Detected with scan engine 4.1.60 DAT version 4.1.4181 from user Exchange running groupshield 4.5.572.182 OAS List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm This message is intended only for the use of the individual or entity to which it is addressed and may contain information that is private and confidential. If you are not the intended recipient, employee or agent responsible for delivering the message to the intended recipient you are hereby notified that any dissemination, distribution or copying of this communication and its attachments are strictly prohibited. If this communication and its attachments contain any commercial, technical or capability related information you should be aware that this may reflect the genuine opinion of the sender but does not in any way, constitute an offer or representation made by or on behalf of Quintek Systems Ltd. Quintek Systems Limited Registered in England No: 1845626 Vat Reg. No: 442412386 List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: virus scan
Thanks for the great info, but i'm still having a problem with doc files. I did ask you stated and made sure that 'enable macro heuristics' and 'find all macros' were unchecked, I did not have on demand scan to scan '_??' but it was scanning '??_'. Is the later one the one you were speaking of? TIA for any input you would have. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: virus scan
Try scanning the file with another Antivirus product. I would suggest connecting to the trendmicro site (www.antivirus.com) and using their housecall? product for a quick check if you don't have access to another vendor's antivirus product. cheers Wayne Hanks Systems Administrator Paterson Ord Minnett Ph 08 9263 1114 fax 08 9325 1086 Don't Panic -Douglas Adams The Hitchhikers Guide to the Galaxy -Original Message- From: aci [mailto:[EMAIL PROTECTED]] Sent: Friday, 18 January 2002 11:17 To: MS-Exchange Admin Issues Subject: virus scan I was told that this was not a virus and that it was a problem with the detection message where no detection name is given, is an error message that is given by the engine and misinterpreted by the GUI product, not a detection by the DAT files. The files are now in quarantine, so can i send out the file or is it infected with a virus? I am running groupshield exchange. This is the message we received in the event viewer: The file testing.doc is infected with '_'. Detected with scan engine 4.1.60 DAT version 4.1.4181 from user Exchange running groupshield 4.5.572.182 OAS List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: virus scan
Personally, if it says it a virus, I don't take a chance. I also do quarantine. If its important, the sender can fix the file and resend it. In any case, I would delete this file and get a fresh copy. -Original Message- From: aci [mailto:[EMAIL PROTECTED]] Sent: Thursday, January 17, 2002 7:17 PM To: MS-Exchange Admin Issues Subject: virus scan I was told that this was not a virus and that it was a problem with the detection message where no detection name is given, is an error message that is given by the engine and misinterpreted by the GUI product, not a detection by the DAT files. The files are now in quarantine, so can i send out the file or is it infected with a virus? I am running groupshield exchange. This is the message we received in the event viewer: The file testing.doc is infected with '_'. Detected with scan engine 4.1.60 DAT version 4.1.4181 from user Exchange running groupshield 4.5.572.182 OAS List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: virus scan
Excellent tool. -Original Message- From: Wayne Hanks [mailto:[EMAIL PROTECTED]] Sent: Thursday, January 17, 2002 7:23 PM To: MS-Exchange Admin Issues Subject: RE: virus scan Try scanning the file with another Antivirus product. I would suggest connecting to the trendmicro site (www.antivirus.com) and using their housecall? product for a quick check if you don't have access to another vendor's antivirus product. cheers Wayne Hanks Systems Administrator Paterson Ord Minnett Ph 08 9263 1114 fax 08 9325 1086 Don't Panic -Douglas Adams The Hitchhikers Guide to the Galaxy -Original Message- From: aci [mailto:[EMAIL PROTECTED]] Sent: Friday, 18 January 2002 11:17 To: MS-Exchange Admin Issues Subject: virus scan I was told that this was not a virus and that it was a problem with the detection message where no detection name is given, is an error message that is given by the engine and misinterpreted by the GUI product, not a detection by the DAT files. The files are now in quarantine, so can i send out the file or is it infected with a virus? I am running groupshield exchange. This is the message we received in the event viewer: The file testing.doc is infected with '_'. Detected with scan engine 4.1.60 DAT version 4.1.4181 from user Exchange running groupshield 4.5.572.182 OAS List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: virus scan
Oops, DO NOT quarantine -Original Message- From: Martin Blackstone Sent: Thursday, January 17, 2002 7:26 PM To: MS-Exchange Admin Issues Subject: RE: virus scan Personally, if it says it a virus, I don't take a chance. I also do quarantine. If its important, the sender can fix the file and resend it. In any case, I would delete this file and get a fresh copy. -Original Message- From: aci [mailto:[EMAIL PROTECTED]] Sent: Thursday, January 17, 2002 7:17 PM To: MS-Exchange Admin Issues Subject: virus scan I was told that this was not a virus and that it was a problem with the detection message where no detection name is given, is an error message that is given by the engine and misinterpreted by the GUI product, not a detection by the DAT files. The files are now in quarantine, so can i send out the file or is it infected with a virus? I am running groupshield exchange. This is the message we received in the event viewer: The file testing.doc is infected with '_'. Detected with scan engine 4.1.60 DAT version 4.1.4181 from user Exchange running groupshield 4.5.572.182 OAS List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
