This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Virus

Hi there,

I've running v7.005 and have done some tesing with - for me - an interesting result:

I've sent a test mail with the EICAR-Virus to test the virus block, but the mail has been blocked by the extension filter. Acutally not a problem, but I thought what happens if I release that mail as there was no reference that there is a virus => as the mail was released is was in my inbox.

Why has the virus not been detected?

rgds

This thread was automatically locked due to age.

0 Simon Shaw over 18 years ago

I've emailed myself Eicar and it gets stopped as virus.
Cancel
Vote Up 0 Vote Down

Cancel
0 Microsaft over 18 years ago in reply to Simon Shaw

Do you have also an extension filter?

I block a lot of extensions (com, exe & co).
In my case the file was blocked by that filer.

M$
Cancel
Vote Up 0 Vote Down

Cancel
0 Simon Shaw over 18 years ago in reply to Microsaft

Hrm.. interesting, tested the other day and it blackholed the eicar file.
I dont think the extension filter got it.

I renamed eicar.com to eicar.sm and emailed it... It went out throught the filter, and came back through the filter untouched.

However, I am getting reports that the SMTP proxy is scanning for viruses as I have two reported hits.
1 Possibly a new variant of W32/Document-disguised-based!Maximus 1 424.0 kB
2 W32/Kapser.A@mm (exact) 1 181.0 kB

Confused. will do some more testing.
Cancel
Vote Up 0 Vote Down

Cancel
0 Simon Shaw over 18 years ago in reply to Microsaft

eicar.com inside a zip file is picked up.
Cancel
Vote Up 0 Vote Down

Cancel
0 Microsaft over 18 years ago in reply to Simon Shaw

Eicar itself is detected, tested inside a RAR-file (as ZIP is also blocked).

But if I send the file as it is (COM) it's beeing blocked by the extension filter. (And there's no hint that a virus is found)

rgds
Cancel
Vote Up 0 Vote Down

Cancel
0 Simon Shaw over 18 years ago in reply to Microsaft

Probably the extension filter kix in first so it never reaches the virus scanner?
Cancel
Vote Up 0 Vote Down

Cancel
0 Microsaft over 18 years ago in reply to Simon Shaw

Look's like - I'll pass this on to Astaro..

Thanks Simon

rgds
Cancel
Vote Up 0 Vote Down

Cancel