sending a virus from mailscanner's domain is undetected butincoming mail from either our domain or others is detected

[Julian Field]

At 20:02 21/06/2002, you wrote:
>I had a similar situation where emails were not being scanned by
>MailScanner when sent through my RAQ but incomming messages where scanned
>OK if sent to my RAQ by someone else.
>
>This was due to the email message being hijacked by the ISP I was
>connecting to and putting the message through their own mail server and
>not mine even though in the properties I had stated the address of my mail
>server.
>I do not know whether this is of any help or am I toytally off track

Ray has a very good point.
What are all the Received: headers on the message that is not being scanned?
And what is the name of your MailScanner server?
Is it ever passing through your MailScanner server?

>----- Original Message -----
>From: <mailto:mailscanner at ECS.SOTON.AC.UK>Julian Field
>To: <mailto:MAILSCANNER at JISCMAIL.AC.UK>MAILSCANNER at JISCMAIL.AC.UK
>Sent: Friday, June 21, 2002 6:56 PM
>Subject: Re: sending a virus from mailscanner's domain is undetected
>butincoming mail from either our domain or others is detected
>
>At 18:45 21/06/2002, you wrote:
>>Hello,
>>No not on the machine running mailscanner, but outlook 2000 on a
>>workstation sent an email to an outside domain with a virus to test and
>>the outside domain received it with the virus in tact.. Its the test
>>virus you referred me earlier to use.. when I reply (from the outside
>>domain) and its incoming to mailscanner, it will pick it up then. only
>>incoming scanning is taken place not outgoing.
>>Thanks!
>Did it get any X-MailScanner: header at all?
>If not, then it probably didn't go via the MailScanner server.
>If it did, then what did the header say? What is in your mailscanner.conf
>file?
>
>Unless it is told to, MailScanner doesn't care what addresses are in the
>email message.
>>-----Original Message-----
>>From: Julian Field [mailto:mailscanner at ECS.SOTON.AC.UK]
>>Sent: Friday, June 21, 2002 2:40 PM
>>To: MAILSCANNER at JISCMAIL.AC.UK
>>Subject: Re: sending a virus from mailscanner's domain is undetected
>>butincoming mail from either our domain or others is detected
>>
>>At 17:36 21/06/2002, you wrote:
>> >Sending a virus from mailscanner's domain to another is undetected, but
>> >incoming mail from either our domain or others, is detected.
>> >Is this normal?
>>
>>Did you run the email client program on the machine that is running
>>MailScanner, by any chance? If so, did you make the email program talk SMTP
>>to localhost:25 or did it invoke sendmail directly?
>>
>>MailScanner (when running with sendmail) can only scan mail coming in the
>>SMTP port. There is no way (with sendmail) of scanning mail poked directly
>>at the sendmail binary.

--
Julian Field                Teaching Systems Manager
jkf at ecs.soton.ac.uk         Dept. of Electronics & Computer Science
Tel. 023 8059 2817          University of Southampton
                             Southampton SO17 1BJ
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20020621/da365040/attachment.html