Sobig-E and McAfee uvscan - intermittent failure to find Sobig-E

[Quentin Campbell]

Denis

After a spate of these exceptions I restarted MailScanner and in the 2 hours subsequent to that I have seen no more instances of McAfee missing the presence of Sobig-E in a message.

Will keep monitoring and let you know if I see it again.

Quentin
---
PHONE: +44 191 222 8209    Computing Service, University of Newcastle
FAX:   +44 191 222 8765    Newcastle upon Tyne, United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own." 

> -----Original Message-----
> From: Denis Beauchemin [mailto:Denis.Beauchemin at USHERBROOKE.CA] 
> Sent: 30 June 2003 16:19
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: Sobig-E and McAfee uvscan - intermittent failure 
> to find Sobig-E
> 
> 
> Le lun 30/06/2003 à 10:00, Quentin Campbell a écrit :
> 
> > 
> > Was monitoring the filtering of viruses on the upgraded 
> machine. Both 
> > McAfee and Sophos were finding Sobig-E OK.
> > 
> > Then McAfee failed to find Sobig-E on the next message (file is
> > "your_details.zip/details.pif") although Sophos found the virus OK. 
> > The next couple of messages showed both scanners working OK 
> again then 
> > McAfee failed once more to find Sobig-E in a message (same file as 
> > above).
> > 
> > I was doing nothing to the machine at the time and the 
> "auto-update" 
> > script did not run.
> > 
> > This behaviour is both perplexing and worrying.
> > 
> 
> Yes, this makes me quite nervous as McAfee is our sole virus 
> protection here...  Maybe I will try CLAMAV...
> 
> Denis
> -- 
> Denis Beauchemin, analyste
> Universit de Sherbrooke, S.T.I.
> T: 819.821.8000x2252 F: 819.821.8045
>