Problems since the new McAfee dat file 4252

[Andrew M. Hoying]

I updated to the latest uvscan version, Virus Scan for Linux v4.24.0 as
was suggested, but scanning the file below still returns the same virus
found. I don't know if MailScanner will break again yet, I'll let you
know what I find.

Thanks. 

> -----Original Message-----
> From: Andrew M. Hoying 
> Sent: Thursday, March 13, 2003 7:08 AM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: Problems since the new McAfee dat file 4252
> 
> 
> Here is a copy of the file h2DAmR5G020453.vir :
> 
> Return-Path: <g>
> Received: from xx ([xx])
>         by xx(8.12.8/8.12.8) with ESMTP id h2DAmR5G020453
>         for <xx>; Thu, 13 Mar 2003 03:48:28 -0700
> Full-Name: Yuriy Toropin
> From: xx
> To: xx
> Subject: Meeting with representative from Vested Development Inc.
> Date: Thu, 13 Mar 2003 13:52:30 +0300
> Message-ID: <00b401c2e94e$a61aa480$d4e7a8c0 at mxpyuriy>
> MIME-Version: 1.0
> Content-Type: text/calendar; method=REQUEST;
>         charset="utf-8"
> Content-Transfer-Encoding: 7bit
> X-Priority: 3 (Normal)
> X-MSMail-Priority: Normal
> X-Mailer: Microsoft Outlook, Build 10.0.4024
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
> Importance: Normal
> 
> 
> Here is the output from uvscan:
> 
> # uvscan --recursive --ignore-links --analyze --secure --noboot
> h2DAmR5G020453.vir
> /root/h2DAmR5G020453.vir
>         Found trojan or variant Exploit-CTCalendar !!!
>         Please send a copy of the file to Network Associates
> 
> 
> ----- Original Message -----
> From: "Julian Field" <mailscanner at ECS.SOTON.AC.UK>
> To: <MAILSCANNER at JISCMAIL.AC.UK>
> Sent: Thursday, March 13, 2003 3:14 AM
> Subject: Re: Problems since the new McAfee dat file 4252
> 
> 
> > At 22:49 12/03/2003, you wrote:
> > >I know I'm running a very old version of mailscanner, 
> 3.14, which may be
> > >the problem, but since the new dat file came out, Office 
> XP calendar
> > >meeting requests are being reported as Exploit-CTCalendar 
> and then the
> > >scanner crashes and reports the virus again, 50-60 times a 
> minute until I
> > >delete the message from the incoming folder. Is there 
> anything I can do,
> > >short of upgrading the a new version, to fix this problem?
> >
> > What happens when you run mcafee on the files by hand? Can 
> you mail me the
> > exact output please, and I'll find out what new versions do with it.
> > --
> > Julian Field
> > www.MailScanner.info
> > Professional Support Services at www.MailScanner.biz
> > MailScanner thanks transtec Computers for their support
> >
>