Bounced sobig passes thru MS and anti-virus checks

[Steve Ellis]

Some automated replies, which also contained the Sobig virus,  notifying
users that they had sent an infected message apparently made it thru MS
and anti-virus checks. The desktop AV package identified the message
attachment as infected with Sobig.f. Directly sent Sobig messages are
correctly handled both by MS checking the extension and by the
anti-virus scan.



Any suggestions as to where to start looking to determine why these
messages made it thru?





Steve Ellis

Sr Engineer

KaZaK Composites, Inc.

781.932.5667 x105



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030905/7ededbbe/attachment.html