How many times does f-secure scan messages?

[Bryan Keet]

Hi All,

I am seeing duplicate reports for a single message also, with ClamAV. Seems
to only happen when the attachment is a zip archive.

--------------------------------
    Sender: x at x
IP Address: x.x.x.x
 Recipient: x at x
   Subject: Re: does it?
 MessageID: i2EHtHe08092
    Report: ClamAV: message.zip contains Worm.SomeFool.Gen-1
            ClamAV: message.txt.com contains Worm.SomeFool.Gen-1
            MailScanner: Executable DOS/Windows programs are dangerous in
email (message.txt.com)
    Report: ClamAV: message.txt.com contains Worm.SomeFool.Gen-1
            MailScanner: Executable DOS/Windows programs are dangerous in
email (message.txt.com)
--------------------------------

Regards,

Bryan Keet


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf
Of Victor DiMichina
Sent: 13 March 2004 20:01
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: How many times does f-secure scan messages?

----- Original Message -----
From: "Michael Freeman" <admin at THENAMEGAME.COM>
To: <MAILSCANNER at JISCMAIL.AC.UK>
Sent: Wednesday, March 10, 2004 7:02 PM
Subject: How many times does f-secure scan messages?


>
> We are seeing double and even tripple virus content information within the
> body of some of our messages.
>

< snip >

 This is perfectly normal for F-secure.  Here's a snippet from mine:

##############################################
IP Address: 68.161.120.28
 Recipient: victor at pixelmagicfx.com
   Subject: Re: Your archive
 MessageID: 16508
    Report: Panda: W32/Netsky
            F-Secure: ./16508/your_archive.pif: Infected: W32/NetSky.K at mm
[Orion]
            F-Secure: ./16508/your_archive.pif: Infected: I-Worm.NetSky.j
[AVP]
            MailScanner: Shortcuts to MS-Dos programs are very dangerous in
email (your_archive.pif)###################################################
I moved Panda to my first line of virus scanners after this
password-protected zip debacle.  The upgrade to the latest mailscanner
helped,  but f-secure still lets some of those Bagel virus e-mails through.
Vic

--
Incoming mail is certified Virus Free.
Checked by AVG Anti-Virus (http://www.grisoft.com).
Version: 7.0.225 / Virus Database: 262.4.4 - Release Date: 13/03/2004


--
Outgoing mail is certified Virus Free.
Checked by AVG Anti-Virus (http://www.grisoft.com).
Version: 7.0.225 / Virus Database: 262.4.4 - Release Date: 13/03/2004