Bofra-32-Sophos getting through

[Martin Hepworth]

Chris

have you tried using 'sweep' on the message file?

Sophos have this annoying habit of not find certain malware till it's
hits the users desktops, esp when the file contains multiple
viruses/trojans etc.

You could also drop the file (passwd protected zip file) to
support at sophos.com and let them look at it..


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Chris Trudeau wrote:
> Hello list,
>
> I am concerned that several of the Bofra bugs have gotten through my
> mailscanner/sophossavi implementation.
>
> Sophos has released and I have confirmed Bofra IDE files in the libs for
> Sophos, but they continue to get through.
>
> Any ideas?
>
> Temprorarily I have jacked up the SPAM score for the
> "SARE_FORGED_PAYPAL_C" check which is catching those and causing them to
> be held as SPAM, but I'm not sure why these messages are getting through.
>
> Any help is appreciated.
>
> CT
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).