<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2600.0" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>I not sure but I believe a couple of ISP's do this
for some strange reason. Which I suppose is quite good as its using their
bandwith and resources and not mine.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Anyway I suppose the most important thing is that
all of my clients incomming mail is being scanned for a virus as they are
collecting from my server.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Perhaps they just want control or watching peoples
e-mails !!</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Ray</FONT></DIV>
<DIV> </DIV>
<DIV>----- Original Message ----- </DIV>
<BLOCKQUOTE dir=ltr
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=Matthew_doherty@DATAWATCH.COM
href="mailto:Matthew_doherty@DATAWATCH.COM">Matt Doherty</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=MAILSCANNER@JISCMAIL.AC.UK
href="mailto:MAILSCANNER@JISCMAIL.AC.UK">MAILSCANNER@JISCMAIL.AC.UK</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Friday, June 21, 2002 8:18 PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Re: sending a virus from
mailscanner's domain is undetectedbutincoming mail from either our domain or
others is detected</DIV>
<DIV><BR></DIV>
<DIV><SPAN class=920191719-21062002><FONT face=Arial><FONT color=#0000ff><FONT
size=2><SPAN
class=383491719-21062002>ps</SPAN></FONT></FONT></FONT></SPAN></DIV>
<DIV><SPAN class=920191719-21062002><SPAN
class=383491719-21062002></SPAN><FONT face=Arial><FONT color=#0000ff><FONT
size=2>HOw the heck could it be hijacked?!!<SPAN class=383491719-21062002>
weird</SPAN></FONT></FONT></FONT></SPAN></DIV>
<BLOCKQUOTE dir=ltr style="MARGIN-RIGHT: 0px">
<DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Tahoma
size=2>-----Original Message-----<BR><B>From:</B> Ray Healy (Data Net
Services) [mailto:ray@MATRIX-DATANET.CO.UK]<BR><B>Sent:</B> Friday, June 21,
2002 4:06 PM<BR><B>To:</B> <A
href="mailto:MAILSCANNER@JISCMAIL.AC.UK">MAILSCANNER@JISCMAIL.AC.UK</A><BR><B>Subject:</B>
Re: sending a virus from mailscanner's domain is undetectedbutincoming mail
from either our domain or others is detected<BR><BR></FONT></DIV>
<DIV><FONT face=Arial size=2>I am probably wrong in your situation but I
thought I would mention this</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>I had a similar situation where emails were not
being scanned by MailScanner when sent through my RAQ but incomming messages
where scanned OK if sent to my RAQ by someone else.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>This was due to the email message being
hijacked by the ISP I was connecting to and putting the message through
their own mail server and not mine even though in the properties I had
stated the address of my mail server. </FONT></DIV>
<DIV><FONT face=Arial size=2>I do not know whether this is of any help or am
I toytally off track</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Ray</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV>----- Original Message ----- </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=mailscanner@ECS.SOTON.AC.UK
href="mailto:mailscanner@ECS.SOTON.AC.UK">Julian Field</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A
title=MAILSCANNER@JISCMAIL.AC.UK
href="mailto:MAILSCANNER@JISCMAIL.AC.UK">MAILSCANNER@JISCMAIL.AC.UK</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Friday, June 21, 2002 6:56
PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Re: sending a virus from
mailscanner's domain is undetected butincoming mail from either our domain
or others is detected</DIV>
<DIV><BR></DIV>At 18:45 21/06/2002, you wrote:<BR>
<BLOCKQUOTE class=cite cite="" type="cite"><FONT face=arial
color=#0000ff size=2>Hello,</FONT><BR><FONT face=arial color=#0000ff
size=2>No not on the machine running mailscanner, but outlook 2000 on a
workstation sent an email to an outside domain with a virus to test and
the outside domain received it with the virus in tact.. Its the test
virus you referred me earlier to use.. when I reply (from the outside
domain) and its incoming to mailscanner, it will pick it up then. only
incoming scanning is taken place not outgoing.</FONT><BR><FONT
face=arial color=#0000ff size=2>Thanks!</FONT></BLOCKQUOTE><BR>Did it get
any X-MailScanner: header at all?<BR>If not, then it probably didn't go
via the MailScanner server.<BR>If it did, then what did the header say?
What is in your mailscanner.conf file?<BR><BR>Unless it is told to,
MailScanner doesn't care what addresses are in the email message.<BR>
<BLOCKQUOTE class=cite cite="" type="cite">
<DL><FONT face=tahoma size=2>
<DD>-----Original Message-----
<DD>From:</B> Julian Field [<A
href="mailto:mailscanner@ECS.SOTON.AC.UK"
eudora="autourl">mailto:mailscanner@ECS.SOTON.AC.UK</A>]
<DD>Sent:</B> Friday, June 21, 2002 2:40 PM
<DD>To:</B> MAILSCANNER@JISCMAIL.AC.UK
<DD>Subject:</B> Re: sending a virus from mailscanner's domain is
undetected butincoming mail from either our domain or others is
detected<BR><BR></FONT>
<DD>At 17:36 21/06/2002, you wrote:
<DD>>Sending a virus from mailscanner's domain to another is
undetected, but
<DD>>incoming mail from either our domain or others, is detected.
<DD>>Is this normal? <BR><BR>
<DD>Did you run the email client program on the machine that is
running
<DD>MailScanner, by any chance? If so, did you make the email program
talk SMTP
<DD>to localhost:25 or did it invoke sendmail directly? <BR><BR>
<DD>MailScanner (when running with sendmail) can only scan mail coming
in the
<DD>SMTP port. There is no way (with sendmail) of scanning mail poked
directly
<DD>at the sendmail binary.
<DD>--
<DD>Julian Field Teaching Systems Manager
<DD>jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science
<DD>Tel. 023 8059 2817 University of Southampton
<DD>Southampton SO17 1BJ </DD></DL></BLOCKQUOTE><BR>
<DIV>--</DIV>
<DIV>Julian
Field
Teaching Systems Manager</DIV>
<DIV>jkf@ecs.soton.ac.uk
Dept. of Electronics & Computer Science</DIV>
<DIV>Tel. 023 8059
2817 University of
Southampton</DIV>
Southampton SO17 1BJ </BLOCKQUOTE></BLOCKQUOTE></BLOCKQUOTE></BODY></HTML>