<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 5.50.4916.2300" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><SPAN class=920191719-21062002><FONT face=Arial><FONT color=#0000ff><FONT
size=2><SPAN
class=383491719-21062002>ps</SPAN></FONT></FONT></FONT></SPAN></DIV>
<DIV><SPAN class=920191719-21062002><SPAN class=383491719-21062002></SPAN><FONT
face=Arial><FONT color=#0000ff><FONT size=2>HOw the heck could it be
hijacked?!!<SPAN class=383491719-21062002>
weird</SPAN></FONT></FONT></FONT></SPAN></DIV>
<BLOCKQUOTE dir=ltr style="MARGIN-RIGHT: 0px">
<DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Tahoma
size=2>-----Original Message-----<BR><B>From:</B> Ray Healy (Data Net
Services) [mailto:ray@MATRIX-DATANET.CO.UK]<BR><B>Sent:</B> Friday, June 21,
2002 4:06 PM<BR><B>To:</B> MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> Re:
sending a virus from mailscanner's domain is undetectedbutincoming mail from
either our domain or others is detected<BR><BR></FONT></DIV>
<DIV><FONT face=Arial size=2>I am probably wrong in your situation but I
thought I would mention this</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>I had a similar situation where emails were not
being scanned by MailScanner when sent through my RAQ but incomming messages
where scanned OK if sent to my RAQ by someone else.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>This was due to the email message being hijacked
by the ISP I was connecting to and putting the message through their own mail
server and not mine even though in the properties I had stated the address of
my mail server. </FONT></DIV>
<DIV><FONT face=Arial size=2>I do not know whether this is of any help or am I
toytally off track</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Ray</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV>----- Original Message ----- </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=mailscanner@ECS.SOTON.AC.UK
href="mailto:mailscanner@ECS.SOTON.AC.UK">Julian Field</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=MAILSCANNER@JISCMAIL.AC.UK
href="mailto:MAILSCANNER@JISCMAIL.AC.UK">MAILSCANNER@JISCMAIL.AC.UK</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Friday, June 21, 2002 6:56
PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Re: sending a virus from
mailscanner's domain is undetected butincoming mail from either our domain
or others is detected</DIV>
<DIV><BR></DIV>At 18:45 21/06/2002, you wrote:<BR>
<BLOCKQUOTE class=cite type="cite" cite=""><FONT face=arial color=#0000ff
size=2>Hello,</FONT><BR><FONT face=arial color=#0000ff size=2>No not on
the machine running mailscanner, but outlook 2000 on a workstation sent an
email to an outside domain with a virus to test and the outside domain
received it with the virus in tact.. Its the test virus you referred me
earlier to use.. when I reply (from the outside domain) and its incoming
to mailscanner, it will pick it up then. only incoming scanning is taken
place not outgoing.</FONT><BR><FONT face=arial color=#0000ff
size=2>Thanks!</FONT></BLOCKQUOTE><BR>Did it get any X-MailScanner: header
at all?<BR>If not, then it probably didn't go via the MailScanner
server.<BR>If it did, then what did the header say? What is in your
mailscanner.conf file?<BR><BR>Unless it is told to, MailScanner doesn't care
what addresses are in the email message.<BR>
<BLOCKQUOTE class=cite type="cite" cite="">
<DL><FONT face=tahoma size=2>
<DD>-----Original Message-----
<DD>From:</B> Julian Field [<A href="mailto:mailscanner@ECS.SOTON.AC.UK"
eudora="autourl">mailto:mailscanner@ECS.SOTON.AC.UK</A>]
<DD>Sent:</B> Friday, June 21, 2002 2:40 PM
<DD>To:</B> MAILSCANNER@JISCMAIL.AC.UK
<DD>Subject:</B> Re: sending a virus from mailscanner's domain is
undetected butincoming mail from either our domain or others is
detected<BR><BR></FONT>
<DD>At 17:36 21/06/2002, you wrote:
<DD>>Sending a virus from mailscanner's domain to another is
undetected, but
<DD>>incoming mail from either our domain or others, is detected.
<DD>>Is this normal? <BR><BR>
<DD>Did you run the email client program on the machine that is running
<DD>MailScanner, by any chance? If so, did you make the email program
talk SMTP
<DD>to localhost:25 or did it invoke sendmail directly? <BR><BR>
<DD>MailScanner (when running with sendmail) can only scan mail coming
in the
<DD>SMTP port. There is no way (with sendmail) of scanning mail poked
directly
<DD>at the sendmail binary.
<DD>--
<DD>Julian Field Teaching Systems Manager
<DD>jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science
<DD>Tel. 023 8059 2817 University of Southampton
<DD>Southampton SO17 1BJ </DD></DL></BLOCKQUOTE><BR>
<DIV>--</DIV>
<DIV>Julian
Field
Teaching Systems Manager</DIV>
<DIV>jkf@ecs.soton.ac.uk
Dept. of Electronics & Computer Science</DIV>
<DIV>Tel. 023 8059
2817 University of
Southampton</DIV>
Southampton SO17 1BJ </BLOCKQUOTE></BLOCKQUOTE></BODY></HTML>