Re: [Clamav-users] SomeFool.P/Q occasionally passing through

2004-08-13 Thread Todd Lyons
Nigel Horne wanted us to know: >On Friday 13 Aug 2004 8:08 pm, Todd Lyons wrote: > >> I wonder. If you hit the max threads and are using the clamav-milter, >> then it will drop through. Try picking up the max threads in >> clamav.conf and see if that makes a difference. >Not true. I thought the

Re: [Clamav-users] SomeFool.P/Q occasionally passing through

2004-08-13 Thread Nigel Horne
On Friday 13 Aug 2004 8:08 pm, Todd Lyons wrote: > I wonder. If you hit the max threads and are using the clamav-milter, > then it will drop through. Try picking up the max threads in > clamav.conf and see if that makes a difference. Not true. -Nigel

Re: [Clamav-users] SomeFool.P/Q occasionally passing through

2004-08-13 Thread Todd Lyons
David Williams wanted us to know: >Hello all, > >We are having the same problem, we are using Clamav at our perimeter, >then it forwards it to another server running Symantec. In the last >week, Clamav has caught ~1200 viruses, but two got through. Symantec >called it [EMAIL PROTECTED] Accordin

Re: [Clamav-users] SomeFool.P/Q occasionally passing through

2004-08-13 Thread Nigel Horne
On Friday 13 Aug 2004 13:18, David Williams wrote: > Hello all, > > We are having the same problem, we are using Clamav at our perimeter, > then it forwards it to another server running Symantec. In the last > week, Clamav has caught ~1200 viruses, but two got through. Symantec > called it [EMAI

Re: [Clamav-users] SomeFool.P/Q occasionally passing through

2004-08-13 Thread Nigel Horne
On Friday 13 Aug 2004 13:59, I wrote: > Do you have the original e-mail that demonstrates the problem? If so please forward > it to me and I'll look at it for you. Don't forget to zip with the password 'virus'. -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. I

Re: [Clamav-users] SomeFool.P/Q occasionally passing through

2004-08-13 Thread David Williams
Hello all, We are having the same problem, we are using Clamav at our perimeter, then it forwards it to another server running Symantec. In the last week, Clamav has caught ~1200 viruses, but two got through. Symantec called it [EMAIL PROTECTED] According to Symantec's website, "When a file is

Re: [Clamav-users] SomeFool.P/Q occasionally passing through

2004-08-12 Thread Arthur Kerpician
Arthur Kerpician wrote: Todd Lyons wrote: Brian Morrison wanted us to know: >Received: from localhost [127.0.0.1] by backup.ccina.ro with >SpamAssassin (2.60 1.212-2003-09-23-exp); Wed, 11 Aug 2004 17:53:00 >+0300 This is the last line of Received headers, so it never says exactly what host it

Re: [Clamav-users] SomeFool.P/Q occasionally passing through

2004-08-12 Thread Arthur Kerpician
Todd Lyons wrote: Brian Morrison wanted us to know: >Received: from localhost [127.0.0.1] by backup.ccina.ro with >SpamAssassin (2.60 1.212-2003-09-23-exp); Wed, 11 Aug 2004 17:53:00 >+0300 This is the last line of Received headers, so it never says exactly what host it came from. It was

Re: [Clamav-users] SomeFool.P/Q occasionally passing through

2004-08-11 Thread Todd Lyons
Brian Morrison wanted us to know: >> >Received: from localhost [127.0.0.1] by backup.ccina.ro with >> >SpamAssassin (2.60 1.212-2003-09-23-exp); Wed, 11 Aug 2004 17:53:00 >> >+0300 >> This is the last line of Received headers, so it never says exactly >> what host it came from. >It was recei

Re: [Clamav-users] SomeFool.P/Q occasionally passing through

2004-08-11 Thread Brian Morrison
On Wed, 11 Aug 2004 12:25:35 -0700 in [EMAIL PROTECTED] Todd Lyons <[EMAIL PROTECTED]> wrote: > >Received: from localhost [127.0.0.1] by backup.ccina.ro with > >SpamAssassin (2.60 1.212-2003-09-23-exp); Wed, 11 Aug 2004 17:53:00 > >+0300 > > This is the last line of Received headers, so it n

Re: [Clamav-users] SomeFool.P/Q occasionally passing through

2004-08-11 Thread Rick Macdougall
Todd Lyons wrote: Arthur Kerpician wanted us to know: Microsoft Mail Internet Headers Version 2.0 What is that? Received: from backup.ccina.ro ([193.41.216.99]) by main-server.ccina.ro with Microsoft SMTPSVC(5.0.2195.6713); Wed, 11 Aug 2004 17:51:46 +0300 Silly question but are you running QS

Re: [Clamav-users] SomeFool.P/Q occasionally passing through

2004-08-11 Thread Todd Lyons
Arthur Kerpician wanted us to know: >Microsoft Mail Internet Headers Version 2.0 What is that? >Received: from backup.ccina.ro ([193.41.216.99]) by main-server.ccina.ro >with Microsoft SMTPSVC(5.0.2195.6713); Wed, 11 Aug 2004 17:51:46 +0300 Ok so it made it through the Linux box (backup) to t

Re: [Clamav-users] SomeFool.P/Q occasionally passing through

2004-08-11 Thread Arthur Kerpician
Damian Menscher wrote: On Wed, 11 Aug 2004, Arthur Kerpician wrote: Still, about 4-5 times a day, NAV detects [EMAIL PROTECTED] I repeat, NAV/Exchange server is behind my RH Linux/ClamAV machine which is supposed to do all filtering (AV/Spam) until it passes the mails to the Exchange. I saved a

Re: [Clamav-users] SomeFool.P/Q occasionally passing through

2004-08-11 Thread Arthur Kerpician
Damian Menscher wrote: On Wed, 11 Aug 2004, Arthur Kerpician wrote: Still, about 4-5 times a day, NAV detects [EMAIL PROTECTED] I repeat, NAV/Exchange server is behind my RH Linux/ClamAV machine which is supposed to do all filtering (AV/Spam) until it passes the mails to the Exchange. I saved a

Re: [Clamav-users] SomeFool.P/Q occasionally passing through

2004-08-11 Thread Damian Menscher
On Wed, 11 Aug 2004, Arthur Kerpician wrote: > Still, about 4-5 times a day, NAV detects [EMAIL PROTECTED] I repeat, > NAV/Exchange server is behind my RH Linux/ClamAV machine which is > supposed to do all filtering (AV/Spam) until it passes the mails to the > Exchange. I saved a copy of the worm