Re: Antivirus - Unscannable message bodies and blank subjects being blocked.

  • From: "Zoran" <zmarjanovic@xxxxxxxx>
  • To: exchangelist@xxxxxxxxxxxxx
  • Date: Fri, 13 Feb 2004 10:23:44 -0700

Hi Jason,

Set Encrypted file rule to Log Only, and in Configuration>General settings
increase Maximum Archive Scan Depth.
You can release these messages from quarantine in a folder and check what
is it. First check the sender name, as there are viruses that spread in
encrypted form.

Zoran

> This is a multi-part message in MIME format.
> 
> ------_=_NextPart_001_01C3F24E.D592FAFA
> Content-Type: text/plain;
>       charset="us-ascii"
> Content-Transfer-Encoding: quoted-printable
> 
> Hi Chaps,
> =20
> Got a problem that I think is related to our AV software. Here's the
> setup:
> =20
> Exchange 2003
> Windows 2003
> Symantec Mail Security v 4.0
> =20
> I'm getting an awful lot of "Unscannable" message errors, and its not
> obvious what is different about these emails. However they do have these
> entries in their headers:
> =20
> ----------------------------
> ------_=3D_NextPart_001_01C3F239.E1391CA0
> Content-Type: text/plain;
>  charset=3D"iso-8859-1"
> Content-Transfer-Encoding: quoted-printable
> =20
> ------_=3D_NextPart_001_01C3F239.E1391CA0
> Content-Type: text/html;
>  charset=3D"iso-8859-1"
> =20
> 
> ------_=3D_NextPart_001_01C3F239.E1391CA0--
> ----------------------------------------------
> =20
> There seems to be some encoding going on that SMS doesn't like, but how
> can I configure the AV to be able to scan these messages?=20
> =20
> One other thing: All messages with blank subjects are being blocked at
> Categorisation. I suspect SMS of this too.
> =20
> Can anyone shed any light on this?
> =20
> Many thanks in advance,
> =20
> Jason
> =20
> =20
> 
> =20
> 
> 
> ------_=_NextPart_001_01C3F24E.D592FAFA
> Content-Type: text/html;
>       charset="us-ascii"
> Content-Transfer-Encoding: quoted-printable
> 
> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
> <HTML><HEAD><TITLE></TITLE>
> <META http-equiv=3DContent-Type content=3D"text/html; =
> charset=3Dus-ascii">
> <META content=3D"MSHTML 6.00.2800.1400" name=3DGENERATOR></HEAD>
> <BODY>
> <DIV dir=3Dltr align=3Dleft><SPAN class=3D710011416-13022004><FONT =
> face=3DArial=20
> size=3D2>Hi Chaps,</FONT></SPAN></DIV>
> <DIV dir=3Dltr align=3Dleft><SPAN class=3D710011416-13022004><FONT =
> face=3DArial=20
> size=3D2></FONT></SPAN>&nbsp;</DIV>
> <DIV dir=3Dltr align=3Dleft><SPAN class=3D710011416-13022004><FONT =
> face=3DArial=20
> size=3D2>Got a problem that I think is related to our AV software. =
> Here's the=20
> setup:</FONT></SPAN></DIV>
> <DIV dir=3Dltr align=3Dleft><SPAN class=3D710011416-13022004><FONT =
> face=3DArial=20
> size=3D2></FONT></SPAN>&nbsp;</DIV>
> <DIV dir=3Dltr align=3Dleft><SPAN class=3D710011416-13022004><FONT =
> face=3DArial=20
> size=3D2>Exchange 2003</FONT></SPAN></DIV>
> <DIV dir=3Dltr align=3Dleft><SPAN class=3D710011416-13022004><FONT =
> face=3DArial=20
> size=3D2>Windows 2003</FONT></SPAN></DIV>
> <DIV dir=3Dltr align=3Dleft><SPAN class=3D710011416-13022004><FONT =
> face=3DArial=20
> size=3D2>Symantec Mail Security v 4.0</FONT></SPAN></DIV>
> <DIV dir=3Dltr align=3Dleft><SPAN class=3D710011416-13022004><FONT =
> face=3DArial=20
> size=3D2></FONT></SPAN>&nbsp;</DIV>
> <DIV dir=3Dltr align=3Dleft><SPAN class=3D710011416-13022004><FONT =
> face=3DArial=20
> size=3D2>I'm getting an awful lot of "Unscannable" message errors, and =
> its not=20
> obvious what is different about these emails. However they do have these =
> entries=20
> in their headers:</FONT></SPAN></DIV>
> <DIV dir=3Dltr align=3Dleft><SPAN class=3D710011416-13022004><FONT =
> face=3DArial=20
> size=3D2></FONT></SPAN>&nbsp;</DIV>
> <DIV dir=3Dltr align=3Dleft><SPAN class=3D710011416-13022004><FONT =
> face=3DArial=20
> size=3D2>----------------------------</FONT></SPAN></DIV>
> <DIV dir=3Dltr align=3Dleft><SPAN class=3D710011416-13022004>
> <DIV><FONT face=3DArial=20
> size=3D2>------_=3D_NextPart_001_01C3F239.E1391CA0<BR>Content-Type:=20
> text/plain;<BR>&nbsp;charset=3D"iso-8859-1"<BR>Content-Transfer-Encoding:=
> =20
> quoted-printable</FONT></DIV>
> <DIV>&nbsp;</DIV>
> <DIV><FONT face=3DArial=20
> size=3D2>------_=3D_NextPart_001_01C3F239.E1391CA0<BR>Content-Type:=20
> text/html;<BR>&nbsp;charset=3D"iso-8859-1"</FONT></DIV>
> <DIV>&nbsp;</DIV>
> <DIV><BR><FONT face=3DArial=20
> size=3D2>------_=3D_NextPart_001_01C3F239.E1391CA0--</FONT></DIV>
> <DIV><SPAN class=3D710011416-13022004><FONT face=3DArial=20
> size=3D2>----------------------------------------------</FONT></SPAN></DI=
> V></SPAN></DIV>
> <DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
> <DIV><SPAN class=3D710011416-13022004><FONT face=3DArial size=3D2>There =
> seems to be=20
> some encoding going on that SMS doesn't like, but how can I configure =
> the AV to=20
> be able to scan these messages? </FONT></SPAN></DIV>
> <DIV><SPAN class=3D710011416-13022004><FONT face=3DArial=20
> size=3D2></FONT></SPAN>&nbsp;</DIV>
> <DIV><SPAN class=3D710011416-13022004><FONT face=3DArial size=3D2>One =
> other thing: All=20
> messages with blank subjects are being blocked at Categorisation. I =
> suspect SMS=20
> of this too.</FONT></SPAN></DIV>
> <DIV><SPAN class=3D710011416-13022004><FONT face=3DArial=20
> size=3D2></FONT></SPAN>&nbsp;</DIV>
> <DIV><SPAN class=3D710011416-13022004><FONT face=3DArial size=3D2>Can =
> anyone shed any=20
> light on this?</FONT></SPAN></DIV>
> <DIV><SPAN class=3D710011416-13022004><FONT face=3DArial=20
> size=3D2></FONT></SPAN>&nbsp;</DIV>
> <DIV><SPAN class=3D710011416-13022004><FONT face=3DArial size=3D2>Many =
> thanks in=20
> advance,</FONT></SPAN></DIV>
> <DIV><SPAN class=3D710011416-13022004><FONT face=3DArial=20
> size=3D2></FONT></SPAN>&nbsp;</DIV>
> <DIV><SPAN class=3D710011416-13022004><FONT face=3DArial=20
> size=3D2>Jason</FONT></SPAN></DIV>
> <DIV><SPAN class=3D710011416-13022004><FONT face=3DArial=20
> size=3D2></FONT></SPAN>&nbsp;</DIV>
> <DIV><SPAN class=3D710011416-13022004><FONT face=3DArial=20
> size=3D2></FONT></SPAN>&nbsp;</DIV>
> <DIV class=3DSection1>
> <P class=3DMsoNormal style=3D"MARGIN-BOTTOM: =
> 5pt">&nbsp;</P></DIV></BODY></HTML>
> 
> ------_=_NextPart_001_01C3F24E.D592FAFA--


Other related posts: