Groupshield on-demand scan finding same virus again

[larsjuhl]

I have Exchange 5.5 with Groupshield SP2, I have tried removing Groupshield to make this problem dissapear..

I have scheduled a on-demand scan on all mailboxes with these settings: Delete attachment on failure to disinfect.

But the scheduled scan are finding the same virus in the same mailboxes on every scan and on every scan it says action:deleted, but why does it keep finding when it deletes them ? the quarantine database is also empty so it must be deleting them... I believe...

Anyone seen this ? know a solution, please..

rgds
Lars

 

[AVChap]

Which virus is it?

AVChap
... my $1 worth of advise, 2cents isn't enough due to inflation

 

[larsjuhl]

some of them are Exploit.MIME.gen.b the rest are not defined with a name...
I have now removed them from the mailboxes and awaiting the result of on-demand scan tomorrow.
thx

 

[AVChap]

Exploit.MIME.gen.b is the generic term for the Microsoft Incorrect MIME Header vulnerability. Viruses are detected generically with this name IF they exploit this vulnerability. Some of these are Badtrans, Nimda, Klez and Bugbear.

HTH,

AVChap
... my $1 worth of advise, 2cents isn't enough due to inflation

 

[jonarden]

You might contact NAI and discuss hotfix GS5E55SP2HF40784.zip to fix the following GroupShield SP2 issue: "This hotfix resolves an issue where an On-Demand scan detects emails again and again as infected with unknown virus name, but is unable to clean or quarantine these emails."