Groupshield Sender and Recipient Info Missing

[dataside]

I can't locate the sender and recepient of virus alerts.

As a result, we can't track down who sent the email and therefore who has the virus or where it came from.

Groupshield is correctly detecting viruses. However the details form the alerts and messages only give the virus and attachment name.

I have changed the messages to add the relevant fields such as <sender> (as indicated in the help files) but we only get N/A.

I can't find this information anywhere on the system.

The current setup is to use a quarantine directory rather than a database - would this make a difference?

Any suggestions?

 

[AVChap]

Lemme guess, you're using Exchange 5.5 SP3 and GroupShield 4.5 SP1? If so, you'll need to either download the Resolve Names Utility from the NAI web site, or upgrade to GroupShield 5.0 for Exchange 5.5.

HTH, AVChap
... take my advice, I don't use it anyway!

 

[dataside]

Thanks AVChap,

I downloaded the Resolve Names Utility.

We need the quarantine database for it to work. Ther is no database on the system. I went into the quarantine manager and selected save as in the hope of creating a new one. I caleled the file called qtine.mdb.

I then set the quarantine action to go tho the database rather than a directory. Nothing appears in the database though.

Ther used to be a database but a previous employee changed things.

Do you know how I get the database to accept the quarantine files?

Thanks

Pete

 

[AVChap]

You need to point to this database in the GroupShield console. Or another way would be to just use the default database name.

HTH, AVChap
... take my advice, I don't use it anyway!

 

[dataside]

I have pointed to the database from the console. The database was not there so I created one using FILE and SAVE As form the quarantine manager.

Viruses are being detected but nothing is getting into the quarantine database. The previous option of directory worked fine.

I was thinking that the database needed to be created first. It may have been there before but was deleted some months ago. Do I need to do anything special to create a new one or is there another problem preventing me from updating the database.

Pete

 

[slsav]

Pete

Save yourself some time and headaches, and upgrade to GroupShield 5.0 for Exchange 5.5. Even with the Resolve Names Utility, it is still a manual job to get the information you want.
GroupShield 5.0 gives you the sender and recipient details, when possible, on the virus alerts automatically. It also has a few other trimmings, and the autoupdating of the dat files actually works everytime.

I have seen an upgrade from GShield 4.5 to 5.0 run smoothly, and also seen it fail miserably. The recommended is to uninstall 4.5, then install 5.0 SP1.

Simon