testvirus.org test #24 - partial vulnerability

[wfbtr]

I'm wondering if anyone has a product that will catch this test email. I use NAV Corporate and Trend Micro ScanMail for Exchange, with EManager. Between the two I can catch all 26 test virus emails except #24.

thanks.

 

[cmeagan656]

I just tried it using CA's InoculateIT v6.0 but it never made it that far. Our spam filter, XWall, picked it up as an exploit.

Cheers.

 

[devastator]

Well at first i caught them all because the reply email got blocked as SPAM.
Then when i excluded TESTVIRUS.org the following emails appeared.
Test 23, 19, 17, 14, 5, and 4.

We run Symantec Corp Edition for Exchange and PC Workstation clients as well as a version for MAC's. (which i ran the test to). We also run a CMD line scanner from McAfee. I am assumming our SPAM filter caught the one yours missed since it reassembles messages before forwarding them on to the Exchange Server.

Interesting results though.

 

[devastator]

Yeah but if you allow it through X-Wall (TESTVIRUS.org) then see what happens. I use X-Wall as well.

 

[devastator]

Just to be complete got my SPAM / Virus report from ESAT and 11 emails were blocked as viruses, another 3 that were let got past McAfee to the Exchange Server got caught in Symantec Mail Security for Exchange. 6 got blocked by X-Wall as exploits and of course 6 made it to my inbox.

 

[wfbtr]

Does it tell you where #24 got caught?

 

[devastator]

Yeah was blocked by X-Wall under the option of "Format" Reassemble message ( removes malformed attachment encoding)

 

[wfbtr]

ok, thanks.
I'll search for that option in my ScanMail.

 

[cmeagan656]

devastator,

When I have XWall allow #24 through it gets through InoculateIT too. :-(

Oh well, as long as XWall catches it before it hits our exchange server.

If I have XWall block exploits and certain level 1 attachments and InoculateIT blocking all level 1 attachments then only 4, 16, and 17 get through.

BTW, InoculateIT caught #23 and 19.

I'm testing using my postmaster account which is exempt from XWall except for attachments, exploits, and internal from.

Cheers.

Cheers.

 

[cmeagan656]

Our #24 got caught as an exploit by XWAll. (Block partial attachment (message partial)).

Cheers.