|
Following up on my own post:
In the meantime while waiting to see if MSU has maintenance through the site
license for Symantec Anti-Virus, perhaps someone here has run into the
problem I have run up against. I have been having trouble similar to that
which happened early in February and was discussed here on the NAG list
where the Anti-virus software is quarantining a user's inbox. On other
client machines, it seems like the "Exclusions" rule works and excludes the
Inbox file from scans, thus avoiding the nasty event where a user's entire
Inbox gets quarantined. However, I have one user here who uses Eudora. I
have excluded both the specific file names In.mbx and In.toc (the inbox file
and table of contents file) and that has not worked. I then tried excluding
the entire Eudora folder, but again Symantec quarantined the entire Inbox.
Then I tried excluding the extensions .MBX and .TOC but again to no avail.
I have made sure that the exclusions apply to both real-time protection and
the scheduled daily scans, but nothing seems to get Symantec to exclude the
Eudora inbox file. The exclusions do appear when I close and re-open the AV
client, the files are checked as required to be excluded.
Has anyone ever encountered problems with Symantec's exclusion rules? It is
strange since it seems like exclusions have worked for me in most cases, but
this one keeps failing daily and the user and I are both getting a bit
frustrated at having to recover the inbox from quarantine. As an aside, I
know Symantec also suggests going through all the recent emails looking for
suspicious emails which might contain the offending worm, but upon doing
this I still have not found the bad email. Unfortunatley this particular
user gets a ton of email and leaves all of it in the Inbox even though
suggestions have been made to trim down the inbox some. THus each recovery
from the quarantine is bringing back an inbox of around 300 Megs, and it is
tough to page through every email to get down to the offending one.
Sorry for the long post, but I wanted to let everyone see my logic and poke
holes through it if I have missed anything.
Cameron Williams
---
_______________________________________
Cameron R. Williams
Information Technologist
Center for Global Change and Earth Observations
Michigan State University
101 Manly Miles
East Lansing, MI 48825
(517) 432-4675
[log in to unmask]
|
