 |
 |
Following up on my own post: In the meantime while waiting to see if MSU has maintenance through the site license for Symantec Anti-Virus, perhaps someone here has run into the problem I have run up against. I have been having trouble similar to that which happened early in February and was discussed here on the NAG list where the Anti-virus software is quarantining a user's inbox. On other client machines, it seems like the "Exclusions" rule works and excludes the Inbox file from scans, thus avoiding the nasty event where a user's entire Inbox gets quarantined. However, I have one user here who uses Eudora. I have excluded both the specific file names In.mbx and In.toc (the inbox file and table of contents file) and that has not worked. I then tried excluding the entire Eudora folder, but again Symantec quarantined the entire Inbox. Then I tried excluding the extensions .MBX and .TOC but again to no avail. I have made sure that the exclusions apply to both real-time protection and the scheduled daily scans, but nothing seems to get Symantec to exclude the Eudora inbox file. The exclusions do appear when I close and re-open the AV client, the files are checked as required to be excluded. Has anyone ever encountered problems with Symantec's exclusion rules? It is strange since it seems like exclusions have worked for me in most cases, but this one keeps failing daily and the user and I are both getting a bit frustrated at having to recover the inbox from quarantine. As an aside, I know Symantec also suggests going through all the recent emails looking for suspicious emails which might contain the offending worm, but upon doing this I still have not found the bad email. Unfortunatley this particular user gets a ton of email and leaves all of it in the Inbox even though suggestions have been made to trim down the inbox some. THus each recovery from the quarantine is bringing back an inbox of around 300 Megs, and it is tough to page through every email to get down to the offending one. Sorry for the long post, but I wanted to let everyone see my logic and poke holes through it if I have missed anything. Cameron Williams --- _______________________________________ Cameron R. Williams Information Technologist Center for Global Change and Earth Observations Michigan State University 101 Manly Miles East Lansing, MI 48825 (517) 432-4675 [log in to unmask]