RE: [cobalt-security] Solarspeed MailScanner Denial of Service attack in message!

["David Gillard" <dgillard@xxxxxxxxxxxxx>]

Hi

> -----Original Message-----
> From: cobalt-security-admin@xxxxxxxxxxxxxxx [mailto:cobalt-security-
> admin@xxxxxxxxxxxxxxx] On Behalf Of David Gillard
> Sent: 27 September 2003 10:49
> To: cobalt-security@xxxxxxxxxxxxxxx
> Subject: [cobalt-security] Solarspeed MailScanner Denial of Service attack
> in message!
> 
> Hi
> 
> This morning our mailscanner started stopping seemingly uninfected email
> messages.  The only common thing about the virus text reports it is
> producing is it mentions Denial of Service attack in message!.
> 
> We have checked a couple of the other servers which have the Solarspeed
> anti
> virus package and they all appear to be running ok. Has anyone else
> experienced this or are currently experiencing this.
> 

We have now solved this now, it appears that the Mailscanner definition file
last night was corrupt in some way.  We fixed it by re-downloading from
within the GUI interface twice (first time didn't work).  This was affecting
3 out of 12 RaQ550 machines we have looked at so far.  

As the problem meant all email was being quarantined as containing a virus
it will cause a big headache for helpdesks on Monday morning if it has
affected your servers.

Regards

David

David Gillard
Completely Different Solutions