Bugtraq: Re: Virus Scan Attack

["Paul Knibbs" <pknibbs () 3t co uk>]

This isn't a DoS as such. The problem occurs because the 4.1.60 scan
engine for McAfee products isn't compatible with the 4367 DATs. In order
to use these DATs you have to update your scan engine, which probably
requires disabling WebShield and running the SuperDAT updater--this is
what I had to do with our Exchange server (running GroupShield)
yesterday morning!

Nate Nord wrote:
> Just wondering if anyone else has seen this come through their mail
portal.
> Something has caused our McAfee Webshield SMTP to seriously eat 
> processor time... to the point that it will no longer forward scanned 
> mail.  I've had to temporarily bypass it until I figure out what it's 
> choking on.  I saw several other posts that said this sent processors 
> into some kind of loop and this is exactly what appears to be
happening with our portal.
>

Paul Knibbs
Systems Administrator
3T Productions Ltd
T: 0161 492 1400  F: 0161 492 1401
www.3t.co.uk