Keep Email Evidence?

[sparkz]

I'm using VirusScan Pro 7 on Windows XP Pro.

I'm having a lot of problems with SPAMers/hackers at the moment. It all started when I made a complaint to someone about illegal use of my email address although I guess there's a long shot it's a coincidence. Within 24 hours I was being bombarded with virus emails (10 in the space of a few minutes). Plus they are sending viruses to others with my name as the sender! Don't you just love these guys!

I can't turn a blind eye to this and need to keep what evidence I can. Is there I can make VirusScan keep the orginal email somewhere without turning it off. If I have to turn if off it kinda makes it a bit pointless having it in the first place. Surely this sort of situation must have arisen before?

Thanks for any help.

Mark

[Rick F]

Hi Mark,

Welcome to McAfee's Help Forum.

Yep, there are a lot of viruses out there now that 'spoof' the sender line (from line) in emails in attempts to get people to open the email.

Not sure what you're trying to do. Keep evidence and not turn off? Keep evidence for what?

You can quarantine any virus rather than delete. Quarantine means to make the virus so it won't run and keep it in the 'quarantine' folder.

[sparkz]

Hi Rick

Thanks for the reply.

If it was just one or two every now and again I would just delete them and forget it but as someone seems to be targeting me I want to pass on any information I can to the originating IP.

I've done a couple but it's a pain as I have to turn off McAfee and kill the agent etc else the email gets deleted straight away.

I couldn't see any options for the email virus detection to make it quarantine them. Is there any way of just making VirusScan warn me about the email and give me total control as to whether I delete it etc.?

Thanks
Mark

[Rick F]

Sure. For System scan settings do the following:

Open VS (double-click on VShield ([or red "M" and open VS]).
Click on 'Configure Automatic Protection Settings'
Click on 'Advanced'
highlight 'System Scan' icon (highlighted in left hand column)
Click on 'Action' tab.
In the pull down press the arrow and select 'prompt for action'
....when that is selected, you'll have more choices below
GUI should be checked
....(GUI = graphical user interface, which means while in Windows)
Under possible actions, tick all the options that you want to choose from when a detection occurs.
Now press 'Apply' and OK.

Do the same thing for email scanning if you use that. I don't as I have POP3 server and use OE (Outlook Express).

Hope this helps.

[sparkz]

I haven't got those options. Are you running the Pro version?

I've got no VShield I can click on only the Security Center. From there I have to go to VirusScan Professional then Options. Here I have an Advanced button. Under Email scan I have already set the "Prompt me when an attachment needs to be cleaned". All this does though is tell you when the email is about to be deleted - no other options.

I guess I'll have to turn off the email scan and manually check them :([/b]

[Rick F]

Sparkz,

I also have VS-7 Pro version. Those options are there for sure... unless you have a different version of McAfee VS? Do you have VS-7 Pro or do you have version 8?

[sparkz]

Sorry, I forgot I upgraded it a couple of weeks ago! It's version 8 Pro. Sounds like they might have taken a few options out?

[Rick F]

Hi Sparkz,

Yes, they did take some of the options out. VS-8 is not written in C++ like prior versions, but uses 'Active-X' plus some other things.

I'm going to move your post to the VS-8 section so those that know can help you. You can follow any posts to this thread in either forum however.

[sparkz]

Thanks

[sparkz]

Typical, I turned off the email scanning today just to make sure I could catch anything and not one virus! Yesterday I had around 30+. Maybe the reports I sent off over the last few days had an effect?

[Kelly_Marshall]

It's possible. The easiest way to turn off mail scanning is to end task on the mcvsescn process.

[sparkz]

Thanks, I'll remember that.

[Kelly_Marshall]

Sure. 8.1 should make it easier than having to end task on a process to kill it.