Inbox Virus Problem - Pegasus

Geoff Lane <geoff@REMOVE3lanes.freeserve.co.uk> wrote in
news:dbjom01k66nan4frcfun51h5e8hus1k7cc@4ax.com:

> I am baffled; AVG resident shield told me I had netsky.q i-worm virus
> and advised that I ran AVG to remove.
>
> Showed the location as C:\pmail\mail\geoff\P0POOUJ3.CNM (The second
> digit was a zero and the 4th and 5th were capital O)
>
> Ran AVG and was told 'No virus detected'
>
> Ran a DOSversion of F-Prot and that did not detect a virus.
>
> I run my computer behind a NAT router, I use ZA (free version) and
> Pegasus as my mailreader.
>
> I downloaded my mail to Pegasus and got the AVG resident shield
> message; every 10/15 seconds a message appeared in my inbox, in the
> listing window it appeared in red but showed no sender or subject,
> each message was 29k.
>
> I could not delete any of these messages which gradually increased
> until I shut down Pegasus. If I reopened Pegasus same problem occured,
> same message, new listing every 10/15 seconds.
>
> I eventually deleted the file via DOS and everything appears back to
> normal; anyone any ideas what the problem could be.
>
I have no idea what causes it, but I've seen the same thing here at work.

--
Terry Austin
www.hyperbooks.com
Campaign Cartographer now available

On Tue, 12 Oct 2004 22:38:27 -0000, No 33 Secretary
<taustin+usenet@hyperbooks.com> wrote:

>Geoff Lane <geoff@REMOVE3lanes.freeserve.co.uk> wrote in
>news:dbjom01k66nan4frcfun51h5e8hus1k7cc@4ax.com:
>
>> I am baffled; AVG resident shield told me I had netsky.q i-worm virus
>> and advised that I ran AVG to remove.

>> I downloaded my mail to Pegasus and got the AVG resident shield
>> message; every 10/15 seconds a message appeared in my inbox, in the
>> listing window it appeared in red but showed no sender or subject,
>> each message was 29k.

>I have no idea what causes it, but I've seen the same thing here at work.

Was it a suspicious file that caused it?

Geoff Lane

On Wed, 13 Oct 2004 08:30:01 +0100, Geoff Lane
<geoff@REMOVE3lanes.freeserve.co.uk> wrote:

>On Tue, 12 Oct 2004 22:38:27 -0000, No 33 Secretary
><taustin+usenet@hyperbooks.com> wrote:
>
>>Geoff Lane <geoff@REMOVE3lanes.freeserve.co.uk> wrote in
>>news:dbjom01k66nan4frcfun51h5e8hus1k7cc@4ax.com:
>>
>>> I am baffled; AVG resident shield told me I had netsky.q i-worm virus
>>> and advised that I ran AVG to remove.
>
>>> I downloaded my mail to Pegasus and got the AVG resident shield
>>> message; every 10/15 seconds a message appeared in my inbox, in the
>>> listing window it appeared in red but showed no sender or subject,
>>> each message was 29k.
>
>>I have no idea what causes it, but I've seen the same thing here at work.
>
>Was it a suspicious file that caused it?

I get this all the time with AVG & Pegasus on a system that uses UUCP mail
transport. The same emails that come to another system running POP3 doesn't
get these extra messages coming in.

I reported it in the newsgroup along with a photo ages ago (sep & Oct last
year in fact). Never heard anything from anyone though, and the bug is still
there.
The photo is actually still there at
http://www.geocities.com/dpbaker1061/PMail_err.gif

What this means is that you can't let PMail run by itself - I'm currently
looking after a friend's email & forwarding them on from his UUCP account to
his POP3 account, and I have to stop PMail & then run AVG to clean the virus
out & restart PMail about once per day. Most annoying.

Dave

The email address used for sending these postings is not valid.
All replies to the group please.

This issue will probably be fixed in the next version, David Harris has
already changed some processing issues which can interfere with AV
scanners.

On Wed, 13 Oct 2004 15:56:36 +0800, Dave Baker
<newsgroup_poster@jodael.com> wrote:

> I get this all the time with AVG & Pegasus on a system that uses UUCP mail
> transport. The same emails that come to another system running POP3 doesn't
> get these extra messages coming in.
>
> I reported it in the newsgroup along with a photo ages ago (sep & Oct last
> year in fact). Never heard anything from anyone though, and the bug is still
> there.
> The photo is actually still there at
> http://www.geocities.com/dpbaker1061/PMail_err.gif
>
> What this means is that you can't let PMail run by itself - I'm currently
> looking after a friend's email & forwarding them on from his UUCP account to
> his POP3 account, and I have to stop PMail & then run AVG to clean the virus
> out & restart PMail about once per day. Most annoying.
>
> Dave
>
> The email address used for sending these postings is not valid.
> All replies to the group please.



Michael

--
PGP Key ID (RSA 2048): 0xC45D831B
PGP Plugin for Pegasus Mail: <http://www.pmpgp.de/pmpgp/>

Geoff Lane <geoff@REMOVE3lanes.freeserve.co.uk> wrote in
news:u9mpm0946gd2s13o6hle9vtgple9f5nbtd@4ax.com:

> On Tue, 12 Oct 2004 22:38:27 -0000, No 33 Secretary
> <taustin+usenet@hyperbooks.com> wrote:
>
>>Geoff Lane <geoff@REMOVE3lanes.freeserve.co.uk> wrote in
>>news:dbjom01k66nan4frcfun51h5e8hus1k7cc@4ax.com:
>>
>>> I am baffled; AVG resident shield told me I had netsky.q i-worm virus
>>> and advised that I ran AVG to remove.
>
>>> I downloaded my mail to Pegasus and got the AVG resident shield
>>> message; every 10/15 seconds a message appeared in my inbox, in the
>>> listing window it appeared in red but showed no sender or subject,
>>> each message was 29k.
>
>>I have no idea what causes it, but I've seen the same thing here at work.
>
> Was it a suspicious file that caused it?
>
As far as I can tell, it's one a message with an encrypted zip file virus
in it. No idea which one, as it was easier to just show the user how to
delete the right .cnm file.

--
Terry Austin
www.hyperbooks.com
Campaign Cartographer now available

On Wed, 13 Oct 2004 15:56:36 +0800, Dave Baker
<newsgroup_poster@jodael.com> wrote:


>>>I have no idea what causes it, but I've seen the same thing here at work.
>>
>>Was it a suspicious file that caused it?
>
>I get this all the time with AVG & Pegasus on a system that uses UUCP mail
>transport.

>I reported it in the newsgroup along with a photo ages ago (sep & Oct last
>year in fact). Never heard anything from anyone though, and the bug is still
>there.
>The photo is actually still there at
>http://www.geocities.com/dpbaker1061/PMail_err.gif

Yep, that is similar to what I got.

Can't recall what transport it came by though.

Geoff Lane

On Tue, 12 Oct 2004 22:35:41 +0100, Geoff Lane
<geoff@REMOVE3lanes.freeserve.co.uk> wrote:

>I am baffled; AVG resident shield told me I had netsky.q i-worm virus
>and advised that I ran AVG to remove.
>
>Showed the location as C:\pmail\mail\geoff\P0POOUJ3.CNM (The second
>digit was a zero and the 4th and 5th were capital O)
>
>Ran AVG and was told 'No virus detected'
>
>Ran a DOSversion of F-Prot and that did not detect a virus.
>
>I run my computer behind a NAT router, I use ZA (free version) and
>Pegasus as my mailreader.
>
>I downloaded my mail to Pegasus and got the AVG resident shield
>message; every 10/15 seconds a message appeared in my inbox, in the
>listing window it appeared in red but showed no sender or subject,
>each message was 29k.
>
>I could not delete any of these messages which gradually increased
>until I shut down Pegasus. If I reopened Pegasus same problem occured,
>same message, new listing every 10/15 seconds.
>
>I eventually deleted the file via DOS and everything appears back to
>normal; anyone any ideas what the problem could be.
>
>Geoff Lane

I've seen similar issues to this before with AVG, and with Trend
Micro's PC-Cillin.

The multiple detections are due to Pegasus Mail opening the message to
get the information for the Inbox display, and the setting in Pegasus
Mail is under Tools / Options / Advanced Settings: Refresh New Mail
Folder view every ____ secs

The trouble is, every time it opens the new mail message file, the
resident AV detects that there's a virus in the file. It seems like
the AV software often can't do anything to the file because Pegasus
Mail has locked the file, since Pegasus is using the file. The thing
to do is make note of the file name, close Pegasus, then delete the
file manually.

Hope this helps,
Anthony Albert

On Wed, 13 Oct 2004 21:42:56 GMT, ajalbert@excite.com (Anthony J.
Albert) wrote:

>>I am baffled; AVG resident shield told me I had netsky.q i-worm virus
>>and advised that I ran AVG to remove.
>>
>>Showed the location as C:\pmail\mail\geoff\P0POOUJ3.CNM (The second
>>digit was a zero and the 4th and 5th were capital O)

>>I downloaded my mail to Pegasus and got the AVG resident shield
>>message; every 10/15 seconds a message appeared in my inbox, in the
>>listing window it appeared in red but showed no sender or subject,
>>each message was 29k.

>The multiple detections are due to Pegasus Mail opening the message to
>get the information for the Inbox display, and the setting in Pegasus
>Mail is under Tools / Options / Advanced Settings: Refresh New Mail
>Folder view every ____ secs
>
>The trouble is, every time it opens the new mail message file, the
>resident AV detects that there's a virus in the file. It seems like
>the AV software often can't do anything to the file because Pegasus
>Mail has locked the file, since Pegasus is using the file. The thing
>to do is make note of the file name, close Pegasus, then delete the
>file manually.

Very helpful thanks.

I thought it was a problem with pegasus but it seems due to the safety
features.

I have deleted the file via DOS..

Geoff Lane

Actually, you just have to close the preview pane and the offending mail
folder. Then you can run AVG delete the virused mail and continue.

This is if you are using the free version of AVG. AVG 7 has set-up
options and instructions for Pegasus mail.

On Wed, 13 Oct 2004 21:42:56 GMT, Anthony J. Albert <ajalbert@excite.com>
wrote:

> On Tue, 12 Oct 2004 22:35:41 +0100, Geoff Lane
> <geoff@REMOVE3lanes.freeserve.co.uk> wrote:
>
>> I am baffled; AVG resident shield told me I had netsky.q i-worm virus
>> and advised that I ran AVG to remove.
>>
>> Showed the location as C:\pmail\mail\geoff\P0POOUJ3.CNM (The second
>> digit was a zero and the 4th and 5th were capital O)
>>
>> Ran AVG and was told 'No virus detected'
>>
>> Ran a DOSversion of F-Prot and that did not detect a virus.
>>
>> I run my computer behind a NAT router, I use ZA (free version) and
>> Pegasus as my mailreader.
>>
>> I downloaded my mail to Pegasus and got the AVG resident shield
>> message; every 10/15 seconds a message appeared in my inbox, in the
>> listing window it appeared in red but showed no sender or subject,
>> each message was 29k.
>>
>> I could not delete any of these messages which gradually increased
>> until I shut down Pegasus. If I reopened Pegasus same problem occured,
>> same message, new listing every 10/15 seconds.
>>
>> I eventually deleted the file via DOS and everything appears back to
>> normal; anyone any ideas what the problem could be.
>>
>> Geoff Lane
>
> I've seen similar issues to this before with AVG, and with Trend
> Micro's PC-Cillin.
>
> The multiple detections are due to Pegasus Mail opening the message to
> get the information for the Inbox display, and the setting in Pegasus
> Mail is under Tools / Options / Advanced Settings: Refresh New Mail
> Folder view every ____ secs
>
> The trouble is, every time it opens the new mail message file, the
> resident AV detects that there's a virus in the file. It seems like
> the AV software often can't do anything to the file because Pegasus
> Mail has locked the file, since Pegasus is using the file. The thing
> to do is make note of the file name, close Pegasus, then delete the
> file manually.
>
> Hope this helps,
> Anthony Albert



--
Using M2, Opera's revolutionary e-mail client: http://www.opera.com/m2/