Re: Microsoft confirms OneCare zaps Outlook, Outlook Express e-mail -- PCTECH

pctech-request@xxxxxxxxxxxx wrote:

   1. Re: Microsoft confirms OneCare zaps Outlook,  Outlook Express
      e-mail (Tom Jedrzejewicz)

The comment was made asking (essentially) how could I send to a list
of software folks statements that shoddy testing is OK.  I never said
that; you all are assuming that because a bug appeared that testing is
shoddy.  I counter that how can we, as software guys, not have some
understanding of the challenges and issues confronting the folks at
Microsoft?


Tom:

I don't know enough about OneCare nor the specific bug to make clearjudgment. Can you clarify about a part that seems odd to me?


The 'fix' is reported to be:

----------

"In the meantime, Microsoft said, users can recover a quarantineddata file by following these instructions:


    * Close Outlook or Outlook Express.
    * Click "Change OneCare Settings" in the OneCare main screen.
    * Click on the "Viruses & Spyware" tab.

* Click on the "Quarantine" button and then select the .pst or.dbx file.

    * Click "Restore."

To prevent OneCare from quarantining the data file between now andnext week, Microsoft recommends that users exclude the .pst or .dbxfiles from scanning.


    * Click "Change OneCare Setting" in the main OneCare screen.
    * Click the "Viruses & Spyware" tab.
    * Click on the "Exclusions" button.
    * Click on the "Add folder" button.

* Navigate to the folder containing the .pst or .dbx to beexcluded, then click "OK.""

----------

And part of the description says "the antimalware engine for OneCareis erroneously quarantining Outlook .pst files or Outlook Express.dbx files, when the .pst file or .dbx file contains an infectedattachment".

So, the bug is basically that the entire file is quarantined whenjust a single e-mail item contains an infection. And the fix is topull the entire file back out of quarantine -- and then to excludeit from further quarantines.


So...

What happens to the infected item? What happens when a new infectede-mail comes two minutes later?


Tom Liotta