Community Discussions and Support
Generic.Peed.eml virus slipping through AV via Preview pane?

I did find the following help document at the Bitdefender website:

http://kb.bitdefender.com/KB151-en--Virus-scanning-from-command-prompt.html

Converting the info here to what's needed in the CmdLine= code isn't straightforward, but this is all that's available-- I did a LOT of scouring looking for this kind of information.  So any other BitDefender + Pegasus users can hopefully use this too.


I did find the following help document at the Bitdefender website: http://kb.bitdefender.com/KB151-en--Virus-scanning-from-command-prompt.html Converting the info here to what's needed in the CmdLine= code isn't straightforward, but this is all that's available-- I did a LOT of scouring looking for this kind of information.  So any other BitDefender + Pegasus users can hopefully use this too.

Hi all, first time poster here.  Please be gentle. :-)

I've been seeing some new behavior in the past couple weeks that prompts me to seek advice.  I've been faithfully using Pegasus since about 1994, always keeping up with the latest versions (using 4.41 now).  I use it on two late-model HP desktops, both running Windows XP Pro, always up to date patchwise.  The behavior I'm reporting is happening on both machines (one at home, one in the office).  About six months ago I switched my AV from Norton corporate client to Bit Defender v. 10.  The combination has worked very well, but recently something has started to slip through and I'm not sure why.  The details:

I've been getting spam emails containing a virus designated Generic.Peed.eml.XXXXXX where XXXXXX is some randomly-generated alphanumeric.  When Pegasus goes out to check for new mail and there is such a message in my server's inbox, Bit Defender duly pops up a box showing its presence and informing me that it did not infect my machine.  However, Pegasus then freezes with the offending message listed in my New Mail folder, or at least partially listed-- sometimes only some characters in the subject line field, sometimes just a date/time.  I have to kill the winpm-32.exe process in Task Manager to get out of it.  After that, relaunching Pegasus shows the error message that the mailbox was locked, only continue if you know there is not another copy running, etc.  Proceeding from there puts Pegasus right back in the same freezed-up state, same visible infected message(s) in New Mail.  I can fix it by going into Windows Explorer, highlighting C:\PMAIL, and scanning with Bit Defender.  It finds the infected file(s) in the ADMIN folder, where it looks like they've been given their encrypted Pegasus file names e.g. PU34PE78.CNM or whatever.  I can then quarantine/remove them, and Pegasus fires up normally after that.  Until, of course, the next infected emails arrive, then I have to go through this all over again.

I've read a couple threads on here this morning about the order in which Pegasus applies filters, and that the Preview pane cannot be disabled "stickily", i.e. deselecting Preview will not persist when Pegasus is closed and launched again later.  I suspect that some subtle interaction of 1) the timing with which Pegasus applies its filtering, 2) that Preview cannot be forced to be off when Pegasus loads, and 3) with which Bit Defender does its incoming-email scan is allowing this to happen.  I'm reluctant to abandon Bit Defender, as it has demonstrated its high quality and I paid $$ for it.  

Also, I have checked the option to apply incoming filter rules to previewed messages, which I did not have checked before; perhaps that will help.

Hoping someone has some useful insight.  Sorry this was so long.

Dave in Albuquerque, NM, USA

Hi all, first time poster here.  Please be gentle. :-) I've been seeing some new behavior in the past couple weeks that prompts me to seek advice.  I've been faithfully using Pegasus since about 1994, always keeping up with the latest versions (using 4.41 now).  I use it on two late-model HP desktops, both running Windows XP Pro, always up to date patchwise.  The behavior I'm reporting is happening on both machines (one at home, one in the office).  About six months ago I switched my AV from Norton corporate client to Bit Defender v. 10.  The combination has worked very well, but recently something has started to slip through and I'm not sure why.  The details: I've been getting spam emails containing a virus designated Generic.Peed.eml.XXXXXX where XXXXXX is some randomly-generated alphanumeric.  When Pegasus goes out to check for new mail and there is such a message in my server's inbox, Bit Defender duly pops up a box showing its presence and informing me that it did not infect my machine.  However, Pegasus then freezes with the offending message listed in my New Mail folder, or at least partially listed-- sometimes only some characters in the subject line field, sometimes just a date/time.  I have to kill the winpm-32.exe process in Task Manager to get out of it.  After that, relaunching Pegasus shows the error message that the mailbox was locked, only continue if you know there is not another copy running, etc.  Proceeding from there puts Pegasus right back in the same freezed-up state, same visible infected message(s) in New Mail.  I can fix it by going into Windows Explorer, highlighting C:\PMAIL, and scanning with Bit Defender.  It finds the infected file(s) in the ADMIN folder, where it looks like they've been given their encrypted Pegasus file names e.g. PU34PE78.CNM or whatever.  I can then quarantine/remove them, and Pegasus fires up normally after that.  Until, of course, the next infected emails arrive, then I have to go through this all over again. I've read a couple threads on here this morning about the order in which Pegasus applies filters, and that the Preview pane cannot be disabled "stickily", i.e. deselecting Preview will not persist when Pegasus is closed and launched again later.  I suspect that some subtle interaction of 1) the timing with which Pegasus applies its filtering, 2) that Preview cannot be forced to be off when Pegasus loads, and 3) with which Bit Defender does its incoming-email scan is allowing this to happen.  I'm reluctant to abandon Bit Defender, as it has demonstrated its high quality and I paid $$ for it.   Also, I have checked the option to apply incoming filter rules to previewed messages, which I did not have checked before; perhaps that will help. Hoping someone has some useful insight.  Sorry this was so long. Dave in Albuquerque, NM, USA

Bit Defender is grabbing the mail from WinPMail breaking the program.  Turn off the Bit Defender  mail checking and use Martin Ireland's Virscan extension to call Bit Defender for the virus checks.  Much cleaner.

 Name of Program: VIRSCAN: Virus Scanning Extension for Pegasus Mail
Location/Filename <URL:mailto:Martin.Ireland@gov.ab.ca?Subject=send_virscan>
<URL:ftp://risc.ua.edu/pegasus/misc/virscan.zip>
Author/email contact: Martin Ireland <Martin.Ireland@gov.ab.ca>
Status: Freeware
Documentation: Included in zip file, Virscan.zip
Features: Extension to invoke virus scanning program of user choice when Pegasus Mail saves or views mail message attachments.
Comments: Available for Windows PCs. 16 and 32 bit versions available and tested on Windows 95, 98, and Windows NT Workstation 4.0.
Defaults to NAI's VirusScan engine. Multi-language support included.  

&lt;p&gt;Bit Defender is grabbing the mail from WinPMail breaking the program.&amp;nbsp; Turn off the Bit Defender&amp;nbsp; mail checking and use Martin Ireland&#039;s Virscan extension to call Bit Defender for the virus checks.&amp;nbsp; Much cleaner.&lt;/p&gt;&lt;p&gt;&amp;nbsp;Name of Program: VIRSCAN: Virus Scanning Extension for Pegasus Mail Location/Filename &amp;lt;URL:mailto:Martin.Ireland@gov.ab.ca?Subject=send_virscan&amp;gt; &amp;lt;URL:ftp://risc.ua.edu/pegasus/misc/virscan.zip&amp;gt; Author/email contact: Martin Ireland &amp;lt;Martin.Ireland@gov.ab.ca&amp;gt; Status: Freeware Documentation: Included in zip file, Virscan.zip Features: Extension to invoke virus scanning program of user choice when Pegasus Mail saves or views mail message attachments. Comments: Available for Windows PCs. 16 and 32 bit versions available and tested on Windows 95, 98, and Windows NT Workstation 4.0. Defaults to NAI&#039;s VirusScan engine. Multi-language support included. &amp;nbsp; &lt;/p&gt;

Thanks Thomas, as it happens I was downloading that probably as you were typing in your reply!

One thing I'm not sure about is how to write the CmdLine= entry in the .ini file for Bitdefender.  I'll try to dig through its documentation to see which command line switches I'd need to invoke.

Thanks Thomas, as it happens I was downloading that probably as you were typing in your reply! One thing I&#039;m not sure about is how to write the CmdLine= entry in the .ini file for Bitdefender. &nbsp;I&#039;ll try to dig through its documentation to see which command line switches I&#039;d need to invoke.
live preview
enter atleast 10 characters
WARNING: You mentioned %MENTIONS%, but they cannot see this message and will not be notified
Saving...
Saved
With selected deselect posts show selected posts
All posts under this topic will be deleted ?
Pending draft ... Click to resume editing
Discard draft