Yes, I know this isn’t a Trend support forum, but a number of posters here seem to use Trend products and I wonder if any of you have seen this:
Worm email containing Klez.H arrives at Domino 6.0.1 server running Trend ScanMail for LN version 2.6 with scan engine 6.510-1002 and pattern file 486.
Message passes right by ScanMail and lands in victim’s mailbox intact!
On detaching .exe file into host OS, client AV software (eTrust Innoculate-IT) immediately kicks in and deletes said file, warning that it has found Klez.H.
On disabling client AV, saving .exe to OS, creating new test email in Notes and attaching said .exe file, Trend ScanMail spots and deletes Klez.H immediately the test email is sent.
On creating a new MIME email using Outlook Express, attaching said .exe file and injecting via SMTP into any Domino server running the same combination of software as above, ScanMail spots and deletes the attachment, correctly identifying it as Klez.H.
On viewing the MIME of the original, unmolested message, still containing the viral payload, copying this to the clipboard intact, then telnetting to port 25 of any Domino server running the same combination of software as above and hand cranking a message through using HELO, MAIL FROM, RCPT TO, DATA then pasting the original MIME and typing . on a blank line to finish (pause for breath) - viral message is once again delivered without ScanMail doing anything to it.
This is 100% reproducible.
The only difference is the MIME rendering of the three types of test. Notes MIME is lovely (we all know that, don’t we). Outlook Express seems to do a decent job, rendering as multipart/mixed. The original MIME of the worm message is badly broken, with the whole thing being rendered as multipart/alternative and the viral payload being the second alternative part.
This appears to confuse the ScanMail MIME renderer, though not the Lotus Notes client which renders the first alternative part (text/html) as rich text, then inserts a page break and shows the two attachments including the one with the viral payload.
It occurs to me that producing syntactically correct MIME is not high on the agenda of most virus writers, so if this is a broken MIME issue, other sites are likely seeing the same thing 
Anyone else seeing this? I thought virus activity was suspiciously low at the moment, but at least this variant of Klez if not others just strolls past my Trend ScanMail installation and Trend themselves have it in their hot list at the moment.