For what it is worth after finally figuring out what all had to be changed
to switch from pr to AV rules (which was not obvious to me at least before
I sat down and basically blew away our A/V rules and recreated them) this
problem appears to have disappeared for us.

-S


On Wed, 15 Mar 2006, Simon Bell wrote:

> Return-Path: <[log in to unmask]>
> Received: from localhost by genesis with LMTP; Wed,
>      15 Mar 2006 13:45:50 -0600
> Received: from smtp01.valpo.edu (smtp01.valpo.edu [152.228.33.51])
> 	by genesis.valpo.edu (Switch-3.1.7/Switch-3.1.0) with ESMTP id
>     k2FJjn41004947;
> 	Wed, 15 Mar 2006 13:45:49 -0600 (CST)
> Received: from localhost (localhost [127.0.0.1])
> 	by smtp01.valpo.edu (8.12.11/8.12.9) with ESMTP id k2FJjnke025179;
> 	Wed, 15 Mar 2006 13:45:49 -0600 (CST)
> Received: from smtp01.valpo.edu ([127.0.0.1])
>  by localhost (smtp01 [127.0.0.1]) (amavisd-new, port 10024) with ESMTP
>  id 23355-09; Wed, 15 Mar 2006 13:45:46 -0600 (CST)
> Received: from listserv.muohio.edu (listserv.muohio.edu [134.53.7.26])
> 	by smtp01.valpo.edu (8.12.11/8.12.9) with ESMTP id k2FJjkKp025147;
> 	Wed, 15 Mar 2006 13:45:46 -0600 (CST)
> Received: from nasw2k01 (listserv.muohio.edu) by listserv.muohio.edu
>     (LSMTP for Windows NT v1.1b) with SMTP id
>     <[log in to unmask]>; Wed, 15 Mar 2006 14:45:46 -0500
> Received: by LISTSERV.MUOHIO.EDU (LISTSERV-TCP/IP release 14.3) with
>     spool id
>           45353662 for [log in to unmask]; Wed, 15 Mar 2006 14:44:26
>           -0500
> Received: from mulnx12.mcs.muohio.edu by listserv.muohio.edu (LSMTP for
>     Windows
>           NT v1.1b) with SMTP id <[log in to unmask]>; Wed,
>      15 Mar
>           2006 14:44:26 -0500
> Received: from mulnx24.mcs.muohio.edu (mulnx24.mcs.muohio.edu
>     [134.53.6.11]) by
>           mulnx12.mcs.muohio.edu (Switch-3.1.6/Switch-3.1.6) with ESMTP id
>           k2FJQNkD014742 for <[log in to unmask]>; Wed, 15 Mar 2006
>           14:26:39 -0500
> Received: from eagle4.cc.GeorgiaSouthern.edu (my2.GeorgiaSouthern.edu
>           [141.165.4.108]) by mulnx24.mcs.muohio.edu
>           (Switch-3.1.6/Switch-3.1.6) with SMTP id k2FJQMAR009696 for
>           <[log in to unmask]>; Wed, 15 Mar 2006 14:26:23 -0500
> Received: from groupwise.georgiasouthern.edu
>     (groupwise.GeorgiaSouthern.edu
>           [141.165.4.101]) by eagle4.cc.GeorgiaSouthern.edu
>     (8.13.4/8.13.4)
>           with ESMTP id k2FJQMks013528 for <[log in to unmask]>;
>     Wed,
>           15 Mar 2006 14:26:22 -0500 (EST)
> Received: from GASOU_GROUPWISE-MTA by groupwise.georgiasouthern.edu with
>           Novell_GroupWise; Wed, 15 Mar 2006 14:26:22 -0500
> X-Mailer: Novell GroupWise Internet Agent 7.0
> References: <[log in to unmask]>
> Mime-Version: 1.0
> Content-Type: text/plain; charset=US-ASCII
> Content-Transfer-Encoding: 7bit
> Content-Disposition: inline
> X-Real-ConnectIP: 141.165.4.108
> Message-ID: <[log in to unmask]>
> Date: Wed, 15 Mar 2006 14:26:03 -0500
> Reply-To: Perfigo SecureSmart and CleanMachines Discussion List
>     <[log in to unmask]>
> Sender: Perfigo SecureSmart and CleanMachines Discussion List
>     <[log in to unmask]>
> From: Simon Bell <[log in to unmask]>
> Subject: Re: Norton Internet Security 2006 - Def Files
> To: [log in to unmask]
> In-Reply-To: <[log in to unmask]>
> Precedence: list
> X-Virus-Scanned: by amavisd-new at valpo.edu
>
> Has this problem been fixed an I just missed it? I've got a user with me
> now who's experiencing this problem.
>
> Simon
>
> >>> [log in to unmask] 2/2/2006 4:02 PM >>>
> We use the AV Rules. The way our setup is:
>
> - We have four AV Rules in place:
> 	Virus_installation_XP-2K - ANY checked for Install
> 	Virus_installation_ME-98 - ANY checked for Install
> 	Virus_definition_check_ME-98 - ANY checked for Def
> 	Virus_definition_check_XP-2K - ANY checked for Def
> - We then have two requirements:
> 	"Antivirus Software Not Detected"
> 	"Antivirus Software Out Of Date / Expired"
>
> Within each requirement, we have the proper AV Rule checked for each
> version of Windows: 98/ME or 2000/XP. We allow students CCA users to
> have any AV installed as long as it is valid and up to date.
>
>
>
>
>
> Timothy Grzeczka
> Network Analyst
> Dominican University
> [log in to unmask]
> Voice - (708) 524-6568
> Fax - (708) 488-5111
>

-------------------------------------------------------------------------------
Simon Kissler                                   [log in to unmask]
UNIX Systems Administrator			Phone: (219) 464 6773
Electronic Information Services                 Fax  : (219) 464 5381
Valparaiso University
Kretzmann Hall B22
Valparaiso, IN 46383
-------------------------------------------------------------------------------

                 "A program is a spell cast over a computer,
                   turning input into error messages."
                                                       -Anon.

-------------------------------------------------------------------------------