Re: [Declude.Virus] Declude Gateway First Phase Beta

2006-08-02 Thread Info Wind

Dear David,

we are interested.

Greetings,
Uwe

Wind Internethaus GmbH
Am Krebsgraben 15
Haus 2
D-78048 Villingen-Schwenningen

Tel:  +49 7721 40 707 44
Fax: +49 7721 40 707 41
http://www.windinternethaus.de


- Original Message - 
From: David Barker [EMAIL PROTECTED]

To: declude.junkmail@declude.com; declude.virus@declude.com
Sent: Wednesday, August 02, 2006 7:27 PM
Subject: [Declude.Virus] Declude Gateway First Phase Beta



I am currently looking for 4 more First Phase Beta testers for the Declude
Gateway.

The Declude Gateway will have to be installed on a separate server to you
Imail or SmarterMail server and we would suggest not using it in a
production enviroment.

If you are interested please email me directly.

Thanks
David Barker
Product Manager
Your Email security is our business
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.





---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.



Re: [Declude.Virus] 4.2.3 Built-in scanner

2006-05-09 Thread Info Wind

Dear David,

since I use 4.2.3 I get always Unknown Virus in Unknown File in the 
message. It seems that the Virusname variables have a problem. Could you 
check this?


Thank you,
Uwe

- Original Message - 
From: David Barker [EMAIL PROTECTED]

To: Declude.Virus@declude.com
Sent: Tuesday, May 09, 2006 3:13 PM
Subject: RE: [Declude.Virus] 4.2.3 Built-in scanner



1. Use the test virus sender http://www.declude.com/Articles.asp?ID=99
2. Check your virus logs
3. Declude\Scanners\AVG\DB
4. Check the date on the database files

David B
www.declude.com

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Shacklett
Sent: Tuesday, May 09, 2006 8:45 AM
To: Declude.Virus@declude.com
Subject: [Declude.Virus] 4.2.3 Built-in scanner


How do I determine if the built-in scanner is working? Where do the virus
signature files live? How do I tell if those files are being updated?

--

John S

---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe, 
just

send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] Declude with IMail 8.22?

2005-12-22 Thread Info Wind

Dear Grant,

we are running 8.22 with 3.0.5.22 (newest one) and we have no problems.

Uwe

- Original Message - 
From: Grant Griffith [EMAIL PROTECTED]

To: Declude.Virus@declude.com
Sent: Thursday, December 22, 2005 11:02 AM
Subject: [Declude.Virus] Declude with IMail 8.22?



Hello All,

We just upgrade to Imail 8.22 overnight and was wanting to check and see
what version of Declude everyone was running with it.  We are still 
running
version 2.0.6.16 right now and remember some talk a while back that you 
need

to upgrade to a newer version as 8.22 added some things that gave Declude
problems.  Can anyone let me know what version they are running without
issues with Imail 8.22?

Thanks,
Grant Griffith
EI8HTLEGS, A Division of ETC
(812)932-1000


---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


[Declude.Virus] Mcafee with 5000 engine tested?

2005-12-11 Thread Info Wind



Does somenone already works with the new 5000-er 
engine?
Does someone has experience?

Thanks for information,
Uwe


Re: [Declude.Virus] Blocking PIF Files

2005-11-23 Thread Info Wind

virus.cfg:

BANEXT PIF

If you also want to block them in zips and encrypted zip:
BANZIPEXTS ON
BANEZIPEXTS ON

Uwe

- Original Message - 
From: Dan Geiser [EMAIL PROTECTED]

To: Declude.Virus@declude.com
Sent: Wednesday, November 23, 2005 3:26 PM
Subject: [Declude.Virus] Blocking PIF Files



Hello, All,
I don't know whether this would be more appropriate for the virus list or 
the junkmail list so please point me towards junkmail if appropriate.


What is the proper technique for blocking messages that have an attachment 
that ends in a pif extension like your_letter.pif?


We are currently using Declude 2.0.6 JunkMail Pro and Virus Standard.

Thanks In Advance!
Dan Geiser
[EMAIL PROTECTED]
---
E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan)

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] Blocking PIF Files

2005-11-23 Thread Info Wind

Dan,

sorry, my information was perhaps not correct.
BANEXT PIF  should run in Standard and Pro version.
Darin is more experient with this and he mailed that the 
BANZIPEXTS/BANEZIPEXTS only run in the pro version.


Uwe

- Original Message - 
From: Dan Geiser [EMAIL PROTECTED]

To: Declude.Virus@declude.com
Sent: Wednesday, November 23, 2005 3:52 PM
Subject: Re: [Declude.Virus] Blocking PIF Files


Thanks, Uwe.  Do you know if both of the below techniques work in with 
Declude Virus Standard?


Thanks,
Dan

- Original Message - 
From: Info Wind [EMAIL PROTECTED]

To: Declude.Virus@declude.com
Sent: Wednesday, November 23, 2005 9:47 AM
Subject: Re: [Declude.Virus] Blocking PIF Files



virus.cfg:

BANEXT PIF

If you also want to block them in zips and encrypted zip:
BANZIPEXTS ON
BANEZIPEXTS ON

Uwe

- Original Message - 
From: Dan Geiser [EMAIL PROTECTED]

To: Declude.Virus@declude.com
Sent: Wednesday, November 23, 2005 3:26 PM
Subject: [Declude.Virus] Blocking PIF Files



Hello, All,
I don't know whether this would be more appropriate for the virus list 
or the junkmail list so please point me towards junkmail if appropriate.


What is the proper technique for blocking messages that have an 
attachment that ends in a pif extension like your_letter.pif?


We are currently using Declude 2.0.6 JunkMail Pro and Virus Standard.

Thanks In Advance!
Dan Geiser
[EMAIL PROTECTED]
---
E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan)

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.
---
E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan)




---
E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan)

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] Declude Licensing codes

2004-12-23 Thread Info Wind
An idea from me to the new licence policy from Declude:
Is it perhaps possible to expand the Decludce Pro licence to include one 
test system (which only will be used for testing before upgrading and to 
test new features, not for business use)) ?
I think this would also help a lot of declude users, who has problems with 
the new Licence code.

Bye,
Uwe
- Original Message - 
From: Keith Johnson [EMAIL PROTECTED]
To: Declude.Virus@declude.com
Sent: Thursday, December 23, 2004 3:40 PM
Subject: RE: [Declude.Virus] Declude Licensing  codes


Andy,
  Upon your phone call with Barry, should we as Declude Users (4 lic. 
in my case), contact Barry directly before upgrading or should we await 
for a post on this forum for new procedures?  I too have a cold spare, 
however, Declude is not loaded there until necessary and upon written 
procedures that we have in place to shutdown the current server (whether 
down by failure or otherwise), rename it and re-ip it and the like. 
Thanks for the info.

Keith
-Original Message- 
From: [EMAIL PROTECTED] on behalf of Andy Schmidt
Sent: Thu 12/23/2004 9:05 AM
To: Declude.Virus@declude.com; Declude.JunkMail@declude.com
Cc:
Subject: RE: [Declude.Virus] Declude Licensing  codes


Hi,
At the end, there are two components to this:
A) the technique used to validate licenses (e.g., an activation code,
hardware detection, etc.)
B) the procedures on how a questionable situation is handled.
I really don't have a problem with ANY technique as long as I can be
comfortable with the procedures.  If the procedures could even remotely
result in an accidental automatic disabling, I'd no longer be able to
justify use of the product.  Per example, if the procedures involve a long
grace period, or, if the procedures simply allow a License Validation
Staff to REVIEW a questionable license with a customer at a mutually
convenient time, or similar safeguards - then I'm absolutely okay with it.
When Barry called yesterday, I listened and agreed wholeheartedly, that
Declude owes it to is PAYING customers to identify and go after
non-compliant customers.  After all - it's money stolen from the paying
customer (by either having to raise prices or by not being able to invest
into future development as much).
But, I repeated my expectations that NOT details of the techniques need 
to
be disclosed - but there should be sufficient disclosure of the
procedures.  And that should be disclosed BEFORE the software is offered
for download - not AFTER people are starting to get suspicious.

With the information that I was given, I'm perfectly satisfied that I can
continue to use Declude - and I fully support their efforts (in general) 
of
license enforcement.

However, I still hope that Barry recognizes the need that ALL customers 
need
to know enough about the procedures to regain (!) MY level of comfort and
confidence in the company and the product.

Best Regards
Andy Schmidt
Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
(Lists)
Sent: Thursday, December 23, 2004 02:01 AM
To: Declude.Virus@declude.com; Declude.JunkMail@declude.com
Subject: [Declude.Virus] Declude Licensing  codes
Here is some information for all who have concerns about the new licensing
and tie in to IPs and/or MACs:
I have spoken to Barry today, and while I will not reveal the little bit 
of
information I was given, I will state on my honor that I have no problem
with the new license code process what ever you want to call it.

Additionally, Declude has designed and taken steps to make sure there will
be no problems in the event you need to change IPs or hardware overnight, 
on
a weekend, on an extended weekend or even if disaster were to strike and 
the
Declude offices were not available for a week.

Hopefully, you can now rest assured that Declude will not stop working if
you have to fix your server.
FYI, there is also a process in place for a cold spare server to be 
prepared
and ready ahead of time. You will need to contact Declude to specifically
set that up.

John Tolmachoff
Engineer/Consultant/Owner
eServices For You

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe, 
just
send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL 

Re: [Declude.Virus] Getting hammered by viruses

2004-12-16 Thread Info Wind
Dear Markus,
same to us.
Bye,
Uwe
- Original Message - 
From: Markus Gufler [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Thursday, December 16, 2004 4:24 PM
Subject: [Declude.Virus] Getting hammered by viruses


Anyone else is seeing this?
Last week we had an average of 2750 viruses each day.
Two days ago this number increased to 9000.
Yesterday we've catched 19000 viruses.
From the other 16000 messages 9600 was spam.
Markus
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] F-Prot 3.16 available.

2004-11-19 Thread Info Wind
Hello,
it seems that f-prot has a problem at the moment with high traffic:
This is a messages from F-Prot Support:
We have been experiencing extensive traffic on our servers and therefore
downloading from them has been very slow.  Our network administrator is
working on this issue and it should be fixed shortly.  Please try the update
again, it should be successful.
Nice weekend,
Uwe
- Original Message - 
From: Hirthe, Alexander [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, November 19, 2004 5:52 PM
Subject: [Declude.Virus] F-Prot 3.16 available.


Hello,
fyi:
--
FRISK Software has released version 3.16 of F Prot Antivirus
for Windows as well as versions 4.4.8 of F-Prot Antivirus for
all UNIX based platforms.
More information on these releases can be found on our
website:
http://www.f-prot.com/news/gen_news/041118_release_win316.html
http://www.f-prot.com/news/gen_news/041119_release_unix_all.html
We recommend that users of F-Prot Antivirus for Windows, for
Linux x86, for BSD x86, for Solaris x86, for Solaris SPARC,
for AIX on IBM pSeries and for Linux on IBM zSeries update
their programs to these newest versions as soon as
possible.
--
No, I won't install it friday evening :)
Alex
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] Fprot GDI Scanner lines.

2004-09-28 Thread Info Wind
Dear Marc,

where did you get the dos scanner for f-prot? On the page of F-prot there is
still only Version 3.15A available.

Bye,
Uwe

- Original Message - 
From: marc [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, September 28, 2004 1:39 PM
Subject: RE: [Declude.Virus] Fprot GDI Scanner lines.



 installed 1.80 declude virus (restart imail smtp) and sending the infected
 JPEG jpegcompoc.zip (http://www.gulftech.org/?node=downloads) it was not
 automatically detect and goes trough, using F-Prot 3.15B updated.

 virus.cfg:

 SCANFILE C:\Progra~1\FSI\F-Prot\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE=5
 /NOBOOT /DUMB /REPORT=report.txt

 # SKIPEXT GIF
 # SKIPEXT JPG
 SKIPEXT TXT
 SKIPEXT MPG
 SKIPEXT PNG

 A Desktop AV F-Prot 3.15B (same version and updates) detect the JPEG
 exploit. any ideas?

 marc


 At 23:31 27.09.2004, you wrote:

 Same here.  Is there a way to make f-prot w\Declude catch these?
 
 The latest release of Declude Virus will automatically detect the
 GDIPlus.dll JPEG exploit.
 
 -Scott
 ---
 Declude JunkMail: The advanced anti-spam solution for IMail mailservers
 since 2000.
 Declude Virus: Ultra reliable virus detection and the leader in
mailserver
 vulnerability detection.
 Find out what you've been missing: Ask for a free 30-day evaluation.
 
 ---
 [This E-mail was scanned for viruses by Declude Virus
 (http://www.declude.com)]
 
 ---
 This E-mail came from the Declude.Virus mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.Virus.The archives can be found
 at http://www.mail-archive.com.
 
 [Scanned for viruses by Declude Virus]


 [Scanned for viruses by Declude Virus]

 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

 ---
 This E-mail came from the Declude.Virus mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.Virus.The archives can be found
 at http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] %date%

2004-08-12 Thread Info Wind



We would also be interested in an variable with 
european time format for use in our *.eml files.

Thank you Bernd and Markus for this Idea, I think 
it would be a help for european people.

Uwe

  - Original Message - 
  From: 
  Markus Gufler 
  
  To: [EMAIL PROTECTED] 
  Sent: Thursday, August 12, 2004 10:03 
  AM
  Subject: RE: [Declude.Virus] %date%
  
  american standard format is 
MM/DD/
  
  european standard format is 
DD.MM.
  
  For logfiles I still preferMMDD (or with IMail 
  MMDD) as it's more logic and straight forward then the european and american 
  format.
  
  In this case Bernd has asked for a variable that can be 
  used in warning messages. If you as server admin has problems with the other 
  date format imagine normal users maybe neihter knowing there is another date 
  format.
  
  Markus
  
  
  


From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff 
(Lists)Sent: Thursday, August 12, 2004 9:44 AMTo: 
[EMAIL PROTECTED]Subject: RE: [Declude.Virus] 
%date%


I have to deal 
with this issue all the time, as I have a client with an office and 4 
servers in Toronto, and they want 
the date set on the servers like DDMM and I have to always double check 
which server and logs I am working on so as to not confuse work done and 
reports from logs.


John 
Tolmachoff
Engineer/Consultant/Owner
eServices For 
You


-Original 
Message-From: 
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
On Behalf Of Goebbels, Bernd 
(LDS)Sent: 
Thursday, 
August 12, 2004 
12:30 
AMTo: 
[EMAIL PROTECTED]Subject: [Declude.Virus] 
%date%


hello 
scott,



is there a 
possibility that you create a secong date because we in europe don't use the date 
like you do, we use it like DDMM, thiscould cause 
misunderstandings with our clients.so could you create for virus and 
junkmail something like i.e.%dateeuro%?



bernd 
goebbels

LDSNRW

Germany


Re: [Declude.Virus] %date%

2004-08-12 Thread Info Wind
Great!

Thank you Scott, that is exactly what we need.

Uwe

- Original Message - 
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Thursday, August 12, 2004 1:51 PM
Subject: Re: [Declude.Virus] %date%



 is there a possibility that you create a secong date because we in
europe
 don't use the date like you do, we use it like DDMM, this could
cause
 misunderstandings with our clients. so could you create for virus and
 junkmail something like i.e. %dateeuro%?
 
 I expect this should get changed shortly.  Most likely, %DATE% will get
 converted to the de-facto international standard DD MMM  (as in 12
 Aug 2004).  Unlike DD/MM/ and MM/DD/, DD MMM  can be read by
 anyone anywhere (with the other two, 02/03/2004 could be either
February
 or March; it is impossible to tell).
 
 The true standard date format (MMDD) is too confusing for the average
 person to deal with, as it is rarely seen, but may get added as well.

 In the next release, %DATE% will indeed be changed to DD MMM  (12 Aug
 2004), and %USDATE% will have the old U.S.-style date format
 (08/12/2004), %EURDATE% will have the European-style date format
 (12/08/2004), and %ISODATE% will have the standard date format
 (2004-08-12).

 The reason for changing %DATE% is to ensure that after upgrading,
everybody
 uses an international-friendly date format.  If anybody doesn't like that,
 they do have the option of switching to %USDATE%.  And those that want to
 can use %EURDATE% or %ISODATE%.  However, only %DATE% or %ISODATE% should
 really be used (as both can be read by anybody).


 -Scott
 ---
 Declude JunkMail: The advanced anti-spam solution for IMail mailservers
 since 2000.
 Declude Virus: Ultra reliable virus detection and the leader in mailserver
 vulnerability detection.
 Find out what you've been missing: Ask for a free 30-day evaluation.

 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

 ---
 This E-mail came from the Declude.Virus mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.Virus.The archives can be found
 at http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] F-Prot and Mydoom.O

2004-07-28 Thread Info Wind
And for fpcmd is this one right?

Declude Manuel:

C:\Progra~1\Comman~1\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOBOOT /DUMB
/REPORT=report.txt

changes to:

C:\Progra~1\Comman~1\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE=5  /NOBOOT
/DUMB /REPORT=report.txt

or should the parameters set with / or with - within fpcmd ?

Thanks for an info,
Uwe

- Original Message - 
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Wednesday, July 28, 2004 3:01 PM
Subject: [Declude.Virus] F-Prot and Mydoom.O


 It turns out that there is a flaw in recent versions of F-Prot that
 prevents it from properly detecting Mydoom.O when it is double-zipped.

 Anyone using F-Prot should change the /ARCHIVE  switch in the SCANFILE
 line in the \IMail\Declude\virus.cfg file to /ARCHIVE=5 .  This will
make
 sure that F-Prot properly scans the .ZIP files.

 -Scott
 ---
 Declude JunkMail: The advanced anti-spam solution for IMail mailservers
 since 2000.
 Declude Virus: Ultra reliable virus detection and the leader in mailserver
 vulnerability detection.
 Find out what you've been missing: Ask for a free 30-day evaluation.

 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

 ---
 This E-mail came from the Declude.Virus mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.Virus.The archives can be found
 at http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] Odd directories under \spool

2004-07-07 Thread Info Wind
 Declude Virus uses these temporary directories to scan attachments. It is
 normal to see them appear for short periods of time. If they are not being
 deleted, there is a problem!

I have sometimes (one per day) .vir directories with the following content:
1 file named 1_1.exe

Is this a problem?

Bye,
Uwe


- Original Message - 
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Wednesday, July 07, 2004 6:30 PM
Subject: Re: [Declude.Virus] Odd directories under \spool



 Looking at my imail\spool directory I have found three directories all
 created July 1 within an hour of each other.
 
 D79d0001f02001d77.vir
 D79d70007023a1d91.vir
 D89d4299a010aa32a.vir
 
 All of them have a report.txt with info from McAfee on doing a virus
 scan.
 
 I assume it is safe to delete these directories but my question would be
 why did they get left behind.

  From the Troubleshooting section of the manual:

 ---
 I see lots of .vir directories in my spool directory.

 Declude Virus uses these temporary directories to scan attachments. It is
 normal to see them appear for short periods of time. If they are not being
 deleted, there is a problem! The two common causes are either that you
 entered an invalid program name in the SCANFILE option in
 \IMail\Declude\virus.cfg (make sure there are no spaces in the path), or
 your virus scanner is leaving files behind that prevent Declude from
 deleting the directory (it may be saving a report file that Declude
doesn't
 know about). This could also happen if you are using the REPORT
 configuration option and do not have a report.txt file being saved
properly
 (you can NOT use a path name for the report.txt file).
 ---

 -Scott
 ---
 Declude JunkMail: The advanced anti-spam solution for IMail mailservers
 since 2000.
 Declude Virus: Ultra reliable virus detection and the leader in mailserver
 vulnerability detection.
 Find out what you've been missing: Ask for a free 30-day evaluation.

 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

 ---
 This E-mail came from the Declude.Virus mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.Virus.The archives can be found
 at http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.