Re: [Declude.Virus] Virus Notification
Hermann Monday, June 30, 2003 you wrote: Although my configuration should not send notifications if the virus forges the sender, it does. Does someone else have this effect? My config is as follows: ONLYSENDIFREMOTESENDER SKIPIFVIRUSNAMEHAS Yaha From the manual: To prevent a notification from getting sent out, you can add a line SKIPIFVIRUSNAMEHAS Virusname to the beginning (before the first blank line) of any of the \IMail\Declude\*.eml files I believe it should be first line. Terry Fritts áÁj)pjË jyÞuú+¾*î±ëÈ7ç^V*î²m§ÿðÃ^r[yÊN¬f¢Æ¦yúèØ^ ç%¹×»¬¨¥x%ËS¢éì¹» ®Þë-±éÝjqj)m¢)[+½×ç^rÛr¥ë§²æìr¸x7ç^V*î±8^j·!÷¬q©Ûyú.ÖÛiÿü0Âf¢ªÜ+Þr
Re: [Declude.Virus] Imail v8.0 and Declude
Saturday, June 28, 2003 you wrote: AS Are there any caveats besides to not use the spam services of AS version 8 with Declude ? Seems the queuemgr is taking up way more AS processing time and slowing everything down to a crawl and we AS noticed a few declude processess running also I couldn't use the Qmanager cache. It gave delivery failures. Apparently it may have been a coincident or just me as others seem not to have had the problem. But I turned it off and everything began working fine for me. Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Imail v8.0 and Declude
Saturday, June 28, 2003 you wrote: AS You mean the dns cache and/or the bad domains thingamajig ? dns cache. But I turned the bad domains off, too. Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Banned extension - MDB
Rodney, Monday, February 24, 2003 you wrote: RB But they wouldn't self execute would they? With a little JavaScript in an html carrier or a few other ways I can imagine it could be made to open. RB You would still have to open the Access DB first before there were RB problems. Putting the ZIP restriction in there wouldn't really RB protect any farther, just one more step to get to the bad macros. Yes, the database has to open. But putting it in the zip means that it has to be unzipped before it can open. RB Or am I missing something here? Can the MDB file be made to execute RB automatically just by receiving the e-mail? It can if the client is using Outlook or Outlook Express and does not have proper security settings. It might even if the security settings are proper. RB What about Word and Excel files? They can also contain macros, can they be RB made to execute automatically just by opening the e-mail? Yes. Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] second-time user of declude, need to use new anti-virus engine f-prot...
Mitch, Saturday, February 8, 2003 you wrote: MI I've read before on this list that f-prot doesn't have to be a server MI version, saving money. F-prot for Windows - gives you 20 workstation lic or so + updater http://www.f-prot.com/products/fpwin.html install it but do not run the real-time scanner - but you can run the updater - in your virus.cfg - SCANFILE C:\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt VIRUSCODE 3 VIRUSCODE 6 VIRUSCODE 8 REPORT Infection see the declude virus manual for more details Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] McAfee 4241 missing w32/SoBig
f-prot scanner caught 8 messages yesterday with the w32/SoBig.A@mm virus that Mcafee (NAI) passed. Mcafee dat is at 4241 released 1/8. I scanned the smd file with NAV and it also reported soBig. Reviewing NAI for information on w32/soBig.A http://vil.nai.com/vil/content/v_99950.htm indicates minimum dat is 4242 release date 1/15. As far as I know there is no extra dat on nai's site for this. Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] McAfee 4241 missing w32/SoBig
NAI just sent me an extra.dat but I had to request it. After installation of the extra.dat the Mcafee scanner is now detecting this virus: Scanner 2: Virus= the W32/Sobig@MM (ED) virus !!! Attachment=Sample.pif [0] I Getting several of these now. Based on what I am seeing the treat assessment may be a little low. Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] w32.lirva out there/Update your signature files
Thursday, January 9, 2003 you wrote: PCS Watch out for a new virus- W32.Lirva I see from our logs that we caught one yesterday with Scanner 2 (McAffee) that was missed by Scanner 1 (F-Prot): - 14:06:15 Outlook 'MIME Header' Vulnerability: type=audio/x-wav, name=Two-Up-Secretly.exe. 14:06:17 Scanner 2: Virus= the W32/Lirva.gen@MM virus !!! Attachment=Two-Up-Secretly.exe [0] I -- Time is CST - I see f-prot has updated as of today. Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] requqing mail
Bonno, Monday, December 23, 2002 you wrote: BB I then realised that probably declude would pick it up again and No, declude will not scan it a 2nd time. BB Why did Declude not scan it the second time? That's how it works. BB Because it was a local delivery? Are *all* local deliveries not BB scanned? It doesn't scan twice so you can examine a message and then re-queue it if necessary from the hold folder. You understood it correctly. Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Problems with catching Virus
Tuesday, December 10, 2002 you wrote: RSP he Test Virus Sender at http://www.declude.com/tools first One thing I wish you'd add to that program is the ability to send mail directly to an address such as [EMAIL PROTECTED] - It reports no mx records for mail.example.com even though mail.example.com may be an mx record. It would really help in testing in my opinion. Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re[2]: OSRELAY:Re: [Declude.Virus] Declude / Application Popup Error ?
I have the registry entry in that article in my Windows 2000 servers. But there isn't a fix for this as far as I can tell. I have experimented with various settings. If IMAIL receives a batch of messages all at once then there is a likelihood that a popup will occur first on smtp32.exe. Once that happens all you can do is just click as fast as possible to get rid of alert boxes. If you do this fast enough you can keep the server up. Otherwise the alert boxes just keep building and finally the server will fail to respond. It is the number of alert boxes that kill the server I think. I can't find a way to suppress them. In my case this usually begins when total processes are between 90 and 100 and IMAIL has received about 100 messages all at once. But I hope you find a solution and if you do please post it. Terry Friday, June 21, 2002 you wrote: MS The registry entry does not even exist in Windows 2000. Is there a different MS name for windows 2000 registry? MS Does anybody know? I know that this is not Scott's problem. This is a MS Microsoft issue but looking for the fix from MS their website is like finding a needle in a hay stack. Any help would be MS greatly appreciated. Please!! I am getting MS tired of resetting the server. MS Best Regards, MS Mishi --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[2]: KITHRUP:RE: [Declude.Virus] Declude Virus v1.54 (beta) released
Jim, sometimes a new imail install will change the host name of the server. The declude activation code is based on the host name. So make certain that your host name is whatever you used when you registered declude. You can change it to that and it will work. Terry Fritts Tuesday, June 11, 2002 you wrote: JR I may have a bigger problem than I thought. The activation code is JR correct according to the email I received when I bought Declude Virus. JR I am assuming the 4th digit from the left is numeric and might be wrong JR on that. I have down loaded the newer version (1.53) and have not JR changed a code on that...does it need a new activation code? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[2]: [Declude.Virus] JS.Menger.Worm Norton AV
My f-prot update about 6:00 CST this morning caught it. They call it something different than NAV though. Terry Fritts Thursday, February 14, 2002 you wrote: RSP FYI, Sophos only announced the JS.Menger.Worm (aka Coolnow) about 2 hours RSP before your post, and McAfee hasn't even announced it yet. So it is very RSP new (I'm surprised that NAV caught it). RSP You can't use Norton with Declude, as they don't include a real command RSP line scanner (there is one that can be used manually, but if you use it in RSP an automated environment, such as with Declude, it will always report that RSP files are virus-free, regardless of whether or not it finds a virus). --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.Virus] Fw: New version of F-PROT (3.11b)
I must not understand your situation. I have 3.11b and I don't have any conflicts. The only one I've seen is if the Real Time scanner were operating and one tried to initiate another instance of it. That gives an error as you describe. I installed without the Real Time scanner option to remove it. Otherwise you can disable it from the task bar tray icon. I've not seen any conflicts with the On Demand scanner. I guess you'd just want to make certain you don't select the spool folder with the On Demand scanner. I don't know about the Real Time scanner settings since I don't use it. But I think I must be misunderstanding your problem. Terry -Original Message- Hello, Anyone find the solution yet. When I did my upgrade, I have the same problem. If I run F-Prot DOS for checking mail, I can't run the OnDemand scanner. I get the same error message about running more that one copy of the program. So my choice is check e-mail or protect the mail server, but it seems like I can't do both. I even did a complete uninstall and reinstall a couple of times but could not get them both to work. Thanks Ken --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: Re[2]: [Declude.Virus] Fw: New version of F-PROT (3.11b)
I don't know then. I am definitely running 3.11b. I just checked again and I can scan anything I want on the server with On Demand. Windows Real Time is not installed. Sorry I couldn't help. Terry -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of andyb@thumpernet Sent: Monday, December 24, 2001 8:52 AM To: Smart Business Lists Subject: Re[2]: [Declude.Virus] Fw: New version of F-PROT (3.11b) Hi, I understand the problem perfectly as it happened to me as well. We are talking about 3 things here: 1) the DOS command line scanner 2) the Windows on demand scanner 3) the Windows real time scanner I've alway been able to use 1 and 2 together before 3.11b. Now if I try to run 2, it tells me *Can't run more than one instance of this program!* There are no other instances of 2 running. 1 and 3 have never been able to run together as it interferes with declude AV scanner. This is a definate bug in the 3.11b, and it has been reported by 2 or 3 other people on this list that I've noticed so far. Thanks, Andy Baldwin [EMAIL PROTECTED] http://www.thumpernet.com 315-282-0020 Monday, December 24, 2001, 9:21:49 AM, you wrote: SBL I must not understand your situation. I have 3.11b and I don't have any SBL conflicts. SBL The only one I've seen is if the Real Time scanner were operating and SBL one tried to initiate another instance of it. That gives an error as SBL you describe. I installed without the Real Time scanner option to SBL remove it. Otherwise you can disable it from the task bar tray icon. SBL I've not seen any conflicts with the On Demand scanner. I guess you'd SBL just want to make certain you don't select the spool folder with the On SBL Demand scanner. SBL I don't know about the Real Time scanner settings since I don't use it. SBL But I think I must be misunderstanding your problem. SBL Terry SBL -Original Message- SBL Hello, SBL Anyone find the solution yet. When I did my upgrade, I have the same SBL problem. If I run F-Prot DOS for checking mail, I can't run the OnDemand SBL scanner. I get the same error message about running more that one copy SBL of SBL the program. SBL So my choice is check e-mail or protect the mail server, but it seems SBL like I SBL can't do both. I even did a complete uninstall and reinstall a couple of SBL times but could not get them both to work. SBL Thanks SBL Ken SBL --- SBL [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] SBL This E-mail came from the Declude.Virus mailing list. To SBL unsubscribe, just send an E-mail to [EMAIL PROTECTED], and SBL type unsubscribe Declude.Virus. You can E-mail SBL [EMAIL PROTECTED] for assistance. You can visit our web SBL site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.Virus] declude pro
How does one know what product level one is running? I think we bought JunkMail pro but I don't remember doing anything different when Virus pro came out. Is there an upgrade from virus standard to virus pro? Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.Virus] gokar
Anyone seen this gokar worm yet? We haven't but have seen quite a bit of traffic on incidents list. I see it is included in the Mcaffee (NEA) 4176 Dat. It was not in my NAV list until just a few minutes ago at about 4:30 cst. In f-prot I see gokar.a only so I'm not sure bout the other variants. Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.Virus] Funny how....
I've added %HEADERS% to my postmaster email as I've had several badtrans that have used the recipient address as the sender address . -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Chris Hunt Sent: Tuesday, December 11, 2001 7:14 AM To: [EMAIL PROTECTED] Subject: [Declude.Virus] Funny how [EMAIL PROTECTED] is used only as a recipient for Declude Virus and now its getting (attempted) viruses. I thought the Badtrans was done but maybe some domains are slow ;) Chris === To: [EMAIL PROTECTED] Subject: virus detected Declude Virus v1.29 caught the : W32/Badtrans.B@mm virus in New_Napster_Site.MP3.pif from [EMAIL PROTECTED] to: [EMAIL PROTECTED] Date: 12/11/2001 06:46:49 Subject:Re: WARNING: YOU MAY HAVE A VIRUS Spool File: Df22714a.SMD --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.Virus] f-prot server and termserv
Every time I logon on my Win2k server running f-prot with TermServ the realtime protector comes on. My scheduler seems to be working. Anyone know how to make the realtime protector stay off? Terry --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.Virus] MISSING_REVERSE_DNS:Imail/declude log parser...
Just fyi Outlook XP will not allow users to receive an attachment with a .cmd extension. Terry Fritts -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Jeff Pitoniak Sent: Thursday, December 06, 2001 4:15 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] MISSING_REVERSE_DNS:Imail/declude log parser... Put this usage.cmd in c:\tools (or modify paths in the scipt to match where you put it) ... --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
RE: [Declude.Virus] MISSING_REVERSE_DNS:New IMail Anti-Virus ad Declude
I can see Ipswitch in a major software rewrite of Imail eliminating the ability for a hook which would effectively eliminate declude. I think the code probably does need a major rewrite because of the ongoing process issues. However, that is likely a pretty significant investment and I suspect it is hard for Ipswitch to justify - ever. The integrated virus scanner appears to really be a gateway type solution that sits in front of imail on a separate port. So it is probably some sort of joint venture arrangement between two companies that can share revenues on an already mol stable product without spending a lot of money on authoring, testing, and so on. And from Ipswitch's pov there is the ongoing support fee which appears to be a hallmark of their marketing. I can even see a market for the product and I doubt that market would hurt declude any. I think it is more likely that the virus scanner producers will try to prevent declude-type solutions by changing licensing, code, or whatever. That is with the probable exception of f-prot which consistently earns more and more respect from me. But probably the largest problem for Ipswitch or virus scanner producers in general is whether they can find a way to actually stay alive in the software publishing business. The sector in general has very few winners and a heap of losers so if one were betting on odds then one should probably be looking at Exchange or a unix mail solution. Terry Fritts This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: Re[2]: [Declude.Virus] MISSING_REVERSE_DNS:New IMail Anti-Virus ad Declude
I agree. My original purchase of Imail was just so I could set up a more or less reliable mail server for my virtual domains cheaply, quickly and easily and then maintain it with relatively little effort and expense. It has fit that bill wonderfully and Scott's declude has enhanced it far more than I ever anticipated. HKSI's templates have also improved it to really a pretty nice product. My basic needs have not changed and neither has the market for Windows mail servers as far as I can tell. I view Scott, Ron, and other 3rd party providers more as custom programming companies that have found a nice niche market for their own efforts and have provided a wonderful value for those of us who use Imail. But the leap into software publishing is a long one and a dangerous one. Certainly it has a lot of allure but the cost of publishing is so great in every area and the chance for a hit is worse than trying to make a hit movie. And it takes a hit now. Even those who get hits usually are unable to stay the course beyond one or two editions. Frankly, I think the future is brighter for Scott than Ipswitch. I don't think the future for software publishing as we've known it up to now is very good. But maybe I'm wrong. Certainly wouldn't be a new experience. Probably we'll see an entire paradigm shift anyway - maybe along the lines of .net or some other kind of widely distributed services components. Still that bodes well for Scott and other adaptable authors but it takes a gargantuan effort to point a company like Ipswitch in that direction. The future is just cloudy. No to your question on spell checkers. I have experimented with a number, too, not just for imail but other applications. Generally I don't like the Java ones as well as I do the ActiveX ones. Well actually I hate the Java ones. The ActiveX ones work a lot better now than they used to but there is still such a wide audience that cannot (or will not) use them. If you have to have one then I think the Word one works about as well as any for those that can use it. Personally I think spell checking for web email is a royal waste of resources from start to finish for all parties. Even when people have them they either don't use them or they make deliberate mistakes anyway. Terry -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Roger Heath Sent: Wednesday, November 28, 2001 9:15 AM snip Let's hope not for Scott's sake... The only thing we really need on our Imail now is a third party spell checker. The Imail forum has not helped me here at all. Has anyone achieved this integration? /snip This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
