Re: [Declude.Virus] Declude Gateway First Phase Beta
Dear David, we are interested. Greetings, Uwe Wind Internethaus GmbH Am Krebsgraben 15 Haus 2 D-78048 Villingen-Schwenningen Tel: +49 7721 40 707 44 Fax: +49 7721 40 707 41 http://www.windinternethaus.de - Original Message - From: David Barker [EMAIL PROTECTED] To: declude.junkmail@declude.com; declude.virus@declude.com Sent: Wednesday, August 02, 2006 7:27 PM Subject: [Declude.Virus] Declude Gateway First Phase Beta I am currently looking for 4 more First Phase Beta testers for the Declude Gateway. The Declude Gateway will have to be installed on a separate server to you Imail or SmarterMail server and we would suggest not using it in a production enviroment. If you are interested please email me directly. Thanks David Barker Product Manager Your Email security is our business 978.499.2933 office 978.988.1311 fax [EMAIL PROTECTED] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] 4.2.3 Built-in scanner
Dear David, since I use 4.2.3 I get always Unknown Virus in Unknown File in the message. It seems that the Virusname variables have a problem. Could you check this? Thank you, Uwe - Original Message - From: David Barker [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Tuesday, May 09, 2006 3:13 PM Subject: RE: [Declude.Virus] 4.2.3 Built-in scanner 1. Use the test virus sender http://www.declude.com/Articles.asp?ID=99 2. Check your virus logs 3. Declude\Scanners\AVG\DB 4. Check the date on the database files David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Shacklett Sent: Tuesday, May 09, 2006 8:45 AM To: Declude.Virus@declude.com Subject: [Declude.Virus] 4.2.3 Built-in scanner How do I determine if the built-in scanner is working? Where do the virus signature files live? How do I tell if those files are being updated? -- John S --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Declude with IMail 8.22?
Dear Grant, we are running 8.22 with 3.0.5.22 (newest one) and we have no problems. Uwe - Original Message - From: Grant Griffith [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Thursday, December 22, 2005 11:02 AM Subject: [Declude.Virus] Declude with IMail 8.22? Hello All, We just upgrade to Imail 8.22 overnight and was wanting to check and see what version of Declude everyone was running with it. We are still running version 2.0.6.16 right now and remember some talk a while back that you need to upgrade to a newer version as 8.22 added some things that gave Declude problems. Can anyone let me know what version they are running without issues with Imail 8.22? Thanks, Grant Griffith EI8HTLEGS, A Division of ETC (812)932-1000 --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] Mcafee with 5000 engine tested?
Does somenone already works with the new 5000-er engine? Does someone has experience? Thanks for information, Uwe
Re: [Declude.Virus] Blocking PIF Files
virus.cfg: BANEXT PIF If you also want to block them in zips and encrypted zip: BANZIPEXTS ON BANEZIPEXTS ON Uwe - Original Message - From: Dan Geiser [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Wednesday, November 23, 2005 3:26 PM Subject: [Declude.Virus] Blocking PIF Files Hello, All, I don't know whether this would be more appropriate for the virus list or the junkmail list so please point me towards junkmail if appropriate. What is the proper technique for blocking messages that have an attachment that ends in a pif extension like your_letter.pif? We are currently using Declude 2.0.6 JunkMail Pro and Virus Standard. Thanks In Advance! Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Blocking PIF Files
Dan, sorry, my information was perhaps not correct. BANEXT PIF should run in Standard and Pro version. Darin is more experient with this and he mailed that the BANZIPEXTS/BANEZIPEXTS only run in the pro version. Uwe - Original Message - From: Dan Geiser [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Wednesday, November 23, 2005 3:52 PM Subject: Re: [Declude.Virus] Blocking PIF Files Thanks, Uwe. Do you know if both of the below techniques work in with Declude Virus Standard? Thanks, Dan - Original Message - From: Info Wind [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Wednesday, November 23, 2005 9:47 AM Subject: Re: [Declude.Virus] Blocking PIF Files virus.cfg: BANEXT PIF If you also want to block them in zips and encrypted zip: BANZIPEXTS ON BANEZIPEXTS ON Uwe - Original Message - From: Dan Geiser [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Wednesday, November 23, 2005 3:26 PM Subject: [Declude.Virus] Blocking PIF Files Hello, All, I don't know whether this would be more appropriate for the virus list or the junkmail list so please point me towards junkmail if appropriate. What is the proper technique for blocking messages that have an attachment that ends in a pif extension like your_letter.pif? We are currently using Declude 2.0.6 JunkMail Pro and Virus Standard. Thanks In Advance! Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Orphaned eml files SMARTERMAIL current DECLUDE 206
Is this only a problem within Smartermail or should Imail users also update? - Original Message - From: Ralph Krausse [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Wednesday, May 11, 2005 3:39 PM Subject: RE: [Declude.Virus] Orphaned eml files SMARTERMAIL current DECLUDE 206 A few customers have reported similar issues with orphaned eml files and we are working on a resolution. In the meantime we would recommend implementing the 2.0.6.10 (or higher) incremental release; it does not run the routine to reprocess email. Declude Engineering -- -Original Message- -- From: [EMAIL PROTECTED] [mailto:Declude.Virus- -- [EMAIL PROTECTED] On Behalf Of Douglas Cohn -- Sent: Tuesday, May 10, 2005 9:01 PM -- To: Declude.Virus@declude.com -- Subject: [Declude.Virus] Orphaned eml files SMARTERMAIL current DECLUDE -- 206 -- -- I have orphaned hdr files in my spool directory like this -- -- C:\SmarterMail\Spool\62298363.~DR -- -- Then I found this in proc -- -- C:\SmarterMail\Spool\proc\62298363.EML -- -- Has anyone else seen this? -- -- Doug -- -- --- -- [This E-mail scanned for viruses by Declude Virus] -- -- -- --- -- This E-mail came from the Declude.Virus mailing list. To -- unsubscribe, just send an E-mail to [EMAIL PROTECTED], and -- type unsubscribe Declude.Virus.The archives can be found -- at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] F-Prot and HTML object exploit
I did contact f-prot now the second time. I did not get an answer till now. Uwe - Original Message - From: Colbeck, Andrew [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Tuesday, May 03, 2005 3:21 AM Subject: RE: [Declude.Virus] F-Prot and HTML object exploit The sign*.def files have been updated to: 05/02/2005 11:46 PM Which I'm pretty sure is UTC. However, these still have the false-positive. As of this writing, I've received no reply to my ticket with F-Prot. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry Sent: Monday, May 02, 2005 2:03 PM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] F-Prot and HTML object exploit F-Prot may have pulled the latest defs do to the number of complaints received, which could explain why the app reports that you have the latest version. Bill - Original Message - From: Kevin Rogers [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Monday, May 02, 2005 1:54 PM Subject: Re: [Declude.Virus] F-Prot and HTML object exploit I also filled out the form at FProt's site. Thanks for the defs. When I open up FProt, though, it says that my defs are up-to-date, even though I replaced the newest ones with the ones that you sent. I hope that that message indicates whether we've downloaded the latest - not whether we are actually using the latest defs. Colbeck, Andrew wrote: I don't think the engine version matters, just the pattern file. I've confirmed that the culprit is this, the most recent sign.def from 05/02/2005 01:32 PM And yes, I've sent in a support request via their web page; I'd like to supply them with several samples. I've also played around with the switch settings and found that there are no relevant switches that can be used as a workaround (i.e. /ai /noheur and /server make no difference in the detection or not of this false-positive). All of the messages detected either had Office 10 or Office 11 headers or were replies to messages created with Office 10 or Office 11. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Monday, May 02, 2005 1:10 PM To: Declude.Virus@declude.com Subject: RE: [Declude.Virus] F-Prot and HTML object exploit Question: Have you all running the latest v3.16b ? I can't see any appearance of HTML/ObjData in the entire current logfile, but I've still running 3.16a Markus -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Monday, May 02, 2005 7:47 PM To: Declude.Virus@declude.com Subject: [Declude.Virus] F-Prot and HTML object exploit It appears that something has updated on F-Prot in the last hour. Now, a lot of outbound HTML e-mails are being flagged by F-Prot as having the HTML object exploit. Running the file on www.virustotal.com shows clean. Any one else seeing problems? For now, as I am at a client, I have turned off F-Prot scanning relying on AVG. John T eServices For You --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses.] --- [This E-mail was scanned for viruses.] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] F-Prot and HTML object exploit
Hello, in the moment I got this email from F-prot support: Unfortunately, virus signature files released at 17:00 on 2 May 2005 included a false positive detection identified as: Infection: HTML/[EMAIL PROTECTED] (exact name) causing problems for some of our users. New virus signature files that fix this problem have now been released. These files are dated 3 May 2005 and users need only update to avoid any further false positives. Greetings, Uwe - Original Message - From: Colbeck, Andrew [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Tuesday, May 03, 2005 3:21 AM Subject: RE: [Declude.Virus] F-Prot and HTML object exploit The sign*.def files have been updated to: 05/02/2005 11:46 PM Which I'm pretty sure is UTC. However, these still have the false-positive. As of this writing, I've received no reply to my ticket with F-Prot. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry Sent: Monday, May 02, 2005 2:03 PM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] F-Prot and HTML object exploit F-Prot may have pulled the latest defs do to the number of complaints received, which could explain why the app reports that you have the latest version. Bill - Original Message - From: Kevin Rogers [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Monday, May 02, 2005 1:54 PM Subject: Re: [Declude.Virus] F-Prot and HTML object exploit I also filled out the form at FProt's site. Thanks for the defs. When I open up FProt, though, it says that my defs are up-to-date, even though I replaced the newest ones with the ones that you sent. I hope that that message indicates whether we've downloaded the latest - not whether we are actually using the latest defs. Colbeck, Andrew wrote: I don't think the engine version matters, just the pattern file. I've confirmed that the culprit is this, the most recent sign.def from 05/02/2005 01:32 PM And yes, I've sent in a support request via their web page; I'd like to supply them with several samples. I've also played around with the switch settings and found that there are no relevant switches that can be used as a workaround (i.e. /ai /noheur and /server make no difference in the detection or not of this false-positive). All of the messages detected either had Office 10 or Office 11 headers or were replies to messages created with Office 10 or Office 11. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Monday, May 02, 2005 1:10 PM To: Declude.Virus@declude.com Subject: RE: [Declude.Virus] F-Prot and HTML object exploit Question: Have you all running the latest v3.16b ? I can't see any appearance of HTML/ObjData in the entire current logfile, but I've still running 3.16a Markus -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Monday, May 02, 2005 7:47 PM To: Declude.Virus@declude.com Subject: [Declude.Virus] F-Prot and HTML object exploit It appears that something has updated on F-Prot in the last hour. Now, a lot of outbound HTML e-mails are being flagged by F-Prot as having the HTML object exploit. Running the file on www.virustotal.com shows clean. Any one else seeing problems? For now, as I am at a client, I have turned off F-Prot scanning relying on AVG. John T eServices For You --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses.] --- [This E-mail was scanned for viruses.] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The
Re: [Declude.Virus] F-Prot and HTML object exploit
I tested it the last hours and had no FP since the new update. Uwe - Original Message - From: Chris Fitch [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Tuesday, May 03, 2005 4:44 PM Subject: RE: [Declude.Virus] F-Prot and HTML object exploit I have these installed and appears to have corrected. Chris Fitch Sr Network Administrator Industrial Chemicals Inc. [EMAIL PROTECTED] 205-823-7330 Ext. 1039 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Wind Sent: Tuesday, May 03, 2005 8:02 AM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] F-Prot and HTML object exploit Hello, in the moment I got this email from F-prot support: Unfortunately, virus signature files released at 17:00 on 2 May 2005 included a false positive detection identified as: Infection: HTML/[EMAIL PROTECTED] (exact name) causing problems for some of our users. New virus signature files that fix this problem have now been released. These files are dated 3 May 2005 and users need only update to avoid any further false positives. Greetings, Uwe - Original Message - From: Colbeck, Andrew [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Tuesday, May 03, 2005 3:21 AM Subject: RE: [Declude.Virus] F-Prot and HTML object exploit The sign*.def files have been updated to: 05/02/2005 11:46 PM Which I'm pretty sure is UTC. However, these still have the false-positive. As of this writing, I've received no reply to my ticket with F-Prot. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry Sent: Monday, May 02, 2005 2:03 PM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] F-Prot and HTML object exploit F-Prot may have pulled the latest defs do to the number of complaints received, which could explain why the app reports that you have the latest version. Bill - Original Message - From: Kevin Rogers [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Monday, May 02, 2005 1:54 PM Subject: Re: [Declude.Virus] F-Prot and HTML object exploit I also filled out the form at FProt's site. Thanks for the defs. When I open up FProt, though, it says that my defs are up-to-date, even though I replaced the newest ones with the ones that you sent. I hope that that message indicates whether we've downloaded the latest - not whether we are actually using the latest defs. Colbeck, Andrew wrote: I don't think the engine version matters, just the pattern file. I've confirmed that the culprit is this, the most recent sign.def from 05/02/2005 01:32 PM And yes, I've sent in a support request via their web page; I'd like to supply them with several samples. I've also played around with the switch settings and found that there are no relevant switches that can be used as a workaround (i.e. /ai /noheur and /server make no difference in the detection or not of this false-positive). All of the messages detected either had Office 10 or Office 11 headers or were replies to messages created with Office 10 or Office 11. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Monday, May 02, 2005 1:10 PM To: Declude.Virus@declude.com Subject: RE: [Declude.Virus] F-Prot and HTML object exploit Question: Have you all running the latest v3.16b ? I can't see any appearance of HTML/ObjData in the entire current logfile, but I've still running 3.16a Markus -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Monday, May 02, 2005 7:47 PM To: Declude.Virus@declude.com Subject: [Declude.Virus] F-Prot and HTML object exploit It appears that something has updated on F-Prot in the last hour. Now, a lot of outbound HTML e-mails are being flagged by F-Prot as having the HTML object exploit. Running the file on www.virustotal.com shows clean. Any one else seeing problems? For now, as I am at a client, I have turned off F-Prot scanning relying on AVG. John T eServices For You --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses.] --- [This E-mail was scanned for viruses.] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found
Re: [Declude.Virus] Who is minding the store
I sent this email because now I am not so sure. And I know others that have the same feelings. Renew or not renew. I was told the company would be run in the same high quality manner as before. Clearly that is not the case. Without knowing the coders know their stuff relating to spam it is quite risky to take the chance with such a small company. I think every company after Scott will have a problem, because Scott did a job, which no one can do a long time without heartattack ;-) I think Declude makes a good job. The new release is out and it is like in the past, no problems. When there is a problem I mail to [EMAIL PROTECTED] .com and get a fast response. That is the main thing why I pay for a service agreement. And these things have not changed in my opinion. Uwe - Original Message - From: Nick [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Monday, May 02, 2005 7:02 PM Subject: RE: [Declude.Virus] Who is minding the store On 2 May 2005 at 9:51, Douglas Cohn wrote: Douglas - I agree with what you are saying. And I miss Scott for his slant on techsupport and philosphy [ Remember Len Scott dialogs? :) ] That said we need to give the new Declude a chance. [That is coming from a guy that has been posting some negativity lately]. They are learning the new turf. And they have some good email admins supporting them (for now) If Declude misses the point competition will but thenm out of business. -Nick Plus, if they actually integrate our feedback, we'll buy the support agreement in order to download the latest fruits of our labor. :) Yes that is a key point and the reason I always rushed out to renew in the past. I sent this email because now I am not so sure. And I know others that have the same feelings. Renew or not renew. I was told the company would be run in the same high quality manner as before. Clearly that is not the case. Without knowing the coders know their stuff relating to spam it is quite risky to take the chance with such a small company. We knew Scott was the best, who are the people that took over the reins and what credentials do they have. I mean Symantec cannot do it right and I should trust someone who won't participate in their own forums? If Scott would chime in here and say DON'T worry Doug these people know their stuff, you are in good hands. I would order a renewal. But he left. Doug -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jonathan Sent: Sunday, May 01, 2005 5:59 PM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] Who is minding the store Douglas Cohn wrote: Using this forum for support is certainly less expensive to the company ... unless you're charging for support, then it could be viewed as a losing proposition to assist in free support. I fear this may be the mindset. This view, is, of course, entirely wrong; as you mentioned, our RD feedback is very valuable-worth more than a support contract. Plus, if they actually integrate our feedback, we'll buy the support agreement in order to download the latest fruits of our labor. :) --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] F-Prot and HTML object exploit
Thank you for the tip, John. I searched the logs and since the update there are legitimate E-mail, which are caught. Uwe - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Monday, May 02, 2005 7:46 PM Subject: [Declude.Virus] F-Prot and HTML object exploit It appears that something has updated on F-Prot in the last hour. Now, a lot of outbound HTML e-mails are being flagged by F-Prot as having the HTML object exploit. Running the file on www.virustotal.com shows clean. Any one else seeing problems? For now, as I am at a client, I have turned off F-Prot scanning relying on AVG. John T eServices For You --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] Warning for Imail 8.2 updaters when using external datase (mysql)
For all the others who also use Imail in combination with mysql for the user accounts: Do not update to Version 8.2. I ran in the greatest problems. There is no info in the release notes about this issue. One friendly forum member from Ipswitch told me about this now. Greetings, Uwe
[Declude.Virus] Info for Trend Micro (PC-cillin)
Here is an info from Trend: Urgent Notification - Trend Micro Pattern File 2.594.00 Causes High CPU Utilization On April 22, 2005 at approximately 3:30 pm Pacific (11:30pm GMT) Trend Micro posted a pattern file (2.594.00) which had the potential to interact with certain computing configurations and cause computer performance issues for some users of PC-cillin, OfficeScan (including the OfficeScan component of Client/Server Suite for SMB, and Client/Server/Messaging Suite for SMB), and ServerProtect for NT. Uwe
[Declude.Virus] F-Prot - Error 8
I had problems with F-Prot the last weeks in combination with new Bagle variants. The BAgles slipped through, althouh I have a multi scanner environment. In the log file there was always an error 8 code in combination with F-Prot . I got this info from Declude, which solved my probles till now: Add VIRUSCODE 8 to the virus config so it reads VIRUSCODE 3 VIRUSCODE 6 VIRUSCODE 8 FProt returns virus code 8 now. (in the past there were only VIRUSCODE 3 and VIRUSCODE 6 the default) Uwe --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] OT: Installing Sophos/Anti Virus
we use Bitdefender Free Edition V. 7 (http://www.bitdefender.com/bd/site/downloads.php?menu_id=21). But I have no experience with Windows 2003 and Bitdefender and do not know if this works. We run it on an Windows 2000 Server without any problem since a year now as 3. scanner. Bye, Uwe - Original Message - From: Aaron Moreau-Cook [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Wednesday, April 20, 2005 8:02 PM Subject: RE: [Declude.Virus] OT: Installing Sophos/Anti Virus I thought about that, but we have a production mail server here running those both. I don't want to uninstall them to install Sophos. What would I do if I found out I couldn't install McAfee after I installed Sophos, it would just be bad. Thanks -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Wednesday, April 20, 2005 10:54 AM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] OT: Installing Sophos/Anti Virus Not that this solves the issue, but what if you installed Sophos first? Darrell invURIBL - Intelligent URI Filtering for Declude Junkmail. Blocks 85% of SPAM with the default configurations. Try it out - http://www.invariantsystems.com Aaron Moreau-Cook writes: All, I have a Imail Server on a Windows 2003 server with Declude Virus 1.82. We have been running with three virus scanners, McAfee VirusScan 7.1, F-Prot 3.16b, and Nod32. After having nothing but trouble with Nod32 crashing on our system we decided to replace Nod32 with another scanner. We tried to install PC-Cillian, but it won't install on a Windows 2003 Server. We tried to install Sophos, but it won't install because other Anti-Virus applications are installed. So my question is, how do I get another third party scanner installed? How has everyone else got Sophos installed on their systems? We'd like to use Sophos, but at this point I don't really care either way as long as it is reliable and doesn't crash. Thanks, Aaron --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Declude Licensing codes
An idea from me to the new licence policy from Declude: Is it perhaps possible to expand the Decludce Pro licence to include one test system (which only will be used for testing before upgrading and to test new features, not for business use)) ? I think this would also help a lot of declude users, who has problems with the new Licence code. Bye, Uwe - Original Message - From: Keith Johnson [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Thursday, December 23, 2004 3:40 PM Subject: RE: [Declude.Virus] Declude Licensing codes Andy, Upon your phone call with Barry, should we as Declude Users (4 lic. in my case), contact Barry directly before upgrading or should we await for a post on this forum for new procedures? I too have a cold spare, however, Declude is not loaded there until necessary and upon written procedures that we have in place to shutdown the current server (whether down by failure or otherwise), rename it and re-ip it and the like. Thanks for the info. Keith -Original Message- From: [EMAIL PROTECTED] on behalf of Andy Schmidt Sent: Thu 12/23/2004 9:05 AM To: Declude.Virus@declude.com; Declude.JunkMail@declude.com Cc: Subject: RE: [Declude.Virus] Declude Licensing codes Hi, At the end, there are two components to this: A) the technique used to validate licenses (e.g., an activation code, hardware detection, etc.) B) the procedures on how a questionable situation is handled. I really don't have a problem with ANY technique as long as I can be comfortable with the procedures. If the procedures could even remotely result in an accidental automatic disabling, I'd no longer be able to justify use of the product. Per example, if the procedures involve a long grace period, or, if the procedures simply allow a License Validation Staff to REVIEW a questionable license with a customer at a mutually convenient time, or similar safeguards - then I'm absolutely okay with it. When Barry called yesterday, I listened and agreed wholeheartedly, that Declude owes it to is PAYING customers to identify and go after non-compliant customers. After all - it's money stolen from the paying customer (by either having to raise prices or by not being able to invest into future development as much). But, I repeated my expectations that NOT details of the techniques need to be disclosed - but there should be sufficient disclosure of the procedures. And that should be disclosed BEFORE the software is offered for download - not AFTER people are starting to get suspicious. With the information that I was given, I'm perfectly satisfied that I can continue to use Declude - and I fully support their efforts (in general) of license enforcement. However, I still hope that Barry recognizes the need that ALL customers need to know enough about the procedures to regain (!) MY level of comfort and confidence in the company and the product. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Thursday, December 23, 2004 02:01 AM To: Declude.Virus@declude.com; Declude.JunkMail@declude.com Subject: [Declude.Virus] Declude Licensing codes Here is some information for all who have concerns about the new licensing and tie in to IPs and/or MACs: I have spoken to Barry today, and while I will not reveal the little bit of information I was given, I will state on my honor that I have no problem with the new license code process what ever you want to call it. Additionally, Declude has designed and taken steps to make sure there will be no problems in the event you need to change IPs or hardware overnight, on a weekend, on an extended weekend or even if disaster were to strike and the Declude offices were not available for a week. Hopefully, you can now rest assured that Declude will not stop working if you have to fix your server. FYI, there is also a process in place for a cold spare server to be prepared and ready ahead of time. You will need to contact Declude to specifically set that up. John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL
Re: [Declude.Virus] Getting hammered by viruses
Dear Markus, same to us. Bye, Uwe - Original Message - From: Markus Gufler [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, December 16, 2004 4:24 PM Subject: [Declude.Virus] Getting hammered by viruses Anyone else is seeing this? Last week we had an average of 2750 viruses each day. Two days ago this number increased to 9000. Yesterday we've catched 19000 viruses. From the other 16000 messages 9600 was spam. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] F-Prot 3.16 available.
Hello, it seems that f-prot has a problem at the moment with high traffic: This is a messages from F-Prot Support: We have been experiencing extensive traffic on our servers and therefore downloading from them has been very slow. Our network administrator is working on this issue and it should be fixed shortly. Please try the update again, it should be successful. Nice weekend, Uwe - Original Message - From: Hirthe, Alexander [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, November 19, 2004 5:52 PM Subject: [Declude.Virus] F-Prot 3.16 available. Hello, fyi: -- FRISK Software has released version 3.16 of F Prot Antivirus for Windows as well as versions 4.4.8 of F-Prot Antivirus for all UNIX based platforms. More information on these releases can be found on our website: http://www.f-prot.com/news/gen_news/041118_release_win316.html http://www.f-prot.com/news/gen_news/041119_release_unix_all.html We recommend that users of F-Prot Antivirus for Windows, for Linux x86, for BSD x86, for Solaris x86, for Solaris SPARC, for AIX on IBM pSeries and for Linux on IBM zSeries update their programs to these newest versions as soon as possible. -- No, I won't install it friday evening :) Alex --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Fprot GDI Scanner lines.
Dear Marc, where did you get the dos scanner for f-prot? On the page of F-prot there is still only Version 3.15A available. Bye, Uwe - Original Message - From: marc [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, September 28, 2004 1:39 PM Subject: RE: [Declude.Virus] Fprot GDI Scanner lines. installed 1.80 declude virus (restart imail smtp) and sending the infected JPEG jpegcompoc.zip (http://www.gulftech.org/?node=downloads) it was not automatically detect and goes trough, using F-Prot 3.15B updated. virus.cfg: SCANFILE C:\Progra~1\FSI\F-Prot\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOBOOT /DUMB /REPORT=report.txt # SKIPEXT GIF # SKIPEXT JPG SKIPEXT TXT SKIPEXT MPG SKIPEXT PNG A Desktop AV F-Prot 3.15B (same version and updates) detect the JPEG exploit. any ideas? marc At 23:31 27.09.2004, you wrote: Same here. Is there a way to make f-prot w\Declude catch these? The latest release of Declude Virus will automatically detect the GDIPlus.dll JPEG exploit. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. [Scanned for viruses by Declude Virus] [Scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] %date%
We would also be interested in an variable with european time format for use in our *.eml files. Thank you Bernd and Markus for this Idea, I think it would be a help for european people. Uwe - Original Message - From: Markus Gufler To: [EMAIL PROTECTED] Sent: Thursday, August 12, 2004 10:03 AM Subject: RE: [Declude.Virus] %date% american standard format is MM/DD/ european standard format is DD.MM. For logfiles I still preferMMDD (or with IMail MMDD) as it's more logic and straight forward then the european and american format. In this case Bernd has asked for a variable that can be used in warning messages. If you as server admin has problems with the other date format imagine normal users maybe neihter knowing there is another date format. Markus From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists)Sent: Thursday, August 12, 2004 9:44 AMTo: [EMAIL PROTECTED]Subject: RE: [Declude.Virus] %date% I have to deal with this issue all the time, as I have a client with an office and 4 servers in Toronto, and they want the date set on the servers like DDMM and I have to always double check which server and logs I am working on so as to not confuse work done and reports from logs. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Goebbels, Bernd (LDS)Sent: Thursday, August 12, 2004 12:30 AMTo: [EMAIL PROTECTED]Subject: [Declude.Virus] %date% hello scott, is there a possibility that you create a secong date because we in europe don't use the date like you do, we use it like DDMM, thiscould cause misunderstandings with our clients.so could you create for virus and junkmail something like i.e.%dateeuro%? bernd goebbels LDSNRW Germany
Re: [Declude.Virus] %date%
Great! Thank you Scott, that is exactly what we need. Uwe - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, August 12, 2004 1:51 PM Subject: Re: [Declude.Virus] %date% is there a possibility that you create a secong date because we in europe don't use the date like you do, we use it like DDMM, this could cause misunderstandings with our clients. so could you create for virus and junkmail something like i.e. %dateeuro%? I expect this should get changed shortly. Most likely, %DATE% will get converted to the de-facto international standard DD MMM (as in 12 Aug 2004). Unlike DD/MM/ and MM/DD/, DD MMM can be read by anyone anywhere (with the other two, 02/03/2004 could be either February or March; it is impossible to tell). The true standard date format (MMDD) is too confusing for the average person to deal with, as it is rarely seen, but may get added as well. In the next release, %DATE% will indeed be changed to DD MMM (12 Aug 2004), and %USDATE% will have the old U.S.-style date format (08/12/2004), %EURDATE% will have the European-style date format (12/08/2004), and %ISODATE% will have the standard date format (2004-08-12). The reason for changing %DATE% is to ensure that after upgrading, everybody uses an international-friendly date format. If anybody doesn't like that, they do have the option of switching to %USDATE%. And those that want to can use %EURDATE% or %ISODATE%. However, only %DATE% or %ISODATE% should really be used (as both can be read by anybody). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] F-Prot and Mydoom.O
And for fpcmd is this one right? Declude Manuel: C:\Progra~1\Comman~1\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOBOOT /DUMB /REPORT=report.txt changes to: C:\Progra~1\Comman~1\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOBOOT /DUMB /REPORT=report.txt or should the parameters set with / or with - within fpcmd ? Thanks for an info, Uwe - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, July 28, 2004 3:01 PM Subject: [Declude.Virus] F-Prot and Mydoom.O It turns out that there is a flaw in recent versions of F-Prot that prevents it from properly detecting Mydoom.O when it is double-zipped. Anyone using F-Prot should change the /ARCHIVE switch in the SCANFILE line in the \IMail\Declude\virus.cfg file to /ARCHIVE=5 . This will make sure that F-Prot properly scans the .ZIP files. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Odd directories under \spool
Declude Virus uses these temporary directories to scan attachments. It is normal to see them appear for short periods of time. If they are not being deleted, there is a problem! I have sometimes (one per day) .vir directories with the following content: 1 file named 1_1.exe Is this a problem? Bye, Uwe - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, July 07, 2004 6:30 PM Subject: Re: [Declude.Virus] Odd directories under \spool Looking at my imail\spool directory I have found three directories all created July 1 within an hour of each other. D79d0001f02001d77.vir D79d70007023a1d91.vir D89d4299a010aa32a.vir All of them have a report.txt with info from McAfee on doing a virus scan. I assume it is safe to delete these directories but my question would be why did they get left behind. From the Troubleshooting section of the manual: --- I see lots of .vir directories in my spool directory. Declude Virus uses these temporary directories to scan attachments. It is normal to see them appear for short periods of time. If they are not being deleted, there is a problem! The two common causes are either that you entered an invalid program name in the SCANFILE option in \IMail\Declude\virus.cfg (make sure there are no spaces in the path), or your virus scanner is leaving files behind that prevent Declude from deleting the directory (it may be saving a report file that Declude doesn't know about). This could also happen if you are using the REPORT configuration option and do not have a report.txt file being saved properly (you can NOT use a path name for the report.txt file). --- -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Current interim release
http://www.declude.com/interim/ Greetings, Uwe -Ursprüngliche Nachricht- Von: David [EMAIL PROTECTED] An: [EMAIL PROTECTED] Gesendet: Mittwoch, 31. März 2004 23:23 Betreff: [Declude.Virus] Current interim release What is the link for the current interim Declude AV download? I know I should know this, but I can't find it. :(( I want to upgrade to catch the .RAR encrypted files too. Thank you, David http://www.orcsweb.com/ Powerful Web Hosting Solutions #1 in Service and Support --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] whitelisting?
Thanks Scott, Best money I ever spent - Declude. Can't say enough how much your efforts are appreciated. :) Andy Thumpernet Same to me ! Thank you a lot, Scott for this great product and the excellent support! Uwe - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, March 19, 2004 1:41 PM Subject: Re: [Declude.Virus] whitelisting? I would now need to go back and try to figure out exactly what settings I need to stop the bad stuff and allow the good stuff. FYI, the latest advice is: [1] Run the latest interim of Declude Virus (1.78i27 or later), and [2] Block all encrypted .ZIP files by adding a line BANEXT EZIP to the \IMail\Declude\virus.cfg file. That shuold block all known viruses. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
