[Declude.Virus] Exchange - Expert: Microsoft TNEF flaw could lead to superworm

2006-01-11 Thread Mark Smith
Anyone seen this yet? -0- Expert: Microsoft TNEF flaw could lead to superworm By Bill Brenner, Senior News Writer10 Jan 2006 | SearchSecurity.com IT administrators won't have much chance to breathe after deploying the patch Microsoft rushed out last week for the Windows Meta File (WMF)

[Declude.Virus] FYI Microsoft just released the patch early...

2006-01-05 Thread Mark Smith
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Title: Microsoft Security Response Center Bulletin Notification Issued: January 05, 2006 Summary ===

[Declude.Virus] SKIPEXT - PDF

2004-12-14 Thread Mark Smith
Does anyone know of a reason why to scan PDF files? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The

[Declude.Virus] DELETEVIRUSES Not working.

2004-10-19 Thread Mark Smith
It seems that DELETEVIRUSES ON isn't working in Declude Virus 1.81 I have it set to: DELETEVIRUSES ON In my virus.cfg but they're staying in my E:\IMail\spool\virus folder. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from

RE: [Declude.Virus] DELETEVIRUSES Not working.

2004-10-19 Thread Mark Smith
Any way to purge 'em all without writing a script? We're running about 200k messages per day across 4 servers and don't bother to check them all. Thanks! Mark -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Tuesday, October 19,

RE: [Declude.Virus] Spool Dir

2004-10-18 Thread Mark Smith
Ipswitch Imail has a command line utility to do this. http://support.ipswitch.com/kb/IM-19990629-DM06.htm -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Rogers Sent: Wednesday, October 13, 2004 1:15 PM To: [EMAIL PROTECTED] Subject:

RE: [Declude.Virus] GDI false Postive

2004-09-30 Thread Mark Smith
Is there a way for Declude to stop checking for the GDI Vulnerability and rely on F-Prot? I went to 1.8 and we found that MANY JPG photos were being caught as false positives. Mark Smith --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came

RE: [Declude.Virus] GDI false Postive

2004-09-30 Thread Mark Smith
When you release next fix, can you add the ability to disable this test from inside of declude and rely on the AV software? It killed our photos department yesterday... :) Mark Smith Associated Press -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf

[Declude.Virus] Fprot GDI Scanner lines.

2004-09-25 Thread Mark Smith
Just did some testing with the POC and noticed that Fprot now is adding a new line to the report.txt: e:\imail\test\poc.jpg Contains the exploit named W32/[EMAIL PROTECTED] So I had to add the line: REPORT Contains the exploit named To my virus.cfg file. My complete setup for F-Prot

RE: [Declude.Virus] Fprot GDI Scanner lines.

2004-09-25 Thread Mark Smith
Actually this breaks Declude because Declude Virus can't look for multiple REPORT lines. Scott, How can we setup Declude Virus to look for multiple lines in the report.txt file? Mark -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark Smith Sent

RE: [Declude.Virus] F-Prot/GDI+ FYI

2004-09-25 Thread Mark Smith
In theory we could block links to JPGs in HTML based email but that doesn't help us with people just browsing the Internet. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Saturday, September 25, 2004 2:59 AM To: [EMAIL

RE: [Declude.Virus] F-Prot/GDI+ FYI

2004-09-24 Thread Mark Smith
Greg, Here's a tool to scan everything on the machine: http://isc.sans.org/gdiscan.php Mark --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED],

RE: [Declude.Virus] Attack?

2004-09-22 Thread Mark Smith
What about just disabling Null senders in Imail? Of course this means that most Out of office messages will not make their way into your system but it takes the load off of Declude. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Donn Bly Sent:

RE: [Declude.Virus] X-Declude-Status: Waiting for activation code

2004-02-20 Thread Mark Smith
Scott, I'm seeing this is 1.77i27 also: Declude 1.77i27 (C) Copyright 2000-2004 Computerized Horizons. Diagnostics ON (Declude v1.77i27). Declude JunkMail: Config file found (E:\imail\Declude\global.CFG). Declude Virus: Config file found (E:\imail\Declude\Virus.CFG). Declude Hijack:

[Declude.Virus] F-Prot - OT

2003-10-02 Thread Mark Smith
Does anyone know if the F-Prot real time scanner relies on the NTFS Change notification kernel driver? Here's my problem... I use Microsoft Index Server for web indexing. Index Server and ANY Antivirus software that uses the NTFS Change notification journal do not work together. You get index

[Declude.Virus] SoBig - Narrowing down on source

2003-08-22 Thread Mark Smith
http://www.washingtonpost.com/wp-dyn/articles/A32161-2003Aug22.html --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe

RE: [Declude.Virus] Sobig- Phase II bombardment

2003-08-22 Thread Mark Smith
What they (M$) really need to do, is make windows update integrated into Windows, the problem is they tell you Stay current with updates in a little box above the taskbar when There are huge debates about this. It's amazing that people are against this. Look at the newsgroups, etc...

RE: [Declude.Virus] F-Prot Updater via AT Scheduler Problem

2002-12-19 Thread Mark Smith
What's NT 4.0? :) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Tony Gray - Network Administrator Sent: Thursday, December 19, 2002 9:35 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] F-Prot Updater via AT Scheduler Problem Sorry,

RE: [Declude.Virus] OT: F-Prot definition updating

2002-12-12 Thread Mark Smith
Why mess with DOS batch files? Just write a VBScript file and use the FileScriptingObject. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of John Shacklett Sent: Thursday, December 12, 2002 1:00 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus]

RE: [Declude.Virus] F-Prot version

2002-12-12 Thread Mark Smith
FWIW, Most of these programs won't work if there is a form that needs to interact with the desktop. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Jerod M. Bennett Sent: Thursday, December 12, 2002 1:41 PM To: [EMAIL PROTECTED] Subject: RE:

RE: [Declude.Virus] Internet dial up access

2002-07-17 Thread Mark Smith
FWIW, Two of my T1's are through UUNet. I also use them for DUN. I wondered about their future but the way I see it the SERVICE will still be there but the bill might come from someone else. I've never had a problem with either service. My rep swears that there's no need for concern (I wouldn't

[Declude.Virus] CA eTrust

2002-07-10 Thread Mark Smith
Has/is anyone using Computer Associates eTrust - InoculateIT Version 6.0 with Declude Virus? If so what is the config line that you're using? Thanks! --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus

RE: [Declude.Virus] Trend Micro

2002-06-24 Thread Mark Smith
Yes. Don't buy it. :) What's your email address? [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff Sent: Monday, June 24, 2002 1:49 PM To: [EMAIL PROTECTED] Subject: [Declude.Virus] Trend Micro Importance: High