[Declude.Virus] What are these

2004-10-25 Thread Keith Johnson
Q06634053002e6803 Error 183 creating temp directory
F:\IMail\spool\D06634053002e6803.vir\.
10/25/2004 10:26:26 Q06634053002e6803 Scanned: Error starting scanner

Thanks for the aid, running 1.81 



---
Keith Johnson
Senior Network Engineer
Network Advocates, Inc.
9001 Shelbyville Road
Burhans Hall, Suite 260
Louisville, KY 40228
TEL: 502.992.5928
FAX: 502.412.1058
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


RE: [Declude.Virus] What are these

2004-10-25 Thread Keith Johnson
Also,

ERROR: Could not open recip file F:\IMail\spool\_08dc4c3a0030129f.~MD
[2]

Please advise to what this is, thanks,

Keith 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson
Sent: Monday, October 25, 2004 10:24 AM
To: [EMAIL PROTECTED]
Subject: [Declude.Virus] What are these

Q06634053002e6803 Error 183 creating temp directory
F:\IMail\spool\D06634053002e6803.vir\.
10/25/2004 10:26:26 Q06634053002e6803 Scanned: Error starting scanner

Thanks for the aid, running 1.81 



---
Keith Johnson
Senior Network Engineer
Network Advocates, Inc.
9001 Shelbyville Road
Burhans Hall, Suite 260
Louisville, KY 40228
TEL: 502.992.5928
FAX: 502.412.1058
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


RE: [Declude.Virus] What are these

2004-10-25 Thread Keith Johnson
Also getting:

Q08b8153d00e2843a Couldn't rename SMD to SM$ [32].  Priority back to 32.


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson
Sent: Monday, October 25, 2004 10:24 AM
To: [EMAIL PROTECTED]
Subject: [Declude.Virus] What are these

Q06634053002e6803 Error 183 creating temp directory
F:\IMail\spool\D06634053002e6803.vir\.
10/25/2004 10:26:26 Q06634053002e6803 Scanned: Error starting scanner

Thanks for the aid, running 1.81 



---
Keith Johnson
Senior Network Engineer
Network Advocates, Inc.
9001 Shelbyville Road
Burhans Hall, Suite 260
Louisville, KY 40228
TEL: 502.992.5928
FAX: 502.412.1058
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


RE: [Declude.Virus] What are these

2004-10-25 Thread John Tolmachoff \(Lists\)
Do you have an on-access scanner running?

John Tolmachoff
Engineer/Consultant/Owner
eServices For You


 -Original Message-
 From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]
 On Behalf Of Keith Johnson
 Sent: Monday, October 25, 2004 7:38 AM
 To: [EMAIL PROTECTED]
 Subject: RE: [Declude.Virus] What are these
 
 Also,
 
 ERROR: Could not open recip file F:\IMail\spool\_08dc4c3a0030129f.~MD
 [2]
 
 Please advise to what this is, thanks,
 
 Keith
 
 -Original Message-
 From: [EMAIL PROTECTED]
 [mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson
 Sent: Monday, October 25, 2004 10:24 AM
 To: [EMAIL PROTECTED]
 Subject: [Declude.Virus] What are these
 
 Q06634053002e6803 Error 183 creating temp directory
 F:\IMail\spool\D06634053002e6803.vir\.
 10/25/2004 10:26:26 Q06634053002e6803 Scanned: Error starting scanner
 
 Thanks for the aid, running 1.81
 
 
 
 ---
 Keith Johnson
 Senior Network Engineer
 Network Advocates, Inc.
 9001 Shelbyville Road
 Burhans Hall, Suite 260
 Louisville, KY 40228
 TEL: 502.992.5928
 FAX: 502.412.1058
 ---
 [This E-mail was scanned for viruses by Declude Virus
 (http://www.declude.com)]
 
 ---
 This E-mail came from the Declude.Virus mailing list.  To unsubscribe,
 just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.Virus.The archives can be found
 at http://www.mail-archive.com.
 
 
 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
 
 ---
 This E-mail came from the Declude.Virus mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.Virus.The archives can be found
 at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] What are these

2004-10-25 Thread R. Scott Perry

Q06634053002e6803 Error 183 creating temp directory
F:\IMail\spool\D06634053002e6803.vir\.
10/25/2004 10:26:26 Q06634053002e6803 Scanned: Error starting scanner
That error means that the .vir directory already exists -- this will happen 
if IMail accidentally calls Declude multiple times.  Although you will see 
the warnings in the log file, Declude will still function properly.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


RE: [Declude.Virus] What are these

2004-10-25 Thread Keith Johnson
John,
Both are turned off, use F-prot (Realtime not install), Inoc
turned off and Disabled.

Keith 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
(Lists)
Sent: Monday, October 25, 2004 10:53 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] What are these

Do you have an on-access scanner running?

John Tolmachoff
Engineer/Consultant/Owner
eServices For You


 -Original Message-
 From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]
 On Behalf Of Keith Johnson
 Sent: Monday, October 25, 2004 7:38 AM
 To: [EMAIL PROTECTED]
 Subject: RE: [Declude.Virus] What are these
 
 Also,
 
 ERROR: Could not open recip file F:\IMail\spool\_08dc4c3a0030129f.~MD
 [2]
 
 Please advise to what this is, thanks,
 
 Keith
 
 -Original Message-
 From: [EMAIL PROTECTED]
 [mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson
 Sent: Monday, October 25, 2004 10:24 AM
 To: [EMAIL PROTECTED]
 Subject: [Declude.Virus] What are these
 
 Q06634053002e6803 Error 183 creating temp directory 
 F:\IMail\spool\D06634053002e6803.vir\.
 10/25/2004 10:26:26 Q06634053002e6803 Scanned: Error starting scanner
 
 Thanks for the aid, running 1.81
 
 
 
 ---
 Keith Johnson
 Senior Network Engineer
 Network Advocates, Inc.
 9001 Shelbyville Road
 Burhans Hall, Suite 260
 Louisville, KY 40228
 TEL: 502.992.5928
 FAX: 502.412.1058
 ---
 [This E-mail was scanned for viruses by Declude Virus 
 (http://www.declude.com)]
 
 ---
 This E-mail came from the Declude.Virus mailing list.  To unsubscribe,

 just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.Virus.The archives can be found
 at http://www.mail-archive.com.
 
 
 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
 
 ---
 This E-mail came from the Declude.Virus mailing list.  To unsubscribe,

 just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.Virus.The archives can be found
 at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


RE: [Declude.Virus] What are these

2004-10-25 Thread Keith Johnson
Scott,
We are backing up in our Queue of about 8000 emails and we
started seeing the below messages as well:


Q08b8153d00e2843a Couldn't rename SMD to SM$ [32].  Priority back to 32.

ERROR: Could not open recip file F:\IMail\spool\_08dc4c3a0030129f.~MD
[2]

Are these related?

Keith

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Monday, October 25, 2004 10:55 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] What are these


Q06634053002e6803 Error 183 creating temp directory 
F:\IMail\spool\D06634053002e6803.vir\.
10/25/2004 10:26:26 Q06634053002e6803 Scanned: Error starting scanner

That error means that the .vir directory already exists -- this will
happen if IMail accidentally calls Declude multiple times.  Although you
will see the warnings in the log file, Declude will still function
properly.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in
mailserver vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


RE: [Declude.Virus] What are these

2004-10-25 Thread R. Scott Perry

We are backing up in our Queue of about 8000 emails and we
started seeing the below messages as well:
Q08b8153d00e2843a Couldn't rename SMD to SM$ [32].  Priority back to 32.
ERROR: Could not open recip file F:\IMail\spool\_08dc4c3a0030129f.~MD
[2]
Are these related?
It almost certainly is related.  Those warnings can occur if there are 
multiple Declude processes trying to handle the same E-mail.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


[Declude.Virus] Re:Alternative to Imail

2004-10-25 Thread Nick
Scott,

What other MTA's do you support or intend to support in the near 
future with Declude like functionality?

Can you suggest one other than Imail?

-Nick

-

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] Scott, what is our future?

2004-10-25 Thread R. Scott Perry

You have been strangely quiet. Are you in shock or formulating a plan --
hopefully the latter?
Although I will admit to shock (disbelief would be a more appropriate term) 
when I first heard about this.  I didn't think that Ipswitch would actually 
do it.  But they did.

As for formulating a plan, that is in the works.  But a lot will depend on 
whether Ipswitch is smart enough to fix the problem, or whether they truly 
isolate the majority of their loyal customers.

It may be too early to ask, but what does the future hold for Declude/Imail
or Declude and _ mail server product (fill in the blank)?
It's too early to say.  A lot will depend on how Ipswitch responds to their 
customers -- I can't imagine that they will completely ignore this.  A 
business can't survive by destroying a loyal customer base, when they have 
the product to offer.

But I can definitely say this:  Declude isn't going to go away, no matter 
what Ipswitch may do.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] Scott, what is our future?

2004-10-25 Thread Dan Shadix
That's great to hear.  I've only stayed with Imail as long as I have 
because of Declude.  I quit upgrading after 7.15 and let my Imail SA 
lapse.  I'll be installing Exchange in a few months and will use my 
Imail/Declude setup as a front end to isolate the Exchange server from 
the Internet and plan to add Declude Anti-Spam at that time.  If you 
create a standalone product that will replace my present Imail/Declude 
setup I'll be ecstatic (unless you pull and Ipswitch and charge an arm 
and a leg).

R. Scott Perry wrote:
But I can definitely say this:  Declude isn't going to go away, no 
matter what Ipswitch may do.

--
Dan Shadix
IT Systems Administrator
Terry Reilly Health Services
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


[Declude.Virus] passworded zip file

2004-10-25 Thread Peter Lowish



Declude 1.81 virus 
standard

A client reguarly 
receives a passworded .zip file. A similiar file is batch sent to 100's of 
others - the sender cant/wont change the way they send these files. The file is 
always received from the same sender using the same ip 
address

We havebeen 
using virus_domains.txt to bypass our clients email being scanned for 
virus'suntil very recently, but has found several virus's have recently 
got thru their own anti virus software

Is there any way of 
declude virus whitelisting either the senders email address or ip address for 
email being sentto our client? - I have added the IP address to be 
whitelisted in global.cfg but it still deletes what it believes to be an 
infected file

10/23/2004 17:59:24 
Qe52c1aeb008a6cf6 Found encrypted .ZIP file10/23/2004 17:59:24 
Qe52c1aeb008a6cf6 Scanned: Banned file extension. [MIME: 3 5031]10/23/2004 
17:59:24 Qe52c1aeb008a6cf6 Couldn't open E-mail file 
C:\IMail\Declude\BANnotify.eml.10/23/2004 17:59:24 Qe52c1aeb008a6cf6 From: 
[EMAIL PROTECTED] To: [EMAIL PROTECTED]10/23/2004 
17:59:24 Qe52c1aeb008a6cf6 Subject: ---Confidential MOE CSV File for pay period 
315[23/10/2004 17:56:27]

tks

Peter


Re: [Declude.Virus] passworded zip file

2004-10-25 Thread R. Scott Perry

A client reguarly receives a passworded .zip file. A similiar file is 
batch sent to 100's of others - the sender cant/wont change the way they 
send these files.
That would have been fine -- until March, 2004, when there was yet another 
change to the way E-mail needs to be handled.  If they send encrypted .ZIP 
files, they need to either rename the extension (which may be only a 
temporary solution), find another method to send the E-mail (perhaps an 
unencrypted .ZIP file with the encrypted .ZIP file in it), or accept that 
some of their E-mails will be blocked.

It's important to remember that sending attachments via E-mail is a hack -- 
FTP is the protocol designed specifically for transferring files.

The file is always received from the same sender using the same ip address
We have been using virus_domains.txt to bypass our clients email being 
scanned for virus's until very recently, but has found several virus's 
have recently got thru their own anti virus software

Is there any way of declude virus whitelisting either the senders email 
address or ip address for email being sent to our client? - I have added 
the IP address to be whitelisted in global.cfg but it still deletes what 
it believes to be an infected file
Note that the global.cfg file only affects Declude JunkMail (not Declude 
Virus).

There isn't any way to whitelist users or IPs in Declude Virus.  If users 
want to have potentially dangerous E-mail delivered to them, they need to 
run AV software that meets their needs.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] Scott, what is our future?

2004-10-25 Thread Matt
Scott,
I accept that Declude isn't going away, but I've dumped a lot of money 
into building my service around both Declude and IMail, and as things 
stand at the moment, I don't have $4,000 to dump on their new product 
just so that I can get updates for the things that they have managed to 
break and not fix.

If you are working on another MTA, then let's hear it!  As things stand 
at the moment, it looks like I have no other choice but to switch to 
another platform, and it would be best to know what your plans are 
before I start making my own.  My gut tells me that even if I threw 
Ipswitch another $4,000, nothing would really change with them except 
for the damn price, and I really, really hate being taken advantage of.

Maybe you are confident about your plans for the future, but not knowing 
them, how could I be.

Thanks,
Matt

R. Scott Perry wrote:

You have been strangely quiet. Are you in shock or formulating a plan --
hopefully the latter?

Although I will admit to shock (disbelief would be a more appropriate 
term) when I first heard about this.  I didn't think that Ipswitch 
would actually do it.  But they did.

As for formulating a plan, that is in the works.  But a lot will 
depend on whether Ipswitch is smart enough to fix the problem, or 
whether they truly isolate the majority of their loyal customers.

It may be too early to ask, but what does the future hold for 
Declude/Imail
or Declude and _ mail server product (fill in the blank)?

It's too early to say.  A lot will depend on how Ipswitch responds to 
their customers -- I can't imagine that they will completely ignore 
this.  A business can't survive by destroying a loyal customer base, 
when they have the product to offer.

But I can definitely say this:  Declude isn't going to go away, no 
matter what Ipswitch may do.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail 
mailservers since 2000.
Declude Virus: Ultra reliable virus detection and the leader in 
mailserver vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] passworded zip file

2004-10-25 Thread Matt




Switch to BANEZIPEXTS ON and remove BANEXT EZIP from your config and
then it will only block password protected zip files that contain a
file with one of your banned extensions. Currently the viruses are
only coming in as EXE, SCR, PIF and COM files within these password
protected zips, so make sure that these file types are in your BANEXT
list. This will allow through all other types of files within the
encrypted zips, including the CSV file that your client wants to
receive.

Matt


Peter Lowish wrote:

  
  
  

  Declude 1.81 virus
standard
  
  A client reguarly receives a passworded .zip
file. A similiar file is batch sent to 100's of others - the sender
cant/wont change the way they send these files. The file is always
received from the same sender using the same ip address
  
  We havebeen using virus_domains.txt to
bypass our clients email being scanned for virus'suntil very recently,
but has found several virus's have recently got thru their own anti
virus software
  
  Is there any way of declude virus
whitelisting either the senders email address or ip address for email
being sentto our client? - I have added the IP address to be
whitelisted in global.cfg but it still deletes what it believes to be
an infected file
  
  10/23/2004 17:59:24 Qe52c1aeb008a6cf6 Found
encrypted .ZIP file
10/23/2004 17:59:24 Qe52c1aeb008a6cf6 Scanned: Banned file extension.
[MIME: 3 5031]
10/23/2004 17:59:24 Qe52c1aeb008a6cf6 Couldn't open E-mail file
C:\IMail\Declude\BANnotify.eml.
10/23/2004 17:59:24 Qe52c1aeb008a6cf6 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED]
10/23/2004 17:59:24 Qe52c1aeb008a6cf6 Subject: ---Confidential MOE CSV
File for pay period 315[23/10/2004 17:56:27]
  
  tks
  
  Peter


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=




Re: [Declude.Virus] passworded zip file

2004-10-25 Thread Serge



create a special mailbox for your 
client
let him use it only for that file
useper-user config in declude virus 
proto whitelist (turn declude virus off) on that particular 
mailbox
use imail rules to delete all mails to that mailbox 
that does not have the sender address and ip in the header




  - Original Message - 
  From: 
  Peter Lowish 
  
  To: [EMAIL PROTECTED] 
  Sent: Monday, October 25, 2004 11:34 
  PM
  Subject: [Declude.Virus] passworded zip 
  file
  
  Declude 1.81 virus 
  standard
  
  A client reguarly 
  receives a passworded .zip file. A similiar file is batch sent to 100's of 
  others - the sender cant/wont change the way they send these files. The file 
  is always received from the same sender using the same ip 
  address
  
  We havebeen 
  using virus_domains.txt to bypass our clients email being scanned for 
  virus'suntil very recently, but has found several virus's have recently 
  got thru their own anti virus 
software
  
  Is there any way of 
  declude virus whitelisting either the senders email address or ip address for 
  email being sentto our client? - I have added the IP address to be 
  whitelisted in global.cfg but it still deletes what it believes to be an 
  infected file
  
  10/23/2004 17:59:24 
  Qe52c1aeb008a6cf6 Found encrypted .ZIP file10/23/2004 17:59:24 
  Qe52c1aeb008a6cf6 Scanned: Banned file extension. [MIME: 3 5031]10/23/2004 
  17:59:24 Qe52c1aeb008a6cf6 Couldn't open E-mail file 
  C:\IMail\Declude\BANnotify.eml.10/23/2004 17:59:24 Qe52c1aeb008a6cf6 From: 
  [EMAIL PROTECTED] To: [EMAIL PROTECTED]10/23/2004 
  17:59:24 Qe52c1aeb008a6cf6 Subject: ---Confidential MOE CSV File for pay 
  period 315[23/10/2004 17:56:27]
  
  tks
  
  Peter


Re: [Declude.Virus] Scott, what is our future?

2004-10-25 Thread Serge
ditto
looking seriously to moving to exim (unix, www.exim.org, free), or more
likely, Mdaemon (windows platform, supports sniffer)
knowing if declude is planning to interface with another product will
probably help me make the decision



- Original Message - 
From: Matt [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, October 25, 2004 11:53 PM
Subject: Re: [Declude.Virus] Scott, what is our future?


 Scott,

 I accept that Declude isn't going away, but I've dumped a lot of money
 into building my service around both Declude and IMail, and as things
 stand at the moment, I don't have $4,000 to dump on their new product
 just so that I can get updates for the things that they have managed to
 break and not fix.

 If you are working on another MTA, then let's hear it!  As things stand
 at the moment, it looks like I have no other choice but to switch to
 another platform, and it would be best to know what your plans are
 before I start making my own.  My gut tells me that even if I threw
 Ipswitch another $4,000, nothing would really change with them except
 for the damn price, and I really, really hate being taken advantage of.

 Maybe you are confident about your plans for the future, but not knowing
 them, how could I be.

 Thanks,

 Matt



 R. Scott Perry wrote:

 
  You have been strangely quiet. Are you in shock or formulating a
plan --
  hopefully the latter?
 
 
  Although I will admit to shock (disbelief would be a more appropriate
  term) when I first heard about this.  I didn't think that Ipswitch
  would actually do it.  But they did.
 
  As for formulating a plan, that is in the works.  But a lot will
  depend on whether Ipswitch is smart enough to fix the problem, or
  whether they truly isolate the majority of their loyal customers.
 
  It may be too early to ask, but what does the future hold for
  Declude/Imail
  or Declude and _ mail server product (fill in the blank)?
 
 
  It's too early to say.  A lot will depend on how Ipswitch responds to
  their customers -- I can't imagine that they will completely ignore
  this.  A business can't survive by destroying a loyal customer base,
  when they have the product to offer.
 
  But I can definitely say this:  Declude isn't going to go away, no
  matter what Ipswitch may do.
 
 -Scott
  ---
  Declude JunkMail: The advanced anti-spam solution for IMail
  mailservers since 2000.
  Declude Virus: Ultra reliable virus detection and the leader in
  mailserver vulnerability detection.
  Find out what you've been missing: Ask for a free 30-day evaluation.
 
  ---
  [This E-mail was scanned for viruses by Declude Virus
  (http://www.declude.com)]
 
  ---
  This E-mail came from the Declude.Virus mailing list.  To
  unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
  type unsubscribe Declude.Virus.The archives can be found
  at http://www.mail-archive.com.
 
 

 -- 
 =
 MailPure custom filters for Declude JunkMail Pro.
 http://www.mailpure.com/software/
 =

 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

 ---
 This E-mail came from the Declude.Virus mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.Virus.The archives can be found
 at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


RE: [Declude.Virus] Scott, what is our future?

2004-10-25 Thread Fritz Squib
See http://www.mail-archive.com/[EMAIL PROTECTED]/

And http://www.ipswitch.com/forums/messages.aspx?ForumID=10

Ipswitch is abandoning Imail for their new Collaboration Suite.

Fritz

Frederick P. Squib, Jr.
Network Operations/Mail Administrator
Citizens Telephone Company of Kecksburg
http://www.wpa.net

()  ascii ribbon campaign - against html mail 
/\- against microsoft attachments

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Jim Matuska
Sent: Monday, October 25, 2004 8:07 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] Scott, what is our future?


Ok, I think I missed something here.  What is everyone talking about here, 
is Imail prohibiting add on's such as declude in future versions (I sure 
hope not), is declude launching a new version for another platform?  The 
panic level just went up with those last few emails.

Jim
- Original Message - 
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, October 25, 2004 3:49 PM
Subject: Re: [Declude.Virus] Scott, what is our future?



You have been strangely quiet. Are you in shock or formulating a plan 
-- hopefully the latter?

 Although I will admit to shock (disbelief would be a more appropriate
 term) when I first heard about this.  I didn't think that Ipswitch would 
 actually do it.  But they did.

 As for formulating a plan, that is in the works.  But a lot will 
 depend on
 whether Ipswitch is smart enough to fix the problem, or whether they truly

 isolate the majority of their loyal customers.

It may be too early to ask, but what does the future hold for
Declude/Imail
or Declude and _ mail server product (fill in the blank)?

 It's too early to say.  A lot will depend on how Ipswitch responds to
 their customers -- I can't imagine that they will completely ignore this. 
 A business can't survive by destroying a loyal customer base, when they 
 have the product to offer.

 But I can definitely say this:  Declude isn't going to go away, no 
 matter
 what Ipswitch may do.

-Scott
 ---
 Declude JunkMail: The advanced anti-spam solution for IMail 
 mailservers
 since 2000.
 Declude Virus: Ultra reliable virus detection and the leader in mailserver

 vulnerability detection.
 Find out what you've been missing: Ask for a free 30-day evaluation.

 ---
 [This E-mail was scanned for viruses by Declude Virus
 (http://www.declude.com)]

 ---
 This E-mail came from the Declude.Virus mailing list.  To unsubscribe, 
 just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.Virus.The archives can be found
 at http://www.mail-archive.com.

 


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just
send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned by Citizens Internet Services with Declude Virus.]


---
[This E-mail scanned by Citizens Internet Services with Declude Virus.]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


Re[2]: [Declude.Virus] Scott, what is our future?

2004-10-25 Thread Sanford Whiteman
 What  is  everyone talking about here, is Imail prohibiting add on's
 such  as  declude  in  future versions

No.

  is declude launching a new version for another platform?

It is, as ever, hoped-for but not confirmed.

 The panic level just went up with those last few emails.

It  sure  did, and despite Ipswitch's scurrilous tactics, I'm not sure
exactly  why  so  many  people are panicking, declaring that they (the
sysadmins)  are  outta  here and running out to find another MTA. If
you're  running 8.1x or 7.1x and are satisfied with its performance as
the  wrapper  for  great  add-ons  such  as Declude (and in turn for
Sniffer,  etc.),  then why all the make-work? Sure, it's never good to
be faced with the knowledge that your relationship with a given vendor
will  be  over  when you _do_ want more features, but the argument for
this  overnight  or near-term migration only makes sense if you have a
current,  spec'd  out  need  for a new feature that (a) is in ICS, but
therefore  beyond  budget  within the Ipswitch product line, or (b) is
not  in  ICS,  but  must be found immediately nonetheless. A couple of
posters have implied that they will move to Exchange, since their last
best  chance  to  avoid  that move (a cheap ICS) hasn't been met; this
makes sense as in option (a). Someone expecting needing envelope-level
anti-spam rejections might move on as in option (b). But wherefore all
the other cut-and-run posts?

We're  only  now  moving  some  of  our last Novell 4.11 shops over to
non-Novell  OSs, and these clients have known for a shocking number of
years  that they would not be using NetWare when the time came to move
on.  Were  we  all angry at Novell for abandoning us when 5 and 6 both
(in  our  opinions)  sucked?  Yes. Did _we_ abandon _them_ in revenge,
when  maintaining  their  most  recent  release  didn't  cost a thing?
Certainly not overnight.

--Sandy



Sanford Whiteman, Chief Technologist
Broadleaf Systems, a division of
Cypress Integrated Systems, Inc.
e-mail: [EMAIL PROTECTED]


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] Scott, what is our future?

2004-10-25 Thread Matt




Sandy,

So what do you do when the next IMail exploit pops up such as that LDAP
exploit and you have no way to fix the bug? Can a serious business
even take the risk of this happening?

No.

I can't see myself on IMail for any more than a year from now.

Matt



Sanford Whiteman wrote:

  
What  is  everyone talking about here, is Imail prohibiting add on's
such  as  declude  in  future versions

  
  
No.

  
  
 is declude launching a new version for another platform?

  
  
It is, as ever, hoped-for but not confirmed.

  
  
The panic level just went up with those last few emails.

  
  
It  sure  did, and despite Ipswitch's scurrilous tactics, I'm not sure
exactly  why  so  many  people are panicking, declaring that they (the
sysadmins)  are  "outta  here" and running out to find another MTA. If
you're  running 8.1x or 7.1x and are satisfied with its performance as
the  "wrapper"  for  great  add-ons  such  as Declude (and in turn for
Sniffer,  etc.),  then why all the make-work? Sure, it's never good to
be faced with the knowledge that your relationship with a given vendor
will  be  over  when you _do_ want more features, but the argument for
this  overnight  or near-term migration only makes sense if you have a
current,  spec'd  out  need  for a new feature that (a) is in ICS, but
therefore  beyond  budget  within the Ipswitch product line, or (b) is
not  in  ICS,  but  must be found immediately nonetheless. A couple of
posters have implied that they will move to Exchange, since their last
best  chance  to  avoid  that move (a cheap ICS) hasn't been met; this
makes sense as in option (a). Someone expecting needing envelope-level
anti-spam rejections might move on as in option (b). But wherefore all
the other cut-and-run posts?

We're  only  now  moving  some  of  our last Novell 4.11 shops over to
non-Novell  OSs, and these clients have known for a shocking number of
years  that they would not be using NetWare when the time came to move
on.  Were  we  all angry at Novell for abandoning us when 5 and 6 both
(in  our  opinions)  sucked?  Yes. Did _we_ abandon _them_ in revenge,
when  maintaining  their  most  recent  release  didn't  cost a thing?
Certainly not overnight.

--Sandy



Sanford Whiteman, Chief Technologist
Broadleaf Systems, a division of
Cypress Integrated Systems, Inc.
e-mail: [EMAIL PROTECTED]


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.


  


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=




Re: [Declude.Virus] Scott, what is our future?

2004-10-25 Thread Matt




Sandy,

I'm not going to debate whether or not the 'sky is blue' with you, but
please don't paint by inference that I'm jumping the gun by
contemplating a very likely change of platforms within the next year.

Scott and the management at Declude might want to continue their
silence regarding target platforms, but they need to make it known
before I make a conscious choice in order to have a better chance of
keeping my business, and I would think that it would be in their best
interest to let others know as well because it is clear in the IMail
list that people are making choices rather quickly. Sure, IMail 8 and
Declude as a pair will limp along for some time, but they are dead-end
products at the moment. Even if Ipswitch changes their tune, I no
longer trust them and I won't be making myself a victim to a potential
screwing at some point down the line. My mail server will no doubt be
changing, and I need to choose a new gateway and mail server to replace
them.

The good news is that I just saved myself the money that I was going to
send to Ipswitch for a new service agreement :) This is the most
ungraceful upgrade path that a piece of software has ever seen when you
consider all the choices, and I've seen some rather hefty changes such
as the WebTrends path to becoming an expensive niche analytics
company. Ipswitch will probably manage the transition fairly well,
keeping say 1 out of 10 subscribers, but it will doom their product to
take themselves out of the mainstream in this way considering that
their pricing now makes them appear not much different than Exchange,
and doing so in a time when capable products are coming up that are
cheaper or even free. I have a memory for people and companies that
try to screw me, and this upgrade path is a screw if I've ever seen
one, and they will never get another dime from me unless the management
is forced out that made these choices. Consider that to be a personal
observation and preference, so the sky is definitely blue.

Matt



Matt



Sanford Whiteman wrote:

  
So  what  do you do when the next IMail exploit pops up such as that
LDAP  exploit  and  you  have  no  way to fix the bug? Can a serious
business even take the risk of this happening?

  
  
There's  no evidence to suggest that security-related patches will not
be  made  available  for  old versions, as evidenced repeatedly in the
pattern  of  moves  from 5-6, 6-7, and 7-8. The particular exploit you
mentioned  is  in a component of IMail that is now open-source, and so
by  definition  can always be patched. Furthermore, using IMail simply
as  a  wrapper  for  Declude gives you only one possible attack vector
(SMTPD)  in a module which essentially hasn't changed in several years
(SMTPD  retains  its  old,  non-multithreaded code, despite QUEUEMGR's
improvements on the delivery side).

Such  patterns  may  change,  but telling our IMail clients that we're
choosing  them  a  new product _now_ would be an admittance of a sheer
lack  of  control.  I'd prefer that the development of, for example, a
new  Declude  MTA  or  preferred  MTA integration not be paced by user
panic.

--Sandy



Sanford Whiteman, Chief Technologist
Broadleaf Systems, a division of
Cypress Integrated Systems, Inc.
e-mail: [EMAIL PROTECTED]


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.


  


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=