RE: [Declude.Virus] BanNotify email not being sent

2007-05-02 Thread Randy Armbrecht
John, Using Declude 4.3.30 Here are the log snippets IMail Log 04:30 15:20 SMTPD(417801bbe648) [10.0.136.32] connect 208.74.87.254 port 3607 04:30 15:20 SMTPD(417801bbe648) [208.74.87.254] EHLO hradt 04:30 15:20 SMTPD(417801bbe648) Authenticated [EMAIL PROTECTED], session

RE: [Declude.Virus] BanNotify email not being sent

2007-05-02 Thread Randy Armbrecht
I just upgraded to 4.3.46 and same thing - BANnotify is not being sent... Randy A. From: John T \(lists\) [EMAIL PROTECTED] Sent: Monday, April 30, 2007 8:21 PM To: declude.virus@declude.com Subject: RE:

RE: [Declude.Virus] BanNotify email not being sent

2007-05-02 Thread John T \(lists\)
1) Put your virus log into debug and then try sending a banned extension attachement. 2) Post your bannotify.eml file as a text attachment John T From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Randy Armbrecht Sent: Wednesday, May 02, 2007 5:48 AM To:

RE: [Declude.Virus] re: new virus with .rar attachment

2007-05-02 Thread Gary Steiner
So, how's the investigation going? Original Message From: David Barker [EMAIL PROTECTED] Sent: Wednesday, April 25, 2007 6:43 PM To: declude.virus@declude.com Subject: RE: [Declude.Virus] re: new virus with .rar attachment Not sure if it is a bug just yet, I have

RE: [Declude.Virus] re: new virus with .rar attachment

2007-05-02 Thread David Barker
It is on our list. I will post when I have any results. So in short it's moving along -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Wednesday, May 02, 2007 3:32 PM To: declude.virus@declude.com Subject: RE: [Declude.Virus] re:

RE: [Declude.Virus] More info about encrypted RAR virus and Declude failures

2007-05-02 Thread Gary Steiner
I am confused as to how this would work, as BANEXT RAR in EVA will hold those files regardless of the weight. Has anyone worked out a way to ban small RAR files that would contain the virus, and pass large RAR files that most likely would not? I'm trying to find a work around until Declude

RE: [Declude.Virus] More info about encrypted RAR virus and Declude failures

2007-05-02 Thread David Barker
Yes I apologize I only realized the next day (Saturday) that this would not work because the message will be scanned if it is under a HOLD or DELETE threshold. David -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Wednesday, May 02,

RE: [Declude.Virus] More info about encrypted RAR virus and Declude failures

2007-05-02 Thread Colbeck, Andrew
Without offering up the exact how-to, I can point out that the SIZE test and a BODY CONTAINS combination would likely help in Declude JunkMail, and that you would have to stop banning RAR files in Declude EVA. Judicious use of the SIZE test would help Gary to HOLD only small RAR files, whether

RE: [Declude.Virus] BanNotify email not being sent

2007-05-02 Thread Randy Armbrecht
John, I should have known to go to DEBUG mode first Here's what is showing there: 05/02/2007 17:27:31.265 q0225028073d8.smd Not sending .eml file since AUTOFORGING detected a forging virus. I sent a regular .exe program install file in the test. The question now is

RE: [Declude.Virus] BanNotify email not being sent

2007-05-02 Thread John T \(lists\)
Sorry to bother, but please post the rest of the lines from the debug log for that message. John T From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Randy Armbrecht Sent: Wednesday, May 02, 2007 2:36 PM To: declude.virus@declude.com Subject: RE: [Declude.Virus] BanNotify email