John Tolmachoff (Lists) wrote:
5 letters left.
Then we'll get W32/Bagle.aa, W32/Bagle.ab etc, like we had with Yaha.
Erminio
---
[This E-mail has been scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came
Maybe some hard evidence this was spread by spammers
At around 3:40AM to 4:00AM ET I caught over 125 Bagle.U viruses in my spam
folder that catches mail held by the CBL blacklist, they were all sent
through open relays like spam and were caught because the hosts they were
sent through were
Is there any thought about changing this? IE removing the attachment and
passing the email through.
Or is the case I gave very rare?? IE a legitimate email with the
Quarantined Attachment.txt. And if not blocked it will come through, I am
aware as I do not block them.
Why add Quarantined
I was researching a pif file that got banned today and found it to be a length=0 file.
I remember a discussion that the Netsky variant was generating these 0 length files.
I wondering if an Declude change to give the option to ban length 0 files would be any
good.
While we are on the topic of
I know Matt @ Mailpure has suggested this in the past. I would also like to vote for
this feature in an upcoming release.
Matt's original e-mail:
I have a problem. I just noticed that since adding the line BANNAME DELETED0.TXT to
my Virus.cfg, my BANnotify.eml file is bouncing notifications in
Hi all we just had a case where an email was banned because Declude said it
had an exe in the email, when it only had a TXT.
What happened here?
Thanks.
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
Is there any thought about changing this? IE removing the attachment and
passing the email through.
That is not likely to happen soon, as it requires MIME encoding (which
Declude doesn't do at all -- it only does MIME decoding).
-Scott
---
Double check the D file. There might be more than one attachment.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]
On Behalf Of Jay Calvert
Sent: Friday, March 26, 2004 8:57 AM
To: [EMAIL PROTECTED]
I have a problem. I just noticed that since adding the line BANNAME
DELETED0.TXT to my Virus.cfg, my BANnotify.eml file is bouncing
notifications in response to these files. I tried SKIPIFVIRUSNAMEHAS
DELETED0.TXT, but that didn't work. The problem of course is that these
files aren't in fact
Hi all we just had a case where an email was banned because Declude said it
had an exe in the email, when it only had a TXT.
What happened here?
What happened is that either it contained an .exe file, or it had multiple
extensions (in which case Declude Virus assumes the worst, that it is an
Scott,
I just sent it to you, please look for it, it came from our systems account.
Jay
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, March 26, 2004 9:17 AM
Subject: Re: [Declude.Virus] BANEXT EXE
Hi all we just had a case where an
I have several examples of that from last night as well, all the txt
attachments were anti-virus generated attachments
03/25/2004 19:11:00 Q751409530072c4c8 MIME file: DELETED0.TXT
[quoted-printable; Length=113 Checksum=12852]
03/25/2004 19:11:00 Q751409530072c4c8 Banning file deleted0.txt.
I have several examples of that from last night as well, all the txt
attachments were anti-virus generated attachments
03/25/2004 19:11:00 Q751409530072c4c8 MIME file: DELETED0.TXT
[quoted-printable; Length=113 Checksum=12852]
03/25/2004 19:11:00 Q751409530072c4c8 Banning file deleted0.txt.
Scott,
Did you receive the second email?
Jay
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, March 26, 2004 9:39 AM
Subject: Re: [Declude.Virus] BANEXT EXE
I have several examples of that from last night as well, all the txt
Hi all we just had a case where an email was banned because Declude said it
had an exe in the email, when it only had a TXT.
What happened here?
The problem here is that the mail client (a program whose name is as poor
as its MIME handling: Mail A.01.77) is giving out 2 different names for
the
But if this is the case, how will a file be caught if somebody renames a
.zip to a .zio?
Will declude know the difference. Would be wonderful if it did!
Jay
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, March 26, 2004 10:50 AM
Subject:
The problem here is that the mail client (a program whose name is as poor
as its MIME handling: Mail A.01.77) is giving out 2 different names for
the file. In one location, it calls the file EPM11002.FILES.CANJET, in
the other location it calls it EPM11002.TXT. While Declude Virus knows
I was just thinking, is there a way instead of having BANEXT, to allowed
EXT?
We want to cut down on employees bypassing the filters by renaming an
attachment Maybe if it isn't in the list it is held for review
Will this stop blah.txt.exe files though if we wanted .txt's to get through
Jay
FYI, at the request of our customers, we have just set a new mailing list
called Virus Alert. The list is designed to let our customers know as
soon as we find out about new, fast-spreading viruses. The goal is to help
you be as protected as possible before virus definitions are updated.
Sounds good. Now the question of the day is...how do we subscribe?
Darin.
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, March 26, 2004 3:29 PM
Subject: [Declude.Virus] New Virus Alert mailing list for urgent virus
information
FYI, at
Sounds good. Now the question of the day is...how do we subscribe?
Oops. :)
You can send an E-mail to [EMAIL PROTECTED] with subscribe virusalert
Your Name in the body of the E-mail.
-Scott
---
Declude JunkMail: The advanced anti-spam
Thanks.
Oh, how does one sign up on this list?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]
On Behalf Of R. Scott Perry
Sent: Friday, March 26, 2004 12:29 PM
To: [EMAIL PROTECTED]
Subject:
You can send an E-mail to [EMAIL PROTECTED] with subscribe virusalert
Your Name in the body of the E-mail.
BUT, that will not work for everything, such as a alpha/numeric pager or a
cell phone which only had SMS on it, not e-mail.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
You can send an E-mail to [EMAIL PROTECTED] with subscribe virusalert
Your Name in the body of the E-mail.
BUT, that will not work for everything, such as a alpha/numeric pager or a
cell phone which only had SMS on it, not e-mail.
In that case, you can just E-mail me the address you want added
You can send an E-mail to [EMAIL PROTECTED] with subscribe
virusalert
Your Name in the body of the E-mail.
BUT, that will not work for everything, such as a alpha/numeric pager or a
cell phone which only had SMS on it, not e-mail.
John Tolmachoff
Engineer/Consultant/Owner
eServices For
BUT, that will not work for everything, such as a alpha/numeric pager or
a
cell phone which only had SMS on it, not e-mail.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
Most cell phone services provide an email address for sending SMS messages
to your phone. ATT for
We set up emergency support aliases for exactly this purpose. They send to
phones/pagers and copy standard support aliases.
So you could create one and subscribe to the virus alert list with it.
Darin.
- Original Message -
From: John Tolmachoff (Lists) [EMAIL PROTECTED]
To: [EMAIL
Excellent idea. Thank you very much.
D.
At 01:29 PM 3/26/2004, you wrote:
FYI, at the request of our customers, we have just set a new mailing list
called Virus Alert. The list is designed to let our customers know as
soon as we find out about new, fast-spreading viruses. The goal is to
we need a similar emergency list for spam tests going down, requiring
changes in global.cfg
- Original Message -
From: Dale McDiarmid [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, March 26, 2004 10:37 PM
Subject: Re: [Declude.Virus] New Virus Alert mailing list for urgent virus
we need a similar emergency list for spam tests going down, requiring
changes in Global.cfg
Not really, as those (in the past) have not occurred so rapidly that a
problem occurred. There is almost always a few days notice and is discussed
on the JunkMail list.
John Tolmachoff
For those of us who are not full time postmasters, we may spend days,
sometime more than a couple of weeks without reading these lists.
and when we come back, we usualy do not have the time to catch up
so an emergency junkmail list would be welcomed, not necessarly to route to
sms/pager, but at
For those of us who are not full time postmasters, we may spend days,
sometime more than a couple of weeks without reading these lists.
and when we come back, we usualy do not have the time to catch up
so an emergency junkmail list would be welcomed, not necessarly to route
to
sms/pager, but
32 matches
Mail list logo
