Re: [Declude.Virus] embedded AVG issue
David, I was having this issue so I followed your directions below. After overwriting the current dlls, I could not get decludeproc to start. I determined that it was the avgsdk.dll that was in the newly downloaded zip file that was the culprit. I had to restore a previous version to get everything working again. I did notice that the new avgsdk.dll is substantially smaller than the old version. So I am still having the issue originally described in the post. Don - Original Message - From: David Barker To: declude.virus@declude.com Sent: Friday, May 07, 2010 1:25 PM Subject: RE: [Declude.Virus] embedded AVG issue We have seen this mostly with manual installs. Error: Could not start AVG Instance (17) has to do with the DLL. Please contact supp...@declude.com if you need assistance. 1. Stop decludeproc 2. Download http://interim.declude.com/41048/AVG-DLL.zip 3. Extract and replace the dll files overwriting your current dlls. 4. Start decludeproc 5. If the error persists or you get error 2 or error 4 6. Stop decludeproc 7. Delete all files in \declude\scanners\avg\db\ 8. Start decludeproc this will initiate a new download of the AVG signatures David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax dbar...@declude.com From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Harry Vanderzand Sent: Friday, May 07, 2010 2:09 PM To: declude.virus@declude.com Subject: [Declude.Virus] embedded AVG issue I though I would check my virus logs which I have not done for a while. It is not working. See log entry: 05/07/2010 14:06:13.502 qb42e00250010.smd Scanned: Virus Free [MIME: 1 125] 05/07/2010 14:06:18.720 q990400280052.smd Vulnerability flags = 862 05/07/2010 14:06:18.814 q990400280052.smd Error: Could not start AVG Instance (17) 05/07/2010 14:06:18.814 q990400280052.smd Scanned: Virus Free [MIME: 2 1293] What could be the issue here? Thank you Please note our new Address Harry Vanderzand Intown Internet 740 Erbsville Road Waterloo, On, N2J 3Z4 519-741-1222 DISCLAIMER: The information in this message is confidential and may be legally privileged. It is intended solely for the addressee. Access to this message by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying,or distribution of the message, or any action or omission taken by you in reliance on it, is prohibited and may be unlawful. Please immediately contact the sender if you have received this message in error. Thank you. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.Virus. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.Virus. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] embedded AVG issue
Thanks Andy, I found that I do not have avgcertx.dll. Should this file have been included in the zip download David made? Don - Original Message - From: Andy Schmidt To: declude.virus@declude.com Sent: Monday, May 10, 2010 9:05 AM Subject: RE: [Declude.Virus] embedded AVG issue Hi Don, Here's what I have in C:\Imail\ 11/06/2008 12:49 PM61,440 AvApiBit.dll 11/06/2008 12:49 PM61,440 AvApiSym.dll 04/29/2010 04:13 PM 834,328 avgcerta.dll 04/29/2010 04:13 PM 623,384 avgcertx.dll 04/29/2010 04:13 PM 4,250,392 avgcorex.dll 04/29/2010 04:13 PM 312,320 avgsdk.dll 10/21/2005 10:43 AM32,768 Declude.exe 04/29/2010 04:12 PM 2,318,428 decludeproc.exe (You can disregard the dates/times, they just represent the time when I copied those files). Maybe do a DIR C:\av*.dll /s to make sure you don't have any duplicates elsewhere. Best Regards, Andy From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of decl...@mail.net1media.com Sent: Monday, May 10, 2010 7:28 AM To: declude.virus@declude.com Subject: Re: [Declude.Virus] embedded AVG issue David, I was having this issue so I followed your directions below. After overwriting the current dlls, I could not get decludeproc to start. I determined that it was the avgsdk.dll that was in the newly downloaded zip file that was the culprit. I had to restore a previous version to get everything working again. I did notice that the new avgsdk.dll is substantially smaller than the old version. So I am still having the issue originally described in the post. Don - Original Message - From: David Barker To: declude.virus@declude.com Sent: Friday, May 07, 2010 1:25 PM Subject: RE: [Declude.Virus] embedded AVG issue We have seen this mostly with manual installs. Error: Could not start AVG Instance (17) has to do with the DLL. Please contact supp...@declude.com if you need assistance. 1. Stop decludeproc 2. Download http://interim.declude.com/41048/AVG-DLL.zip 3. Extract and replace the dll files overwriting your current dlls. 4. Start decludeproc 5. If the error persists or you get error 2 or error 4 6. Stop decludeproc 7. Delete all files in \declude\scanners\avg\db\ 8. Start decludeproc this will initiate a new download of the AVG signatures David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax dbar...@declude.com From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Harry Vanderzand Sent: Friday, May 07, 2010 2:09 PM To: declude.virus@declude.com Subject: [Declude.Virus] embedded AVG issue I though I would check my virus logs which I have not done for a while. It is not working. See log entry: 05/07/2010 14:06:13.502 qb42e00250010.smd Scanned: Virus Free [MIME: 1 125] 05/07/2010 14:06:18.720 q990400280052.smd Vulnerability flags = 862 05/07/2010 14:06:18.814 q990400280052.smd Error: Could not start AVG Instance (17) 05/07/2010 14:06:18.814 q990400280052.smd Scanned: Virus Free [MIME: 2 1293] What could be the issue here? Thank you Please note our new Address Harry Vanderzand Intown Internet 740 Erbsville Road Waterloo, On, N2J 3Z4 519-741-1222 DISCLAIMER: The information in this message is confidential and may be legally privileged. It is intended solely for the addressee. Access to this message by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying,or distribution of the message, or any action or omission taken by you in reliance on it, is prohibited and may be unlawful. Please immediately contact the sender if you have received this message in error. Thank you. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.Virus. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.Virus. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.Virus. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list
Re: [Declude.Virus] Upgrade 4.6.35 AVG not scanning - FIX
How could this have happened How long has this been going on for? I think some kind of explanation should be forthcoming. David? Don Winsauer Net1 Media - Original Message - From: Colbeck, Andrew To: declude.virus@declude.com Sent: Monday, June 01, 2009 5:24 PM Subject: RE: [Declude.Virus] Upgrade 4.6.35 AVG not scanning - FIX Aha! That was a fishy circumstance. Those errors were red herrings raised by my other virus scanner, not the AVG scanner. If anybody is interested, this is what the log lines looked like at the last time that AVG triggered on a virus was April 3rd, 2009: 04/03/2009 08:54:05.047 Q003993048.smd Vulnerability flags = 2047 04/03/2009 08:54:05.047 Q003993048.smd MIME file: [text/html][8bit; Length=2371 Checksum=206516] 04/03/2009 08:54:05.062 Q003993048.smd MIME file: postcard.zip [base64; Length=449806 Checksum=56953283] 04/03/2009 08:54:05.062 Q003993048.smd Banning .ZIP file with SCR extension. 04/03/2009 08:54:07.501 Q003993048.smd AVG Reports VIRUS: Win32/Cryptor 04/03/2009 08:54:07.501 Q003993048.smd File(s) are INFECTED [Win32/Cryptor: 7] 04/03/2009 08:54:08.220 Q003993048.smd Virus scanner 1 reports exit code of 0 04/03/2009 08:54:08.345 Q003993048.smd Scanned: CONTAINS A VIRUS [Prescan OK][MIME: 2 452321] 04/03/2009 08:54:08.345 Q003993048.smd From: postca...@hallmark.com To: snip [outgoing from 69.156.243.37] 04/03/2009 08:54:08.345 Q003993048.smd Subject: You've received A Hallmark E-Card! There were three of those, and otherwise I had no detections, and no interesting messages from AVG or with error in the log line. After stopping the DecludeProc service, then replacing decludeproc.exe with the Imail version, decludeproc_IM4635.exe as decludeproc.exe, and then restarting the DecludeProc service, I can then send a test email with the EICAR test virus as an attachment, and AVG does pick it up. 06/01/2009 18:11:11.305 Q000595199.smd Vulnerability flags = 2047 06/01/2009 18:11:11.305 Q000595199.smd MIME file: eicar.com [base64; Length=68 Checksum=6829] 06/01/2009 18:11:13.711 Q000595199.smd AVG Reports VIRUS: EICAR_Test 06/01/2009 18:11:13.711 Q000595199.smd File(s) are INFECTED [EICAR_Test: 7] 06/01/2009 18:11:13.727 Q000595199.smd Found a bogus .com file 06/01/2009 18:11:13.727 Q000595199.smd Scanned: CONTAINS A VIRUS [MIME: 2 157] 06/01/2009 18:11:13.727 Q000595199.smd From: snip To: snip [outgoing from snip] 06/01/2009 18:11:13.727 Q000595199.smd Subject: test 03 Andrew. -- From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David Barker Sent: Monday, June 01, 2009 2:00 PM To: declude.virus@declude.com Subject: RE: [Declude.Virus] Upgrade 4.6.35 AVG not scanning - FIX Not for everyone, but certainly for your server that would be true if that is what your logs indicate. From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Colbeck, Andrew Sent: Monday, June 01, 2009 4:03 PM To: declude.virus@declude.com Subject: RE: [Declude.Virus] Upgrade 4.6.35 AVG not scanning - FIX David, this log excerpt seems to indicate that my AVG hasn't been working since May 1st 2009. Is this correct? C:\IMail\Spoolgrep -c smd Scanned: Error in virus scanner vir.log vir0401.log:0 vir0402.log:0 vir0403.log:0 vir0404.log:0 vir0405.log:0 vir0406.log:0 vir0407.log:0 vir0408.log:0 vir0409.log:0 vir0410.log:0 vir0411.log:0 vir0412.log:0 vir0413.log:0 vir0414.log:0 vir0415.log:0 vir0416.log:0 vir0417.log:0 vir0418.log:0 vir0419.log:0 vir0420.log:0 vir0421.log:0 vir0422.log:0 vir0423.log:0 vir0424.log:0 vir0425.log:0 vir0426.log:0 vir0427.log:0 vir0428.log:0 vir0429.log:0 vir0430.log:0 vir0501.log:2722 vir0502.log:640 vir0503.log:623 vir0504.log:3143 vir0505.log:2885 vir0506.log:2568 vir0507.log:2761 vir0508.log:2554 vir0509.log:386 vir0510.log:415 vir0511.log:3110 vir0512.log:2920 vir0513.log:2761 vir0514.log:2771 vir0515.log:2429 vir0516.log:300 vir0517.log:376 vir0518.log:857 vir0519.log:2605 vir0520.log:2793 vir0521.log:2574 vir0522.log:2598 vir0523.log:279 vir0524.log:430 vir0525.log:2630 vir0526.log:2751 vir0527.log:3217 vir0528.log:3026 vir0529.log:2532 vir0530.log:336 vir0531.log:608 vir0601.log:1894 Andrew. -- From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David Barker Sent: Monday, June 01, 2009 12:38 PM To: declude.junkm...@declude.com; declude.virus@declude.com Subject: [Declude.Virus] Upgrade 4.6.35 AVG not scanning - FIX If your AVG is not scanning emails, please upgrade immediately to 4.6.35 which is available from the Declude website. If you are unsure whether this means you
[Declude.Virus] OT: Speaking of BLAT
Does anyone have a recommendation of an open source piece of software that is the counterpart of Blat. I am looking for a command line POP3 utility. Any thoughts? Don - Original Message - From: Matt To: declude.virus@declude.com Sent: Monday, December 10, 2007 3:01 PM Subject: Re: [Declude.Virus] RE: IMmail 2006.23 release notes It's as easy as creating the spool files from scratch. Declude already does everything else that is necessary. There's no need for even something like BLAT. Matt Andy Schmidt wrote: it could generate bounces with a null sender, and that's long overdue. Agreed! There is no excuse for Declude NOT to have its own mailer - after all, there is an Imail listening on SOME local port - it's ridiculous that the matter of NULL senders hasn't been addresses. At LEAST make it a configuration option to use a standard tool, such as BLAT. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Monday, December 10, 2007 2:06 PM To: declude.virus@declude.com Subject: Re: [Declude.Virus] RE: IMmail 2006.23 release notes Some of us believe that it is the IMail1.exe executable that Declude uses and not the IMail.exe executable that is being discontinued. Regardless, if Declude stopped using IMail1.exe, it could generate bounces with a null sender, and that's long overdue. Matt Andy Schmidt wrote: Darrell, I think they are using SOME Imail mailer to send the Virus, Bounce andPostmaster notifications. However, I DO believe there is some confusion between the .EXE that is themailer vs. the old .EXE that is a mailbox CLIENT software. (There used to bean Imail client where you could read/reply messages, etc.) Best Regards,Andy -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell([EMAIL PROTECTED])Sent: Monday, December 10, 2007 10:33 AMTo: [EMAIL PROTECTED]: [EMAIL PROTECTED]: [Declude.JunkMail] Re: [Declude.Virus] IMmail 2006.23 release notes Bonno, After Declude finishes scanning the message it passes it off to smtp32.exe for delivery. I can't think of any instance where declude will use the imail.exe utility. Darrell--Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Bonno Bloksma wrote: Hi, In the IMail 2006.23 release notes it states:--Quote--The IMail.exe Client provided in the IMail Server contained a vulnerability due to a boundary error when processing emails with multipart MIME data, which could potentially compromise a user's system. IMail.exe will no longer be delivered during installation. Caution: It is recommended that existing installations remove IMail.exe from the IMail directory. It has been determined that utilizing this feature could potentially corrupt mailboxes.--Quote-- I seem to remember Declude used this (IMail.exe) as part of it's mail delivery. Is that still true with the 4.x versions I use it to send myself mails when something happens like a sniffer update. But that is just one script which I can change.Is there something similar that we can use? p.s. I assume they mean IMail1 as there is no IMail.exe in the IMail directory. Met vriendelijke groet,Bonno Bloksmahoofd systeembeheer tio hogeschool hotelmanagement en toerismebegijnenhof 8-12 / 5611 el eindhovent 040 296 28 28 / f 040 237 35 [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] / www.tio.nl http://www.tio.nl/- Original Message -*From:* Tom Lewis mailto:[EMAIL PROTECTED]*To:* [EMAIL PROTECTED] mailto:[EMAIL PROTECTED]*Sent:* Monday, December 10, 2007 2:28 PM*Subject:* RE: [IMail Forum] apimmdd.txt files The api/mmdd/.txt files are new in 9.23. There is informational logging taking place that is creating these logs. They can be used by tech support for diagnosing problems in the web client if they were to occur. You can get to the release notes here: http://docs.ipswitch.com/IMail2006.23/ImailRelNotes/index.htm Tom Lewis*Ipswitch, Inc.*Development Manager - Messaging Products706-312-3573 *From:* [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] *On Behalf Of *Bonno Bloksma*Sent:* Monday, December 10, 2007 7:27 AM*To:* [EMAIL PROTECTED]:* [IMail Forum] apimmdd.txt files Hi, As of IMail 2006.23 I have apimmdd.txt logfiles. However I cannot find what these are for. Is this the new extra debugging for the webmail?There seem to be no release notes for 2006.23, at least I cannot find them. Appart from that, everything seems to be working ok. Met vriendelijke groet,Bonno Bloksmahoofd systeembeheer tio hogeschool hotelmanagement en
Re: [Declude.Virus] Support
I feel a need to jump in with my praise of my last support call. It was on a Friday night close to quitting time. I wanted to add Sniffer to my other Declude tests. I had previously made the purchase but never configured it and it had expired. I had to renew it online. The support tech spent several hours helping me getting it configured (I mean she did all the work and I just talked to keep her company). The online registration needed some manual processing and she got someone via cell phone to complete the transaction and get it to go through. All this late on a Friday night. She could have just as easily put me off until Monday - but she didn't. Not only that but she seemed to enjoy helping. It was truly refreshing to deal with a person of such high caliber. Keep up the great work!! Don - Original Message - From: Kevin Bilbee [EMAIL PROTECTED] To: declude.virus@declude.com Sent: Tuesday, March 27, 2007 12:02 AM Subject: RE: [Declude.Virus] Support For me it has been spotty. I have received great support and I have received terrible support. My last support call that I about the day or the day after 4.3.40 came out has yet to be returned. So I would gather that support is hit and miss on how well it goes! I resolved the issue by completely uninstalling Declude rebooting the server the reinstalling the latest version. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Heimir Eidskrem Sent: Monday, March 26, 2007 7:29 PM To: declude.virus@declude.com Subject: Re: [Declude.Virus] Support Dan Shadix wrote: I read occasionally on here about support or the lack thereof, but I just used support for the first time for anything other than a minor issue. This was the best support I've received from any company at any time. A few others have come close, but my support experience was absolutely wonderful. I don't know if I should mention the tech by name but let me just say that if my wife knew how much hand holding had been going on I'd be in big trouble. Dan Shadix --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. I second that. I have not needed support often but when i did I got some excellent support. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] F-Prot Version 6
When did their licensing change? F-Prot used to be extremely reasonable. Don - Original Message - From: Kevin Bilbee [EMAIL PROTECTED] To: declude.virus@declude.com Sent: Wednesday, January 31, 2007 11:14 PM Subject: RE: [Declude.Virus] F-Prot Version 6 Read the license. It may be compatible but the licensing is expensive. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Dodell Sent: Wednesday, January 31, 2007 7:26 PM To: Declude.Virus@declude.com Subject: [Declude.Virus] F-Prot Version 6 Been using F-Prot version 3 for years ... and now getting notices to upgrade to version 6. Anyone done this yet, and is it still compatible with Declude/Imail, etc? David --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] AVAFTERJM
When scanning for viruses after JunkMail through use of the above directive, the following rule applies: All email will continue to be scanned for viruses EXCEPT those emails having a final JunkMail action of: HOLD DELETE David Franco-Rocha Declude Technical / Engineering --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] Declude Technical Support Tickets
Please note that we receive a large amount of spam at our technical support email address for the ticket system. When I look through the tickets, I delete whatever looks like spam, as well as all tickets that do not contain a subject. Fortunately I keep backup copies of all incoming tech support email. I discovered a backup copy this morning of a legitimate ticket that I had deleted because it lacked a subject: completely blank. Please always provide a subject when you send email to technical support because it allows us to see at a glance whether we have several instances of an issue and also to prioritize the tickets. We have to delete emails that do not contain a subject because it takes too much time to open every email without a subject merely to determine whether it is valid or not. To facilitate processing of trouble tickets, please do not generate multiple tickets for the same issue. Simply reply to our email, which will contain the ticket number as part of the subject line. If we resolve an issue and close a ticket and the issue creeps up again, you can always reply to the last reply you received from us on that ticket. This will automatically re-open the same ticket and we will have acess to all information previously provided by you. Thanks for your cooperation and assistance. David Franco-Rocha Declude Technical / Engineering --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Current Version 3.05.11??
There were several customers who were having connectivity issues with 3.0.5.9. It was traced to problems within Winsock. The subsequent versions reset Winsock periodically, which has a negative effect on the processing time, but it seerms to eliminate those connectivity issues. Very shortly we will be incorporating a new directive into the configuration, so that the system administrator can elect to have Winsock do periodic resets or not. For those who did not experience problems with connectivity, turning off that option will provide the speed of 3.0.5.9, as well as the bugs that will have been fixed since that version. David Franco-Rocha Declude Technical / Engineering - Original Message - From: Marcel Sangers [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Friday, October 28, 2005 2:27 AM Subject: RE: [Declude.Virus] Current Version 3.05.11?? We have the same problem. 3.05.9 seems to be lots faster than 3.05.11/12. We had a problem with the mailserver so Declude had to process about 2000 msgs at once. With 3.05.12 that takes way too much time, we did a rollback to 3.05.9 and the email flows very fast. How is this possible? We use Declude Spam+Virus THREADS 15 F+Prot+AVG Sniffer -Oorspronkelijk bericht- Van: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Namens Harry Vanderzand Verzonden: vrijdag 21 oktober 2005 22:49 Aan: Declude.Virus@declude.com Onderwerp: RE: [Declude.Virus] Current Version 3.05.11?? Changing from 305.9 to 3.05.11 changed the behaviour of processing Processing slowed down With 3.05.09 my proc directory stays virtually empty whereas with 11 it did not get emptied as entries arrived. Went back to .9 My declude.cfg is: threads 20 waitformail 500 waitforthreads 1500 waitbetweenthreads 100 Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert Grosshandler Sent: Friday, October 21, 2005 4:23 PM To: Declude.Virus@declude.com Subject: [Declude.Virus] Current Version 3.05.11?? Hi Are there any release notes for this? It went from .09 this morning to .11 about five minutes ago. What's up? Thanks, Rob --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] viruses getting through
Daniel, Do the log files show anything for these messages? If so, please send the related entries from the logs to [EMAIL PROTECTED] David Franco-Rocha Declude Technical Support - Original Message - From: Daniel Ivey [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Wednesday, June 08, 2005 3:53 PM Subject: [Declude.Virus] viruses getting through Greetings, Over the past 2 days, I have had some viruses get through my Declude Virus, with updated definitions. Has anyone else seen this? Also, when I receive an email and look at the headers of the email, I am not seeing where Declude Virus scanned the message. Does anyone have any suggestions? I am running version 1.82. Thanks, Daniel === Daniel Ivey GCR Company / GCR Online Voice: 434 - 570 - 1765 Fax:434 - 572 - 1981 [EMAIL PROTECTED] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] what does this mean in the virus log file?
Nick, With the enhancement of turning off checking for individual vulnerabilities, this information indicates for Declude which vulnerabilities are being checked and which ones are not. David Franco-Rocha Declude Technical Support - Original Message - From: NIck Hayer [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Monday, June 06, 2005 5:51 PM Subject: Re: [Declude.Virus] what does this mean in the virus log file? Vulnerability flags = 76 Thanks! -Nick --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Invalid ZIP Vulnerability
This vulnerability is triggered if the file format diverges from the official ZIP format specification. David Franco-Rocha Declude Technical Support - Original Message - From: Paul Navarre [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Friday, May 27, 2005 1:54 AM Subject: [Declude.Virus] Invalid ZIP Vulnerability What exactly triggers the Invalid ZIP Vulnerability? I am a small ISP, and one of my client keeps getting expected zips from a graphics company caught by this. Thanks, Paul --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] EXITSCANONVIRUS
John, This setting defaults to OFF, which is the way it has been historically. The only setting it actually looks for is ON. If you omit the directive completely from your virus.cfg file, it will be OFF. Please note that the actual directive is EXITSCANONVIRUSDETECT ON David Franco-Rocha Declude Technical Support - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Friday, May 27, 2005 11:17 AM Subject: RE: [Declude.Virus] EXITSCANONVIRUS Thanks. Is this a configurable meaning we have to have either ON or OFF? John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Franco-Rocha [ Declude ] Sent: Friday, May 27, 2005 7:21 AM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] EXITSCANONVIRUS John, There is a processing loop wherein all the scanners are called in succession. It is independent of vulnerability checking. This directive merely tells Declude to break out of the external virus scanner execution loop. If you use this directive to exit the scanning loop on virus detection and (1) you have 5 scanners listed in your cfg file and (2) a virus is detected by the first scanner listed, then the effect is exactly the same in processing as if you had a single scanner listed and a virus were detected by that single scanner. David Franco-Rocha Declude Technical Support - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Friday, May 27, 2005 2:50 AM Subject: [Declude.Virus] EXITSCANONVIRUS A question about this new feature. Am I correct in thinking that as soon as a scanner reports a virus, the next scanner(s) in line will not be called and the message will be processed accordingly, and that it will not be affected by Declude first finding a banned attachment before having it scanned by a scanner? John T eServices For You --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: AW: [Declude.Virus] Spamheaders-Warning
Hi Markus, oops. Sorry, I realized this is indeed the wrong list. ;-) I will wait for version 1.82. Until then I disabled it. Thanks ! Uwe GML hi uwe, GML the short version is: wrong list, look at the junkmail list (or the archive GML http://www.mail-archive.com/declude.junkmail@declude.com/) GML the long version: GML there is a problem with the SPAMHEADERS-Test up to version 1.81, in the GML junkmaillist you will find a message from barry simpson about the download of GML the new version 1.82. GML if you still want to disable the test: GML put an # in front of the line of the test in the global.cfg GML mfg GML i.a. GML gez. guhl GML -Ursprungliche Nachricht- GML Von: [EMAIL PROTECTED] GML [mailto:[EMAIL PROTECTED] Auftrag von Uwe Degenhardt GML Gesendet: Dienstag, 4. Januar 2005 09:03 GML An: Declude.Virus@declude.com GML Betreff: [Declude.Virus] Spamheaders-Warning GML Hi list, GML almost every other eMail (too many false positives !) GML arrives to us with: GML X-Spam-Tests-Failed: SPAMHEADERS [x] GML and is giving a warning (WARN) GML and marks the subject line with the GML word SPAM. GML How can I disable the SPAMHEADERS-Test ? GML Uwe GML --- GML [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] GML --- GML This E-mail came from the Declude.Virus mailing list. To GML unsubscribe, just send an E-mail to [EMAIL PROTECTED], and GML type unsubscribe Declude.Virus.The archives can be found GML at http://www.mail-archive.com. GML --- GML [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] GML --- GML This E-mail came from the Declude.Virus mailing list. To GML unsubscribe, just send an E-mail to [EMAIL PROTECTED], and GML type unsubscribe Declude.Virus.The archives can be found GML at http://www.mail-archive.com. -- Best regards, Decludemailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.Virus] strange sending problem to the same domain
Hi John, this is the actual forwarding of one eMail of my customer. I guess I have to make a reverse DNS entry, don't you think ? Uwe Received: from lasthope [217.235.73.14] by irgendwas.de with ESMTP (SMTPD32-6.06) id AF231070262; Fri, 29 Oct 2004 11:36:35 +0200 From: info_irgendwas [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: WG: Spezialanfrage Date: Fri, 29 Oct 2004 11:36:33 +0200 Message-ID: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_000_0001_01C4BDAB.8FEFC810 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.6626 Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 X-RBL-Warning: MAILFROM: Domain irgendwas.de has no MX or A records [0001]. X-Declude-Sender: [EMAIL PROTECTED] [217.235.73.14] X-Note: Scanned by Declude JunkMail http://www.declude.com/x-note.htm X-Spam-Tests-Failed: CMDSPACE, MAILFROM, WEIGHT10, WEIGHT20 [20] X-Note: Scanned by Declude JunkMail http://www.declude.com/x-note.htm X-Note: This E-mail was sent from pD9EB490E.dip0.t-ipconnect.de ([217.235.73.14]). X-RCPT-TO: [EMAIL PROTECTED] X-UIDL: 373489920 Status: U JTL 1. Is the sender authenticating during the SMTP send to the server? JTL 2. Log lines for the messages sent please. JTL 3. Is the sender using Outlook 2003? JTL 4. Headers of the message that came through after changing from DELETE at 20 JTL to WARN. JTL John Tolmachoff JTL Engineer/Consultant/Owner JTL eServices For You -Original Message- From: [EMAIL PROTECTED] JTL [mailto:[EMAIL PROTECTED] On Behalf Of Declude Sent: Thursday, October 28, 2004 8:20 AM To: [EMAIL PROTECTED] Subject: [Declude.Virus] strange sending problem to the same domain Hi list, a customer of us complained today that he could't send any eMail from [EMAIL PROTECTED] to [EMAIL PROTECTED] But he receives eMails to both of the above postboxes from externally. Today I bypassed Declude. (I deleted eMails over weight 20 I guess, now I only do a WARN) Since then it is working fine for him again. I tested his domain remotely with no problems. Although he takes Outlook. It seems as if Outlook as a Mailer-SW is causing problems here. Any ideas ? Uwe --- [This E-mail was scanned for viruses by Declude Virus JTL (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. JTL --- JTL [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] JTL --- JTL This E-mail came from the Declude.Virus mailing list. To JTL unsubscribe, just send an E-mail to [EMAIL PROTECTED], and JTL type unsubscribe Declude.Virus.The archives can be found JTL at http://www.mail-archive.com. -- Best regards, Decludemailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.Virus] strange sending problem to the same domain
Hi John, thank you. Below you can find my answers. Is it of any help ? Uwe JTL 1. Is the sender authenticating during the SMTP send to the server? Yes he is, this was my first thought as well. JTL 2. Log lines for the messages sent please. The odd thing is, that Outlook doesn't let my see the Mail-Headers to the eMails sent. Or do you mean the log lines in IMail ? JTL 3. Is the sender using Outlook 2003? The answer is: Outlook 2002 / SP 2 JTL 4. Headers of the message that came through after changing from DELETE at 20 JTL to WARN. I have to ask the customers to send it to me tomorrow. JTL John Tolmachoff JTL Engineer/Consultant/Owner JTL eServices For You -Original Message- From: [EMAIL PROTECTED] JTL [mailto:[EMAIL PROTECTED] On Behalf Of Declude Sent: Thursday, October 28, 2004 8:20 AM To: [EMAIL PROTECTED] Subject: [Declude.Virus] strange sending problem to the same domain Hi list, a customer of us complained today that he could't send any eMail from [EMAIL PROTECTED] to [EMAIL PROTECTED] But he receives eMails to both of the above postboxes from externally. Today I bypassed Declude. (I deleted eMails over weight 20 I guess, now I only do a WARN) Since then it is working fine for him again. I tested his domain remotely with no problems. Although he takes Outlook. It seems as if Outlook as a Mailer-SW is causing problems here. Any ideas ? Uwe --- [This E-mail was scanned for viruses by Declude Virus JTL (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. JTL --- JTL [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] JTL --- JTL This E-mail came from the Declude.Virus mailing list. To JTL unsubscribe, just send an E-mail to [EMAIL PROTECTED], and JTL type unsubscribe Declude.Virus.The archives can be found JTL at http://www.mail-archive.com. -- Best regards, Decludemailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Netsky.P Occasionally Slips through?
Just add the VIRUSCODE 8 to the config files. Note that it may have some false positives, but we are OK with that. Would rather that than a possible virus getting thru. Sincerely, Grant Griffith, Vice President EI8HT LEGS Web Management Co., Inc. http://www.getafreewebsite.com 877-483-3393 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Douglas Cohn Sent: Tuesday, March 30, 2004 9:57 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Netsky.P Occasionally Slips through? If F-prot notes a file as suspicious is it stopped by declude or passed. Can this be a setting possibly? IE if F-prot notes it as suspicious allow declude to block it. DC -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Monday, March 29, 2004 8:52 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Netsky.P Occasionally Slips through? F-Prot's manual scan results: C:\eudora\ATTACH\document_all02c.zip-document.txt a security risk or a backdoor program That sounds like an exit code of 8, meaning that F-Prot detected a suspicious file, but not a virus. Would it be possible to E-mail the .ZIP file to the declude.com virustrap@ address, so we can analyze it? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] F-prot passing Netsky.P or variant?
I had one slip thru to me this morning also... McAfee detected it on my system as the W32/Netsky.b.eml!zip virus. Not sure as to where it quarantined the file too, but I was surprised my banext's did not catch it also. Sincerely,Grant Griffith, Vice PresidentEI8HT LEGS Web Management Co., Inc.http://www.getafreewebsite.com877-483-3393 -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Darin CoxSent: Thursday, March 25, 2004 10:17 AMTo: [EMAIL PROTECTED]Subject: [Declude.Virus] F-prot passing Netsky.P or variant? Anyone else having trouble with a lot of new viruses slipping through? I submitted two to F-Prot earlier this morning, but they are claiming that the attachments were Netsky.P. However, I have the latest virus defs from them and the virus logs clearly show them being scanned and virus free. I'm betting it's a new, fast-spreading variant or Netsky, but am curious as to what others are seeing.. Darin.
[Declude.Virus] SKIPIFFORGING ?
Hello, Does the SKIPIFFORGING include the Vulnerabilities? I was just looking into why I was not receiving Vulnerability notifications and it appears the SKIPIFFORGING is stopping these from being sent. As an administrator, I would like to receive those in case it might be a legit message. Is there a way I can allow these notifications sent out while leaving the SKIPIFFORGING in place? Sincerely, Grant Griffith, Vice President EI8HT LEGS Web Management Co., Inc. http://www.getafreewebsite.com 877-483-3393 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Log error with latest interim release
I just upgraded to version 3 and am still seeing this. I will contact F-Prot to see if they can give me some insight on this. Sincerely, Grant Griffith, Vice President EI8HT LEGS Web Management Co., Inc. http://www.getafreewebsite.com 877-483-3393 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Thursday, March 18, 2004 12:04 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Log error with latest interim release 03/18/2004 11:20:01 Qcc24005d0536a2e6 Error 128 in virus scanner 1. 03/18/2004 11:21:09 Qcc661aa8032aa581 Error 128 in virus scanner 1. F-Prot doesn't define an exit code of 128 -- I would recommend reinstalling F-Prot and/or moving to the latest version of F-Prot. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Log error with latest interim release
Meant version E. Sorry, been a long day. Sincerely, Grant Griffith, Vice President EI8HT LEGS Web Management Co., Inc. http://www.getafreewebsite.com 877-483-3393 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Grant Griffith - Declude Virus Sent: Thursday, March 18, 2004 12:35 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Log error with latest interim release I just upgraded to version 3 and am still seeing this. I will contact F-Prot to see if they can give me some insight on this. Sincerely, Grant Griffith, Vice President EI8HT LEGS Web Management Co., Inc. http://www.getafreewebsite.com 877-483-3393 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Thursday, March 18, 2004 12:04 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Log error with latest interim release 03/18/2004 11:20:01 Qcc24005d0536a2e6 Error 128 in virus scanner 1. 03/18/2004 11:21:09 Qcc661aa8032aa581 Error 128 in virus scanner 1. F-Prot doesn't define an exit code of 128 -- I would recommend reinstalling F-Prot and/or moving to the latest version of F-Prot. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Question: Do the new zip commands reject the file extension and not pass the file to the virus scanner
Replying to try and help Scott out... A New Interim release of 1.78i9 is there that checks for viruses first in this case... version i8 blocked by extension first... Sincerely, Grant Griffith, Vice President EI8HT LEGS Web Management Co., Inc. http://www.getafreewebsite.com 877-483-3393 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Darrell LaRock Sent: Wednesday, March 03, 2004 11:52 AM To: [EMAIL PROTECTED] Subject: [Declude.Virus] Question: Do the new zip commands reject the file extension and not pass the file to the virus scanner Running 1.78i8 on Declude Virus Pro. Have both the BANEXT EZIP and BANEZIPEXTS ON in virus.cfg Question: Currently does the BANEXT EZIP and BANEZIPEXTS ON commands block the mail based on the file extension and not scan the email with the configured virus scanner (See snippet #1 below) i.e. the virus scanner is not called or doesn't appear to be? When checking the file which was banned it does contain a virus (Bagle/h pwd) which was being detected fine prior to the new zip features (see snippet #2)? Issue: Currently the files which should be caught by the virus scanner are not being caught by the scanner BUT being rejected due to the file extension which than generates the bannotify.eml (as you can see from below we now have that turned off right now). Previously (prior to the new zip features) banned extensions (see snippet #3) would appear to be scanned by the scanner and if a virus was found it would not generate the bannotify.eml. Snippet #1 03/03/2004 11:04:16 Q01fea15f01b20d9a MIME file: Letter.zip [base64; Length=20780 Checksum=2629640] 03/03/2004 11:04:16 Q01fea15f01b20d9a Banning .ZIP file with exe extension. 03/03/2004 11:04:16 Q01fea15f01b20d9a Scanned: Banned file extension. [MIME: 2 20916] 03/03/2004 11:04:16 Q01fea15f01b20d9a Couldn't open E-mail file e:\imail\Declude\BANnotify.eml. 03/03/2004 11:04:16 Q01fea15f01b20d9a From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] 03/03/2004 11:04:16 Q01fea15f01b20d9a Subject: ^_^ meay-meay! Snippet #2 03/02/2004 15:30:25 Qeede7761020e584c MIME file: Letter.zip [base64; Length=20859 Checksum=2628208] 03/02/2004 15:30:25 Qeede7761020e584c Scanner 1: Virus= the W32/Bagle.gen!pwdzip (ED) virus !!! Attachment=Letter.zip [10] O 03/02/2004 15:30:25 Qeede7761020e584c File(s) are INFECTED [ the W32/Bagle.gen!pwdzip (ED) virus !!!: 13] 03/02/2004 15:30:25 Qeede7761020e584c Scanned: CONTAINS A VIRUS [MIME: 2 20975] 03/02/2004 15:30:25 Qeede7761020e584c From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [outgoing from 66.188.246.138] 03/02/2004 15:30:25 Qeede7761020e584c Subject: Hey, ya! =)) Snippet #3 02/25/2004 00:03:52 Q2cb6170b005aec2b MIME file: [text/html][quoted-printable; Length=5254 Checksum=412704] 02/25/2004 00:03:52 Q2cb6170b005aec2b MIME file: [image/gif][base64; Length=3639 Checksum=424621] 02/25/2004 00:03:52 Q2cb6170b005aec2b MIME file: [image/gif][base64; Length=359 Checksum=35758] 02/25/2004 00:03:52 Q2cb6170b005aec2b MIME file: Update28.exe [base64; Length=106496 Checksum=9386997] 02/25/2004 00:03:52 Q2cb6170b005aec2b Banning file with exe extension [application/x-msdownload]. 02/25/2004 00:03:53 Q2cb6170b005aec2b Scanner 1: Virus= the W32/[EMAIL PROTECTED] virus !!! Attachment=Update28.exe [10] O 02/25/2004 00:03:53 Q2cb6170b005aec2b File(s) are INFECTED [ the W32/[EMAIL PROTECTED] virus !!!: 13] 02/25/2004 00:03:53 Q2cb6170b005aec2b Scanned: CONTAINS A VIRUS [Prescan OK][MIME: 5 117540] 02/25/2004 00:03:53 Q2cb6170b005aec2b From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [outgoing from 210.150.150.240] 02/25/2004 00:03:53 Q2cb6170b005aec2b Subject: New Net Patch -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, March 03, 2004 11:00 AM To: [EMAIL PROTECTED] Subject: [Declude.Virus] Summary of new options With the latest interim release, you can use: BANEXT EZIP - This line will ban all .ZIP files with an encrypted file in them BANZIPEXTS ON - This line (Pro version only) will ban all file extensions listed in BANEXT lines, if they appear in non-encrypted .ZIP files BANEZIPEXTS ON - This line (Pro version only) will ban all file extensions listed in BANEXT lines, if they appear in encrypted .ZIP files Also, the latest interim (with the Pro version only) will detect bogus .BAT/.COM/.PIF/.SCR files (automatically as vulnerabilities, with no need for config file entries). If you are having any troubles with these, please re-read the information on them, and then be very clear what is happening. There are a lot of possibilities here. You'll need to specify [1] Whether you are using BANZIPEXTS ON or BANEZIPEXTS ON (or the not-recommended-but-still-useful BANEXT EZIP), [2] Whether you have a BANEXT line to block the appropriate file (BANEXT com, for example), [3] What type of file you are sending through (.com? .com within a .zip?), [4] If it is a .ZIP file, is the file inside
[Declude.Virus] Test
This is a test - please ignore --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] FW: WARNING: YOU MAY HAVE A VIRUS
I'd have to agree. I guess all of the letters after John's name have gone to his head. In my experience it's people with bloated egos who attempt to publically ridicule and chastise. Seems to me a friendly note directly to the admin would have been more appropriate. Mike Tindor -- Original Message -- From: Tim Collins [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Sat, 30 Aug 2003 07:55:41 -0500 John Tolmachoff, Personally, I have 2 months experience with my new ISP company and Declude. Not everyone is as smart as you. Maybe you should leave the List and start your own discussion group. The only stupid question is the one that is not asked. Often, there is more than one way to do something. Please keep your personal comments to yourself. Tim Collins -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Saturday, August 30, 2003 12:19 AM To: [EMAIL PROTECTED]; [EMAIL PROTECTED]; [EMAIL PROTECTED]; [EMAIL PROTECTED]; [EMAIL PROTECTED]; [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Subject: [Declude.Virus] FW: WARNING: YOU MAY HAVE A VIRUS Importance: High After all this has been talked about, that Sobig forges the sender, this pisses me off. Do you not know how to add FORGINGVIRUS and SKIPIFVIRUSNAMEHAS to the config and e-mail files? Get your bleeping act together or forfeit your Declude software to someone who knows how to use it. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: Postmaster [mailto:[EMAIL PROTECTED] Sent: Friday, August 29, 2003 7:58 PM To: [EMAIL PROTECTED] Subject: WARNING: YOU MAY HAVE A VIRUS The Declude Virus software on lcs.net has reported that you sent an E-mail to [EMAIL PROTECTED], containing the Unknown Virus virus in the Unknown File attachment. The subject of the E-mail was Your details. The E-mail containing the virus has been quarantined to prevent further damage. Headers Follow: Received: from ARNOLDS_ROOM [160.36.73.149] by lcs.net with ESMTP (SMTPD32-7.07) id A2A72C08013C; Fri, 29 Aug 2003 22:57:43 -0400 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Your details Date: Fri, 29 Aug 2003 22:59:36 --0400 X-MailScanner: Found to be clean Importance: Normal X-Mailer: Microsoft Outlook Express 6.00.2600. X-MSMail-Priority: Normal X-Priority: 3 (Normal) MIME-Version: 1.0 Content-Type: multipart/mixed; boundary=_NextPart_000_7E49D478 Message-Id: [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. Sent via the WebMail system at 1st.net --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] server-based encryption
Keep in mind, it would only apply for certain destination addresses, not all outgoing messages. My company is very interested in this ability. What would it take to get this done? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Jonathan Sent: Wednesday, January 22, 2003 5:28 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] server-based encryption I actually don't think it'd be too bad .. the keys would be stored on the mail server, the program you call would find the body, encrypt it, pass declude a return true, or however it's handled, and away it goes out to the world. You are, of course, assuming that the user isn't using webmail, and that they're using the imail box to send mail (relay). The other catch would be decryption .. maybe not so difficult either. Jonathan At 04:56 PM 1/22/2003 -0500, you wrote: That would be ideal. But is it feasible? If so, don't forget to include me on the royalties! :) -Scott -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Jonathan Sent: Wednesday, January 22, 2003 12:37 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] server-based encryption Maybe something could be scripted and called via declude .. an external .. might not be so difficult .. Jonathan At 09:10 AM 1/22/2003 -0500, you wrote: I was initially going to implement PGP, but I have about 10 internal users (that would each need a digital certificate) sending to two or three external users (that would need to install the public keys from all of my internal users). That's a lot of administration. I even tried setting up a computer running MS Outlook 2002 with the following... Receive mail on Account A Setup a rule to forward all messages from Account A out on Account B Setup PGP on Account B Therefore internal users send mail to Account A. The rule forwards the mail to external users via encrypted Account B. It seems logical enough, but Outlook 2002 would default to sending out on Account A rather than B, because the mail was originally received on Account A. I even tried changing the default account, but it never worked correctly. -Scott -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Jeff Maze - Hostmaster Sent: Wednesday, January 22, 2003 8:48 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] server-based encryption Have you tried PGP on the client side? I've used it before, but the only problem is that you have to distribute your public key to everyone that you're sending messages to. Then they have to install PGP on their machine, create a public key for them, and then install your public key to read your message. Also, there was a big security hole discovered in PGP a few months ago. I haven't heard anything about it recently as to whether they've fixed it or not. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Declude Forum Sent: Wednesday, January 22, 2003 8:35 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] server-based encryption I tried a VPN between the sites, but the IT staff at the other site (different company) couldn't get their act together. I use a VPN for my own remote sites without any problems. I currently use SSL on the webmail interface, but for this instance the external users would need internal mail accounts. It would be nice if there was a simple app, like declude, that would encrypt outgoing emails. A suggestion for a future release ;-) -Scott -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Jonathan Sent: Tuesday, January 21, 2003 10:28 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] server-based encryption In our case, its a many to many, and not all the sites will be on our mail servers. I'd rather not have all those sites tunneling into our server, just for management overhead. But mostly, we need a way to let end-users send secure messages to people on a variety of ISPs etc. One being AOL! ick .. hence my self-extracting file, or client pgp. Jonathan At 03:50 PM 1/21/2003 -0800, you wrote: If you are looking at just 2 primary sites, why not use a site to site vpn to encrypt date between your locations. Jim - Original Message - From: Jonathan [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, January 21, 2003 3:47 PM Subject: RE: [Declude.Virus] server-based encryption oops .. responded too quickly. I guess that wouldn't be server-side, would it? :) Sorry .. We've been using webmail in secure mode (yuck), and dabbling a bit with SSL POP and SMTP.. but of course this doesn't help with remote users. I was playing with just having the server pgp up any file that goes to an outside address, or some self-extracting file .. didn't come up
RE: [Declude.Virus] server-based encryption
That would be ideal. But is it feasible? If so, don't forget to include me on the royalties! :) -Scott -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Jonathan Sent: Wednesday, January 22, 2003 12:37 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] server-based encryption Maybe something could be scripted and called via declude .. an external .. might not be so difficult .. Jonathan At 09:10 AM 1/22/2003 -0500, you wrote: I was initially going to implement PGP, but I have about 10 internal users (that would each need a digital certificate) sending to two or three external users (that would need to install the public keys from all of my internal users). That's a lot of administration. I even tried setting up a computer running MS Outlook 2002 with the following... Receive mail on Account A Setup a rule to forward all messages from Account A out on Account B Setup PGP on Account B Therefore internal users send mail to Account A. The rule forwards the mail to external users via encrypted Account B. It seems logical enough, but Outlook 2002 would default to sending out on Account A rather than B, because the mail was originally received on Account A. I even tried changing the default account, but it never worked correctly. -Scott -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Jeff Maze - Hostmaster Sent: Wednesday, January 22, 2003 8:48 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] server-based encryption Have you tried PGP on the client side? I've used it before, but the only problem is that you have to distribute your public key to everyone that you're sending messages to. Then they have to install PGP on their machine, create a public key for them, and then install your public key to read your message. Also, there was a big security hole discovered in PGP a few months ago. I haven't heard anything about it recently as to whether they've fixed it or not. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Declude Forum Sent: Wednesday, January 22, 2003 8:35 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] server-based encryption I tried a VPN between the sites, but the IT staff at the other site (different company) couldn't get their act together. I use a VPN for my own remote sites without any problems. I currently use SSL on the webmail interface, but for this instance the external users would need internal mail accounts. It would be nice if there was a simple app, like declude, that would encrypt outgoing emails. A suggestion for a future release ;-) -Scott -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Jonathan Sent: Tuesday, January 21, 2003 10:28 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] server-based encryption In our case, its a many to many, and not all the sites will be on our mail servers. I'd rather not have all those sites tunneling into our server, just for management overhead. But mostly, we need a way to let end-users send secure messages to people on a variety of ISPs etc. One being AOL! ick .. hence my self-extracting file, or client pgp. Jonathan At 03:50 PM 1/21/2003 -0800, you wrote: If you are looking at just 2 primary sites, why not use a site to site vpn to encrypt date between your locations. Jim - Original Message - From: Jonathan [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, January 21, 2003 3:47 PM Subject: RE: [Declude.Virus] server-based encryption oops .. responded too quickly. I guess that wouldn't be server-side, would it? :) Sorry .. We've been using webmail in secure mode (yuck), and dabbling a bit with SSL POP and SMTP.. but of course this doesn't help with remote users. I was playing with just having the server pgp up any file that goes to an outside address, or some self-extracting file .. didn't come up with anything else. I'm interested to see what everyone else is working on, though.. Jonathan At 05:40 PM 1/21/2003 -0600, you wrote: There's always PGP, but both sides need the plugins .. Jonathan At 03:30 PM 1/21/2003 -0800, you wrote: I work for the healthcare division of Siemens, and we are currently beta testing our secure message delivery products (including e-mail) with some our healthcare customers. Depending on how soon you need it, our offering should be publicly available in a couple of months. Bill -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Declude Forum Sent: Tuesday, January 21, 2003 10:12 AM To: [EMAIL PROTECTED] Subject: [Declude.Virus] server-based encryption Greetings, Does anyone use an application to encrypt outgoing email messages? I work for a medical related company, and we need a way to encrypt some outgoing
RE: [Declude.Virus] SMTP AUTH - Imail v6.06
Yes, your absolutely right. You can include your internal addresses, if applicable, in the addresses box to insure your own systems won't need auth if you wish. Maintain, Babul (210) 696-1130, ext. 102 (210) 696-0572 [fax] The Montopolis Group - www.montopolis.com Building stronger businesses... with Technology -Original Message- From: Jack Taugher [mailto:[EMAIL PROTECTED]] Posted At: Tuesday, May 14, 2002 12:16 PM Posted To: Lists - Declude Virus Conversation: [Declude.Virus] SMTP AUTH - Imail v6.06 Subject: [Declude.Virus] SMTP AUTH - Imail v6.06 (IMail v6.06 - SMTP AUTH) We need to enable SMTP AUTH for all of our clients -- we've found some device/person (IP) on the outside of our network spoofing emails to lists by the few users who are authorized list posters. In order to do this, is it best that we just check No Mail Relay on the server and make all of our users go through the few steps to do SMTP AUTH? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.Virus] Notification Messages
I would like to put my 2 cents in for more options on a domain by domain basis. I would like to be able to ban different extensions for different domains. Some of my customers may want .exe while others would not. Sending an email to an administrator along with the receipient would be appreciated by some of my customers. Another option I would like to see on a domain/user basis is the ability to only pass the text portion of an email and strip any HTML segments. I could see there being either multiple config files name by their domain (domain.cfg) with a default.cfg if none is found or using the windows.ini approach where sections would be begin with a label [domain name] followed by domain specific options. Again, just my personal wish list, Don - Original Message - From: David Stavert [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, February 26, 2002 7:06 PM Subject: RE: [Declude.Virus] Notification Messages Scott What things are at the top of the list? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Tuesday, February 26, 2002 3:57 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Notification Messages Is there a way to set up custom EML files for different domains? No, there is not. Drat. Do you know if this feature is anywhere on the near-future list? No, it is not on the near-future list. It's something we would like to add, but unfortunately it isn't at the top of the list right now. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.Virus] Virus Scanning Terms of Service
We offer virus scanning as an add-on service. Has anyone had a lawyer draw up language to add to your Terms of Service that holds them harmless if a virus does get through? TIA, Don --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.Virus] Declude v1.30 released (beta)
Scott, How could you possibly continue to improve on an already great product - You/Computer Horizons have done a great job on this product. I'm impressed by its robustness, reliability and features -- all for much much less than we'd have to pay to handle our current load with some other product. I'm hoping to take advantage of the multiple domain support of Declude PRO on our commercial hosting machines down the road. Every day that I don't have to reboot my NT mail server is a testament to the robustness of Declude -- On one of our main servers (and the only one that I run Declude on right now) it processes over 200,000 messages a day, all scanned with Declude, on a Dual 1Ghz/512MB RAM SCSI system. I never thought I'd see the day where we could provide our customer base some real AV protection (without the necessity of me reacting to pager alerts every 15 minutes). Great Job! Mike Tindor FIRST Internet -- Original Message -- From: R. Scott Perry [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Tue, 18 Dec 2001 13:11:37 -0500 Computerized Horizons has just released Declude Virus v1.30. Notable changes include: o Major overhaul to MIME decoding functions to support further enhancements o Declude's dependency on user32.dll was removed, which (should) prevent Declude from counting towards the depletion of Microsoft's Mystery Heap. o DELIVERERRORS ON config option will allow E-mail that a scanner reports an error on to be delivered (if neither a Virus free or Virus found code is returned). o TEMPDIR config option to let you choose the temporary directory that Declude scans files in (to allow usage with on-access scanners that can't exclude subdirectories, and for RAM disk support) o Will automatically detect F-Prot.PIF file and delete it if necessary, to prevent halt of E-mail delivery. o PRO version adds internal support for multiple virus scanners. Also, the size of the Declude.exe has been shrunk to about 1/2 of its original size, so don't be alarmed if it appears small. The beta can be downloaded from http://www.declude.com/junkmail/support/ip4r.htm . -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . 1st.net --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.Virus] vir####.log analyzer ?
I'm wondering if anybody has a utility that will process the vir.log that is produced to provide useful statistics on the types of viruses received as well as the number (and maybe even sender/recipient info). Has this been done by anybody yet? Mike Tindor 1st.net --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
