-David
Since it is out there,
I also have seen rare D* messages without Q* file stranded in the work
folder also.
For me about 2 a month. They tend to be spam (of course so does 80% of all
mail).
If it is a legit message, I'll just forge up a corresponding Q* message and
reprocess them.
I'm running Declude 4.3.14
I'm quite confident that it isn't a real-time scanning problem here.
I think the virus program would probable quarantine a D* file and leave the
q* file. Instead the Q* file is gone, elaving the D* file.
The next time I get one, I'll check the logs for that message for anything
unusual.
----- Original Message -----
From: "David Barker" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Tuesday, October 31, 2006 1:52 PM
Subject: RE: [Declude.Virus] Hijack Question
1. Make sure that the Real-Time scanner of F-prot is disabled
2. At a minimum you should be running Declude 3.11
David
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mario
Antonio
Sent: Tuesday, October 31, 2006 2:38 PM
To: [email protected]
Subject: Re: [Declude.Virus] Hijack Question
David,
I am running f-prot 3.16f
Take a look at my configs
SCANFILE C:\f-prot_windows\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE=5
/PACKED /NOBOOT /DUMB /REPORT=report.txt
VIRUSCODE 3
VIRUSCODE 6
VIRUSCODE 8
REPORT Infection:
Any suggestions?
Regards
Mario Antonio
----- Original Message -----
From: "David Barker" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Tuesday, October 31, 2006 1:58 PM
Subject: RE: [Declude.Virus] Hijack Question
There should not be orphan files I would think you are running some type
of
virus scanner that is removing the D*.smd files from the \work directory.
David B
www.declude.com
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mario
Antonio
Sent: Tuesday, October 31, 2006 11:50 AM
To: [email protected]
Subject: Re: [Declude.Virus] Hijack Question
David,
One more question,
I am seeing that some Q files remain in the spool\proc\work folder, is
this
normal?
why?
Should I clean them manually? Where are the corresponding D files?
Regards
Mario Antonio
----- Original Message -----
From: "David Barker" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Tuesday, October 31, 2006 10:18 AM
Subject: RE: [Declude.Virus] Hijack Question
> Stop/Start the decludeproc will reset the hijack counter.
>
> David B
> www.declude.com
>
> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
Mario
> Antonio
> Sent: Tuesday, October 31, 2006 9:42 AM
> To: [email protected]
> Subject: [Declude.Virus] Hijack Question
>
> Does anyone know if you have to restart the declude process after you
have
> moved back files from the HOLD2 folder into the spool ---Declude
> 3.0.5/Imail 8.22?
>
> In the Declude 2.X you had to close the foreground screen/console
> (which
> restarts Hijack) in order to clean all the IP addresses that have been
> banned.
>
>
> Regards
>
> Mario Antonio
>
>
>
>
>
>
>
>
>
>
>
> ---
> This E-mail came from the Declude.Virus mailing list. To unsubscribe,
just
> send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.Virus". The archives can be found
> at http://www.mail-archive.com.
>
>
>
> ---
> This E-mail came from the Declude.Virus mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.Virus". The archives can be found
> at http://www.mail-archive.com.
>
>
>
>
>
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
