So, how's the investigation going?
-------- Original Message -------- > From: "David Barker" <[EMAIL PROTECTED]> > Sent: Wednesday, April 25, 2007 6:43 PM > To: [email protected] > Subject: RE: [Declude.Virus] re: new virus with .rar attachment > > Not sure if it is a bug just yet, I have submitted it for investigation. > > David Barker > VP Operations | Declude > Your Email Security is our business > O: 978.499.2933 x7007 > F: 978.988.1311 > E: [EMAIL PROTECTED] > > > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary > Steiner > Sent: Wednesday, April 25, 2007 6:28 PM > To: [email protected] > Subject: Re: [Declude.Virus] re: new virus with .rar attachment > > Yes, junkmail is scanning before virus. > > I was referring to > http://manuals.declude.com/proconlinehelp/eva_4.0.8_automatically_banning_al > l_encrypted_archive_files.htm > According to the manual, BANEXT EZIP should also pick up password protected > RAR files. > > I've just been told by Declude support that the failure to pick up the > password-protected RAR file is a bug, and that they are working on fixing > it. > > > > -------- Original Message -------- > > From: "John T" <[EMAIL PROTECTED]> > > Sent: Wednesday, April 25, 2007 5:41 PM > > To: [email protected] > > Subject: Re: [Declude.Virus] re: new virus with .rar attachment > > > > Only if you also have BANEXT rar. > > > > Do you have junkmail scanning before virus? > > > > John T > > > > -----Original Message----- > > From: "Gary Steiner" <[EMAIL PROTECTED]> Sent 4/25/2007 > > 10:44:37 AM > > To: [email protected] > > Subject: [Declude.Virus] re: new virus with .rar attachment > > > > As a followup to this, in my virus.cfg I have BANEXT EZIP. Shouldn't > > this have caught the password-protected .rar file? Declude passed the > > message to SmarterMail without holding it. I'm running Declude 4.3.46. > > > > -------- Original Message -------- > > > From: "Gary Steiner" <[EMAIL PROTECTED]> > > > Sent: Wednesday, April 25, 2007 1:31 PM > > > To: [email protected] > > > Subject: new virus with .rar attachment > > > > > > I started getting some messages today that were picked up as spam, > > > but we > > re not being identified as viruses. They looked suspicious, having > > subject lines of > > > > > > Virus Activity Detected! > > > Spyware Alert! > > > > > > It containes a .gif message that tells the user to open the .rar > > > file and > > run the patch there to protect them from the virus/spyware. > > > > > > I ran it on www.virustotal.com, and the only scanner that picked it > > > up wa > > s McAfee, and it identified it as "W32/[EMAIL PROTECTED]". > > > > > > http://vil.nai.com/vil/content/v_142094.htm > > > > > > Since this a password protected .rar file, should we now be blocking > > > thes > > e? > > > > --- > > > > > > --- > This E-mail came from the Declude.Virus mailing list. To unsubscribe, just > send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
