Uh oh ... I think you are removing too many blanklines.
BTW, what gets returned if Declude can't identify the
virusname? "UNKNOWN"?
==============this was sent to me===============
This is an automated DECLUDE message ...
A virus identified as "EICAR test file NOT a virus."
was discovered in an e-mail from:
[EMAIL PROTECTED]
The e-mail containing the virus has been
quarantined to prevent damage.
(D033413a.SMD)
================================================
==============this was my EML file==============
From: [EMAIL PROTECTED]
To: %ALLRECIPS%
Subject: NOTICE: You've been SAVED from a Virus!
This is an automated DECLUDE message ...
A virus identified as "%VIRUSNAME%"
was discovered in an e-mail from:
%MAILFROM%
The e-mail containing the virus has been
quarantined to prevent damage.
(%QUEUENAME%)
================================================
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Sunday, March 11, 2001 4:08 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] v1.15 issue
>FYI, we have just had a report from people using v1.15 that E-mail
>notifications are sometimes being sent out to/from the incorrect domain
>(the %LOCALHOST% and %REMOTEHOST% variables are being switched). This is
>something that we are looking into; I will post here when we find out what
>the problem is.
We have identified and fixed a problem with v1.15 (beta) that is fixed in
v1.16 (beta), where the %LOCALHOST% variable could be improperly determined
(using the remote domain instead of the local domain).
v1.15 switched from using the actual recipient to using the intended
recipient. With IMail, if you had an alias "[EMAIL PROTECTED]" that
pointed to "[EMAIL PROTECTED]", and a user sent an E-mail to
"[EMAIL PROTECTED]" (the intended recipient), it will actually go to
"[EMAIL PROTECTED]" (the actual recipient). Before v1.15, Declude would use
the actual recipient. Starting with v1.15, Declude now uses the intended
recipient. This helps prevent confusion, and prevents a minor security
problem (users could find out what address(es) an alias points to by
sending the eicar.com file to it).
The problem with the %LOCALHOST% variable appears to have been a
side-effect of this change. The actual recipient would use the official
domain name, whereas the intended recipient could use a domain
alias. Declude was just checking official host names to see if a domain
was local or not, and not checking domain aliases. So, if an E-mail was
delivered to a local user (but using a domain alias, such as
mail.declude.com instead of declude.com), Declude would think that the
E-mail was destined for a remote user, and would use the sender's address
as the "local host".
v1.16 has just been released that fixes this, as well as another minor
issue that came up with v1.15 where several blank lines would be added to
the beginning of the E-mail notifications.
Anyone who was using v1.15 should upgrade to v1.16, but be sure to send a
test eicar.com E-mail through (you can go to http://www.declude.com/tools
and use the "Test E-mail Sender" to send it if you like) to make sure that
the notifications are being sent properly.
-Scott
[ This E-mail came from the Declude.Virus mailing list. To ]
[ unsubscribe, just send an E-mail to [EMAIL PROTECTED], and ]
[ type "unsubscribe Declude.Virus yourname". You can E-mail ]
[ [EMAIL PROTECTED] for assistance. You can visit our web ]
[ site at http://www.declude.com . ]
[ This E-mail came from the Declude.Virus mailing list. To ]
[ unsubscribe, just send an E-mail to [EMAIL PROTECTED], and ]
[ type "unsubscribe Declude.Virus yourname". You can E-mail ]
[ [EMAIL PROTECTED] for assistance. You can visit our web ]
[ site at http://www.declude.com . ]
