The sobig virus forges the sender, as you should know. The Declude software allows you to indicate this in the bounce message to yourself by putting the line "FORGINGVIRUS Sobig" in the virus.cfg fie. It also allows you not send this notification by putting the line "SKIPIFVIRUSNAMEHAS Sobig" in both your otherpostmaster.eml file and your sender.eml file, open them in notepad and paste the line at the very top. By sending these erroneous notifications out, you are adding the problems that this virus creates.
I'd also like to make two suggestions: 1. Join the Declude mailing lists so you know how to better utilize your software. They are very helpful. 2. Also add the following to your sender and postmaster .eml files: SKIPIFVIRUSNAMEHAS Yaha SKIPIFVIRUSNAMEHAS Lentin SKIPIFVIRUSNAMEHAS Magistr SKIPIFVIRUSNAMEHAS Klez SKIPIFVIRUSNAMEHAS Vulnerability SKIPIFVIRUSNAMEHAS Bugbear SKIPIFVIRUSNAMEHAS Bridex SKIPIFVIRUSNAMEHAS Braid SKIPIFVIRUSNAMEHAS Palyh SKIPIFVIRUSNAMEHAS Fizzer SKIPIFVIRUSNAMEHAS Ganda SKIPIFVIRUSNAMEHAS Dumar Good luck - Marc -----Original Message----- From: Postmaster [mailto:[EMAIL PROTECTED] Sent: Saturday, August 30, 2003 9:01 AM To: [EMAIL PROTECTED] Subject: Your mail server sent us a virus The Declude Virus software on our mail server detected the the W32/[EMAIL PROTECTED] virus !!! virus that appears to have come from your mail server. It was sent in an attachment details.pif, from [EMAIL PROTECTED] to [EMAIL PROTECTED], with the subject "Re: Wicked screensaver". The Message-ID was: <[EMAIL PROTECTED]>. This notice is sent as a courtesy so that you have the option of contacting your user and helping them get rid of the virus. This message was sent by Declude Virus. If your mail server had better virus protection, it would have caused less work for our server and could have prevented one of your users from getting a virus. The headers from the E-mail are: Received: from DJHX0Y21 [68.193.182.54] by eastwestresorts.com with ESMTP (SMTPD32-7.13) id A01CF6B00EC; Sat, 30 Aug 2003 07:01:16 -0600 From: <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: Re: Wicked screensaver Date: Sat, 30 Aug 2003 9:00:36 --0400 X-MailScanner: Found to be clean Importance: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MSMail-Priority: Normal X-Priority: 3 (Normal) MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="_NextPart_000_3842A4B8" Message-Id: <[EMAIL PROTECTED]> --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
