Does that mean one of your users is infected with Swen? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com
> -----Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.Virus- > [EMAIL PROTECTED] On Behalf Of Franco Celli > Sent: Friday, September 26, 2003 7:52 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.Virus] Is Declude Hijack run before Declude Virus - Swen > virus > > > The same thing is happening here. > I have the folder HOLD2 full of messages, most of them are actually infected > with Swen.A virus, few are legitimate (sent after the IP was blocked by > hijack). > > Below are my settings and Declude version > > Declude ver. 1.76b (updated today) also happened during past days with 1.75 > > I do NOT have AVAFTERJM in virus.cfg > > >From hijack.cfg > RELAYTHRESHOLD1 10 20 > RELAYTHRESHOLD2 60 200 > > > >From Virus LOG > 09/26/2003 16:24:47 Q4c0a05d60228270f File(s) are INFECTED [ > W32/[EMAIL PROTECTED]: > 3] > 09/26/2003 16:24:47 Q4c0a05d60228270f Scanned: CONTAINS A VIRUS [MIME: > 2 > 106736] > 09/26/2003 16:24:47 Q4c0a05d60228270f ERROR: Could not move virus-infected > E-mail1! Code: 2 f:\spool\D4c0a05d60228270f.SMD > F:\virus\D4c0a05d60228270f.SMD > 09/26/2003 16:24:47 Q4c0a05d60228270f ERROR: Could not move virus-infected > E-mail2! Code: 2 f:\spool\Q4c0a05d60228270f.SMD > F:\virus\Q4c0a05d60228270f.SMD > > >From Hijack LOG > 09/26/2003 16:24:47 Q4c0a05d60228270f [EMAIL PROTECTED] is not local. > 09/26/2003 16:24:47 Q4c0a05d60228270f [EMAIL PROTECTED] is not local. > 09/26/2003 16:24:47 Q4c0a05d60228270f [EMAIL PROTECTED] is not local. > 09/26/2003 16:24:47 Q4c0a05d60228270f [EMAIL PROTECTED] is not local. > 09/26/2003 16:24:47 Q4c0a05d60228270f [EMAIL PROTECTED] is not local. > 09/26/2003 16:24:47 Q4c0a05d60228270f [EMAIL PROTECTED] is not local. > 09/26/2003 16:24:47 Q4c0a05d60228270f [EMAIL PROTECTED] is not local. > 09/26/2003 16:24:47 Q4c0a05d60228270f [EMAIL PROTECTED] is not local. > 09/26/2003 16:24:47 Q4c0a05d60228270f [EMAIL PROTECTED] is not local. > 09/26/2003 16:24:47 Q4c0a05d60228270f [EMAIL PROTECTED] is not local. > 09/26/2003 16:24:47 Q4c0a05d60228270f [EMAIL PROTECTED] is not local. > 09/26/2003 16:24:47 Q4c0a05d60228270f [EMAIL PROTECTED] is not > local. > 09/26/2003 16:24:47 Q4c0a05d60228270f [EMAIL PROTECTED] is not local. > 09/26/2003 16:24:47 Q4c0a05d60228270f [EMAIL PROTECTED] is not local. > 09/26/2003 16:24:47 Q4c0a05d60228270f [EMAIL PROTECTED] is not local. > 09/26/2003 16:24:47 Q4c0a05d60228270f [EMAIL PROTECTED] is not local. > 09/26/2003 16:24:47 Q4c0a05d60228270f [EMAIL PROTECTED] is not > local. > 09/26/2003 16:24:47 Q4c0a05d60228270f [EMAIL PROTECTED] is not local. > 09/26/2003 16:24:47 Q4c0a05d60228270f [EMAIL PROTECTED] is not local. > 09/26/2003 16:24:47 Q4c0a05d60228270f [EMAIL PROTECTED] is not local. > 09/26/2003 16:24:47 Q4c0a05d60228270f [EMAIL PROTECTED] is not local. > 09/26/2003 16:24:47 Q4c0a05d60228270f [EMAIL PROTECTED] is not > local. > 09/26/2003 16:24:47 Q4c0a05d60228270f [EMAIL PROTECTED] is not local. > 09/26/2003 16:24:47 Q4c0a05d60228270f [EMAIL PROTECTED] is not local. > 09/26/2003 16:24:47 Q4c0a05d60228270f [EMAIL PROTECTED] is not local. > 09/26/2003 16:24:47 Q4c0a05d60228270f [EMAIL PROTECTED] is not local. > 09/26/2003 16:24:47 Q4c0a05d60228270f Outgoing from 213.213.100.186:; > threshold 1 reached; holding temporarily. > > > ------------------------ > Franco Celli > [EMAIL PROTECTED] > > --- > [Quipo ISP - Questa E-mail e' stata controllata dal programma Declude Virus] > [Quipo ISP - This E-mail was scanned for viruses by Declude Virus] > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
