Hello, Is this correct?
With Test eicar.com file [eicardynamicencodedzip] --------------------------------------------------------- This is a test message that was sent to you because you (or someone you know) visited our page at http://www.declude.com/tools . This E-mail is designed to trigger mailserver virus scanners, but WILL NOT do any harm. It is not a virus. If you receive this E-mail, your mail server probably has no virus protection, so it will pass on viruses to you. Visit http://www.declude.com for our Declude Virus solution for IMail servers. This E-mail contains the test eicar.com file in a dynamic encoded .ZIP file. It is expected that no AV program will block this E-mail due to the eicar.com file in it. However, a mailserver AV program should block the E-mail (due to the encoded file in it). --------------------------------------------------------- My version of Declude is: --------------------------------------------------------- c:\IMail>declude -diag Declude 1.78i9 (C) Copyright 2000-2004 Computerized Horizons. NoMaxQueProc Diagnostics ON (Declude v1.78i9). Declude JunkMail: Not installed (no c:\IMail\Declude\global.CFG file). Declude Virus: Config file found (c:\IMail\Declude\Virus.CFG). Declude Hijack: Not installed (no c:\IMail\Declude\Hijack.CFG file). Declude Confirm: Not installed (no c:\IMail\Declude\Confirm.CFG file). IMail reports Official Host Name as: "mail.monmariola.com". IMail's SendName registry seems OK: "C:\IMail\Declude.exe". DNS Server: 217.76.128.129 Declude Virus Status: Standard Version Registered. Declude Hijack Status: NOT REGISTERED: No activation code. End of diagnostics. --------------------------------------------------------- My virus.cfg is: --------------------------------------------------------- # # Declude Virus configuration file # CODE ?????????? # The "####" in the LOGFILE option automatically gets replaced with the month/date LOGFILE spool\vir####.log LOGLEVEL HIGH CONSOLE OFF # # SCANFILE is the location of the command-line virus scanner. Note that it # must include the full path. VIRUSCODE is the code that scanner returns if # it finds a virus. # SCANFILE C:\Archiv~1\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt VIRUSCODE 3 VIRUSCODE 6 REPORT Infection # VIRDIR is the directory to move E-mails with viruses; by default, # it is set to 'virus' (\IMail\spool\virus). VIRDIR spool\virus # The MAXATONCE option limits the number of AV processes. For example, # MAXATONCE 1 will only allow 1 AV process to run at once (IE for licensing # purposes). A value of 0 (or commenting it out) allows unlimited processes # to run at the same time. MAXATONCE 0 # # The following options allow you to limit scanning to only incoming or outgoing # E-mail. # INCOMING ON OUTGOING ON # # The ONACCESS option should be set to OFF unless you have an on-access virus scanner # that will be deleting attachments with viruses. # ONACCESS OFF # # The SCANNERTIMEOUT option lets you choose the number of seconds that Declude will # wait for the virus scanner to finish. The minimum value is 10 seconds. Most # scanners will not need to take that long. This option is mainly to prevent # defective scanners (that never finish) from interfering with your outgoing E-mail. # Raising this will NOT help if your virus scanner always times out. # SCANNERTIMEOUT 60 # # The SKIPEXT option will let you skip scanning of certain file extensions. For # example, a GIF file can't contain a virus, so there is no need to scan it. # SKIPEXT GIF SKIPEXT TXT SKIPEXT JPG SKIPEXT MPG SKIPEXT PNG # # The BANEXT option will let you ban file extensions. E-mails containing attachments # with these file extensions will be quarantined, and if you have a BANnotify.EML file, # it will be sent out. # BANEXP EZIP BANEXT ADE BANEXT ADP BANEXT ASD BANEXT ASF BANEXT ASP # BANEXT ASX BANEXT BAS BANEXT BAT BANEXT CAB BANEXT CEO BANEXT CHM BANEXT CHM BANEXT CMD BANEXT COM BANEXT CPL BANEXT CRT BANEXT DLL BANEXT EXE BANEXT HLP BANEXT HTA BANEXT HTO BANEXT INF BANEXT INS BANEXT ISP BANEXT JS BANEXT JSE BANEXT LNK BANEXT MDB BANEXT MDE BANEXT MSC BANEXT MSI BANEXT MSP BANEXT MST BANEXT NWS BANEXT OCX BANEXT PCD BANEXT PIF # BANEXT PNG BANEXT PRF BANEXT REG BANEXT SCF BANEXT SCR BANEXT SCT BANEXT SHB BANEXT SHS BANEXT SYS # BANEXT URL BANEXT VB BANEXT VBE BANEXT VBS BANEXT VBX BANEXT VSD BANEXT VSS BANEXT VST BANEXT VSW BANEXT WS BANEXT WSC BANEXT WSF BANEXT WSH BANEXT XML # # Declude Virus Pro can pre-scan HTML files. If no dangerous code is detected, the # virus scanner will not get called. This can significantly cut down on CPU usage. # PRESCAN ON # # Declude Virus can block treat files using CLSID extensions as viruses. This type of # extension will force a certain type of program to be run, while making the file appear # to be a .TXT or other safe file. There is no known legitimate reason to send this # type of file through E-mail. # BANCLSID ON BANPARTIAL ON # # The FOOTER lines will add a footer to the bottom of E-mails that are scanned. This may # not be visible if you send HTML or attachments with the E-mail. # #FOOTER --- #FOOTER [This E-mail scanned for viruses by Declude Virus] FOOTER --- FOOTER [Este correo ha sido verificado por un antivirus antes de ser enviado] # # The DELETEVIRUSES option, when set to ON, will delete viruses, rather than quarantine them. # It is recommended to leave this at OFF. # DELETEVIRUSES OFF # # The DELIVERERRORS option, when set to ON, will treat errors from the virus scanner as if no # virus was found. When set to ON, this could cause viruses to get through in rare situations, # but will also prevent legitimate mail from being quarantined due to an error in the scanner. # It is recommend to leave this at ON. # DELIVERERRORS ON # # The BANCRVIRUSES option will automatically treat E-mail with malformed headers that could # contain a virus as if they did contain a virus. It is strongly recommended that you keep # this set to ON; otherwise, viruses could slip through. # BANCRVIRUSES ON # # The FORGINGVIRUS option is used to list viruses that forge the return address, so Declude # can replace the name of the sender with "[Forged]". # FORGINGVIRUS Magistr FORGINGVIRUS Hybris FORGINGVIRUS Klez FORGINGVIRUS Yaha FORGINGVIRUS Lentin FORGINGVIRUS Bugbear FORGINGVIRUS Bridex FORGINGVIRUS Braid FORGINGVIRUS Exploit-MIME FORGINGVIRUS Fizzer FORGINGVIRUS Sobig FORGINGVIRUS Mimail FORGINGVIRUS Bagle FORGINGVIRUS Mydoom FORGINGVIRUS Netsky XSPOOLNAME ON XSENDER ON --------------------------------------------------------- --- [Este correo ha sido verificado por un antivirus antes de ser enviado] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
