Does anyone else agree using the 32 bit command line scanner is better than the dos?
Thanks, Chris Patterson, CCNA Network Engineer -----Original Message----- From: Douglas Cohn [mailto:[EMAIL PROTECTED] Sent: Friday, October 22, 2004 2:39 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] MyDoom.o's slipping through. You should NOT use the dos scanner but instead use the Windows 32 bit command line scanner. You would change the command to C:\Progra~1\FSI\F-Prot\fpcmd.exe. Also there are some other changes needed to reflect the different program. This is my current command line and I found that fpcmd was much better than using the dos scanner. C:\Progra~1\FSI\F-Prot\Fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOBOOT /DUMB /REPORT=report.txt > C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 > /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chris Patterson Sent: Thursday, October 21, 2004 4:38 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] MyDoom.o's slipping through. I was up until one of my customers and then one of my Engineers could not receive firmware updates from Linksys. We are still reviewing that decision. Do you think this MyDoom is a result of removing that block? Since adding the /ARCHIVE=5 this afternoon, I have seen it catch 2 of the rapidsys.com.zip attachments destined for the same customer that earlier reported the trouble. Thanks, Chris Patterson, CCNA Network Engineer -----Original Message----- From: John Tolmachoff (Lists) [mailto:[EMAIL PROTECTED] Sent: Thursday, October 21, 2004 4:12 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] MyDoom.o's slipping through. Why are you not banning executable files within zip files? John Tolmachoff Engineer/Consultant/Owner eServices For You > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > On Behalf Of Chris Patterson > Sent: Thursday, October 21, 2004 12:42 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.Virus] MyDoom.o's slipping through. > > Thanks, I was not aware of the /ARCHIVE=5. I have adjusted that, here > is my current cfg line: > > C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 > /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt > > If there is something I am missing, please let me know. > > Thanks, > > Chris Patterson, CCNA > Network Engineer > > > > -----Original Message----- > From: R. Scott Perry [mailto:[EMAIL PROTECTED] > Sent: Thursday, October 21, 2004 3:25 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.Virus] MyDoom.o's slipping through. > > > >I have had two reports in the last 2 days about a virus coming through. > > > >The customer forwarded these to me on an Exchange mailbox using Mcaffee > >which identified them as MyDoom.o. Tracing the Logs, they were scanned > >and Deemed Virus Free using Prescan. > > Given that it is in a .ZIP file, and you are using F-Prot, do you have > "/ARCHIVE=5 " in the SCANFILE line in the \IMail\Declude\virus.cfg > file? If it is just "/ARCHIVE ", you should change it to "/ARCHIVE=5 ", > > due to a bug in the latest version of F-Prot. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers > since 2000. > Declude Virus: Ultra reliable virus detection and the leader in > mailserver vulnerability detection. > Find out what you've been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To unsubscribe, > just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To unsubscribe, > just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
