Yes John Tolmachoff Engineer/Consultant/Owner eServices For You
> -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > On Behalf Of Chris Patterson > Sent: Friday, October 22, 2004 12:52 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.Virus] MyDoom.o's slipping through. > > Does anyone else agree using the 32 bit command line scanner is better > than the dos? > > Thanks, > > Chris Patterson, CCNA > Network Engineer > > > > -----Original Message----- > From: Douglas Cohn [mailto:[EMAIL PROTECTED] > Sent: Friday, October 22, 2004 2:39 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.Virus] MyDoom.o's slipping through. > > You should NOT use the dos scanner but instead use the Windows 32 bit > command line scanner. You would change the command to > C:\Progra~1\FSI\F-Prot\fpcmd.exe. Also there are some other changes > needed > to reflect the different program. This is my current command line and I > found that fpcmd was much better than using the dos scanner. > > C:\Progra~1\FSI\F-Prot\Fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOBOOT > /DUMB /REPORT=report.txt > > > C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 > > /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt > > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Chris Patterson > Sent: Thursday, October 21, 2004 4:38 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.Virus] MyDoom.o's slipping through. > > I was up until one of my customers and then one of my Engineers could > not > receive firmware updates from Linksys. > > We are still reviewing that decision. Do you think this MyDoom is a > result > of removing that block? > > Since adding the /ARCHIVE=5 this afternoon, I have seen it catch 2 of > the > rapidsys.com.zip attachments destined for the same customer that earlier > reported the trouble. > > Thanks, > > Chris Patterson, CCNA > Network Engineer > > > > -----Original Message----- > From: John Tolmachoff (Lists) [mailto:[EMAIL PROTECTED] > Sent: Thursday, October 21, 2004 4:12 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.Virus] MyDoom.o's slipping through. > > Why are you not banning executable files within zip files? > > John Tolmachoff > Engineer/Consultant/Owner > eServices For You > > > -----Original Message----- > > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] > > On Behalf Of Chris Patterson > > Sent: Thursday, October 21, 2004 12:42 PM > > To: [EMAIL PROTECTED] > > Subject: RE: [Declude.Virus] MyDoom.o's slipping through. > > > > Thanks, I was not aware of the /ARCHIVE=5. I have adjusted that, here > > > is my current cfg line: > > > > C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 > > /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt > > > > If there is something I am missing, please let me know. > > > > Thanks, > > > > Chris Patterson, CCNA > > Network Engineer > > > > > > > > -----Original Message----- > > From: R. Scott Perry [mailto:[EMAIL PROTECTED] > > Sent: Thursday, October 21, 2004 3:25 PM > > To: [EMAIL PROTECTED] > > Subject: Re: [Declude.Virus] MyDoom.o's slipping through. > > > > > > >I have had two reports in the last 2 days about a virus coming > through. > > > > > >The customer forwarded these to me on an Exchange mailbox using > Mcaffee > > >which identified them as MyDoom.o. Tracing the Logs, they were > scanned > > >and Deemed Virus Free using Prescan. > > > > Given that it is in a .ZIP file, and you are using F-Prot, do you have > > "/ARCHIVE=5 " in the SCANFILE line in the \IMail\Declude\virus.cfg > > file? If it is just "/ARCHIVE ", you should change it to "/ARCHIVE=5 > ", > > > > due to a bug in the latest version of F-Prot. > > > > -Scott > > --- > > Declude JunkMail: The advanced anti-spam solution for IMail > mailservers > > since 2000. > > Declude Virus: Ultra reliable virus detection and the leader in > > mailserver vulnerability detection. > > Find out what you've been missing: Ask for a free 30-day evaluation. > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.Virus mailing list. To unsubscribe, > > > just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus". The archives can be found > > at http://www.mail-archive.com. > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.Virus mailing list. To unsubscribe, > > > just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus". The archives can be found > > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To unsubscribe, > just > send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To unsubscribe, > just > send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus] > > > --- > [This E-mail scanned for viruses by Declude Virus] > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
