hi, if you put AVAFTERJM ON in your virus.cfg jm is called bevor av. but i do not think that this will solve your problem. if you just want av to stop sending virusnotification when a virus is send from a certain sender, why dont you try SKIPIFSENDER [EMAIL PROTECTED] in the .eml file which is used to notify the recipient. look in the manual (http://www.declude.com/virus/manual.htm) chapter 14 to learn about this.
hope it helps (and my english is not to bad) greetings from germany mfg i.a. gez. markus guhl *********************************** lds nrw ref. 241 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *********************************** -----Urspr�ngliche Nachricht----- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Auftrag von Kevin Rogers Gesendet: Mittwoch, 8. Juni 2005 06:10 An: [email protected] Betreff: Re: [Declude.Virus] Newbie question Should I put "AVAFTERJM ON" in my global.cfg file? And does it matter where I put it inside the file? Thanks. David Franco-Rocha [ Declude ] wrote: > Thanks. This will be added to the manual. > > David Franco-Rocha > Declude Technical Support > > ----- Original Message ----- From: "Darin Cox" <[EMAIL PROTECTED]> > To: <[email protected]> > Sent: Monday, June 06, 2005 10:58 AM > Subject: Re: [Declude.Virus] Newbie question > > >> Great... Could the Declude staff have this added to the manual? >> >> Darin. >> >> >> ----- Original Message ----- From: "Guhl, Markus (LDS)" >> <[EMAIL PROTECTED]> >> To: <[email protected]> >> Sent: Monday, June 06, 2005 4:28 AM >> Subject: AW: [Declude.Virus] Newbie question >> >> >> hi darin, >> >> we use AVAFTERJM ON with Declude 2.0.6.14 and it works like we need it. >> >> mfg >> i.a. >> gez. markus guhl >> *********************************** >> lds nrw >> ref. 241 >> tel.: 0211 9449 2578 >> fax.: 0211 9449 8344 >> mailto:[EMAIL PROTECTED] >> *********************************** >> >> >> >> -----Urspr�ngliche Nachricht----- >> Von: [EMAIL PROTECTED] >> [mailto:[EMAIL PROTECTED] Auftrag von Darin Cox >> Gesendet: Sonntag, 5. Juni 2005 23:02 >> An: [email protected] >> Betreff: Re: [Declude.Virus] Newbie question >> >> >> I don't know if it still exists since it is not in the current >> manual, but >> there was an option in previous versions of AV called AVAFTERJM that >> allowed >> JunkMail to run first. Otherwise you are correct that AV would run >> first. >> >> Darin. >> >> >> ----- Original Message ----- From: "Kevin Rogers" <[EMAIL PROTECTED]> >> To: <[email protected]> >> Sent: Sunday, June 05, 2005 3:17 PM >> Subject: Re: [Declude.Virus] Newbie question >> >> >> Thanks for the quick response. Yes, I have the Pro versions for both AV >> and Junkmail. >> >> >> Darin Cox wrote: >> >>> Do you have the Pro version of Declude Junkmail? You have to have >>> pro to >>> use filters and outbound scanning. The fromfile filter I mentioned >>> will >>> work in the standard version, though. >>> >>> Darin. >>> >>> >>> ----- Original Message ----- From: "Kevin Rogers" >>> <[EMAIL PROTECTED]> >>> To: <[email protected]> >>> Sent: Sunday, June 05, 2005 2:56 PM >>> Subject: Re: [Declude.Virus] Newbie question >>> >>> >>> I changed it to HEADERS and still I am receiving emails from these >>> addresses (got 4 of them personally yesterday). My virus scanner is >>> now >>> updated every four hours, so F-Prot caught these viruses, but I >>> still am >>> receiving the virus notifications. Perhaps the scanning takes place >>> (and the notifications are sent out) before my filter is called? >>> >>> This is what my filter file contains: >>> HEADERS 0 CONTAINS [EMAIL PROTECTED] >>> HEADERS 0 CONTAINS [EMAIL PROTECTED] >>> etc..... >>> >>> This is what I have in my global.cfg >>> MYFILTER filter C:\Imail\Declude\Filter.txt x 20 0 >>> >>> This is in my $default$.junkmail file >>> WEIGHT20 HOLD >>> >>> What am I missing? >>> >>> Thanks. >>> >>> >>> Scott Fisher wrote: >>> >>> >>> >>>> The MAILFROM filter test is seperate from anything in the headers. It >>>> is the envelope sender. >>>> >>>> If you want to test on the header from (I call it display from because >>>> that's what Outlook displays), you need to check the HEADERS. >>>> >>>> >>>> ----- Original Message ----- From: "Kevin Rogers" >>>> <[EMAIL PROTECTED]> >>>> To: <[email protected]> >>>> Sent: Friday, June 03, 2005 3:26 AM >>>> Subject: Re: [Declude.Virus] Newbie question >>>> >>>> >>>> >>>> >>>>> Great. Exactly what I needed. >>>>> I was also confused about the MAILFROM. Does MAILFROM mean what is >>>>> displayed as the FROM: in the headers or what it says in the "X-Note: >>>>> This E-mail was sent from 206-72-95-86.wi.skypipeline.com >>>>> ([206.72.95.86])" or in the X-Declude-Sender field? >>>>> >>>>> Maybe I should just use the HEADERS 0 CONTAINS.... instead. >>>>> >>>>> Thanks again. >>>>> >>>>> >>>>> >>>>> Scott Fisher wrote: >>>>> >>>>> >>>>> >>>>>> One caveat. The MAILFROM uses the envelope mailfrom, which is >>>>>> different than the ones displayed in the headers. >>>>>> If the below doesn't stop it, add >>>>>> HEADERS 0 CONTAINS [EMAIL PROTECTED] >>>>>> HEADERS 0 CONTAINS [EMAIL PROTECTED] >>>>>> >>>>>> ----- Original Message ----- From: "Kevin Rogers" >>>>>> <[EMAIL PROTECTED]> >>>>>> To: <[email protected]> >>>>>> Sent: Thursday, June 02, 2005 10:37 PM >>>>>> Subject: Re: [Declude.Virus] Newbie question >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>> I looked up the filter section at the manual. This is what I did. >>>>>>> >>>>>>> I made a file called filter.txt. This contains: >>>>>>> MAILFROM 0 CONTAINS [EMAIL PROTECTED] >>>>>>> MAILFROM 0 CONTAINS [EMAIL PROTECTED] >>>>>>> etc..... >>>>>>> >>>>>>> I then added this line in global.cfg: >>>>>>> MYFILTER filter C:\Imail\Declude\filter.txt x 20 0 >>>>>>> >>>>>>> In my $default$.junkmail file there was already this line: >>>>>>> WEIGHT20 HOLD >>>>>>> >>>>>>> Do I need to do anything else to the junkmail file to reference >>>>>>> MYFILTER or does the WEIGHT20 take care of everything? >>>>>>> >>>>>>> Thanks. >>>>>>> >>>>>>> Kevin >>>>>>> >>>>>>> >>>>>>> >>>>>>> Darin Cox wrote: >>>>>>> >>>>>>> >>>>>>> >>>>>>>> Nope... add a "filter" test and put those lines in it. The same >>>>>>>> thing I >>>>>>>> mentioned without pro applies here for adding test names to the >>>>>>>> global.cfg >>>>>>>> and $default$.junkmail. >>>>>>>> >>>>>>>> The manual at http://declude.com/junkmail/manual.htm decribes >>>>>>>> adding filter >>>>>>>> files pretty well. >>>>>>>> >>>>>>>> Darin. >>>>>>>> >>>>>>>> >>>>>>>> ----- Original Message ----- From: "Kevin Rogers" >>>>>>>> <[EMAIL PROTECTED]> >>>>>>>> To: <[email protected]> >>>>>>>> Sent: Thursday, June 02, 2005 7:09 PM >>>>>>>> Subject: Re: [Declude.Virus] Newbie question >>>>>>>> >>>>>>>> >>>>>>>> I have pro. How do I add filters? >>>>>>>> >>>>>>>> Should I add that line "MAILFROM10 CONTAINS >>>>>>>> [EMAIL PROTECTED]" in >>>>>>>> virus.cfg or global.cfg? Do I need to use another file? >>>>>>>> >>>>>>>> If I use the HEADERS option "HEADERS 10 CONTAINS >>>>>>>> [EMAIL PROTECTED]" >>>>>>>> - where would I put that? >>>>>>>> >>>>>>>> Sorry for the newbie questions. >>>>>>>> >>>>>>>> Kevin >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> Scott Fisher wrote: >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>> If you've got pro, you could add a filter: >>>>>>>>> MAILFROM10 CONTAINS [EMAIL PROTECTED] >>>>>>>>> that will check the envelope mailfrom. >>>>>>>>> >>>>>>>>> To check for those addresses in the headers: >>>>>>>>> HEADERS 10 CONTAINS [EMAIL PROTECTED] >>>>>>>>> >>>>>>>>> Another option is to update your virus software more often to >>>>>>>>> minimize >>>>>>>>> the opportunity window for the virus. >>>>>>>>> >>>>>>>>> ----- Original Message ----- From: "Kevin Rogers" >>>>>>>>> <[EMAIL PROTECTED]> >>>>>>>>> To: <[email protected]> >>>>>>>>> Sent: Thursday, June 02, 2005 5:15 PM >>>>>>>>> Subject: [Declude.Virus] Newbie question >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>>> How do I ban certain email addresses? >>>>>>>>>> >>>>>>>>>> Some viruses have gotten through lately (first that I know about >>>>>>>>>> since installing Declude) sent from forged email addresses using >>>>>>>>>> our >>>>>>>>>> own domain. We do not whitelist our domain. I'd like to ban >>>>>>>>>> some of >>>>>>>>>> these common addresses (e.g., [EMAIL PROTECTED], >>>>>>>>>> [EMAIL PROTECTED], etc.) >>>>>>>>>> >>>>>>>>>> Thanks. >>>>>>>>>> >>>>>>>>>> --- >>>>>>>>>> [This E-mail was scanned for viruses.] >>>>>>>>>> >>>>>>>>>> --- >>>>>>>>>> This E-mail came from the Declude.Virus mailing list. To >>>>>>>>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>>>>>>>> type "unsubscribe Declude.Virus". The archives can be found >>>>>>>>>> at http://www.mail-archive.com. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>> --- >>>>>>>>> This E-mail came from the Declude.Virus mailing list. To >>>>>>>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>>>>>>> type "unsubscribe Declude.Virus". The archives can be found >>>>>>>>> at http://www.mail-archive.com. >>>>>>>>> --- >>>>>>>>> [This E-mail was scanned for viruses.] >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>> --- >>>>>>>> [This E-mail was scanned for viruses.] >>>>>>>> >>>>>>>> --- >>>>>>>> This E-mail came from the Declude.Virus mailing list. To >>>>>>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>>>>>> type "unsubscribe Declude.Virus". The archives can be found >>>>>>>> at http://www.mail-archive.com. >>>>>>>> >>>>>>>> --- >>>>>>>> This E-mail came from the Declude.Virus mailing list. To >>>>>>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>>>>>> type "unsubscribe Declude.Virus". The archives can be found >>>>>>>> at http://www.mail-archive.com. >>>>>>>> --- >>>>>>>> [This E-mail was scanned for viruses.] >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>> --- >>>>>>> [This E-mail was scanned for viruses.] >>>>>>> >>>>>>> --- >>>>>>> This E-mail came from the Declude.Virus mailing list. To >>>>>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>>>>> type "unsubscribe Declude.Virus". The archives can be found >>>>>>> at http://www.mail-archive.com. >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>> --- >>>>>> This E-mail came from the Declude.Virus mailing list. To >>>>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>>>> type "unsubscribe Declude.Virus". The archives can be found >>>>>> at http://www.mail-archive.com. >>>>>> --- >>>>>> [This E-mail was scanned for viruses.] >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>> --- >>>>> [This E-mail was scanned for viruses.] >>>>> >>>>> --- >>>>> This E-mail came from the Declude.Virus mailing list. To >>>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>>> type "unsubscribe Declude.Virus". The archives can be found >>>>> at http://www.mail-archive.com. >>>>> >>>>> >>>>> >>>> --- >>>> This E-mail came from the Declude.Virus mailing list. To >>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>> type "unsubscribe Declude.Virus". The archives can be found >>>> at http://www.mail-archive.com. >>>> --- >>>> [This E-mail was scanned for viruses.] >>>> >>>> >>>> >>>> >>>> >>> --- >>> [This E-mail was scanned for viruses.] >>> >>> --- >>> This E-mail came from the Declude.Virus mailing list. To >>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>> type "unsubscribe Declude.Virus". The archives can be found >>> at http://www.mail-archive.com. >>> >>> --- >>> This E-mail came from the Declude.Virus mailing list. To >>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>> type "unsubscribe Declude.Virus". The archives can be found >>> at http://www.mail-archive.com. >>> --- >>> [This E-mail was scanned for viruses.] >>> >>> >>> >>> >>> >> --- >> [This E-mail was scanned for viruses.] >> >> --- >> This E-mail came from the Declude.Virus mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.Virus". The archives can be found >> at http://www.mail-archive.com. >> >> --- >> This E-mail came from the Declude.Virus mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.Virus". The archives can be found >> at http://www.mail-archive.com. >> --- >> This E-mail came from the Declude.Virus mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.Virus". The archives can be found >> at http://www.mail-archive.com. >> >> --- >> This E-mail came from the Declude.Virus mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.Virus". The archives can be found >> at http://www.mail-archive.com. >> > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail was scanned for viruses.] > > > --- [This E-mail was scanned for viruses.] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
