BanNotify.eml is sent out to people who try sending a banned file extension. BounceNotify.eml is used with the BOUNCEONLYIFYOUMUST ACTION which will send a "bounce" message - this should NOT be used except in rare cases.
David B www.declude.com -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Friday, August 11, 2006 1:09 PM To: declude.virus@declude.com Subject: RE: [Declude.Virus] New feature needed I'm just trying to narrow these files down. I don't want to stick something in the Declude directory and have it exhibit unexpected behavior. Also there are many other files in the Declude directory that are unexplained and may be left over from older versions, but I have no way to know if I can delete them or not. BounceNotify.eml is there, it was installed by Declude. Though I just tested it by sending myself a banned file, and it did not work, so maybe Declude discontinued it at some point (David?). There is no file called Vulnerabilty.eml in the Declude directory, so I assume Declude does not install this by default. -------- Original Message -------- > From: "John T \(Lists\)" <[EMAIL PROTECTED]> > Sent: Friday, August 11, 2006 3:56 AM > To: declude.virus@declude.com > Subject: RE: [Declude.Virus] New feature needed > > Sorry, forgot to make an all inclusive list: > > To my knowledge, there is no BounceNotify.eml. > > JunkMail uses the following eml files ONLY: > SpamAttach.eml > > Confirm uses the following eml file ONLY: > Confirm.eml > > When EVA finds a vulnerability (list in the EVA manual further down > from the allow section) it uses the following file ONLY: > Vulnerability.eml > > When EVA finds a banned attachment and the associated email is not > found to be virus laden or contain a vulnerability, EVA will use the > following file > ONLY: > BanNotify.eml > > ANY OTHER eml file contained in the \declude directory will be used by > EVA when a virus is found according to parameters within each file. > So, if you have 50 eml files aside from the above specifically > mentioned 4, EVA will try to use all 50 when it finds a virus. > > The reason for this along with the original 4 other eml files normally > found (postmaster.eml, otherpostmaster.eml, sender.eml and > recipient.eml) was so that a appropriately worded notice be set to > each respective party as desired. However, that also allows for plenty > of customization. Example, I have a client that the manager wants a > copy of each notice sent. So I have created 2 specific eml files for > that client, one for if the infected email is incoming and one for if the infected email is outgoing. > > John T > eServices For You > > "Seek, and ye shall find!" > > > > -----Original Message----- > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > > Gary Steiner > > Sent: Thursday, August 10, 2006 9:05 PM > > To: declude.virus@declude.com > > Subject: RE: [Declude.Virus] New feature needed > > > > But what defines a "vulnerability"? Are you referring to the list > > of > vulnerabilities > > associated with the ALLOWVULNERABILITY statement in the EVA manual? > > I'm confused by the various .eml files Declude provides and how it > > decides to > use them, > > whether EVA or Junkmail. None of the .eml files that come with > > Declude > have the > > name of a vulnerability. > > > > Here is a list of the E-mail template files that came with the > > Declude 4.x > installation > > and how I guess that they are used (since there doesn't seem to be > > some > centralized > > description/list of what these files are and how they are used): > > > > spamattach.eml - Used by Junkmail when ATTACH action is implemented. > > > > postmaster.eml - Used by EVA to warn the postmaster of the local > > machine > that a > > virus was detected. > > > > BOUNCEnotify.eml - Used by EVA to warn the local sender that his > (outgoing) E-mail > > attachment contained a banned extension. > > > > BANnotify.eml - Used by EVA to warn the sender that his (incoming) > > E-mail attachment contained a banned extension. > > > > otherpostmaster.eml - Used by EVA to warn the postmaster of a host > > that a > virus > > came from his server (typically not used due to virus forging). > > > > sender.eml - Used by EVA to warn the sender that an E-mail sent by > > him was detected as a virus (typically not used due to virus forging). > > > > recip.eml - Used by EVA to warn the recipient that Declude detected > > a > virus send to > > him. > > > > confirm.eml - Used by Declude Confirm > > (http://www.declude.com/Articles.asp?ID=127). Is this a > > discontinued > product? If > > not, does it work with SmarterMail? > > > > > > So it seems that most of the files are used by EVA, one by Junkmail > > and > one by > > Confirm. Does that mean that Junkmail and Confirm only use their > > one > specific .eml > > file and ignore all the others? If I create a randomly named .eml > > file, > will it only be > > used by EVA? > > > > > > > > -------- Original Message -------- > > > From: "John T \(Lists\)" <[EMAIL PROTECTED]> > > > Sent: Thursday, August 10, 2006 9:37 PM > > > To: declude.virus@declude.com > > > Subject: RE: [Declude.Virus] New feature needed > > > > > > When a vulnerability is detected, it looks for vulnerability.eml only. > When > > > a virus is detected, it uses any and all .eml files except for > > > vulnerability.eml. > > > > > > So yes, you could do that. > > > > > > John T > > > eServices For You > > > > > > "Seek, and ye shall find!" > > > > > > > -----Original Message----- > > > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf > > > > Of > Gary > > > > Steiner > > > > Sent: Thursday, August 10, 2006 4:43 PM > > > > To: declude.virus@declude.com > > > > Subject: RE: [Declude.Virus] New feature needed > > > > > > > > I was wondering if there might be a work-around for this. Could > > > > a > > > combination of > > > > multiple .eml files utilizing SKIPIFRECIP work? > > > > > > > > I guess the first question is what .eml files does Declude look > > > > for > when > > > it detects a > > > > virus? Does EVA specifically look for a file named "recip.eml"? > > > > Or > does > > > it look at all > > > > the .eml files in the main Declude directory? > > > > > > > > Could you have two files, one called recip-en.eml (English) and > > > > one > called > > > recip- > > > > es.eml (Spanish), and then list in those files using SKIPIFRECIP > > > > all > the > > > domains that > > > > want the other language? > > > > > > > > Gary > > > > > > > > > > > > -------- Original Message -------- > > > > > From: "Goran Jovanovic" <[EMAIL PROTECTED]> > > > > > Sent: Tuesday, June 20, 2006 3:57 PM > > > > > To: declude.virus@declude.com > > > > > Subject: RE: [Declude.Virus] New feature needed > > > > > > > > > > Gary, > > > > > > > > > > I have not even thought of something like that (since all my > customers > > > > > are English speaking) but you are absolutely right. > > > > > > > > > > So David will we be seeing this new feature next week? :) > > > > > > > > > > Goran Jovanovic > > > > > Omega Network Solutions > > > > > > > > > > > > > > > > > > > > > -----Original Message----- > > > > > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > > > > > > Behalf > Of > > > > > Gary > > > > > > Steiner > > > > > > Sent: Tuesday, June 20, 2006 3:24 PM > > > > > > To: declude.virus@declude.com > > > > > > Subject: re: [Declude.Virus] New feature needed > > > > > > > > > > > > > > > > > > I asked about the possibility of per domain replies several > > > > > > months > > > > > ago. I > > > > > > would hope that it has already been placed on the wish list. > > > > > > > > > > > > It is especially useful when you have users speaking > > > > > > different > > > > > languages > > > > > > and you want to have language specific messages linked to > > > > > > each > domain. > > > > > > > > > > > > Gary > > > > > > > > > > > > > > > > > > -------- Original Message -------- > > > > > > > From: "Goran Jovanovic" > > > > > > > <[EMAIL PROTECTED]> > > > > > > > Sent: Tuesday, June 20, 2006 2:30 PM > > > > > > > To: declude.virus@declude.com > > > > > > > Subject: [Declude.Virus] New feature needed > > > > > > > > > > > > > > Hi, > > > > > > > > > > > > > > I would like to suggest a new feature to be added to the > > > > > > > virus notification capabilities. > > > > > > > > > > > > > > Right now to notify a recipient that I stopped a virus I > > > > > > > have a recip.eml file in my main delude directory. There > > > > > > > is another recip-vulnerability.eml file that is used if > > > > > > > the "virus" is a vulnerability. These two files are all or > > > > > > > nothing files. Meaning > > > > > that > > > > > > > all recipients for all the domains that I process are in > > > > > > > the > same > > > > > file. > > > > > > > > > > > > > > I need to be able to specify a per domain recip.eml file. > > > > > > > This > way I > > > > > can > > > > > > > tailor the notifications to each domain as appropriate. > > > > > > > These > files > > > > > > > should be in the domain subdirectory along with the > > > > > $default$.junkfile > > > > > > > etc. > > > > > > > > > > > > > > I am faced with the challenge right now for a single > > > > > > > domain to > send > > > > > all > > > > > > > virus notification to one person only or to stop all > notifications > > > > > to > > > > > > > that domain. To the best of my knowledge I cannot redirect > > > > > > > all > the > > > > > > > notifications to the one person for that domain and to the > original > > > > > > > recipients for all the other domains. > > > > > > > > > > > > > > Another feature that should be added to the *.eml files is > > > > > > > the > > > > > ability > > > > > > > to do a BCC to a monitoring address. This is a good way to > monitor > > > > > what > > > > > > > is happening with banned files, viruses or whatever > > > > > > > notification processes we have setup. > > > > > > > > > > > > > > So can you please add this to the "to do" list > > > > > > > > > > > > > > Thank you > > > > > > > > > > > > > > Goran Jovanovic > > > > > > > Omega Network Solutions > > > > > > > > > > > > > > > > > > > > > --- > > > > > > > > > > > > --- > > This E-mail came from the Declude.Virus mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus". The archives can be found > > at http://www.mail-archive.com. > > > > > --- > This E-mail came from the Declude.Virus mailing list. To unsubscribe, > just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
