[Declude.Virus] trusted senders and scanfiles
A few questions: 1. We have a customer who periodically receives encrypted (password-protected) ZIPs from a trusted company. Is there a way to allow certain senders to bypass the BANEXT EZIP line in the virus.cfg (or in some other way get their email through)? 2. Is there a place somewhere that describes the various options for the SCANFILE line of virus.cfg? I am generating several reports (decMMDD.log and hiMMDD.log) that have to do with Declude HiJack, even though I do not have HiJack. So I'm thinking that my SCANFILE is telling Declude that I DO have it. Here is my SCANFILE. I am running Declude Virus Pro (and no other Declude software): LOGFILE spool\vir.log LOGLEVELLOW CONSOLEOFF # # SCANFILE is the location of the command-line virus scanner. Note that it # must include the full path. VIRUSCODE is the code that scanner returns if # it finds a virus. # SCANFILE C:\Progra~1\FSI\F-Prot\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOBOOT /DUMB /REPORT=report.txt VIRUSCODE 3 VIRUSCODE 6 REPORT Infection: Thanks! --- [This E-mail was scanned for viruses.] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] trusted senders and scanfiles
The sender of the EZIP file is obligated (by HIPAA legislation - insurance industry - and by Blue Shield) to send out password-protected files. Does anyone have a work-around for this? I'm sure some of you have come across HIPAA or other industry requirements to send out password-protected files. Thanks! Kevin Rogers wrote: A few questions: 1. We have a customer who periodically receives encrypted (password-protected) ZIPs from a trusted company. Is there a way to allow certain senders to bypass the BANEXT EZIP line in the virus.cfg (or in some other way get their email through)? --- [This E-mail was scanned for viruses.] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] trusted senders and scanfiles
Kevin Rogers wrote: The sender of the EZIP file is obligated (by HIPAA legislation - insurance industry - and by Blue Shield) to send out password-protected files. Does anyone have a work-around for this? I'm sure some of you have come across HIPAA or other industry requirements to send out password-protected files. Have the sender rename the file with a unique extension, preferable longer than 3 characters -- .SafeZip or some such.. Then tell Declude Virus to skip that extension. -- The problem with the gene pool is there are no lifeguards -Steven Wright - Bud Durland, CNE Mold-Rite Plastics Network Administrator http://www.mrpcap.com - --- [This E-mail scanned for viruses by Declude Virus / Sophos AV] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Recommended Scanner PART 2
When I changed it to SCANFILE, VIRUSCODE and REPORT, the error changed to: 10/08/2004 11:46:43 Qb66205aa013e801a Error 21 starting scanner [d:\imail\declude\runclamscan.exe log=0 C:\clamav-devel\bin\clamdscan.exe --quiet --mbox -l report.txt e:\IMAIL\spool\DB6620~1.VIR\]; NOT SCANNING ATTACHMENTS! 10/08/2004 11:46:43 Qb66205aa013e801a Your virus scanner DOES NOT EXIST (at e:\IMAIL\spool\DB6620~1.VIR\); NOT SCANNING ATTACHMENTS! [2] 10/08/2004 11:46:43 Qb66205aa013e801a Scanned: Error starting scanner Thanks Chris = I tried installing it as you indicate but I'm getting in VIR.LOG: 10/08/2004 11:44:32 Qb5de05b600627f6a Your virus scanner DOES NOT EXIST (at e:\IMAIL\spool\DB5DE0~1.VIR\); NOT SCANNING ATTACHMENTS! [2] 10/08/2004 11:44:32 Qb5de05b600627f6a Scanned: Error starting scanner In your config you have: SCANFILE4 d:\imail\declude\runclamscan.exe log=0 C:\clamav-devel\bin\clamdscan.exe --quiet --mbox -l report.txt VIRUSCODE4 1 REPORT4 FOUND For FProt, I have similar, but they are SCANFILE, VIRUSCODE and REPORT, without the 4 on the end. What does the 4 signify? Would this cause a problem? Thanks At 05:43 PM 10/7/2004, you wrote: Here's what I need to do to get clamav running: I used clam-av from here: http://www.sosdg.org/clamav-win32/index.php. Default install. I used the clamscan wrapper from here: http://www.smartbusiness.com/imail/declude/. Extracted files copied into declude folder. (This allows you to log the virus names) I added these to virus.cfg: SCANFILE4 d:\imail\declude\runclamscan.exe log=0 C:\clamav-devel\bin\clamdscan.exe --quiet --mbox -l report.txt VIRUSCODE4 1 REPORT4 FOUND I excluded the c:\cygwin\tmp folder from any server anti-virus that is running. I scheduled c:\clamav-devel\bin\freshclam with the task scheduler. - Original Message - From: marc catuogno [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 07, 2004 4:16 PM Subject: RE: [Declude.Virus] Recommended Scanner I couldn't get Clamav to run on mine. May I ask what version of ClamAV you are using? When I installed it I couldn't figure out if it was in and Declude kept throwing me an error. What is your Declude config line ? Thanks - Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Thursday, October 07, 2004 2:41 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Recommended Scanner My personal scores from best to worst: Clamav (been only a week, but it hasn't missed one) and free (Also catches some phish with prescan off) Mcafee Virusscan (beats F-prot on encyrpted zips) pretty resonably priced if you can secure DOS command line only license. (Also catches some phish with prescan off) F-Prot (catches more corrupted variants than Virusscan) Most expensive at $50 a year AVG (lags behind the others especially with encrypted zips). $75 for two years. I'll note that scanning speed isn't a consideration of mine. Others can comment on that. - Original Message - From: Brian Guenther [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 07, 2004 12:24 PM Subject: [Declude.Virus] Recommended Scanner From the list of virus scanners given in the Declude Virus Manual is there one more preferred than the others and why? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives
Re: [Declude.Virus] Recommended Scanner
I tried installing it as you indicate but I'm getting in VIR.LOG: 10/08/2004 11:44:32 Qb5de05b600627f6a Your virus scanner DOES NOT EXIST (at e:\IMAIL\spool\DB5DE0~1.VIR\); NOT SCANNING ATTACHMENTS! [2] 10/08/2004 11:44:32 Qb5de05b600627f6a Scanned: Error starting scanner In your config you have: SCANFILE4 d:\imail\declude\runclamscan.exe log=0 C:\clamav-devel\bin\clamdscan.exe --quiet --mbox -l report.txt VIRUSCODE4 1 REPORT4 FOUND For FProt, I have similar, but they are SCANFILE, VIRUSCODE and REPORT, without the 4 on the end. What does the 4 signify? Would this cause a problem? Thanks At 05:43 PM 10/7/2004, you wrote: Here's what I need to do to get clamav running: I used clam-av from here: http://www.sosdg.org/clamav-win32/index.php. Default install. I used the clamscan wrapper from here: http://www.smartbusiness.com/imail/declude/. Extracted files copied into declude folder. (This allows you to log the virus names) I added these to virus.cfg: SCANFILE4 d:\imail\declude\runclamscan.exe log=0 C:\clamav-devel\bin\clamdscan.exe --quiet --mbox -l report.txt VIRUSCODE4 1 REPORT4 FOUND I excluded the c:\cygwin\tmp folder from any server anti-virus that is running. I scheduled c:\clamav-devel\bin\freshclam with the task scheduler. - Original Message - From: marc catuogno [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 07, 2004 4:16 PM Subject: RE: [Declude.Virus] Recommended Scanner I couldn't get Clamav to run on mine. May I ask what version of ClamAV you are using? When I installed it I couldn't figure out if it was in and Declude kept throwing me an error. What is your Declude config line ? Thanks - Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Thursday, October 07, 2004 2:41 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Recommended Scanner My personal scores from best to worst: Clamav (been only a week, but it hasn't missed one) and free (Also catches some phish with prescan off) Mcafee Virusscan (beats F-prot on encyrpted zips) pretty resonably priced if you can secure DOS command line only license. (Also catches some phish with prescan off) F-Prot (catches more corrupted variants than Virusscan) Most expensive at $50 a year AVG (lags behind the others especially with encrypted zips). $75 for two years. I'll note that scanning speed isn't a consideration of mine. Others can comment on that. - Original Message - From: Brian Guenther [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 07, 2004 12:24 PM Subject: [Declude.Virus] Recommended Scanner From the list of virus scanners given in the Declude Virus Manual is there one more preferred than the others and why? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Recommended Scanner
The 4 indicates that it is scanner #4 on my system. I think you need Declude Virus Pro to run multiple scanners on a system. - Original Message - From: Chris Ulrich [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, October 08, 2004 10:42 AM Subject: Re: [Declude.Virus] Recommended Scanner I tried installing it as you indicate but I'm getting in VIR.LOG: 10/08/2004 11:44:32 Qb5de05b600627f6a Your virus scanner DOES NOT EXIST (at e:\IMAIL\spool\DB5DE0~1.VIR\); NOT SCANNING ATTACHMENTS! [2] 10/08/2004 11:44:32 Qb5de05b600627f6a Scanned: Error starting scanner In your config you have: SCANFILE4 d:\imail\declude\runclamscan.exe log=0 C:\clamav-devel\bin\clamdscan.exe --quiet --mbox -l report.txt VIRUSCODE4 1 REPORT4 FOUND For FProt, I have similar, but they are SCANFILE, VIRUSCODE and REPORT, without the 4 on the end. What does the 4 signify? Would this cause a problem? Thanks At 05:43 PM 10/7/2004, you wrote: Here's what I need to do to get clamav running: I used clam-av from here: http://www.sosdg.org/clamav-win32/index.php. Default install. I used the clamscan wrapper from here: http://www.smartbusiness.com/imail/declude/. Extracted files copied into declude folder. (This allows you to log the virus names) I added these to virus.cfg: SCANFILE4 d:\imail\declude\runclamscan.exe log=0 C:\clamav-devel\bin\clamdscan.exe --quiet --mbox -l report.txt VIRUSCODE4 1 REPORT4 FOUND I excluded the c:\cygwin\tmp folder from any server anti-virus that is running. I scheduled c:\clamav-devel\bin\freshclam with the task scheduler. - Original Message - From: marc catuogno [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 07, 2004 4:16 PM Subject: RE: [Declude.Virus] Recommended Scanner I couldn't get Clamav to run on mine. May I ask what version of ClamAV you are using? When I installed it I couldn't figure out if it was in and Declude kept throwing me an error. What is your Declude config line ? Thanks - Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Thursday, October 07, 2004 2:41 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Recommended Scanner My personal scores from best to worst: Clamav (been only a week, but it hasn't missed one) and free (Also catches some phish with prescan off) Mcafee Virusscan (beats F-prot on encyrpted zips) pretty resonably priced if you can secure DOS command line only license. (Also catches some phish with prescan off) F-Prot (catches more corrupted variants than Virusscan) Most expensive at $50 a year AVG (lags behind the others especially with encrypted zips). $75 for two years. I'll note that scanning speed isn't a consideration of mine. Others can comment on that. - Original Message - From: Brian Guenther [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 07, 2004 12:24 PM Subject: [Declude.Virus] Recommended Scanner From the list of virus scanners given in the Declude Virus Manual is there one more preferred than the others and why? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for
Re: [Declude.Virus] Recommended Scanner PART 2
Do you need to change my d:\mail to e:\imail? - Original Message - From: Chris Ulrich [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, October 08, 2004 10:44 AM Subject: Re: [Declude.Virus] Recommended Scanner PART 2 When I changed it to SCANFILE, VIRUSCODE and REPORT, the error changed to: 10/08/2004 11:46:43 Qb66205aa013e801a Error 21 starting scanner [d:\imail\declude\runclamscan.exe log=0 C:\clamav-devel\bin\clamdscan.exe --quiet --mbox -l report.txt e:\IMAIL\spool\DB6620~1.VIR\]; NOT SCANNING ATTACHMENTS! 10/08/2004 11:46:43 Qb66205aa013e801a Your virus scanner DOES NOT EXIST (at e:\IMAIL\spool\DB6620~1.VIR\); NOT SCANNING ATTACHMENTS! [2] 10/08/2004 11:46:43 Qb66205aa013e801a Scanned: Error starting scanner Thanks Chris = I tried installing it as you indicate but I'm getting in VIR.LOG: 10/08/2004 11:44:32 Qb5de05b600627f6a Your virus scanner DOES NOT EXIST (at e:\IMAIL\spool\DB5DE0~1.VIR\); NOT SCANNING ATTACHMENTS! [2] 10/08/2004 11:44:32 Qb5de05b600627f6a Scanned: Error starting scanner In your config you have: SCANFILE4 d:\imail\declude\runclamscan.exe log=0 C:\clamav-devel\bin\clamdscan.exe --quiet --mbox -l report.txt VIRUSCODE4 1 REPORT4 FOUND For FProt, I have similar, but they are SCANFILE, VIRUSCODE and REPORT, without the 4 on the end. What does the 4 signify? Would this cause a problem? Thanks At 05:43 PM 10/7/2004, you wrote: Here's what I need to do to get clamav running: I used clam-av from here: http://www.sosdg.org/clamav-win32/index.php. Default install. I used the clamscan wrapper from here: http://www.smartbusiness.com/imail/declude/. Extracted files copied into declude folder. (This allows you to log the virus names) I added these to virus.cfg: SCANFILE4 d:\imail\declude\runclamscan.exe log=0 C:\clamav-devel\bin\clamdscan.exe --quiet --mbox -l report.txt VIRUSCODE4 1 REPORT4 FOUND I excluded the c:\cygwin\tmp folder from any server anti-virus that is running. I scheduled c:\clamav-devel\bin\freshclam with the task scheduler. - Original Message - From: marc catuogno [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 07, 2004 4:16 PM Subject: RE: [Declude.Virus] Recommended Scanner I couldn't get Clamav to run on mine. May I ask what version of ClamAV you are using? When I installed it I couldn't figure out if it was in and Declude kept throwing me an error. What is your Declude config line ? Thanks - Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Thursday, October 07, 2004 2:41 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Recommended Scanner My personal scores from best to worst: Clamav (been only a week, but it hasn't missed one) and free (Also catches some phish with prescan off) Mcafee Virusscan (beats F-prot on encyrpted zips) pretty resonably priced if you can secure DOS command line only license. (Also catches some phish with prescan off) F-Prot (catches more corrupted variants than Virusscan) Most expensive at $50 a year AVG (lags behind the others especially with encrypted zips). $75 for two years. I'll note that scanning speed isn't a consideration of mine. Others can comment on that. - Original Message - From: Brian Guenther [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 07, 2004 12:24 PM Subject: [Declude.Virus] Recommended Scanner From the list of virus scanners given in the Declude Virus Manual is there one more preferred than the others and why? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives
Re: [Declude.Virus] Recommended Scanner PART 3 - Fixed
Sorry to all for the brainfart - lack of sleep and coffee. I had the drive letter wrong and, after rereading the manual, changed SCANFILE4, etc., to SCANFILE2. It didn't like that I skipped a number (well, two technically). Once I changed that, it seems to be working OK Chris At 11:44 AM 10/8/2004, you wrote: When I changed it to SCANFILE, VIRUSCODE and REPORT, the error changed to: 10/08/2004 11:46:43 Qb66205aa013e801a Error 21 starting scanner [d:\imail\declude\runclamscan.exe log=0 C:\clamav-devel\bin\clamdscan.exe --quiet --mbox -l report.txt e:\IMAIL\spool\DB6620~1.VIR\]; NOT SCANNING ATTACHMENTS! 10/08/2004 11:46:43 Qb66205aa013e801a Your virus scanner DOES NOT EXIST (at e:\IMAIL\spool\DB6620~1.VIR\); NOT SCANNING ATTACHMENTS! [2] 10/08/2004 11:46:43 Qb66205aa013e801a Scanned: Error starting scanner Thanks Chris = I tried installing it as you indicate but I'm getting in VIR.LOG: 10/08/2004 11:44:32 Qb5de05b600627f6a Your virus scanner DOES NOT EXIST (at e:\IMAIL\spool\DB5DE0~1.VIR\); NOT SCANNING ATTACHMENTS! [2] 10/08/2004 11:44:32 Qb5de05b600627f6a Scanned: Error starting scanner In your config you have: SCANFILE4 d:\imail\declude\runclamscan.exe log=0 C:\clamav-devel\bin\clamdscan.exe --quiet --mbox -l report.txt VIRUSCODE4 1 REPORT4 FOUND For FProt, I have similar, but they are SCANFILE, VIRUSCODE and REPORT, without the 4 on the end. What does the 4 signify? Would this cause a problem? Thanks At 05:43 PM 10/7/2004, you wrote: Here's what I need to do to get clamav running: I used clam-av from here: http://www.sosdg.org/clamav-win32/index.php. Default install. I used the clamscan wrapper from here: http://www.smartbusiness.com/imail/declude/. Extracted files copied into declude folder. (This allows you to log the virus names) I added these to virus.cfg: SCANFILE4 d:\imail\declude\runclamscan.exe log=0 C:\clamav-devel\bin\clamdscan.exe --quiet --mbox -l report.txt VIRUSCODE4 1 REPORT4 FOUND I excluded the c:\cygwin\tmp folder from any server anti-virus that is running. I scheduled c:\clamav-devel\bin\freshclam with the task scheduler. - Original Message - From: marc catuogno [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 07, 2004 4:16 PM Subject: RE: [Declude.Virus] Recommended Scanner I couldn't get Clamav to run on mine. May I ask what version of ClamAV you are using? When I installed it I couldn't figure out if it was in and Declude kept throwing me an error. What is your Declude config line ? Thanks - Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Thursday, October 07, 2004 2:41 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Recommended Scanner My personal scores from best to worst: Clamav (been only a week, but it hasn't missed one) and free (Also catches some phish with prescan off) Mcafee Virusscan (beats F-prot on encyrpted zips) pretty resonably priced if you can secure DOS command line only license. (Also catches some phish with prescan off) F-Prot (catches more corrupted variants than Virusscan) Most expensive at $50 a year AVG (lags behind the others especially with encrypted zips). $75 for two years. I'll note that scanning speed isn't a consideration of mine. Others can comment on that. - Original Message - From: Brian Guenther [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 07, 2004 12:24 PM Subject: [Declude.Virus] Recommended Scanner From the list of virus scanners given in the Declude Virus Manual is there one more preferred than the others and why? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by
Re: [Declude.Virus] trusted senders and scanfiles
Thanks. I'm having him password protect his Office documents directly and that seems to be working. But does anyone have any information about my second question? 2. Is there a place somewhere that describes the various options for the SCANFILE line of virus.cfg? I am generating several reports (decMMDD.log and hiMMDD.log) that have to do with Declude HiJack, even though I do not have HiJack. So I'm thinking that my SCANFILE is telling Declude that I DO have it (or it could be some other line in the virus.cfg?). Here is my SCANFILE. I am running Declude Virus Pro (and no other Declude software). LOGFILE spool\vir.log LOGLEVELLOW CONSOLEOFF # # SCANFILE is the location of the command-line virus scanner. Note that it # must include the full path. VIRUSCODE is the code that scanner returns if # it finds a virus. # SCANFILE C:\Progra~1\FSI\F-Prot\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOBOOT /DUMB /REPORT=report.txt VIRUSCODE 3 VIRUSCODE 6 REPORT Infection: Bud Durland wrote: Kevin Rogers wrote: The sender of the EZIP file is obligated (by HIPAA legislation - insurance industry - and by Blue Shield) to send out password-protected files. Does anyone have a work-around for this? I'm sure some of you have come across HIPAA or other industry requirements to send out password-protected files. Have the sender rename the file with a unique extension, preferable longer than 3 characters -- .SafeZip or some such.. Then tell Declude Virus to skip that extension. --- [This E-mail was scanned for viruses.] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
