RE: [Declude.Virus] Declude Beta 3.0.3.8 Available
Darrell, I will need to check with the engineers and get back to you as to where we are with the multi-processor environment, although I am pretty sure this version should work with multi-processors, as I know that the delay between threads should have been reduced. David -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Wednesday, September 14, 2005 4:38 PM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] Declude Beta 3.0.3.8 Available David, Any progress on the issues we seen under multi-processor environments? Darrell David Barker writes: > If you are running the Declude Beta please upgrade to 3.0.3.8 and send > feedback to [EMAIL PROTECTED] > > David B > www.declude.com > > --- > This E-mail came from the Declude.Virus mailing list. To unsubscribe, > just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus".The archives can be found > at http://www.mail-archive.com. Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Declude Beta 3.0.3.8 Available
Sorry, I am just getting my head back into Declude/Imail/etc from Katrina. Is 3.0+ ok for single processor systems? John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Wednesday, September 14, 2005 3:38 PM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] Declude Beta 3.0.3.8 Available David, Any progress on the issues we seen under multi-processor environments? Darrell David Barker writes: > If you are running the Declude Beta please upgrade to 3.0.3.8 and send > feedback to [EMAIL PROTECTED] > > David B > www.declude.com > > --- > This E-mail came from the Declude.Virus mailing list. To unsubscribe, > just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus".The archives can be found > at http://www.mail-archive.com. Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Declude Beta 3.0.3.8 Available
David, Any progress on the issues we seen under multi-processor environments? Darrell David Barker writes: If you are running the Declude Beta please upgrade to 3.0.3.8 and send feedback to [EMAIL PROTECTED] David B www.declude.com --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] blocking eml and msg attachments
Darin, I would suggest maybe trying 1.0.6 instead of the beta. I have no measurable delay moving from one message to another; it's instantaneous. Even in the IMail Forum which I have messages going back to 1/1/2004, everything happens instantly. I am not on a laptop, and my system is only slightly faster as far as the stats go, but I don't think that makes a difference. Maybe the newer versions do things differently. I would doubt that the developers would accept a noticeable slowdown in a final version. Matt Darin Cox wrote: According to the Thunderbird web page and download filename, Thunderbird has a 1.5.1 beta 1. Check the website. However, when I installed it, it said it was installing 1.4. Startup speed for Thunderbird is way faster than OE at just a few seconds compared to 20-30 seconds for OE, however I leave email open all day every day, so startup isn't much of an issue for me. What I am seeing much slower in Thunderbird is moving from one message to another in the preview window. In OE it's very snappy with ~1/2 second response, but in Thunderbird I'm seeing 1-3 seconds before I can read the message. Also, double-clicking to open the message is between 0.5 and 1 second in OE, but 3-4 seconds in Thunderbird. So, for reading mail quickly, it's much slower for me on a 3GHz P4 laptop with 1GB RAM. I have about 1GB of email in a couple hundred folders. Darin. - Original Message - From: Matt To: Declude.Virus@declude.com Sent: Wednesday, September 14, 2005 3:47 PM Subject: Re: [Declude.Virus] blocking eml and msg attachments Darin, I'm confused. FireFox, the Web browser is at 1.5.1 beta, but Thunderbird, the E-mail client, is at 1.0.6. I'm also not clear on what you mean regarding speed. I am very happy, and it seems to me that an empty OE or Outlook is much slower to launch, and Thunderbird seems faster when there is a ton of E-mail in a folder. Thunderbird is meant to be a fairly lean application. It is also very stable, at least on my system. I have about 7 E-mail accounts going, and I over 2 GB of E-mail dispersed through them. You might be running into issues with indexing folders following an initial setup? Maybe you could be more specific about the speed issues. Matt Darin Cox wrote: Just loaded it (1.5.1 beta). Seems to be almost identical to OE for the way I use it...except slower. Speed is one of the reasons I use OE instead of Outlook. :( Darin. - Original Message - From: Matt To: Declude.Virus@declude.com Sent: Wednesday, September 14, 2005 3:07 PM Subject: Re: [Declude.Virus] blocking eml and msg attachments Thunderbird just simply works. My only complaint is that the spell checker sucks and has serious problems if you are off by more than one letter. For the type of work that we do, it is definitely a better application. The E-mail is stored in plain text files so you can search it that way, and there's none of that magic stuff that hides important things from you the way that Outlook does. And of course hardly any known vulnerabilities for auto-execution. Matt Darin Cox wrote: Plain text would be my preference as well, to see headers and message at once. Hmmm...may have to try Thunderbird again. It seemed to be missing some features I liked in OE the last time I tried it. I would use Outlook, but it still experiences too many failures in communicating with the TCP/IP stack, and is too slow and bloated for my taste...and preview doesn't seem to work as well as OE. If MS would combine the best features of OE and Outlook, they'd have a better mail client. Darin. - Original Message - From: Matt To: Declude.Virus@declude.com Sent: Wednesday, September 14, 2005 2:46 PM Subject: Re: [Declude.Virus] blocking eml and msg attachments Hmm, works fine in Thunderbird/Netscape, or at least I can see it as plain text. It seems from Pete's MIME headers that he intended for the message to just simply be attached and viewable as the original message. If he changed the extension to .eml that should work. I'm not sure whether or not is is better to see the plain text source or the rendered message. I guess I am used to seeing the plain text and it is easier for me to figure out what the rule matched that way without a Ctrl+U to view the source (shortcut in Thunderbird/Netscape). Matt Darin Cox wrote: Yep... banning 1.msg wouldn't be a good idea unless we can get Pete to change the name of his attachments. I myself would prefer them not to be named .msg (.txt would be _great_) as I can't open them directly in OE that way. I have to save them to disk in order to see which
Re: [Declude.Virus] blocking eml and msg attachments
According to the Thunderbird web page and download filename, Thunderbird has a 1.5.1 beta 1. Check the website. However, when I installed it, it said it was installing 1.4. Startup speed for Thunderbird is way faster than OE at just a few seconds compared to 20-30 seconds for OE, however I leave email open all day every day, so startup isn't much of an issue for me. What I am seeing much slower in Thunderbird is moving from one message to another in the preview window. In OE it's very snappy with ~1/2 second response, but in Thunderbird I'm seeing 1-3 seconds before I can read the message. Also, double-clicking to open the message is between 0.5 and 1 second in OE, but 3-4 seconds in Thunderbird. So, for reading mail quickly, it's much slower for me on a 3GHz P4 laptop with 1GB RAM. I have about 1GB of email in a couple hundred folders. Darin. - Original Message - From: Matt To: Declude.Virus@declude.com Sent: Wednesday, September 14, 2005 3:47 PM Subject: Re: [Declude.Virus] blocking eml and msg attachments Darin,I'm confused. FireFox, the Web browser is at 1.5.1 beta, but Thunderbird, the E-mail client, is at 1.0.6.I'm also not clear on what you mean regarding speed. I am very happy, and it seems to me that an empty OE or Outlook is much slower to launch, and Thunderbird seems faster when there is a ton of E-mail in a folder. Thunderbird is meant to be a fairly lean application. It is also very stable, at least on my system. I have about 7 E-mail accounts going, and I over 2 GB of E-mail dispersed through them.You might be running into issues with indexing folders following an initial setup? Maybe you could be more specific about the speed issues.MattDarin Cox wrote: Just loaded it (1.5.1 beta). Seems to be almost identical to OE for the way I use it...except slower. Speed is one of the reasons I use OE instead of Outlook. :( Darin. - Original Message - From: Matt To: Declude.Virus@declude.com Sent: Wednesday, September 14, 2005 3:07 PM Subject: Re: [Declude.Virus] blocking eml and msg attachments Thunderbird just simply works. My only complaint is that the spell checker sucks and has serious problems if you are off by more than one letter. For the type of work that we do, it is definitely a better application. The E-mail is stored in plain text files so you can search it that way, and there's none of that magic stuff that hides important things from you the way that Outlook does. And of course hardly any known vulnerabilities for auto-execution.MattDarin Cox wrote: Plain text would be my preference as well, to see headers and message at once. Hmmm...may have to try Thunderbird again. It seemed to be missing some features I liked in OE the last time I tried it. I would use Outlook, but it still experiences too many failures in communicating with the TCP/IP stack, and is too slow and bloated for my taste...and preview doesn't seem to work as well as OE. If MS would combine the best features of OE and Outlook, they'd have a better mail client. Darin. - Original Message - From: Matt To: Declude.Virus@declude.com Sent: Wednesday, September 14, 2005 2:46 PM Subject: Re: [Declude.Virus] blocking eml and msg attachments Hmm, works fine in Thunderbird/Netscape, or at least I can see it as plain text.It seems from Pete's MIME headers that he intended for the message to just simply be attached and viewable as the original message. If he changed the extension to .eml that should work. I'm not sure whether or not is is better to see the plain text source or the rendered message. I guess I am used to seeing the plain text and it is easier for me to figure out what the rule matched that way without a Ctrl+U to view the source (shortcut in Thunderbird/Netscape).MattDarin Cox wrote: Yep... banning 1.msg wouldn't be a good idea unless we can get Pete to change the name of his attachments. I myself would prefer them not to be named .msg (.txt would be _great_) as I can't open them directly in OE that way. I have to save them to disk in order to see which false positive I reported. Darin. - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: Sent: Wednesday, September 14, 2005 2:27 PM Subject: RE: [Declude.Virus] blocking eml and msg attachments My bad. I was not banning eml and msg. I realized that as I was getting AOL feedbacks. What I was banning was 1.msg as there was a virus reported to be using that. Sniffer responds to false positives and in doing so, renames the request to 1.msg as an attachment to the response. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf
[Declude.Virus] Declude Beta 3.0.3.8 Available
If you are running the Declude Beta please upgrade to 3.0.3.8 and send feedback to [EMAIL PROTECTED] David B www.declude.com --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] blocking eml and msg attachments
Darin, I'm confused. FireFox, the Web browser is at 1.5.1 beta, but Thunderbird, the E-mail client, is at 1.0.6. I'm also not clear on what you mean regarding speed. I am very happy, and it seems to me that an empty OE or Outlook is much slower to launch, and Thunderbird seems faster when there is a ton of E-mail in a folder. Thunderbird is meant to be a fairly lean application. It is also very stable, at least on my system. I have about 7 E-mail accounts going, and I over 2 GB of E-mail dispersed through them. You might be running into issues with indexing folders following an initial setup? Maybe you could be more specific about the speed issues. Matt Darin Cox wrote: Just loaded it (1.5.1 beta). Seems to be almost identical to OE for the way I use it...except slower. Speed is one of the reasons I use OE instead of Outlook. :( Darin. - Original Message - From: Matt To: Declude.Virus@declude.com Sent: Wednesday, September 14, 2005 3:07 PM Subject: Re: [Declude.Virus] blocking eml and msg attachments Thunderbird just simply works. My only complaint is that the spell checker sucks and has serious problems if you are off by more than one letter. For the type of work that we do, it is definitely a better application. The E-mail is stored in plain text files so you can search it that way, and there's none of that magic stuff that hides important things from you the way that Outlook does. And of course hardly any known vulnerabilities for auto-execution. Matt Darin Cox wrote: Plain text would be my preference as well, to see headers and message at once. Hmmm...may have to try Thunderbird again. It seemed to be missing some features I liked in OE the last time I tried it. I would use Outlook, but it still experiences too many failures in communicating with the TCP/IP stack, and is too slow and bloated for my taste...and preview doesn't seem to work as well as OE. If MS would combine the best features of OE and Outlook, they'd have a better mail client. Darin. - Original Message - From: Matt To: Declude.Virus@declude.com Sent: Wednesday, September 14, 2005 2:46 PM Subject: Re: [Declude.Virus] blocking eml and msg attachments Hmm, works fine in Thunderbird/Netscape, or at least I can see it as plain text. It seems from Pete's MIME headers that he intended for the message to just simply be attached and viewable as the original message. If he changed the extension to .eml that should work. I'm not sure whether or not is is better to see the plain text source or the rendered message. I guess I am used to seeing the plain text and it is easier for me to figure out what the rule matched that way without a Ctrl+U to view the source (shortcut in Thunderbird/Netscape). Matt Darin Cox wrote: Yep... banning 1.msg wouldn't be a good idea unless we can get Pete to change the name of his attachments. I myself would prefer them not to be named .msg (.txt would be _great_) as I can't open them directly in OE that way. I have to save them to disk in order to see which false positive I reported. Darin. - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: Sent: Wednesday, September 14, 2005 2:27 PM Subject: RE: [Declude.Virus] blocking eml and msg attachments My bad. I was not banning eml and msg. I realized that as I was getting AOL feedbacks. What I was banning was 1.msg as there was a virus reported to be using that. Sniffer responds to false positives and in doing so, renames the request to 1.msg as an attachment to the response. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Darin Cox Sent: Wednesday, September 14, 2005 11:01 AM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] blocking eml and msg attachemtns With Declude 1.82, we haven't had any trouble with decoding and blocking viruses or banned attachments in attached .eml or .msg files. We wouldn't block them separately because of all of forwarded messages sent as attachments, both by us, AOL feedback loops, and by our users. Darin. - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: Sent: Wednesday, September 14, 2005 1:32 PM Subject: [Declude.Virus] blocking eml and msg attachemtns What are others thoughts on blocking eml and msg attachments? If there is an eml or msg attachment which that has a executable or virus attachment, will Declude properly decode it and will it be scanned for viruses and banned attachments? John T eServices For You --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be
Re: [Declude.Virus] blocking eml and msg attachments
Just loaded it (1.5.1 beta). Seems to be almost identical to OE for the way I use it...except slower. Speed is one of the reasons I use OE instead of Outlook. :( Darin. - Original Message - From: Matt To: Declude.Virus@declude.com Sent: Wednesday, September 14, 2005 3:07 PM Subject: Re: [Declude.Virus] blocking eml and msg attachments Thunderbird just simply works. My only complaint is that the spell checker sucks and has serious problems if you are off by more than one letter. For the type of work that we do, it is definitely a better application. The E-mail is stored in plain text files so you can search it that way, and there's none of that magic stuff that hides important things from you the way that Outlook does. And of course hardly any known vulnerabilities for auto-execution.MattDarin Cox wrote: Plain text would be my preference as well, to see headers and message at once. Hmmm...may have to try Thunderbird again. It seemed to be missing some features I liked in OE the last time I tried it. I would use Outlook, but it still experiences too many failures in communicating with the TCP/IP stack, and is too slow and bloated for my taste...and preview doesn't seem to work as well as OE. If MS would combine the best features of OE and Outlook, they'd have a better mail client. Darin. - Original Message - From: Matt To: Declude.Virus@declude.com Sent: Wednesday, September 14, 2005 2:46 PM Subject: Re: [Declude.Virus] blocking eml and msg attachments Hmm, works fine in Thunderbird/Netscape, or at least I can see it as plain text.It seems from Pete's MIME headers that he intended for the message to just simply be attached and viewable as the original message. If he changed the extension to .eml that should work. I'm not sure whether or not is is better to see the plain text source or the rendered message. I guess I am used to seeing the plain text and it is easier for me to figure out what the rule matched that way without a Ctrl+U to view the source (shortcut in Thunderbird/Netscape).MattDarin Cox wrote: Yep... banning 1.msg wouldn't be a good idea unless we can get Pete to change the name of his attachments. I myself would prefer them not to be named .msg (.txt would be _great_) as I can't open them directly in OE that way. I have to save them to disk in order to see which false positive I reported. Darin. - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: Sent: Wednesday, September 14, 2005 2:27 PM Subject: RE: [Declude.Virus] blocking eml and msg attachments My bad. I was not banning eml and msg. I realized that as I was getting AOL feedbacks. What I was banning was 1.msg as there was a virus reported to be using that. Sniffer responds to false positives and in doing so, renames the request to 1.msg as an attachment to the response. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Darin Cox Sent: Wednesday, September 14, 2005 11:01 AM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] blocking eml and msg attachemtns With Declude 1.82, we haven't had any trouble with decoding and blocking viruses or banned attachments in attached .eml or .msg files. We wouldn't block them separately because of all of forwarded messages sent as attachments, both by us, AOL feedback loops, and by our users. Darin. - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: Sent: Wednesday, September 14, 2005 1:32 PM Subject: [Declude.Virus] blocking eml and msg attachemtns What are others thoughts on blocking eml and msg attachments? If there is an eml or msg attachment which that has a executable or virus attachment, will Declude properly decode it and will it be scanned for viruses and banned attachments? John T eServices For You --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] blocking eml and msg attachments
Thunderbird just simply works. My only complaint is that the spell checker sucks and has serious problems if you are off by more than one letter. For the type of work that we do, it is definitely a better application. The E-mail is stored in plain text files so you can search it that way, and there's none of that magic stuff that hides important things from you the way that Outlook does. And of course hardly any known vulnerabilities for auto-execution. Matt Darin Cox wrote: Plain text would be my preference as well, to see headers and message at once. Hmmm...may have to try Thunderbird again. It seemed to be missing some features I liked in OE the last time I tried it. I would use Outlook, but it still experiences too many failures in communicating with the TCP/IP stack, and is too slow and bloated for my taste...and preview doesn't seem to work as well as OE. If MS would combine the best features of OE and Outlook, they'd have a better mail client. Darin. - Original Message - From: Matt To: Declude.Virus@declude.com Sent: Wednesday, September 14, 2005 2:46 PM Subject: Re: [Declude.Virus] blocking eml and msg attachments Hmm, works fine in Thunderbird/Netscape, or at least I can see it as plain text. It seems from Pete's MIME headers that he intended for the message to just simply be attached and viewable as the original message. If he changed the extension to .eml that should work. I'm not sure whether or not is is better to see the plain text source or the rendered message. I guess I am used to seeing the plain text and it is easier for me to figure out what the rule matched that way without a Ctrl+U to view the source (shortcut in Thunderbird/Netscape). Matt Darin Cox wrote: Yep... banning 1.msg wouldn't be a good idea unless we can get Pete to change the name of his attachments. I myself would prefer them not to be named .msg (.txt would be _great_) as I can't open them directly in OE that way. I have to save them to disk in order to see which false positive I reported. Darin. - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: Sent: Wednesday, September 14, 2005 2:27 PM Subject: RE: [Declude.Virus] blocking eml and msg attachments My bad. I was not banning eml and msg. I realized that as I was getting AOL feedbacks. What I was banning was 1.msg as there was a virus reported to be using that. Sniffer responds to false positives and in doing so, renames the request to 1.msg as an attachment to the response. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Darin Cox Sent: Wednesday, September 14, 2005 11:01 AM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] blocking eml and msg attachemtns With Declude 1.82, we haven't had any trouble with decoding and blocking viruses or banned attachments in attached .eml or .msg files. We wouldn't block them separately because of all of forwarded messages sent as attachments, both by us, AOL feedback loops, and by our users. Darin. - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: Sent: Wednesday, September 14, 2005 1:32 PM Subject: [Declude.Virus] blocking eml and msg attachemtns What are others thoughts on blocking eml and msg attachments? If there is an eml or msg attachment which that has a executable or virus attachment, will Declude properly decode it and will it be scanned for viruses and banned attachments? John T eServices For You --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] blocking eml and msg attachemtns
Also, any emails that are mime/base64 encoded should be mime decoded by the AV scanner. I know mcafee has that option which we enable. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Darin Cox writes: With Declude 1.82, we haven't had any trouble with decoding and blocking viruses or banned attachments in attached .eml or .msg files. We wouldn't block them separately because of all of forwarded messages sent as attachments, both by us, AOL feedback loops, and by our users. Darin. - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: Sent: Wednesday, September 14, 2005 1:32 PM Subject: [Declude.Virus] blocking eml and msg attachemtns What are others thoughts on blocking eml and msg attachments? If there is an eml or msg attachment which that has a executable or virus attachment, will Declude properly decode it and will it be scanned for viruses and banned attachments? John T eServices For You --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] blocking eml and msg attachments
Plain text would be my preference as well, to see headers and message at once. Hmmm...may have to try Thunderbird again. It seemed to be missing some features I liked in OE the last time I tried it. I would use Outlook, but it still experiences too many failures in communicating with the TCP/IP stack, and is too slow and bloated for my taste...and preview doesn't seem to work as well as OE. If MS would combine the best features of OE and Outlook, they'd have a better mail client. Darin. - Original Message - From: Matt To: Declude.Virus@declude.com Sent: Wednesday, September 14, 2005 2:46 PM Subject: Re: [Declude.Virus] blocking eml and msg attachments Hmm, works fine in Thunderbird/Netscape, or at least I can see it as plain text.It seems from Pete's MIME headers that he intended for the message to just simply be attached and viewable as the original message. If he changed the extension to .eml that should work. I'm not sure whether or not is is better to see the plain text source or the rendered message. I guess I am used to seeing the plain text and it is easier for me to figure out what the rule matched that way without a Ctrl+U to view the source (shortcut in Thunderbird/Netscape).MattDarin Cox wrote: Yep... banning 1.msg wouldn't be a good idea unless we can get Pete to change the name of his attachments. I myself would prefer them not to be named .msg (.txt would be _great_) as I can't open them directly in OE that way. I have to save them to disk in order to see which false positive I reported. Darin. - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: Sent: Wednesday, September 14, 2005 2:27 PM Subject: RE: [Declude.Virus] blocking eml and msg attachments My bad. I was not banning eml and msg. I realized that as I was getting AOL feedbacks. What I was banning was 1.msg as there was a virus reported to be using that. Sniffer responds to false positives and in doing so, renames the request to 1.msg as an attachment to the response. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Darin Cox Sent: Wednesday, September 14, 2005 11:01 AM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] blocking eml and msg attachemtns With Declude 1.82, we haven't had any trouble with decoding and blocking viruses or banned attachments in attached .eml or .msg files. We wouldn't block them separately because of all of forwarded messages sent as attachments, both by us, AOL feedback loops, and by our users. Darin. - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: Sent: Wednesday, September 14, 2005 1:32 PM Subject: [Declude.Virus] blocking eml and msg attachemtns What are others thoughts on blocking eml and msg attachments? If there is an eml or msg attachment which that has a executable or virus attachment, will Declude properly decode it and will it be scanned for viruses and banned attachments? John T eServices For You --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] blocking eml and msg attachments
Hmm, works fine in Thunderbird/Netscape, or at least I can see it as plain text. It seems from Pete's MIME headers that he intended for the message to just simply be attached and viewable as the original message. If he changed the extension to .eml that should work. I'm not sure whether or not is is better to see the plain text source or the rendered message. I guess I am used to seeing the plain text and it is easier for me to figure out what the rule matched that way without a Ctrl+U to view the source (shortcut in Thunderbird/Netscape). Matt Darin Cox wrote: Yep... banning 1.msg wouldn't be a good idea unless we can get Pete to change the name of his attachments. I myself would prefer them not to be named .msg (.txt would be _great_) as I can't open them directly in OE that way. I have to save them to disk in order to see which false positive I reported. Darin. - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: Sent: Wednesday, September 14, 2005 2:27 PM Subject: RE: [Declude.Virus] blocking eml and msg attachments My bad. I was not banning eml and msg. I realized that as I was getting AOL feedbacks. What I was banning was 1.msg as there was a virus reported to be using that. Sniffer responds to false positives and in doing so, renames the request to 1.msg as an attachment to the response. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Darin Cox Sent: Wednesday, September 14, 2005 11:01 AM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] blocking eml and msg attachemtns With Declude 1.82, we haven't had any trouble with decoding and blocking viruses or banned attachments in attached .eml or .msg files. We wouldn't block them separately because of all of forwarded messages sent as attachments, both by us, AOL feedback loops, and by our users. Darin. - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: Sent: Wednesday, September 14, 2005 1:32 PM Subject: [Declude.Virus] blocking eml and msg attachemtns What are others thoughts on blocking eml and msg attachments? If there is an eml or msg attachment which that has a executable or virus attachment, will Declude properly decode it and will it be scanned for viruses and banned attachments? John T eServices For You --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] blocking eml and msg attachemtns
Declude can handle normally nestled attachments. I know of one bug however where there was a malformed virus that E-mail clients understood, but Declude apparently didn't decode properly. The issue was that the base64 encoding was longer than the normal size. It wasn't an issue except for backscatter as it was only spread as an EXE so it was bounced but not detected. It could have been something else that people don't block-on-sight and caused many more problems. That virus looked like the following, but with the end of the attachment clipped off and absent any line breaks that this E-mail will insert. Note to Declude: I haven't yet reported this yet, and I also have other bugs to report, but it has seemed like a bad time to report such things for the last few months. Let me know when you are ready. Received: from mx2.mailpure.com [12.152.254.47] by mail.mailpure.com with ESMTP (SMTPD32-8.15) id A0674292006C; Thu, 19 May 2005 00:04:55 -0400 Received: from 127.0.0.1 ([24.17.226.231]) by mx2.mailpure.com with Microsoft SMTPSVC(5.0.2195.6713); Thu, 19 May 2005 00:04:50 -0400 SUBJECT: urgent FROM: [EMAIL PROTECTED] TO: [EMAIL PROTECTED] DATE: [[ Wed, 18 May 2005 9:04:52 PM ]] MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="bound--" Return-Path: [EMAIL PROTECTED] Message-ID: <[EMAIL PROTECTED]> X-OriginalArrivalTime: 19 May 2005 04:04:51.0151 (UTC) FILETIME=[E7BFBDF0:01C55C27] X-MailPure: X-MailPure: Spam Score: 0 X-MailPure: Scan Time: 19 May 2005 at 00:05:15 EST X-MailPure: Spool File: D10664292006C2AC4.SMD X-MailPure: Server Name: X-MailPure: SMTP Sender: [EMAIL PROTECTED] X-MailPure: Received From: c-24-17-226-231.hsd1.wa.comcast.net [24.17.226.231] X-MailPure: Country Chain: X-MailPure: X-MailPure: Spam and virus blocking services provided by MailPure.com X-MailPure: --bound-- Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Hi Sorry, I forgot to send an important document to you in that last email. I had an important phone call. Please checkout attached doc file when you have a moment. Best Regards --bound-- Content-Type: application/x-msdownload; name="docs.doc .exe" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="docs.doc .exe" TVqQAAME//8AALgAQAAA4A4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJABGXurlAj+EtgI/hLYCP4S2gSOKthI/hLZtII+2BD+Etm0gjrY/P4S2gTfZtgU/hLYCP4W2Pj+EtgQckrYAP4S2xTmCtgM/hLZSaWNoAj+EtgBQRQAATAEDAObVd0EAAOAADwELAQYAAGACAAAQkAAAoPECAACgAAMAAABQAgAABAAEAAAQAwAAEAIAABAAABAAEAAAEBAAAKQDAwDgAAADAKQDAFVQWDAAAJAQAAQAAIAAAOBVUFgxAABgAgAAoFQCAAAEAABAAADgLnJzcmMAEAADAAAGWAIAQAAAw AAAMS4yNQBVUFghDAkCCq/DZRXqhlUzL9UCAJlRAgAAwAIAJgUAB/+9+f9Vi+xq/2jgbUAAZKEAUGSJJQdRgeygBLX//S9TVleJZfDHRfwTagCLRQhQBfwuWPcBaA+ABgTPAGiMr0K93969yIJCHP8V3HBQiUXoaIA2rpntkwGLTehRG+AyXIO82f6Nlej7//9SEQS/vIJCg/9g///J/zPA8q730Sv5i/eL2Yv6EIPH/4vLwen/+f7tAvOlBoPhA/OkaLgzhVDoBQAFedvt2/2DxAiJheQOi40FUWbcAXcBe1527WhAgGAgBE8Qi5VSDmCz2bID+QSJQ4n5OUHIrCYARFxC3Vv5CLkgAF2NvVgV89iXdIerO5hYiz1ImWy7QchYXQLsilA5M1vsBQtU9o1s5oTtUYdUhwAe4NO9Efaoz+k4WPt/drIZRezLi0IMg+AQhcB1M/aHba0F8QGw3OYRhGdse/UsUBaNUQxhLyQ8670OJwvxbG2McZx4BJCI2zdjg2XUr9jrBrjPEgzDsWHYHKkM/wlq9I7zv7vJDQAAX15bi+VdwhAAzO9mmo3/g+wcahyNReRQjgQIsdFt7u10BW/o6wI4K8MkUX/ht9/5i30MD699sF0Ii8+FN338iU0Iddz+77YHIumV3ot1FGb3Rgw MAXQdRhjY8m8vARTrDHwUABAAAOsDCBv3/90yKgRcIzvIi/lyAov4V/82U9T/7e1/DWwpfQgpfgQBPtwMA99o/OtLO00Uci7+rf3bg31Ci8F0CTPS918IK8JQU/92EJf+zu0xC3YpSTaD+P90NymHA9ht993u6xhWGAqdEVl0KIgDhkP/ebcZfnOKRQgAD4V2CNQQ/7bdLXzJw4NODGEEBSCLx1srPri1/7deDOvlVot0JAhXg88mrKhAtt8vXAKDyEg6qIN0NFgSIx742Uae7QcRvYERCn0lz/sfum0SMRyNC6EQoYNmHABZWDYSDFsGDG09ayDcDIY5PgeL3z23Qa7kBUAHi6OB4U/+hNsIAQh0KTsiO9iL+3UIPwgTCj49OivfAX0Ib7P28utGO11GhcmOtzRZdXmz/eQPSXQNi8P7K/rrQvtfPpyzzRRLRwEr
Re: [Declude.Virus] blocking eml and msg attachments
Yep... banning 1.msg wouldn't be a good idea unless we can get Pete to change the name of his attachments. I myself would prefer them not to be named .msg (.txt would be _great_) as I can't open them directly in OE that way. I have to save them to disk in order to see which false positive I reported. Darin. - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: Sent: Wednesday, September 14, 2005 2:27 PM Subject: RE: [Declude.Virus] blocking eml and msg attachments My bad. I was not banning eml and msg. I realized that as I was getting AOL feedbacks. What I was banning was 1.msg as there was a virus reported to be using that. Sniffer responds to false positives and in doing so, renames the request to 1.msg as an attachment to the response. John T eServices For You > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > On Behalf Of Darin Cox > Sent: Wednesday, September 14, 2005 11:01 AM > To: Declude.Virus@declude.com > Subject: Re: [Declude.Virus] blocking eml and msg attachemtns > > With Declude 1.82, we haven't had any trouble with decoding and blocking > viruses or banned attachments in attached .eml or .msg files. We wouldn't > block them separately because of all of forwarded messages sent as > attachments, both by us, AOL feedback loops, and by our users. > > Darin. > > > - Original Message - > From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> > To: > Sent: Wednesday, September 14, 2005 1:32 PM > Subject: [Declude.Virus] blocking eml and msg attachemtns > > > What are others thoughts on blocking eml and msg attachments? > > If there is an eml or msg attachment which that has a executable or virus > attachment, will Declude properly decode it and will it be scanned for > viruses and banned attachments? > > John T > eServices For You > > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus".The archives can be found > at http://www.mail-archive.com. > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus".The archives can be found > at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] blocking eml and msg attachments
My bad. I was not banning eml and msg. I realized that as I was getting AOL feedbacks. What I was banning was 1.msg as there was a virus reported to be using that. Sniffer responds to false positives and in doing so, renames the request to 1.msg as an attachment to the response. John T eServices For You > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > On Behalf Of Darin Cox > Sent: Wednesday, September 14, 2005 11:01 AM > To: Declude.Virus@declude.com > Subject: Re: [Declude.Virus] blocking eml and msg attachemtns > > With Declude 1.82, we haven't had any trouble with decoding and blocking > viruses or banned attachments in attached .eml or .msg files. We wouldn't > block them separately because of all of forwarded messages sent as > attachments, both by us, AOL feedback loops, and by our users. > > Darin. > > > - Original Message - > From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> > To: > Sent: Wednesday, September 14, 2005 1:32 PM > Subject: [Declude.Virus] blocking eml and msg attachemtns > > > What are others thoughts on blocking eml and msg attachments? > > If there is an eml or msg attachment which that has a executable or virus > attachment, will Declude properly decode it and will it be scanned for > viruses and banned attachments? > > John T > eServices For You > > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus".The archives can be found > at http://www.mail-archive.com. > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus".The archives can be found > at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] blocking eml and msg attachemtns
With Declude 1.82, we haven't had any trouble with decoding and blocking viruses or banned attachments in attached .eml or .msg files. We wouldn't block them separately because of all of forwarded messages sent as attachments, both by us, AOL feedback loops, and by our users. Darin. - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: Sent: Wednesday, September 14, 2005 1:32 PM Subject: [Declude.Virus] blocking eml and msg attachemtns What are others thoughts on blocking eml and msg attachments? If there is an eml or msg attachment which that has a executable or virus attachment, will Declude properly decode it and will it be scanned for viruses and banned attachments? John T eServices For You --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
[Declude.Virus] blocking eml and msg attachemtns
What are others thoughts on blocking eml and msg attachments? If there is an eml or msg attachment which that has a executable or virus attachment, will Declude properly decode it and will it be scanned for viruses and banned attachments? John T eServices For You --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
