[Declude.Virus] Problems with scanning after moving Imail Sever
I had to move my Imail server to another machine because the primary crashed last week. I'm still cleaning up a number of issues that have surfaced since the move. The main one I'm dealing with now has to do with the Declude Virus Scanning. The .vir directories are not being removed after the emails are scanned and the log file has this error 06/21/2004 10:39:08 Qf2fe09c Could not find parse string Found in report.txt 06/21/2004 10:39:08 Qf2fe09c Error -1073741819 in virus scanner 1. 06/21/2004 10:39:08 Qf2fe09c Scanned: Error in virus scanner. [MIME: 1 10502] 06/21/2004 10:39:22 Qf30c09a Could not find parse string Found in report.txt 06/21/2004 10:39:22 Qf30c09a Error -1073741819 in virus scanner 1. 06/21/2004 10:39:22 Qf30c09a Scanned: Error in virus scanner. [MIME: 1 375] What does it mean? and how can I correct it? Thanks, Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Problems with scanning after moving Imail Sever
This is very strange... I've installed and reinstalled about five times now and can't this to run correctly at all. It use to work just fine on my old mail server. This is Mcafee and I'm running version 4 with service pack 1. Greg R. Scott Perry wrote: That one is due to a crash in your virus scanner -- if you re-install it, it should fix the problem (if you haven't changed the SCANFILE line in your \IMail\Declude\virus.cfg file). If you have changed the SCANFILE line, you should compare it to the one in the manual. If you are still having troubles, you can E-mail the virus.cfg file to our support@ address. One follow-up here -- if this is McAfee, you need to be running the latest .exe from them (the latest virus definitions cause older versions to crash). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] Changing to F-prot good or bad?
I'm just having to many problems with Mcafee right now and can't afford being down any longer. I was considering changing to F-prot... would this be a good or bad idea? What is your experience with F-prot? Is there something better? Thanks, Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Changing to F-prot good or bad?
Changed my SCANFILE to remove the NOFLOPPY and am still getting these errors. 06/21/2004 13:22:02 ERROR: SCANFILE option must not have any spaces in the pathname 06/21/2004 13:22:02 Q1938080 Your virus scanner DOES NOT EXIST (at SCANFILE C:\Progra~1\FSI\F-Prot\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOBOOT /DUMB /REPORT=report.txt C:\IMail\spool\D1938080.vir\); NOT SCANNING ATTACHMENTS! [2] 06/21/2004 13:22:02 Q1938080 Scanned: Error starting scanner 06/21/2004 13:22:46 ERROR: SCANFILE option must not have any spaces in the pathname 06/21/2004 13:22:46 Q1965080 Your virus scanner DOES NOT EXIST (at SCANFILE C:\Progra~1\FSI\F-Prot\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOBOOT /DUMB /REPORT=report.txt C:\IMail\spool\D1965080.vir\); NOT SCANNING ATTACHMENTS! [2] 06/21/2004 13:22:46 Q1965080 Scanned: Error starting scanner 06/21/2004 13:23:07 ERROR: SCANFILE option must not have any spaces in the pathname 06/21/2004 13:23:07 Q197a080 Your virus scanner DOES NOT EXIST (at SCANFILE C:\Progra~1\FSI\F-Prot\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOBOOT /DUMB /REPORT=report.txt C:\IMail\spool\D197a080.vir\); NOT SCANNING ATTACHMENTS! [2] 06/21/2004 13:23:07 Q197a080 Scanned: Error starting scanner 06/21/2004 13:23:43 ERROR: SCANFILE option must not have any spaces in the pathname 06/21/2004 13:23:43 Q199f080 Your virus scanner DOES NOT EXIST (at SCANFILE C:\Progra~1\FSI\F-Prot\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOBOOT /DUMB /REPORT=report.txt C:\IMail\spool\D199f080.vir\); NOT SCANNING ATTACHMENTS! [2] 06/21/2004 13:23:43 Q199f080 Scanned: Error starting scanner 06/21/2004 13:24:33 ERROR: SCANFILE option must not have any spaces in the pathname 06/21/2004 13:24:33 Q19d1080 Scanned: Virus Free [Prescan OK][MIME: 2 5650] 06/21/2004 13:25:17 ERROR: SCANFILE option must not have any spaces in the pathname 06/21/2004 13:25:17 Q19f9094 Scanned: Virus Free [MIME: 1 699] 06/21/2004 13:25:49 ERROR: SCANFILE option must not have any spaces in the pathname 06/21/2004 13:25:49 Q1a1b094 Scanned: Virus Free [MIME: 0 620] 06/21/2004 13:25:51 ERROR: SCANFILE option must not have any spaces in the pathname 06/21/2004 13:25:51 Q1a1d080 Your virus scanner DOES NOT EXIST (at SCANFILE C:\Progra~1\FSI\F-Prot\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOBOOT /DUMB /REPORT=report.txt C:\IMail\spool\D1a1d080.vir\); NOT SCANNING ATTACHMENTS! [2] 06/21/2004 13:25:51 Q1a1d080 Scanned: Error starting scanner 06/21/2004 13:26:41 ERROR: SCANFILE option must not have any spaces in the pathname 06/21/2004 13:26:41 Q1a50080 Scanned: Virus Free [Prescan OK][MIME: 1 712] 06/21/2004 13:27:16 ERROR: SCANFILE option must not have any spaces in the pathname 06/21/2004 13:27:16 Q1a74094 WARNING: F-Stop is running, please disable it (you may need to reinstall F-Prot and disable the Realtime Protector to disable it), or it will interfere with Declude. 06/21/2004 13:27:16 Q1a74094 Scanned: Virus Free [Prescan OK][MIME: 1 4387] Mike Hyslip wrote: Might want to remove the /NOFLOPPY from that one, I think that was one that messed this command line version up. Here's my scan line SCANFILED:\PROGRA~1\F-prot\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOBOOT /DUMB /REPORT=report.txt VIRUSCODE 3 VIRUSCODE 6 REPORT Infection: -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Greg Foulks Sent: Monday, June 21, 2004 1:07 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Changing to F-prot good or bad? I've used the config options in the virus.cfg file when trying to configure F-prot with Declude and continue to get this error in the log 06/21/2004 13:04:43 ERROR: SCANFILE option must not have any spaces in the pathname 06/21/2004 13:04:43 Q152b090 Your virus scanner DOES NOT EXIST (at SCANFILE C:\Progra~1\FSI\F-Prot\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt C:\IMail\spool\D152b090.vir\); NOT SCANNING ATTACHMENTS! [2] 06/21/2004 13:04:43 Q152b090 Scanned: Error starting scanner I copied the SCANFILE directly from the manual... Anyone know what is causing this error? Greg Greg Foulks wrote: I'm just having to many problems with Mcafee right now and can't afford being down any longer. I was considering changing to F-prot... would this be a good or bad idea? What is your experience with F-prot? Is there something better? Thanks, Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found
Re: [Declude.Virus] Changing to F-prot good or bad?
I'm so stupid thanks Scott! Even though you were telling me I just wasn't seeing the extra SCANFILE in my config file. I'm so sorry. Okay any truth that I should include /ARCHIVE=3 /SERVER to my parameters and what about VIRUSCODE 8? R. Scott Perry wrote: Changed my SCANFILE to remove the NOFLOPPY and am still getting these errors. 06/21/2004 13:22:02 Q1938080 Your virus scanner DOES NOT EXIST (at SCANFILE C:\Progra~1\FSI\F-Prot\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOBOOT /DUMB /REPORT=report.txt C:\IMail\spool\D1938080.vir\); NOT SCANNING ATTACHMENTS! [2] You need to change your SCANFILE line from: SCANFILE SCANFILE C:\Progra~1\FSI\F-Prot\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOBOOT /DUMB /REPORT=report.txt to: SCANFILE C:\Progra~1\FSI\F-Prot\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOBOOT /DUMB /REPORT=report.txt -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] FW: Your mail server sent us a virus
I think public humiliation is a good thing ;-) Greg R. Scott Perry wrote: Here's another, do you want these off list? Yes, off-list would be best (unless others on the list would like to see them -- if so, speak up). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] W32_Webb_Worm Policy - Is this a new hoax
I already did ;-) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Kami Razvan Sent: Tuesday, October 07, 2003 11:55 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] W32_Webb_Worm Policy - Is this a new hoax Does anyone know if Symantec actually uses this email: [EMAIL PROTECTED] Perhaps we should block that email at Imail level for now until the patches catch up. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of William Baumbach Sent: Tuesday, October 07, 2003 11:41 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] W32_Webb_Worm Policy - Is this a new hoax I received one today. the email had NAV32.zip and in the zip file was NAV32.exe it was NOT detected as a virus by EITHER F-Prot or AVG it was however cought as spam by CBL, FIVETEN-SPAM, SPAMCOP the header of the email was Received: from c-67-164-195-92.client.comcast.net [67.164.195.92] by phcc.org (SMTPD32-8.03) id AE4F17E00F8; Tue, 07 Oct 2003 07:06:55 -0400 Message-ID: [EMAIL PROTECTED] Date: Tue, 7 Oct 2003 04:10:24 -0700 From: [EMAIL PROTECTED] Subject: ** 22. CBL, FIVETEN-SPAM, SPAMCOP, WEIGHT-F, WEIGHT20, WEIGHT202 ** Last Update. To: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: multipart/mixed; boundary=--9D16FAF1684605E X-RBL-Warning: CBL: Blocked - see http://cbl.abuseat.org/lookup.cgi?ip=67.164.195.92 X-RBL-Warning: FIVETEN-SPAM: 92.195.164.67.blackholes.five-ten-sg.com. X-RBL-Warning: SPAMCOP: Blocked - see http://www.spamcop.net/bl.shtml?67.164.195.92 X-Declude-Sender: [EMAIL PROTECTED] [67.164.195.92] X-Declude-Spoolname: D9e4f017e00f890ba.SMD X-In-Date: 10/07/2003 Time: 07:07:23 -0500 ET. X-Country-Chain: UNITED STATES-destination X-In-Note: This E-mail was comming into phcc.org Declude ver.1.76i5. X-In-Spam-Tests-Failed: CBL, FIVETEN-SPAM, SPAMCOP, WEIGHT-F, WEIGHT20, WEIGHT202 Total Weight= 22 x-In-Organization: DcMetroNet.com is the ISP for phcc.org X-In-Abuse: Please send abuse reports to [EMAIL PROTECTED] X-In-Note: This E-mail was sent from ([EMAIL PROTECTED]) c-67-164-195-92.client.comcast.net ([67.164.195.92]). X-In-Recips: [EMAIL PROTECTED] really [EMAIL PROTECTED] X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 349908174 Sincerely, William J. Baumbach II [EMAIL PROTECTED] 9975 Pennsylvania Ave. Manassas, Va. 20110-2028 Ph: 703-367-7900 ext:1708 Fax: 703-691-0946 - - Original Message - From: Bill Naber [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, October 07, 2003 7:55 AM Subject: [Declude.Virus] W32_Webb_Worm Policy - Is this a new hoax I just received an Email from [EMAIL PROTECTED] with the subject Last Update.. The message warns of the [EMAIL PROTECTED] worm, but a search on the Symantec site shows nothing of the kind. The message has a Nav32.zip attachment that doesn't fail on either F-Prot or NAV. The message appears to have originated via an ameritech.net dsl connection and it has some grammatical errors, so I'm not doubting that it is bogus. I've only received one of these messages, but I am curious if I'm on the leading edge or if this is a very random incident. In the short run, I've put in a filter on messages from [EMAIL PROTECTED], but I'm concerned that it will use other return addresses. I've included the text from the message body and the headers below. Thanks, -Bill Naber Kitchin Hospitality, LLC === Message Body October 06, 2003 Intruder Alert 4.1 W32_Webb_Worm Policy This policy detects the propagation of the W32.SobigF.Worm through changes in the registry. [EMAIL PROTECTED] is a mass-mailing, network-aware worm that sends itself to all the email addresses it finds in various files. The worm uses its own SMTP engine to propagate and attempts to create a copy of itself on accessible network shares, but fails due to bugs in the code. In attachment you can find program that update your Norton Antivirus to Norton Antivirus 2004. Message Header == Received: from horace.mail.atl.earthlink.net [207.69.200.41] by mail.jamesoninns.com with ESMTP (SMTPD32-7.15) id A328716014C; Tue, 07 Oct 2003 07:27:36 -0400 Received: from samuel.mail.atl.earthlink.net ([207.69.200.65]) by horace.mail.atl.earthlink.net with smtp (Exim 3.33 #1) id 1A6q0J-0005vx-00 for [EMAIL PROTECTED]; Tue, 07 Oct 2003 07:27:47 -0400 X-MindSpring-Loop: [EMAIL PROTECTED] Received: from adsl-68-77-24-119.dsl.emhril.ameritech.net ([68.77.24.119]) by samuel.mail.atl.earthlink.net (Earthlink Mail Service) with SMTP id 1a6Q0f2aB3Nl3pv0 for [EMAIL PROTECTED]; Tue, 7 Oct 2003 07:27:42 -0400 (EDT) Message-ID: [EMAIL PROTECTED] Date: Tue, 7 Oct 2003 04:32:14 -0700 From: [EMAIL PROTECTED] Subject: Last Update. To: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: multipart/mixed;
RE: [Declude.Virus] W32_Webb_Worm Policy - Is this a new hoax
How do you ban a file by name? The manual only shows how to ban by extension. Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Russ Uhte (Lists) Sent: Tuesday, October 07, 2003 12:00 PM To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: Re: [Declude.Virus] W32_Webb_Worm Policy - Is this a new hoax At 10:40 AM 10/7/2003, William Baumbach wrote: I received one today. the email had NAV32.zip and in the zip file was NAV32.exe it was NOT detected as a virus by EITHER F-Prot or AVG I can't believe this wouldn't be caught... gez... Looks like Declude to the rescue... BANNAME NAV32.zip. As a side note, the first one I detected was at 6:30 EST and McAfee did detect it. -Russ --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] F-Prot vs Other brands
With the problems I've seen with F-Prot like the one mentioned below. Why did you F-Prot users choose F-Prot over other brands like McAfee? Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Chad Killion Sent: Thursday, October 02, 2003 11:03 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] MS Security Patch Emails Well, I have upgraded to 3.14, but still see TONS of these viruses getting through. Please help if you can... Chad -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] MS Security Patch Emails
If you don't start to block these dangerous extensions it's just going to continue to cause you problems in the future. My users where not happy at first but after I explained why they were all more than happy to help fight the spread of viruses. Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jason Newland Sent: Thursday, October 02, 2003 12:00 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] MS Security Patch Emails I would suggest a notification to users telling them that as of X date, the e-mail system will no longer accept/transmit e-mails that have .exe/.bat/or whatever extentions attached. Then give them a breif, and honest explanation of the risks that it poses them and you. You can even include information on how to continue to send these files, but in a faster way (zip) Keeping up front and honest with your customers will always result in better satisfaction. You are perceived as looking out for them. Jason - Original Message - From: Chad Killion [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 02, 2003 10:36 AM Subject: RE: [Declude.Virus] MS Security Patch Emails We have never filtered EXE before, so it would just cause too many problems to do this now. We have well over 25 thousand customers using this server, and I hate to spring something like that on them. The others, sure, we can exclude those, but just don't want to do EXE. Thanks. Chad -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell LaRock Sent: Thursday, October 02, 2003 10:14 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] MS Security Patch Emails Chad, Is there any reason why you can't filter on common virus extensions. This will cutdown on many viruses. It is common practice not to accept exe, com, bat, pif, scr, and the list goes on... Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chad Killion Sent: Thursday, October 02, 2003 11:03 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] MS Security Patch Emails Well, I have upgraded to 3.14, but still see TONS of these viruses getting through. Please help if you can... Chad -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sheldon Koehler Sent: Wednesday, October 01, 2003 5:38 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] MS Security Patch Emails No wonder I'm still getting slammed with systems trying to send this virus to my users. This was a big thread back in July. F-Prot was only catching the Blaster worm if it tried to run (Desktop Real Time). But it was not detected in the scanning of email even after the definition file updates. F-Prot released 3.14a to fix this in the actual engine. I was blocking it by banned file extensions! So this was another valid reason to block certain extensions. Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! Whenever you find yourself on the side of the majority, it's time to pause and reflect. Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com]
[Declude.Virus] How to stop the zip of death
Does anyone have a solution for stopping the zip of death? I've been running some DOS attacks on different network points of mine trying to find weak spots when I found this problem 11036 Denial of Service: SMTP antivirus scanner DoS Description smtp (25/tcp) For some reason, we could not send the 42.zip file to this MTA BID : 3027 This script sends the 42.zip recursive archive to the mail server. If there is an antivirus filter, it may start eating huge amounts of CPU or memory. 42.zip: ZIP archive, 42K, composed of nested zips (nested 6 levels deep, each level 17 wide) - produces a file 4GB in size and will reportedly crash 'most email virus checkers'. Solution: Reconfigure your antivirus / upgrade it Risk factor : High Greg attachment: winmail.dat
[Declude.Virus] Usage 1.2
For those that are using the Usage 1.2 tool have any of you seen this error? C:\IMail\Decludeusage.cmd Mail destination: [EMAIL PROTECTED] Invalid number. Numeric constants are either decimal (17), hexadecimal (0x11), or octal (021). 9 was unexpected at this time. what does this mean? It was working fine up till a couple days ago. Thanks, Greg attachment: winmail.dat
RE: [Declude.Virus] Blue Screen on Imail with Declude Virus and Declude Junkmail and Declude Junkmail
I hate to hijack the thread but... Why run so many scanners? We only run one scanner and have never had a problem... Are we missing something by not running more than one? Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Monday, September 08, 2003 1:16 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Blue Screen on Imail with Declude Virus and Declude Junkmail and Declude Junkmail hopefully someone can give us some insight to a problem related to BSOD we have been encountering on our Imail server I'm guessing that it is one of the 3 virus scanners. AV programs often access memory and hard drives at a low level, and are a bit more prone to issues like this than most applications. What I would do is remove one at a time, to see if removing one of them fixes the problem. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Sobig, the next wave?
I'll buy that virus! Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of John Tolmachoff (Lists) Sent: Tuesday, August 26, 2003 4:57 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Sobig, the next wave? Ok, this calls for a white hat virus creator. A virus that will infect all these unpatched computers, and the only thing it does is create a big bold red popup every 15 minutes that says Patch your computer, you dummy. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.Virus- [EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Tuesday, August 26, 2003 1:44 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Sobig, the next wave? People a typically unaware that their machine is infected - because it continues to function perfectly. That is very true. We infected a computer in our virus lab with Sobig.F, and you couldn't tell anything unusual was happening. The file didn't seem to do anything when it was run (so the recipient probably figures that the attachment didn't get downloaded or something like that, and probably won't even say Yes, I ran the program when asked by an admin), and the only noticeable differences on the system were a couple extra registry entries and system files (files in the \Winnt directory and \Winnt\system32 directory), and a program running in Task Manager (something like winsst32.exe that doesn't look unusual). People who are infected probably would have a somewhat slower Internet connection, but that's probably about all they would notice. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] On Access Question
So I disabled the On-Access scanner and I still get the error when an email is found with a virus 08/21/2003 16:03:46 Q2584064 ERROR: Virus scanner didn't finish after 30 seconds; terminating. 08/21/2003 16:04:03 Q2584064 Couldn't delete C:\IMail\spool\D2584064.vir\0: 32. 08/21/2003 16:04:03 Q2584064 WARNING: Couldn't remove .vir directory C:\IMail\spool\D2584064.vir\: SHARING VIOLATION. 08/21/2003 16:04:03 Q2584064 Likely problem: An on-access scanner is interfering; disable or set not to scan subdirectories off of \IMail\spool. 08/21/2003 16:04:03 Q2584064 Scanned: Virus Free [MIME: 2 1128] Notice the last line of this message. The file went from being infected to Virus Free - how? Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Darrell LaRock Sent: Wednesday, August 20, 2003 2:48 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] On Access Question Question is do you still get the error if you disable on-access scan? That's one way to rule it out Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, August 20, 2003 2:42 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] On Access Question I'm 99.% sure that McAfee is not scanning that directory. If I open the On Access scanner and watch it as I open a file in that directory it does not show the file being opened. Could the permissions on the directory be wrong? If so-- what should it be set to? It isn't a permissions issue. It is definitely a sharing violation. It means that some program besides Declude is accessing the directory, which won't normally happen (how else will a program know that the directory is there? Not even IMail knows). So it would have to be a program that either knows as soon as files are written to the hard drive (as in the case with the virus scanner), or that looks at all the files on the hard drive (such as a backup program). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] On Access Question
I just upgraded to the latest version let's see if that fixes the problems. Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Greg Foulks Sent: Thursday, August 21, 2003 4:09 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] On Access Question So I disabled the On-Access scanner and I still get the error when an email is found with a virus 08/21/2003 16:03:46 Q2584064 ERROR: Virus scanner didn't finish after 30 seconds; terminating. 08/21/2003 16:04:03 Q2584064 Couldn't delete C:\IMail\spool\D2584064.vir\0: 32. 08/21/2003 16:04:03 Q2584064 WARNING: Couldn't remove .vir directory C:\IMail\spool\D2584064.vir\: SHARING VIOLATION. 08/21/2003 16:04:03 Q2584064 Likely problem: An on-access scanner is interfering; disable or set not to scan subdirectories off of \IMail\spool. 08/21/2003 16:04:03 Q2584064 Scanned: Virus Free [MIME: 2 1128] Notice the last line of this message. The file went from being infected to Virus Free - how? Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Darrell LaRock Sent: Wednesday, August 20, 2003 2:48 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] On Access Question Question is do you still get the error if you disable on-access scan? That's one way to rule it out Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, August 20, 2003 2:42 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] On Access Question I'm 99.% sure that McAfee is not scanning that directory. If I open the On Access scanner and watch it as I open a file in that directory it does not show the file being opened. Could the permissions on the directory be wrong? If so-- what should it be set to? It isn't a permissions issue. It is definitely a sharing violation. It means that some program besides Declude is accessing the directory, which won't normally happen (how else will a program know that the directory is there? Not even IMail knows). So it would have to be a program that either knows as soon as files are written to the hard drive (as in the case with the virus scanner), or that looks at all the files on the hard drive (such as a backup program). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. - [This E-mail was scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] New interim release of Declude Virus to block Mimail's message.zip
Thanks Scott! I understand about the archive but if it was critical I thought I would have received a response from the list faster than it would have been for me to look it up. Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Tuesday, August 05, 2003 2:35 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] New interim release of Declude Virus to block Mimail's message.zip I must have missed something? What is going on... can anyone forward to me a summery email? That's what the archives are for. :) A new virus, Mimail, was released a few days ago and spread very fast. F-Prot did not detect it. Earlier today, we came out with an interim release of Declude Virus that lets you block attachments based on the file name (so you could block message.zip). Shortly thereafter, F-Prot announced that they have a new version of F-Prot that combined with the latest virus definitions will catch Mimail. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] [OT]: BugBear
No but man did we get hit with Sobig last night! Thank you Declude and Mcafee! You make my network admin life easy! Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jeff Maze - Hostmaster Sent: Thursday, June 05, 2003 9:40 AM To: [EMAIL PROTECTED] Subject: [Declude.Virus] [OT]: BugBear Anyone notice a rise in Bugbear lately? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: Re: [Declude.Virus] New virus: W95/CIH-1106 New variant of Chernobyl
Here is the list of Banned Extension that I use T BANEXT REG BANEXT LNK BANEXT CMD BANEXT CPL BANEXT JS BANEXT JSE BANEXT MSI BANEXT MSP BANEXT PCD BANEXT SCT BANEXT SHB BANEXT SHS BANEXT VB BANEXT VBE BANEXT WSC BANEXT WSF BANEXT WSH BANEXT CEO BANEXT OCX BANEXT NWS BANEXT VBX BANEXT DLL BANEXT CAB BANEXT XML BANEXT LNK BANEXT SYS BANEXT ASP BANEXT ASD BANEXT SWF BANEXT CHM Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Paul Ingram Sent: Tuesday, December 03, 2002 4:07 PM To: [EMAIL PROTECTED] Subject: H:Re: [Declude.Virus] New virus: W95/CIH-1106 New variant of Chernobyl Hello, Tuesday, December 3, 2002, 3:56:58 PM, you wrote: Kris What is extensions is everyone blocking in general? I am blocking scr, pif, Kris ceo ? Should I be blocking any thing else? This is what I am using. .pif.nws.dll.cmd.xml.sys.asd.chm .ocx.vbe.wsf.com.exe.vbs.scr.shs .wsh.vbx.bat.cab.lnk.asp.swf.js .ceo -- Best regards, ~Paul~mailto:[EMAIL PROTECTED] --- [This E-mail scanned for viruses by Declude Virus/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] Blank E-mail's - As anyone seen this?
I've been getting a number of blank emails (No Header, Subject, Sender or Body) I've double scanned all of our systems and they all come up clean (No viruses found). As anyone else seen this and what could I do to block these emails from getting to myself and my users? Thanks, Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] virus config file changes
If I make a change to the virus.cfg file do I need to restart anything? Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] virus config file changes
Thanks Scott.. I couldn't remember if I needed to do anything or not. Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Monday, September 30, 2002 2:04 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] virus config file changes If I make a change to the virus.cfg file do I need to restart anything? No, you do not. Declude Virus will detect the changes on-the-fly. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
