RE: [Declude.Virus] Where to send exe's to check if they are a virus?
Hi Kami, (Nice to read you) > As suggested the best path at the moment could be: > BANZIPEXTSON Yes this is necessary and unfortunately we can't still choose to block only certain extensions within zip-files from all the extensions we block as direct attachment. Something like BANZIPEXT exe would be a very usefull feature, because with the current list of recommendet BANEXT's and BANZIPEXTS ON no users can send or recieve legit packed file attachments like application updates. And again most AV-engines has showed that they are not more fast enough :-/ Markus --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Where to send exe's to check if they are a virus?
Hi Markus: I just updated F-Prot and scanned the one I received called "Katherine.zip". It shows it as Suspicious file. McAfee is not detecting it. As suggested the best path at the moment could be: BANZIPEXTS ON We have: - Grisoft AVG - F-Prot - Clam AV - McAfee Only F-Prot with the latest update shows it as suspicious. Regards, - Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Thursday, December 15, 2005 10:55 AM To: Declude.Virus@declude.com Subject: RE: [Declude.Virus] Where to send exe's to check if they are a virus? > Some of the small AV companies are reporting it as a Bagle variant and > F-Prot is reporting it as MitGlieder.GU although it is not catching it > on the server. Even if I can't explain why it is not catching it I can confirm this. F-Prot on virustotal is catching it. On my server with newest definitions it's not blocking it as a virus. Mcafee at the moment seems not catching it with newest signatures. Markus --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Where to send exe's to check if they are a virus?
Hmmm, maybe try switching that from "totalvirus" to "virustotal". Bill - Original Message - From: "Goran Jovanovic" <[EMAIL PROTECTED]> To: Sent: Thursday, December 15, 2005 7:53 AM Subject: RE: [Declude.Virus] Where to send exe's to check if they are a virus? I tried www.totalvirus.com and it is an ad site. Thank you Goran Jovanovic Omega Network Solutions -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.Virus- [EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Thursday, December 15, 2005 10:45 AM To: Declude.Virus@declude.com Subject: RE: [Declude.Virus] Where to send exe's to check if they are a virus? www.virustotal.com (se me previous posting for results) At the moment i consider blocking at least temporaly eye in zips and update the virus definitions Markus > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Goran Jovanovic > Sent: Thursday, December 15, 2005 4:26 PM > To: Declude.Virus@declude.com > Subject: [Declude.Virus] Where to send exe's to check if they > are a virus? > > Hi, > > I am getting a bunch of exe in zip files being banned right > now. I have grabbed one of them it is called marie.zip and > has a single exe in it called s3700020.exe and when you put > it on your desktop is has the standard jpeg icon associated with it. > > My F-Prot, McAfee and Symantec scanners are not finding a > virus. Where is the place that you can send it to and have it > checked out by a ton of virus scanners? > > Thanx > > Goran Jovanovic > Omega Network Solutions > --- > [This E-mail was scanned for viruses by Declude EVA www.declude.com] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus".The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Where to send exe's to check if they are a virus?
Uh, keyboard virus? ;) John T eServices For You > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > On Behalf Of Goran Jovanovic > Sent: Thursday, December 15, 2005 7:53 AM > To: Declude.Virus@declude.com > Subject: RE: [Declude.Virus] Where to send exe's to check if they are a virus? > > I tried www.totalvirus.com and it is an ad site. > > Thank you > > Goran Jovanovic > Omega Network Solutions > > > > > -Original Message- > > From: [EMAIL PROTECTED] [mailto:Declude.Virus- > > [EMAIL PROTECTED] On Behalf Of Markus Gufler > > Sent: Thursday, December 15, 2005 10:45 AM > > To: Declude.Virus@declude.com > > Subject: RE: [Declude.Virus] Where to send exe's to check if they are > a > > virus? > > > > www.virustotal.com (se me previous posting for results) > > > > At the moment i consider blocking at least temporaly eye in zips and > > update > > the virus definitions > > > > Markus > > > > > > > > > -Original Message- > > > From: [EMAIL PROTECTED] > > > [mailto:[EMAIL PROTECTED] On Behalf Of Goran > Jovanovic > > > Sent: Thursday, December 15, 2005 4:26 PM > > > To: Declude.Virus@declude.com > > > Subject: [Declude.Virus] Where to send exe's to check if they > > > are a virus? > > > > > > Hi, > > > > > > I am getting a bunch of exe in zip files being banned right > > > now. I have grabbed one of them it is called marie.zip and > > > has a single exe in it called s3700020.exe and when you put > > > it on your desktop is has the standard jpeg icon associated with it. > > > > > > My F-Prot, McAfee and Symantec scanners are not finding a > > > virus. Where is the place that you can send it to and have it > > > checked out by a ton of virus scanners? > > > > > > Thanx > > > > > > Goran Jovanovic > > > Omega Network Solutions > > > --- > > > [This E-mail was scanned for viruses by Declude EVA www.declude.com] > > > > > > --- > > > This E-mail came from the Declude.Virus mailing list. To > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > type "unsubscribe Declude.Virus".The archives can be found > > > at http://www.mail-archive.com. > > > > > > > --- > > [This E-mail was scanned for viruses by Declude EVA www.declude.com] > > > > --- > > This E-mail came from the Declude.Virus mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus".The archives can be found > > at http://www.mail-archive.com. > --- > [This E-mail was scanned for viruses by Declude EVA www.declude.com] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus".The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Where to send exe's to check if they are a virus?
As one of my clients like to say "It is a Code 18 problem" Problem is 18 inches from the keyboard They are a school so it is true a lot of the time :) Goran Jovanovic Omega Network Solutions > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.Virus- > [EMAIL PROTECTED] On Behalf Of John T (Lists) > Sent: Thursday, December 15, 2005 11:07 AM > To: Declude.Virus@declude.com > Subject: RE: [Declude.Virus] Where to send exe's to check if they are a > virus? > > Uh, keyboard virus? > > ;) > > John T > eServices For You > > > > -Original Message- > > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] > > On Behalf Of Goran Jovanovic > > Sent: Thursday, December 15, 2005 7:53 AM > > To: Declude.Virus@declude.com > > Subject: RE: [Declude.Virus] Where to send exe's to check if they are a > virus? > > > > I tried www.totalvirus.com and it is an ad site. > > > > Thank you > > > > Goran Jovanovic > > Omega Network Solutions > > > > > > > > > -Original Message- > > > From: [EMAIL PROTECTED] [mailto:Declude.Virus- > > > [EMAIL PROTECTED] On Behalf Of Markus Gufler > > > Sent: Thursday, December 15, 2005 10:45 AM > > > To: Declude.Virus@declude.com > > > Subject: RE: [Declude.Virus] Where to send exe's to check if they are > > a > > > virus? > > > > > > www.virustotal.com (se me previous posting for results) > > > > > > At the moment i consider blocking at least temporaly eye in zips and > > > update > > > the virus definitions > > > > > > Markus > > > > > > > > > > > > > -Original Message- > > > > From: [EMAIL PROTECTED] > > > > [mailto:[EMAIL PROTECTED] On Behalf Of Goran > > Jovanovic > > > > Sent: Thursday, December 15, 2005 4:26 PM > > > > To: Declude.Virus@declude.com > > > > Subject: [Declude.Virus] Where to send exe's to check if they > > > > are a virus? > > > > > > > > Hi, > > > > > > > > I am getting a bunch of exe in zip files being banned right > > > > now. I have grabbed one of them it is called marie.zip and > > > > has a single exe in it called s3700020.exe and when you put > > > > it on your desktop is has the standard jpeg icon associated with it. > > > > > > > > My F-Prot, McAfee and Symantec scanners are not finding a > > > > virus. Where is the place that you can send it to and have it > > > > checked out by a ton of virus scanners? > > > > > > > > Thanx > > > > > > > > Goran Jovanovic > > > > Omega Network Solutions > > > > --- > > > > [This E-mail was scanned for viruses by Declude EVA www.declude.com] > > > > > > > > --- > > > > This E-mail came from the Declude.Virus mailing list. To > > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > > type "unsubscribe Declude.Virus".The archives can be found > > > > at http://www.mail-archive.com. > > > > > > > > > > --- > > > [This E-mail was scanned for viruses by Declude EVA www.declude.com] > > > > > > --- > > > This E-mail came from the Declude.Virus mailing list. To > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > type "unsubscribe Declude.Virus".The archives can be found > > > at http://www.mail-archive.com. > > --- > > [This E-mail was scanned for viruses by Declude EVA www.declude.com] > > > > --- > > This E-mail came from the Declude.Virus mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus".The archives can be found > > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude EVA www.declude.com] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus".The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Where to send exe's to check if they are a virus?
> Some of the small AV companies are reporting it as a Bagle > variant and F-Prot is reporting it as MitGlieder.GU although > it is not catching it on the server. Even if I can't explain why it is not catching it I can confirm this. F-Prot on virustotal is catching it. On my server with newest definitions it's not blocking it as a virus. Mcafee at the moment seems not catching it with newest signatures. Markus --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Where to send exe's to check if they are a virus?
Yup this is the one I got as well. I just did a manual update of F-Prot and it found a new SIGN.DEF and SIGN2.DEF Maybe these signatures will find it now. Goran Jovanovic Omega Network Solutions > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.Virus- > [EMAIL PROTECTED] On Behalf Of John T (Lists) > Sent: Thursday, December 15, 2005 10:46 AM > To: Declude.Virus@declude.com > Subject: RE: [Declude.Virus] Where to send exe's to check if they are a > virus? > > www.virustotal.com > > This is a very small e-mail, the D file being only 11 kb. > > Some of the small AV companies are reporting it as a Bagle variant and > F-Prot is reporting it as MitGlieder.GU although it is not catching it on > the server. > > John T > eServices For You > > > -Original Message- > > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] > > On Behalf Of Goran Jovanovic > > Sent: Thursday, December 15, 2005 7:26 AM > > To: Declude.Virus@declude.com > > Subject: [Declude.Virus] Where to send exe's to check if they are a > virus? > > > > Hi, > > > > I am getting a bunch of exe in zip files being banned right now. I have > > grabbed one of them it is called marie.zip and has a single exe in it > > called s3700020.exe and when you put it on your desktop is has the > > standard jpeg icon associated with it. > > > > My F-Prot, McAfee and Symantec scanners are not finding a virus. Where > > is the place that you can send it to and have it checked out by a ton of > > virus scanners? > > > > Thanx > > > > Goran Jovanovic > > Omega Network Solutions > > --- > > [This E-mail was scanned for viruses by Declude EVA www.declude.com] > > > > --- > > This E-mail came from the Declude.Virus mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus".The archives can be found > > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude EVA www.declude.com] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus".The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Where to send exe's to check if they are a virus?
I tried www.totalvirus.com and it is an ad site. Thank you Goran Jovanovic Omega Network Solutions > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.Virus- > [EMAIL PROTECTED] On Behalf Of Markus Gufler > Sent: Thursday, December 15, 2005 10:45 AM > To: Declude.Virus@declude.com > Subject: RE: [Declude.Virus] Where to send exe's to check if they are a > virus? > > www.virustotal.com (se me previous posting for results) > > At the moment i consider blocking at least temporaly eye in zips and > update > the virus definitions > > Markus > > > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of Goran Jovanovic > > Sent: Thursday, December 15, 2005 4:26 PM > > To: Declude.Virus@declude.com > > Subject: [Declude.Virus] Where to send exe's to check if they > > are a virus? > > > > Hi, > > > > I am getting a bunch of exe in zip files being banned right > > now. I have grabbed one of them it is called marie.zip and > > has a single exe in it called s3700020.exe and when you put > > it on your desktop is has the standard jpeg icon associated with it. > > > > My F-Prot, McAfee and Symantec scanners are not finding a > > virus. Where is the place that you can send it to and have it > > checked out by a ton of virus scanners? > > > > Thanx > > > > Goran Jovanovic > > Omega Network Solutions > > --- > > [This E-mail was scanned for viruses by Declude EVA www.declude.com] > > > > --- > > This E-mail came from the Declude.Virus mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus".The archives can be found > > at http://www.mail-archive.com. > > > > --- > [This E-mail was scanned for viruses by Declude EVA www.declude.com] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus".The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Where to send exe's to check if they are a virus?
You can upload it to this website where it will be scanned by all the leading virus vendors that haven't sent them a cease-and-desist order: http://www.virustotal.com/flash/index_en.html And you can also upload it to here to have their 'bot run the application in a sandbox and report back to you what it does, which may be obviously viral: http://sandbox.norman.no/live.html Andrew 8) > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Goran Jovanovic > Sent: Thursday, December 15, 2005 7:26 AM > To: Declude.Virus@declude.com > Subject: [Declude.Virus] Where to send exe's to check if they > are a virus? > > Hi, > > I am getting a bunch of exe in zip files being banned right > now. I have grabbed one of them it is called marie.zip and > has a single exe in it called s3700020.exe and when you put > it on your desktop is has the standard jpeg icon associated with it. > > My F-Prot, McAfee and Symantec scanners are not finding a > virus. Where is the place that you can send it to and have it > checked out by a ton of virus scanners? > > Thanx > > Goran Jovanovic > Omega Network Solutions > --- > [This E-mail was scanned for viruses by Declude EVA www.declude.com] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus".The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Where to send exe's to check if they are a virus?
www.virustotal.com (se me previous posting for results) At the moment i consider blocking at least temporaly eye in zips and update the virus definitions Markus > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Goran Jovanovic > Sent: Thursday, December 15, 2005 4:26 PM > To: Declude.Virus@declude.com > Subject: [Declude.Virus] Where to send exe's to check if they > are a virus? > > Hi, > > I am getting a bunch of exe in zip files being banned right > now. I have grabbed one of them it is called marie.zip and > has a single exe in it called s3700020.exe and when you put > it on your desktop is has the standard jpeg icon associated with it. > > My F-Prot, McAfee and Symantec scanners are not finding a > virus. Where is the place that you can send it to and have it > checked out by a ton of virus scanners? > > Thanx > > Goran Jovanovic > Omega Network Solutions > --- > [This E-mail was scanned for viruses by Declude EVA www.declude.com] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus".The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Where to send exe's to check if they are a virus?
www.virustotal.com This is a very small e-mail, the D file being only 11 kb. Some of the small AV companies are reporting it as a Bagle variant and F-Prot is reporting it as MitGlieder.GU although it is not catching it on the server. John T eServices For You > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > On Behalf Of Goran Jovanovic > Sent: Thursday, December 15, 2005 7:26 AM > To: Declude.Virus@declude.com > Subject: [Declude.Virus] Where to send exe's to check if they are a virus? > > Hi, > > I am getting a bunch of exe in zip files being banned right now. I have > grabbed one of them it is called marie.zip and has a single exe in it > called s3700020.exe and when you put it on your desktop is has the > standard jpeg icon associated with it. > > My F-Prot, McAfee and Symantec scanners are not finding a virus. Where > is the place that you can send it to and have it checked out by a ton of > virus scanners? > > Thanx > > Goran Jovanovic > Omega Network Solutions > --- > [This E-mail was scanned for viruses by Declude EVA www.declude.com] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus".The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
[Declude.Virus] Where to send exe's to check if they are a virus?
Hi, I am getting a bunch of exe in zip files being banned right now. I have grabbed one of them it is called marie.zip and has a single exe in it called s3700020.exe and when you put it on your desktop is has the standard jpeg icon associated with it. My F-Prot, McAfee and Symantec scanners are not finding a virus. Where is the place that you can send it to and have it checked out by a ton of virus scanners? Thanx Goran Jovanovic Omega Network Solutions --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
