Re: [Declude.Virus] Log error with latest interim release
Thanks for the input, Scott. Darin. - Original Message - From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, March 18, 2004 1:12 PM Subject: Re: [Declude.Virus] Log error with latest interim release >Scott, your thoughts? From what I have seen, AV heuristics just don't do a good enough job to be useful. Specifically, they seem to catch legitimate E-mails regularly (typically .doc/.xls files). However, depending on your needs, it may be worthwhile to use the heuristics, if the occasional false positive is acceptable. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. _ [This E-mail virus scanned by 4C Web] _ [This E-mail virus scanned by 4C Web] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Log error with latest interim release
Scott, your thoughts? Darin. - Original Message - From: "Bill Landry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, March 18, 2004 12:58 PM Subject: Re: [Declude.Virus] Log error with latest interim release My understanding is that Scott does not think they are necessary, and that may be true. However, F-Prot must have had some reason for adding those switches (especially the PACKED switch), so I use them - just to be safe... Bill - Original Message - From: "Darin Cox" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, March 18, 2004 9:48 AM Subject: Re: [Declude.Virus] Log error with latest interim release > Hi Bill, > > Yeah, I had seen your configs...just wanted to get Scott's feedback on > the -AI and -PACKED switches. > > Darin. > > > - Original Message - > From: "Bill Landry" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Thursday, March 18, 2004 12:00 PM > Subject: Re: [Declude.Virus] Log error with latest interim release > > > - Original Message - > From: "Darin Cox" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Thursday, March 18, 2004 8:08 AM > Subject: Re: [Declude.Virus] Log error with latest interim release > > > > Scott, > > > > What are your thoughts on the /AI and /PACKED switches? Any particular > > reason to use or not use them? > > For what it worth, here is what I use: > > SCANFILE1 > M:\FSI\F-Prot\fpcmd.exe -AI -ARCHIVE -DUMB -NOBOOT -NOBREAK -NOMEM -PACKED - > SAFEREMOVE -SERVER -SILENT -TYPE -REPORT=report.txt > VIRUSCODE1 3 > VIRUSCODE1 6 > VIRUSCODE1 8 > REPORT1 Infection: > > and I experience no error or problems. But then I like to error on the side > of being too cautious. > > Bill > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus".The archives can be found > at http://www.mail-archive.com. > > _ > [This E-mail virus scanned by 4C Web] > > > > _ > [This E-mail virus scanned by 4C Web] > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus".The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. _ [This E-mail virus scanned by 4C Web] _ [This E-mail virus scanned by 4C Web] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Log error with latest interim release
Scott, your thoughts? From what I have seen, AV heuristics just don't do a good enough job to be useful. Specifically, they seem to catch legitimate E-mails regularly (typically .doc/.xls files). However, depending on your needs, it may be worthwhile to use the heuristics, if the occasional false positive is acceptable. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Log error with latest interim release
My understanding is that Scott does not think they are necessary, and that may be true. However, F-Prot must have had some reason for adding those switches (especially the PACKED switch), so I use them - just to be safe... Bill - Original Message - From: "Darin Cox" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, March 18, 2004 9:48 AM Subject: Re: [Declude.Virus] Log error with latest interim release > Hi Bill, > > Yeah, I had seen your configs...just wanted to get Scott's feedback on > the -AI and -PACKED switches. > > Darin. > > > - Original Message - > From: "Bill Landry" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Thursday, March 18, 2004 12:00 PM > Subject: Re: [Declude.Virus] Log error with latest interim release > > > - Original Message - > From: "Darin Cox" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Thursday, March 18, 2004 8:08 AM > Subject: Re: [Declude.Virus] Log error with latest interim release > > > > Scott, > > > > What are your thoughts on the /AI and /PACKED switches? Any particular > > reason to use or not use them? > > For what it worth, here is what I use: > > SCANFILE1 > M:\FSI\F-Prot\fpcmd.exe -AI -ARCHIVE -DUMB -NOBOOT -NOBREAK -NOMEM -PACKED - > SAFEREMOVE -SERVER -SILENT -TYPE -REPORT=report.txt > VIRUSCODE1 3 > VIRUSCODE1 6 > VIRUSCODE1 8 > REPORT1 Infection: > > and I experience no error or problems. But then I like to error on the side > of being too cautious. > > Bill > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus".The archives can be found > at http://www.mail-archive.com. > > _ > [This E-mail virus scanned by 4C Web] > > > > _ > [This E-mail virus scanned by 4C Web] > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus".The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Log error with latest interim release
Meant version E. Sorry, been a long day. Sincerely, Grant Griffith, Vice President EI8HT LEGS Web Management Co., Inc. http://www.getafreewebsite.com 877-483-3393 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Grant Griffith - Declude Virus Sent: Thursday, March 18, 2004 12:35 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Log error with latest interim release I just upgraded to version 3 and am still seeing this. I will contact F-Prot to see if they can give me some insight on this. Sincerely, Grant Griffith, Vice President EI8HT LEGS Web Management Co., Inc. http://www.getafreewebsite.com 877-483-3393 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Thursday, March 18, 2004 12:04 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Log error with latest interim release >03/18/2004 11:20:01 Qcc24005d0536a2e6 Error 128 in virus scanner 1. >03/18/2004 11:21:09 Qcc661aa8032aa581 Error 128 in virus scanner 1. F-Prot doesn't define an exit code of 128 -- I would recommend reinstalling F-Prot and/or moving to the latest version of F-Prot. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Log error with latest interim release
Hi Bill, Yeah, I had seen your configs...just wanted to get Scott's feedback on the -AI and -PACKED switches. Darin. - Original Message - From: "Bill Landry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, March 18, 2004 12:00 PM Subject: Re: [Declude.Virus] Log error with latest interim release - Original Message - From: "Darin Cox" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, March 18, 2004 8:08 AM Subject: Re: [Declude.Virus] Log error with latest interim release > Scott, > > What are your thoughts on the /AI and /PACKED switches? Any particular > reason to use or not use them? For what it worth, here is what I use: SCANFILE1 M:\FSI\F-Prot\fpcmd.exe -AI -ARCHIVE -DUMB -NOBOOT -NOBREAK -NOMEM -PACKED - SAFEREMOVE -SERVER -SILENT -TYPE -REPORT=report.txt VIRUSCODE1 3 VIRUSCODE1 6 VIRUSCODE1 8 REPORT1 Infection: and I experience no error or problems. But then I like to error on the side of being too cautious. Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. _ [This E-mail virus scanned by 4C Web] _ [This E-mail virus scanned by 4C Web] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Log error with latest interim release
Gotcha. So it just different virus scanners clsify threats differently?[ The other scanners are flagging these as viruses.] If F-Prot returns an exit code other than 6, it did not detect a virus. Is there a way to display different strings from reportt.txt? No. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Log error with latest interim release
> >"Could not find parse string Infection: in report.txt" > > That is normal, if the virus scanner does not detect a virus (but instead > reports a vulnerability). Gotcha. So it just different virus scanners clsify threats differently?[ The other scanners are flagging these as viruses.] Is there a way to display different strings from reportt.txt? Thanks! -Nick Hayer --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Log error with latest interim release
I just upgraded to version 3 and am still seeing this. I will contact F-Prot to see if they can give me some insight on this. Sincerely, Grant Griffith, Vice President EI8HT LEGS Web Management Co., Inc. http://www.getafreewebsite.com 877-483-3393 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Thursday, March 18, 2004 12:04 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Log error with latest interim release >03/18/2004 11:20:01 Qcc24005d0536a2e6 Error 128 in virus scanner 1. >03/18/2004 11:21:09 Qcc661aa8032aa581 Error 128 in virus scanner 1. F-Prot doesn't define an exit code of 128 -- I would recommend reinstalling F-Prot and/or moving to the latest version of F-Prot. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Log error with latest interim release
I to am recording an error: "Could not find parse string Infection: in report.txt" That is normal, if the virus scanner does not detect a virus (but instead reports a vulnerability). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Log error with latest interim release
Scott, I to am recording an error: "Could not find parse string Infection: in report.txt" Circumstances are occuring only with fprot, and only on banned extensions or on [banned] encrypted zips. I only looked at todays logs so I really do not know if it started with the latest interim release. I am running fprot 3.14e latest defs -Nick Hayer > > >03/18/2004 11:20:01 Qcc24005d0536a2e6 Error 128 in virus scanner 1. > >03/18/2004 11:21:09 Qcc661aa8032aa581 Error 128 in virus scanner 1. > > F-Prot doesn't define an exit code of 128 -- I would recommend reinstalling > F-Prot and/or moving to the latest version of F-Prot. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers > since 2000. > Declude Virus: Ultra reliable virus detection and the leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus".The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Log error with latest interim release
03/18/2004 11:20:01 Qcc24005d0536a2e6 Error 128 in virus scanner 1. 03/18/2004 11:21:09 Qcc661aa8032aa581 Error 128 in virus scanner 1. F-Prot doesn't define an exit code of 128 -- I would recommend reinstalling F-Prot and/or moving to the latest version of F-Prot. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Log error with latest interim release
- Original Message - From: "Darin Cox" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, March 18, 2004 8:08 AM Subject: Re: [Declude.Virus] Log error with latest interim release > Scott, > > What are your thoughts on the /AI and /PACKED switches? Any particular > reason to use or not use them? For what it worth, here is what I use: SCANFILE1 M:\FSI\F-Prot\fpcmd.exe -AI -ARCHIVE -DUMB -NOBOOT -NOBREAK -NOMEM -PACKED - SAFEREMOVE -SERVER -SILENT -TYPE -REPORT=report.txt VIRUSCODE1 3 VIRUSCODE1 6 VIRUSCODE1 8 REPORT1 Infection: and I experience no error or problems. But then I like to error on the side of being too cautious. Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Log error with latest interim release
You might want to use the 32b version of the scanner, as well. # F-PROT - 1st scanner SCANFILE1 C:\Progra~1\FSI\F-Prot\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOBOOT /DUMB /REPORT=report.txt VIRUSCODE1 3 VIRUSCODE1 6 REPORT1 Infection: Thursday, March 18, 2004, 9:57:41 AM, R. Scott Perry <[EMAIL PROTECTED]> wrote: >>We have been running the latest interims for a couple of weeks (since >>the EZIP stuff came out). We are seeing the following error in the >>virus logs: >> >>03/18/2004 07:25:33 Qa32252df006a099c Could not find parse string >>Infection: in report.txt >>03/18/2004 07:25:33 Qa32252df006a099c Error 8 in virus scanner 1. >>03/18/2004 07:25:33 Qa32252df006a099c Scanned: Error in virus scanner. >>[MIME: 3 23481] RSP> That is normal. The "Error 8" indicates that F-Prot detected a suspicious RSP> file, in which case it will not know the name of the virus (since it didn't RSP> detect one). >>We have f-prot 3.14e and Declude v1.78i27. Running on Imail 7.15. Here >>is the Scan line from the virus.cfg: >> >>SCANFILEC:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM >>/ARCHIVE /NOFLOPPY /NOBOOT /DUMB /SERVER /REPORT=report.txt RSP> The "/SERVER" is not recommended, and will cause the "Error 8"'s. RSP> -Scott RSP> --- RSP> Declude JunkMail: The advanced anti-spam solution for IMail mailservers RSP> since 2000. RSP> Declude Virus: Ultra reliable virus detection and the leader in mailserver RSP> vulnerability detection. RSP> Find out what you've been missing: Ask for a free 30-day evaluation. RSP> --- RSP> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] RSP> --- RSP> This E-mail came from the Declude.Virus mailing list. To RSP> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and RSP> type "unsubscribe Declude.Virus".The archives can be found RSP> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net PGP Key ID: 04C99A55 (972) 788-2364 Fax: (972) 788-5049 Providing Internet Solutions Worldwide - An eDataWeb Affiliate --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Log error with latest interim release
Scott, We are seeing something similar since upgrading to interim release 178i27. Logs: 03/18/2004 11:19:34 Qcc0742d003962ecf Could not find report file D:\IMAIL\spool\Dcc0742d003962ecf.vir\report.txt. 03/18/2004 11:19:34 Qcc0742d003962ecf Scanned: Banned file extension. [MIME: 2 22185] 03/18/2004 11:19:34 Qcc0742d003962ecf From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] 03/18/2004 11:19:34 Qcc0742d003962ecf Subject: hi 03/18/2004 11:19:59 Qcc2b190e032abe2e Scanned: Virus Free [Prescan OK][MIME: 2 8244] 03/18/2004 11:20:01 Qcc24005d0536a2e6 Could not find report file D:\IMAIL\spool\Dcc24005d0536a2e6.vir\report.txt. 03/18/2004 11:20:01 Qcc24005d0536a2e6 Error 128 in virus scanner 1. 03/18/2004 11:20:01 Qcc24005d0536a2e6 Scanned: Error in virus scanner. [MIME: 1 901] 03/18/2004 11:20:43 Qcc4f1a37032a49b5 Could not find report file D:\IMAIL\spool\Dcc4f1a37032a49b5.vir\report.txt. 03/18/2004 11:20:43 Qcc4f1a37032a49b5 Error 128 in virus scanner 1. 03/18/2004 11:20:43 Qcc4f1a37032a49b5 Scanned: Error in virus scanner. [MIME: 1 3045] 03/18/2004 11:21:09 Qcc661aa8032aa581 Could not find report file D:\IMAIL\spool\Dcc661aa8032aa581.vir\report.txt. 03/18/2004 11:21:09 Qcc661aa8032aa581 Error 128 in virus scanner 1. 03/18/2004 11:21:09 Qcc661aa8032aa581 Scanned: Error in virus scanner. [Prescan OK][MIME: 4 33052] Virus.cfg setting: SCANFILEd:\imail\declude\FProt-Win\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE /DUMB /REPORT=report.txt VIRUSCODE 3 VIRUSCODE 6 VIRUSCODE 8 REPORT Infection: Still using F-Prot version C! Sincerely, Grant Griffith, Vice President EI8HT LEGS Web Management Co., Inc. http://www.getafreewebsite.com Bus. Phone: (877) 483-3393 Cell Phone: (812) 569-6401 -- Original Message -- From: "R. Scott Perry" <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] Date: Thu, 18 Mar 2004 10:57:41 -0500 > >>We have been running the latest interims for a couple of weeks (since >>the EZIP stuff came out). We are seeing the following error in the >>virus logs: >> >>03/18/2004 07:25:33 Qa32252df006a099c Could not find parse string >>Infection: in report.txt >>03/18/2004 07:25:33 Qa32252df006a099c Error 8 in virus scanner 1. >>03/18/2004 07:25:33 Qa32252df006a099c Scanned: Error in virus scanner. >>[MIME: 3 23481] > >That is normal. The "Error 8" indicates that F-Prot detected a suspicious >file, in which case it will not know the name of the virus (since it didn't >detect one). > >>We have f-prot 3.14e and Declude v1.78i27. Running on Imail 7.15. Here >>is the Scan line from the virus.cfg: >> >>SCANFILEC:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM >>/ARCHIVE /NOFLOPPY /NOBOOT /DUMB /SERVER /REPORT=report.txt > >The "/SERVER" is not recommended, and will cause the "Error 8"'s. > >-Scott >--- >Declude JunkMail: The advanced anti-spam solution for IMail mailservers >since 2000. >Declude Virus: Ultra reliable virus detection and the leader in mailserver >vulnerability detection. >Find out what you've been missing: Ask for a free 30-day evaluation. > >--- >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > >--- >This E-mail came from the Declude.Virus mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.Virus".The archives can be found >at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Log error with latest interim release
Scott, What are your thoughts on the /AI and /PACKED switches? Any particular reason to use or not use them? Darin. - Original Message - From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, March 18, 2004 10:57 AM Subject: Re: [Declude.Virus] Log error with latest interim release >We have been running the latest interims for a couple of weeks (since >the EZIP stuff came out). We are seeing the following error in the >virus logs: > >03/18/2004 07:25:33 Qa32252df006a099c Could not find parse string >Infection: in report.txt >03/18/2004 07:25:33 Qa32252df006a099c Error 8 in virus scanner 1. >03/18/2004 07:25:33 Qa32252df006a099c Scanned: Error in virus scanner. >[MIME: 3 23481] That is normal. The "Error 8" indicates that F-Prot detected a suspicious file, in which case it will not know the name of the virus (since it didn't detect one). >We have f-prot 3.14e and Declude v1.78i27. Running on Imail 7.15. Here >is the Scan line from the virus.cfg: > >SCANFILEC:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM >/ARCHIVE /NOFLOPPY /NOBOOT /DUMB /SERVER /REPORT=report.txt The "/SERVER" is not recommended, and will cause the "Error 8"'s. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. _ [This E-mail virus scanned by 4C Web] _ [This E-mail virus scanned by 4C Web] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Log error with latest interim release
We have been running the latest interims for a couple of weeks (since the EZIP stuff came out). We are seeing the following error in the virus logs: 03/18/2004 07:25:33 Qa32252df006a099c Could not find parse string Infection: in report.txt 03/18/2004 07:25:33 Qa32252df006a099c Error 8 in virus scanner 1. 03/18/2004 07:25:33 Qa32252df006a099c Scanned: Error in virus scanner. [MIME: 3 23481] That is normal. The "Error 8" indicates that F-Prot detected a suspicious file, in which case it will not know the name of the virus (since it didn't detect one). We have f-prot 3.14e and Declude v1.78i27. Running on Imail 7.15. Here is the Scan line from the virus.cfg: SCANFILEC:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOFLOPPY /NOBOOT /DUMB /SERVER /REPORT=report.txt The "/SERVER" is not recommended, and will cause the "Error 8"'s. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
