Re: [Declude.Virus] McAfee and /clean
Sorry for the denseness I was looking at the McAfee help file, and there were /mime and /mailbox switches. Am I missing something? Also is there an AV product that will function w. Declude AV and clean and pass the messages along? Statistically it would probably be seldom used as most viral attachments are deliberate rather than accidental, so I just currious. Anyone on the list? Burzin In other words is there a problem with adding /clean to the virus.cfg file? Yes, there would be a problem. Specifically, McAfee will clean the decoded attachment that Declude Virus creates, and will report the E-mail as virus-free -- so Declude Virus will deliver the E-mail, even though it has a virus in it (note that McAfee doesn't know or care that there is an encoded E-mail somewhere else that is related to the file it is scanning). -Scott --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] McAfee and /clean
I was looking at the McAfee help file, and there were /mime and /mailbox switches. Am I missing something? You can ignore those. McAfee won't see any MIME segments or mailboxes -- Declude Virus handles all that. McAfee will just see an attachment (one that will be deleted immediately after it is scanned, so any alterations McAfee might make to it will not be used anywhere). Also is there an AV product that will function w. Declude AV and clean and pass the messages along? No -- because if it cleans the attachment, the attachment is then immediately deleted, so nobody will ever see the cleaned file. Statistically it would probably be seldom used as most viral attachments are deliberate rather than accidental, so I just currious. Anyone on the list? About 99% of viruses that are received are ones that the virus itself sent out, that has meaningless content. In the rare cases where someone intentionally sends out an attachment that happens to have a virus, their computer is infected -- and, well, I think it's not a good idea to go out of your way to get their E-mail delivered. If you do, they may not bother disinfecting their computer -- which could enable spammers to send out millions of spams, for example. Also, you should note that several viruses will include a document from the computer they infect in the E-mails they send out. So confidential documents may be spread by cleaning E-mails with viruses. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] McAfee and /clean
Thanks John and Andy and others... :) I realize that the situation is a statistical abnormality-- far more extreme than John suggests. Chalk the question up to one of curiosity more so than one of an immediate driving technical need. Thanks, Burzin At 04:57 PM 12/3/2003, you wrote: 99 times out of 100, the message infected with a virus is not legit, therefore there is no reason to clean and deliver. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.Virus- [EMAIL PROTECTED] On Behalf Of Burzin Sumariwalla Sent: Wednesday, December 03, 2003 2:39 PM To: [EMAIL PROTECTED] Subject: [Declude.Virus] McAfee and /clean Hello, Is the /clean switch in McAfee AV (Enterprise Edition 7.1) supported within Declude? In other words is there a problem with adding /clean to the virus.cfg file? Thanks, Burzin At 02:32 PM 12/3/2003, you wrote: Welcome aboard the Declude Virus mailing list! This list was created to help users (and potential users) of Declude Virus to get together and share information about it. Suggested uses of this list include: Sharing tips and tricks, reporting problems (Computerized Horizons monitors the forum), discussion of beta features, anything you can think of. To send an E-mail to the list, just send an E-mail to [EMAIL PROTECTED] -Scott --- [This E-mail scanned for viruses by Declude Virus] -- Burzin Sumariwalla Phone: (314) 994-9411 x291 [EMAIL PROTECTED] Fax: (314) 997-7615 Pager: (314) 407-3345 Networking and Telecommunications Manager Information Technology Services St. Louis County Library District 1640 S. Lindbergh Blvd. St. Louis, MO 63131 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] -- Burzin Sumariwalla Phone: (314) 994-9411 x291 [EMAIL PROTECTED] Fax: (314) 997-7615 Pager: (314) 407-3345 Networking and Telecommunications Manager Information Technology Services St. Louis County Library District 1640 S. Lindbergh Blvd. St. Louis, MO 63131 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] McAfee and /clean
Is the /clean switch in McAfee AV (Enterprise Edition 7.1) supported within Declude? No, it is not. In other words is there a problem with adding /clean to the virus.cfg file? Yes, there would be a problem. Specifically, McAfee will clean the decoded attachment that Declude Virus creates, and will report the E-mail as virus-free -- so Declude Virus will deliver the E-mail, even though it has a virus in it (note that McAfee doesn't know or care that there is an encoded E-mail somewhere else that is related to the file it is scanning). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] McAfee and /clean
Hi, I think that virtually all virus infected emails nowadays contain worth preserving, because the only thing attached is the virus itself. Cleaning would not accomplish anything - because after the cleaning there'd be nothing left. (Sorry to disappoint you, but that virus email that claims that the attachment contains some nude photos of Anna whoever is lying - there really is no pictures G.) The clean option is practical on an already infected machine where executables, registry and other settings needs to be cleaned to remove the virus without losing critical files. In theory, Declude could ask the virus scanner to 'clean' an infected WORDS or EXCEL document and then pass it on - but I can't remember the last time I've seen an unintentional infection. Nowadays everything seem to be viruses/worms that are spamming themselves. Best Regards Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] McAfee and /clean
99 times out of 100, the message infected with a virus is not legit, therefore there is no reason to clean and deliver. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.Virus- [EMAIL PROTECTED] On Behalf Of Burzin Sumariwalla Sent: Wednesday, December 03, 2003 2:39 PM To: [EMAIL PROTECTED] Subject: [Declude.Virus] McAfee and /clean Hello, Is the /clean switch in McAfee AV (Enterprise Edition 7.1) supported within Declude? In other words is there a problem with adding /clean to the virus.cfg file? Thanks, Burzin At 02:32 PM 12/3/2003, you wrote: Welcome aboard the Declude Virus mailing list! This list was created to help users (and potential users) of Declude Virus to get together and share information about it. Suggested uses of this list include: Sharing tips and tricks, reporting problems (Computerized Horizons monitors the forum), discussion of beta features, anything you can think of. To send an E-mail to the list, just send an E-mail to [EMAIL PROTECTED] -Scott --- [This E-mail scanned for viruses by Declude Virus] -- Burzin Sumariwalla Phone: (314) 994-9411 x291 [EMAIL PROTECTED] Fax: (314) 997-7615 Pager: (314) 407-3345 Networking and Telecommunications Manager Information Technology Services St. Louis County Library District 1640 S. Lindbergh Blvd. St. Louis, MO 63131 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
