Re: what are bat*.tmp files?

2002-10-10 Thread Doug Weller

Hi Gerard,

Thursday, October 10, 2002, 12:08:22 AM, you wrote:

[SNIP]

 Why would you want that garbage at the end of incoming or outgoing
 mail anyway. In most cases the receiver (either you or those to whom
 you send an e-mail to) don't really care what the sender's system did.

I don't, but it would tell me if it was working!

I don't trust such stuff anyway.

Doug

-- 
 Doug Weller  Moderator, sci.archaeology.moderated
 Submissions to:[EMAIL PROTECTED]
 Doug's Archaeology Site: http://www.ramtops.demon.co.uk
 Co-owner UK-Schools mailing list: email me for details



Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



Re: what are bat*.tmp files?

2002-10-09 Thread Doug Weller

On Wed, 9 Oct 2002 11:09:12 +0545
 Sudip Pokhrel [EMAIL PROTECTED] wrote:
 Hi Doug,
 
 On Wednesday, October 9, 2002 05:51 your local time, (10:36 my local
 time), you [DW] wrote:
 
 DW Which of those is the AVG plugin though? Found the Nod32 one,
 DW which I also need.
 
 You can get AVG plug-in directly from Grisoft:
 
 http://files.grisoft.cz/softw/thebat/avgbat9us.exe
 
 
Thanks. I thought I'd searched their site!

Doug
-- 
 Doug's Archaeology Site http://www.ramtops.demon.co.uk


Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



Re[2]: what are bat*.tmp files?

2002-10-09 Thread D Gerard Raftery Sr.

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Wednesday, October 09, 2002
8:11:24 AM
RE: what are bat*.tmp files?

Greetings Doug,

On Wednesday, October 9, 2002, 3:01:25 AM, you wrote:

 You can get AVG plug-in directly from Grisoft:

 http://files.grisoft.cz/softw/thebat/avgbat9us.exe

DW Thanks. I thought I'd searched their site!

It's not easy to find. You have to scroll down through the Updates
listing or simply go here:

http://www.grisoft.com/html/us_avgbat.htm?session=222c74fe60752605c3145686492d8df6

Hope this helps.

- --
Regards,
 D Gerard Raftery Sr.

A paperless office has about as much chance as a paperless bathroom.

-BEGIN PGP SIGNATURE-
Version: PGP for Business Security 6.0

iQA/AwUBPaQdqvrDU+56b7pcEQJfBQCgmkW+sYl+D+b8AkuAMzLhtBlabvIAoPfs
kIKACZdTuwvCqw7q/7/qEcTo
=0+JX
-END PGP SIGNATURE-



Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



Re: what are bat*.tmp files?

2002-10-09 Thread Doug Weller

Hi,

Wednesday, October 9, 2002, 1:14:59 PM, you wrote:

DW 

 It's not easy to find. You have to scroll down through the Updates
 listing or simply go here:

 http://www.grisoft.com/html/us_avgbat.htm?session=222c74fe60752605c3145686492d8df6


Ok, it's installed, thanks very much for the help. What bits of AVG itself do I have 
to keep running
to make it operational? I don't think I want to run AVG's Resident
Shield alongside Trend's Real-Time monitor, for instance. But I do
want it to update.

Doug

-- 
 Doug Weller  Moderator, sci.archaeology.moderated
 Submissions to:[EMAIL PROTECTED]
 Doug's Archaeology Site: http://www.ramtops.demon.co.uk
 Co-owner UK-Schools mailing list: email me for details



Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



Re[2]: what are bat*.tmp files?

2002-10-09 Thread D Gerard Raftery Sr.

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Wednesday, October 09, 2002
5:54:36 PM
RE: what are bat*.tmp files?

Greetings Doug,

On Wednesday, October 9, 2002, 1:47:10 PM, you wrote:

DW Hi,

DW Wednesday, October 9, 2002, 1:14:59 PM, you wrote:

DW

 It's not easy to find. You have to scroll down through the Updates
 listing or simply go here:

 http://www.grisoft.com/html/us_avgbat.htm?session=222c74fe60752605c3145686492d8df6


DW Ok, it's installed, thanks very much for the help. What bits of AVG itself do I 
have to keep running
DW to make it operational? I don't think I want to run AVG's Resident
DW Shield alongside Trend's Real-Time monitor, for instance. But I do
DW want it to update.

DW Doug

Just uncheck the Resident Shield boxes (and then click on Save
Parameters as New Default) and leave the control center (icon
on your taskbar) running. You need not have the Resident Shield
operational for the plugin to do it's job.

I know many that have two or three AV's installed with the primary AV
performing resident scan operation and the other two to either utilize
a plugin feature or have a back up AV program to check to see if the
primary missed something.

- --
Regards,
 D Gerard Raftery Sr.

ASCII stupid question, get a stupid ANSI!

-BEGIN PGP SIGNATURE-
Version: PGP for Business Security 6.0

iQA/AwUBPaSnWWGmTEg4iItaEQKzXQCfaCk7ToQs1+GkIGqlRxsSQd0o0wUAn2/M
fJuAXypLnNY+sXHLH6emeCqk
=V2KG
-END PGP SIGNATURE-



Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



Re: what are bat*.tmp files?

2002-10-09 Thread Doug Weller

Hi Gerard,

Wednesday, October 9, 2002, 11:02:15 PM, you wrote:



 Just uncheck the Resident Shield boxes (and then click on Save
 Parameters as New Default) and leave the control center (icon
 on your taskbar) running. You need not have the Resident Shield
 operational for the plugin to do it's job.

 I know many that have two or three AV's installed with the primary AV
 performing resident scan operation and the other two to either utilize
 a plugin feature or have a back up AV program to check to see if the
 primary missed something.

That makes sense and is probably what I shall do.

Do I gather it doesn't actually mark either outgoing or incoming
email?

Thanks.

Doug


-- 
 Doug Weller  Moderator, sci.archaeology.moderated
 Submissions to:[EMAIL PROTECTED]
 Doug's Archaeology Site: http://www.ramtops.demon.co.uk
 Co-owner UK-Schools mailing list: email me for details



Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



Re: what are bat*.tmp files?

2002-10-09 Thread Doug Weller

Hi Sudip,

Wednesday, October 9, 2002, 6:24:12 AM, you wrote:

 Hi Doug,

 On Wednesday, October 9, 2002 05:51 your local time, (10:36 my local
 time), you [DW] wrote:

DW Which of those is the AVG plugin though? Found the Nod32 one,
DW which I also need.

 You can get AVG plug-in directly from Grisoft:

 http://files.grisoft.cz/softw/thebat/avgbat9us.exe

Thanks, it is up and I hope running now!

Doug


-- 
 Doug Weller  Moderator, sci.archaeology.moderated
 Submissions to:[EMAIL PROTECTED]
 Doug's Archaeology Site: http://www.ramtops.demon.co.uk
 Co-owner UK-Schools mailing list: email me for details



Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



Re[2]: what are bat*.tmp files?

2002-10-09 Thread D Gerard Raftery Sr.

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Wednesday, October 09, 2002
6:38:53 PM
RE: what are bat*.tmp files?

Greetings Avram,

On Tuesday, October 8, 2002, 1:48:33 PM, you wrote:

Acc Thanks, again.  Your explanation this time, was much more clear.   Given my
Acc setup, is there any reason (in terms of catching viruses from incoming messages)
Acc why it would be advantageous for me to move to AV software, such as AVG, or some
Acc of the others mentioned on this list that have plug-ins for The Bat?   Any
Acc reason to just let well enough alone?

Any AV software that is worth it's salt SHOULD, with resident scanner
abilities ON, alert when you try and open an e-mail attachment that is
infected.

As reported within this thread, the plus side of having an e-mail
plugin is to quarantine and bring the exact message to your attention.
I have seen Norton AV, resident shield only, alert and disappear
leaving one to weed through AV logs only to find that the infected
file is specified but not the e-mail message that carried the payload.

In most cases, as a network engineer of some 28+ years, I want the
file AND the message flagged so I can gather all pertinent information
as to the sender, ISP, what SMTP server allowed the file to pass and
as much routing info as can be gleamed from the RFC-822 header info.

Anyway ... I ramble. In the end to each their own. Whatever YOU feel
secure doing is what plan of action you need follow.

Opinions are like buttholes. Everybody has one BUT, covering your own
is your most critical mission.

- --
Regards,
 D Gerard Raftery Sr.

If the automobile had followed the same development cycle as the computer, a 
Rolls-Royce today would cost $100, get a million miles to the gallon, and explode once 
a year, killing everyone inside.

-BEGIN PGP SIGNATURE-
Version: PGP for Business Security 6.0

iQA/AwUBPaSybmGmTEg4iItaEQJ4RACfSYQLo9Cg37Z2UCrCVo7NiYzcWqgAn1z2
U9+Va4orSb91t+JeF6IXuHEN
=7BzW
-END PGP SIGNATURE-



Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



Re[2]: what are bat*.tmp files?

2002-10-09 Thread D Gerard Raftery Sr.

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Wednesday, October 09, 2002
6:53:41 PM
RE: what are bat*.tmp files?

Greetings Doug,

On Wednesday, October 9, 2002, 6:30:52 PM, you wrote:

DW Do I gather it doesn't actually mark either outgoing or incoming
DW email?

Mark as how? With the This message has been certified virus free by
blah, blah, blah etc.? One the freeware AVG does not do this as only
the Pro version does and two, The_Bat! plugin supports this feature in
neither the freeware nor Pro versions.

Why would you want that garbage at the end of incoming or outgoing
mail anyway. In most cases the receiver (either you or those to whom
you send an e-mail to) don't really care what the sender's system did.

- --
Regards,
 D Gerard Raftery Sr.

If at first you don't succeed, call it version 1.0.

-BEGIN PGP SIGNATURE-
Version: PGP for Business Security 6.0

iQA/AwUBPaS0tmGmTEg4iItaEQJtogCg4Q5BlzU/NkVprnBwj+CRd/j7MvIAn1Ac
aSI6eHtO7s/hpmy7dNzu4pFo
=FVvK
-END PGP SIGNATURE-



Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



Re[3]: what are bat*.tmp files?

2002-10-09 Thread Scott McNay


Hi, Gerard!

Wednesday, October 9, 2002, 6:08:22 PM, you wrote:

DGRS Mark as how? With the This message has been certified virus free by
DGRS blah, blah, blah etc.? One the freeware AVG does not do this as only

DGRS Why would you want that garbage at the end of incoming or outgoing
DGRS mail anyway. In most cases the receiver (either you or those to whom
DGRS you send an e-mail to) don't really care what the sender's system did.

Would  make an excellent trojan horse too.  Well, his message said it
was  checked  for  viruses!!!.   IMO, it's just more useless stuff to
impress the easily impressed.

-- 
--Scott.
mailto:[EMAIL PROTECTED]


Using The Bat! 1.61 under Windows XP 5.1 Build 2600  on an AMD Athlon XP 1900 (1.6G 
real, 1.9G effective) with 512MB.




Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



Re: what are bat*.tmp files?

2002-10-08 Thread Jonathan Angliss

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On Tuesday, October 08, 2002, achdut wrote...

 Hi, everyone. Can someone explain to me what the signficance, if
 any, is of files that appear in the Local Settings\Temp subdirectory
 that are named bat*.tmp, where the * represents any two- to
 four-character alphanumeric combination? These files appear in the
 temp subdirectory only on occasion after I have downloaded e-mail.
 There must be nothing in these files, since the size is 0kb.
 Additonally, they only seem to appear when I have received an error
 message that reads something like: ezTrustAntivirus real-time
 protection has found that C:\DOCUME~1\USER\LOCALS~1\Temp\bat4D2.tmp
 was infected with HTML.MimeExploit virus and has restored the file.
 Curiously, when I run a search for the infected file, it does not
 appear anywhere on the hard drive. This has happened three times in
 the past several days. Can I safely delete all of those .tmp files?

The temp files are there so that TB can write the file locally before
trying to insert into the message base. A safety precaution if you
will, because I'm sure it won't do the message base any good if you
download half completed mails into it ;)

As for the reason the files are there, and not deleted, you gave
yourself the reason. Your virus scanner reads all data being written
to the drive, and as it sees the virus signature, it stops the write,
this returns an error to TB! as your virus scanner returns a simple
file lock message (a cheating way to stop a program from writing
data), so TB! cannot write to the file, so assumes it cannot destroy
it either. This would mean there is something wrong with it, so it
skips onto the the next message.

Yes it is safe to delete them, you may want to make sure TB! is closed
when you do it, as you probably don't want to catch it half-way
through writing a temp file ;)

- --
Jonathan Angliss
([EMAIL PROTECTED])

-BEGIN PGP SIGNATURE-
Comment: Fingerprint: 676A 1701 665B E343 E393  B8D2 2B83 E814 F8FD 1F73

iQA/AwUBPaHSYCuD6BT4/R9zEQJtRACg6EAw093hWmX77cwOkvst3Fh03EcAnRNF
Pi3RbcjfXsM9sQBJcs7EkrP9
=bMqh
-END PGP SIGNATURE-



Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



Re: what are bat*.tmp files?

2002-10-08 Thread Avram_Sacks




Hi, Jonathan, and anyone else listening in.   I originally asked:
 Can someone explain to me what the significance, if
 any, is of files that appear in the Local Settings\Temp subdirectory
 that are named bat*.tmp, where the * represents any two- to
 four-character alphanumeric combination? These files appear in the
 temp subdirectory only on occasion after I have downloaded e-mail.
 There must be nothing in these files, since the size is 0kb.

Jonathan Angliss [EMAIL PROTECTED] on 10/07/2002 replied:

The temp files are there so that TB can write the file locally before
trying to insert into the message base.
As for the reason the files are there, and not deleted, you gave
yourself the reason. Your virus scanner reads all data being written
to the drive, and as it sees the virus signature, it stops the write,
this returns an error to TB! as your virus scanner returns a simple
file lock message (a cheating way to stop a program from writing
data), so TB! cannot write to the file, so assumes it cannot destroy
it either. This would mean there is something wrong with it, so it
skips onto the next message.

If I understand you correctly, under normal circumstances, where no virus is
present, the temp file gets erased once it is scanned and found clean so that
the message body can be inserted into the database.   Correct?  If so, this
raises several questions:

1.  why would there be more empty bat*.tmp files than error messages warning of
a virus.  For example,  I might have 200 messages to download, receive one error
message during the download warning of the presence of the MimeExploit virus
[which shouldn't affect me anyway since I am running IE 6.0]  but will still
find perhaps a dozen or two dozen empty bat*.tmp files.   Shouldn't there be a
one-for-one correspondence between the number of virus warnings I get and the
number of empty bat*.tmp files sitting in the Temp directory?

2.  Because I use eZTrust antivirus, I don't have a plug-in for The Bat.   I
thought plug-ins were what allowed incoming messages to be scanned.   However,
it seems that I am getting those messages scanned anyway, correct?So, what
does a plug-in do that my setup doesn't already accomplish?

Thanks for  your help,

--
Avi
Avram Sacks
Chicago, IL
[EMAIL PROTECTED]
[EMAIL PROTECTED]
using The Bat ver. 1.61 on Windows XP home




Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



Re: what are bat*.tmp files?

2002-10-08 Thread Jonathan Angliss

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On Tuesday, October 08, 2002, [EMAIL PROTECTED] wrote...

 The temp files are there so that TB can write the file locally
 before trying to insert into the message base. As for the
 reason the files are there, and not deleted, you gave yourself the
 reason. Your virus scanner reads all data being written to the
 drive, and as it sees the virus signature, it stops the write, this
 returns an error to TB! as your virus scanner returns a simple file
 lock message (a cheating way to stop a program from writing data),
 so TB! cannot write to the file, so assumes it cannot destroy it
 either. This would mean there is something wrong with it, so it
 skips onto the next message.

 If I understand you correctly, under normal circumstances, where no
 virus is present, the temp file gets erased once it is scanned and
 found clean so that the message body can be inserted into the
 database. Correct?

Yes under normal circumstances, and in a perfect environment.
Unfortunately Windows is faaar from perfect ;)

 If so, this raises several questions:

 1. why would there be more empty bat*.tmp files than error messages
 warning of a virus. [...] Shouldn't there be a one-for-one
 correspondence between the number of virus warnings I get and the
 number of empty bat*.tmp files sitting in the Temp directory?

Not always, but in theory yes. The problem arises when your virus
scanner monitors all file system activity, both read and write to the
disk. The order of things works like so:

 - Mail Comes in
 - TB Creates Temporary File
 - Virus scanner checks temporary file
 - TB Writes data to temporary File
 - Virus scanner reads data
 - TB moves temporary data out of temporary file into message base
 - Virus scanner reads data movement between two
 - TB tries to delete temporary file
 - Virus scanner reads delete attempt
 - TB *might* get a file lock if virus scanner is still scanning, at
   which point TB leaves the file.

It is the last two events that cause the temp files to stay in most
cases. If the virus scanner has hold of the temporary file for just a
little too long, then the file cannot be deleted. Did I make it a
little clearer this time? At least that is the way I'm seeing things
working anyway. I write software, and we have a hell of a time with
temporary files and virus scanners because of the above order of
things.

 2. Because I use eZTrust antivirus, I don't have a plug-in for The
 Bat. I thought plug-ins were what allowed incoming messages to be
 scanned. However, it seems that I am getting those messages scanned
 anyway, correct? So, what does a plug-in do that my setup doesn't
 already accomplish?

Yes and no.  Yes your mail is being scanned, but that is because it is
being written to a temporary file first, and your virus scanner is set
to scan for disk read/writes.  If you were to do it via a plugin, the
method of scanning would be while the message is being put into the
stream inside TB and would result in no disk writing until the scan is
complete.  If a virus is found, then it follows the settings in your
plugin.

- --
Jonathan Angliss
([EMAIL PROTECTED])

-BEGIN PGP SIGNATURE-
Version: 6.5.8ckt

iQA/AwUBPaMVSyuD6BT4/R9zEQK/3ACfZXDWEHFtYzceWbHMaXf0vqZQITUAnRiy
nO1UKMeecQLm2Xj6K6GR5fIw
=gEpX
-END PGP SIGNATURE-



Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



Re: what are bat*.tmp files?

2002-10-08 Thread Avram_Sacks



I asked,
So, what does a plug-in do that my setup doesn't
 already accomplish?

To which Jonathan Angliss [EMAIL PROTECTED] replied:

Yes your mail is being scanned, but that is because it is
being written to a temporary file first, and your virus scanner is set
to scan for disk read/writes.  If you were to do it via a plugin, the
method of scanning would be while the message is being put into the
stream inside TB and would result in no disk writing until the scan is
complete.  If a virus is found, then it follows the settings in your
plugin.

Thanks, again.  Your explanation this time, was much more clear.   Given my
setup, is there any reason (in terms of catching viruses from incoming messages)
why it would be advantageous for me to move to AV software, such as AVG, or some
of the others mentioned on this list that have plug-ins for The Bat?   Any
reason to just let well enough alone?

[There might be other reasons for me to switch, e.g., I can't get eZTrust to
automatically download using Windows scheduler--but that is an issue for another
list]

--
Avi
Avram Sacks
[EMAIL PROTECTED]
[EMAIL PROTECTED]
using The Bat ver. 1.61 on Windows XP home




Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



Re: what are bat*.tmp files?

2002-10-08 Thread Gerard


ON Tuesday, October 8, 2002, 8:01:11 PM, you wrote:

JA On Tuesday, October 08, 2002, [EMAIL PROTECTED] wrote...


JA It really depends. Using a virus plugin will allow you to quarantine
JA the mail withing TB! and actually look at the mail, but not
JA execute/open any attachments.

Hi Jonathan,
   The Norton quarantine function offers the same functionality. The
   difference is that you can only see the text of the email in Norton.

-- 
Best regards,
 Gerard 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
I am an Insomniac, agnostic, Egotist: I lie awake nights wondering
whether I believe that I am as great as I think I am.


 Using The Bat! v1.61 on Windows 2000 5.0 Build 2195 Service Pack 3



Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



Re: what are bat*.tmp files?

2002-10-08 Thread Avram Sacks

Hi, again.  It seems like each answer prompts another question.  This time,
Jonathan Angliss [EMAIL PROTECTED] wrote:

Using a virus plugin will allow you to quarantine
the mail withing TB! and actually look at the mail, but not
execute/open any attachments. This is an advantage if you are after
the actual email itself, and want to alert the real sender of
infection (note that Klez and others spoof from headers, and if you
set the virus scanner to auto-alert the person, you'll probably get a
few upset replies).  

I thought I was already able to look at the mail because whenever I get the
warning from the AV program, it says
...real-time protection has found that [filename] was infected with
HTML.MimeExploit virus and has *restored the file.*  (emphasis added), AND,
I am able to find an e-mail in my in-box that has all the earmarks of it
having carried a virus (unexpected attachments from unknown senders).  I
open these e-mails to add the sender's ISP to my filter list if the ISP
looks bogus, such as where it's a random alphanumeric combination followed
by .com, or some cutsy nomenclature like just4u.com but I don't open the
attachments, which almost all invariably have the .exe extension.   (I
really like it that The Bat does NOT automatically open attachments.)

Aren't these e-mails the ones that my AV software found infected,
particularly since it has told me that it has restored the file?   If so,
then there really is no advantage to using plug-ins. No?


Of course, if you're not too worried about seeing
the content of these 'infected' files, and trust your virus scanner to
make a valued judgement about the email (knowing that it only matches
signatures, and doesn't care about content), then you can just stick
with using an external virus scanner.

How is eZTrust-AV matching signatures?   What signatures is it matching, and
with what? I don't use an address book, although I do have filters in The
Bat for trash.  But why should the AV software care about what filters I am
using? Also, if I what I said above about the file being restored is
correct, then it seems to me that the AV software is letting me make the
decision about whether to dump the message or not.   

Again, thanks for your patience is answering these questions.
-- 
Avi
Avram Sacks
[EMAIL PROTECTED]
[EMAIL PROTECTED]
using ver. 1.61 of The Bat on Windows XP home




Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



Re: what are bat*.tmp files?

2002-10-08 Thread Thomas F.

Hello Avram,

On Tue, 8 Oct 2002 12:48:33 -0500 GMT (09/10/02, 00:48 +0700 GMT),
[EMAIL PROTECTED] wrote:

Acc Thanks, again. Your explanation this time, was much more clear.
Acc Given my setup, is there any reason (in terms of catching viruses
Acc from incoming messages) why it would be advantageous for me to
Acc move to AV software, such as AVG, or some of the others mentioned
Acc on this list that have plug-ins for The Bat?

You won't have the nasty bat*.tmp files. ;-)

Acc Any reason to just let well enough alone?

Happiness with your current virus-scanner, maybe.

BTW it might be interesting for your to know that I get a lot of
bat*.tmp files as well. The reason is that I am on dial-up, and my
connection breaks automtically after 20 minutes. If TB is in the
process of downloading an email, these files (with 0 KB size) will
remain in the Windows\Temp directory.

-- 

Cheers,
Thomas.

Moderator der deutschen The Bat! Beginner Liste.

A day without fusion is like a day without sunshine.

Message reply created with The Bat! 1.62/Beta1
under Chinese Windows 98 4.10 Build  A 
using an AMD Athlon K7 1.2GHz, 128MB RAM



Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



Re: what are bat*.tmp files?

2002-10-08 Thread Jonathan Angliss

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On Tuesday, October 08, 2002, Avram Sacks wrote...

 Aren't these e-mails the ones that my AV software found infected,
 particularly since it has told me that it has restored the file?
 If so, then there really is no advantage to using plug-ins. No?

I didn't realise your mail was still being delivered.  This may be
okay for the files it can fix, but for those it cannot, you'll find
them relegated to the virus scanners quarantine, or even deleted
completely.

Of course, if you're not too worried about seeing the content of
these 'infected' files, and trust your virus scanner to make a
valued judgement about the email (knowing that it only matches
signatures, and doesn't care about content), then you can just stick
with using an external virus scanner.

 How is eZTrust-AV matching signatures?   What signatures is it matching, and
 with what?

When I say signatures I mean the signatures of a virus itself.  I
didn't mean the email has a nice footer at the bottom saying I'm a
virus ;)  Take for example eicar (test virus), the signature starts:

X5O!P%@AP[4\PZX54(P^)7CC... (you can see the rest at
http://www.eicar.org/anti_virus_test_file.htm)

You can write that signature to a text file, save as a .com and then
scan it, and it'll be detected.  A virus scanner just keeps a
dictionary of such signatures, and then does matches based on those
signatures.  Imagine a signature as a finger print for each virus.
Each virus has it's own finger print.

 I don't use an address book, although I do have filters in The Bat
 for trash. But why should the AV software care about what filters I
 am using?

It doesn't. I believe we may have mixed ideas (or I may have confused
you) about the term 'signature' in this context.

  Also, if I what I said above about the file being restored
 is correct, then it seems to me that the AV software is letting me
 make the decision about whether to dump the message or not.

It depends on the virus really. If the virus is not removable, or the
file cannot be repaired, then your virus scanner will most likely move
it to it's own quarantine, or even just trash it. The other option is
that some virus scanners now come with in built pop/smtp connection
scanning. It 'hijacks' the connections made on the related ports,
reads the email, if it matches a 'fingerprint' of a virus, it
re-writes the email, removing the attachment, and often putting a text
file in it's place. This 'feature' is all dependant of the virus
scanner you have installed. I know Norton 2002 does this, but not sure
about yours.

 Again, thanks for your patience is answering these questions.

You're welcome... :)

- --
Jonathan Angliss
([EMAIL PROTECTED])

-BEGIN PGP SIGNATURE-
Version: 6.5.8ckt

iQA/AwUBPaMp0iuD6BT4/R9zEQIS+ACfbSrg/BGa6x6xCSfgyVo2xQnASV0AoOfj
G4mLJHEZDJ8H/1rcXdh2B9PM
=gM+n
-END PGP SIGNATURE-



Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



Re: what are bat*.tmp files?

2002-10-08 Thread Doug Weller

Hi,

Does the AVG plugin work with the free version of AVG? And where do
you get it? (I have already bought Trend's Pc-Cillin, but would like
to try the AVG plugin).

Thanks.

Doug

-- 
 Doug Weller  Moderator, sci.archaeology.moderated
 Submissions to:[EMAIL PROTECTED]
 Doug's Archaeology Site: http://www.ramtops.demon.co.uk
 Co-owner UK-Schools mailing list: email me for details



Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



Re: what are bat*.tmp files?

2002-10-08 Thread Jonathan Angliss

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On Tuesday, October 08, 2002, Doug Weller wrote...

 Does the AVG plugin work with the free version of AVG? And where do
 you get it? (I have already bought Trend's Pc-Cillin, but would like
 to try the AVG plugin).

funny... I downloaded this this morning after scanning the archives...
just being curious and all ;)

ftp://ftp.ritlabs.com/pub/the_bat/bav/

- --
Jonathan Angliss
([EMAIL PROTECTED])

-BEGIN PGP SIGNATURE-
Version: 6.5.8ckt

iQA/AwUBPaNRWSuD6BT4/R9zEQID7QCg2gO6iYLGZV99gPqc3iiB0mZIR58AoKFo
JPQ25D/8ykptkZHY9AuA3Idt
=z3iq
-END PGP SIGNATURE-



Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



Re: what are bat*.tmp files?

2002-10-08 Thread Doug Weller

Hi Jonathan,

Tuesday, October 8, 2002, 10:42:45 PM, you wrote:

 On Tuesday, October 08, 2002, Doug Weller wrote...

 Does the AVG plugin work with the free version of AVG? And where do
 you get it? (I have already bought Trend's Pc-Cillin, but would like
 to try the AVG plugin).

 funny... I downloaded this this morning after scanning the archives...
 just being curious and all ;)

 ftp://ftp.ritlabs.com/pub/the_bat/bav/

Thanks.  Now to figure out how to install it, and where the Nod32 is
for my other half's TheBat!

Doug


-- 
 Doug Weller  Moderator, sci.archaeology.moderated
 Submissions to:[EMAIL PROTECTED]
 Doug's Archaeology Site: http://www.ramtops.demon.co.uk
 Co-owner UK-Schools mailing list: email me for details



Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



Re: what are bat*.tmp files?

2002-10-08 Thread Jonathan Angliss

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On Tuesday, October 08, 2002, Doug Weller wrote...

 Does the AVG plugin work with the free version of AVG? And where do
 you get it? (I have already bought Trend's Pc-Cillin, but would like
 to try the AVG plugin).

 funny... I downloaded this this morning after scanning the archives...
 just being curious and all ;)

 ftp://ftp.ritlabs.com/pub/the_bat/bav/

 Thanks.  Now to figure out how to install it, and where the Nod32 is
 for my other half's TheBat!

Installation is easy, drop it into your TB Folder, then go into
Options - Virus Protection - Add then select the .bav file :)

- --
Jonathan Angliss
([EMAIL PROTECTED])

-BEGIN PGP SIGNATURE-
Comment: Fingerprint: 676A 1701 665B E343 E393  B8D2 2B83 E814 F8FD 1F73

iQA/AwUBPaLc4CuD6BT4/R9zEQJ53wCgwuWiz5GDu/PSzL5KihmCwRVdYrUAoPPv
uC2GfLIYCOplQQ9yyghcdQbH
=EcIR
-END PGP SIGNATURE-



Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



Re: what are bat*.tmp files?

2002-10-08 Thread Sudip Pokhrel

Hi Thomas,

On Wednesday, October 9, 2002 01:06 your local time, (Tuesday, 23:51
my local time), you [TF] wrote:

TF The reason is that I am on dial-up, and my connection breaks
TF automtically after 20 minutes.

Why?

-- 
be well,
Sudip Pokhrel |/\
PM: [EMAIL PROTECTED] |\ / ASCII Ribbon Campaign
PGP Key ID: 0xD93F5185| X  Against HTML E-mail !
http://pgpkeys.mit.edu|/ \
___
Age doesn't always bring wisdom. Sometimes age comes alone
___
TB! v1.61 on XP Pro|
P4-1.6Ghz 256MB RAM|



Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



Re: what are bat*.tmp files?

2002-10-08 Thread Thomas F.

Hello Sudip,

On Wed, 9 Oct 2002 08:26:30 +0545 GMT (09/10/02, 09:41 +0700 GMT),
Sudip Pokhrel wrote:

TF The reason is that I am on dial-up, and my connection breaks
TF automtically after 20 minutes.

SP Why?

Because I do not have a direct telephone line. In order to dial out
from my appartment, I have to dial 9, like in a hotel. The call will
go via the appartment building's switchboard (yes, it is a classic
PABX). Since they have only 24 lines for 80 or so appartments, the
time for each call is limited to 20 minutes, the PABX will cut me off
after that. So that not a few tenants block all the lines.

I can apply for a direct phone line directly with one of the
fixed-line providers, and it is not even expensive. However, I have
been planning to move to a bigger appartment, and am still looking;
that's why I don't have that direct line yet.

f'up2:tbot.

-- 

Cheers,
Thomas.

Moderator der deutschen The Bat! Beginner Liste.

Some people have a photographic memory but with the lens cover glued
on.

Message reply created with The Bat! 1.62/Beta1
under Chinese Windows 98 4.10 Build  A 
using an AMD Athlon K7 1.2GHz, 128MB RAM



Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



Re: what are bat*.tmp files?

2002-10-08 Thread Doug Weller

Hi Jonathan,

Tuesday, October 8, 2002, 10:42:45 PM, you wrote:

 On Tuesday, October 08, 2002, Doug Weller wrote...

 Does the AVG plugin work with the free version of AVG? And where do
 you get it? (I have already bought Trend's Pc-Cillin, but would like
 to try the AVG plugin).

 funny... I downloaded this this morning after scanning the archives...
 just being curious and all ;)

 ftp://ftp.ritlabs.com/pub/the_bat/bav/


Which of those is the AVG plugin though? Found the Nod32 one, which I
also need.

Thanks.

Doug

-- 
 Doug Weller  Moderator, sci.archaeology.moderated
 Submissions to:[EMAIL PROTECTED]
 Doug's Archaeology Site: http://www.ramtops.demon.co.uk
 Co-owner UK-Schools mailing list: email me for details



Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



Re[2]: what are bat*.tmp files?

2002-10-08 Thread Scott McNay

Hi, Thomas!

Tuesday, October 8, 2002, 11:40:50 PM, you wrote:

TF The reason is that I am on dial-up, and my connection breaks
TF automtically after 20 minutes.

TF PABX). Since they have only 24 lines for 80 or so appartments, the
TF time for each call is limited to 20 minutes, the PABX will cut me off
TF after that. So that not a few tenants block all the lines.

Also, some ISPs limit the time.

-- 
--Scott.
mailto:[EMAIL PROTECTED]

Using The Bat! 1.61 under Windows XP 5.1 Build 2600  on an AMD Athlon XP 1900 (1.6G 
real, 1.9G effective) with 512MB.




Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



Re: what are bat*.tmp files?

2002-10-08 Thread Sudip Pokhrel

Hi Doug,

On Wednesday, October 9, 2002 05:51 your local time, (10:36 my local
time), you [DW] wrote:

DW Which of those is the AVG plugin though? Found the Nod32 one,
DW which I also need.

You can get AVG plug-in directly from Grisoft:

http://files.grisoft.cz/softw/thebat/avgbat9us.exe


-- 
be well,
Sudip Pokhrel |/\
PM: [EMAIL PROTECTED] |\ / ASCII Ribbon Campaign
PGP Key ID: 0xD93F5185| X  Against HTML E-mail !
http://pgpkeys.mit.edu|/ \
___
John Lennon -- ///o-o\\
___
TB! v1.61 on XP Pro|
P4-1.6Ghz 256MB RAM|



Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html



what are bat*.tmp files?

2002-10-07 Thread achdut

Hi, everyone. Can someone explain to me what the signficance, if any,
is of files that appear in the Local Settings\Temp subdirectory that
are named bat*.tmp, where the * represents any two- to
four-character alphanumeric combination? These files appear in the
temp subdirectory only on occasion after I have downloaded e-mail.
There must be nothing in these files, since the size is 0kb.
Additonally, they only seem to appear when I have received an error
message that reads something like: ezTrustAntivirus real-time
protection has found that C:\DOCUME~1\USER\LOCALS~1\Temp\bat4D2.tmp
was infected with HTML.MimeExploit virus and has restored the file.
Curiously, when I run a search for the infected file, it does not
appear anywhere on the hard drive. This has happened three times in
the past several days. Can I safely delete all of those .tmp files?

-- 
Avi
Avram Sacks
Chicago, IL
runnning The Bat ver. 1.61 on Windows XP home



Current version is 1.61 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html