Many Thanks Scott.
Stu
At 05:12 PM 04/24/2002 -0400, you wrote:
I know I mentioned this before but thought I'd ask again.
Any chance of getting an I (for Inbound) or O (for Outbound) added to the
virus line in the log file at the MID level. So Inbound vs Outbound Viruses
can be tracked.
This
Now I don't know which address (nmiller or mmiller) Declude sends it's you
sent a virus message to. Maybe Scott can answer that, but if it is the
wrong address then sending that message to the sender could be skipped.
Declude Virus sends to the return address (from the SMTP envelope), which
in
The thing is, 655.120.133.104 is a central freight server...ergo it is
being sent from a system that I thought I had protected.
Ah, I see now. Then I would guess that your original thought may be
correct (that it was picked up from another source, such as another E-mail
account).
The Klez virus fakes the return email address using a valid addy but not the
one of the infected system... right??
Do all Klez variants do this?
~JP~
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
This E-mail came from the Declude.Virus mailing list. To
I hope so...job security is such a fleeting reality :)
Jim Rooth
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Thursday, April 25, 2002 8:00 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] Declude and F-Prot
The thing
Is it possible that the user also has an alternative account where they
cought the bug? (We have users who also insist on keeping hotmail or
other accounts - that is until they get hit with one of these).
_M
| -Original Message-
| From: [EMAIL PROTECTED]
| [mailto:[EMAIL PROTECTED]] On
I thought on the magistr virus every 5th address was possibly not altered?
Are all the return addresses bad? I have chosen not to skip this one to the sender as
20% of the time it reaches the infected sender. Maybe not exactly 20% but some success
anyway...
On Thursday, April 25, 2002 7:18
Would the notification emails be something like this:
SKIPIFVIRUSNAMEHAS Magistr
SKIPIFVIRUSNAMEHAS Kelz
ONLYSENDIFREMOTESENDER
From: postmaster@%LOCALHOST%
To: postmaster@%SENDERHOST%
Subject: Your mail server sent us a virus
Or
SKIPIFVIRUSNAMEHAS W32/Magistr.b@MM; W32/Klez.h@MM;
Another thought on a similar issue, is a way to prevent the remote
postmaster and sender notifications from bouncing when the senders address
is forged, I see this more often with Declude Junkmail than Anti-Virus, but
it would help cut down the hundreds of messages a day that are bouncing back
as
Here is the old line:
SCANFILE D:\Norman\nvc\bin\nvc32.exe /AF /B /BS- /C /N /Q /LF:.\report.txt
Here is the new line:
SCANFILE D:\Norman\nvc\bin\nvcc.exe /B /BS- /C /N /Q /LF:.\report.txt
Thanks for pointing that out. The manual has been updated to include the
nvcc.exe entry.
Man I hate that. I can't put desktop AV here so Declude is it! They
scream they have to have Hotmail then scream they have a virus. I love
my job! Here come the men in white coats so I must go now!
~Paul~
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of
Would the notification emails be something like this:
SKIPIFVIRUSNAMEHAS Magistr
SKIPIFVIRUSNAMEHAS Kelz
Like this -- although I'd use Klez instead. :)
SKIPIFVIRUSNAMEHAS W32/Magistr.b@MM; W32/Klez.h@MM; W32/Hybris.worm.B
This way will not work. This will look for a virus that has
I solved that by not using the BOUNCE, rather hold.
John Tolmachoff
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA 92835
www.reliancesoft.com
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Jim Matuska
Sent: Thursday, April 25, 2002
I hope so!
Jim Rooth
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Madscientist
Sent: Thursday, April 25, 2002 9:10 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] Declude and F-Prot
Is it possible that the user also has an alternative
Thanks For the great product and A++ support!!!
~Paul~
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Thursday, April 25, 2002 11:13 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] Another virus to skip notify
Would the
I have a unique problem that I swear is 100% user stupidity, but they swear
they're not at fault so I'm asking you folks if you've heard of anything
like this.
In the last month or so I've had three users complain about not being able
to get into their Outlook database. The first two kept their
Hi
Is this possible:
On the gateway server i want to recieve the mail and when its passed to my mailserver
it will be scanned by declude.
So that the server just recieve the mail without scanning and first when it pass it to
the other server it will be scanned on the
way out ?
Benny
---
Unfortunately we do occasionally get a legitimate message blocked even using
really mild tests, and it was decided that we needed to send a notification
to the sender of the message, even though 99% of the time it is all just
junkmail with a invalid return address. Is there any possibility you
Is this possible:
On the gateway server i want to recieve the mail and when its passed to my
mailserver it will be scanned by declude.
So that the server just recieve the mail without scanning and first when
it pass it to the other server it will be scanned on the
way out ?
I'm not entirely
I am using Declude Virus v1.46 with McAfee 6.0 with data files dated the
17th of this month.
Some Hi How are you viruses are allowed through if the attachment is a .txt
file. Shouldn't my setup catch these as well? Is anyone else having this
same issue?
The title of the message is: ~$li's
Is there any possibility you could
make declude send the bounce messages directly bypassing Imail completely,
and then just send them once, that way server resources wouldn't be tied up
trying to send them multiple times throughout the day and then declude could
just ignore the bounced bounce
I am using Declude Virus v1.46 with McAfee 6.0 with data files dated the
17th of this month.
Some Hi How are you viruses are allowed through if the attachment is a .txt
file. Shouldn't my setup catch these as well? Is anyone else having this
same issue?
That depends on your setup. The default
Declude scans the e-mail when it is received by IMail.
So if you set up a gateway server running Imail and Declude the gateway
server will scan the e-mail before it delivers it to your other mail server.
Stu
At 06:10 PM 04/25/2002 +0200, you wrote:
Hi
Is this possible:
On the gateway
Yes i know that
but what i wanted was that Imail recived it on the gateway and on the way out it to
the mailserver it would scan it.
this for speeding up the receiving
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of [EMAIL PROTECTED]
Sent: 25.
They scream they _Must_ have some outside account... I tell them, then
forward it through your account or take your chances... At least if it
comes through the main account we get a shot at it. Usually that works.
_M
| -Original Message-
| From: [EMAIL PROTECTED]
| [mailto:[EMAIL
Does the email get scanned for virii before Spam?
Craig.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus. You
26 matches
Mail list logo
