[Declude.Virus] links on declude site

2004-04-13 Thread Bonno Bloksma
Hi Scott, I had a link in my messages about blocking vulnerabilities. [.] If you need more info about thesevulnerabilities take a look at the the decludesite http://www.declude.com/virus/vulnerability.htm This link no longer seems to work. It's all messages now on your site. Will

RE: [Declude.Virus] BANEZIPEXTS and BANZIPEXTS question and suggestion

2004-04-13 Thread R. Scott Perry
The new site looks good. Thank you. :) But where can I find the interim releases now? The new location is http://www.declude.com/version/interim . -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000.

Re: [Declude.Virus] getting this in my logfile

2004-04-13 Thread R. Scott Perry
04/13/2004 11:21:23 Qb1072b82012a066d Could not find parse string Infection in report.txt 04/13/2004 11:21:23 Qb1072b82012a066d Error 8 in virus scanner 1. 04/13/2004 11:21:23 Qb1072b82012a066d Scanned: Error in virus scanner. [MIME: 2 270831] the mail with attachment are being hold Its a

RE: [Declude.Virus] getting this in my logfile

2004-04-13 Thread ISPhuset Nordic AS
? # The in the LOGFILE option gets replaced with the month/date LOGFILE E:\virus\vir.log LOGLEVELMID CONSOLE OFF # SCANFILE is the location of the command-line virus scanner. Note that it # must include the full path. VIRUSCODE is the code that scanner

RE: [Declude.Virus] getting this in my logfile

2004-04-13 Thread R. Scott Perry
SCANFILEC:\f-prot\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOBOOT /DUMB /REPORT=report.txt This is indeed the standard F-Prot configuration. I can't explain why it is returning the exit code of 8, unless F-Prot switched to have that on by default (which could be the case). Since you

RE: [Declude.Virus] getting this in my logfile

2004-04-13 Thread ISPhuset Nordic AS
well done that now the rest of teh file is like this # VIRDIR is the directory to move E-mails with viruses; by default, # it is set to 'virus' (\IMail\spool\virus). VIRDIR E:\virus # The MAXATONCE option limits the number of AV processes. For example, # MAXATONCE 1 will only allow 1

[Declude.Virus] Mime headers question

2004-04-13 Thread Chuck Schick
I have a customer who is trying to send out Midi files as an attachment and his email is getting held because of the mime headers vulnerability. He is using Entourage as his mail client. Is it something about the way he is attaching the Midi file that is causing the issue? Or is it just because

Re: [Declude.Virus] Mime headers question

2004-04-13 Thread R. Scott Perry
I have a customer who is trying to send out Midi files as an attachment and his email is getting held because of the mime headers vulnerability. He is using Entourage as his mail client. Is it something about the way he is attaching the Midi file that is causing the issue? Or is it just because

Re: [Declude.Virus] Scott, what do you use to generate this report

2004-04-13 Thread Bill Landry
Very nice! Thanks for sharing this, Bill! Bill - Original Message - From: Bill [EMAIL PROTECTED] To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Sent: Tuesday, April 13, 2004 12:33 PM Subject: RE: [Declude.Virus] Scott, what do you use to generate this report Hi, I have a utility to do

Re: [Declude.Virus] Scott, what do you use to generate this report

2004-04-13 Thread Bill Landry
Bill, would you consider adding the OK count so that we could also see the counts and percentages of what was delivered successfully, as well. Thanks again, Bill - Original Message - From: Bill [EMAIL PROTECTED] To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Sent: Tuesday, April 13, 2004

[Declude.Virus] log entry and banned file extension question

2004-04-13 Thread Jeffrey Di Gregorio
Will someone explain what this log entry from my vir log means. Particularly the [MIME: 11 271688] part. The client is claiming the attachment is a .doc which I do not block. 04/13/2004 09:08:56 Q10890f9a01084f3b Scanned: Banned file extension. [MIME: 11 271688] 04/13/2004 09:08:56

Re: [Declude.Virus] log entry and banned file extension question

2004-04-13 Thread R. Scott Perry
Will someone explain what this log entry from my vir log means. Particularly the [MIME: 11 271688] part. The client is claiming the attachment is a .doc which I do not block. Most likely, it is using malformed headers (so it appears as both a .doc and other file extension), in which case

RE: [Declude.Virus] getting this in my logfile

2004-04-13 Thread Douglas Cohn
On this same subject. If you are using Fprot and have configured it exactly as you recommend on the WEBSITE will an Excel file with a dangerous Macro be detected? IE is there a middle ground with FPROT? I currently have /SERVER in my commandline and Viruscode 8 in my config (see below) because

RE: [Declude.Virus] getting this in my logfile

2004-04-13 Thread R. Scott Perry
If you are using Fprot and have configured it exactly as you recommend on the WEBSITE will an Excel file with a dangerous Macro be detected? It will not. But this recent development shows that the latest version of F-Prot may return an exit code of 8, whether or not you have requested it to.

RE: [Declude.Virus] Scott, what do you use to generate this report

2004-04-13 Thread Bill
The very last line shows the total message count including messages that did not fail any tests. My program, as it is now, does not look at any of the declude actions, just the tests failed. I primarily use it is to determine if any of the tests that I am using have quit working or how

RE: [Declude.Virus] Scott, what do you use to generate this report

2004-04-13 Thread Bill
Hi, I have a utility to do a quick analysis of my decMMDD.log file to discover test effectiveness. If anyone would like to use it, I have it available for free from my website: http://www.wamusa.com/wamtools The program is designed for LOGLEVEL MID but it may work for other levels. My