or the absolute easy way, and in my opinion the only, ban all exe files
attached in mail.
Have been doing this for several years now,
Benny
Colbeck, Andrew wrote:
Yes, and it should be old news by now.
http://isc.sans.org/diary.html?storyid=2071
The end of the page lists the four
?
# The in the LOGFILE option gets replaced with the month/date
LOGFILE E:\virus\vir.log
LOGLEVELMID
CONSOLE OFF
# SCANFILE is the location of the command-line virus scanner. Note that it
# must include the full path. VIRUSCODE is the code that scanner
well done that now
the rest of teh file is like this
# VIRDIR is the directory to move E-mails with viruses; by default,
# it is set to 'virus' (\IMail\spool\virus).
VIRDIR E:\virus
# The MAXATONCE option limits the number of AV processes. For example,
# MAXATONCE 1 will only allow 1
Hear Hear...
Have had so many problems with Imail, declude has so far kept me from going to other
systems
Benny
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Rodney Bertsch
Sent: 7. april 2004 19:40
To: [EMAIL PROTECTED]
Subject: RE:
Hi anyone else experienced problems with zipfile maked with the latest winzip version?
Reported by a user it is encryoting in a way per default so that declude take it as a
EZIP and block it.
Benny
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: 30. mars 2004 22:19
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] EZIP problem
Hi anyone else experienced problems with zipfile maked with
the latest
winzip
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: 30. mars 2004 22:19
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] EZIP problem
Hi anyone else experienced problems with zipfile maked with
the latest
winzip
Pls could someone post the link to the interim release...
Benny
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: 3. mars 2004 18:41
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] Passworded zip files still
getting
] [mailto:Declude.Virus-
[EMAIL PROTECTED] On Behalf Of ISPhuset Nordic AS
Sent: Sunday, January 04, 2004 12:54 PM
To: [EMAIL PROTECTED]
Subject: [Declude.Virus] OT windows eating all memory
Hi
I have in the last 3 - 4 weeks experienced that my w2k
and w2003 servers
running web and sql
Hi
I have in the last 3 - 4 weeks experienced that my w2k and w2003 servers running web
and sql suddenly has startet using all ram on
the servers
Booting them fix the problems for a day or three and then i have to boot again
Any other have seen the same ?
Benny
---
[This E-mail was scanned
: [Declude.Virus] How do i do
this
Is that english? o_O
- Original Message -
From:
ISPhuset Nordic
AS
To: [EMAIL PROTECTED]
Sent: Friday, December 05, 2003 1:03
PM
Subject: FW: [Declude.Virus] How do i
do this
So is this list now
We have a number of large customers who has serius problems with 'Blank Folding'
We would like to be able to skip scanning for this single problem until the problems
are solved on a per domain setting.
The reason to this is that there are no pattern in where the mail are coming from or
which
Unfortunately, the only way to do this is to turn off all vulnerability
detection, which is not recommended. But if you feel the benefits of
allowing some vulnerabilities through outweighs the risks of letting all
vulnerabilities through, that is your decision (you can use BANCRVIRUSES
OFF
after putting in this BANCRVIRUSES OFF
I still get this
[Outlook 'Boundary Space
Gap' Vulnerability] / [No attachment]
Why ?
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of ISPhuset Nordic AS
Sent: 31. oktober 2003 15:48
To: [EMAIL PROTECTED]
Subject
Last time i was on the web pages for Imail there where a page of third party tools
Loganalyzeres and declude and so on, but now I only find 3 links there and all of them
looks like close companies to Ipswich. Is
this a new policy or have I just blind ?
Anyone have the link for the
problems with new server
Are you using Imail AntiSpam DNS tests?
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED] On Behalf Of ISPhuset Nordic AS
Sent: Tuesday
] [mailto:Declude.Virus-
[EMAIL PROTECTED] On Behalf Of ISPhuset Nordic AS
Sent: Wednesday, October 15, 2003 12:22 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] Huge problems with new server
No I am running 7.13
It occurs only when i load the Iadmin interface on the server
after testing som
http://authorizations.net/
sending this mail as html, the webpage looks ok but I can't take such email serious
Benny
Attention! In our global system of monitoring there was a technical failure.
In avoidance of frauds with your credit card enter the full data for authorization,
otherwise your
Moving an imail server to a never box but it is running so slow that u can't imagine
the new box is a
4 way Xeon 1,4 MP with 4 cpu's
4 GB of ram
256 mb on the scsi controller
running 2003 standard server
and still opening imail admin on the server is taken forever
it is showing about 1 virtual
server
Make sure you are running a multi processor version of the operating system
otherwise your screwed...
- Original Message -
From: ISPhuset Nordic AS [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, October 14, 2003 12:51 PM
Subject: [Declude.Virus] Huge problems with new
Anyone having an idea why this mail is assumed to be an exe when its actually a doc
file ?
Benny
10/07/2003 15:18:38 Qbd2e1e29004e9eb1 Found file with mismatched extensions
[=?ISO-8859-1?Q?Supportm=F6nster.do?==?ISO-8859-1?Q-=?ISO-8859-1?Q?Supportm=F6nster?==?ISO-8859-1?Q?.d];
assuming .exe
Why is this mail cached by the blank folder
I can't see anywhere that there are an error which should cause this
Benny
Received: from mailgw2.mailserveren.com [213.236.237.229] by mx2.mailserveren.com with
ESMTP
(SMTPD32-7.13) id AE3826FC0024; Fri, 03 Oct 2003 11:15:36 +0200
Received: from
so just a wild guess if u sent to a group of your contacts in Outlook and is has a bad
adresss this can happen ?
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: 3. oktober 2003 15:35
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus]
The problem is that folding is used to take a long line and split it up
into several smaller lines (if you have looked at Received: headers, most
of them do this -- if the header starts with a space or a tab, it is a
continuation of the previous line). However, with just a single space or
ok just trying to figure out why this is coming in the mail
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: 3. oktober 2003 16:52
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] Blank Folding
thats right but if I send an email
Title: Message
-Original Message-From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf Of Sharyn SchmidtSent: 29. september 2003
13:35To: [EMAIL PROTECTED]Subject: RE:
[Declude.Virus] Swen... Incredible..
Not a single person in the domains hosted on our
Anyone here having anything like the domlist.exe for the virus log
I would like to create som stats for who is sending virus and to whom its coming
Benny
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing
Anyone her knowing how to create a report with the folder size for the mailusers
i know how to list out the mailbox size but what i want is to get at report where the
total folder size is listed... banging my head
here
Benny
---
[This E-mail was scanned for viruses by Declude Virus
just using SKIPIFVIRUSNAMEHAS Sobig and that seems to work
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Steve Flook
Sent: 20. august 2003 14:45
To: Declude Virus Mailing list (E-mail)
Subject: [Declude.Virus] Skipping Sobig.F virus notifications
I
configuration file do you put 'SKIPIFVIRUSNAMEHAS Sobig' in and
what exactly does it do with the message.
New ISP owner,
Tim Collins
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of ISPhuset Nordic AS
Sent: Wednesday, August 20, 2003 7:00 AM
To: [EMAIL
Have sett up the server in the exact same with one exception
on the old server i use f-prot312c
on the new server i user f-prot314a_m
when i run a test with eicar.com on the server localy in webmail
it slips through when i have i only the on demand scanner installed
copy of config
#
#
server, I
seem to remember something a while back about needing a later version of
Imail or Declude to catch webmail based virus attachments.
Jim Matuska Jr.
Computer Tech II
CCNA
Nez Perce Tribe
Information Systems
[EMAIL PROTECTED]
- Original Message -
From: ISPhuset Nordic AS [EMAIL
That fixed it
thanks a lot
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: 12. august 2003 22:47
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] problems when testing a new server
with the new engine and using f-prot.exe and
ahh that explains a lot
thought for a moment here it was my scanner messing with me
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: 12. august 2003 22:27
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] problems when testing a new
Yes its anew variant of Bugbear worse than the first one
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Greg Foulks
Sent: 5. juni 2003 15:52
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] [OT]: BugBear
No but man did we get hit with Sobig last
35 matches
Mail list logo
