Re: [Declude.Virus] AVG 7.0 32-bit scanner find...extra space???

2004-02-07 Thread R. Scott Perry
I've already written tech support asking them if there are different result codes for avgscan.exe, and if there are none, if they could add them. If they do add them, please do post the information here. :) Here's what the DOS version provides:

Re: [Declude.Virus] How to stop BANNAME notifications in BANnotify.eml

2004-02-07 Thread R. Scott Perry
I have a problem. I just noticed that since adding the line BANNAME DELETED0.TXT to my Virus.cfg, my BANnotify.eml file is bouncing notifications in response to these files. I tried SKIPIFVIRUSNAMEHAS DELETED0.TXT, but that didn't work. The problem of course is that these files aren't in

Re: [Declude.Virus] Mail Freezing up...

2004-02-06 Thread R. Scott Perry
I am having a problem here... not sure if it is with declude or with f-prot. Thought I would ask here. What is happening is this. My mail will be coming in, I run task manager and see many declude.exe running. then all of a sudden mail will not come in. when I check the task manager this

Re: [Declude.Virus] XRBL WARNING - false report

2004-02-06 Thread R. Scott Perry
http://www.dnsreport.com/tools/dnsreport.ch?domain=comcast.net Shows they DO support the postmaster account. That actually just means that they *have* a postmaster account. However I get this in mail headers form any Comcast.net users. X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

Re: [Declude.Virus] How to turn off blank folding vulnerability filtering

2004-02-06 Thread R. Scott Perry
Just recently installed a Declude Virus trial (and will purchase). I'm finding the program to be as good as I expected having used Declude Junkmail for about a year. I'm having just one problem. Though I've put BANCRVIRUSES OFF in virus.cfg, messages with the blank folding vulnerability

Re: [Declude.Virus] IncrediMail Blank Folding vulnerability

2004-02-06 Thread R. Scott Perry
The problem: It looks like IncrediMail has introduced many new and very very important email features like colored backgrounds, emoticons, animations, ... but is not able to create a proper simple email. G Question: Are vulnerabilities like Blank folding non-RFC conform formats or is this simply

Re: [Declude.Virus] IncrediMail Blank Folding vulnerability

2004-02-06 Thread R. Scott Perry
I would much rather prefer to filter vulnerabilities with JunkMail. This stuff scares me. The fact that it scares you is exactly why it should be done with Declude Virus. Scott, isn't this somewhat the equivalent of a virus scanner going after Zap The Dingbat??? There's no virus there, just

Re: [Declude.Virus] IncrediMail Blank Folding vulnerability

2004-02-06 Thread R. Scott Perry
I totally get how wide the hole is, though I wonder about how many of these have been patched for some time? Still though, it doesn't seem to catch any viruses, just 99% spam, and maybe 1% legit E-mail. In fact a search of Google for some of the Vulnerabilities will turn up people bitching

Re: [Declude.Virus] MY Doom declude notification from @toplineus.com

2004-02-05 Thread R. Scott Perry
What version automatically stops the forging ( or ones that are deemed forging ) viruses from sending out emails to the receipent and/or other postmaster ? We are running v1.75 If you upgrade to 1.77 at http://www.declude.com/virus/manual.htm it will automatically stop the bogus

Re: [Declude.Virus] Where do they come from??

2004-02-03 Thread R. Scott Perry
Pardon my language... butDAM... Where are all these virus-infected emails coming from?? Are they coming from home computers, servers or what?? We went through a list of about 60,000 different IPs that were sending Mydoom, and got reverse DNS entries for them, to figure out who was sending

Re: [Declude.Virus] Virus report and log entry question

2004-02-03 Thread R. Scott Perry
Would it be possible to E-mail one of the quarantined D*.SMD files to our virustrap@ account? We can then analyze it and should be able to get a better idea of why this is happening. I sent sample d*.smd virus files and postmaster and log file txt to the virustrap account. It looks like

Re: [Declude.Virus] Virus report and log entry question

2004-02-03 Thread R. Scott Perry
I'm using Grisoft's AVG 7.0 professional, and I've been getting this a lot: 02/03/2004 08:44:02 Qb395000802285220 Error 6 in virus scanner 1. 02/03/2004 08:44:02 Qb395000802285220 Scanned: Error in virus scanner. [MIME: 2 800] I already emailed AVG, but haven't heard back. Anyone have any idea

Re: [Declude.Virus] Virus report and log entry question

2004-02-03 Thread R. Scott Perry
I resent it last night from my yahoo account. Did you receive it at the virustrap address? No -- the only E-mail to arrive there was the one from GroupShield for Exchange. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail

Re: [Declude.Virus] Virus report and log entry question

2004-02-03 Thread R. Scott Perry
Please check the virustrap mailbox again, hopefully third attempt is a charm... It came through -- it looks like the one from last night probably did as well, but got caught here. Are you running 3 virus scanners with Declude Virus? The only thing that I can think of that could account for

Re: [Declude.Virus] F-Prot and viruses

2004-02-03 Thread R. Scott Perry
I am using F-Prot with Declude Virus and have had something interesting happen today. I currently have Declude Virus set to delete emails with viruses. However, somehow a user was using webmail on my Imail server and sent a message that contained a virus to a user that has his account on our

Re: [Declude.Virus] Virus report and log entry question

2004-02-03 Thread R. Scott Perry
Are you running 3 virus scanners with Declude Virus? The only thing that I can think of that could account for this happening is if there are 3 or more virus scanners being used with Declude Virus. No, just two. We replaced McAfee with TrendMicro. Here are the actual virus scanner config

Re: [Declude.Virus] Virus Getting Through?

2004-02-02 Thread R. Scott Perry
This morning Norton caught a copy of MyDoom in my inbox. At first I assumed it was just one of the damaged variants, but I decided to track it down and make sure. Following is a log snippet from when the message came in. 20040201 205725 127.0.0.1 SMTPD (2CA400EE) [64.186.56.58]

RE: [Declude.Virus] Virus Getting Through?

2004-02-02 Thread R. Scott Perry
However, I think you hit it with the SMTP service being restarted. While I didn't restart it, I found this in the event log: The IMail SMTP Server service terminated unexpectedly. It has done this 8 time(s). The following corrective action will be taken in 0 milliseconds: No action. There is a

Re: [Declude.Virus] Virus report and log entry question

2004-02-02 Thread R. Scott Perry
This is indeed due to an issue with Declude Virus -- it will be fixed in the next interim release. Scott, I upgraded to Declude v1.77i26 and that took care of the file name issue - thanks! However, I am now noticing that about 1 in 10 postmaster messages is displaying virus in Unknown File,

Re: [Declude.Virus] Virus report and log entry question

2004-02-02 Thread R. Scott Perry
Attached are 5 recent samples. Let me know if you need more. Thanks -- that information is very helpful. It seems that the problem occurs when there are more than 2 MIME segments (perhaps these are coming from bounce messages). Would it be possible to E-mail one of the quarantined D*.SMD

Re: [Declude.Virus] Slow SMTP and Incrimenting Queue

2004-01-31 Thread R. Scott Perry
Processor is up around 85-90% If you use Task Manager, go to the Processes tab, and click the button that says CPU (which sorts by CPU usage), which process(es) are at the top of the list? -Scott --- Declude JunkMail: The advanced anti-spam

Re: [Declude.Virus] Questions on SKIPIFFORGING

2004-01-30 Thread R. Scott Perry
Using SKIPIFFORGING means we don't have to keep adding SKIPIFVIRUSNAMEHAS to the eml's for each new forging virus, right??? Can we then remove the SKIPIFVIRUSNAMEHAS lines? Correct -- *if* you are running the latest beta. What specifically do we put in virus.cfg and/or the individual eml's? Just

Re: [Declude.Virus] Suppressing MYDoom Postmaster Notifications

2004-01-30 Thread R. Scott Perry
Is there a quick way that I can suppress the notifications being sent to the sender... and the sender's postmaster The options are: [1] Upgrade to v1.77, which automatically supresses them, or [2] Delete the \IMail\Declude\sender.eml and \IMail\Declude\otherpostmaster.eml files, or [3] Manually

Re: [Declude.Virus] Suppressing MYDoom Postmaster Notifications

2004-01-30 Thread R. Scott Perry
Am I correct that if we don't have a current service agreement then we can't upgrade to any version above 1.75? It depends on when the Service Agreement expired. You are entitled to run any version that is released while your Service Agreement is active. Although we prefer that people run the

Re: [Declude.Virus] Multi-scanner Question

2004-01-30 Thread R. Scott Perry
Are multiple scanners run in series or concurrently? They are run in series. Since the virus scanners typically use up as close to 100% of the CPU time that they are given, if we switched to running them in parallel, an improvement would only be shown on servers with multiple processors.

Re: [Declude.Virus] FW: Your mail server sent us a virus

2004-01-30 Thread R. Scott Perry
Scott - did you ever find these guys? They still don't get it... Received: from prudentialrand.com [65.160.6.2] by mail.toplineus.com with ESMTP (SMTPD32-7.07) id A36A225A007C; Fri, 30 Jan 2004 10:08:26 -0500 We're still trying to track them the toplineus.com people.

Re: [Declude.Virus] Suppressing MYDoom Postmaster Notifications

2004-01-30 Thread R. Scott Perry
The current version number that we are running is 1.75. Our service agreement expired on 12/31/03. What is the highest version number we can upgrade to? The latest beta, v1.77, was released in December so you are entitled to run that version if you wish.

RE: [Declude.Virus] Multi-scanner Question

2004-01-30 Thread R. Scott Perry
If they are run in series, then wouldn't it be best to run the next scanner only if the previous scanner passed? In other words why scan the email again if it already failed one of the scanners? The logic behind that is the only a small fraction of E-mail contains a virus. Since the majority of

Re: [Declude.Virus] FW: Your mail server sent us a virus

2004-01-30 Thread R. Scott Perry
Scott - did you ever find these guys? They still don't get it... I finally got a hold of someone there. It looks like they will fix the problem, but I just have to convince them first that it wasn't really someone on your server that sent the virus. :)

Re: [Declude.Virus] Multi-scanner Question

2004-01-30 Thread R. Scott Perry
The best of both worlds approach would be to allow for a switch, SKIPIFFOUND ON. Removing the second scanner isn't a good option as variants can come at any time and both F-Prot and AVG lagged badly on picking up both Mimail.s and MyDoom.b. We will look into adding an option like this.

Re: [Declude.Virus] Mydoom.B

2004-01-29 Thread R. Scott Perry
Has anyone been catching any of these? I updated F-Prot this morning and verified that .B was in the virus list but still none have shown up. We are getting blasted with .A though. We're seeing about 5,000 Mydoom.A's for every 1 Mydoom.B, so you probably just have been lucky enough not to have a

RE: [Declude.Virus] MyDoom Virus got through!

2004-01-29 Thread R. Scott Perry
Since this is the only one I have seen as all else has been caught, I do not know the real virus size The size of what came in here is 14K. The real Mydoom.A is around 22K, so the one you got was definitely a corrupt (truncated) copy. One more question, everyone is talking about version 1.77ixx

Re: [Declude.Virus] OtherPostmaster notice

2004-01-29 Thread R. Scott Perry
Is the name of the file otherpostmaster1.eml or otherpostmaster.eml? It can be whatever you want, but the default one is otherpostmaster.eml For some reason, I have it as otherpostmaster1.eml but I am now seeing it in the manual as otherpostmaster.eml. Either way will work fine -- Declude Virus

Re: [Declude.Virus] Virus report and log entry question

2004-01-29 Thread R. Scott Perry
F-Prot is the first virus and the log samples I provided show the F-Prot did report the virus name. In fact, the log and postmaster report both use the first scanners reported virus name (in this case F-Prot reported the virus as Mydoom) instead of the second scanner (TrendMicro, which reports

Re: [Declude.Virus] Deleting quarrantined viruses

2004-01-28 Thread R. Scott Perry
Due to the overwhelming amount of MyDoom quarrantines, my virus folder is huge. I know this has been addressed, sorry, but can I just delete what is in there? Yes, you can, if you have no need for the viruses. :) You can also use the DELETEVIRUSES ON setting to automatically delete them.

Re: [Declude.Virus] Forging vs autoforge

2004-01-28 Thread R. Scott Perry
i'm still using forgingvirus and want to enable autoforge what will happen if a virus is marked by both ? You'll see [forged], and the notification won't be sent. can we change the autoforge action so it just tag the virus as forgingvirus ? It's on the to do list.

Re: [Declude.Virus] Scanning attachments

2004-01-28 Thread R. Scott Perry
Does the extension name of a file play in the proper scanning of an attachment? IE: If we rename a ZIP file to say test.ziz to get by the ban on ZIPs. Will it still get scanned ok? That's up to the virus scanner -- it *should* detect that it is a .ZIP file. F-Prot definitely does. So if it

Re: [Declude.Virus] [OT]: unexpected results with DNSreport.com

2004-01-28 Thread R. Scott Perry
I'm trying to understand the report results for one of our client's domain names. The name is ezrentnow.com. We host both DNS servers (primary is bcw4.bcwebhost.net and secondary is dns2.bcwebhost.net). I know that the registrar holding the name (gkg.net) has an error and lists the secondary

Re: [Declude.Virus] W32/Mydoom.A@mm

2004-01-28 Thread R. Scott Perry
So with the new beta, I don't have to change anything in the config files? Does this make the SKIP in the .eml notifications obsolete? Correct. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus:

Re: [Declude.Virus] Mailbox Copy

2004-01-27 Thread R. Scott Perry
I am confused as to how add this to JM. Lets say we want to send a copy of the email to a certain mailbox and also CC the spam address for the domain. Rule1mailbox spam Rule1COPYTO mailto:[EMAIL PROTECTED][EMAIL PROTECTED] can these be done with one rule or is mailbox a final action?

Re: [Declude.Virus] Forging recipients for gateway customers, bounce overload

2004-01-27 Thread R. Scott Perry
Most system notifications come by way of the null SMTP sender, , while having a valid address in the from field. If I'm not mistaken, Declude Virus can't be configured this way. Correct (IMail's imail1.exe process, which is used to send the notifications, does not allow E-mail to be sent from

Re: [Declude.Virus] Forging recipients for gateway customers, bounce overload

2004-01-27 Thread R. Scott Perry
Would it work to have a Reply-To address of instead? Assuming of course that Declude Virus supports Reply-To and mailer daemon's would use the Reply-To address. It might be worth a try, but I don't think it will work. Most bounce messages will normally go to the return address (in the SMTP

Re: [Declude.Virus] Time for public request.

2004-01-27 Thread R. Scott Perry
To the admin responsible for the Imail server running Declude at Camargocadillac.com, I have attempted 3 times to notify you to have you stop sending out Declude notifications to forged addresses. Please correct this problem. We sent them an E-mail earlier today (their ISP, actually), after

Re: [Declude.Virus] Imail and Spyware Protection

2004-01-26 Thread R. Scott Perry
How do you know if spyware is on a PC? Does Declude or Imail identify and remove sneakly applications such as these? That is up to the AV program. Most AV programs do not attempt to detect spyware. However, if the AV program you use with Declude Virus is capable of detecting spyware, then it

RE: [Declude.Virus] Imail and Spyware Protection

2004-01-26 Thread R. Scott Perry
I use F-Prot and I don't know if they block this. I will check it out. They do not. Very, very few AV programs detect spyware. If you want to detect spyware sent in E-mail, it may be best to use a program like PestPatrol with Declude Virus in addition to F-Prot.

[Declude.Virus] New, fast-spreading virus

2004-01-26 Thread R. Scott Perry
FYI, there is a new fast-spreading virus out there, that is too new to be caught by AV programs yet. So far we have seen filenames of body, data, document, file, glszfj, message, readme, test, text, vgsu042a, and vncexdl, with extensions of .pif, .scr, .zip. It may be a wise idea to

Re: [Declude.Virus] New, fast-spreading virus

2004-01-26 Thread R. Scott Perry
Well, that's a good sign then that JunkMail will at least add a few points to it. If I'm correct, that error also causes BADHEADERS to trip as well... No (this is important). If an E-mail has headers that are [1] common in spam, and [2] rare in legitimate E-mail, it will fail either the

Re: [Declude.Virus] BANNAME in virus.cfg

2004-01-26 Thread R. Scott Perry
Does the BANNAME entry in virus.cfg support a comment on the end of the line? No. We are banning a number of specific filenames due to specific virus threats and I would like to put the virus name next to the BANNAME entry. In this case, I would recommend adding a comment line before it, such

Re: [Declude.Virus] HELP! Problem with Declude

2004-01-26 Thread R. Scott Perry
There I was today adding some new BANNAME's to the virus.cfg file when I notice .vir directories starting to stack up... Running declude 1.76i14 Is there any help out there? Yes -- run the latest release, latest beta, or latest interim release. Any of the above should fix your problem. :)

Re: [Declude.Virus] Heads up on F-Prot configuration

2004-01-25 Thread R. Scott Perry
I noticed while testing the command line output that the switches recommended in the manual doesn't include /NOBOOT and as a result, F-Prot will scan your boot sectors every time it is run. This would waste clock cycles. I also included the /PACK option which is said to unpack compressed

Re: [Declude.Virus] NOLEGITCONTENT

2004-01-25 Thread R. Scott Perry
Can you tell us what things the test checks for? That might help us fine tune our configurations based on the traffic we see. No -- we don't want spammers knowing what we check for. Spammers have actually purchased copies of Declude JunkMail, so it would not be unreasonable to think that they

Re: [Declude.Virus] Heads up on F-Prot configuration

2004-01-25 Thread R. Scott Perry
I include the VIRUSCODE 8 for holding suspicious files, and -AI to enable neural-network virus detection. I'm not sure why Scott did not add at least the -PACKED switch back then, figured maybe he though I was just being overly cautious. The -PACKED switch is used for .exe files that are

Re: [Declude.Virus] Partial (Fragmented) Vulnerability

2004-01-19 Thread R. Scott Perry
Is there any way to disable the Partial (Fragmented) Vulnerability check? Only by disabling all vulnerability detection. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and

Re: [Declude.Virus] new forging worm: Bagle

2004-01-19 Thread R. Scott Perry
We have seen about 35 so far this morning. Mcafee says it is a Forging virus... This one definitely is a forging virus. Right now, it looks like Bagle is now accounting for over 20% of all viruses (excluding vulnerabilities). -Scott ---

Re: [Declude.Virus] new forging worm: Bagle

2004-01-19 Thread R. Scott Perry
I am running f-prot (windows version) with declude. When I get the virus-list (fpcmd -virlist vir.txt), I do not find [EMAIL PROTECTED] listed there, and I have my virus definitions updated. I wonder if something is wrong with my f-prot settings, or perhaps I am missing something. What is the

Re: [Declude.Virus] new forging worm: Bagle

2004-01-19 Thread R. Scott Perry
These are my def status: SIGN2.DEF created 19 January 2004 F-Prot definitely should detect Bagle with the 19 Jan 2004 definitions. For some reason, it seems that the /VIRLIST doesn't display Bagle -- I can't explain why, though. But it is catching it (as W32/[EMAIL PROTECTED]).

Re: [Declude.Virus] exclude Outlook 'CR' Vulnerability

2004-01-16 Thread R. Scott Perry
im new to declude and i have to make some changements to the config file as we have only problems with Outlook 'CR' Vulnerability, i would like to disable this one it seems, that some self written form2mail handlers and imail produces more false positivs then it does help i have seen in

Re: [Declude.Virus] W32.bugbear.B.Dam getting through

2004-01-16 Thread R. Scott Perry
For some reason an attachment infected with the W32.bugbear.B.Dam is getting through today. The .Dam means damaged, and usually indicates a corrupt, non-viable (safe) variant (which AV programs may or may not detect). -Scott --- Declude

Re: [Declude.Virus] Overflow?

2004-01-15 Thread R. Scott Perry
what must I do to use the Declude Queue Feature? It is automatically enabled (except with very old versions of Declude). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and

RE: [Declude.Virus] %ALLRECIPS%

2004-01-15 Thread R. Scott Perry
Any progress? We are still working on this. The processing of recipients from Q*.SMD files is extremely tricky, even the smallest change will affect something, so it is slow work. -Scott --- Declude JunkMail: The advanced anti-spam solution

RE: [Declude.Virus] Overflow?

2004-01-15 Thread R. Scott Perry
what must I do to use the Declude Queue Feature? It is automatically enabled (except with very old versions of Declude). How do I see it working? I have ~ 400 Q* Files in my Spooldir, no directory overflow or something like that. If there is no \IMail\spool\overflow directory, the problem is

RE: [Declude.Virus] Space-Gap Vulnerability

2004-01-13 Thread R. Scott Perry
--NextPart_see7a Content-Type: image/gif;Name = tst.gif Here's the problem -- this Name = tst.gif is not RFC-compliant, and triggers an Outlook vulnerability. It looks like the sender will need to upgrade or replace their program Mail v1.0 based on anyMail v1.1. But with a name of

Re: [Declude.Virus] Fwd: WARNING: We blocked a virus that was sent to you

2003-12-29 Thread R. Scott Perry
Here's a message that I received this morning. The message is obviously forged, but I'm curious if others have seen messages that appear to come from discussion lists that they are subscribed to complete with appropriate subject lines and passable to and from lines. This is the fourth or

Re: [Declude.Virus] Sobig.C

2003-12-27 Thread R. Scott Perry
Are you treating Sobig.C as a forging virus? Yes. All variants of Sobig are being treated as forging. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in

RE: [Declude.Virus] Optionally change order of execution for JunkMail and Virus JunkMail and Virus

2003-12-23 Thread R. Scott Perry
I'm either missing what you are referring to or it isn't there, or I am wrong on what the current order of execution is. Could you be more specific as to which option you are speaking of? You can add a line AVAFTERJM ON to accomplish this. However, be warned that any E-mail held by Declude

RE: [Declude.Virus] Optionally change order of execution for JunkMail and Virus

2003-12-23 Thread R. Scott Perry
I don't want to throw away false positives and I don't want our mail admin to have to look through all messages flagged by Declude Virus because that could possibly take a lot of time. FWIW, the de-facto standard is to delete them or quarantine them. All up-to-date mailserver virus scanners

Re: [Declude.Virus] reporting

2003-12-22 Thread R. Scott Perry
As I'm seeing the line in Sophos SWEEP for NT I was thinking I did something wrong. However, here are both report files (manually run from the commandline). Where is Declude getting the sting in Sophos NT from? I'm guessing that it is in your .eml file. :)

Re: [Declude.Virus] reporting

2003-12-22 Thread R. Scott Perry
That's the funny part, I had looked at it but that's not it either. Here's my postmaster.eml file: Good catch. It turns out this is a flaw with the way that Declude Virus is handling the multiple scanners. It is automatically overwriting the filename that F-Prot reports (the correct one) when

Re: [Declude.Virus] Declude Virus v1.76b caught the Unknown Virus virus in Unknown File Virus virus in Unknown File

2003-12-15 Thread R. Scott Perry
Below is the line I have in my virus.cfg file: SCANFILEd:\imail\declude\FProt\f-prot.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt But I still receive the following in my logs when running the virus scanning. 12/11/2003 11:49:32 Qa01a010901fa167a Could

Re: [Declude.Virus] Declude Virus v1.76b caught the Unknown Virus virus in Unknown File Virus virus in Unknown File

2003-12-15 Thread R. Scott Perry
Yep, This is what I have in the virus.cfg file. SCANFILEd:\imail\declude\FProt\f-prot.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt Is this all on one line? If not, you need to combine it into one line, so that it begins with SCANFILE and ends with

Re: [Declude.Virus] Virus not logging

2003-12-14 Thread R. Scott Perry
We're getting viruses tossed into the virus directory, but it's not being logged. I have the following settings.. Declude 1.77 Imail 8.03 F-Prot 3.14b Virus.cfg line for F-Prot - :\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOFLOPPY /NOBOOT /DUMB /REPORT=report It's catching

Re: [Declude.Virus] Virus not logging

2003-12-14 Thread R. Scott Perry
And what about LOGFILE? That determines where Declude Virus saves the log file. Is anything appearing in the log file? -Scott At 05:15 PM 12/14/2003, Rich wrote: MID Rich - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED

Re: [Declude.Virus] ONLYSENDIFVIRUSNAMEHAS

2003-12-12 Thread R. Scott Perry
Before I consider this feature further, let me doublecheck. If a mail fails the vulnerability check AND a virus check, but has an EML template with ONLYSENDIFVIRUSNAMEHAS - will the notification be sent or not? Example: When Declude Virus detects both a vulnerability and a virus, Declude Virus

Re: [Declude.Virus] McAfee and /clean

2003-12-04 Thread R. Scott Perry
I was looking at the McAfee help file, and there were /mime and /mailbox switches. Am I missing something? You can ignore those. McAfee won't see any MIME segments or mailboxes -- Declude Virus handles all that. McAfee will just see an attachment (one that will be deleted immediately after

[Declude.Virus] Declude Virus v1.77 (beta) released

2003-12-04 Thread R. Scott Perry
We have just released Declude Virus v1.77 (beta). See http://www.declude.com/virus/manual.htm . Notable changes since the last beta include: o BANNAME option would cause problems when too many entries were used; fixed. o Added SKIPIFFORGING option for .eml files. o

Re: [Declude.Virus] McAfee and /clean

2003-12-03 Thread R. Scott Perry
Is the /clean switch in McAfee AV (Enterprise Edition 7.1) supported within Declude? No, it is not. In other words is there a problem with adding /clean to the virus.cfg file? Yes, there would be a problem. Specifically, McAfee will clean the decoded attachment that Declude Virus creates,

[Declude.Virus] Declude Virus BANNAME option with v1.76

2003-12-03 Thread R. Scott Perry
Several people have reported issues with E-mail not being delivered over the past few days. The problem has been identified; there was a problem with v1.76 (beta) and subsequent interim releases and the BANNAME option. This issue is fixed in a new interim release v1.76i30 at

Re: [Declude.Virus] Install for first time message repeats

2003-11-26 Thread R. Scott Perry
However one of my colo customers purchased IMAIL and declude lite virus version. I set the server up just like mine but I keep getting an error when it fires up. declude.exe continues to say; INSTALLING DECLUDE FOR THE FIRST TIME INSTALLATION COMPLETE! The above is written to the dec log file

Re: [Declude.Virus] Current Forging Virus list

2003-11-25 Thread R. Scott Perry
Scott, my list also longer then the list in the sender.eml file. You are missing Avril I can't seem to find any indication that Avril is a forging virus. Gibe This appears to use the sender's E-mail address as the return address. Hybris This is indeed a forging virus. The files will be updated

Re: [Declude.Virus] Current Forging Virus list

2003-11-24 Thread R. Scott Perry
Thanks Scott. I am pretty sure that is what I did; one of the few things I actually remembered.:(( I just tried it again, and the virus.cfg only lists Klez. The last line in the file is FORGINGVIRUS Klez. Is it me? The virus.cfg file just has a sample FORGINGVIRUS entry (since few people use

Re: [Declude.Virus] Different directories for viruses and blocked extensions

2003-11-21 Thread R. Scott Perry
Is it possible to put the mails with blocked extension in a separate directory than the mails with a virus? The directory name could be \Imail\spool\ext. This is already in the suggestion database, and something that we plan to add to a future release.

Re: [Declude.Virus] Anyone know what this was supposed to be?

2003-11-20 Thread R. Scott Perry
I just received thisI've pasted the message below. It came with a midi which my firewall stripped but I'd say this looks like some sort of virus? It's definitely a rogue E-mail: Received: from vsmtp4.tin.it [212.216.176.224] by todhunter.com with ESMTP (SMTPD32-7.15) id A6C26340126; Thu, 20

Re: [Declude.Virus] Mime Segments

2003-11-18 Thread R. Scott Perry
Over the last few days, the majority (about 98%) of entries in our Virus log look like this: 11/18/2003 04:10:10 Qeff80ed6013007fe 50 is too many MIME levels to recurse 11/18/2003 04:10:10 Qeff80ed6013007fe 50 is too many MIME levels to recurse 11/18/2003 04:10:10 Qeff80ed6013007fe 50 is too many

Re: [Declude.Virus] virus_domains.txt default setting

2003-11-18 Thread R. Scott Perry
Note that the scan_alias ON and scan ON do not need to be in there (the DEFAULT ON will set them both to ON). If I remove the scan and scan alias NOTHING will be scanned. For some reason the default does then nothing. What version of Declude are you running (\IMail\Declude -diag from a command

Re: [Declude.Virus] virus_domains.txt default setting

2003-11-17 Thread R. Scott Perry
I am currently working on a demo version to see if this program is the one we need. Seems cool but there is one problem I wonder if its solvable. I want to scan a domain (scan) and not scan another one (noscan). I set default to 0. Is there a way to make it scan all domains exept the noscan

[Declude.Virus] A reminder NEVER to send live viruses to a list or just about anywhere else...

2003-11-17 Thread R. Scott Perry
This is just a reminder to NEVER send viruses, suspected viruses, or unknown files to mailing lists or any address not specifically set up to handle viruses. We have an address [EMAIL PROTECTED] that is designed to handle viruses safely. Nobody should intentionally send any potentially unsafe

RE: [Declude.Virus] A reminder NEVER to send live viruses to a list or just about anywhere else... list or just about anywhere else...

2003-11-17 Thread R. Scott Perry
Are you referring to my message, Scott. It was strictly the text of a message received and did not include anything executable. Since our Declude, Groupshield nor my desktop McAfee detected as anything executable I felt it was safe to send it as it was, strictly ASCII text and as such not a live

RE: [Declude.Virus] A reminder NEVER to send live viruses to a list or just about anywhere else... list or just about anywhere else...

2003-11-17 Thread R. Scott Perry
Hmmmwe are currently already using McAfee VirusScan Enterprise 7.0 with engine 4.2.60 and Dat version 4304 (Nov 14.) I use a batch file to copy the DAT files daily to the folder for use be the command line scanner after the McAfee auto-update. Our mail servers are updated daily with the

RE: [Declude.Virus] mails from support@microsoft.com

2003-11-12 Thread R. Scott Perry
Here also same situation 2+ alerts daily, stopped alerting. Otherwise it was big load to server compared to regular mail delivery. Anybody please suggest me a way to get rid of this. When there is a virus that is causing huge problems due to its volume (as was the case for many people with

Re: [Declude.Virus] Scanning Question

2003-11-12 Thread R. Scott Perry
Is it possible to not scan an email from a specific sender for vulnerabilities? No. They are tripping the 'blank folding' vuln. and we quarantine it. Thanks, Why do you want them to be allowed to send E-mail with vulnerabilities? -Scott ---

RE: [Declude.Virus] Scanning Question

2003-11-12 Thread R. Scott Perry
Is is possible (using per user settings) to simply suspend the vulnerability scanning, yet still keep the main virus scanning on? No. The vulnerability detection can only be turned on/off globally. For an individual account (or domain), it can only be turned on/off along with virus

Re: [Declude.Virus] blocking mimail

2003-11-04 Thread R. Scott Perry
How is everyone blocking this virus? Declude Virus will automatically block Mimail, unless your AV software does not detect it. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known

Re: [Declude.Virus] Zips are corrupt

2003-11-03 Thread R. Scott Perry
I'm trying to narrow down a problem where zip attachments that are received via IMail 8.03 w/hf are corrupt. Same zip via FTP or HTTP check out OK. Using the latest Declude virus beta and F-Prot 3.14b. The declude log looks great, no errors. Are they being sent as attachment-only E-mails

Re: [Declude.Virus] Zips are corrupt

2003-11-03 Thread R. Scott Perry
They are regular emails, I just sent you an example. They definitely are corrupt (2 of the 3 in the E-mail you sent). However, I can't explain what would be corrupting them (or whether they were corrupt before they were sent). -Scott ---

Re: [Declude.Virus] Suggestion

2003-10-31 Thread R. Scott Perry
We have a number of large customers who has serius problems with 'Blank Folding' We would like to be able to skip scanning for this single problem until the problems are solved on a per domain setting. Unfortunately, the only way to do this is to turn off all vulnerability detection, which is

Re: [Declude.Virus] Forging Virus

2003-10-31 Thread R. Scott Perry
I'm running Declude v1.76i14, and it is my understanding that this version will lookup the virus name via DNS to see if it's forging or not. Correct. It appears that the below virus is forging, but I believe my logs show it trying to send a notification to the sender. We've updated our server

RE: [Declude.Virus] Suggestion

2003-10-31 Thread R. Scott Perry
after putting in this BANCRVIRUSES OFF I still get this [Outlook 'Boundary Space Gap' Vulnerability] / [No attachment] There is an interim release 1.76i16 at http://www.declude.com/release/176i/declude.exe that will take care of this. -Scott

Re: [Declude.Virus] New Virus - MiMail.C - spreading fast

2003-10-31 Thread R. Scott Perry
We started seeing these are 8am this morning The attachment comes as photos.zip and so far neither Mcafee or F-prot is catching them. We recommend adding a line BANNAME photos.zip to the \IMail\Declude\virus.cfg file (with v1.76 or higher), which will catch this. From: james@current domain

RE: [Declude.Virus] declude and win 2003 server

2003-10-31 Thread R. Scott Perry
I have never experienced this problem. What version of Imail does it relate to? I believe the reports have been for IMail v8. So you may want to wait on upgrading to v8 (or test it on another server, first). -Scott --- Declude JunkMail: The

RE: [Declude.Virus] containing the Unknown Virus

2003-10-29 Thread R. Scott Perry
Attached is the file for your review - we ran declude for about 2 min. It almost crashed the iMail server. What do you mean by it almost crashed the IMail server? How many E-mails do you send/receive per day on this server? 10/28/2003 23:30:36 Q5532251336c 1 [1 of 2 not deleted] files were

<    1   2   3   4   5   6   7   8   9   10   >