Re: [Declude.Virus] As usual, Scott came up with the answer
fpcmd.exe may work OK if you want to keep the 8.3 name generation turned off. I wouldn't though, unless absolutely 100% sure of everything that may EVER run on the server. Jerry - Original Message - From: "David Dodell" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Sunday, March 24, 2002 1:38 PM Subject: [Declude.Virus] As usual, Scott came up with the answer > I know there was a good reason I bought this product ... Scott found > the problem, I had followed the advice of someone else on the Imail > list about changing a registry entry and that caused Declude to stop > functioning properly. I changed the registry back, and now all works > again. > > If you saw this same message on the Imail forum, you might want to > reverse what you did too. > > THANKS SCOTT! > > David > - > > > > > This is a forwarded message > From: David Dodell <[EMAIL PROTECTED]> > To: "R. Scott Perry" <[EMAIL PROTECTED]> > Date: Sunday, March 24, 2002, 11:32:35 AM > Subject: updated log > > ===Original message text=== > > This line indicates that the temporary directory that Declude is storing > > the files in does not exist. However, the directory was created. Do you > > have the F-Prot on-access scanner running (or any other AV program) that > > might delete the directory if Declude stored a virus in it? Have you made > > any registry changes as to how your server may handle short file names? > > I found the message in the archive: > > > > From: Sanford Whiteman > Subject: Re: [IMail Forum] Attn: Declude Confirm users who have upgraded to IMail 7.06HF1 > Date: Fri, 15 Mar 2002 13:16:27 -0800 > > > > Related recommendation to all: now that Imail is creating long file > names (LFNs), you will get increased (i.e. unchanged) performance by > turning off automatic 8.3 file name creation (if you haven't already): > > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisable8dot 3NameCreation > > should be DWORD = 1. > > Note that this is generally a best practice for Win32 servers that > only run LFN-aware software. > > Sandy > > > > I've changed DWORD back to zero and rebooting .. hopefully this will > fix the problem. I'll report back in a second. > > david > > > End of original message text=== > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". You can E-mail > [EMAIL PROTECTED] for assistance. You can visit our web > site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.Virus] As usual, Scott came up with the answer
I know there was a good reason I bought this product ... Scott found the problem, I had followed the advice of someone else on the Imail list about changing a registry entry and that caused Declude to stop functioning properly. I changed the registry back, and now all works again. If you saw this same message on the Imail forum, you might want to reverse what you did too. THANKS SCOTT! David - This is a forwarded message From: David Dodell <[EMAIL PROTECTED]> To: "R. Scott Perry" <[EMAIL PROTECTED]> Date: Sunday, March 24, 2002, 11:32:35 AM Subject: updated log ===Original message text=== > This line indicates that the temporary directory that Declude is storing > the files in does not exist. However, the directory was created. Do you > have the F-Prot on-access scanner running (or any other AV program) that > might delete the directory if Declude stored a virus in it? Have you made > any registry changes as to how your server may handle short file names? I found the message in the archive: From: Sanford Whiteman Subject: Re: [IMail Forum] Attn: Declude Confirm users who have upgraded to IMail 7.06HF1 Date: Fri, 15 Mar 2002 13:16:27 -0800 Related recommendation to all: now that Imail is creating long file names (LFNs), you will get increased (i.e. unchanged) performance by turning off automatic 8.3 file name creation (if you haven't already): HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisable8dot3NameCreation should be DWORD = 1. Note that this is generally a best practice for Win32 servers that only run LFN-aware software. Sandy I've changed DWORD back to zero and rebooting .. hopefully this will fix the problem. I'll report back in a second. david End of original message text=== --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.Virus] F-Prot version
doh. I guess some things are just too easy .. thanks. I'll blame it on being tired on a Sunday morning ;) I thought the F-Prot executable was being updated by that wget script you wrote a while back, but it looks like I'm still running 3.12. Jonathan At 12:54 PM 3/24/2002 -0500, you wrote: >Scan any file(even a nonexistent file), the version number is in the banner of >the output - or - run without any parameters, and it should be displayed in >the top banner of the UI. > >Jerry > >- Original Message - >From: "Jonathan" <[EMAIL PROTECTED]> >To: <[EMAIL PROTECTED]> >Sent: Sunday, March 24, 2002 12:45 PM >Subject: [Declude.Virus] F-Prot version > > > > Is there an easy way to tell the version of F-Prot.exe? I know you can tell > > which definitions it's running with f-prot /virno, but I dont see anything > > about the executable's version there. > > > > TIA, > > Jonathan > > > > --- > > [This E-mail was scanned for viruses by Declude Virus >(http://www.declude.com)] > > > > This E-mail came from the Declude.Virus mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus". You can E-mail > > [EMAIL PROTECTED] for assistance. You can visit our web > > site at http://www.declude.com . > >--- >[This E-mail was scanned for viruses by Declude Virus >(http://www.declude.com)] > >This E-mail came from the Declude.Virus mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.Virus". You can E-mail >[EMAIL PROTECTED] for assistance. You can visit our web >site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.Virus] F-Prot version
Scan any file(even a nonexistent file), the version number is in the banner of the output - or - run without any parameters, and it should be displayed in the top banner of the UI. Jerry - Original Message - From: "Jonathan" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Sunday, March 24, 2002 12:45 PM Subject: [Declude.Virus] F-Prot version > Is there an easy way to tell the version of F-Prot.exe? I know you can tell > which definitions it's running with f-prot /virno, but I dont see anything > about the executable's version there. > > TIA, > Jonathan > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". You can E-mail > [EMAIL PROTECTED] for assistance. You can visit our web > site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.Virus] warning ... check your f-prot installations
>Did u remember to delete .pif file in the f-prot directory ? > >if its still there declude will not run the f-prot FYI, the .PIF file instructs Windows never to let F-Prot end. So Declude will still start F-Prot, but it will sit in memory until Declude times out and kills the process. Recent versions of Declude will automatically delete the F-Prot.PIF file if it finds it (which would prevent the first E-mail from being scanned properly after an upgrade, but all others would get scanned). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.Virus] F-Prot version
Is there an easy way to tell the version of F-Prot.exe? I know you can tell which definitions it's running with f-prot /virno, but I dont see anything about the executable's version there. TIA, Jonathan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[2]: [Declude.Virus] warning ... check your f-prot installations
Sunday, March 24, 2002, 7:32:51 PM, you wrote: > Did u remember to delete .pif file in the f-prot directory ? > if its still there declude will not run the f-prot No PIF file in the directory. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.Virus] warning ... check your f-prot installations
[NOTE: Your mail server [212.45.188.110] is missing a reverse DNS entry. All Internet hosts are required to have a reverse DNS entry. The missing reverse DNS entry will cause your mail to be treated as spam on some servers, such as AOL.] [NOTE: Your mail server [212.45.188.110] is missing a reverse DNS entry. All Internet hosts are required to have a reverse DNS entry. The missing reverse DNS entry will cause your mail to be treated as spam on some servers, such as AOL.] Did u remember to delete .pif file in the f-prot directory ? if its still there declude will not run the f-prot Benny - Original Message - From: "David Dodell" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Sunday, March 24, 2002 8:22 AM Subject: [Declude.Virus] warning ... check your f-prot installations > Just a note ... I downloaded an installed the f-prot 3.12 program > since everybody said it was working fine. I'm using Declude 1.45 > > Today, the W32/Magistr.32768 infected my wife's machine. My virus > definitions are updated every 6 hours. > > The declude logs show everything normal ... I ran the test eicar files > from declude/tools and it passes right through. > > Something has changed from 3.11b to 3.12 that I'm not catching viruses > all of a sudden. > > FALSE sense of security ... you might want to check your virus > installation against the Declude EICAR test to make sure your > installation is working. > > I've sent the logs / cfg files to Scott hoping to find an answer ... > > David > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". You can E-mail > [EMAIL PROTECTED] for assistance. You can visit our web > site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.Virus] warning ... check your f-prot installations
Just a note ... I downloaded an installed the f-prot 3.12 program since everybody said it was working fine. I'm using Declude 1.45 Today, the W32/Magistr.32768 infected my wife's machine. My virus definitions are updated every 6 hours. The declude logs show everything normal ... I ran the test eicar files from declude/tools and it passes right through. Something has changed from 3.11b to 3.12 that I'm not catching viruses all of a sudden. FALSE sense of security ... you might want to check your virus installation against the Declude EICAR test to make sure your installation is working. I've sent the logs / cfg files to Scott hoping to find an answer ... David --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
