Reply to: Adrian Hauri
Re: [Declude.Virus] TCP WAIT TIME on Thursday 7:48:49 PM
Thanks! Yes. I think this is part of my problem. Also, someone
from Ipswitch was asking if I was getting lots of wait times in
HTTP service.. so I would like to experiment with this..
--
Roger Heath
[EMAIL PROTE
Has anyone of you guys ever had this problem? It could be helpful during the
high traffic time that the Sobig Virus causes:
http://www.stalker.com/CommuniGatePro/Scalability.html#TimeWait
Adrian
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail
That's normal -- it just means that you do not have a MaxQueProc registry
entry (it is not there by default).
-Scott
At 05:31 PM 8/21/2003, Alan Walters wrote:
I just updated my Declude Virus to v1.75 and ran DECLUDE -DIAG to confirm.
At the top of the text display I saw "NoMax
I just updated my Declude Virus to v1.75 and ran DECLUDE -DIAG to confirm.
At the top of the text display I saw "NoMaxQueProc". I don't recall seeing
this before. Is this okay?
Alan Walters
Director of I.T.
Royce Medical
---
[This E-mail was scanned for viruses by Declude Virus (http://www.decl
You can try www.zcom.it/decludeupdater/ictcleaner.zip
Markus
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Jim Matuska
> Sent: Thursday, August 21, 2003 5:04 PM
> To: [EMAIL PROTECTED]
> Subject: Re: [Declude.Virus] Delete or Hold for Viruses?
I just upgraded to the latest version let's see if that fixes the problems.
Greg
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Greg Foulks
Sent: Thursday, August 21, 2003 4:09 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] On Access Question
So I
So I disabled the On-Access scanner and I still get the error when an email
is found with a virus
08/21/2003 16:03:46 Q2584064 ERROR: Virus scanner didn't finish after 30
seconds; terminating.
...
08/21/2003 16:04:03 Q2584064 Scanned: Virus Free [MIME: 2 1128]
Notice the last line of this mes
> Of course, if everyone had their configuration correct...
>
> John Tolmachoff MCSE CSSA
> Engineer/Consultant
> eServices For You
> www.eservicesforyou.com
Amen, I didn't get nearly enough sleep last night and had received this
auto-response from another declude user that had received a virus fr
Scott,
Unfortunately (actually a good thing), all the virus e-mails I have left in
the \virus directory are bounces from other servers. I don't have a Sobig.F
attachment available to test. Once I receive one, I'll re-test.
Thanks,
Bill
> -- Original Message -
Yes, that is what I have been doing on some. But I do have other work to do
too.
Of course, if everyone had their configuration correct...
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declu
So I disabled the On-Access scanner and I still get the error when an email
is found with a virus
08/21/2003 16:03:46 Q2584064 ERROR: Virus scanner didn't finish after 30
seconds; terminating.
08/21/2003 16:04:03 Q2584064 Couldn't delete C:\IMail\spool\D2584064.vir\0:
32.
08/21/2003 16:04:03 Q
Our VIRUSCODE line reads: VIRUSCODE 13
Could that be it?
That would be the problem. McAfee and some others use VIRUSCODE 13, but
F-Prot does not.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude
Our VIRUSCODE line reads: VIRUSCODE 13
Could that be it?
Terry
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry
Sent: Thursday, August 21, 2003 12:26 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] ERROR 3 in virus scanner 1
>Her
I *think* you are saying the notifications are coming from a server other
than mine.
- Original Message -
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, August 21, 2003 2:15 PM
Subject: Re: [Declude.Virus] Fw: Your mail server sent us a virus
>
> >Ther
Here's the command line from my config file:
SCANFILE C:\Progra~1\Fsi\F-Prot\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE
/NOBOOT /DUMB /REPORT=report.txt
Actually, it looks like the default configuration for F-Prot includes:
VIRUSCODE 3
VIRUSCODE 6
So adding the "VIRUSCOD
John,
Here's what I send back to the IMail / Declude Postmasters.
-
I function as the Postmaster for domain.com domain.
An examination of our mail server logs indicates that the e-mail in question
was NOT sent
Here's the command line from my config file:
SCANFILE C:\Progra~1\Fsi\F-Prot\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE
/NOBOOT /DUMB /REPORT=report.txt
Terry
On the other hand, if he doesn't have -NOBOOT and it is scanning his boot
sector, should he not be concerned that it thinks he as a boot sec
See http://www.f-prot.com/support/fpwin_faq/08.html
Bill
- Original Message -
From: "Todd Holt" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, August 21, 2003 11:51 AM
Subject: [Declude.Virus] f-prot command line switches for updater
> What are the command line switches to
I did that with eicar and the On-Demand Scanner picked it up. However, when
I did it with Sobig.F, there was no attachment. Then I noticed that it was a
bounced message from another server (not using SKIPIFVIRUSNAMEHAS). I'm now
wondering if that is why McAfee On-Demand/Declude is not picking it u
What are the command line switches to update f-prot?
Todd Holt
Xidix Technologies, Inc
Las Vegas, NV USA
www.xidix.com
---
[This E-mail scanned for viruses by Declude Virus (http://www.declude.com)]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E
Why is it there are mail admins out there running Imail and Declude that are
continuing to send out virus notices to forged addresses?
I have seen 5 in the last 24 hours.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
> -Original Message-
> From:
Is there a way to automate purging of the virus hold directory? Scott, What
about putting an option like that in declude to set a storage timeframe for
intercepted viruses?
Jim Matuska Jr.
Computer Tech II
CCNA
Nez Perce Tribe
Information Systems
[EMAIL PROTECTED]
- Original Message -
Fr
Hi,
NetShield is what I'm running. To install, I had to run:
N2Ki45L.zip (Netshield 4.5)
NNT45SP1.zip (Netshield 4.5 SP1)
And of course then you still need to run the engine upgrade to 4.2.60 (a
regular SuperDAT will accomlish that).
(I'm not sure why you need the commands as a text file, but
Scott,
Still the sobig notifications are going out...I've check the postmaster.eml
file 3 times already.
There is one tab between skipvirusname and sobig.
There are no lines, or spaces or tabs before the first line.
There are no lines, spaces or tabs between the last skipvirusname and the
from li
I have started using McAfee it looks like the server will reboot every day
or so. When installing (Win2k Server), what options are people using. When I
installed, I installed netshield and I'm getting the updates with the GUI. I
have disable the real time scanning but still seem to have some proble
After reading your post I went in and looked at my server, and the
[expletive deleted] McAfee Autoupdater hadn't successfully processed an
update since the 19th when it pulled 4286. That meant that we were on 4286
DATs and not the current 4288. I forced an update manually, and it pulled
these new d
Title: Message
Hi;
Interesting...
"... Sobig is
unusual in that it has the ability to go onto the Internet from its host PC and
update itself with new capabilities, Huger said.
Those capabilities could include tools for
denial-of-service attacks or relaying spam. "It's entirely up to the
> Does anyone else bother to look at the header, do a who is on the IP and
> notify the responsible party of the possible problem on their IP? I see
the
> IPs in the e-mail headers so if someone was notified do you think they can
> find the actually infected user? Would they bother?
MY experienc
28 matches
Mail list logo
