RE: [Declude.Virus] Update- New virus

[Robert Grosshandler]

At one point, only Declude Virus Pro included this new functionality of
detecting virii in encoded zip files.  Is that still the case?

Rob

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] W32.Beagle.J@mm cannot be caught

[Robert Grosshandler]

Also - f-prot 3.14b is the current version.  It's an important upgrade if I
recall correctly.


terry ip wrote:

> Hi All,
>
> Desktop Norton caught but declude didn't. I'm using Declude 1.75 + 
> F-prot 3.14a with the latest virus pattern. Anyone have the same 
> problem as I'm? or any cure on this? Thanks.
>
> Terry
>
> _
>

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

[Declude.Virus] Suggestion

[Robert Grosshandler]

I'm lazy (actually, just small staff, and I want to keep it that way).

I would love to find a way to give Scott & Co. the way to automatically
force my installation to upgrade to the next interim release, if important.

I understand that there is a possibility that might backfire, but I think
that's less a troubling issue than letting something nasty through to users.

Of course, the nasties always seem to come out on weekends, or nights, or
when I'm on vacation, when I don't want to have somebody on duty to make the
decision, and then do the upgrade.  I'd rather the decision be Scott's, and
the process be automatic.

It could be as simple as a special mailbox that triggers an action on my
server.  If a specially formated e-mail sent by Scott reaches that mailbox,
the action does the download.  We use that to trigger Sniffer downloads, and
it works flawlessly.

I haven't seen anything like that for Declude, and I scanned the archives,
but I may have missed it.  If so, my apologies.

Rob



www.iGive.com

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] Suggestion

[Robert Grosshandler]

Just to reiterate -- I'd trust you to choose which updates to trigger - it
certainly doesn't have to be every interim, but in the last month or so,
we'd have been better off updating as quickly as possible about three times.

For Sniffer, it's a wget script that's triggered when that specific mailbox
gets hit.  You decide when to send to that mailbox.  Might be as simple as
that.  No maintenance on your part other than a list of folks who want that
service, and an e-mail to that list when appropriate.

Rob

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Friday, March 19, 2004 7:30 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] Suggestion



>I would love to find a way to give Scott & Co. the way to automatically 
>force my installation to upgrade to the next interim release, if 
>important.

That is a good idea.  There is a third party program that can automatically 
upgrade to new betas and released versions, but it doesn't handle interims, 
nor does it have a way that we can trigger it somehow.  We will be looking 
into the possibility of adding an option for pushing updates to customers.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just
send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] Urgent notifications

[Robert Grosshandler]

John -

Thinking about it some more, I think it might be the same.  You can choose
to have that notification go to your pager.  I could choose to have that
notification spawn a script.  Scott only has to maintain one list.

After you got that notification, you could choose to login to your servers
and download OR you could also have set up a e-mail address as a trigger to
a script.  You could then send an e-mail to that address.

Could this be a case of having our cake and eating it too!?

I've used both the Verizon PC Card solution, and the Sprint PC Card solution
AND I have a remote client I can use from my Treo 600.  I travel a lot.  For
my travels, I've found Sprint to have better coverage for the "fast"
service, so that's the only PC Card I use now.  However, sometimes fast
isn't.  So being able to e-mail your server and trigger a download would be
a very good thing.

I hope your wife is feeling better.   Not much worse than having a loved one
in the hospital.

Rob

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] 8.11 possible problem

[Robert Grosshandler]

Unfortunately, no.  I'm not able to identify which e-mail it was - McAfee or
human error (I actually believe McAfee) blew the e-mail away.

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] 8.11 possible problem

[Robert Grosshandler]

CPL's are being blocked - which is why I'm worried that it might be the
"sporadic" problem arisen again.

No CPL file has ever made it to my desktop before.

Rob


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] 8.11 possible problem

[Robert Grosshandler]

Declude is working normally, filtering and AVing away.

Nothing looks wrong, I've just had that one instance of a .cpl making it
through (and it was, of course, virus-laden).

Therefore, my concern.  Can't point a finger yet, and the volume of .cpl
files we get is low (four yesterday).  So I can't provide a good testbed for
this.

Which is why I'm saying "possible problem", rather than shouting BUG!  I
just don't know.

Rob


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] 8.11 possible problem

[Robert Grosshandler]

Ah, if were that easy.  It actually went to a support e-mail box, which gets
dozens of emails a minute sometimes, under all sorts of different aliases.


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

[Declude.Virus] 8.11 possible problem

[Robert Grosshandler]

Upgraded to 8.11 - no apparent issues.  Did a reboot just in case.

About 1.5 hours later, a bagle virus, in a .cpl file, found it's way to my
computer.  McAfee alerted me.

Unfortunately, McAfee completely wiped out any trace of said virus, so I'm
unable to go back to logs on server to confirm what might have happened.

I use f-prot and AVG on mail server.  I've got BANEXT CPL in my virus.cfg
(this is the first time a .cpl file has gotten through).

I'm thinking / worrying that this patch to Imail recreated the problem we
had a couple of months ago when Imail wouldn't call declude consistently.

Rob


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] problems with the F-Prot updater

[Robert Grosshandler]

No problem here.


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] AVG zip file problems/fix

[Robert Grosshandler]

can you point to their beta releases?
 
Thanks!


From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of 
MattSent: Monday, July 26, 2004 2:33 PMTo: 
[EMAIL PROTECTED]Subject: [Declude.Virus] AVG zip file 
problems/fix
The issue with the latest AVG not scanning zip files properly because 
they broke the /ARCW and /RTW switches is apparently fixed in a beta release on 
their site, and they indicated that the full version will be released 
soon.  Here's a quote from their support in response to a query:
"It should be working in the build 260 (in our beta section). But 
  you can also wait for the next official version (version 261) which will be 
  released soon."They also noted that /NOEXPORT is not coming 
back.  I'm not sure if that means that they will be exporting suspicious 
files to AVG, or if that just simply isn't an option for the command line 
scanner anymore.  If you use this switch, it will break AVG in versions 
2.51+Matt-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

RE: [Declude.Virus] JS/illWill

[Robert Grosshandler]

We're seeing it too.
 
McAfee on desktop catching as a "trojan".  AVG and F-Prot not 
catching it yet.
Declude not stopping, either.
 
newprice.zip is the attachment name.
 
 


From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Markus 
GuflerSent: Monday, August 09, 2004 11:23 AMTo: 
[EMAIL PROTECTED]Subject: [Declude.Virus] 
JS/illWill

I've seen several 
JS/IllWill messages in the past 20 minutes on our system
 
Looking at http://vil.nai.com/vil/content/v_99242.htm it's 
an old virus (2001) and I can't remember another one in the 
past.
But now I can see 
them comming from all different IP-Adresses.
 
Mailfrom looks like 
real existing adresses but are definitively forged.
 
Markus
 
 

RE: [Declude.Virus] JS/illWill

[Robert Grosshandler]

Problem is, I want to get "good" zipped 
exe's.
 
Oh well.  Until the AV programs start catching it, I've made our 
e-mail less useful by blocking any zips with exe's in 
them.


From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff 
(Lists)Sent: Monday, August 09, 2004 12:50 PMTo: 
[EMAIL PROTECTED]Subject: RE: [Declude.Virus] 
JS/illWill


Declude is indeed 
stopping it if configured correctly. That is how I am stopping 
them.
 
BANZIPEXTS
 
BANEXT 
EXE
 

John 
Tolmachoff
Engineer/Consultant/Owner
eServices For 
You
 

-Original 
Message-From: 
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
On Behalf Of Robert 
GrosshandlerSent: 
Monday, August 09, 
2004 10:31 
AMTo: [EMAIL PROTECTED]Subject: RE: [Declude.Virus] 
JS/illWill
 
We're seeing it 
too.
 
McAfee on desktop catching as a 
"trojan".  AVG and F-Prot not catching it yet.
Declude not stopping, 
either.
 
newprice.zip is the attachment 
name.
 
 
 



From: 
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
On Behalf Of Markus 
GuflerSent: 
Monday, August 09, 
2004 11:23 
AMTo: [EMAIL PROTECTED]Subject: [Declude.Virus] 
JS/illWill

I've seen several JS/IllWill 
messages in the past 20 minutes on our system

 

Looking at http://vil.nai.com/vil/content/v_99242.htm it's 
an old virus (2001) and I can't remember another one in the 
past.

But now I can see them comming from 
all different IP-Adresses.

 

Mailfrom looks like real existing 
adresses but are definitively forged.

 

Markus

 

 

RE: [Declude.Virus] JS/illWill

[Robert Grosshandler]

For us, less useful means the inability to receive .exe's as zipped
attachments, which is how people are used to sending them.

John T. posted a nice set of instructions on how to get around that, but it
requires that your sender know that he / she has to go through a couple of
extra steps in order to get the zipped .exe to us.

So, harder = less useful. 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Olden
Sent: Monday, August 09, 2004 1:47 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] JS/illWill

Want to know what "less useful" really means, try being like us with only
Declude AV Standard. We can't ban certain extensions in zip files.
Plus we can only use one scanner with Standard so we constantly get bit
having to wait until the AV companies update their signatures.

John Olden - Systems Administrator
Champaign Park District


- Original Message -
From: "Robert Grosshandler" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, August 09, 2004 1:02 PM
Subject: RE: [Declude.Virus] JS/illWill


> Problem is, I want to get "good" zipped exe's.
>
> Oh well.  Until the AV programs start catching it, I've made our
e-mail less
> useful by blocking any zips with exe's in them.
>
>   _
>
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
> (Lists)
> Sent: Monday, August 09, 2004 12:50 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.Virus] JS/illWill
>
>
>
> Declude is indeed stopping it if configured correctly. That is how I
am
> stopping them.
>
>
>
> BANZIPEXTS
>
>
>
> BANEXT EXE
>
>
>
> John Tolmachoff
>
> Engineer/Consultant/Owner
>
> eServices For You
>
>
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Robert
Grosshandler
> Sent: Monday, August 09, 2004 10:31 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.Virus] JS/illWill
>
>
>
> We're seeing it too.
>
>
>
> McAfee on desktop catching as a "trojan".  AVG and F-Prot not catching
it
> yet.
>
> Declude not stopping, either.
>
>
>
> newprice.zip is the attachment name.
>
>
>
>
>
>
>
>   _
>
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler
> Sent: Monday, August 09, 2004 11:23 AM
> To: [EMAIL PROTECTED]
> Subject: [Declude.Virus] JS/illWill
>
> I've seen several JS/IllWill messages in the past 20 minutes on our
system
>
>
>
> Looking at http://vil.nai.com/vil/content/v_99242.htm it's an old
virus
> (2001) and I can't remember another one in the past.
>
> But now I can see them comming from all different IP-Adresses.
>
>
>
> Mailfrom looks like real existing adresses but are definitively
forged.
>
>
>
> Markus
>
>
>
>
>
>

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

[Declude.Virus] Current Version 3.05.11??

[Robert Grosshandler]

 
Hi

Are there any release notes for this?  It went from .09 this morning to .11
about five minutes ago.

What's up?

Thanks,

Rob

---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] Changes @ Declude

[Robert Grosshandler]

I for one do not recall receiving such an 
e-mail. 
 
I'm not complaining, just posting here in case others have 
a similar issue.
 
Since I didn't get it, is there a way to see that e-mail 
online someplace?
 
Thanks,
 
Rob 


From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of 
[EMAIL PROTECTED]Sent: Friday, February 10, 2006 12:47 
PMTo: Declude.Virus@declude.comSubject: [Declude.Virus] 
Changes @ Declude


In the 
last 10 days we have received a number of inquiries to the email sent to every 
customer explaining the changes that are happening here at Declude. To summarize 
the answers to those questions:
 

RE: [Declude.Virus]

[Robert Grosshandler]

Interesting.  For about a month I've been seeing headers from you, as well. 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Sanford Whiteman
Sent: Sunday, February 19, 2006 5:46 PM
Subject: [Declude.Virus] 

Organization:Cypress Integrated Systems, Inc.
X-Priority: 3 (Normal)
Message-ID: <[EMAIL PROTECTED]>
To: Kevin Bilbee 
Subject: Re: [Declude.Virus] Running declude 4.x
In-Reply-To: <[EMAIL PROTECTED]>
References: <[EMAIL PROTECTED]>
<[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

> I am wondering if the headers showing in the body of this message was 
> intentional. If not then there is a bug in declude 4.x. I have seen 
> this from another source and reported it to Declude but am wndering if 
> it has not appeared from a different source. If so it would comfirm to 
> me that the problem is with declude and I will roll bacl to the 3.x 
> version we were running before.

Not  at  all intentional, same The Bat! version I've been using for at least
a month.

--Sandy


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus]

[Robert Grosshandler]

Declude has a problem with "non-standard" headers.  There is a whole
category of spam that has headers with this problem.

The other symptom we see is that Declude is unable to edit the headers
properly when this happens.  That is, for us, Declude cannot alter the
Subject line (which we use in downline filtering) when the header exhibits
the same attributes that yours is showing.

We've had some test builds from Declude to try and fix this, so far nothing
has worked.  They are still on the case, though.

Rob 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Sanford Whiteman
Sent: Monday, February 20, 2006 3:57 AM
Subject: [Declude.Virus] 

Organization:Cypress Integrated Systems, Inc.
X-Priority: 3 (Normal)
Message-ID: <[EMAIL PROTECTED]>
To: Kevin Bilbee 
Subject: Re[3]: [Declude.Virus] Running declude 4.x
In-Reply-To: <[EMAIL PROTECTED]>
References: <[EMAIL PROTECTED]>
<[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Never mind, the headers did not change with that last attempt.


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] Built in virus detector

[Robert Grosshandler]

Also, what about those of us on 3.x ? 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Carter
Sent: Wednesday, May 03, 2006 3:17 PM
To: Declude.Virus@declude.com
Subject: [Declude.Virus] Built in virus detector

Just noticed yesterday's 4.2.3 release notes:

EVA ADD BUILTINSCANNEROFF
Located in Virus.cfg. Will disable the internal AVG scanner.  
EVA ADD Integrated AVG Scanner into Decludeproc no configuration required.

Can someone supply info on this?  I must have missed the discussion, if
there was one.

Thanks,
John

---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just
send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]


---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] New Virus: zipped word doc with Macro-Virus

[Robert Grosshandler]

Matt -

Thanks for keeping track of all of this for the rest of us.

Rob 

-Original Message-

David,

I'm just wondering about the issue with the invalid characters in the Mail
From's that caused massive spam leakage almost a month ago.  Is this too
supposed to be fixed?

I'm also very, very curious about the other bugs such as long base 64
encoding causing Declude Virus to fail decoding, WHITELIST IP being applied
before IPBYPASS, and the issue where Declude's headers are inserted at the
bottom of the message when the headers don't use proper CRLF line breaks?

Thanks,

Matt

---
[This E-mail scanned for viruses by Declude Virus]



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

[Declude.Virus] CRLF Issue - more input

[Robert Grosshandler]

Folk -

Chiming in here on the CRLF issue.  For many months, David R (Rocqa?) from
Declude sent me versions to test that were attempting to fix this issue.
None solved the problem (we probably tested four or five versions), but
never once did he or anybody point a finger at the email server. 

It is true that we've not seen any e-mail come through with "broken headers"
that was legitimate.

The problem comes, as Matt nicely put it, is that we rely on the Subject
being altered to do further disposition of the e-mail.  With the "broken
header" problem, that doesn't happen.

Rob

---
[This E-mail scanned for viruses by Declude Virus]



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

WARNING -RE: [Declude.JunkMail] Declude 4.3.40 Released

[Robert Grosshandler]

Hi

We tried installing, decludeproc wouldn't start.  We have fallen back to
4.3.30, successfully.  Getting on the phone now with Declude.

Your mileage hopefully will vary.

Rob

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Monday, March 12, 2007 9:26 AM
To: declude.junkmail@declude.com; declude.virus@declude.com
Subject: [Declude.JunkMail] Declude 4.3.40 Released


FIX ZEROHOUR passing weight to SM when email WHITELISTED
FIX Ignore Case checking in Imail Address book 2006
FIX Improved performance when OUTBOUNDSPAMSCANNING OFF
FIX Updated CommTouch ZEROHOUR Dll
FIX EXITSCANONVIRUSDETECT   ON works between AVG and Commtouch
ADD SM allows both email addresses and domains in their trusted sender
list, declude will match on either
ADD Support for Regular Expressions
http://support.declude.com/Customer/KBArticle.aspx?articleid=97 in the
Filters using PCRE library

We will also be sending an email to notify customers of important changes.

David Barker
Director of Product Management
Your Email security is our business
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.Virus] WARNING -RE: [Declude.JunkMail] Declude 4.3.40 Released

[Robert Grosshandler]

Hi

We tried installing, decludeproc wouldn't start.  We have fallen back to
4.3.30, successfully.  Getting on the phone now with Declude.

Your mileage hopefully will vary.

Rob

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Monday, March 12, 2007 9:26 AM
To: declude.junkmail@declude.com; declude.virus@declude.com
Subject: [Declude.JunkMail] Declude 4.3.40 Released


FIX ZEROHOUR passing weight to SM when email WHITELISTED
FIX Ignore Case checking in Imail Address book 2006
FIX Improved performance when OUTBOUNDSPAMSCANNING OFF
FIX Updated CommTouch ZEROHOUR Dll
FIX EXITSCANONVIRUSDETECT   ON works between AVG and Commtouch
ADD SM allows both email addresses and domains in their trusted sender
list, declude will match on either
ADD Support for Regular Expressions
http://support.declude.com/Customer/KBArticle.aspx?articleid=97 in the
Filters using PCRE library

We will also be sending an email to notify customers of important changes.

David Barker
Director of Product Management
Your Email security is our business
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

Warning Rescinded: RE: [Declude.Virus] WARNING -RE: [Declude.JunkMail]

[Robert Grosshandler]

Amazing.  Called.  Went into voicemail.  2 minutes later, got a call back.
Gave them access.  Diagnosed problem.  Fixed problem.
Amazing.

The problem, the regular expressions library - PCRE.dll didn't install
properly.  Not sure why, I'm sure they're looking at it.

I learned a wonderful thing.  You don't need PERL to use the new library.
That was worth the time I spent on this.

Thanks Declude.

Rob

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert
Grosshandler
Sent: Monday, March 12, 2007 10:12 AM
To: declude.junkmail@declude.com; declude.virus@declude.com
Subject: [Declude.Virus] WARNING -RE: [Declude.JunkMail] Declude 4.3.40
Released

Hi

We tried installing, decludeproc wouldn't start.  We have fallen back to
4.3.30, successfully.  Getting on the phone now with Declude.

Your mileage hopefully will vary.

Rob

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Monday, March 12, 2007 9:26 AM
To: declude.junkmail@declude.com; declude.virus@declude.com
Subject: [Declude.JunkMail] Declude 4.3.40 Released


FIX ZEROHOUR passing weight to SM when email WHITELISTED
FIX Ignore Case checking in Imail Address book 2006
FIX Improved performance when OUTBOUNDSPAMSCANNING OFF
FIX Updated CommTouch ZEROHOUR Dll
FIX EXITSCANONVIRUSDETECT   ON works between AVG and Commtouch
ADD SM allows both email addresses and domains in their trusted sender
list, declude will match on either
ADD Support for Regular Expressions
http://support.declude.com/Customer/KBArticle.aspx?articleid=97 in the
Filters using PCRE library

We will also be sending an email to notify customers of important changes.

David Barker
Director of Product Management
Your Email security is our business
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Warning Rescinded: RE: [Declude.Virus] WARNING -RE: [Declude.JunkMail]

[Robert Grosshandler]

Amazing.  Called.  Went into voicemail.  2 minutes later, got a call back.
Gave them access.  Diagnosed problem.  Fixed problem.
Amazing.

The problem, the regular expressions library - PCRE.dll didn't install
properly.  Not sure why, I'm sure they're looking at it.

I learned a wonderful thing.  You don't need PERL to use the new library.
That was worth the time I spent on this.

Thanks Declude.

Rob

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert
Grosshandler
Sent: Monday, March 12, 2007 10:12 AM
To: declude.junkmail@declude.com; declude.virus@declude.com
Subject: [Declude.Virus] WARNING -RE: [Declude.JunkMail] Declude 4.3.40
Released

Hi

We tried installing, decludeproc wouldn't start.  We have fallen back to
4.3.30, successfully.  Getting on the phone now with Declude.

Your mileage hopefully will vary.

Rob

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Monday, March 12, 2007 9:26 AM
To: declude.junkmail@declude.com; declude.virus@declude.com
Subject: [Declude.JunkMail] Declude 4.3.40 Released


FIX ZEROHOUR passing weight to SM when email WHITELISTED
FIX Ignore Case checking in Imail Address book 2006
FIX Improved performance when OUTBOUNDSPAMSCANNING OFF
FIX Updated CommTouch ZEROHOUR Dll
FIX EXITSCANONVIRUSDETECT   ON works between AVG and Commtouch
ADD SM allows both email addresses and domains in their trusted sender
list, declude will match on either
ADD Support for Regular Expressions
http://support.declude.com/Customer/KBArticle.aspx?articleid=97 in the
Filters using PCRE library

We will also be sending an email to notify customers of important changes.

David Barker
Director of Product Management
Your Email security is our business
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

[Declude.Virus] header vulnerability

[Robert Grosshandler]

Hi

We're seeing the HEADER warning being triggered where it was never triggered
before.  Here's one sample:

Headers:
Received: from QMTA01.westchester.pa.mail.comcast.net [76.96.62.16] by
smtp.igive.com with ESMTP
  (SMTPD-9.23) id A12C03D8; Tue, 21 Oct 2008 05:38:36 -0500
Received: from OMTA02.westchester.pa.mail.comcast.net ([76.96.62.19])
by QMTA01.westchester.pa.mail.comcast.net with comcast
id VM361a00K0QuhwU51NecVF; Tue, 21 Oct 2008 10:38:36 +
Received: from sz0128.wc.mail.comcast.net ([76.96.58.192])
by OMTA02.westchester.pa.mail.comcast.net with comcast
id VNeb1a00H48qnZY3NNebzd; Tue, 21 Oct 2008 10:38:36 +
X-Authority-Analysis: v=1.0 c=1 a=k_JVt2Eeq2AA:10 a=uSyEGTH4XvkA:10
Date: Tue, 21 Oct 2008 10:38:35 + (UTC)
From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Message-ID:
<[EMAIL PROTECTED]
ast.net>
In-Reply-To: <[EMAIL PROTECTED]>
Subject: Re: Help FUMCH - Habitat for Humanity with Every Search
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Auto-Submitted: auto-replied (zimbra; vacation)
Precedence: bulk


It looks to me like Comcast is using zimbra, and something about the way it
constructs its auto-replies doesn't sit well with Declude.  We do want to
receive these notices.

Any insight appreciated.

Rob



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] OT - looking for a command line email tool - with attachments

[Robert Grosshandler]

Try Gammadyne Mailer.

 

www.gammadyne.com

 

 

I believe it has a feature that will allow this.

 

Rob

From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Hirthe,
Alexander
Sent: Tuesday, May 12, 2009 9:57 AM
To: 'declude.virus@declude.com'
Subject: [Declude.Virus] OT - looking for a command line email tool - with
attachments

 

Hello,

 

can anyone help me? 

 

I'm looking for a command line tool to send mail (within our company)
including an attachment. 

(I want to forward the incoming fax to the inbox of the user :)  

 

I can create the pdf, put it in a directory and now I only need a command
line mailer *with* attachment.

 

I tried different tools now, the best sent me the mail and the embedded pdf
font was missing :-/ 

if I open the pdf on the server it's all working. 

 

?

 

Alex

 

 

  _  


Siller AG, Wannenaeckerstrasse 43, 74078 Heilbronn
Vorstand: Prof. H.-F. Siller (Vorsitzender), Joern Buelow, Ralf Michi
Aufsichtsratsvorsitzender: Dr. Peter Baumeister
Reg. Gericht Stuttgart, HRB 107707, Ust-Id Nr. DE145782955


---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com. 



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] RE: [Declude.JunkMail] Declude stopped logging, high CPU usage, slow processing

[Robert Grosshandler]

Thanks!



From: David Barker [mailto:david.bar...@mailsbestfriend.com]
Sent: Tuesday, April 09, 2013 12:02 PM
To: Declude.Virus@declude.com
Subject: [Declude.Virus] RE: [Declude.JunkMail] Declude stopped logging, high 
CPU usage, slow processing



If you don’t have the last build 4.12.02 get it now!



http://interim.declude.com/41202/

U: Interim

P: decinterimv4



Also get the latest AVG DB at:



http://downloads.declude.com/AVG/



U: DecDown

P:  DecDown



Sunday, April 07, 2013  7:37 PM 72153339 incavi.avm 




Once you have upgraded to the latest version drop the  
 incavi.avm into 
\declude\scanners\AVG\db



This should resolve the ERROR: Failed Initialize AVG 183”. If you need further 
assistance contact Linda linda.pagi...@mailsbestfriend.com or myself 
david.bar...@mailsbestfriend.com

David Barker
Mail’s Best Friend

Email : david.bar...@mailsbestfriend.com
Web  : www.mailsbestfriend.com 
Office: 703.988.3605 x7015
Mobile  : 978.518.6461

cid:image001.png@01CE2B2E.8B3E9EF0



From: Colbeck, Andrew [mailto:acolb...@bentallkennedy.com]
Sent: Tuesday, April 9, 2013 12:37 PM
To: declude.junkm...@declude.com
Subject: RE: [Declude.JunkMail] Declude stopped logging, high CPU usage, slow 
processing



If you upgraded to Declude 4.11.09 to avoid the AVG licence issue, you’ll find 
that it was a bandaid, and that build’s usefulness also expired 
contemporaneously with David and Linda’s employee status, on January 31, 2013.



C:\IMail>strings decludeproc.exe| grep  "LicBeg"

LicBeg, Ver=1.1, Name="Declude", Exp=2013-01-31, +Av, Sign=blahblahblah



You still received updates for a grace period (the files with zero bytes are 
normal for the Declude implementation of AVG):



C:\IMail>dir C:\IMail\declude\scanners\AVG\db

Volume in drive C has no label.

Volume Serial Number is 9471-8A74



Directory of C:\IMail\declude\scanners\AVG\db



03/22/2013  07:47 AM  .

03/22/2013  07:47 AM  ..

03/19/2013  02:44 PM 0 avi7.avg

03/19/2013  02:44 PM 0 microavi.avg

03/19/2013  02:44 PM 0 miniavi.avg

03/22/2013  07:47 AM71,002,023 incavi.avm

   4 File(s) 71,002,023 bytes

   2 Dir(s)  11,036,254,208 bytes free

C:\IMail>



This might be addressed in the latest (last?) build which you can obtain 
through the interim downloads website (log into your client support site for 
the link).



If I remember correctly, that build is on 2013-03-15 with v4.12.02 that 
specifically cites in the change log ReadMe.txt:



4.12.02 ==>  Fix: update AVG Key

4.12.01 ==>  Fix: AVG Bug

4.12.00 ==>  Fix: update AVG Key



Which (I think) also fixes the “ERROR: Failed Initialize AVG 183” being spammed 
all over your c:\imail\declude\diags.txt





Andrew.





From: Dean Lawrence [mailto:dean...@gmail.com]
Sent: Friday, January 11, 2013 7:33 AM
To: declude.junkm...@declude.com
Subject: Re: [Declude.JunkMail] Declude stopped logging, high CPU usage, slow 
processing



Thanks Dave, will do.



On Fri, Jan 11, 2013 at 10:25 AM, David Barker  wrote:

Dean,



There is currently an issue with the AVG that we are currently working on. As 
far as backup in the \proc directory and the 0 Kb log that seems like a 
different issue. Can you please contact supp...@declude.com for assistance.


David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 office
978.988.1311 fax
  dbar...@declude.com



Description: Description: -declude







From: Dean Lawrence [mailto:dean...@gmail.com]
Sent: Friday, January 11, 2013 10:18 AM
To: declude.junkm...@declude.com
Subject: [Declude.JunkMail] Declude stopped logging, high CPU usage, slow 
processing



The subject says it all. This morning, declude stated to have high cpu usage, 
the log file is 0k and messages are backing up in the proc directory. I looked 
in the diags.txt and I see this message:



ERROR: Failed Initialize AVG 183Daisy Chain 
smtp32.exe



I was running 4.11 and upgraded to 4.11.09 and still have the same results. Any 
thoughts?



--
---
Dean M. Lawrence
INTERNET DATA TECHNOLOGY
p // 888.438.4381 ext. 701 
w // www.idatatech.com
f // www.facebook.com/idatatech
t // www.twitter.com/idatatech

Social Marketing | SEO | Design | Internet Development


--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.


--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive

RE: [Declude.Virus] Declude Virus v1.61 (beta) released

[Robert Grosshandler]

Everything is working so well right now I'm not sure I want to deploy
beta code.  How long do you estimate before this goes into production?

Rob


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

[Declude.Virus] Bugbear made it past declude / f-prot

[Robert Grosshandler]

Not sure why yet.

Norton stopped it on my personal desktop.

Since it made it through, is there anything I can provide to anyone to
help figure out why?

F-prot is dated 9/30.
Declude is 1.60
Imail is 7.13
Win2k
Norton was updated yesterday, too.
I didn't have BANEXT exe  (I do now!)

Rob

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] Bugbear made it past declude / f-prot

[Robert Grosshandler]

Declude / f-prot caught 5 different variants of eicar.

Using Lite version, don't have per user settings available to me.

I believe that I was able to isolate the e-mail that contained the
virus.  It does not appear to have the "scanned by Declude Virus"
message appended to it, which leads me to believe that maybe declude
didn't submit it to f-prot?  It does have headers that indicate that
declude junkmail did its thing.

Rob


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Tuesday, October 01, 2002 11:29 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] Bugbear made it past declude / f-prot



>Not sure why yet.
>
>Norton stopped it on my personal desktop.
>
>Since it made it through, is there anything I can provide to anyone to 
>help figure out why?
>
>F-prot is dated 9/30.
>Declude is 1.60
>Imail is 7.13
>Win2k
>Norton was updated yesterday, too.
>I didn't have BANEXT exe  (I do now!)

First question:  Is the eicar.com file caught when sent from the Test
Virus 
Sender at http://www.declude.com/tools ?

Second question: Do you have virus scanning disabled for any
users/domains?

Since we've seen the file sent in two different ways (both with and
without 
the MIME Header vulnerability), there's a chance that there could be 
several variants out there, that aren't all getting caught yet.
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] Bugbear made it past declude / f-prot

[Robert Grosshandler]

If I'm reading the e-mail and the logs correctly, declude / f-prot did
scan that e-mail, and it passed.

I'll keep my eyes much more open today!

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Tuesday, October 01, 2002 11:54 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] Bugbear made it past declude / f-prot



>Declude / f-prot caught 5 different variants of eicar.
>
>Using Lite version, don't have per user settings available to me.
>
>I believe that I was able to isolate the e-mail that contained the 
>virus.  It does not appear to have the "scanned by Declude Virus" 
>message appended to it, which leads me to believe that maybe declude 
>didn't submit it to f-prot?  It does have headers that indicate that 
>declude junkmail did its thing.

Have you checked the \IMail\spool\vir.log file, to see what it
reports 
for that E-mail?  That should provide a clue.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] Bugbear made it past declude / f-prot

[Robert Grosshandler]

It did say Virus Free.  F-prot has bugbear.A@mm

Obviously, BANEXT will now be catching this.  Boy, what a waste of time.

Thanks,

Rob

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

[Declude.Virus] Bugbear getting through

[Robert Grosshandler]

Hi

The bugbear virus is getting through f-prot / declude virus.  Not always,
but more than once.  It's being caught by Norton AV on my desktop.  Here's
the latest:

F-prot is up to date.  I use fpcmd.
Virus log shows it being scanned.
The attachment had the name AAL benefit.doc.scr
I have BANEXT scr in my virus.cfg
I'm running declude 1.70i2

What else can I provide?

Rob

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] Bugbear getting through

[Robert Grosshandler]

One more bit of info - using Virus Lite, which I just learned will not ban
extensions.


Hi

The bugbear virus is getting through f-prot / declude virus.  Not always,
but more than once.  It's being caught by Norton AV on my desktop.  Here's
the latest:

F-prot is up to date.  I use fpcmd.
Virus log shows it being scanned.
The attachment had the name AAL benefit.doc.scr
I have BANEXT scr in my virus.cfg
I'm running declude 1.70i2

What else can I provide?

Rob

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] Bugbear getting through

[Robert Grosshandler]

They're getting quarantined by Norton, and I'm afraid to fool around and
figure out how to unquarantine and send them to FSI.  Sending them to Norton
is easy, of course.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry
Sent: Tuesday, June 10, 2003 11:04 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] Bugbear getting through


Have you tried sending a copy of the virus' that are passing by F-Prot to
FSI for review?

Bill
- Original Message - 
From: "Robert Grosshandler" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, June 10, 2003 8:56 PM
Subject: RE: [Declude.Virus] Bugbear getting through


> One more bit of info - using Virus Lite, which I just learned will not 
> ban extensions.
>
> >>>>
> Hi
>
> The bugbear virus is getting through f-prot / declude virus.  Not 
> always, but more than once.  It's being caught by Norton AV on my 
> desktop.  Here's the latest:
>
> F-prot is up to date.  I use fpcmd.
> Virus log shows it being scanned.
> The attachment had the name AAL benefit.doc.scr
> I have BANEXT scr in my virus.cfg
> I'm running declude 1.70i2
>
> What else can I provide?
>
> Rob
>

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] Bugbear getting through

[Robert Grosshandler]

Windows version (fpcmd).

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
(Lists)
Sent: Wednesday, June 11, 2003 12:03 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] Bugbear getting through


Robert, I have noticed the same thing, but in my case they were caught by
banned extension. I did submit to F-Prot and here is the reply I got earlier
in the week, which was then discussed on this list:

F-Prot Antivirus detects and disinfects the Bugbear.B worm with the latest
virus signature files.

However, according to the information you sent to us you are using the DOS
version on a Windows 2000 server. 

Unfortunately there is a problem with running a DOS anti-virus scanner on
Windows NT 4.0/2000/XP systems. It is not guaranteed that all files will be
scanned. The reason for this has mainly to do with long filenames and
non-ASCII characters in file names. DOS only "understands" 8 character long
filenames.

Therefore F-Prot Antivirus for Windows to scan Windows NT 4.0/2000/XP
systems.


Are you using the DOS version or Windows version?

John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just
send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] Grisoft- New finding.. FYI

[Robert Grosshandler]

Title: Message



Do 
people use Fire Daemon or something similar to get around this problem?  Or 
a chron job of some sort?

  
  -Original Message-From: 
  [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On 
  Behalf Of Kami RazvanSent: Thursday, June 12, 2003 10:54 
  AMTo: [EMAIL PROTECTED]Subject: RE: 
  [Declude.Virus] Grisoft- New finding.. FYI
  John..
  I guess that is 
  a possibility.  Have not tried it..
   
  & yes you 
  are right we don't want to leave the server logged on.  The same issue 
  also exists with F-Prot as we know.  The update does not work if you are 
  not logged on and have to run an update scheduled task.
   
  Does anyone know 
  anything about F-Secure?  Do they run as a service?
   
  Regards,
  Kami
   
   
  
  -Original Message-From: 
  [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On 
  Behalf Of John Tolmachoff (Lists)Sent: Thursday, June 12, 2003 
  10:37 AMTo: [EMAIL PROTECTED]Subject: RE: 
  [Declude.Virus] Grisoft- New finding.. FYI
  
  Thanks Kami. Since 
  we are talking about Mail Servers, we all know that servers should not be left 
  logged on.
   
  What about starting 
  the AVG 
  Control 
  Center as a scheduled 
  task just before the update manager needs to run?
   
  
  
  John Tolmachoff MCSE 
  CSSA
  Engineer/Consultant
  eServices For You
  www.eservicesforyou.com
   
  
  -Original 
  Message-From: 
  [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
  On Behalf Of Kami 
  RazvanSent: 
  Thursday, June 12, 
  2003 7:00 
  AMTo: Virus ListSubject: [Declude.Virus] Grisoft- New 
  finding.. FYI
   
  
  Hi;
  
   
  
  I have been exchanging email 
  with the Tech Support at Grisoft about the Auto-Update.  I thought it is 
  good to know considering I have suggested this software recently as a 
  scanner.
  
   
  
  Here is the 
  response:
  
  ==
  
  I am sorry, but the update 
  manager does not run as a service. The update manager is managed by AVG 
  Control Cetner. The AVG Control center starts, when a user logs 
  on.
  I recommend to log on and lock 
  the station.
  This problem will be solved in 
  AVG 7, in this version, there will be possible to update also, when a user is 
  logged off. The version 7 will be released in a few weeks.
  ==
  Regards,
  Kami

[Declude.Virus] BANEXT

[Robert Grosshandler]

Thanks to all for the quick notification of the new virus.  We seemed to
have escaped any harm.

We immediately put BANEXT zip into our virus.cfg file, and that seemed to be
a good thing.

Now I'm thinking about lowering our protection back to where it was.

Is it possible, with Virus Standard, and/or Junkmail Pro, to ban by
extension for just some users?

Or, better yet, conversely ban an extension for all user EXCEPT certain
"power" users?

Inquring minds want to know.

Thanks in advance

Rob


www.iGive.com
Turn your online shopping into cash for your charity.

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] BANEXT

[Robert Grosshandler]

Well, yes!  If I open a zip and catch a virus, woe on me.  I'm supposed to
be experienced enough not to do that.  Plus, my personal machine is
definitely as up to date as possible on virus defs.

Rob

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Rick Klinge
Sent: Monday, January 26, 2004 10:11 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] BANEXT


Geeze.. So you want the virus to only effect certain users?

~Rick

> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Robert 
> Grosshandler
> Sent: Monday, January 26, 2004 9:19 PM
> To: [EMAIL PROTECTED]
> Subject: [Declude.Virus] BANEXT
> 
> 
> Thanks to all for the quick notification of the new virus.
> We seemed to have escaped any harm.
> 
> We immediately put BANEXT zip into our virus.cfg file, and
> that seemed to be a good thing.
> 
> Now I'm thinking about lowering our protection back to where it was.
> 
> Is it possible, with Virus Standard, and/or Junkmail Pro, to
> ban by extension for just some users?
> 
> Or, better yet, conversely ban an extension for all user
> EXCEPT certain "power" users?
> 
> Inquring minds want to know.
> 
> Thanks in advance
> 
> Rob
> 
> 
www.iGive.com
Turn your online shopping into cash for your charity.

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just
send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.
___
Virus Scanned and Filtered by http://www.FamHost.com E-Mail System.


___
Virus Scanned and Filtered by http://www.FamHost.com E-Mail System.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just
send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.