Re: [Declude.Virus] Any one heard about or seen this one yet?
or the absolute easy way, and in my opinion the only, ban all exe files attached in mail. Have been doing this for several years now, Benny Colbeck, Andrew wrote: Yes, and it should be old news by now. http://isc.sans.org/diary.html?storyid=2071 The end of the page lists the four executables to ban, if you don't trust your antivirus software, i.e. #Jan-18-2007 AC New fake news clips virus called Small.Dam by F-Secure and W32/Downloader.AYDY by F-Prot BANNAME Full Clip.exe BANNAME Read More.exe BANNAME Full Story.exe BANNAME Video.exe Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Heimir Eidskrem Sent: Friday, January 19, 2007 12:02 PM To: declude.virus@declude.com Subject: [Declude.Virus] Any one heard about or seen this one yet? Storm Worm Hits Computers Around the World By Reuters January 19, 2007 HELSINKI (Reuters)-Computer virus writers started to use raging European storms on Friday to attack thousands of computers in an unusual real-time assault, head of research at Finnish data security firm F-Secure told Reuters. The virus, which the company named Storm Worm, is sent to hundreds of thousands of e-mail addresses globally, with the e-mail's subject line saying 230 dead as storm batters Europe. The attached file contains the so-called malware that can infiltrate computer systems. What makes this exceptional is the timely nature of the attack, Mikko Hypponen, head of research at F-Secure said. Hypponen said thousands of computers around the world, most in private use, had been affected. He said most users would not notice the malware, or trojan, which creates a back door to the computer that can be exploited later to steal data or to use the computer to post spam Regards, Dennis Curry System Administrator SNC-Lavalin GDS --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] getting this in my logfile
? # The in the LOGFILE option gets replaced with the month/date LOGFILE E:\virus\vir.log LOGLEVELMID CONSOLE OFF # SCANFILE is the location of the command-line virus scanner. Note that it # must include the full path. VIRUSCODE is the code that scanner returns if # it finds a virus. SCANFILEC:\f-prot\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOBOOT /DUMB /REPORT=report.txt VIRUSCODE 3 VIRUSCODE 6 #VIRUSCODE 8 REPORTInfection PRESCAN ON can't see that -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: 13. april 2004 14:00 To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] getting this in my logfile 04/13/2004 11:21:23 Qb1072b82012a066d Could not find parse string Infection in report.txt 04/13/2004 11:21:23 Qb1072b82012a066d Error 8 in virus scanner 1. 04/13/2004 11:21:23 Qb1072b82012a066d Scanned: Error in virus scanner. [MIME: 2 270831] the mail with attachment are being hold Its a mail with an excel document with macro's but no virus Running the latest f-prot, and a the latest interim relase, anyone having any idea why or what happens It sounds like you set up F-Prot to detect suspicious files -- which will block most files with macros in them. You need to switch back to the default settings (unless you are OK blocking files with macros in them). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] getting this in my logfile
well done that now the rest of teh file is like this # VIRDIR is the directory to move E-mails with viruses; by default, # it is set to 'virus' (\IMail\spool\virus). VIRDIR E:\virus # The MAXATONCE option limits the number of AV processes. For example, # MAXATONCE 1 will only allow 1 AV process to run at once (IE for licensing # purposes). A value of 0 (or commenting it out) allows unlimited processes # to run at the same time. #MAXATONCE 1 ## The following options allow you to limit scanning to only incoming or outgoing # E-mail, with v1.13 and higher. If they are commented out (# in front of them), # Declude will scan all E-mail. #INCOMING ON #OUTGOING ON BANEXT COM BANEXT PIF BANEXT EXE BANEXT SCR BANEXT EZIP BANNAME message.zip BANNAME photos.zip BANCRVIRUSES OFF AUTOFORGE OFF -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: 13. april 2004 14:34 To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] getting this in my logfile SCANFILEC:\f-prot\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOBOOT /DUMB /REPORT=report.txt This is indeed the standard F-Prot configuration. I can't explain why it is returning the exit code of 8, unless F-Prot switched to have that on by default (which could be the case). Since you have no VIRUSCODE 8 line (it is commented out), Declude Virus will not block the E-mail (unless you use DELIVERERRORS OFF in your virus.cfg file). In this case, I would recommend adding a line OKCODE 8 to the \IMail\Declude\virus.cfg file, which will let Declude Virus know that if F-Prot returns an exit code of 8, Declude Virus should not block the E-mail. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Deactivation
Hear Hear... Have had so many problems with Imail, declude has so far kept me from going to other systems Benny -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rodney Bertsch Sent: 7. april 2004 19:40 To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Deactivation 1,000,000 praises to Declude and Scott!!! It's FANTASTIC!! The only reason we haven't migrated to a different mail program is because of Declude, not I-Mail. And Scott's service is FANTASTIC! -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of marc catuogno Sent: Wednesday, April 07, 2004 1:24 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Deactivation I believe you are in the same exact situation you were before the trial. Imail would've passed on the spam and viruses too with out Declude. I would buy it, really, it is the only thing saving my butt... Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mitch Hegstad Sent: Wednesday, April 07, 2004 1:01 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Deactivation I can't argue with that. I just wish I wasn't left in a worse situation than I was prior to setting up declude when it deactivated. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ncl Admin Sent: Wednesday, April 07, 2004 11:46 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Deactivation One would think that prior to the 30 day trial one would purchase declude and it would run forever! At 12:20 PM 4/7/2004 -0400, you wrote: What happens when the 30 days is up and declude deactivates? At that point, mail will be handled almost exactly the same as it was before Declude was installed (the core Declude code will still run, but E-mail will be delivered exactly as it had before). Are the virus's passed on to the users? Correct. The Declude Virus code will not run, so viruses will not be detected, and will be delivered to users exactly as they would be before the Declude Virus evaluation was installed. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] EZIP problem
Hi anyone else experienced problems with zipfile maked with the latest winzip version? Reported by a user it is encryoting in a way per default so that declude take it as a EZIP and block it. Benny --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] EZIP problem
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: 30. mars 2004 22:19 To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] EZIP problem Hi anyone else experienced problems with zipfile maked with the latest winzip version? Reported by a user it is encryoting in a way per default so that declude take it as a EZIP and block it. If a .ZIP files is marked as being split among multiple .ZIP files (whether or not it actually is), BANEXT EZIP will block it as well (since it could hide a virus). No it's a single zip file --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] EZIP problem
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: 30. mars 2004 22:19 To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] EZIP problem Hi anyone else experienced problems with zipfile maked with the latest winzip version? Reported by a user it is encryoting in a way per default so that declude take it as a EZIP and block it. If a .ZIP files is marked as being split among multiple .ZIP files (whether or not it actually is), BANEXT EZIP will block it as well (since it could hide a virus). -Scott Using an older version of winzip fixes the problem --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Passworded zip files still getting through!
Pls could someone post the link to the interim release... Benny -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: 3. mars 2004 18:41 To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Passworded zip files still getting through! Might this be the issue with other folks reporting this problem? Quite possibly, yes, but that's why I keep saying that people need to read the information carefully before posting that it doesn't work. :) -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] OT windows eating all memory
Its both type of servers 90 % of them are only webservers The strange thing is that i think it started after a patch from microsoft -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Djerr C. de Meijer Sent: 5. januar 2004 09:07 To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] OT windows eating all memory Also might be a idea to dig through the memory resources lists. Those contain some good info. :) DC - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, January 05, 2004 5:37 AM Subject: RE: [Declude.Virus] OT windows eating all memory Is this MS SQL 2000 or SQL 7.0? Have you configured memory usage in SQL? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.Virus- [EMAIL PROTECTED] On Behalf Of ISPhuset Nordic AS Sent: Sunday, January 04, 2004 12:54 PM To: [EMAIL PROTECTED] Subject: [Declude.Virus] OT windows eating all memory Hi I have in the last 3 - 4 weeks experienced that my w2k and w2003 servers running web and sql suddenly has startet using all ram on the servers Booting them fix the problems for a day or three and then i have to boot again Any other have seen the same ? Benny --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] OT windows eating all memory
Hi I have in the last 3 - 4 weeks experienced that my w2k and w2003 servers running web and sql suddenly has startet using all ram on the servers Booting them fix the problems for a day or three and then i have to boot again Any other have seen the same ? Benny --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] How do i do this
hmm sorry a little to fast in writing this message... I just got a little pissed that i received spam from a user on the list :-) From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Djerr C. de MeijerSent: 8. desember 2003 08:49To: [EMAIL PROTECTED]Subject: Re: [Declude.Virus] How do i do this Is that english? o_O - Original Message - From: ISPhuset Nordic AS To: [EMAIL PROTECTED] Sent: Friday, December 05, 2003 1:03 PM Subject: FW: [Declude.Virus] How do i do this So is this list now been compromitted så that we recieve spam based on this list and is this fool a member here in that case he should be hanged :-) benny From: Hani Karkabi [mailto:[EMAIL PROTECTED] Sent: 5. desember 2003 12:26To: [EMAIL PROTECTED]Subject: RE: [Declude.Virus] How do i do this Do you Yahoo!?Free Pop-Up Blocker - Get it now
[Declude.Virus] Suggestion
We have a number of large customers who has serius problems with 'Blank Folding' We would like to be able to skip scanning for this single problem until the problems are solved on a per domain setting. The reason to this is that there are no pattern in where the mail are coming from or which client is sending the mail, personally i do belive its a problem with Imail Benny --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Suggestion
Unfortunately, the only way to do this is to turn off all vulnerability detection, which is not recommended. But if you feel the benefits of allowing some vulnerabilities through outweighs the risks of letting all vulnerabilities through, that is your decision (you can use BANCRVIRUSES OFF in the virus.cfg file to do this). Yes and thats what i had to do We're not aware of any cases of IMail causing this (although IMail v8's web messaging *does* send out the Outlook 'CR' vulnerability when attachments with filenames containing high-bit characters are sent). If you see a line in the headers with a single space or tab, then the sending mail client needs to be fixed. Well we from a webbased form send to a list off users to another server et comes through with out this problem But sending to our server it is stopped directly and there is a blank line Note that *any* mailserver running up-to-date AV software should be blocking these E-mails. So having your customers fix the problem may help them out much more than they realize (they could have half of their E-mails blocked right now and not know it, for example). But thats another question --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Suggestion
after putting in this BANCRVIRUSES OFF I still get this [Outlook 'Boundary Space Gap' Vulnerability] / [No attachment] Why ? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of ISPhuset Nordic AS Sent: 31. oktober 2003 15:48 To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Suggestion Unfortunately, the only way to do this is to turn off all vulnerability detection, which is not recommended. But if you feel the benefits of allowing some vulnerabilities through outweighs the risks of letting all vulnerabilities through, that is your decision (you can use BANCRVIRUSES OFF in the virus.cfg file to do this). Yes and thats what i had to do We're not aware of any cases of IMail causing this (although IMail v8's web messaging *does* send out the Outlook 'CR' vulnerability when attachments with filenames containing high-bit characters are sent). If you see a line in the headers with a single space or tab, then the sending mail client needs to be fixed. Well we from a webbased form send to a list off users to another server et comes through with out this problem But sending to our server it is stopped directly and there is a blank line Note that *any* mailserver running up-to-date AV software should be blocking these E-mails. So having your customers fix the problem may help them out much more than they realize (they could have half of their E-mails blocked right now and not know it, for example). But thats another question --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] Ipswitch removed link til declude and other 3. party
Last time i was on the web pages for Imail there where a page of third party tools Loganalyzeres and declude and so on, but now I only find 3 links there and all of them looks like close companies to Ipswich. Is this a new policy or have I just blind ? Anyone have the link for the virusloganalyzer ? Benny --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Huge problems with new server
No I am running 7.13 It occurs only when i load the Iadmin interface on the server after testing som more it takes around 30 minutes to load all 5000 virtual domains in the GUI. Had to take it back from production yesterday really didn't want to risk something went real bad . And this is before any mail are send to it, this just when we are testing that i shows all domains and so on -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: 15. oktober 2003 07:01 To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Huge problems with new server Are you using Imail AntiSpam DNS tests? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.Virus- [EMAIL PROTECTED] On Behalf Of ISPhuset Nordic AS Sent: Tuesday, October 14, 2003 1:29 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Huge problems with new server The windows 2003 supports up to 4 cpu and i see all 4 eight hyper cpu's -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.Virus- [EMAIL PROTECTED] On Behalf Of Webmaster Oilfield Directory Sent: 14. oktober 2003 23:04 To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Huge problems with new server Make sure you are running a multi processor version of the operating system otherwise your screwed... - Original Message - From: ISPhuset Nordic AS [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, October 14, 2003 12:51 PM Subject: [Declude.Virus] Huge problems with new server Moving an imail server to a never box but it is running so slow that u can't imagine the new box is a 4 way Xeon 1,4 MP with 4 cpu's 4 GB of ram 256 mb on the scsi controller running 2003 standard server and still opening imail admin on the server is taken forever it is showing about 1 virtual domain in the list per second any one having any idea what can be wrong It is only accessing one cpu when doing this Benny --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Huge problems with new server
Is it possible to call u and explain... even show u contact me offlist [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: 15. oktober 2003 09:31 To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Huge problems with new server OK, so this is a new server not in production yet. Have you run performance monitor to see what is taking up the CPU time? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.Virus- [EMAIL PROTECTED] On Behalf Of ISPhuset Nordic AS Sent: Wednesday, October 15, 2003 12:22 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Huge problems with new server No I am running 7.13 It occurs only when i load the Iadmin interface on the server after testing som more it takes around 30 minutes to load all 5000 virtual domains in the GUI. Had to take it back from production yesterday really didn't want to risk something went real bad . And this is before any mail are send to it, this just when we are testing that i shows all domains and so on -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.Virus- [EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: 15. oktober 2003 07:01 To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Huge problems with new server Are you using Imail AntiSpam DNS tests? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.Virus- [EMAIL PROTECTED] On Behalf Of ISPhuset Nordic AS Sent: Tuesday, October 14, 2003 1:29 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Huge problems with new server The windows 2003 supports up to 4 cpu and i see all 4 eight hyper cpu's -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.Virus- [EMAIL PROTECTED] On Behalf Of Webmaster Oilfield Directory Sent: 14. oktober 2003 23:04 To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Huge problems with new server Make sure you are running a multi processor version of the operating system otherwise your screwed... - Original Message - From: ISPhuset Nordic AS [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, October 14, 2003 12:51 PM Subject: [Declude.Virus] Huge problems with new server Moving an imail server to a never box but it is running so slow that u can't imagine the new box is a 4 way Xeon 1,4 MP with 4 cpu's 4 GB of ram 256 mb on the scsi controller running 2003 standard server and still opening imail admin on the server is taken forever it is showing about 1 virtual domain in the list per second any one having any idea what can be wrong It is only accessing one cpu when doing this Benny --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list
[Declude.Virus] OT anyone know these guys ?
http://authorizations.net/ sending this mail as html, the webpage looks ok but I can't take such email serious Benny Attention! In our global system of monitoring there was a technical failure. In avoidance of frauds with your credit card enter the full data for authorization, otherwise your credit card will be frozen during 10 day. First name: Last name: Date of Birth SSN: MMN: Alternative password: max 8 char. Full Name on Credit Card: Card Type: VisaMasterCardAmexDinersClub Card Number: Expiry date: CVV2 code: ATM PIN (Bank Verification) #: Credit Card Billing Address: City: State/Province: Province if not US/Canada: Zip/Postal Code: Phone Number: Fax Number: Country: AfghanistanAlbaniaAlgeriaAmerican SamoaAngolaAnguillaAntarcticaAntiguaArgentinaArmeniaArubaAscension IslandAustraliaAustriaAzerbaijanBahamasBahrainBangladeshBarbadosBelarusBelgiumBelizeBeninBermudaBhutanBoliviaBosnia-HerzegovinaBotsw anaBrazilBritish Virgin IslandsBruneiBulgariaBarkinoa FasoBurundiCameroonCambodiaCanadaCape Verde IslandsCayman IslandsCentral African Rep.Chad RepublicChileChinaColombiaComorosCongoCook IslandsCosta RicaCroatiaCyprusCzech RepublicDenmarkDiego GarciaDjiboutiDominicaDominican RepublicEcuadorEgyptEl SalvadorEqitorial GuineaEritreaEstoniaEthiopiaFaeroe IslandsFalkland IslandsFiji IslandsFinlandFrench GuyanaFrench PolynesiaFranceFrench AntillesGabonGambiaGeorgiaGermanyGhanaGibralterGreeceGreenlandGrenadaGuadeloupeGuamGuantanemo BayGuatemalaGuineaGuinea BissauGuyanaHaitiHondurasHong KongHungaryIcelandIndiaIndonesiaIranIraqIrelandIsraelItalyIvory CoastJamaicaJapanJordanKazakhstanKenyaKiribatiKorea (South)Korea (North)KuwaitKyrgyzstanLaosLatviaLebanonLesothoLiberiaLibyaLithuaniaLuxembourgMacaoMacedoniaMadagascarMalawiMalaysiaMaldivesMali RepublicMaltaMarshall IslandsMauritaniaMauritiusMexicoMicronesiaMoldovaMongoliaMontserratMoroccoMozambiqueNamibiaNauruNepalNetherland AntillesNetherlandsNevisNew CalidoniaNew ZealandNicaraguaNigerNigeriaNiue IslandNorfork IslandNorwayOmanPakistanPalauPanamaPapua New GuiniaParaguayPeruPhilipinesPolandPortugalQatarReunion IslandRomaniaRussian FederationRwandaSaipanSao TomeSaudi ArabiaSenegal RepublicSeychelles IslandSierrra LeoneSingaporeSlovakiaSloveniaSoloman IslandSomaliaSouth AfricaSpainSri LankaSt HelenSt KittsSt LuciaSt PierreSt VincentSudanSurinameSwazilandSwedenSwitzerlandSyriaTaiwanTanzaniaThailandTogoTongaTrinidad TobagoTunisiaTurkeyTurks/CaicosTuvaluUgandaUkraineUnited Arab EmiratesUnited KingdomUnited StatesCanadaUruguayVanuatuVenezuelaViet NamWallis / FutunaWest SamoaYemen RepublicYugoslaviaZaireZambiaZimbabwe Authorizations.Net, an InfoSpace service, is the preferred global payment-processing service for e-commerce, enabling merchants to process secure transactions in real time, 24 hours a day. Authorizations.Net Payment Solutions process credit cards and electronic checks, and work with any business model, including Internet, broadband, wireless, call centers, and retail. More businesses are using Authorizations.Net to process their transactions over the Internet than any other payment solutions provider. Since 1996, Authorizations.Net has rapidly become a leading provider of Internet-based transaction services, with thousands of online and traditional business customers around the world. Authorizations.Net has also formed strategic alliances with leading financial institutions and technology partners to deliver the most comprehensive online authorization and processing services in the industry. Business Development As the Internet's leading real-time payment processor, Authorizations.Net is the clear choice for e-commerce-related business development opportunities. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] Huge problems with new server
Moving an imail server to a never box but it is running so slow that u can't imagine the new box is a 4 way Xeon 1,4 MP with 4 cpu's 4 GB of ram 256 mb on the scsi controller running 2003 standard server and still opening imail admin on the server is taken forever it is showing about 1 virtual domain in the list per second any one having any idea what can be wrong It is only accessing one cpu when doing this Benny --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Huge problems with new server
The windows 2003 supports up to 4 cpu and i see all 4 eight hyper cpu's -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Webmaster Oilfield Directory Sent: 14. oktober 2003 23:04 To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Huge problems with new server Make sure you are running a multi processor version of the operating system otherwise your screwed... - Original Message - From: ISPhuset Nordic AS [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, October 14, 2003 12:51 PM Subject: [Declude.Virus] Huge problems with new server Moving an imail server to a never box but it is running so slow that u can't imagine the new box is a 4 way Xeon 1,4 MP with 4 cpu's 4 GB of ram 256 mb on the scsi controller running 2003 standard server and still opening imail admin on the server is taken forever it is showing about 1 virtual domain in the list per second any one having any idea what can be wrong It is only accessing one cpu when doing this Benny --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] Doc file cached as exe and banned
Anyone having an idea why this mail is assumed to be an exe when its actually a doc file ? Benny 10/07/2003 15:18:38 Qbd2e1e29004e9eb1 Found file with mismatched extensions [=?ISO-8859-1?Q?Supportm=F6nster.do?==?ISO-8859-1?Q-=?ISO-8859-1?Q?Supportm=F6nster?==?ISO-8859-1?Q?.d]; assuming .exe 10/07/2003 15:18:38 Qbd2e1e29004e9eb1 Scanned: Banned file extension. [MIME: 2 82375] 10/07/2003 15:18:38 Qbd2e1e29004e9eb1 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] 10/07/2003 15:18:38 Qbd2e1e29004e9eb1 Subject: Supportmönster --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] Blank Folding
Why is this mail cached by the blank folder I can't see anywhere that there are an error which should cause this Benny Received: from mailgw2.mailserveren.com [213.236.237.229] by mx2.mailserveren.com with ESMTP (SMTPD32-7.13) id AE3826FC0024; Fri, 03 Oct 2003 11:15:36 +0200 Received: from bnserver01.bennin.no (a217-118-34-25.bluecom.no [217.118.34.25]) by mailgw2.mailserveren.com (Postfix) with ESMTP id 6B6B611D768 for [EMAIL PROTECTED]; Fri, 3 Oct 2003 11:28:48 +0200 (CEST) content-class: urn:content-classes:message Subject: =?iso-8859-1?Q?VS=3A_Storrengj=F8ring?= MIME-Version: 1.0 Content-Type: image/jpeg; name=dishwasher.jpg Content-Transfer-Encoding: base64 Content-Description: dishwasher.jpg Content-Disposition: attachment; filename=dishwasher.jpg Date: Fri, 3 Oct 2003 11:13:10 +0200 X-MimeOLE: Produced By Microsoft Exchange V6.0.6375.0 Message-ID: [EMAIL PROTECTED] X-MS-Has-Attach: yes X-MS-TNEF-Correlator: Thread-Topic: =?iso-8859-1?Q?VS=3A_Storrengj=F8ring?= Thread-Index: AcOJjpB/chACwfE4QEeJ8limw8F/kA== From: Eivind Pettersen [EMAIL PROTECTED] To: =?iso-8859-1?Q?Helge_B=F8e_=28E-post=29?= [EMAIL PROTECTED], Carl E. M. Flygare (E-post) [EMAIL PROTECTED], Harald Fossum (E-post) [EMAIL PROTECTED], Petter(jobb) (E-post) [EMAIL PROTECTED], =?iso-8859-1?Q?Karl_Erik_Sletteb=F8e_=28E-post=29?= [EMAIL PROTECTED], X-Declude-Sender: [EMAIL PROTECTED] [213.236.237.229] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: None [0] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Blank Folding
so just a wild guess if u sent to a group of your contacts in Outlook and is has a bad adresss this can happen ? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: 3. oktober 2003 15:35 To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Blank Folding Why is this mail cached by the blank folder I can't see anywhere that there are an error which should cause this The Outlook Blank Folding Vulnerability occurs when there is a line in the headers with just a single space or a single tab character. In this case: From: Eivind Pettersen [EMAIL PROTECTED] To: =?iso-8859-1?Q?Helge_B=F8e_=28E-post=29?= [EMAIL PROTECTED], Carl E. M. Flygare (E-post) [EMAIL PROTECTED], Harald Fossum (E-post) [EMAIL PROTECTED], Petter(jobb) (E-post) [EMAIL PROTECTED], =?iso-8859-1?Q?Karl_Erik_Sletteb=F8e_=28E-post=29?= [EMAIL PROTECTED], X-Declude-Sender: [EMAIL PROTECTED] [213.236.237.229] The last header (before Declude added its headers) was a line with just a single tab character. This is in violation of RFC822 3.2.3, and creates the vulnerability. Even more interesting, it appears that the mail client dropped off one of the recipients -- the last one ends with a ,, which would imply that there were more addresses that disappeared. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Blank Folding
The problem is that folding is used to take a long line and split it up into several smaller lines (if you have looked at Received: headers, most of them do this -- if the header starts with a space or a tab, it is a continuation of the previous line). However, with just a single space or tab, that's like taking one line and making two out of it, with the first line containing the whole line, and the second line completely blank. It just doesn't make any sense. -Scott thats right but if I send an email to someone this is taken automaticly to outlook and in outlook it just appeas as benny not the email address then Outlook will try to send to this contact even if there is not an email address in that contact, then this one will appear as blank and can cause this ? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Blank Folding
ok just trying to figure out why this is coming in the mail -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: 3. oktober 2003 16:52 To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Blank Folding thats right but if I send an email to someone this is taken automaticly to outlook and in outlook it just appeas as benny not the email address then Outlook will try to send to this contact even if there is not an email address in that contact, then this one will appear as blank and can cause this ? Unfortunately, I do not know under what situations Outlook will do this. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Swen... Incredible..
Title: Message -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sharyn SchmidtSent: 29. september 2003 13:35To: [EMAIL PROTECTED]Subject: RE: [Declude.Virus] Swen... Incredible.. Not a single person in the domains hosted on our server has received a single incident. Kami, If it makes you feel any better, I am getting approximately 40 to 50 of these a day, while the rest of my users, combined, have received no more than 20. Sharyn That has a natural explanation the virus are looking in newsgroups and mailinglists for adresses to send to... most people dont use that Benny
[Declude.Virus] loganalyzer
Anyone here having anything like the domlist.exe for the virus log I would like to create som stats for who is sending virus and to whom its coming Benny --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] OT folder size
Anyone her knowing how to create a report with the folder size for the mailusers i know how to list out the mailbox size but what i want is to get at report where the total folder size is listed... banging my head here Benny --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Skipping Sobig.F virus notifications
just using SKIPIFVIRUSNAMEHAS Sobig and that seems to work -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Steve Flook Sent: 20. august 2003 14:45 To: Declude Virus Mailing list (E-mail) Subject: [Declude.Virus] Skipping Sobig.F virus notifications I have tried a couple of different SKIPIFVIRUSNAMEHAS variations without success: SKIPIFVIRUSNAMEHAS W32/Sobig.F SKIPIFVIRUSNAMEHAS Sobig.F There is just one space betweent the SKIPVIRUSNAMEHAS and vulnerability. What is everyone else using? Also, for the next time, will the vulnerability name be what is reported by the %VIRUSNAME% variable or something else? Thanks, Steve --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Skipping Sobig.F virus notifications
you put it in every .eml file in the declude folder as the first line -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Tim Collins Sent: 20. august 2003 15:08 To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Skipping Sobig.F virus notifications What configuration file do you put 'SKIPIFVIRUSNAMEHAS Sobig' in and what exactly does it do with the message. New ISP owner, Tim Collins -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of ISPhuset Nordic AS Sent: Wednesday, August 20, 2003 7:00 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Skipping Sobig.F virus notifications just using SKIPIFVIRUSNAMEHAS Sobig and that seems to work -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Steve Flook Sent: 20. august 2003 14:45 To: Declude Virus Mailing list (E-mail) Subject: [Declude.Virus] Skipping Sobig.F virus notifications I have tried a couple of different SKIPIFVIRUSNAMEHAS variations without success: SKIPIFVIRUSNAMEHAS W32/Sobig.F SKIPIFVIRUSNAMEHAS Sobig.F There is just one space betweent the SKIPVIRUSNAMEHAS and vulnerability. What is everyone else using? Also, for the next time, will the vulnerability name be what is reported by the %VIRUSNAME% variable or something else? Thanks, Steve --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] problems when testing a new server
Have sett up the server in the exact same with one exception on the old server i use f-prot312c on the new server i user f-prot314a_m when i run a test with eicar.com on the server localy in webmail it slips through when i have i only the on demand scanner installed copy of config # # Declude Virus configuration file # CODE6F4B90A4 # The in the LOGFILE option gets replaced with the month/date LOGFILE E:\virus\vir.log LOGLEVELMID CONSOLE OFF # SCANFILE is the location of the command-line virus scanner. Note that it # must include the full path. VIRUSCODE is the code that scanner returns if # it finds a virus. SCANFILEC:\f-prot\fpcmd.exe /TYPE /SILENT /NOMEM /NOFLOPPY /ARCHIVE /NOBOOT /DUMB /REPORT=report.txt VIRUSCODE 3 VIRUSCODE 6 #VIRUSCODE 8 REPORTInfection PRESCAN ON # VIRDIR is the directory to move E-mails with viruses; by default, # it is set to 'virus' (\IMail\spool\virus). VIRDIR E:\virus # The MAXATONCE option limits the number of AV processes. For example, # MAXATONCE 1 will only allow 1 AV process to run at once (IE for licensing # purposes). A value of 0 (or commenting it out) allows unlimited processes # to run at the same time. #MAXATONCE 1 ## The following options allow you to limit scanning to only incoming or outgoing # E-mail, with v1.13 and higher. If they are commented out (# in front of them), # Declude will scan all E-mail. #INCOMING ON #OUTGOING ON BANEXT COM BANEXT PIF BANEXT EXE BANEXT SCR BANNAME message.zip when i turn on the real time protector i cant attatch the eicar.com file deny it just at is should Any good ideas here --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] problems when testing a new server
running the exact same version but what i found here is that if i log onto my webmail on the old server i can send and eicar.com file to my account on another domain and it is not being stopped either from the virus scanner or from the banext in my config file but do i send it from my mailclient it works ok -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jim Matuska Sent: 12. august 2003 22:02 To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] problems when testing a new server Are you running the same versions of Imail and declude on each server, I seem to remember something a while back about needing a later version of Imail or Declude to catch webmail based virus attachments. Jim Matuska Jr. Computer Tech II CCNA Nez Perce Tribe Information Systems [EMAIL PROTECTED] - Original Message - From: ISPhuset Nordic AS [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, August 12, 2003 12:41 PM Subject: [Declude.Virus] problems when testing a new server Have sett up the server in the exact same with one exception on the old server i use f-prot312c on the new server i user f-prot314a_m when i run a test with eicar.com on the server localy in webmail it slips through when i have i only the on demand scanner installed copy of config # # Declude Virus configuration file # CODE6F4B90A4 # The in the LOGFILE option gets replaced with the month/date LOGFILE E:\virus\vir.log LOGLEVELMID CONSOLE OFF # SCANFILE is the location of the command-line virus scanner. Note that it # must include the full path. VIRUSCODE is the code that scanner returns if # it finds a virus. SCANFILEC:\f-prot\fpcmd.exe /TYPE /SILENT /NOMEM /NOFLOPPY /ARCHIVE /NOBOOT /DUMB /REPORT=report.txt VIRUSCODE 3 VIRUSCODE 6 #VIRUSCODE 8 REPORTInfection PRESCAN ON # VIRDIR is the directory to move E-mails with viruses; by default, # it is set to 'virus' (\IMail\spool\virus). VIRDIR E:\virus # The MAXATONCE option limits the number of AV processes. For example, # MAXATONCE 1 will only allow 1 AV process to run at once (IE for licensing # purposes). A value of 0 (or commenting it out) allows unlimited processes # to run at the same time. #MAXATONCE 1 ## The following options allow you to limit scanning to only incoming or outgoing # E-mail, with v1.13 and higher. If they are commented out (# in front of them), # Declude will scan all E-mail. #INCOMING ON #OUTGOING ON BANEXT COM BANEXT PIF BANEXT EXE BANEXT SCR BANNAME message.zip when i turn on the real time protector i cant attatch the eicar.com file deny it just at is should Any good ideas here --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] problems when testing a new server
That fixed it thanks a lot -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: 12. august 2003 22:47 To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] problems when testing a new server with the new engine and using f-prot.exe and sending from my outlook client i get a virus warning and its ok but doing the same with fpcmd.exe it get caught of the banext This sounds like a separate issue -- the command lines for F-Prot.exe and fpcmd.exe should be identical *except* that you must not use /NOFLOPPY with fpcmd.exe, but you must use it with F-Prot.exe. If you use /NOFLOPPY with fpcmd.exe, it will not work. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] problems when testing a new server
ahh that explains a lot thought for a moment here it was my scanner messing with me -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: 12. august 2003 22:27 To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] problems when testing a new server do i send an email from webmail opened on a terminal session, and sending eicar.com out in the world it will NOT trigger any of the options witch are in the virus config file f.ex banext Why ? That's because in versions of IMail before v8, they set it up so that outgoing E-mail from web messaging would not get scanned. It is extremely rare, however, for outgoing web messaging E-mail to contain a virus (it can only happen if the sender has a virus on their computer, intentionally attaches a file, that happens to contain a virus, and it is an executable file). If you have an on-access virus scanner scanning just the \IMail\spool directory (but not the subdirectories!), then the virus will get caught when it is uploaded (you'll need to double-check that your version of IMail stores the attachments in the \IMail\spool directory while they are being uploaded, however). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] [OT]: BugBear
Yes its anew variant of Bugbear worse than the first one -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Greg Foulks Sent: 5. juni 2003 15:52 To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] [OT]: BugBear No but man did we get hit with Sobig last night! Thank you Declude and Mcafee! You make my network admin life easy! Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jeff Maze - Hostmaster Sent: Thursday, June 05, 2003 9:40 AM To: [EMAIL PROTECTED] Subject: [Declude.Virus] [OT]: BugBear Anyone notice a rise in Bugbear lately? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
