Re: [Declude.Virus] F-Prot Updater
I use the F-prot updater, no problem. Andy - Original Message - From: Lukasz Kaminski [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, April 07, 2004 1:49 PM Subject: [Declude.Virus] F-Prot Updater I was wondering if someone could point out the advantages/disadvantages between using the F-Prot updater and the F-Prot for DOS updater from declude.com/tools. I only run 1 IMail Server. I spoke to F-Prot Support and they confirmed that their updater renews both the win32 and DOS definitions. Thanks, Lukasz --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] whitelisting?
Hi, I have a customer that is insisting I let .zip files through (I have them banned right now). Is there any way to allow email to a single address to go through? If I do a whitelist entry for this one email address in the global.cfg, will that work? Thanks, andy thumpernet --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] whitelisting?
Because I am dealing with unsophisticated uses that click on anything attached. There was so much confusion on the list at the time that I just banned all zip files, better safe than sorry. I would now need to go back and try to figure out exactly what settings I need to stop the bad stuff and allow the good stuff. I know, I know, go search the archives.. That is exactly why it is the way it is. I'm one of those people that believe telling people to go search the archives is a waste of time. Everytime I search the archives, I never find what I need and I end up asking anywayor I ask Scott off list so I don't get ridiculed for asking (that's why I pay for a support contract, to get support). If things have settled down enough now so that it is OK to allow certain zip files to go through, I'd be happy to do that if I knew concisely how. Thanks, andy - Original Message - From: Douglas Cohn [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, March 19, 2004 1:14 PM Subject: Re: [Declude.Virus] whitelisting? I agree with your customer. Why do you ban all zip files? How are they expected to conduct business if their business requires transferring files? My customers required that I create a way for them to retrieve the infected files for them. You could simply do that. Allow the customer to retrieve the infected files if desired by creating a link and script to copy them into the spool dir. Blocking encrypted zips is one thing but why all zip files? Doug -- Original Message -- From: [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Fri, 19 Mar 2004 12:44:15 -0500 Hi, I have a customer that is insisting I let .zip files through (I have them banned right now). Is there any way to allow email to a single address to go through? If I do a whitelist entry for this one email address in the global.cfg, will that work? Thanks, andy thumpernet --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] whitelisting?
I have the pro version syntax please Thanks, andy - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, March 19, 2004 1:13 PM Subject: Re: [Declude.Virus] whitelisting? I have a customer that is insisting I let .zip files through (I have them banned right now). Is there any way to allow email to a single address to go through? If I do a whitelist entry for this one email address in the global.cfg, will that work? You could disable virus scanning for that one customer (if you are using Declude Virus Pro). But it is not possible to set the banned file extensions or vulnerability detect on a per-user or per-domain basis. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] whitelisting?
Thanks Scott, Best money I ever spent - Declude. Can't say enough how much your efforts are appreciated. :) Andy Thumpernet - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, March 19, 2004 1:41 PM Subject: Re: [Declude.Virus] whitelisting? I would now need to go back and try to figure out exactly what settings I need to stop the bad stuff and allow the good stuff. FYI, the latest advice is: [1] Run the latest interim of Declude Virus (1.78i27 or later), and [2] Block all encrypted .ZIP files by adding a line BANEXT EZIP to the \IMail\Declude\virus.cfg file. That shuold block all known viruses. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] whitelisting?
and BANEZIPEXTS ON is no longer needed, correct? Thanks, Andy - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, March 19, 2004 1:41 PM Subject: Re: [Declude.Virus] whitelisting? I would now need to go back and try to figure out exactly what settings I need to stop the bad stuff and allow the good stuff. FYI, the latest advice is: [1] Run the latest interim of Declude Virus (1.78i27 or later), and [2] Block all encrypted .ZIP files by adding a line BANEXT EZIP to the \IMail\Declude\virus.cfg file. That shuold block all known viruses. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] New interim Declude Virus Pro to block bogus .bat, .com, .pif, and .scr files
I also forwarded the original message to your email addresswith .zip attached. Thanks, Andy - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, March 03, 2004 7:51 AM Subject: Re: [Declude.Virus] New interim Declude Virus Pro to block bogus .bat, .com, .pif, and .scr files Matt, that's how I have it setup, and one got through. What is one? A .ZIP file with a banned encrypted file extension? A .ZIP file with a banned non-encrypted file extension? A .ZIP file with an encrypted file that does not have a banned file extension? Something else? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] New interim release to ban extensions in .ZIP files
Hi, I've got BANEZIPEXTS ON And the file got through (encrypeted zip with password in the body of the email) ver 1.78i7 There is so much info floating around...what version do I need to block this, and what exactley do I need in the config files?? Scott, can you please list the recommended config, the ver, and what each config line does? Thanks, Andy - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, March 02, 2004 6:17 PM Subject: Re: [Declude.Virus] New interim release to ban extensions in .ZIP files I am trying to understand this, but the reality doesn't work like I think you are saying it should. If I have the following in my virus.cfg file: BANEXT EZIP Note that BANEXT EZIP is the original quickly-implemented format that may have problems. with or without: BANZIPEXTS ON BANEZIPEXTS ON These lines will ban file extensions that appear in .ZIP files (both un-encrypted and encrypted files). Any BANEXT lines will be used to determine whether files within .ZIP files should be banned. I catch the encrypted/password protected virus files. However, if I use just: BANZIPEXTS ON BANEZIPEXTS ON the virus files pass right through declude, reporting that the file is virus free. Am I simply not understanding how this is supposed to work. I though we no longer needed to use BANEXT EZIP. Please enlighten me on the error of my ways... :-) The old format (which I won't repeat, just because the more it gets repeated the more likely people will try to use it) would block any .ZIP file if the first file in it was encrypted (even if it was a .TXT file). The new format will ban the same extensions that you are already banning, but will do so in .ZIP files. The BANZIPEXTS ON option will ban the files if they are un-encrypted, the BANEZIPEXTS ON will ban the files if they are encrypted. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] New interim Declude Virus Pro to block bogus .bat, .com, .pif, and .scr files
thanks, Andy - Original Message - From: John Carter [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, March 03, 2004 11:37 AM Subject: RE: [Declude.Virus] New interim Declude Virus Pro to block bogus .bat, .com, .pif, and .scr files Virustrap at the declude.com domain - Scott wisely doesn't post actual @ addresses on the list. The list archive is probably scanned for addresses just as our websites are. John -Original Message- OK... so I got a No, no, NO but what is the address!!!??? - Original Message - From: R. Scott Perry [EMAIL PROTECTED] We have one and only one E-mail address that viruses or suspicious files may be sent to (the declude.com virustrap address). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Passworded zip files still getting through!
HI, I've been using BANEXT .com I am seeing on this list that is wrong, and the *dot* should be removed...correct? Thanks, Andy Thumpernet - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, March 03, 2004 11:43 AM Subject: RE: [Declude.Virus] Passworded zip files still getting through! Confirmed. I commented out # BANEZIPEXTSON I left in: BANEXT EZIP And resent myself the virus and it was blocked. Good catch. :) I'll be investigating this to see why that is happening. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Scan Password Protected Zip's
Yea, that what I was looking for, but I did find it (I was lookin for the earl..) thanky, backwoods Andy - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, March 02, 2004 4:19 PM Subject: Re: [Declude.Virus] Scan Password Protected Zip's I'm only seeing 1.78 beta on your website? Correct. We do not have a direct link to the interims on the website. You must follow the supplied URL. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] New F-prot 3.14c
F-Prot will detect mydoom.f with 3.14b and updated defintions... Andy Thumpernet - Original Message - From: Gene Head To: [EMAIL PROTECTED] Sent: Tuesday, February 24, 2004 6:54 PM Subject: RE: [Declude.Virus] New F-prot 3.14c I installed it and it is finally detecting MyDoom.F Gene HeadACCRAM Inc.MCP,Net+,A+,CCNA,CCDA[EMAIL PROTECTED][EMAIL PROTECTED] -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Don HickeySent: Tuesday, February 24, 2004 9:17 AMTo: [EMAIL PROTECTED]Subject: [Declude.Virus] New F-prot 3.14c I see they updated F-prot to 3.14c Anyone had a chance to try it out yet? Thanks Don Hickey
Re: [Declude.Virus] log file analyzer
I didn't notice it the readme.txt. I did read ALL of the setup info on the web page... - Original Message - From: Darin Cox To: [EMAIL PROTECTED] Sent: Sunday, February 01, 2004 8:46 PM Subject: Re: [Declude.Virus] log file analyzer Hi Andy, Not sure if you got a reply...but you need to set Declude Virus LogLevel to MID. It's in the Readme.txt. I did the same thing...ran the utility before looking at the doc... Darin. - Original Message - From: andyb To: [EMAIL PROTECTED] Sent: Friday, January 30, 2004 11:13 PM Subject: Fw: [Declude.Virus] log file analyzer Hi everyone, Scott, anybody, does the log file analyzer work? Am I chasing my tail here? Is there a log file analyzer out there that IS working? If so can someone point the way? I've looked in the archives and haven't found anything. This the 3rd post, and haven't even gotten a grunt from anyone yet Thanks, Andy - Original Message - From: andyb To: [EMAIL PROTECTED] Sent: Friday, January 30, 2004 5:12 PM Subject: [Declude.Virus] log file analyzer HI, The log file analyzer 3.0 is counting the carriage return vulnerablity, but not the virus. There are hundreds of virus in log files. It also appears that the .txt file is properly formed (no garbage, it is just saying there are - 0 - virus found) I'm using declude 1.77. I've tried installing the analyzer on4 different computers, 3 different operating systems so it appears that there may be an issue with the log files,not with the analyzer. There is nothing about this in the archives that I could find. What does the log analyzer need to have in the logs to count the virus? Guidance please. thanks, Andy Thumpernet
Re: [Declude.Virus] log file analyzer
Hi, I'm all set, needed to change the log level to mid. Caught 7 my doom in 1 hour..sheesh. Thanks to all for helping. Andy - Original Message - From: Dan Berry To: [EMAIL PROTECTED] Sent: Monday, February 02, 2004 9:24 AM Subject: RE: [Declude.Virus] log file analyzer Set the log level to MID and it works great. Just rana virus analysis report thismorning andprevented over 300 viruses from entering the data environment through e-mail attachments last week. Thank you Declude.You are good. Dan BerrySenior Information System/Telecommunication CoordinatorCity of Raytown, MO.816-737-6070 -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of andybSent: Monday, February 02, 2004 8:01 AMTo: [EMAIL PROTECTED]Subject: Re: [Declude.Virus] log file analyzer I didn't notice it the readme.txt. I did read ALL of the setup info on the web page... - Original Message - From: Darin Cox To: [EMAIL PROTECTED] Sent: Sunday, February 01, 2004 8:46 PM Subject: Re: [Declude.Virus] log file analyzer Hi Andy, Not sure if you got a reply...but you need to set Declude Virus LogLevel to MID. It's in the Readme.txt. I did the same thing...ran the utility before looking at the doc... Darin. - Original Message - From: andyb To: [EMAIL PROTECTED] Sent: Friday, January 30, 2004 11:13 PM Subject: Fw: [Declude.Virus] log file analyzer Hi everyone, Scott, anybody, does the log file analyzer work? Am I chasing my tail here? Is there a log file analyzer out there that IS working? If so can someone point the way? I've looked in the archives and haven't found anything. This the 3rd post, and haven't even gotten a grunt from anyone yet Thanks, Andy - Original Message - From: andyb To: [EMAIL PROTECTED] Sent: Friday, January 30, 2004 5:12 PM Subject: [Declude.Virus] log file analyzer HI, The log file analyzer 3.0 is counting the carriage return vulnerablity, but not the virus. There are hundreds of virus in log files. It also appears that the .txt file is properly formed (no garbage, it is just saying there are - 0 - virus found) I'm using declude 1.77. I've tried installing the analyzer on4 different computers, 3 different operating systems so it appears that there may be an issue with the log files,not with the analyzer. There is nothing about this in the archives that I could find. What does the log analyzer need to have in the logs to count the virus? Guidance please. thanks, Andy Thumpernet
Re: [Declude.Virus] W32/Mydoom.A@mm
So with the new beta, I don't have to change anything in the config files? Does this make the SKIP in the .eml notifications obsolete? Thanks, Andy - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, January 28, 2004 11:42 AM Subject: Re: [Declude.Virus] W32/[EMAIL PROTECTED] Automatically ? I always think that if the client isn't notified at least once, they will not think they are protected. We let a few slip through and them stop them from being notified like the Klez virus. The automatic detection of forging viruses prevents the *bogus* notifications (ones that go to the wrong people). It does not block the valid ones (the ones to your users). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] W32/Mydoom.A@mm
cool - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, January 28, 2004 3:45 PM Subject: Re: [Declude.Virus] W32/[EMAIL PROTECTED] So with the new beta, I don't have to change anything in the config files? Does this make the SKIP in the .eml notifications obsolete? Correct. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] BANEXT
Would you be willing to send the list as a text file? Thanks, Andy - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, January 28, 2004 3:55 PM Subject: RE: [Declude.Virus] BANEXT What are the recommended extensions to BAN? http://www.eservicesforyou.com/documents/emailattachments.pdf How do you handle it if someone needs to send a file through...sometimes there will be legitimate files that need to be send through. I tell them to zip it. John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] declude and win 2003 server
Scott, Are there any compatibility issues with declude and win 2003 server? Thanks, Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] declude and win 2003 server
Is this also an issue with Win 2000 server? - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, October 31, 2003 2:34 PM Subject: Re: [Declude.Virus] declude and win 2003 server Are there any compatibility issues with declude and win 2003 server? No, but there are some issues with IMail and Windows 2003. Specifically, there is a registry problem, where it can take minutes to load IMail Administrator. I believe a workaround was posted on the IMail Forum (by adding a registry entry, it would apparently fix the problem). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Declude and win 2003 server
What DNS software are you using? Is it located on the same server or elsewhere? - Original Message - From: Kami Razvan [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, October 31, 2003 4:09 PM Subject: RE: [Declude.Virus] Declude and win 2003 server Hi; We have DNS issues... - Windows 2003 Standard - Declude JM, Virus - IMail 8.03 Every 2-3 days the DNS server can not be located and the outgoing mail gets stuck.. If you try to go to an internet site it can't find it.. We have searched all over MSDN for KB articles or IPSwitch site but have not found anything. Remedy: Reboot every other day... After reboot it is all fine. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Friday, October 31, 2003 3:41 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Declude and win 2003 server I consult on a server that has Imail 8.03 on Windows 2003. There are some issues. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.Virus- [EMAIL PROTECTED] On Behalf Of Todd Holt Sent: Friday, October 31, 2003 11:45 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] declude and win 2003 server We run Imail 7.x, Declude Junkmail and Virus, f-prot and AVG all on a Win2003 server. It works great! Does anyone run Imail 8.x on Win2003? We are upgrading to 8.x soon. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.Virus- [EMAIL PROTECTED] On Behalf Of andyb Sent: Friday, October 31, 2003 11:31 AM To: [EMAIL PROTECTED] Subject: [Declude.Virus] declude and win 2003 server Scott, Are there any compatibility issues with declude and win 2003 server? Thanks, Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] FW: WARNING: YOU MAY HAVE A VIRUS
Is this BS really necessary? If you don't like someone, can't you keep it to yourself? A simple philosophy, don't be annoying and don't be easily annoyed. John may have a big ego...so what?! I haven't met a computer engineer yet worth a darn that doesn't have a big ego. It take a lot of moxy to be responsible for hundreds/thousands of users computers/accounts when the crap is flying all around and you are the one getting yelled at. I've been on/watching this list for a long time. I don't always like the answers I get, but the people here DO HELP ME. That is the bottom line, isn't it? Or is it about hurting egos? Personally, I don't think there is room for ego in the business world. I don't think any of us are here for the fun of it, but to make money, right? If I have to supress my ego to get the answers I need and to get the job done, SO BE IT. Come to think of it, we are usually guilty of what we accuse others of. In my experience it's people with bloated egos who attempt to publically ridicule and chastise. Mike Tindor I think it would be helpful to remember that John and others like him are NOT GETTING PAID to help with your issues or mine. This IS THE SPIRIT of the Internet, all of us helping each other, the best we can. That's my 2 cents worth. And I've been in this business a long time, 16 years, 8 of it running ISP's and being responsible for corporate networks. I don't have to like John's approach to *respect* him and his efforts on this list. Now, can we all be nice to each other in this sand box...PLEASE?! Andrew Thumpernet - Original Message - From: FIRST Internet Declude Virus Account [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, September 06, 2003 12:25 PM Subject: RE: [Declude.Virus] FW: WARNING: YOU MAY HAVE A VIRUS I'd have to agree. I guess all of the letters after John's name have gone to his head. In my experience it's people with bloated egos who attempt to publically ridicule and chastise. Seems to me a friendly note directly to the admin would have been more appropriate. Mike Tindor -- Original Message -- From: Tim Collins [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Sat, 30 Aug 2003 07:55:41 -0500 John Tolmachoff, Personally, I have 2 months experience with my new ISP company and Declude. Not everyone is as smart as you. Maybe you should leave the List and start your own discussion group. The only stupid question is the one that is not asked. Often, there is more than one way to do something. Please keep your personal comments to yourself. Tim Collins -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Saturday, August 30, 2003 12:19 AM To: [EMAIL PROTECTED]; [EMAIL PROTECTED]; [EMAIL PROTECTED]; [EMAIL PROTECTED]; [EMAIL PROTECTED]; [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Subject: [Declude.Virus] FW: WARNING: YOU MAY HAVE A VIRUS Importance: High After all this has been talked about, that Sobig forges the sender, this pisses me off. Do you not know how to add FORGINGVIRUS and SKIPIFVIRUSNAMEHAS to the config and e-mail files? Get your bleeping act together or forfeit your Declude software to someone who knows how to use it. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: Postmaster [mailto:[EMAIL PROTECTED] Sent: Friday, August 29, 2003 7:58 PM To: [EMAIL PROTECTED] Subject: WARNING: YOU MAY HAVE A VIRUS The Declude Virus software on lcs.net has reported that you sent an E-mail to [EMAIL PROTECTED], containing the Unknown Virus virus in the Unknown File attachment. The subject of the E-mail was Your details. The E-mail containing the virus has been quarantined to prevent further damage. Headers Follow: Received: from ARNOLDS_ROOM [160.36.73.149] by lcs.net with ESMTP (SMTPD32-7.07) id A2A72C08013C; Fri, 29 Aug 2003 22:57:43 -0400 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Your details Date: Fri, 29 Aug 2003 22:59:36 --0400 X-MailScanner: Found to be clean Importance: Normal X-Mailer: Microsoft Outlook Express 6.00.2600. X-MSMail-Priority: Normal X-Priority: 3 (Normal) MIME-Version: 1.0 Content-Type: multipart/mixed; boundary=_NextPart_000_7E49D478 Message-Id: [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
Re: [Declude.Virus] Sobig- Phase II bombardment
If it was easy, and if every computer user was computer literate and responsible, we wouldn't have jobs... Andy - Original Message - From: Markus Gufler [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, August 22, 2003 3:17 PM Subject: RE: [Declude.Virus] Sobig- Phase II bombardment Sobig.G will have a line X-MailScanner: The Sobig.G virus is in the attachment, you will be infected if you open it... and Sobig.G will spread just as fast as Sobig.F. It make's me really wonder how many stupid people is not able to patch the own system (or at least outlook). I swear I will light 100 candles the day when a new Outlook-vulnerability worm will spread and removes any text, number and picture from any DOC, XLS, and PPT-files he can found. Other 100 candles if the worm places a You're really stupid! Patch your system or turn your computer of - immediatly! in any DOC-file. (Maybe also in other international languages) If the worms continue with the actual destructive functionality, most people will never patch the own system. They will only say: Ouch, how slow is the Internet today! What I will say: Not Sobig.f is frustrating but all this ignorant people that are not able to patch the own system. Culpability of MS? As I know they offer patches for all this vulnerabilities for a long time now. They can't do more. (except write a worm that install automatically all available patches from MS) Maybe the worm I wait for shouldn't delete anything, but change only some numbers in MS-Documents. I think that's enough to cause the attention of the end user - and not make work technicians like us day and night. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] notifications issue
Scott, Still the sobig notifications are going out...I've check the postmaster.eml file 3 times already. There is one tab between skipvirusname and sobig. There are no lines, or spaces or tabs before the first line. There are no lines, spaces or tabs between the last skipvirusname and the from line Here is the top of the file SKIPIFVIRUSNAMEHAS Sobig.f SKIPIFVIRUSNAMEHAS Mimail SKIPIFVIRUSNAMEHAS Yaha SKIPIFVIRUSNAMEHAS Lentin SKIPIFVIRUSNAMEHAS Magistr SKIPIFVIRUSNAMEHAS Klez SKIPIFVIRUSNAMEHAS Vulnerability SKIPIFVIRUSNAMEHAS Bugbear SKIPIFVIRUSNAMEHAS Bridex SKIPIFVIRUSNAMEHAS Braid SKIPIFVIRUSNAMEHAS Sobig SKIPIFVIRUSNAMEHAS Palyh From: [EMAIL PROTECTED] Thanks, Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Fw: Your mail server sent us a virus
Hi Scott, I did that, but I'm still getting the notifications Thanks, Andy - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, August 13, 2003 1:34 PM Subject: Re: [Declude.Virus] Fw: Your mail server sent us a virus That's due to the Mimail virus -- if you add a line SKIPIFVIRUSNAMEHAS Mimail to the top of the \IMail\Declude\sender.eml and \IMail\Declude\otherpostmaster.eml files, you won't get those anymore. -Scott At 01:28 PM 8/13/2003, andyb wrote: Hi, I keep getting these...any ideas? Thanks, Andy - Original Message - From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, August 13, 2003 10:33 AM Subject: Your mail server sent us a virus The Declude software on our mail server detected a virus that appears to have come from your mail server. It was sent from [EMAIL PROTECTED] to [EMAIL PROTECTED], with the subject your account oamoshgs. The Message-ID was: [EMAIL PROTECTED]. If your mail server had virus protection, it would have caused less work for our server and would have likely prevented one of your users from getting a virus in the first place! Virus name: : W32/[EMAIL PROTECTED] File name: message.zip This is an automated message sent by Declude Virus ( http://www.declude.com ). --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] Fw: Your mail server sent us a virus
HI, I get these once in a while, and wonder how it's possible that the sender is [EMAIL PROTECTED] Thanks, Andy - Original Message - From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, April 12, 2003 7:43 PM Subject: Your mail server sent us a virus The Declude software on our mail server detected a virus that appears to have come from your mail server. It was sent from [EMAIL PROTECTED] to [EMAIL PROTECTED], with the subject Undelivered Mail Returned to Sender -goldfish. The Message-ID was: [EMAIL PROTECTED]. If your mail server had virus protection, it would have caused less work for our server and would have likely prevented one of your users from getting a virus in the first place! Virus name: : W32/[EMAIL PROTECTED] File name: goldfish.mpg.bat This is an automated message sent by Declude Virus ( http://www.declude.com ). --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] forged, what would that mean?
I'm sure you've handed out the info b4, but can you point me to the info on FORGINGVIRUS option? TY Andrew - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, October 11, 2002 8:11 AM Subject: Re: [Declude.Virus] forged, what would that mean? here's a copy of my latest virus alert, I've never seen [forged] before, I have relay turned off. The Klez virus forges the return address, that's all that means. The [Forged] is used in conjunction with the FORGINGVIRUS option, so that you won't get mad at the person who apparently sent you the E-mail, since it wasn't really them that sent it. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
