What is processed first?
BANEXT
or On Demand Virus Scan ?
If BanExt is First, Is there a way to CC the email
?
I think I understand the question.
I only get banned extension notices when there is no known virus.
I route these banned notices to a folder in my mail program for special
attention (the virus name is in the subject).
The banned e-mails get checked by hand.
If it looks legit, I send a form
In my Virus.cfg file, it says BANEXT This works in the Standard and Pro
versions.
but in the Scott reply, it says BANEXT EZIP work with all version.
May I know does BANEXT scr BANEXT pif also work for all version, like lite
version?
My declude is 1.79 beta.
Regards
Brian
- Original
Hi all we just had a case where an email was banned because Declude said it
had an exe in the email, when it only had a TXT.
What happened here?
Thanks.
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
]
Subject: [Declude.Virus] BANEXT EXE
Hi all we just had a case where an email was banned because Declude said
it
had an exe in the email, when it only had a TXT.
What happened here?
Thanks.
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses
Hi all we just had a case where an email was banned because Declude said it
had an exe in the email, when it only had a TXT.
What happened here?
What happened is that either it contained an .exe file, or it had multiple
extensions (in which case Declude Virus assumes the worst, that it is an
Scott,
I just sent it to you, please look for it, it came from our systems account.
Jay
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, March 26, 2004 9:17 AM
Subject: Re: [Declude.Virus] BANEXT EXE
Hi all we just had a case where
Calvert [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, March 26, 2004 11:56 AM
Subject: [Declude.Virus] BANEXT EXE
Hi all we just had a case where an email was banned because Declude said
it
had an exe in the email, when it only had a TXT.
What happened here?
Thanks.
---
[This E-mail
I have several examples of that from last night as well, all the txt
attachments were anti-virus generated attachments
03/25/2004 19:11:00 Q751409530072c4c8 MIME file: DELETED0.TXT
[quoted-printable; Length=113 Checksum=12852]
03/25/2004 19:11:00 Q751409530072c4c8 Banning file deleted0.txt.
Scott,
Did you receive the second email?
Jay
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, March 26, 2004 9:39 AM
Subject: Re: [Declude.Virus] BANEXT EXE
I have several examples of that from last night as well, all the txt
Hi all we just had a case where an email was banned because Declude said it
had an exe in the email, when it only had a TXT.
What happened here?
The problem here is that the mail client (a program whose name is as poor
as its MIME handling: Mail A.01.77) is giving out 2 different names for
the
: Re: [Declude.Virus] BANEXT EXE
Hi all we just had a case where an email was banned because Declude said
it
had an exe in the email, when it only had a TXT.
What happened here?
The problem here is that the mail client (a program whose name is as poor
as its MIME handling: Mail A.01.77
The problem here is that the mail client (a program whose name is as poor
as its MIME handling: Mail A.01.77) is giving out 2 different names for
the file. In one location, it calls the file EPM11002.FILES.CANJET, in
the other location it calls it EPM11002.TXT. While Declude Virus knows
- Original Message -
From: Jay Calvert [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, March 26, 2004 10:58 AM
Subject: Re: [Declude.Virus] BANEXT EXE
But if this is the case, how will a file be caught if somebody renames a
.zip to a .zio?
Will declude know the difference. Would
PROTECTED]
Sent: Monday, March 08, 2004 2:22 AM
Subject: RE: [Declude.Virus] BANEXT question
As Don said, there is no such thing as BANEXT EZIP.
Try reading the archives again.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED
No such thing as BANEXT EZIP??
I believe he meant There is no such thing as BANEZIP ON (because there
isn't one of those). But Don re-posted the summary that I had sent out
last week, which has all the details in it.
-Scott
---
Declude
Perry
Sent: Monday, March 08, 2004 6:44 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] BANEXT question
No such thing as BANEXT EZIP??
I believe he meant There is no such thing as BANEZIP ON (because there
isn't one of those). But Don re-posted the summary that I had sent out
I'm currently using: BANEXT EZIP, becuase BANEZIP ON does not work for me.
I'm running the latest intrum version of Declude w/ F-Prot. I have a
Standard Declude license. Does BANEZIP ON only work for the Pro version of
Declude? If yes, I guess I should just continue to use BANEXT EZIP ?
(Such a
detection.
Find out what you've been missing: Ask for a free 30-day evaluation.
- Original Message -
From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Sunday, March 07, 2004 7:22 PM
Subject: [Declude.Virus] BANEXT question
I'm currently using: BANEXT EZIP, becuase BANEZIP ON does
Why does the BANEXT EZIP report a virus (and send the associated
notifications) instead of reporting a banned extension (and send the
bannotify.eml)??
Todd Holt
Xidix Technologies, Inc
Las Vegas, NV USA
702.319.4349
www.xidix.com
---
[This E-mail scanned for viruses by Declude Virus
Scott,
Can I configure the bannotify.eml to not send messages to the sender of
the file, but to send them only to the recipient and to me.
Not currently.
Isn't it possible to modify the Bannotify.eml file and only include the recipient and
postmaster? Would it still send a notice to the
Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of bill.maillists
Sent: Tuesday, March 02, 2004 12:27 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] Banext and bannotify.eml questions
Scott,
Can I configure the bannotify.eml to not send messages to the sender
Can I configure the bannotify.eml to not send messages to the sender of
the file, but to send them only to the recipient and to me.
Not currently.
Actually, I believe this can be done, by using a line To:
%ALLRECIPS%,[EMAIL PROTECTED] in the \IMail\Declude\BANnotify.eml file.
OK, I have it the other way around, does that matter?
No. Any E-mail addresses that appear after To: and that are separated
by commas will work.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
PROTECTED] Behalf Of R. Scott Perry
Sent: Tuesday, March 02, 2004 12:47 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] Banext and bannotify.eml questions
Isn't it possible to modify the Bannotify.eml file and only include the
recipient and postmaster? Would it still send a notice
BANEXTdata
Does not look to be executable.
http://filext.com/detaillist.php?extdetail=dataSubmit3=Go%21
BANEXTlink
No such extension found.
http://filext.com/detaillist.php?extdetail=linkgoButton=Go
BANEXTunk
No such extension found.
Good list, John. Thanks for sharing.
Darin.
- Original Message -
From: John Tolmachoff (Lists) [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Wednesday, January 28, 2004 3:55 PM
Subject: RE: [Declude.Virus] BANEXT
What are the recommended extensions to BAN?
http
] On Behalf Of Darin Cox
Sent: Sunday, February 01, 2004 9:23 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] BANEXT
Good list, John. Thanks for sharing.
Darin.
- Original Message -
From: John Tolmachoff (Lists) [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Wednesday, January 28, 2004 3:55
What are the recommended extensions to BAN?
http://www.eservicesforyou.com/documents/emailattachments.pdf
How do you handle it if someone needs to send a file through...sometimes
there will be legitimate files that need to be send through.
I tell them to zip it.
John Tolmachoff
Would you be willing to send the list as a text file?
Thanks, Andy
- Original Message -
From: John Tolmachoff (Lists) [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Wednesday, January 28, 2004 3:55 PM
Subject: RE: [Declude.Virus] BANEXT
What are the recommended extensions to BAN
Klinge
Sent: Monday, January 26, 2004 10:11 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] BANEXT
Geeze.. So you want the virus to only effect certain users?
~Rick
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Robert
Grosshandler
Sent
PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED] On Behalf Of Robert Grosshandler
Sent: Tuesday, January 27, 2004 6:10 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] BANEXT
Well, yes! If I open a zip and catch a virus, woe on me. I'm supposed to
be experienced enough not to do
Thanks to all for the quick notification of the new virus. We seemed to
have escaped any harm.
We immediately put BANEXT zip into our virus.cfg file, and that seemed to be
a good thing.
Now I'm thinking about lowering our protection back to where it was.
Is it possible, with Virus Standard,
Geeze.. So you want the virus to only effect certain users?
~Rick
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Robert
Grosshandler
Sent: Monday, January 26, 2004 9:19 PM
To: [EMAIL PROTECTED]
Subject: [Declude.Virus] BANEXT
Thanks to all
Please excuse this if it has already been answered-
Just like everyone else, we are getting hammered by Sobig.F. Declude seems
to be catching and holding the virus e-mails with the attachments because of
the BANEXT option. The potential exists to overload our hard drive. There
were over 3,000
Just like everyone else, we are getting hammered by Sobig.F. Declude seems
to be catching and holding the virus e-mails with the attachments because of
the BANEXT option. The potential exists to overload our hard drive. There
were over 3,000 held messages today (that is about 2x what we would
: [Declude.Virus] BANEXT to delete all .pif?
Just like everyone else, we are getting hammered by Sobig.F. Declude seems
to be catching and holding the virus e-mails with the attachments because
of
the BANEXT option. The potential exists to overload our hard drive. There
were over 3,000 held messages
] Behalf Of R. Scott Perry
Sent: Wednesday, August 20, 2003 04:03 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] BANEXT to delete all .pif?
Just like everyone else, we are getting hammered by Sobig.F. Declude seems
to be catching and holding the virus e-mails with the attachments because
I thought BANEXT worked before the scanner?
Both are done on all E-mail, and if a virus is found, it takes priority
over the banned file extension.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude
Hi,
I'm thinking of leaving the banext in place but
want to allert the sender and/or recipient when a mail is being held. I've
downloaded the BANnotify.eml file but don't see how Declude decides when to use
it. Do I need to put any extra control lines at the beginning?
Groetjes,
Bonno
I'm thinking of leaving the banext in place but want to allert the sender
and/or recipient when a mail is being held. I've downloaded the
BANnotify.eml file but don't see how Declude decides when to use it. Do I
need to put any extra control lines at the beginning?
Declude knows by the name of
Scott.
Is there a way to just refuse attachments of certain types? instead of
quarantined OR strip the attachment off? I don't want to bounce messages,
I'd be happy with just removing the attachment. maybe add a line to the
mail Attachment removed ? Is this possible? Or something we can add?
Is there a way to just refuse attachments of certain types? instead of
quarantined OR strip the attachment off? I don't want to bounce messages,
I'd be happy with just removing the attachment. maybe add a line to the
mail Attachment removed ? Is this possible? Or something we can add?
No,
Hello,
I am running Declude 1.65 with F-Prot 3.12b. All virus scanning works
fine, as I receive several notifications weekly regarding infected
emails. However, the BANEXT feature does not seem to be working. I
sent test emails with VBS attachments and they got through. Here's the
BANEXT
I have 2 people that are mad at me for blocking the SHS extension. Are there
any web pages from anti virus companies or some such Authority that I can
send them on why I am blocking it?
They say they are sending a Christmas card.
Sheldon
Sheldon Koehler, Owner/Partner
PROTECTED]
Subject: [Declude.Virus] BANEXT SHS
I have 2 people that are mad at me for blocking the SHS extension. Are there
any web pages from anti virus companies or some such Authority that I can
send them on why I am blocking it?
They say they are sending a Christmas card.
Sheldon
Sheldon Koehler
Hope that helps.
Thanks John!
Sheldon
Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com
Ten Forward Communications 360-457-9023
Nationwide access, neighborhood support!
Whenever you find yourself on the side of the majority, it's time
to pause and reflect. Mark Twain
Hello,
is it possible to ban extensions on a per domain base?
I'd like to let our customers do whatever they want, but I don't want to get
.mp3 files.
is this possible with declude virus pro?
Alex
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
I just implimented the BANEXT in my virus.cfg and added the bannotify.eml to
my Declude directory. The notify only goes out to the sender and I would
like to know when a banned extension tries to come in as well. I know I
could just add an additional entry to the to: field of bannotify.eml but
Thanks, will do Scott!
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Wednesday, September 04, 2002 2:07 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] BANEXT settings
I just implimented the BANEXT in my virus.cfg
I recently added multiple banext commands to my config file.
I send a message to sender and postmaster when the message is banned. This morning I
had a postmaster message and the message listed no banned extension.
so, I looked at the message in the virus folder and there were 4 attachments
The catch here is that BinHex (Mac encoding) files have the filename within
the encoded segment. So you can have a situation where the MIME filename
is safefile.txt, but the BinHex segment says the filename is
evilvirus.exe (which you won't see, because it is encoded).
Those headers won't affect whether or not Declude bans the files -- the
*real* filename is one you won't see, becaues it is encoded.
You can send a copy of the E-mail file to [EMAIL PROTECTED] , and I can
test it here to see what the real extensions are.
ok, so next question... if declude caught the attachment why did it not list with the
%BANEXT% variable? That variable was blank. How would I determine what file
extension was caught. I'm just trying to understand...
On Friday, August 9, 2002 9:17 AM, R. Scott Perry [EMAIL PROTECTED] wrote:
]] On Behalf Of R. Scott Perry
Sent: Friday, August 09, 2002 8:18 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] banext issue
Those headers won't affect whether or not Declude bans the files -- the
*real* filename is one you won't see, becaues it is encoded.
You can send a copy of the E-mail
Perry
Sent: Friday, August 09, 2002 8:18 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] banext issue
Those headers won't affect whether or not Declude bans the files -- the
*real* filename is one you won't see, becaues it is encoded.
You can send a copy of the E-mail file to [EMAIL PROTECTED
I did not catch that you wanted the message How do I go about taking
something from the virus folder, change the recipient to [EMAIL PROTECTED]?
just copy and change the sender in both files?
Probably the easiest thing to do would be to send the .SMD file (from the
virus folder) as an
ok scott, I'll get the latest thanks for looking into it.
Insidently, I see that all the time with mac files... spaces at the end pain in the
_ss
On Friday, August 9, 2002 11:18 AM, R. Scott Perry [EMAIL PROTECTED] wrote:
so, I looked at the message in the virus folder and there were
I have the BANEXT and the notify working fine. My question is there a way to
send the notify email to the postmaster (me) also to let me know that
someone tried to send a banned extension?
Thanks
Don Hickey
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
I have the BANEXT and the notify working fine. My question is there a way to
send the notify email to the postmaster (me) also to let me know that
someone tried to send a banned extension?
You can have:
To: %MAILFROM%,[EMAIL PROTECTED]
in the \IMail\Declude\BANnotify.eml file, which
Can I downoload the BANnotify.eml template from somewhere?
Yes, you can download it from
http://www.declude.com/release/154/bannotify.eml . Further details on
banning file extensions can be found at
http://www.declude.com/virus/manual.htm in the Banning files based on
extension section.
Thanks all
-Original Message-
From: Dustin Freeman [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, June 12, 2002 10:25 AM
To: '[EMAIL PROTECTED]'
Subject: RE: [Declude.Virus] BANEXT notify
Can I downoload the BANnotify.eml template from somewhere?
-Original Message-
From: Don
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] BANEXT maybe not working?
the virus scanning takes priority over the banning. That is,
the E-mail
will be scanned for viruses first, and only if the E-mail is
virus-free will
the file extension banning be done.
Thank you and PLEASE remember
63 matches
Mail list logo
