[Declude.Virus] Mcafee Auto Updates
What most people using to auto update Mcafee command line scanner? Mark Reimer IT System Admin American CareSource 972-308-6887 ---This E-mail came from the Declude.Virus mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.Virus".The archives can be foundat http://www.mail-archive.com.
[Declude.Virus] Mcafee Command Line Scanner
Anyone know where to find this? I assume most people are switching away from F-prot because of their wonderful new licensing structure. It seems Clam and Mcafee are the most popular but what else are users using and liking? Also is there any real difference between Clamwin and Clam-win32? Thanks for any input. Mark Reimer IT System Admin American CareSource 972-308-6887 ---This E-mail came from the Declude.Virus mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.Virus".The archives can be foundat http://www.mail-archive.com.
[Declude.Virus] Mcafee with 5000 engine tested?
Does somenone already works with the new 5000-er engine? Does someone has experience? Thanks for information, Uwe
Re: [Declude.Virus] McAfee DailyDAT download location change.
I changed the subject so that people can be alerted to this. Announcements of things like this would be useful to the entire Declude customer base. I am afraid that we are a little over a month behind. Those with a single scanner would be screwed. I adjusted my scripts to use the link that you provided and it does in fact work just great...so far :) Thanks, Matt Scott Fisher wrote: Great catch Matt. Mine's gone too since August 2 Thank you Declude for multiple virus scanner option. Try: http://download.nai.com/products/mcafee-avert/beta_packages/win_netware_betadat.zip From: http://groups.google.com/group/mailing.unix.amavis-user/browse_thread/thread/890f45b2e1cfdec9/61f1bcbcc4e71848?lnk=stq=dailydatrnum=1hl=en#61f1bcbcc4e71848 - Original Message - From: Matt To: Declude.Virus@declude.com Sent: Monday, September 12, 2005 2:26 PM Subject: Re: [Declude.Virus] Seemingly bad virus this morning This is a new Bagel variant: http://vil.nai.com/vil/content/v_129588.htm I was wrong about what was detecting it first...it was F-Prot. I just figured out that my McAfee update script is no longer working. Does anyone have a newer link to the daily DAT's than http://download.nai.com/products/mcafee-avert/daily_dats/DailyDAT.zip. Thanks, Matt John Tolmachoff (Lists) wrote: OK, so it is cpl file, which we should all have in our list of banned extensions including banned if within a zip file, so we should all be safe, correct? John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Dan Geiser Sent: Monday, September 12, 2005 11:49 AM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] Seemingly bad virus this morning I opened the zip file and it contained one file called "1.cpl" (without the quotes). Some sort of malicious Control Panel applet? - Original Message - From: "John Tolmachoff (Lists)" [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Monday, September 12, 2005 11:55 AM Subject: RE: [Declude.Virus] Seemingly bad virus this morning What is the payload inside the zip? John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Matt Sent: Monday, September 12, 2005 7:52 AM To: Declude.Virus@declude.com Subject: [Declude.Virus] Seemingly bad virus this morning FYI, We found a rapidly spreading zip virus beginning at about 8:15 a.m. this morning, first coming from Eastern Europe. McAfee seems to be detecting all of them now, but F-Prot as of this moment is not on our system. Every attachment name seemingly contained the word "price". Here's a quick filter that I had put together for it: HEADERSENDNOTCONTAINSboundary=" BODYENDNOTCONTAINSattachment; filename=" BODYENDNOTCONTAINS.zip" Content-Transfer-Encoding BODY15CONTAINS price Matt --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] McAfee DailyDAT download location change.
I have been monitoring everything that has been said and I agree - there is a place I had setup on the front page for these kinds of alerts and currently working on the best way to provide this information to our customer base using that area on the website. David B www.declude.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Monday, September 12, 2005 3:58 PMTo: Declude.Virus@declude.comSubject: Re: [Declude.Virus] McAfee DailyDAT download location change. I changed the subject so that people can be alerted to this. Announcements of things like this would be useful to the entire Declude customer base. I am afraid that we are a little over a month behind. Those with a single scanner would be screwed.I adjusted my scripts to use the link that you provided and it does in fact work just great...so far :)Thanks,MattScott Fisher wrote: Great catch Matt. Mine's gone too since August 2 Thank you Declude for multiple virus scanner option. Try: http://download.nai.com/products/mcafee-avert/beta_packages/win_netware_betadat.zip From: http://groups.google.com/group/mailing.unix.amavis-user/browse_thread/thread/890f45b2e1cfdec9/61f1bcbcc4e71848?lnk=stq=dailydatrnum=1hl=en#61f1bcbcc4e71848 - Original Message - From: Matt To: Declude.Virus@declude.com Sent: Monday, September 12, 2005 2:26 PM Subject: Re: [Declude.Virus] Seemingly bad virus this morning This is a new Bagel variant: http://vil.nai.com/vil/content/v_129588.htmI was wrong about what was detecting it first...it was F-Prot. I just figured out that my McAfee update script is no longer working. Does anyone have a newer link to the daily DAT's than http://download.nai.com/products/mcafee-avert/daily_dats/DailyDAT.zip.Thanks,MattJohn Tolmachoff (Lists) wrote: OK, so it is cpl file, which we should all have in our list of banned extensions including banned if within a zip file, so we should all be safe, correct? John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Dan Geiser Sent: Monday, September 12, 2005 11:49 AM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] Seemingly bad virus this morning I opened the zip file and it contained one file called "1.cpl" (without the quotes). Some sort of malicious Control Panel applet? - Original Message - From: "John Tolmachoff (Lists)" [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Monday, September 12, 2005 11:55 AM Subject: RE: [Declude.Virus] Seemingly bad virus this morning What is the payload inside the zip? John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Matt Sent: Monday, September 12, 2005 7:52 AM To: Declude.Virus@declude.com Subject: [Declude.Virus] Seemingly bad virus this morning FYI, We found a rapidly spreading zip virus beginning at about 8:15 a.m. this morning, first coming from Eastern Europe. McAfee seems to be detecting all of them now, but F-Prot as of this moment is not on our system. Every attachment name seemingly contained the word "price". Here's a quick filter that I had put together for it: HEADERSENDNOTCONTAINSboundary=" BODYENDNOTCONTAINSattachment; filename=" BODYENDNOTCONTAINS.zip" Content-Transfer-Encoding BODY15CONTAINS price Matt --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] McAfee DailyDAT download location change.
I have to check my script because it still works fine up to now. Markus From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Monday, September 12, 2005 9:58 PMTo: Declude.Virus@declude.comSubject: Re: [Declude.Virus] McAfee DailyDAT download location change. I changed the subject so that people can be alerted to this. Announcements of things like this would be useful to the entire Declude customer base. I am afraid that we are a little over a month behind. Those with a single scanner would be screwed.I adjusted my scripts to use the link that you provided and it does in fact work just great...so far :)Thanks,MattScott Fisher wrote: Great catch Matt. Mine's gone too since August 2 Thank you Declude for multiple virus scanner option. Try: http://download.nai.com/products/mcafee-avert/beta_packages/win_netware_betadat.zip From: http://groups.google.com/group/mailing.unix.amavis-user/browse_thread/thread/890f45b2e1cfdec9/61f1bcbcc4e71848?lnk=stq=dailydatrnum=1hl=en#61f1bcbcc4e71848 - Original Message - From: Matt To: Declude.Virus@declude.com Sent: Monday, September 12, 2005 2:26 PM Subject: Re: [Declude.Virus] Seemingly bad virus this morning This is a new Bagel variant: http://vil.nai.com/vil/content/v_129588.htmI was wrong about what was detecting it first...it was F-Prot. I just figured out that my McAfee update script is no longer working. Does anyone have a newer link to the daily DAT's than http://download.nai.com/products/mcafee-avert/daily_dats/DailyDAT.zip.Thanks,MattJohn Tolmachoff (Lists) wrote: OK, so it is cpl file, which we should all have in our list of banned extensions including banned if within a zip file, so we should all be safe, correct? John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Dan Geiser Sent: Monday, September 12, 2005 11:49 AM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] Seemingly bad virus this morning I opened the zip file and it contained one file called "1.cpl" (without the quotes). Some sort of malicious Control Panel applet? - Original Message - From: "John Tolmachoff (Lists)" [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Monday, September 12, 2005 11:55 AM Subject: RE: [Declude.Virus] Seemingly bad virus this morning What is the payload inside the zip? John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Matt Sent: Monday, September 12, 2005 7:52 AM To: Declude.Virus@declude.com Subject: [Declude.Virus] Seemingly bad virus this morning FYI, We found a rapidly spreading zip virus beginning at about 8:15 a.m. this morning, first coming from Eastern Europe. McAfee seems to be detecting all of them now, but F-Prot as of this moment is not on our system. Every attachment name seemingly contained the word "price". Here's a quick filter that I had put together for it: HEADERSENDNOTCONTAINSboundary=" BODYENDNOTCONTAINSattachment; filename=" BODYENDNOTCONTAINS.zip" Content-Transfer-Encoding BODY15CONTAINS price Matt --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] McAfee DailyDAT download location change.
Mr. Obvious says: You would have to change the URL plus the name of the file you're unzipping! So that I didn't have to change my script much, I changed my wget line to: wget http://download.nai.com/products/mcafee-avert/beta_packages/win_netware_betadat.zip -O dailyscan.zip The -O parameter tells wget to save the requested file with that particular filename. I think that NAI/McAfee changed the path as part of the web interface change to funnel people through their EULA. When I follow it through, the web interface takes you to a filenames that now have a dynamic instead of static name. If they change the URL again, we may need a smarter script that can scrape out the correct name from the webpage. Hopefully, they'll bring the static name back, perhaps parallel to the Stinger download. Andrew 8) p.s. I only use McAfee as a backup, standalone scanner. Not part of my Declude at all. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Monday, September 12, 2005 12:58 PMTo: Declude.Virus@declude.comSubject: Re: [Declude.Virus] McAfee DailyDAT download location change. I changed the subject so that people can be alerted to this. Announcements of things like this would be useful to the entire Declude customer base. I am afraid that we are a little over a month behind. Those with a single scanner would be screwed.I adjusted my scripts to use the link that you provided and it does in fact work just great...so far :)Thanks,MattScott Fisher wrote: Great catch Matt. Mine's gone too since August 2 Thank you Declude for multiple virus scanner option. Try: http://download.nai.com/products/mcafee-avert/beta_packages/win_netware_betadat.zip From: http://groups.google.com/group/mailing.unix.amavis-user/browse_thread/thread/890f45b2e1cfdec9/61f1bcbcc4e71848?lnk=stq=dailydatrnum=1hl=en#61f1bcbcc4e71848 - Original Message - From: Matt To: Declude.Virus@declude.com Sent: Monday, September 12, 2005 2:26 PM Subject: Re: [Declude.Virus] Seemingly bad virus this morning This is a new Bagel variant: http://vil.nai.com/vil/content/v_129588.htmI was wrong about what was detecting it first...it was F-Prot. I just figured out that my McAfee update script is no longer working. Does anyone have a newer link to the daily DAT's than http://download.nai.com/products/mcafee-avert/daily_dats/DailyDAT.zip.Thanks,MattJohn Tolmachoff (Lists) wrote: OK, so it is cpl file, which we should all have in our list of banned extensions including banned if within a zip file, so we should all be safe, correct? John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Dan Geiser Sent: Monday, September 12, 2005 11:49 AM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] Seemingly bad virus this morning I opened the zip file and it contained one file called "1.cpl" (without the quotes). Some sort of malicious Control Panel applet? - Original Message - From: "John Tolmachoff (Lists)" [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Monday, September 12, 2005 11:55 AM Subject: RE: [Declude.Virus] Seemingly bad virus this morning What is the payload inside the zip? John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Matt Sent: Monday, September 12, 2005 7:52 AM To: Declude.Virus@declude.com Subject: [Declude.Virus] Seemingly bad virus this morning FYI, We found a rapidly spreading zip virus beginning at about 8:15 a.m. this morning, first coming from Eastern Europe. McAfee seems to be detecting all of them now, but F-Prot as of this moment is not on our system. Every attachment name seemingly contained the word "price". Here's a quick filter that I had put together for it: HEADERSENDNOTCONTAINSboundary=" BODYENDNOTCONTAINSattachment; filename=" BODYENDNOTCONTAINS.zip" Content-Transfer-Encoding BODY15CONTAINS price Matt --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- E
Re: [Declude.Virus] McAfee DailyDAT download location change.
David, Information such as this is best 'pushed' rather than 'pulled'. Declude should have a notification list that sends announcements of important things concerning all products such as new interims/betas/releases, new and important bugs, updates on known issues and things that can broadly affect customers such as issues like this one. I wouldn't expect more than a few messages per month. There was an earlier list that was to be reserved for the absolute biggest issues that never got used, and the specificity of that list was it's downfall. I would create a list and opt all customers into it but give them an opt-out message for the first mailing. Most Declude customers will never hear about things like this issue with McAfee otherwise. The site doesn't work at all for timely things such as this. BTW, I believe there are probably scripts linked to or contained on the Declude site for McAfee updates. You will want to change those before anyone new adds it in to their system. Thanks, Matt David Barker wrote: I have been monitoring everything that has been said and I agree - there is a place I had setup on the front page for these kinds of alerts and currently working on the best way to provide this information to our customer base using that area on the website. David B www.declude.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Matt Sent: Monday, September 12, 2005 3:58 PM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] McAfee DailyDAT download location change. I changed the subject so that people can be alerted to this. Announcements of things like this would be useful to the entire Declude customer base. I am afraid that we are a little over a month behind. Those with a single scanner would be screwed. I adjusted my scripts to use the link that you provided and it does in fact work just great...so far :) Thanks, Matt Scott Fisher wrote: Great catch Matt. Mine's gone too since August 2 Thank you Declude for multiple virus scanner option. Try: http://download.nai.com/products/mcafee-avert/beta_packages/win_netware_betadat.zip From: http://groups.google.com/group/mailing.unix.amavis-user/browse_thread/thread/890f45b2e1cfdec9/61f1bcbcc4e71848?lnk=stq=dailydatrnum=1hl=en#61f1bcbcc4e71848 - Original Message - From: Matt To: Declude.Virus@declude.com Sent: Monday, September 12, 2005 2:26 PM Subject: Re: [Declude.Virus] Seemingly bad virus this morning This is a new Bagel variant: http://vil.nai.com/vil/content/v_129588.htm I was wrong about what was detecting it first...it was F-Prot. I just figured out that my McAfee update script is no longer working. Does anyone have a newer link to the daily DAT's than http://download.nai.com/products/mcafee-avert/daily_dats/DailyDAT.zip. Thanks, Matt John Tolmachoff (Lists) wrote: OK, so it is cpl file, which we should all have in our list of banned extensions including banned if within a zip file, so we should all be safe, correct? John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Dan Geiser Sent: Monday, September 12, 2005 11:49 AM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] Seemingly bad virus this morning I opened the zip file and it contained one file called "1.cpl" (without the quotes). Some sort of malicious Control Panel applet? - Original Message - From: "John Tolmachoff (Lists)" [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Monday, September 12, 2005 11:55 AM Subject: RE: [Declude.Virus] Seemingly bad virus this morning What is the payload inside the zip? John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Matt Sent: Monday, September 12, 2005 7:52 AM To: Declude.Virus@declude.com Subject: [Declude.Virus] Seemingly bad virus this morning FYI, We found a rapidly spreading zip virus beginning at about 8:15 a.m. this morning, first coming from Eastern Europe. McAfee seems to be detecting all of them now, but F-Prot as of this moment is not on our system. Every attachment name seemingly contained the word "price". Here's a quick filter that I had put together for it: HEADERSENDNOTCONTAINSboundary=" BODYENDNOTCONTAINSattachment; filename=" BODYENDNOTCONTAINS.zip&q
Re: [Declude.Virus] McAfee DailyDAT download location change.
The Proper method to update the dat would be to pull the "ini" file http://download.nai.com/products/datfiles/4.x/nai/update.ini Then Parse this [zip] section [ZIP]EngineVersion=0DATVersion=4579FileName=dat-4579.zipFilePath=/pub/antivirus/datfiles/4.x/FileSize=6448048Checksum=2090,BED1MD5=cc4e480fbc191a89354a5891ca4aa6dc to obtain the URI Filename then, verify the MD5 Checksum, then unzip it.. then notify you of the download, unzip, and send the DatVersion to you. What happens if you download is corrupt? you now have successfully disabled your virus scanner.
Re: [Declude.Virus] McAfee DailyDAT download location change.
The FTP site doesn't have the beta DAT's listed. It is the beta DAT's that contain the latest updates, and for an E-mail system, they are the best thing to use. Naturally they aren't as well tested as the other things, but they will block things more quickly and you have to weigh that against the possibility of losing E-mail. I would recommend the HTTP link that Scott provided unless the beta DAT's are available over FTP. Matt William Stillwell wrote: The Proper method to update the dat would be to pull the "ini" file http://download.nai.com/products/datfiles/4.x/nai/update.ini Then Parse this [zip] section [ZIP] EngineVersion=0 DATVersion=4579 FileName=dat-4579.zip FilePath=/pub/antivirus/datfiles/4.x/ FileSize=6448048 Checksum=2090,BED1 MD5=cc4e480fbc191a89354a5891ca4aa6dc to obtain the URI Filename then, verify the MD5 Checksum, then unzip it.. then notify you of the download, unzip, and send the DatVersion to you. What happens if you download is corrupt? you now have successfully disabled your virus scanner.
Re: [Declude.Virus] McAfee DailyDAT download location change.
Well, there's always the Declude.Releases mailing list. Not sure that I've ever received anything on that one. Maybe they need to make another one and call it Declude.News. I'd refer people to Declude's User Forums, but they seem to be extremely under utilized by both Declude users and Declude support. By contrast, the SmarterMail user forums are extremely active, though that may be because SmaterMail doesn't have a mailing list equivalent to Declude.Junkmail. Original Message From: Matt [EMAIL PROTECTED] Sent: Monday, September 12, 2005 4:27 PM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] McAfee DailyDAT download location change. David, Information such as this is best 'pushed' rather than 'pulled'. Declude should have a notification list that sends announcements of important things concerning all products such as new interims/betas/releases, new and important bugs, updates on known issues and things that can broadly affect customers such as issues like this one. I wouldn't expect more than a few messages per month. There was an earlier list that was to be reserved for the absolute biggest issues that never got used, and the specificity of that list was it's downfall. I would create a list and opt all customers into it but give them an opt-out message for the first mailing. Most Declude customers will never hear about things like this issue with McAfee otherwise. The site doesn't work at all for timely things such as this. BTW, I believe there are probably scripts linked to or contained on the Declude site for McAfee updates. You will want to change those before anyone new adds it in to their system. Thanks, Matt David Barker wrote: I have been monitoring everything that has been said and I agree - there is a place I had setup on the front page for these kinds of alerts and currently working on the best way to provide this information to our customer base using that area on the website. David B www.declude.com http://www.declude.com *From:* [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] *On Behalf Of *Matt *Sent:* Monday, September 12, 2005 3:58 PM *To:* Declude.Virus@declude.com *Subject:* Re: [Declude.Virus] McAfee DailyDAT download location change. I changed the subject so that people can be alerted to this. Announcements of things like this would be useful to the entire Declude customer base. I am afraid that we are a little over a month behind. Those with a single scanner would be screwed. I adjusted my scripts to use the link that you provided and it does in fact work just great...so far :) Thanks, Matt Scott Fisher wrote: Great catch Matt. Mine's gone too since August 2 Thank you Declude for multiple virus scanner option. Try: http://download.nai.com/products/mcafee-avert/beta_packages/win_netware_betadat.zip From: http://groups.google.com/group/mailing.unix.amavis-user/browse_thread/thread/890f45b2e1cfdec9/61f1bcbcc4e71848?lnk=stq=dailydatrnum=1hl=en#61f1bcbcc4e71848 http://groups.google.com/group/mailing.unix.amavis-user/browse_thread/thread/890f45b2e1cfdec9/61f1bcbcc4e71848?lnk=stq=dailydatrnum=1hl=en#61f1bcbcc4e71848 - Original Message - *From:* Matt mailto:[EMAIL PROTECTED] *To:* Declude.Virus@declude.com mailto:Declude.Virus@declude.com *Sent:* Monday, September 12, 2005 2:26 PM *Subject:* Re: [Declude.Virus] Seemingly bad virus this morning This is a new Bagel variant: http://vil.nai.com/vil/content/v_129588.htm I was wrong about what was detecting it first...it was F-Prot. I just figured out that my McAfee update script is no longer working. Does anyone have a newer link to the daily DAT's than http://download.nai.com/products/mcafee-avert/daily_dats/DailyDAT.zip. Thanks, Matt John Tolmachoff (Lists) wrote: OK, so it is cpl file, which we should all have in our list of banned extensions including banned if within a zip file, so we should all be safe, correct? John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Monday, September 12, 2005 11:49 AM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] Seemingly bad virus this morning I opened the zip file and it contained one file called 1.cpl (without the quotes). Some sort of malicious Control Panel applet? - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Monday, September 12, 2005 11:55 AM Subject: RE: [Declude.Virus] Seemingly bad virus this morning What is the payload inside the zip? John T eServices
[Declude.Virus] Mcafee error 8
I think I missed something, and I'll admit right up front that I've been swamped and I haven't been paying attention as close as circumstances require, so it's my own fault. That being said, I'm getting a steady stream of Error 8 in virus scanner 1. messages in my virus logs over the last several days. My virus scanner #1 is scan-dot-exe from our good friends at McAfee. Have others been having issues with scan-dot-exe? I don't see an engine update, and I don't see anything else peculiar in my DAT updates, but this puppy isn't performing. -- John Shacklett --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] McAfee throwing errors
I've noted that McAfee will throw errors from time to time when called with Declude, and when it does, they tend to come in droves, otherwise I can go weeks with it being absolutely quiet. I have a feeling that this might be related to the daily dats. Today I have seen over a dozen such errors. Is anyone else seeing this? Thanks, Matt -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] McAfee throwing errors
I haven't seen anything obvious in a quick glance through today's logs. Do you have an example? Usually, I just force another download of the dats. - Original Message - From: Matt [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Monday, April 25, 2005 3:42 PM Subject: [Declude.Virus] McAfee throwing errors I've noted that McAfee will throw errors from time to time when called with Declude, and when it does, they tend to come in droves, otherwise I can go weeks with it being absolutely quiet. I have a feeling that this might be related to the daily dats. Today I have seen over a dozen such errors. Is anyone else seeing this? Thanks, Matt -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] McAfee and POP3 service crash
I've never seen this before, but beginning on Saturday morning, I started getting appearances of "Application Error" in my Event Log about McAfee: Faulting application Scan.exe, version 4.3.2.0, faulting module mcscan32.dll, version 4.3.2.0, fault address 0x0001cfd0. Then this morning the POP3 service started also giving errors in addition to McAfee: Faulting application POP3d32.exe, version 12.11.9.8, faulting module POP3d32.exe, version 12.11.9.8, fault address 0x00010bcb. The POP3 service had in fact crashed and it needed to be restarted (I rebooted just to be safe). I believe that this is the first time that I have ever seen the POP3 service crash. Although I don't believe that POP3 has anything direct relationship to McAfee on my server since that app is only used as a command line scanner, I'm quite suspicious of this causing the issue. Has anyone else seen either one of these errors on their systems? Thanks, Matt -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
Re: [Declude.Virus] McAfee and POP3 service crash
Although I cannot explain the cause of the issues you've seen, I would suggest that you upgrade your scan engine: http://www.mcafeesecurity.com/us/downloads/default.asp?wt.mc_n=us_updateswt.mc_t=ext_li_concid=10373. Download and run the SuperDat, file which contains the latest dat and engine updates (version 4400\4426). Bill - Original Message - From: Matt [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Monday, February 07, 2005 6:27 AM Subject: [Declude.Virus] McAfee and POP3 service crash I've never seen this before, but beginning on Saturday morning, I started getting appearances of Application Error in my Event Log about McAfee: Faulting application Scan.exe, version 4.3.2.0, faulting module mcscan32.dll, version 4.3.2.0, fault address 0x0001cfd0. Then this morning the POP3 service started also giving errors in addition to McAfee: Faulting application POP3d32.exe, version 12.11.9.8, faulting module POP3d32.exe, version 12.11.9.8, fault address 0x00010bcb. The POP3 service had in fact crashed and it needed to be restarted (I rebooted just to be safe). I believe that this is the first time that I have ever seen the POP3 service crash. Although I don't believe that POP3 has anything direct relationship to McAfee on my server since that app is only used as a command line scanner, I'm quite suspicious of this causing the issue. Has anyone else seen either one of these errors on their systems? Thanks, Matt -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] McAfee and POP3 service crash
FWIW, I recently ran into a weirdness with McAfee; I use the daily dat download (engine plus dats), and have so for some months. What I do is for reporting completeness, I do a nightly scan of my spam folder to find out how many viruses were caught as spam. January didn't work, and I didn't notice for most of the month. What was happening was that the script was taking forever, and not completing for the script ran again the next night. I copied my spam folder to my local machine and ran the script again, with much the same result. I ran SystInternals.com's FileMon and found that McAfee's scan.exe was reading the current folder and the root of the drive bazillions of times. With a small-ish corpus, these extraneous reads made no difference to the scan time. With a large number of files in a directory with a very large number of files, the scan wasn't worth running. So just at the end of last week, I modified the script to use F-Prot instead of McAfee, and that has been working fine. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry Sent: Monday, February 07, 2005 7:04 AM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] McAfee and POP3 service crash Although I cannot explain the cause of the issues you've seen, I would suggest that you upgrade your scan engine: http://www.mcafeesecurity.com/us/downloads/default.asp?wt.mc_n=us_update swt.mc_t=ext_li_concid=10373. Download and run the SuperDat, file which contains the latest dat and engine updates (version 4400\4426). Bill - Original Message - From: Matt [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Monday, February 07, 2005 6:27 AM Subject: [Declude.Virus] McAfee and POP3 service crash I've never seen this before, but beginning on Saturday morning, I started getting appearances of Application Error in my Event Log about McAfee: Faulting application Scan.exe, version 4.3.2.0, faulting module mcscan32.dll, version 4.3.2.0, fault address 0x0001cfd0. Then this morning the POP3 service started also giving errors in addition to McAfee: Faulting application POP3d32.exe, version 12.11.9.8, faulting module POP3d32.exe, version 12.11.9.8, fault address 0x00010bcb. The POP3 service had in fact crashed and it needed to be restarted (I rebooted just to be safe). I believe that this is the first time that I have ever seen the POP3 service crash. Although I don't believe that POP3 has anything direct relationship to McAfee on my server since that app is only used as a command line scanner, I'm quite suspicious of this causing the issue. Has anyone else seen either one of these errors on their systems? Thanks, Matt -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] McAfee and POP3 service crash
Andrew, When you say "reading the root of the drive" do you mean the boot sector, or the files contained in the root of C: or the drive that was defined in the command line? And also just to clarify, "reading" in this case meaning "scanning", correct? Seems like being able to turn that off, or at least remove files from the root might make a big performance difference when you have high volume. Thanks, Matt Colbeck, Andrew wrote: FWIW, I recently ran into a weirdness with McAfee; I use the daily dat download (engine plus dats), and have so for some months. What I do is for reporting completeness, I do a nightly scan of my spam folder to find out how many viruses were caught as spam. January didn't work, and I didn't notice for most of the month. What was happening was that the script was taking forever, and not completing for the script ran again the next night. I copied my spam folder to my local machine and ran the script again, with much the same result. I ran SystInternals.com's FileMon and found that McAfee's scan.exe was reading the current folder and the root of the drive bazillions of times. With a small-ish corpus, these extraneous reads made no difference to the scan time. With a large number of files in a directory with a very large number of files, the scan wasn't worth running. So just at the end of last week, I modified the script to use F-Prot instead of McAfee, and that has been working fine. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Bill Landry Sent: Monday, February 07, 2005 7:04 AM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] McAfee and POP3 service crash Although I cannot explain the cause of the issues you've seen, I would suggest that you upgrade your scan engine: http://www.mcafeesecurity.com/us/downloads/default.asp?wt.mc_n=us_update swt.mc_t=ext_li_concid=10373. Download and run the SuperDat, file which contains the latest dat and engine updates (version 4400\4426). Bill - Original Message - From: "Matt" [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Monday, February 07, 2005 6:27 AM Subject: [Declude.Virus] McAfee and POP3 service crash I've never seen this before, but beginning on Saturday morning, I started getting appearances of "Application Error" in my Event Log about McAfee: Faulting application Scan.exe, version 4.3.2.0, faulting module mcscan32.dll, version 4.3.2.0, fault address 0x0001cfd0. Then this morning the POP3 service started also giving errors in addition to McAfee: Faulting application POP3d32.exe, version 12.11.9.8, faulting module POP3d32.exe, version 12.11.9.8, fault address 0x00010bcb. The POP3 service had in fact crashed and it needed to be restarted (I rebooted just to be safe). I believe that this is the first time that I have ever seen the POP3 service crash. Although I don't believe that POP3 has anything direct relationship to McAfee on my server since that app is only used as a command line scanner, I'm quite suspicious of this causing the issue. Has anyone else seen either one of these errors on their systems? Thanks, Matt -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
RE: [Declude.Virus] McAfee and POP3 service crash
Title: Message I don't mean scanning the files in the root repetitively. In particular, FileMon was showing me that scan.exe was READing D:\ (as opposed to OPEN, CLOSE, QUERY INFORMATION, or SET INFORMATION - all of which are other request types that FileMon can log). Actually, it might have been D: instead of D:\ ... I'm not sure now.My conclusionwas thatit was re-reading the contents of the directory over and over. As you suggest, using the /exclude parameter to excerpt the root of the drive may have helped. The scan.exe file is dated October 2004, and my script was certainly working before and after that date, so it is also possible that a hotfix applied in late December or early January changed the behaviour of some API that scan.exe uses; I really don't know how much a DAT file can control the scanning behaviour, but the DATs are the only part of the McAfee client that changed! Andrew 8) -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Monday, February 07, 2005 10:35 AMTo: Declude.Virus@declude.comSubject: Re: [Declude.Virus] McAfee and POP3 service crashAndrew,When you say "reading the root of the drive" do you mean the boot sector, or the files contained in the root of C: or the drive that was defined in the command line? And also just to clarify, "reading" in this case meaning "scanning", correct?Seems like being able to turn that off, or at least remove files from the root might make a big performance difference when you have high volume.Thanks,MattColbeck, Andrew wrote: FWIW, I recently ran into a weirdness with McAfee; I use the daily dat download (engine plus dats), and have so for some months. What I do is for reporting completeness, I do a nightly scan of my spam folder to find out how many viruses were caught as spam. January didn't work, and I didn't notice for most of the month. What was happening was that the script was taking forever, and not completing for the script ran again the next night. I copied my spam folder to my local machine and ran the script again, with much the same result. I ran SystInternals.com's FileMon and found that McAfee's scan.exe was reading the current folder and the root of the drive bazillions of times. With a small-ish corpus, these extraneous reads made no difference to the scan time. With a large number of files in a directory with a very large number of files, the scan wasn't worth running. So just at the end of last week, I modified the script to use F-Prot instead of McAfee, and that has been working fine. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Bill Landry Sent: Monday, February 07, 2005 7:04 AM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] McAfee and POP3 service crash Although I cannot explain the cause of the issues you've seen, I would suggest that you upgrade your scan engine: http://www.mcafeesecurity.com/us/downloads/default.asp?wt.mc_n=us_update swt.mc_t=ext_li_concid=10373. Download and run the SuperDat, file which contains the latest dat and engine updates (version 4400\4426). Bill - Original Message - From: "Matt" [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Monday, February 07, 2005 6:27 AM Subject: [Declude.Virus] McAfee and POP3 service crash I've never seen this before, but beginning on Saturday morning, I started getting appearances of "Application Error" in my Event Log about McAfee: Faulting application Scan.exe, version 4.3.2.0, faulting module mcscan32.dll, version 4.3.2.0, fault address 0x0001cfd0. Then this morning the POP3 service started also giving errors in addition to McAfee: Faulting application POP3d32.exe, version 12.11.9.8, faulting module POP3d32.exe, version 12.11.9.8, fault address 0x00010bcb. The POP3 service had in fact crashed and it needed to be restarted (I rebooted just to be safe). I believe that this is the first time that I have ever seen the POP3 service crash. Although I don't believe that POP3 has anything direct relationship to McAfee on my server since that app is only used as a command line scanner, I'm quite suspicious of this causing the issue. Has anyone else seen either one of these errors on their systems? Thanks, Matt -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for vi
RE: [Declude.Virus] McAfee and POP3 service crash
Title: Message I should have also mentioned that the script first makes a list of the files to scan, then tells scan.exe to scan the files in the list. I don't just tell scan.exe to scan the folder (if I had, I could buy the behaviour of reading the directory over and over again). Andrew 8) -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, AndrewSent: Monday, February 07, 2005 10:54 AMTo: Declude.Virus@declude.comSubject: RE: [Declude.Virus] McAfee and POP3 service crash I don't mean scanning the files in the root repetitively. In particular, FileMon was showing me that scan.exe was READing D:\ (as opposed to OPEN, CLOSE, QUERY INFORMATION, or SET INFORMATION - all of which are other request types that FileMon can log). Actually, it might have been D: instead of D:\ ... I'm not sure now.My conclusionwas thatit was re-reading the contents of the directory over and over. As you suggest, using the /exclude parameter to excerpt the root of the drive may have helped. The scan.exe file is dated October 2004, and my script was certainly working before and after that date, so it is also possible that a hotfix applied in late December or early January changed the behaviour of some API that scan.exe uses; I really don't know how much a DAT file can control the scanning behaviour, but the DATs are the only part of the McAfee client that changed! Andrew 8) -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Monday, February 07, 2005 10:35 AMTo: Declude.Virus@declude.comSubject: Re: [Declude.Virus] McAfee and POP3 service crashAndrew,When you say "reading the root of the drive" do you mean the boot sector, or the files contained in the root of C: or the drive that was defined in the command line? And also just to clarify, "reading" in this case meaning "scanning", correct?Seems like being able to turn that off, or at least remove files from the root might make a big performance difference when you have high volume.Thanks,MattColbeck, Andrew wrote: FWIW, I recently ran into a weirdness with McAfee; I use the daily dat download (engine plus dats), and have so for some months. What I do is for reporting completeness, I do a nightly scan of my spam folder to find out how many viruses were caught as spam. January didn't work, and I didn't notice for most of the month. What was happening was that the script was taking forever, and not completing for the script ran again the next night. I copied my spam folder to my local machine and ran the script again, with much the same result. I ran SystInternals.com's FileMon and found that McAfee's scan.exe was reading the current folder and the root of the drive bazillions of times. With a small-ish corpus, these extraneous reads made no difference to the scan time. With a large number of files in a directory with a very large number of files, the scan wasn't worth running. So just at the end of last week, I modified the script to use F-Prot instead of McAfee, and that has been working fine. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Bill Landry Sent: Monday, February 07, 2005 7:04 AM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] McAfee and POP3 service crash Although I cannot explain the cause of the issues you've seen, I would suggest that you upgrade your scan engine: http://www.mcafeesecurity.com/us/downloads/default.asp?wt.mc_n=us_update swt.mc_t=ext_li_concid=10373. Download and run the SuperDat, file which contains the latest dat and engine updates (version 4400\4426). Bill - Original Message - From: "Matt" [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Monday, February 07, 2005 6:27 AM Subject: [Declude.Virus] McAfee and POP3 service crash I've never seen this before, but beginning on Saturday morning, I started getting appearances of "Application Error" in my Event Log about McAfee: Faulting application Scan.exe, version 4.3.2.0, faulting module mcscan32.dll, version 4.3.2.0, fault address 0x0001cfd0. Then this morning the POP3 service started also giving errors in addition to McAfee: Faulting application POP3d32.exe, version 12.11.9.8, faulting module POP3d32.exe, version 12.11.9.8, fault address 0x00010bcb. The POP3 service had in fact crashed and it needed to be restarted (I rebooted just to be safe). I believe that this is the first time that I have ever seen the POP3 service crash. Although I don't believe that POP3 has anything direct relationship to McAfee on my server since that app is only used as a command line scanner, I'm quite suspicious of this causing the issue. Has anyone else seen either on
Re: [Declude.Virus] McAfee and POP3 service crash
Title: Message Sounds like it's worth a test and some monitoring just to see if there is a measurable difference in mail scanning activities. Thanks for sharing. Matt Colbeck, Andrew wrote: I should have also mentioned that the script first makes a list of the files to scan, then tells scan.exe to scan the files in the list. I don't just tell scan.exe to scan the folder (if I had, I could buy the behaviour of reading the directory over and over again). Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Colbeck, Andrew Sent: Monday, February 07, 2005 10:54 AM To: Declude.Virus@declude.com Subject: RE: [Declude.Virus] McAfee and POP3 service crash I don't mean scanning the files in the root repetitively. In particular, FileMon was showing me that scan.exe was READing D:\ (as opposed to OPEN, CLOSE, QUERY INFORMATION, or SET INFORMATION - all of which are other request types that FileMon can log). Actually, it might have been D: instead of D:\ ... I'm not sure now.My conclusionwas thatit was re-reading the contents of the directory over and over. As you suggest, using the /exclude parameter to excerpt the root of the drive may have helped. The scan.exe file is dated October 2004, and my script was certainly working before and after that date, so it is also possible that a hotfix applied in late December or early January changed the behaviour of some API that scan.exe uses; I really don't know how much a DAT file can control the scanning behaviour, but the DATs are the only part of the McAfee client that changed! Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Matt Sent: Monday, February 07, 2005 10:35 AM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] McAfee and POP3 service crash Andrew, When you say "reading the root of the drive" do you mean the boot sector, or the files contained in the root of C: or the drive that was defined in the command line? And also just to clarify, "reading" in this case meaning "scanning", correct? Seems like being able to turn that off, or at least remove files from the root might make a big performance difference when you have high volume. Thanks, Matt Colbeck, Andrew wrote: FWIW, I recently ran into a weirdness with McAfee; I use the daily dat download (engine plus dats), and have so for some months. What I do is for reporting completeness, I do a nightly scan of my spam folder to find out how many viruses were caught as spam. January didn't work, and I didn't notice for most of the month. What was happening was that the script was taking forever, and not completing for the script ran again the next night. I copied my spam folder to my local machine and ran the script again, with much the same result. I ran SystInternals.com's FileMon and found that McAfee's scan.exe was reading the current folder and the root of the drive bazillions of times. With a small-ish corpus, these extraneous reads made no difference to the scan time. With a large number of files in a directory with a very large number of files, the scan wasn't worth running. So just at the end of last week, I modified the script to use F-Prot instead of McAfee, and that has been working fine. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Bill Landry Sent: Monday, February 07, 2005 7:04 AM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] McAfee and POP3 service crash Although I cannot explain the cause of the issues you've seen, I would suggest that you upgrade your scan engine: http://www.mcafeesecurity.com/us/downloads/default.asp?wt.mc_n=us_update swt.mc_t=ext_li_concid=10373. Download and run the SuperDat, file which contains the latest dat and engine updates (version 4400\4426). Bill - Original Message - From: "Matt" [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Monday, February 07, 2005 6:27 AM Subject: [Declude.Virus] McAfee and POP3 service crash I've never seen this before, but beginning on Saturday morning, I started getting appearances of "Application Error" in my Event Log about McAfee: Faulting application Scan.exe, version 4.3.2.0, faulting module mcscan32.dll, version 4.3.2.0, fault address 0x0001cfd0. Then this morning the POP3 service started also giving errors in addition to McAfee: Faulting application POP3d32.exe, version 12.11.9.8, faulting module POP3d32.exe, version 12.11.9.8, fault address 0x00010bcb. The POP3 service had in fact crashed and it needed to be restarted (I rebooted just to be safe). I believe that this is the first time that I have e
[Declude.Virus] McAfee VScan 8
Anybody installed VScan 8i on an IMail/Declude setup? We just got our copy of it and I wanted to see if there are any gotchas before going forward with the upgrade from v7.1. Doug --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] McAfee VScan 8
Version 8 has extremely limited user functionality (far less than version 7 had). For example, you cannot exclude directories or applications from being scanned. And, if the virus scanner spots something suspicious even though clearly NOT a virus it stops all process of the application in question until a user manually clicks a little pop-up window saying its okay to proceed. It may be okay for an average user PC but should NOT be used on servers or power users or developers workstations. There are several discussions on McAfees support forums with people upset with the reduction of the feature set and reduced functionality. Frankly, I dumping my copies (even those on my workstations and PCs) and going back to Version 7.1. Just my 2 cents. Wolf
RE: [Declude.Virus] McAfee VScan 8
This is not correct for the Enterprise version of 8.0i. I have it installed on my
workstation to test and will soon be deploying it to our staff and faculty computers.
We will be managing it centrally with ePolicy Orchestrator. There are actually a
number of additional features over 7.1 such as blocking outgoing IRC, SMTP and other
traffic with modifiable exclusions for specific applications. I have been able to
configure my installation to exclude directories without any problems. It will also
scan scripts, has buffer overflow protection and in the Unwanted Programs Policy you
can exclude whatever programs you want.
Richard Edge
Senior Systems Administrator
Technology Services Department
TRINITY WESTERN UNIVERSITY
Voice: 604-513-2089
E-mail: [EMAIL PROTECTED]
WWW: http://www.twu.ca/technology
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Wolf Tombe
Sent: Friday, September 03, 2004 12:05 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] McAfee VScan 8
Version 8 has extremely limited user functionality (far less than version 7 had). For
example, you cannot exclude directories or applications from being scanned. And, if
the virus scanner spots something suspicious even though clearly NOT a virus it
stops all process of the application in question until a user manually clicks a little
pop-up window saying its okay to proceed.
It may be okay for an average user PC but should NOT be used on servers or power
users or developers workstations.
There are several discussions on McAfees support forums with people upset with the
reduction of the feature set and reduced functionality.
Frankly, I dumping my copies (even those on my workstations and PCs) and going back to
Version 7.1. Just my 2 cents.
Wolf
Nfyu udj)jgr[yXXX:mfyu*{nyurzj j)8I[jyu*7V*
Nf_ ynub!
0u%dj)\jgr[yXXX:.m fynu(*^{.n+ynubrzjm
j)Zb(
RE: [Declude.Virus] McAfee VScan 8
Very good Point about the enterprise version! I just say the subject line which indicated McAfee VScan 8 and immediately reacted with a warning since I've had several pretty significant problems with it do to it's limitations. Wolf --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] McAfee VScan 8
Scott, Looking at the logging in terms of vulnerabilities I noticed that under certain circumstances it does not print out the File(s) are Infected line when the vulnerability is found in the subject or from field. Is this by design? Also, in terms of when it catches the vulnerability in something other than the subject what does [X-1: stand for? Thanks Darrell 08/31/2004 01:38:01 Q0eb966f604807108 Outlook 'CR' vulnerability [X-1: At Bi] in line 8 08/31/2004 01:38:02 Q0eb966f604807108 File(s) are INFECTED [[Outlook 'CR' Vulnerability]: 0] 08/31/2004 01:38:02 Q0eb966f604807108 Scanned: CONTAINS A VIRUS 08/31/2004 01:38:02 Q0eb966f604807108 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [outgoing from 63.247.75.250] 08/31/2004 01:38:02 Q0eb966f604807108 Subject: est Drive the Red Ferrari for Unlimited Free Leads 08/31/2004 00:02:03 Qf83a69e905108edd Outlook 'CR' vulnerability [Subject: T] in line 13 08/31/2004 00:02:03 Qf83a69e905108edd Scanned: CONTAINS A VIRUS [MIME: 1 274] 08/31/2004 00:02:03 Qf83a69e905108edd From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [outgoing from 82.225.129.128] 08/31/2004 00:02:03 Qf83a69e905108edd Subject: This is incredible,free Vi'ag;r;a --- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] McAfee VScan 8
Has anyone tried out 8.0i (enterprise) on their mail server? 8.0i enterprise on the desktop seems to consume a bit more resources than 7.x which makes me wonder how well it will do on the mail server. Darrell - Original Message - From: Wolf Tombe [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, September 03, 2004 4:04 PM Subject: RE: [Declude.Virus] McAfee VScan 8 Very good Point about the enterprise version! I just say the subject line which indicated McAfee VScan 8 and immediately reacted with a warning since I've had several pretty significant problems with it do to it's limitations. Wolf --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] Mcafee command line scanner
Hi, About 3 years ago I ordered McAfee Active Virus Defense (aka NetShield Security Suite) v4.5 from CDW for use with Declude. Their part numbers have changed over the years, but this link to CDW should get you started. http://www.cdw.com/shop/products/default.aspx?EDC=343571 If you talk directly with McAfee, they'll try selling you a version that has as many seats as you have email boxes for. At the time we had the 250 user version of IMail, so McAfee wanted to sell me the 250 user version of NetShield. All I really needed was the Command Line Scanner (which comes as part of NetShield) so I went through my CDW Rep and just purchased that version. Since we were running IMail/Declude on Windows NT Server with 5 CALs, I ordered the 5 user version of the License along with the 5 user version of 2 years Support, and the media kit. You have to install the full version of NetShield to get the Command Line Scanner, but then you can deselect the installation options to give you just the Command Line Scanner and the Console which schedules the updates. In Declude's Virus.Cfg file I set MAXATONCE to 5, so it won't spawn any more than 5 copies of the Command Line Scanner. If McAfee wants to try proving I'm violating their License Agreement, they can come get me... Alan Walters Director of I.T. Royce Medical --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] Mcafee command line scanner
Is this a real price for the Mcafee command line scanner: http://www.macmall.com/macmall/shop/detail.asp?dpno=118250 Has anyone found this software this low?? This is what is needed to work with Declude? Thanks, Adam --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Mcafee command line scanner
It will work, but you will most likely be violating their licensing agreement. - Original Message - From: Adam Hobach [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, July 07, 2004 12:31 PM Subject: [Declude.Virus] Mcafee command line scanner Is this a real price for the Mcafee command line scanner: http://www.macmall.com/macmall/shop/detail.asp?dpno=118250 Has anyone found this software this low?? This is what is needed to work with Declude? Thanks, Adam --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Mcafee command line scanner
Which Mcafee product does everyone use then? Thanks, Adam -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jeff Pereira Sent: Wednesday, July 07, 2004 11:31 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Mcafee command line scanner It will work, but you will most likely be violating their licensing agreement. - Original Message - From: Adam Hobach [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, July 07, 2004 12:31 PM Subject: [Declude.Virus] Mcafee command line scanner Is this a real price for the Mcafee command line scanner: http://www.macmall.com/macmall/shop/detail.asp?dpno=118250 Has anyone found this software this low?? This is what is needed to work with Declude? Thanks, Adam --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Mcafee command line scanner
That is the correct price for that LICENSE LEVEL (L) VCLCAE-AA-LH But you must be GOVERNMENT and I believe that price is for 10,000+ copies. License Pricing IDIQ:Level L,Volume:,Government: McAfee VirusScan Command Line Scanner Standard - complete package Specifications General Compatibility PC: Operating System License qty 1 node License type Complete package Licensing program Network Associates TSP Licensing Program System Requirements Min operating system Microsoft DOS 6.22,Microsoft Windows XP,Microsoft Windows 95/98,Microsoft Windows NT 3.51,Microsoft Windows 2000 / NT4.0,Microsoft Windows Millennium Edition Software License Pricing IDIQ:Level L,Volume:,Government: Service / Support Service / Support Details Technical support -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adam Hobach Sent: Wednesday, July 07, 2004 12:48 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee command line scanner Which Mcafee product does everyone use then? Thanks, Adam -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jeff Pereira Sent: Wednesday, July 07, 2004 11:31 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Mcafee command line scanner It will work, but you will most likely be violating their licensing agreement. - Original Message - From: Adam Hobach [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, July 07, 2004 12:31 PM Subject: [Declude.Virus] Mcafee command line scanner Is this a real price for the Mcafee command line scanner: http://www.macmall.com/macmall/shop/detail.asp?dpno=118250 Has anyone found this software this low?? This is what is needed to work with Declude? Thanks, Adam --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] McAfee 4160 engine is toooo old
More info on problems with the old engine. Also sometimes (esp on Win 98) it may take some extra procedures to fully update the engine. http://forums.mcafeehelp.com/viewtopic.php?t=27957 PS For any McAfee question this forum is a GREAT resource. (Focused on Retail customers, but there is a small corner for Corp questions also.) http://forums.mcafeehelp.com Greg Little --- [This E-mail scanned for viruses by Findlay Internet] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Mcafee NetShield Problems
Contact Microsoft. They can analyze the dumps for you. 64K dumps should be fine. DC -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Hahn Sent: Wednesday, April 28, 2004 3:24 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee NetShield Problems John- Thanks for the response. We are taking small memory dumps as we cannot afford to have it down in time for a full 4 GB mem dump. I do have 189 Minni 64 KB dump files. How can I analyze those? I also opened drwatsn32. It is enabled and noticed a error I N ldap Application exception occurred: App: f:\imail\OpenLDAP\bin\slapd.exe (pid=1940) When: 4/24/2004 @ 07:24:33.281 Exception number: c005 (access violation) I have 1 power supply I have latest BIOS Raid adapter was current until 4/23 when a new firmware was released. We will be upgrading that tonight. Any thoughts. Thanks -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Wednesday, April 28, 2004 12:37 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee NetShield Problems Any memory dumps being created? Is DrWatson Running? Do you have 2 power supplies running, and are they both in use? What is the firmware on the raid controller? (There was a critical update on this about 5 months ago.) John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Hahn Sent: Wednesday, April 28, 2004 9:23 AM To: [EMAIL PROTECTED] Subject: [Declude.Virus] Mcafee NetShield Problems We are having problems with a brand new dell poweredge 2650 that is crashing 5-10 times per day: Windows 2003 Latest patches Imail 8.1 latest Declude Junk Virus Netshield 4.5 We have worked this with dell and they have run Hardware Diagnostics and they Do not see a problem My question: Is anyone else having problems using Netshield 4.5.1 on windows 2003 ? Is anyone using Virus scan enterprise 7 on windows 2003 with declude? Thanks all --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Mcafee NetShield Problems
Why the interest in the second power supply??? Is it used or just laying in wait for the first one to die as in 99% of the RDP systems currently in production? Don't get me wrong. You should always have at least one spare power supply handy and if money is not an issue or the server is critical (mail) then install them both but this is the first I ever heard anyone say you need the second power supply to avoid daily crashes. Is it a DELL thing? DC -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Wednesday, April 28, 2004 5:23 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee NetShield Problems I agree with Scott's response about LDAP. The raid controller firmware I am not concerned with, although I did not know they had a new one. I will have to check on my clients 2650 for that. While apparently not the root of the problem, I would highly suggest getting the second PS for that unit and installing it. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Hahn Sent: Wednesday, April 28, 2004 12:24 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee NetShield Problems John- Thanks for the response. We are taking small memory dumps as we cannot afford to have it down in time for a full 4 GB mem dump. I do have 189 Minni 64 KB dump files. How can I analyze those? I also opened drwatsn32. It is enabled and noticed a error I N ldap Application exception occurred: App: f:\imail\OpenLDAP\bin\slapd.exe (pid=1940) When: 4/24/2004 @ 07:24:33.281 Exception number: c005 (access violation) I have 1 power supply I have latest BIOS Raid adapter was current until 4/23 when a new firmware was released. We will be upgrading that tonight. Any thoughts. Thanks -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Wednesday, April 28, 2004 12:37 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee NetShield Problems Any memory dumps being created? Is DrWatson Running? Do you have 2 power supplies running, and are they both in use? What is the firmware on the raid controller? (There was a critical update on this about 5 months ago.) John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Hahn Sent: Wednesday, April 28, 2004 9:23 AM To: [EMAIL PROTECTED] Subject: [Declude.Virus] Mcafee NetShield Problems We are having problems with a brand new dell poweredge 2650 that is crashing 5-10 times per day: Windows 2003 Latest patches Imail 8.1 latest Declude Junk Virus Netshield 4.5 We have worked this with dell and they have run Hardware Diagnostics and they Do not see a problem My question: Is anyone else having problems using Netshield 4.5.1 on windows 2003 ? Is anyone using Virus scan enterprise 7 on windows 2003 with declude? Thanks all --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Mcafee NetShield Problems
I agree with Scott's response about LDAP. The raid controller firmware I am not concerned with, although I did not know they had a new one. I will have to check on my clients 2650 for that. While apparently not the root of the problem, I would highly suggest getting the second PS for that unit and installing it. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Hahn Sent: Wednesday, April 28, 2004 12:24 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee NetShield Problems John- Thanks for the response. We are taking small memory dumps as we cannot afford to have it down in time for a full 4 GB mem dump. I do have 189 Minni 64 KB dump files. How can I analyze those? I also opened drwatsn32. It is enabled and noticed a error I N ldap Application exception occurred: App: f:\imail\OpenLDAP\bin\slapd.exe (pid=1940) When: 4/24/2004 @ 07:24:33.281 Exception number: c005 (access violation) I have 1 power supply I have latest BIOS Raid adapter was current until 4/23 when a new firmware was released. We will be upgrading that tonight. Any thoughts. Thanks -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Wednesday, April 28, 2004 12:37 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee NetShield Problems Any memory dumps being created? Is DrWatson Running? Do you have 2 power supplies running, and are they both in use? What is the firmware on the raid controller? (There was a critical update on this about 5 months ago.) John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Hahn Sent: Wednesday, April 28, 2004 9:23 AM To: [EMAIL PROTECTED] Subject: [Declude.Virus] Mcafee NetShield Problems We are having problems with a brand new dell poweredge 2650 that is crashing 5-10 times per day: Windows 2003 Latest patches Imail 8.1 latest Declude Junk Virus Netshield 4.5 We have worked this with dell and they have run Hardware Diagnostics and they Do not see a problem My question: Is anyone else having problems using Netshield 4.5.1 on windows 2003 ? Is anyone using Virus scan enterprise 7 on windows 2003 with declude? Thanks all --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Mcafee NetShield Problems
How can I tell what hotfixes were applied to my system? I am 8.1, I think I have HF2 (The latest) In the meantime I have disabled LDAP to see if that helps. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, April 28, 2004 3:38 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee NetShield Problems I also opened drwatsn32. It is enabled and noticed a error I N ldap Application exception occurred: Given this App: f:\imail\OpenLDAP\bin\slapd.exe (pid=1940) and: Imail 8.1 latest this, I think this is one of the problems people are having with LDAP on IMail v8.10. I would recommend getting the latest hotfix from Ipswitch, if you have not yet done so. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Mcafee NetShield Problems
Start;Programs;Imail;Imail release notes - I'm really shocked that they don't put this in Imail admin or help or something... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Hahn Sent: Wednesday, April 28, 2004 8:40 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee NetShield Problems How can I tell what hotfixes were applied to my system? I am 8.1, I think I have HF2 (The latest) In the meantime I have disabled LDAP to see if that helps. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, April 28, 2004 3:38 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee NetShield Problems I also opened drwatsn32. It is enabled and noticed a error I N ldap Application exception occurred: Given this App: f:\imail\OpenLDAP\bin\slapd.exe (pid=1940) and: Imail 8.1 latest this, I think this is one of the problems people are having with LDAP on IMail v8.10. I would recommend getting the latest hotfix from Ipswitch, if you have not yet done so. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Mcafee NetShield Problems
Thanks Scott Hahn -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of marc catuogno Sent: Wednesday, April 28, 2004 10:30 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee NetShield Problems Start;Programs;Imail;Imail release notes - I'm really shocked that they don't put this in Imail admin or help or something... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Hahn Sent: Wednesday, April 28, 2004 8:40 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee NetShield Problems How can I tell what hotfixes were applied to my system? I am 8.1, I think I have HF2 (The latest) In the meantime I have disabled LDAP to see if that helps. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, April 28, 2004 3:38 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee NetShield Problems I also opened drwatsn32. It is enabled and noticed a error I N ldap Application exception occurred: Given this App: f:\imail\OpenLDAP\bin\slapd.exe (pid=1940) and: Imail 8.1 latest this, I think this is one of the problems people are having with LDAP on IMail v8.10. I would recommend getting the latest hotfix from Ipswitch, if you have not yet done so. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] McAfee batch updates
I am working on the mcafee batch updates linked to on declude.com
I am trying to customize the file for a special case, and to rewrite one to
download the latest McAfee engine instead of SDAT
for that, i need some help understanding the lines below
any hints welcomed
mainly, how do we get the latest sdat filename to execute.
and how do we expand and/or execute it, and in which directory it expand.
Thanks in advance, especialy for the person who first wrote and shared these
files.
:ProcessSDAT
SET T=0
for /F %%I in ('dir %DownloadDir%\sdat4*.exe /a-d-s /b /o:-n') do call
:RunSDAT %DownloadDir%\%%I
%unzipcmd% %DownloadDir%\DAILYDAT.zip %unziptail%
del %SDATLog%
goto END
:RunSDAT
SET /a T = 1+%T%
if %T% EQU 1 start /wait %1 -logfile %SDATLog% -e %scandrv%%scandir%
if %T% LEQ 3 goto :RunSDAT_exit
if exist %1 del /F %1
:RunSDAT_exit
goto :EOF
:END
ENDLOCAL
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.
RE: [Declude.Virus] Mcafee
Troy, Thanks for the part numbers. I've managed too download the manual. Can I get a copy of the batch file? Gene Head ACCRAM Inc. MCP,Net+,A+,CCNA,CCDA [EMAIL PROTECTED] [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Troy Hickerson Sent: Wednesday, February 25, 2004 3:45 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Mcafee Here is some information for a McAfee VirusScan Command Line which works well. From the testing I've done it appears to be a fast, small, lightweight scanner with SCAN.EXE and all the Declude integration. AND IT ONLY COSTS $15 PER COPY FOR A WINDOWS 200/2003 SERVER OS. The only drawback is that it does not include an auto-updater. I write a batch file to check every 15 minutes and download and new DAT file if available. Here's my order information from CDW in case you want to track down the part number: Thank you for considering CDW for your computing needs. Following are the details of your quote. Quote Date: 1/13/2004 Payment Terms: Request Terms Shipped Via: DROP SHIP-GROUND == == QTYITEMDESCRIPTION /MFG. PART NUMBERUNIT PRICE EXT. PRICE 1 458401 MCL VSCL STD 2:1 1-25 W/WEB 15.00 15.00 MCL-VCLAAE-AA-AA Subtotal 15.00 Sales Tax .00 Freight.00 Total15.00 From: R. Scott Perry [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Wed, 25 Feb 2004 13:52:11 -0500 To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee Thanks for the link. I called them to get a price and ran into another brick wall. McAfee is like that. Their normal MO, though, is to oversell, doing everything short of blatant lying to do so. What you may want to do is try asking them I have one computer running Windows XYZ (for example, Windows 2003 Server or Windows 2000 Professional) and need one license of VirusScan or NetShield to run on it, what is my least expensive option? If they ask you *any* questions, evade them (I don't know, I'll have to check with my boss, I really don't want to give that information to you, Please, just answer my question!, whatever). If licensing may be an issue, take a look at their license, and have whoever is in charge at your company (your boss, legal department, etc.) look at it and make a determination. Our reading is that you either need 1 license per server running Declude, or 1 license per user on the Internet (millions of licenses). Other possibilities (but ones we don't read in their license) include one license per user of yours, or one license per copy that can be running simultaneously on the IMail server (the MAXATONCE option in the virus.cfg file can determine this number). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Mcafee
It's Mcafee Virus Scan Ver 8.0 Build 8.0.26 There isn't a scan.exe or scan32.exe on the drive. You'll need to do a Full Install. That should get the scan.exe installed. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Mcafee
Scott, I've re-installed it a couple of times but I haven't seen anywhere that I can tell it to do a full install. Does anyone have this version? Gene Head ACCRAM Inc. MCP,Net+,A+,CCNA,CCDA [EMAIL PROTECTED] [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, February 25, 2004 5:41 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee It's Mcafee Virus Scan Ver 8.0 Build 8.0.26 There isn't a scan.exe or scan32.exe on the drive. You'll need to do a Full Install. That should get the scan.exe installed. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Mcafee
I've re-installed it a couple of times but I haven't seen anywhere that I can tell it to do a full install. You'll need to contact McAfee then to see how to do a Full Install (or at least how to get the scan.exe file installed). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Mcafee
I believe you have the consumer version. The corporate version is still at version 7.1. I know the corporate version has the scan/scan32.exe files. Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gene Head Sent: Wednesday, February 25, 2004 9:25 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee Scott, I've re-installed it a couple of times but I haven't seen anywhere that I can tell it to do a full install. Does anyone have this version? Gene Head ACCRAM Inc. MCP,Net+,A+,CCNA,CCDA [EMAIL PROTECTED] [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, February 25, 2004 5:41 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee It's Mcafee Virus Scan Ver 8.0 Build 8.0.26 There isn't a scan.exe or scan32.exe on the drive. You'll need to do a Full Install. That should get the scan.exe installed. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Mcafee
Do you have a part number/SKU for that? I've called Mcafee and can't seem to get them to understand what I need. They do have a version called VirusScan ASAP but they can't tell me if it has scan.exe. Gene -- Original Message -- From: Darrell LaRock [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Wed, 25 Feb 2004 10:41:56 -0500 I believe you have the consumer version. The corporate version is still at version 7.1. I know the corporate version has the scan/scan32.exe files. Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gene Head Sent: Wednesday, February 25, 2004 9:25 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee Scott, I've re-installed it a couple of times but I haven't seen anywhere that I can tell it to do a full install. Does anyone have this version? Gene Head ACCRAM Inc. MCP,Net+,A+,CCNA,CCDA [EMAIL PROTECTED] [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, February 25, 2004 5:41 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee It's Mcafee Virus Scan Ver 8.0 Build 8.0.26 There isn't a scan.exe or scan32.exe on the drive. You'll need to do a Full Install. That should get the scan.exe installed. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Mcafee
Gene: If you review the archives you will see a great discussion on this topic. We did this research a while back and finally gave up.. The final word was McAfee requires you to buy a license for every mailbox you have. If you are an ISP then this makes no sense. There is no such thing as a single license server version of McAfee. If you buy the server version it comes with client licenses.. And each client for a mail server is defined as a User (or mailbox). McAfee has a Network server version that comes with client licenses. At the time we did the research (over a year ago) the price was several hundred dollars. For 1/3 of that price we added F-Prot (~$50) and AVG (~$100) and use 2 scanners. We even considered F-Secure but I think they wanted a license for every mailbox as well but I am not sure. Anyway-- trying to get an answer from anyone regarding McAfee will waste a lot of your time .. We had our CDW rep. research it and the final verdict was as I stated earlier. Of course all that could have changed .. But I doubt it. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gene Head Sent: Wednesday, February 25, 2004 12:15 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee Do you have a part number/SKU for that? I've called Mcafee and can't seem to get them to understand what I need. They do have a version called VirusScan ASAP but they can't tell me if it has scan.exe. Gene -- Original Message -- From: Darrell LaRock [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Wed, 25 Feb 2004 10:41:56 -0500 I believe you have the consumer version. The corporate version is still at version 7.1. I know the corporate version has the scan/scan32.exe files. Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gene Head Sent: Wednesday, February 25, 2004 9:25 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee Scott, I've re-installed it a couple of times but I haven't seen anywhere that I can tell it to do a full install. Does anyone have this version? Gene Head ACCRAM Inc. MCP,Net+,A+,CCNA,CCDA [EMAIL PROTECTED] [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, February 25, 2004 5:41 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee It's Mcafee Virus Scan Ver 8.0 Build 8.0.26 There isn't a scan.exe or scan32.exe on the drive. You'll need to do a Full Install. That should get the scan.exe installed. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Mcafee
Unfortunately, I do not have a SKU. However, this link will take you to the product. http://www.networkassociates.com/us/products/mcafee/antivirus/desktop/vs.htm Don't be scared by the word desktop. VS 7.0 has both the server and desktop version built into the installer. Also, the current version is 7.1. Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gene Head Sent: Wednesday, February 25, 2004 12:15 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee Do you have a part number/SKU for that? I've called Mcafee and can't seem to get them to understand what I need. They do have a version called VirusScan ASAP but they can't tell me if it has scan.exe. Gene -- Original Message -- From: Darrell LaRock [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Wed, 25 Feb 2004 10:41:56 -0500 I believe you have the consumer version. The corporate version is still at version 7.1. I know the corporate version has the scan/scan32.exe files. Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gene Head Sent: Wednesday, February 25, 2004 9:25 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee Scott, I've re-installed it a couple of times but I haven't seen anywhere that I can tell it to do a full install. Does anyone have this version? Gene Head ACCRAM Inc. MCP,Net+,A+,CCNA,CCDA [EMAIL PROTECTED] [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, February 25, 2004 5:41 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee It's Mcafee Virus Scan Ver 8.0 Build 8.0.26 There isn't a scan.exe or scan32.exe on the drive. You'll need to do a Full Install. That should get the scan.exe installed. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Mcafee
Thanks for the link. I called them to get a price and ran into another brick wall. Very frustrating. Do you remember where you bought it and what you paid? Gene -- Original Message -- From: Darrell LaRock [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Wed, 25 Feb 2004 12:19:35 -0500 Unfortunately, I do not have a SKU. However, this link will take you to the product. http://www.networkassociates.com/us/products/mcafee/antivirus/desktop/vs.htm Don't be scared by the word desktop. VS 7.0 has both the server and desktop version built into the installer. Also, the current version is 7.1. Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gene Head Sent: Wednesday, February 25, 2004 12:15 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee Do you have a part number/SKU for that? I've called Mcafee and can't seem to get them to understand what I need. They do have a version called VirusScan ASAP but they can't tell me if it has scan.exe. Gene -- Original Message -- From: Darrell LaRock [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Wed, 25 Feb 2004 10:41:56 -0500 I believe you have the consumer version. The corporate version is still at version 7.1. I know the corporate version has the scan/scan32.exe files. Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gene Head Sent: Wednesday, February 25, 2004 9:25 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee Scott, I've re-installed it a couple of times but I haven't seen anywhere that I can tell it to do a full install. Does anyone have this version? Gene Head ACCRAM Inc. MCP,Net+,A+,CCNA,CCDA [EMAIL PROTECTED] [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, February 25, 2004 5:41 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Mcafee It's Mcafee Virus Scan Ver 8.0 Build 8.0.26 There isn't a scan.exe or scan32.exe on the drive. You'll need to do a Full Install. That should get the scan.exe installed. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Mcafee
Thanks for the link. I called them to get a price and ran into another brick wall. McAfee is like that. Their normal MO, though, is to oversell, doing everything short of blatant lying to do so. What you may want to do is try asking them I have one computer running Windows XYZ (for example, Windows 2003 Server or Windows 2000 Professional) and need one license of VirusScan or NetShield to run on it, what is my least expensive option? If they ask you *any* questions, evade them (I don't know, I'll have to check with my boss, I really don't want to give that information to you, Please, just answer my question!, whatever). If licensing may be an issue, take a look at their license, and have whoever is in charge at your company (your boss, legal department, etc.) look at it and make a determination. Our reading is that you either need 1 license per server running Declude, or 1 license per user on the Internet (millions of licenses). Other possibilities (but ones we don't read in their license) include one license per user of yours, or one license per copy that can be running simultaneously on the IMail server (the MAXATONCE option in the virus.cfg file can determine this number). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Mcafee
Typically the McAfee command line scanned, scan.exe, has been located in c:\program files\common files\Network Associates\VirusScan Engine\4.0.xx, or whatever version number you are running. Here is the McAfee entry from the Declude Virus manual at http://www.declude.com/virus/manual.htm: SCANFILE C:\Progra~1\Common~1\networ~1\viruss~1\4.0.xx\scan.exe /ALL /NOMEM /NOBEEP /NOBREAK /UNZIP /SILENT /NODDA /REPORT report.txt VIRUSCODE 13 REPORT Found Bill - Original Message - From: Gene Head [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, February 24, 2004 5:14 PM Subject: [Declude.Virus] Mcafee I just purchased Mcafee to use as a third scanner. I installed it but I can't find the command line scanner. Anyone have the new Virus scan program and can share the process for getting this to work? Gene Head ACCRAM Inc. MCP,Net+,A+,CCNA,CCDA [EMAIL PROTECTED] [EMAIL PROTECTED] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] Mcafee
I just purchased Mcafee to use as a third scanner. I installed it but I can't find the command line scanner. Anyone have the new Virus scan program and can share the process for getting this to work? Gene Head ACCRAM Inc. MCP,Net+,A+,CCNA,CCDA [EMAIL PROTECTED] [EMAIL PROTECTED] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Mcafee
It's Mcafee Virus Scan Ver 8.0 Build 8.0.26 There isn't a scan.exe or scan32.exe on the drive. Gene Head ACCRAM Inc. MCP,Net+,A+,CCNA,CCDA [EMAIL PROTECTED] [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry Sent: Tuesday, February 24, 2004 6:36 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Mcafee Typically the McAfee command line scanned, scan.exe, has been located in c:\program files\common files\Network Associates\VirusScan Engine\4.0.xx, or whatever version number you are running. Here is the McAfee entry from the Declude Virus manual at http://www.declude.com/virus/manual.htm: SCANFILE C:\Progra~1\Common~1\networ~1\viruss~1\4.0.xx\scan.exe /ALL /NOMEM /NOBEEP /NOBREAK /UNZIP /SILENT /NODDA /REPORT report.txt VIRUSCODE 13 REPORT Found Bill - Original Message - From: Gene Head [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, February 24, 2004 5:14 PM Subject: [Declude.Virus] Mcafee I just purchased Mcafee to use as a third scanner. I installed it but I can't find the command line scanner. Anyone have the new Virus scan program and can share the process for getting this to work? Gene Head ACCRAM Inc. MCP,Net+,A+,CCNA,CCDA [EMAIL PROTECTED] [EMAIL PROTECTED] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Mcafee
Dunno then. You may need to put a call into McAfee. Bill - Original Message - From: Gene Head [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, February 24, 2004 6:48 PM Subject: RE: [Declude.Virus] Mcafee It's Mcafee Virus Scan Ver 8.0 Build 8.0.26 There isn't a scan.exe or scan32.exe on the drive. Gene Head ACCRAM Inc. MCP,Net+,A+,CCNA,CCDA [EMAIL PROTECTED] [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry Sent: Tuesday, February 24, 2004 6:36 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Mcafee Typically the McAfee command line scanned, scan.exe, has been located in c:\program files\common files\Network Associates\VirusScan Engine\4.0.xx, or whatever version number you are running. Here is the McAfee entry from the Declude Virus manual at http://www.declude.com/virus/manual.htm: SCANFILE C:\Progra~1\Common~1\networ~1\viruss~1\4.0.xx\scan.exe /ALL /NOMEM /NOBEEP /NOBREAK /UNZIP /SILENT /NODDA /REPORT report.txt VIRUSCODE 13 REPORT Found Bill - Original Message - From: Gene Head [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, February 24, 2004 5:14 PM Subject: [Declude.Virus] Mcafee I just purchased Mcafee to use as a third scanner. I installed it but I can't find the command line scanner. Anyone have the new Virus scan program and can share the process for getting this to work? Gene Head ACCRAM Inc. MCP,Net+,A+,CCNA,CCDA [EMAIL PROTECTED] [EMAIL PROTECTED] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] McAfee and /clean
Sorry for the denseness I was looking at the McAfee help file, and there were /mime and /mailbox switches. Am I missing something? Also is there an AV product that will function w. Declude AV and clean and pass the messages along? Statistically it would probably be seldom used as most viral attachments are deliberate rather than accidental, so I just currious. Anyone on the list? Burzin In other words is there a problem with adding /clean to the virus.cfg file? Yes, there would be a problem. Specifically, McAfee will clean the decoded attachment that Declude Virus creates, and will report the E-mail as virus-free -- so Declude Virus will deliver the E-mail, even though it has a virus in it (note that McAfee doesn't know or care that there is an encoded E-mail somewhere else that is related to the file it is scanning). -Scott --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] McAfee and /clean
I was looking at the McAfee help file, and there were /mime and /mailbox switches. Am I missing something? You can ignore those. McAfee won't see any MIME segments or mailboxes -- Declude Virus handles all that. McAfee will just see an attachment (one that will be deleted immediately after it is scanned, so any alterations McAfee might make to it will not be used anywhere). Also is there an AV product that will function w. Declude AV and clean and pass the messages along? No -- because if it cleans the attachment, the attachment is then immediately deleted, so nobody will ever see the cleaned file. Statistically it would probably be seldom used as most viral attachments are deliberate rather than accidental, so I just currious. Anyone on the list? About 99% of viruses that are received are ones that the virus itself sent out, that has meaningless content. In the rare cases where someone intentionally sends out an attachment that happens to have a virus, their computer is infected -- and, well, I think it's not a good idea to go out of your way to get their E-mail delivered. If you do, they may not bother disinfecting their computer -- which could enable spammers to send out millions of spams, for example. Also, you should note that several viruses will include a document from the computer they infect in the E-mails they send out. So confidential documents may be spread by cleaning E-mails with viruses. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] McAfee and /clean
Thanks John and Andy and others... :) I realize that the situation is a statistical abnormality-- far more extreme than John suggests. Chalk the question up to one of curiosity more so than one of an immediate driving technical need. Thanks, Burzin At 04:57 PM 12/3/2003, you wrote: 99 times out of 100, the message infected with a virus is not legit, therefore there is no reason to clean and deliver. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.Virus- [EMAIL PROTECTED] On Behalf Of Burzin Sumariwalla Sent: Wednesday, December 03, 2003 2:39 PM To: [EMAIL PROTECTED] Subject: [Declude.Virus] McAfee and /clean Hello, Is the /clean switch in McAfee AV (Enterprise Edition 7.1) supported within Declude? In other words is there a problem with adding /clean to the virus.cfg file? Thanks, Burzin At 02:32 PM 12/3/2003, you wrote: Welcome aboard the Declude Virus mailing list! This list was created to help users (and potential users) of Declude Virus to get together and share information about it. Suggested uses of this list include: Sharing tips and tricks, reporting problems (Computerized Horizons monitors the forum), discussion of beta features, anything you can think of. To send an E-mail to the list, just send an E-mail to [EMAIL PROTECTED] -Scott --- [This E-mail scanned for viruses by Declude Virus] -- Burzin Sumariwalla Phone: (314) 994-9411 x291 [EMAIL PROTECTED] Fax: (314) 997-7615 Pager: (314) 407-3345 Networking and Telecommunications Manager Information Technology Services St. Louis County Library District 1640 S. Lindbergh Blvd. St. Louis, MO 63131 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] -- Burzin Sumariwalla Phone: (314) 994-9411 x291 [EMAIL PROTECTED] Fax: (314) 997-7615 Pager: (314) 407-3345 Networking and Telecommunications Manager Information Technology Services St. Louis County Library District 1640 S. Lindbergh Blvd. St. Louis, MO 63131 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] McAfee and /clean
Is the /clean switch in McAfee AV (Enterprise Edition 7.1) supported within Declude? No, it is not. In other words is there a problem with adding /clean to the virus.cfg file? Yes, there would be a problem. Specifically, McAfee will clean the decoded attachment that Declude Virus creates, and will report the E-mail as virus-free -- so Declude Virus will deliver the E-mail, even though it has a virus in it (note that McAfee doesn't know or care that there is an encoded E-mail somewhere else that is related to the file it is scanning). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] McAfee and /clean
Hi, I think that virtually all virus infected emails nowadays contain worth preserving, because the only thing attached is the virus itself. Cleaning would not accomplish anything - because after the cleaning there'd be nothing left. (Sorry to disappoint you, but that virus email that claims that the attachment contains some nude photos of Anna whoever is lying - there really is no pictures G.) The clean option is practical on an already infected machine where executables, registry and other settings needs to be cleaned to remove the virus without losing critical files. In theory, Declude could ask the virus scanner to 'clean' an infected WORDS or EXCEL document and then pass it on - but I can't remember the last time I've seen an unintentional infection. Nowadays everything seem to be viruses/worms that are spamming themselves. Best Regards Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] McAfee and /clean
99 times out of 100, the message infected with a virus is not legit, therefore there is no reason to clean and deliver. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.Virus- [EMAIL PROTECTED] On Behalf Of Burzin Sumariwalla Sent: Wednesday, December 03, 2003 2:39 PM To: [EMAIL PROTECTED] Subject: [Declude.Virus] McAfee and /clean Hello, Is the /clean switch in McAfee AV (Enterprise Edition 7.1) supported within Declude? In other words is there a problem with adding /clean to the virus.cfg file? Thanks, Burzin At 02:32 PM 12/3/2003, you wrote: Welcome aboard the Declude Virus mailing list! This list was created to help users (and potential users) of Declude Virus to get together and share information about it. Suggested uses of this list include: Sharing tips and tricks, reporting problems (Computerized Horizons monitors the forum), discussion of beta features, anything you can think of. To send an E-mail to the list, just send an E-mail to [EMAIL PROTECTED] -Scott --- [This E-mail scanned for viruses by Declude Virus] -- Burzin Sumariwalla Phone: (314) 994-9411 x291 [EMAIL PROTECTED] Fax: (314) 997-7615 Pager: (314) 407-3345 Networking and Telecommunications Manager Information Technology Services St. Louis County Library District 1640 S. Lindbergh Blvd. St. Louis, MO 63131 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.Virus] McAfee Enterprise 7.0 not picking up Sobig.F
Hello R., Thursday, August 21, 2003, 2:59:18 PM, you wrote: I did that with eicar and the On-Demand Scanner picked it up. However, when I did it with Sobig.F, there was no attachment. Then I noticed that it was a bounced message from another server (not using SKIPIFVIRUSNAMEHAS). I'm now wondering if that is why McAfee On-Demand/Declude is not picking it up, because the virus is part of the bounced message and it appears to not be executable. However, F-Prot and McAfee On-Access both detect Sobig.F in the SMD file. ?? RSP Most AV programs will not detect corrupt, non-viable variants, which often RSP includes bounce messages (because those bounce messages are usually truncated). RSP -Scott RSP --- RSP Declude JunkMail: The advanced anti-spam solution for IMail mailservers. RSP Declude Virus: Catches known viruses and is the leader in mailserver RSP vulnerability detection. RSP Find out what you have been missing: Ask for a free 30-day evaluation. We started seeing something similar about 2:00 a.m. I started getting warnings Trend that it was picking up viruses in my /spam folder. Don't know how many going through because can't scan the /spool with Trend. Trying to figure out if they're non-viable. Even if they are Declude/F-prot should be stopping them though because we had a similar problem a few weeks ago and added VIRUSCODE 8 in order to stop suspicious files. -David -- Best regards, Davidmailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] McAfee Enterprise 7.0 not picking up Sobig.F
After reading your post I went in and looked at my server, and the [expletive deleted] McAfee Autoupdater hadn't successfully processed an update since the 19th when it pulled 4286. That meant that we were on 4286 DATs and not the current 4288. I forced an update manually, and it pulled these new definitions just fine, but I have two days worth of failed updates in the activity logs that just give me a sick feeling in the pit of my stomach. I am finally seeing both scanners picking it up. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Bill Newberg Sent: Wednesday, 20 August 2003 6:55 PM To: [EMAIL PROTECTED] Subject: [Declude.Virus] McAfee Enterprise 7.0 not picking up Sobig.F I use two scanners, F-Prot and McAfee Enterprise 7.0. F-Prot is picking up Sobig.F, but McAfee is not. I have the latest definitions, 4288, and the latest engine 4.2.60. When I send the test eicar file as a zip, both scanners detect it, so I know both scanners are functioning. Does anyone have any ideas as to why my McAfee is not detecting Sobig.F? Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] McAfee Enterprise 7.0 not picking upSobig.F
I did that with eicar and the On-Demand Scanner picked it up. However, when I did it with Sobig.F, there was no attachment. Then I noticed that it was a bounced message from another server (not using SKIPIFVIRUSNAMEHAS). I'm now wondering if that is why McAfee On-Demand/Declude is not picking it up, because the virus is part of the bounced message and it appears to not be executable. However, F-Prot and McAfee On-Access both detect Sobig.F in the SMD file. ?? Most AV programs will not detect corrupt, non-viable variants, which often includes bounce messages (because those bounce messages are usually truncated). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] McAfee Enterprise 7.0 not picking upSobig.F
Scott, Unfortunately (actually a good thing), all the virus e-mails I have left in the \virus directory are bounces from other servers. I don't have a Sobig.F attachment available to test. Once I receive one, I'll re-test. Thanks, Bill -- Original Message -- From: R. Scott Perry [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Thu, 21 Aug 2003 14:59:18 -0400 I did that with eicar and the On-Demand Scanner picked it up. However, when I did it with Sobig.F, there was no attachment. Then I noticed that it was a bounced message from another server (not using SKIPIFVIRUSNAMEHAS). I'm now wondering if that is why McAfee On-Demand/Declude is not picking it up, because the virus is part of the bounced message and it appears to not be executable. However, F-Prot and McAfee On-Access both detect Sobig.F in the SMD file. ?? Most AV programs will not detect corrupt, non-viable variants, which often includes bounce messages (because those bounce messages are usually truncated). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] McAfee Enterprise 7.0 not picking up Sobig.F
I use two scanners, F-Prot and McAfee Enterprise 7.0. F-Prot is picking up Sobig.F, but McAfee is not. I have the latest definitions, 4288, and the latest engine 4.2.60. When I send the test eicar file as a zip, both scanners detect it, so I know both scanners are functioning. Does anyone have any ideas as to why my McAfee is not detecting Sobig.F? Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] McAfee 4241 missing w32/SoBig
f-prot scanner caught 8 messages yesterday with the w32/SoBig.A@mm virus that Mcafee (NAI) passed. Mcafee dat is at 4241 released 1/8. I scanned the smd file with NAV and it also reported soBig. Reviewing NAI for information on w32/soBig.A http://vil.nai.com/vil/content/v_99950.htm indicates minimum dat is 4242 release date 1/15. As far as I know there is no extra dat on nai's site for this. Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] McAfee 4241 missing w32/SoBig
NAI just sent me an extra.dat but I had to request it. After installation of the extra.dat the Mcafee scanner is now detecting this virus: Scanner 2: Virus= the W32/Sobig@MM (ED) virus !!! Attachment=Sample.pif [0] I Getting several of these now. Based on what I am seeing the treat assessment may be a little low. Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] McAfee update
To those interested in the topic of virus scanner cost a few weeks ago, here is an update on my conversations with McAfee. Not Good. If we got the rate of their best client, we would pay about $2,000 per year. Any we are a small shop. :( John Tolmachoff IT Manager, Network Engineer Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.Virus] McAfee
I have just installed NetShield, (full install disabled on demand,) but I do not see a scan.exe in the directory. I do see the scan32.exe, but according to the virus manual, that is not the one to use for command line. I even ran a manual scan to see if it would create it. You may need to do a Full Install. Also note that it may install it to a directory of its choosing instead of the one you tell it to, so you may want to search your hard drive for scan.exe. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.Virus] McAfee Daily DAT Command Line Scanner Update Script
- Original Message -
From: "Jerry Murdock" [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, January 28, 2002 6:53 PM
Subject: [Declude.Virus] McAfee Daily DAT Command
Line Scanner Update Script
As requested a few times, attached is a script to update the engine
and dat files for a command line install of McAfee. I
was hesitant to post, and it comes with some limitations and warnings:
NAI considers the daily dat files BETA quality NAI
could change sdat behavior at any time. See notes in the file.
It is NOT designed to update a running Netshield, but can be modified
to do so. See notes in the file. It is more wget
version dependent than I'd like. For easier deployment, this
version uses MS find.exe instead of grep(requiring a change in my search
string). To use with MS find instead of grep, pay attention to wget
version and use the appropriate switches. As always,
use at your own risk. It works for my personal purposes, but could
cause loss of data or worse on your systems.
Jerry
The archived version of the original post shows the
attachment in-line and wraps some of the lines.
There is no change in the script, only posted via
HTML to to prevent wrapping in the archive, along with an attached zip file of
the same.
Jerry
:= BEGIN CUT HERE =
rem Updates a Mcafee *! COMMAND LINE !* scanner installation with
latest rem engine and daily dat files.
rem WARNING: rem NAI considers the daily dat files BETA quality.
Use at your own risk.
rem WARNING:rem NAI could change the behavior of the SuperDAT packages
at any time, rem rendering this script useless or even dangerous.
rem WARNING: rem This is *NOT* designed to update a running
on-access/real-time scanner rem installation. If using Netshield or
VirusScan on-access/real-time rem scanners, create a separate directory for
the command line functionality.remrem Alternatively, it is possible to
use the same techniques to automaterem updating of the real-time
Netshield/VirusScan. Get SDATDAILY.exe insteadrem of DAILIYDAT.ZIP,
and look at the sdat command line switches to installrem the sdat(s)
silently. Proceed with caution, and test all possible rem scenarios.
An SDAT updating a running Netshield may want to reboot (morerem likely for
the "release" sdat41## file, probably not an issue for rem sdatdaily).
Proceed with caution.
rem Requires info-zip's unzip.exe 5.42 www.info-zip.orgrem Requires gnu wget,
links to Windows binaries at www.cygwin.com
or rem www.wget.org. rem rem
NOTE command line change for wget 1.8 or greater!
rem This script is distributed in the hope that it will be useful,rem
but WITHOUT ANY WARRANTY; without even the implied warranty ofrem
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. rem rem USE
AT YOUR OWN RISK!
SETLOCAL
:Set Path InfoSET scandrv=f:SET scandir=\vscan\McAfeeSET
DownloadDir=%scandrv%%scandir%\updateSET
SDATLog=%DownloadDir%\SDAT.LOG
:Set Unzip Command InfoSET unzipcmd=UNZIP -o -uSET unziptail=-d
%scandrv%%scandir%
:CheckDirectoriesmd %scandrv%%scandir%md %DownloadDir%if not
exist %DownloadDir% goto end
:Set FTP Info
:FOR WGET 1.7
!*!SET
wgetcmd=c:\cygwin\bin\wget.exe
:FOR WGET 1.8 OR GREATER
!**!:SET wgetcmd=c:\cygwin\bin\wget.exe
--progress=dot
SET SDATURL=ftp://ftp.nai.com/pub/antivirus/datfiles/4.x/sdat*.exeSET
DDATURL=http://download.nai.com/products/mcafee-avert/daily_dats/DAILYDAT.ZIP
SET NewSDAT=1SET NewDDAT=1
:FTPDownload%wgetcmd% -t 2 -N -P %DownloadDir% %SDATURL% 21 |
find "100%%"if errorlevel 1 SET NewSDAT=0
%wgetcmd% -t 2 -N -P %DownloadDir% %DDATURL% 21 | find
"100%%"if errorlevel 1 SET NewDDAT=0
if %NewSDAT%==1 goto ProcessSDATif %NewDDAT%==1 %unzipcmd%
%DownloadDir%\DAILYDAT.zip %unziptail%goto end
:ProcessSDATSET T=0for /F %%I in ('dir %DownloadDir%\sdat4*.exe
/a-d-s /b /o:-n') do call :RunSDAT %DownloadDir%\%%I %unzipcmd%
%DownloadDir%\DAILYDAT.zip %unziptail%del %SDATLog%goto END
:RunSDATSET /a T = 1+%T%if %T% EQU 1 start /wait %1 -logfile
%SDATLog% -e %scandrv%%scandir%if %T% LEQ 3 goto :RunSDAT_exitif exist
%1 del /F %1 :RunSDAT_exitgoto :EOF
:ENDENDLOCAL
:=ENDCUT
HERE=
updmcafee.zip
Description: Binary data
Re: [Declude.Virus] McAfee Daily DAT Command Line Scanner Update Script
Then on the mcafee site there isn't a link for an update for the command line scanner for the myparty virus. If there is a link, please forward it. Thanks, STeve --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.Virus] McAfee Daily DAT Command Line Scanner Update Script
I'm not sure what your asking. Update instructions are clearly described in the virus listing on McAfee's site. Jerry - Original Message - From: Steve Spear [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, January 29, 2002 4:32 PM Subject: Re: [Declude.Virus] McAfee Daily DAT Command Line Scanner Update Script Then on the mcafee site there isn't a link for an update for the command line scanner for the myparty virus. If there is a link, please forward it. Thanks, STeve --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.Virus] McAfee Virusscan command-line
Thanks, that little trick helped me out. Is there any chance I could have a peek a that update script of yours? My scripting are rather basic, I doubt it would take me less than a day to get it to work :P Joachim. If you actually managed to find and install the command line only version of Mcafee, it probably doesn't provide the registry hooks for SuperDat to know where it's installed. Use sdat /E d:\McafeePath to extract the files to your installation directory. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
RE: [Declude.Virus] McAfee NetShield Upgrade
In the declude.cfg look for; SCANNERTIMEOUT 60 I think 60 is the default so if you increase this your scanner is allowed more time to scan big files and thus eliminate your problem. Mark Chadwick IT Support Engineer Science International Bateman House 82-88 Hills Road Cambridge UK CB2 1LQ Tel: +44 (0)1223 326512 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Serge Dergham Sent: Friday, October 12, 2001 3:20 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] McAfee NetShield Upgrade upgraded to engine 4.1.5, but still getting the timout alerts do you know what are these ? The scan of E:\McAfee\SecureCast\ESC_55SP2.zip\ESC_55SP2.EXE has taken too long to complete and is being canceled. Scan engine version used is 4.1.50 DAT version 4.0.4165 - Original Message - From: Jerry Murdock [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 11, 2001 10:04 PM Subject: Re: [Declude.Virus] McAfee NetShield Upgrade 4100 is over a year old. Get the latest 4165 from the mcafee site. Jerry - Original Message - From: Serge Dergham [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 11, 2001 4:57 PM Subject: Re: [Declude.Virus] McAfee NetShield Upgrade thanks just tried sdat4100.exe and 4100xdat.exe that came with the CD, they both said I have the latest engine and dat files the about netshield has: Netshield for windows NT and W 2000 4.5 Virus def 4.0.4165 Scan engine 4.0.70 What is going on ? how can I get the new engines ? I just got my CD last week ? - Original Message - From: Jerry Murdock [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 11, 2001 8:23 PM Subject: Re: [Declude.Virus] McAfee NetShield Upgrade 1: 4.0.70 must be 2-3 years old now. Run SDAT ASAP, the scanner isn't worthless, but there are plenty of things that require the newer engines. 2: I don't like ME much. Haven't used it recently enough to help you. I've moved almost all clients with a corporate desktop solution to Trend Officescan. 3: See #2 Jerry - Original Message - From: Serge Dergham [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 11, 2001 3:22 PM Subject: Re: [Declude.Virus] McAfee NetShield Upgrade Hi jerry, few questions if you have the time: 1- I keep getting this type of alert from netshield: The scan of F:\pcany\pcanywhere\Full.Cab\F1477_Aw32ban.dll has taken too long to complete and is being canceled. Scan engine version used is 4.0.70 DAT version 4.0.4164. How can avoid this, is there a timeout or a time limit I can change ? 2- I am playing with ME (management edition), I downloaded and saved latest DAT with netshield, and used it to updated other machienes with netshield, but could not use it on machines with Viruscan, it gives a message that it could not get update.ini any idea what to do ? 3- can/should we use sdat with ME ? TIA - Original Message - From: Jerry Murdock [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 11, 2001 7:10 PM Subject: Re: [Declude.Virus] McAfee NetShield Upgrade Yes. - Original Message - From: Charles Stanley [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 11, 2001 3:06 PM Subject: Re: [Declude.Virus] McAfee NetShield Upgrade At 12:03 PM 10/11/01, you wrote: If you just mean the engine, download and run the latest SDAT.exe. This will update the engine for the server version of Netshield? This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail
RE: [Declude.Virus] McAfee NetShield Upgrade
In the declude.cfg look for; SCANNERTIMEOUT 60 I think 60 is the default so if you increase this your scanner is allowed more time to scan big files and thus eliminate your problem. Actually, his problem is with the scanner itself, when it is not being used with Declude. The SCANNERTIMEOUT actually should never need to be changed. A virus scanner should be able to scan any attachments within a second or two at the most. The SCANNERTIMEOUT value is designed to be a fail-safe, in case the scanner never ends (which will happen if a GUI scanner is accidentally used, for example). In a case like that, the SCANNERTIMEOUT will (help) prevent the system from crashing after running out of resources. -Scott This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
MISSING_REVERSE_DNS:Re: [Declude.Virus] McAfee NetShield Upgrade
forwarded email from aol (.eml files) have gotten through declude and f-prot. users are returning messages to our users that those emails have a virus. i need to include eml file attachments in scanning. ??? thanks - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, October 12, 2001 8:30 AM Subject: RE: [Declude.Virus] McAfee NetShield Upgrade In the declude.cfg look for; SCANNERTIMEOUT 60 I think 60 is the default so if you increase this your scanner is allowed more time to scan big files and thus eliminate your problem. Actually, his problem is with the scanner itself, when it is not being used with Declude. The SCANNERTIMEOUT actually should never need to be changed. A virus scanner should be able to scan any attachments within a second or two at the most. The SCANNERTIMEOUT value is designed to be a fail-safe, in case the scanner never ends (which will happen if a GUI scanner is accidentally used, for example). In a case like that, the SCANNERTIMEOUT will (help) prevent the system from crashing after running out of resources. -Scott This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: MISSING_REVERSE_DNS:Re: [Declude.Virus] McAfee NetShieldUpgrade
forwarded email from aol (.eml files) have gotten through declude and f-prot. users are returning messages to our users that those emails have a virus. i need to include eml file attachments in scanning. Declude with F-Prot should catch those. When the E-mail is forwarded as an .eml file, Declude will decode the .eml file and any attachment(s) or non-text MIME segments within it. You may need to use the /DUMB switch in F-Prot to make sure that it scans all files regardless of the extension. What virus was it? You should also make sure that you are running v3.11 (or higher) of F-Prot, and the latest definitions -- there is a Magistr variant that can only be caught with v3.11 and higher. -Scott This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.Virus] McAfee NetShield Upgrade
thanks just tried sdat4100.exe and 4100xdat.exe that came with the CD, they both said I have the latest engine and dat files the about netshield has: Netshield for windows NT and W 2000 4.5 Virus def 4.0.4165 Scan engine 4.0.70 What is going on ? how can I get the new engines ? I just got my CD last week ? - Original Message - From: Jerry Murdock [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 11, 2001 8:23 PM Subject: Re: [Declude.Virus] McAfee NetShield Upgrade 1: 4.0.70 must be 2-3 years old now. Run SDAT ASAP, the scanner isn't worthless, but there are plenty of things that require the newer engines. 2: I don't like ME much. Haven't used it recently enough to help you. I've moved almost all clients with a corporate desktop solution to Trend Officescan. 3: See #2 Jerry - Original Message - From: Serge Dergham [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 11, 2001 3:22 PM Subject: Re: [Declude.Virus] McAfee NetShield Upgrade Hi jerry, few questions if you have the time: 1- I keep getting this type of alert from netshield: The scan of F:\pcany\pcanywhere\Full.Cab\F1477_Aw32ban.dll has taken too long to complete and is being canceled. Scan engine version used is 4.0.70 DAT version 4.0.4164. How can avoid this, is there a timeout or a time limit I can change ? 2- I am playing with ME (management edition), I downloaded and saved latest DAT with netshield, and used it to updated other machienes with netshield, but could not use it on machines with Viruscan, it gives a message that it could not get update.ini any idea what to do ? 3- can/should we use sdat with ME ? TIA - Original Message - From: Jerry Murdock [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 11, 2001 7:10 PM Subject: Re: [Declude.Virus] McAfee NetShield Upgrade Yes. - Original Message - From: Charles Stanley [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 11, 2001 3:06 PM Subject: Re: [Declude.Virus] McAfee NetShield Upgrade At 12:03 PM 10/11/01, you wrote: If you just mean the engine, download and run the latest SDAT.exe. This will update the engine for the server version of Netshield? This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.Virus] McAfee NetShield Upgrade
ftp://ftp.nai.com/pub/antivirus/superdat/intel/sdat4164.exe -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Serge Dergham Sent: Thursday, October 11, 2001 4:57 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] McAfee NetShield Upgrade thanks just tried sdat4100.exe and 4100xdat.exe that came with the CD, they both said I have the latest engine and dat files the about netshield has: Netshield for windows NT and W 2000 4.5 Virus def 4.0.4165 Scan engine 4.0.70 What is going on ? how can I get the new engines ? I just got my CD last week ? - Original Message - From: Jerry Murdock [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 11, 2001 8:23 PM Subject: Re: [Declude.Virus] McAfee NetShield Upgrade 1: 4.0.70 must be 2-3 years old now. Run SDAT ASAP, the scanner isn't worthless, but there are plenty of things that require the newer engines. 2: I don't like ME much. Haven't used it recently enough to help you. I've moved almost all clients with a corporate desktop solution to Trend Officescan. 3: See #2 Jerry - Original Message - From: Serge Dergham [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 11, 2001 3:22 PM Subject: Re: [Declude.Virus] McAfee NetShield Upgrade Hi jerry, few questions if you have the time: 1- I keep getting this type of alert from netshield: The scan of F:\pcany\pcanywhere\Full.Cab\F1477_Aw32ban.dll has taken too long to complete and is being canceled. Scan engine version used is 4.0.70 DAT version 4.0.4164. How can avoid this, is there a timeout or a time limit I can change ? 2- I am playing with ME (management edition), I downloaded and saved latest DAT with netshield, and used it to updated other machienes with netshield, but could not use it on machines with Viruscan, it gives a message that it could not get update.ini any idea what to do ? 3- can/should we use sdat with ME ? TIA - Original Message - From: Jerry Murdock [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 11, 2001 7:10 PM Subject: Re: [Declude.Virus] McAfee NetShield Upgrade Yes. - Original Message - From: Charles Stanley [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 11, 2001 3:06 PM Subject: Re: [Declude.Virus] McAfee NetShield Upgrade At 12:03 PM 10/11/01, you wrote: If you just mean the engine, download and run the latest SDAT.exe. This will update the engine for the server version of Netshield? This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.Virus] McAfee NetShield Upgrade
At 01:23 PM 10/11/01, you wrote: 1: 4.0.70 must be 2-3 years old now. Run SDAT ASAP, the scanner isn't worthless, but there are plenty of things that require the newer engines. Is there a URL available for the SDAT? I've been searching McAfee's site for way too long, no luck... This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.Virus] McAfee NetShield Upgrade
At 03:47 PM 10/11/01, you wrote: At 01:23 PM 10/11/01, you wrote: 1: 4.0.70 must be 2-3 years old now. Run SDAT ASAP, the scanner isn't worthless, but there are plenty of things that require the newer engines. Is there a URL available for the SDAT? I've been searching McAfee's site for way too long, no luck... Disregard please, ftp://ftp.nai.com/pub/antivirus/superdat/intel/sdat4164.exe is no longer valid, but ftp://ftp.nai.com/pub/antivirus/superdat/intel/ seems to contain the SDAT.
Re: [Declude.Virus] McAfee NetShield Upgrade
upgraded to engine 4.1.5, but still getting the timout alerts do you know what are these ? The scan of E:\McAfee\SecureCast\ESC_55SP2.zip\ESC_55SP2.EXE has taken too long to complete and is being canceled. Scan engine version used is 4.1.50 DAT version 4.0.4165 - Original Message - From: Jerry Murdock [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 11, 2001 10:04 PM Subject: Re: [Declude.Virus] McAfee NetShield Upgrade 4100 is over a year old. Get the latest 4165 from the mcafee site. Jerry - Original Message - From: Serge Dergham [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 11, 2001 4:57 PM Subject: Re: [Declude.Virus] McAfee NetShield Upgrade thanks just tried sdat4100.exe and 4100xdat.exe that came with the CD, they both said I have the latest engine and dat files the about netshield has: Netshield for windows NT and W 2000 4.5 Virus def 4.0.4165 Scan engine 4.0.70 What is going on ? how can I get the new engines ? I just got my CD last week ? - Original Message - From: Jerry Murdock [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 11, 2001 8:23 PM Subject: Re: [Declude.Virus] McAfee NetShield Upgrade 1: 4.0.70 must be 2-3 years old now. Run SDAT ASAP, the scanner isn't worthless, but there are plenty of things that require the newer engines. 2: I don't like ME much. Haven't used it recently enough to help you. I've moved almost all clients with a corporate desktop solution to Trend Officescan. 3: See #2 Jerry - Original Message - From: Serge Dergham [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 11, 2001 3:22 PM Subject: Re: [Declude.Virus] McAfee NetShield Upgrade Hi jerry, few questions if you have the time: 1- I keep getting this type of alert from netshield: The scan of F:\pcany\pcanywhere\Full.Cab\F1477_Aw32ban.dll has taken too long to complete and is being canceled. Scan engine version used is 4.0.70 DAT version 4.0.4164. How can avoid this, is there a timeout or a time limit I can change ? 2- I am playing with ME (management edition), I downloaded and saved latest DAT with netshield, and used it to updated other machienes with netshield, but could not use it on machines with Viruscan, it gives a message that it could not get update.ini any idea what to do ? 3- can/should we use sdat with ME ? TIA - Original Message - From: Jerry Murdock [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 11, 2001 7:10 PM Subject: Re: [Declude.Virus] McAfee NetShield Upgrade Yes. - Original Message - From: Charles Stanley [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 11, 2001 3:06 PM Subject: Re: [Declude.Virus] McAfee NetShield Upgrade At 12:03 PM 10/11/01, you wrote: If you just mean the engine, download and run the latest SDAT.exe. This will update the engine for the server version of Netshield? This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED
