Re: [Declude.Virus] Help, New F-Prot not working!

2004-02-24 Thread Matt
make sure that you run the updater just to make sure that you have the latest and greatest. Error 5 according to F-Prot is "Program terminated with ^C or ESC." Matt David Dodell wrote: Just installed the new version of F-Prot c ... now my log is showing the following: 02/2

Re: [Declude.Virus] file extensions banned by domain

2004-02-26 Thread Matt
ng these lines, or along some other path would help him determine where he should focus his efforts.  I would prefer that he leave full MIME parsing for the 2.0 release :) Matt Gene Head wrote: Matt,   Do you have any ideas how I could improve on this?   I have sp

Re: [Declude.Virus] file extensions banned by domain

2004-02-26 Thread Matt
catch most, especially the legitimate ones. Matt Gene Head wrote: Scott, I came up with this filter to trigger on emails with attachments with a .zip extension. I created a file called ziptest and added it into the global.cfg file as a filter named zipper. Ziptest.txt # Zip test HEADERS

Re: [Declude.Virus] Bagle.F - password protected Zip files

2004-02-29 Thread Matt
me and/or the list. If you create a text file with just the base64 code in it and zip it up, it should be no harm to anyone and it will allow us to study it. Here's what Mcafee says about it. http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=101062 Thanks, Matt

Re: [Declude.Virus] Bagle.F - password protected Zip files

2004-02-29 Thread Matt
Qbc230b2500aa8d4f Deleting E-mail with virus! 02/29/2004 23:29:32 Qbc230b2500aa8d4f Scanned: CONTAINS A VIRUS [MIME: 2 23524] 02/29/2004 23:29:32 Qbc230b2500aa8d4f From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [outgoing from 151.198.155.141] 02/29/2004 23:29:32 Qbc230b2500aa8d4f Subject: Rena Matt

Re: [Declude.Virus] New interim Declude Virus Pro to block bogus .bat, .com, .pif, and .scr files

2004-03-02 Thread Matt
Scott, Can I have a million dollars??? :) R. Scott Perry wrote: We now have a new interim release 1.78i8 of Declude Virus Pro at http://www.declude.com/interim that will look for invalid .bat, .com, .pif, and .scr files, and will treat them as vulnerabilities. It is expected that this wil

Re: [Declude.Virus] Directories Not Being Removed With BANEZIPEXTS ON

2004-03-03 Thread Matt
EXE BANEZIPEXE BANNAME DELTETED0.TXT Matt -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Dec

Re: [Declude.Virus] New interim Declude Virus Pro to block bogus .bat, .com, .pif, and .scr files

2004-03-03 Thread Matt
clude isn't parsing this correctly from the config file??? I think it's worth a quick look. Matt R. Scott Perry wrote: I apologize for the flood of emails to you as I know your time is precious. However, I pulled the following that BANZIPEXTS and BANEZIPEXTS was added

Re: [Declude.Virus] New interim Declude Virus Pro to block bogus .bat, .com, .pif, and .scr files

2004-03-03 Thread Matt
Keith Johnson wrote: Matt, Is yours working with the TAB, I'll try anything? Yes, mine is working. It's a shot in the dark, but here's my Virus.cfg attached as a text file with the only modification being that my CODE was removed. You will definitely want to customize the

Re: [Declude.Virus] Performance Issues

2004-03-03 Thread Matt
of us administrators plus it stops needless notifications to and from forged addresses. Matt Gene Head wrote: Mitch, You can modify the notification emails to skipp virus' that are known to forge the senders address. In the Declude subdirectory you will find files with a .eml extension.

Re: [Declude.Virus] Doh! SpamCop Report

2004-03-04 Thread Matt
this is justified IMO, though I would prefer better categorization of such things in SpamCop. Matt Paul Navarre wrote: I just got a SpamCop report about one of my mail servers. Upon looking at the report, it appears that they are complaining about a "Undeliverable Mail" message. It

Re: [Declude.Virus] (OT) Second Scanner

2004-03-04 Thread Matt
in the archives.  Unless you monitor this group regularly, it is good practice to search the archives before posting a new question.  Understandably, the search function in the archives kind of sucks. Matt bill.maillists wrote: Scott, Can you shed some light on this? Thanks, Bill --

[Declude.Virus] 32-bit avgscan.exe does now work.

2004-03-04 Thread Matt
     identified If others can agree on the best switches, this should probably be added to the Declude Virus manual. Matt Matt wrote: The 32-bit version of AVG won't work because it doesn't return result codes which Declude needs to take action.  I E-mailed them about a month

Re: [Declude.Virus] 32-bit avgscan.exe does now work.

2004-03-04 Thread Matt
I'd say that this is definitely a lot faster to process at least, and I no longer am seeing NTVDM in Task Manager, typically achieving over 10% of my processing per call, no sign of avgscan.exe showing up at all.  Check out the time stamps: - 16-bit AVG as Scanner 2 - 03/04/2004 06:38:

Re: [Declude.Virus] Network Associates Products Will Soon Detect Bagle Variants with Encrypted Zip Attachments

2004-03-04 Thread Matt
product like Sniffer. Note that not everyone uses both products on the same machine, or even in that order, so this isn't a universal implementation, and I'm not asking for it to happen either. Matt CompuLogics.Net Admin wrote: Just an FYI Update for Declude Virus users that are

Re: [Declude.Virus] Bagle.J / news.com article on AV software opening zipped files.

2004-03-05 Thread Matt
character difference between normal zips and password protected ones. Matt R. Scott Perry wrote: That is exactly why I suggested scanning for file types instead of extension. I think Scott mentioned that they need to include full MIME decoding before something like that would be possible

[Declude.Virus] Swen not tagged as forging?

2004-03-07 Thread Matt
/07/2004 17:37:53 Qa43c661500982fd2 Scanned: CONTAINS A VIRUS [Prescan OK][MIME: 2 106748] 03/07/2004 17:37:53 Qa43c661500982fd2 From: ariearazi@example.com.mx To: [EMAIL PROTECTED] [outgoing from 148.233.93.6] 03/07/2004 17:37:53 Qa43c661500982fd2 S

Re: [Declude.Virus] NAV 2003 catches beagleJ in encrypted zip?

2004-03-07 Thread Matt
at can be tracked in combination for a positive hit.  I would imagine that not all such viruses will have highly reliable patterns, though most will. Matt marc catuogno wrote: If you want I can send it to you, it isn't important but I found it curious. All I know is it is a virus, it i

CBL:Re: [Declude.Virus] Swen not tagged as forging?

2004-03-08 Thread Matt
tally disappear. Seems like SKIPIFFORGING was really intended to handle bounces to the sender and not to the receiver by the way it is being applied. Matt John Tolmachoff (Lists) wrote: SWEN is not known to be forging. Every one that I have seen came from the sender that was i

Re: [Declude.Virus] Swen not tagged as forging?

2004-03-08 Thread Matt
Just to clarify. Swen forges the From address, but not the Mail From address. I'm reevaluating my choice to only send recipient notices. I may just change to sender notifications only with SKIPIFFORGING. Matt R. Scott Perry wrote: Yes, Swen forges. FWIW, we haven't yet see

Re: [Declude.Virus] W32.Beagle.J@mm cannot be caught

2004-03-09 Thread Matt
Search the archives. There are about 300 posts on the subject from the last week. Matt terry ip wrote: Hi All, Desktop Norton caught but declude didn't. I'm using Declude 1.75 + F-prot 3.14a with the latest virus pattern. Anyone have the same problem as I'm? or any cure

[Declude.Virus] AVG config

2004-03-12 Thread Matt
in the dark a bit about this. Any thoughts? Matt -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declu

Re: [Declude.Virus] AVG config

2004-03-12 Thread Matt
paste a hit for NetSky.J to the list. Matt 03/12/2004 14:55:04.292 Q158a0c4c0272caa5 Declude Virus Pro Registered 03/12/2004 14:55:04.292 Q158a0c4c0272caa5 Starting locality check (sender=carcitydirect.com; nr=2 ca=off). 03/12/2004 14:55:04.292 Q158a0c4c0272caa5 CL Opening HKEY_LOCAL_MACHINE\so

Re: [Declude.Virus] Multiple scanners

2004-03-12 Thread Matt
ame IP address, 64.80.8.238. Matt R. Scott Perry wrote: When running multiple scanners it would sure be great if one of the scanners scores a hit the other scanners do not run. I have seen this mentioned before and wanted to just bring it up again... The rationale for using them all is so that

Re: [Declude.Virus] Multiple scanners

2004-03-12 Thread Matt
don't grep because I have this crutch, though it is not as powerful. Matt Nick wrote: On 12 Mar 2004 at 15:41, Matt wrote: FYI, yesterday in a single 13 1/2 minute period, F-Prot tagged 145 NetSky.L's and AVG tagged 105 NetSky.L's. Matt - How did you get

Re: [Declude.Virus] Accepting SPAM pads spammer's success stats

2004-03-12 Thread Matt
Remove the "nobody" alias and IMail will reject all invalid addresses during the SMTP envelope. Matt Rick Davidson wrote: As a long time anti-spam combatant and Declude user I am seeing something I am interpreting as another way spammers are exploiting us. The problem with this s

Re: [Declude.Virus] Accepting SPAM pads spammer's success stats

2004-03-12 Thread Matt
reatly.  Note that I don't currently use this application, though I am preparing to because of the need to not have a secondary MX accept every last piece of E-mail. Matt Rick Davidson wrote: I should have been more clear, I use gateways in from of Imail peer groups neither can use the nob

Re: [Declude.Virus] Banned extension tripped by Microsoft Outlook, Build 10.0.3416

2004-03-18 Thread Matt
Turns out it was, and this also makes sense. Outlook only munged the name and not the file. Here's the base64 code for the spacer image along with the link and JavaScript is used to generate arguments appended to the link: - Actual Attachment (GIF) - Content-Type: application/octet-st

Re: [Declude.Virus] Virus wars heat up: Bagle.Q can't be detected as a virus by mailserver virus scanners

2004-03-18 Thread Matt
I've only seen two of these so far, and according to McAfee, over 90% of the hosts have been shut down: http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=101108 -- Update March 18th 2004 06:45 PST -- The majority of the 590 IP addresses seen have been closed down. At the time

Re: [Declude.Virus] F-Prot 3.14 d&e Rel. Notes

2004-03-18 Thread Matt
ithin archives" Maybe this is an advance? Maybe it combines too many things under one result code and isn't useful since Declude already gives us some capabilities here? If anyone tests this stuff out, please share. Matt Adrian Titei wrote: I thought that these notes for the last 2 rel

Re: [Declude.Virus] How do we block the next Bagle?

2004-03-19 Thread Matt
I've found Declude JunkMail on my system tends to catch most all of the undetected variants that slip through in normal ZIP files early on. Matt Greg Little wrote: How will we block a virus like Bagle.Q that does not use an "auto run" vulnerability? There's still no attac

Re: [Declude.Virus] How do we block the next Bagle?

2004-03-19 Thread Matt
up on the issues and working around them as they appear. Matt Scott Fisher wrote: Perhaps Pete from Sniffer could assign a new Message Sniffer Result Code just for these heuristics. We could then assign a hold based on this specific result code. Scott Fisher Director of IT Farm Progress

Re: [Declude.Virus] How do we block the next Bagle?

2004-03-22 Thread Matt
This didn't make it through the first time, so I am sending it along again without the content that probably tripped the filters. Matt Original Message Bill, IPLINKED is of course a custom filter and not a standard feature of Declude.  That filter would score poin

Re: [Declude.Virus] Netsky returns with auto-response

2004-03-24 Thread Matt
Virus log file snippet??? That helps. Have you viewed the source of the message? Could have been a zero byte file. I've seen a lot fo these with Netsky, though I thought they were all just empty zips. Matt Rodney Bertsch wrote: If this has been covered in the list please give

Re: [Declude.Virus] Netsky returns with auto-response

2004-03-24 Thread Matt
It looks like it didn't detect an attachment.  I think the standard procedure is to send the full source of the message to virustrap [at] declude [dot] com and ask Scott to take a look at it.  Sending to this list wouldn't be advised for obvious reasons. Matt Rodney Ber

Re: [Declude.Virus] [Partial Vulnerability]

2004-03-30 Thread Matt
ONLYSENDIF that advises the sender about how to turn this off in Outlook/Outlook Express, and possibly other mail clients if supported. I may also take that route. Matt Jeff Kratka wrote: Scott, What is the Partial Vulnerability that Declude Virus is picking up. I have a customer asking me w

Re: [Declude.Virus] declude junkmail vs iMail Anti Spam feature

2004-03-30 Thread Matt
per handling by IMail). Run don't walk :)  All IMO of course. Matt Johan Driesmans wrote: Hi,   We recently upgraded iMail from v7.07 to v8.05 We noticed that iMail also has an anti-spam feature.   We where planning a licence upgrade from declude anti-virus to junkmai

[Declude.Virus] Faster second scanner needed

2004-03-30 Thread Matt
stablish F-Prot's time as being the control. I'm primarily interested in Kaspersky, ClamAV and McAfee, in that order, though I'm welcome to suggestions for other products that don't prohibit command line scanning of E-mail in their licenses. Anecodotal e

Re: [Declude.Virus] Faster second scanner needed

2004-03-30 Thread Matt
ptimal. Thanks, Matt Adrian Hauri wrote: AVG takes about 4 seconds to fire up the AV Engine and scan. I'm running the 16bit version 6 of AVG. I would recommend you to use McAfee. I use version 4.32 for more than a year now and it is as fast as F-Prot. Also it was the first and only AV

Re: [Declude.Virus] Using a BitDefender scanner

2004-03-31 Thread Matt
nd is generous enough to share what they have learned. Matt Brad Morgan wrote: The announcement of IMail 8.1 adds another anti-virus option using BitDefender and a quick scan of the Declude Virus Manual shows an entry for BitDefender. Does anyone have any experiences with BitDefender as a scann

[Declude.Virus] Scanner Efficiency Olympics

2004-03-31 Thread Matt
eed, efficiency, and reporting capabilities, there doesn't seem to be any good choices. The fact though that F-Prot spanks everyone suggests that even AVG and McAfee have a lot of room for improvement. Matt -- = MailPur

Re: [Declude.Virus] Scanner Efficiency Olympics

2004-04-01 Thread Matt
If yo ushow me how to set up your side of things, I'll show you how to keep the daemon running :) Matt Terry Fritts wrote: ClamAV...1.0 seconds...2.303%...100.000% Charles posted on this a while back. Run clamd and link to clamdscan.exe (rather

Re: [Declude.Virus] clamav

2004-04-01 Thread Matt
ing.  I suppose this could be done by having a before and an after definition instead of just a before. Terry, if you could explain the demime thing, that would be appreciated. Thanks, Matt Charles Frolick wrote: I never updated after I posted that. I need to find a way to start and che

Re: [Declude.Virus] clamav

2004-04-01 Thread Matt
ks to SKIPIFWEIGHT) despite the lower volume, and tests like file size can be used to defeat expensive tests that aren't likely to be of use in such E-mail by using handler scripts and the new TESTSFAILED filter element. Matt Terry Fritts wrote: Terry, if you could explain the demime

Re: [Declude.Virus] MAXATONCE Switch

2004-04-16 Thread Matt
Doug, I'm not sure about the NOMEM option, but I verified several months ago that while NOBOOT isn't listed, fpcmd.exe will scan the boot sectors unless you use that switch.  You should definitely use both of these switches. Matt Douglas Cohn wrote: First of all I am a pu

Re: [Declude.Virus] 1_1.exe binhex file and vir directiory left in spool

2004-04-22 Thread Matt
is unzipping whatever is being sent and then leaving the file behind. Declude of course is calling the file 1_1.exe.binhex and not just 1_1.exe like the actual file that is being left behind. Matt R. Scott Perry wrote: I've seen this twice now with the same exact circumstances so I t

Re: [Declude.Virus] RE Mass mailing maybe new virus

2004-05-11 Thread Matt
in the sig) called !YDIRECTED. Matt -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = Email Admin wrote: Hello Our Mail server recevie

Re: [Declude.Virus] RE Mass mailing maybe new virus

2004-05-11 Thread Matt
ually everything that slips through before definitions are updates, ends up getting caught by a good JunkMail config.  It can be very time consuming though, especially if you enjoy it too much :) Matt Douglas Cohn wrote: Thanks   I was thinking about adding the rule as well but also as

Re: [Declude.Virus] blocking auto reply messages

2004-05-06 Thread Matt
are of any NDR's that are getting through your setup, i.e. ones that don't contain the headers. Thanks, Matt System Administrator wrote: on 5/6/04 10:10 AM, Douglas Cohn wrote: Why are we looking for the beginning of an IP address? Our users were re

Re: [Declude.Virus] AVG appears to be slower

2004-04-29 Thread Matt
they have added "conservative" detection of encrypted zip files, and this capability might be the cause.  Maybe there are some new switches? Matt Butch Andrews wrote: After last nights update for AVG7, for the first time I was required to re-boot. Since then it appears that t

[Declude.Virus] FYI regarding AVG

2004-04-29 Thread Matt
Today I found that AVG had crashed on my server and it was causing the scanner to time out most of the time that Declude called it, leading to a buildup of vir directories.  The AVG interface was showing no components installed.  A reboot fixed that problem. I then ran a manual update and foun

Re: [Declude.Virus] OT Problems with emails to aol.com and earthlink.net addresses

2004-05-05 Thread Matt
I think you jumped one hop too low and grabbed his client IP.  His server IP is 12.17.162.191 and it checks out just fine and matches his A and MX records as well.  There are no problems there. Matt Ncl Admin wrote: No it isn't. Reverse DNS for 172.16.2.103 Generat

Re: [Declude.Virus] Passing a bogus zip.

2004-05-21 Thread Matt
Do you have a BANNAME entry for that one? Matt Markus Gufler wrote: I believe the spaces in the BANNAME was fixed in 179i6 and higher. I have successfully blocked "Deleted Attachment" I'm running 1.79i7 now and messages containing an attachment like &q

Re: [Declude.Virus] BANnotify.eml

2004-05-25 Thread Matt
f having them tell you to turn them off for their account, in which case they might not realize that a legitimate message was blocked. Maybe that all makes sense? Matt Goran Jovanovic wrote: Hi,   The documentation shows that the bannotify.eml file send mail back

Re: [Declude.Virus] .vbs 1 byte files

2004-05-27 Thread Matt
I've been seeing these for almost a week I believe.  They appear to be damaged versions of know viruses, delivered with MIME headers but no code. If you search the archives, you should be able to find lots of discussions about banned extensions. Matt Jim Matuska (by way of R. Scott

[Declude.Virus] Bounces to encrypted zips

2004-06-02 Thread Matt
f my total traffic from Joe-Job and AV NDR's without contributing to it with my own system. Thanks, Matt -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =

Re: [Declude.Virus] Bounces to encrypted zips

2004-06-02 Thread Matt
re from new undetected viruses during the first few hours of an outbreak and with Declude's new vulnerability detection, they should be much less common now. Matt Darin Cox wrote: Hi Matt,   Here's how we handled the issue.   Set postmaster and abuse aliase

Re: [Declude.Virus] What is "Partial Vulnerability" on a PDF

2004-06-03 Thread Matt
e arrested that German teenager :) Matt Goran Jovanovic wrote: Declude Virus and F-Prot reported X-Declude-Virus: Detected [Partial Vulnerability]. This is an e-mail that has been cut into 5 part and it has a PDF attached to it. --=_NextPart_000_0019_01C4494C.0AFFE0A0 Content-Type: applicati

Re: [Declude.Virus] Stranger...

2004-06-07 Thread Matt
mind that I am stabbing in the dark. Matt Serge wrote: Strange... hi all urgent help needed I have imail1 client window ("create mail message") pop up on my server with all kind of real and strange addresses in the TO: and CC: Fields. The windows remains ope

Re: [Declude.Virus] Stranger...

2004-06-07 Thread Matt
ly advised. Matt serge wrote: Strange... i know imail1 is a command line mailer but how do i find what i causing the imail 1 window to be open and filed with all these adresses ? see attached gif     - Original Message - From: Darin Cox To:

Re: [Declude.Virus] Serious Problem with attachments and AVG 7

2004-06-10 Thread Matt
I just verified that AVG has been throwing this error all day long on my server.  Errors were being delivered so I guess there was little harm so long as F-Prot was also working.  Has anyone contacted AVG yet about this? Thanks, Matt bill.maillists wrote: Same here. I've disable

Re: [Declude.Virus] Getting hammered by W32.Netsky.P@mm!enc

2004-06-12 Thread Matt
s of your version and your desire for specificity. Matt Jeff Maze wrote: Beginning using the banned extension option with Declude (see virus.cfg). Then any attachment with a .SCR or whatever is blocked at the server level and the user doesn't see it. This is the way I have our server confi

Re: [Declude.Virus] BSOD and IMail-Server reboot

2004-06-12 Thread Matt
Please let's move on from this discussion. Thanks, Matt -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for virus

Re: [Declude.Virus] Virus bypassing newer MX records

2004-06-15 Thread Matt
nlargement guy that sends many messages. Matt Andy Schmidt wrote: Message Other than the firewall/router - doesn't their SMTP server application (e.g., like IIS) have the ability to restrict inbound connections to certain IP ranges.   We had a similar issue with one of my relay

[Declude.Virus] Binhex reminants from virus scanning

2004-07-16 Thread Matt
t. I can provide log snippets as well as the contents of this vir directory if you need that also.  This is only a minor nuisance that I see about 5-10 times a month and nothing actually gets blocked that shouldn't, although I would imagine there is a possibility that it could be a potent

[Declude.Virus] Burnt by double failure today

2004-07-19 Thread Matt
formation on the daemon's Window's support and stability, please chime in. Matt -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail

Re: [Declude.Virus] Error 10 in AVG

2004-07-20 Thread Matt
file viruses, encrypted or otherwise.  They did however throw in a switch for detecting encrypted archives, but I haven't bothered to test that out because of the above. Systems running AVG alone are quite vulnerable. Matt Kami Razvan wrote: Hi;   For the past 2+ weeks I see AVG

Re: [Declude.Virus] Burnt by double failure today

2004-07-20 Thread Matt
users without a practical option. I can't claim perfection, but rule #1 is to deliver the good E-mail, rule #2 is to block the bad.  That will never change for me. Matt John Tolmachoff (Lists) wrote: Matt, even though F-Prot or AVG may not have been catching them (I use both) b

Re: [Declude.Virus] Bitdefender claims terror ties to virus

2004-07-21 Thread Matt
e plastic sheets and duct tape away for the time being :) Matt marc catuogno wrote: What do you guys think of this? http://antivirus.about.com/od/virusdescriptions/a/atakb.htm I've forwarded it to all my users, maybe they will take their computer security more seriously. Marc --- [This

Re: [Declude.Virus] BanNotify Problem

2004-07-22 Thread Matt
Goran, Are you running any other software or hardware that might be inspecting these messages? The EXE response doesn't seem very Declude'ish. Matt Goran Jovanovic wrote: I have Virus Pro latest interim release 179i8. I have BANEXT EXE and BANEXT EZIP in my config file. I do not h

Re: [Declude.Virus] Extra "the" in the log file

2004-07-23 Thread Matt
Goran, Change the REPORT line for your second scanner (McAfee) to the following: REPORT2Found the If you add a space following the word "the" it will also take care of the space. You can do the same for REPORT1 as well to get rid of the space. Matt Goran Jovanovic wrote

Re: [Declude.Virus] Extra "the" in the log file

2004-07-23 Thread Matt
Thanks for pointing that out.  I have yet to come across that issue after migrating to McAfee only a few days ago (because AVG doesn't want to recognize their problem after multiple E-mails, which is a departure from the past). Matt Andy Schmidt wrote: Hm, I recommend AGAINS

[Declude.Virus] AVG zip file problems/fix

2004-07-26 Thread Matt
AVG, or if that just simply isn't an option for the command line scanner anymore.  If you use this switch, it will break AVG in versions 2.51+ Matt -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =

Re: [Declude.Virus] AVG zip file problems/fix

2004-07-26 Thread Matt
They didn't provide a link to it.  I would imagine that you can access it through the same page that you access the registered full versions of their software, but that requires a serial number to access.  I didn't check so I'm not sure it's there. Matt Rober

Re: [Declude.Virus] Blocking the files in mydoom

2004-07-26 Thread Matt
other banned extensions, is the presumeably best work-around? If not that, then custom filters in Declude? I'm seeing a fair number of MyDoom.M (F-Prot)/MyDoom.N(McAfee), but no MyDoom.O that the scanners have picked up on. Am I missing something? Thanks, Matt R. Scott Perry wrote: Ma

Re: [Declude.Virus] F-Prot and Mydoom.O

2004-07-28 Thread Matt
Would you like for me to E-mail it to you? Matt John Tolmachoff (Lists) wrote: Well, that is the problem on that one server. Even running the manual update, which is using updater.exe, it is saying it is updated. I will probably do a restart on the server tonight and try

Re: FW: [Declude.Virus] can we block by attachment file name

2004-07-29 Thread Matt
. You can however see what types of files lie within such a file and depending on your version, you can either ban all of them, or just ban the ones that contain files with one of your banned extensions in it. Matt Venkateswarlu Swarna wrote: Hi Guys, Please through some light on this. -

[Declude.Virus] 'Space Gap' in StarOffice mailer?

2004-07-29 Thread Matt
s are creating regular issues that require attention, and I'm sure that I'm not nearly catching them all. Better granularity would be appreciated and is often requested, but I know better than to expect that tomorrow. Thanks, Matt -- ===

Re: [Declude.Virus] 'Space Gap' in StarOffice mailer?

2004-07-29 Thread Matt
d about turning this stuff off. Are file vulnerabilities tied to the same switch for vulnerability detection? Yes. That's very unfortunate. Please consider the ability to at least turn these off and on seperate from the other vulnerabil

Re: [Declude.Virus] 'Space Gap' in StarOffice mailer?

2004-07-29 Thread Matt
. Besides, there is no open source Mozilla 3.0. I'll send the full source in a follow-up off list. Barry will earn big points from me if he forces you to change the way Declude handles granularity in vulnerability checks :) Thanks, Matt R. Scott Perry wrote: I found a false positive block

Re: [Declude.Virus] Error in virus scanner AVG report.txt

2004-08-10 Thread Matt
't be protecting you from viruses in zip files, though this might not be a big deal if you have 2 scanners configured. Matt Marcel Sangers wrote: In my logfiles I find someting like: 08/10/2004 19:26:59 Q055786ca007cc13b Could not find report file D:\IMAIL\spool\D055786ca007cc13b.vir\report.txt.

Re: [Declude.Virus] JS/IFromot.A

2004-09-07 Thread Matt
at all JS/ viruses don't need notifications. Ok, back to hibernation for me :) Matt John Tolmachoff (Lists) wrote: I received one of those as well (from a different domain) and explained thanking for the information and to remember that it takes time to fully understand what a virus do

Re: [Declude.Virus] Microsoft GDI+ Security Update

2004-09-15 Thread Matt
nt to have to start scanning JPEG's and wasting a ton of additional resources to do so. Matt R. Scott Perry wrote: Unfortunately this is from Microsoft's main web page, just click on the "Critical Update" in the upper right corner of the page. I'm still trying to figure

[Declude.Virus] Forging candidate - JS/IFrame@exp

2004-09-17 Thread Matt
D] X-OriginalArrivalTime: 17 Sep 2004 20:51:11.0635 (UTC) FILETIME=[10876E30:01C49CF8] I can't find any descriptions for the exploit on the F-Prot site nor on Google.   Thanks, Matt -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =

Re: [Declude.Virus] F-Prot/GDI+ FYI

2004-09-24 Thread Matt
x27;s are one of the few worst-case scenarios. Fingers crossed, hoping that the high school kids are all busy with school for now. Matt R. Scott Perry wrote: > Without blocking all .JPG files, nothing. The problem is that there is a > lack of information on how to detect such .JPG's.

Re: [Declude.Virus] Paypal and "Outlook 'Blank Folding' Vulnerability"

2004-09-24 Thread Matt
generally smart enough to make my own decisions, or at least fully willing to take responsibility for them :) Matt John Tolmachoff (Lists) wrote: This looks like a clear explanation to me: 18.3 Outlook 'Blank Folding' Vulnerability: This vulnerability occurs when there is a line

Re: [Declude.Virus] Paypal and "Outlook 'Blank Folding' Vulnerability"

2004-09-24 Thread Matt
PG files, and intercepting such files for scanning prior to display in Internet Explorer could drive many machines into the ground in terms of performance.  Shame on Microsoft. Matt -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =

Re: [Declude.Virus] Fprot GDI Scanner lines.

2004-09-28 Thread Matt
es reality, but I would prefer to be a step ahead on something this obvious. Thanks, Matt marc wrote: installed 1.80 declude virus (restart imail smtp) and sending the infected JPEG jpegcompoc.zip (http://www.gulftech.org/?node=downloads) it was not automatically detect and goes trough, u

Re: [Declude.Virus] Fprot GDI Scanner lines.

2004-09-28 Thread Matt
hey typically don't handle the files directly from the Internet, and most of course aren't using Microsoft's code for this.  I do a lot of graphic design work and haven't found a non-MS app yet that had a vulnerable version of GDI on all of the machines that I own. Matt Sanford

Re: [Declude.Virus] GDI false Postive

2004-09-30 Thread Matt
ue to wait patiently since I don't expect miracles to happen overnight, but I would really, really appreciate it if you could raise the priority of when to allow us to turn these all off and on individually. Thanks, Matt -- = MailPure cus

Re: [Declude.Virus] BankFraud (phishing) e-mails

2004-10-06 Thread Matt
oduce something that Declude could be coded to support (provided that Scott is willing of course). Matt Bill Landry wrote: I just found that if you have "PRESCAN" set to on, you will not be able to catch these BankFraud/Phishing e-mails. However, if you set "PRESCAN" to "

Re: [Declude.Virus] Banned ZIP with .exe extension

2004-10-20 Thread Matt
some protections for zip files with malformed headers that might detect this exploit. Matt Tito Macapinlac wrote: Hi, Here is a bulletin re: new vulnerability regarding zip files. Maybe another good reason to ban zip files if your AV is vulnerable. http://www.idefense.com/application/poi

Re: [Declude.Virus] MyDoom.o's slipping through.

2004-10-21 Thread Matt
Chris, It's always helpful to share the actual lines of your log when asking a question such as this. That will clear up any possible misperceptions and allow one to focus on what happened. Matt Chris Patterson wrote: I have had two reports in the last 2 days about a virus coming through

Re: [Declude.Virus] MyDoom.o's slipping through.

2004-10-21 Thread Matt
e updating your definitions on an hourly basis and also think about adding a second scanner if things like this are going to cause problems for your clients and business. Matt Chris Patterson wrote: Log Files: 10/19/2004 12:58:45 Q47c21ade0114a44b MIME file: [EMAIL PROTECTED] [base64; Le

Re: [Declude.Virus] Scott, what is our future?

2004-10-25 Thread Matt
that even if I threw Ipswitch another $4,000, nothing would really change with them except for the damn price, and I really, really hate being taken advantage of. Maybe you are confident about your plans for the future, but not knowing them, how could I be. Thanks, Matt R. Scott Perry wrote: You

Re: [Declude.Virus] passworded zip file

2004-10-25 Thread Matt
make sure that these file types are in your BANEXT list.  This will allow through all other types of files within the encrypted zips, including the CSV file that your client wants to receive. Matt Peter Lowish wrote: Declude 1.81 virus standard   A client reguarly receives a

Re: [Declude.Virus] Scott, what is our future?

2004-10-25 Thread Matt
Sandy, So what do you do when the next IMail exploit pops up such as that LDAP exploit and you have no way to fix the bug?  Can a serious business even take the risk of this happening? No. I can't see myself on IMail for any more than a year from now. Matt Sanford Whiteman

Re: [Declude.Virus] Scott, what is our future?

2004-10-25 Thread Matt
his upgrade path is a screw if I've ever seen one, and they will never get another dime from me unless the management is forced out that made these choices.  Consider that to be a personal observation and preference, so the sky is definitely blue. Matt Matt Sanford Whiteman wrote:

Re: [Declude.Virus] Unknown virus warnings

2004-10-29 Thread Matt
Just a couple of thoughts...Maybe there is a limitation with strings that involve a space?  Alternatively, maybe there was no name reported by the scanner, and this was just simply the value that Declude logged. Matt Markus Gufler wrote: Now the F-prot update is arrived also here

Re: [Declude.Virus] strange sending problem to the same domain

2004-10-29 Thread Matt
ither has an MX or an A record.  Adding one of these will keep that test from failing. Matt Declude wrote: Hi John, this is the actual forwarding of one eMail of my customer. I guess I have to make a reverse DNS entry, don't you think ? Uwe Received: from lasthope [217.235.73.14] by irg

  1   2   3   4   >