[Declude.Virus] url file extensions

2006-04-11 Thread Nick Hayer
I been asked to remove the block I have on these - and since I have 
forgotten why I am blocking them Is there a valid reason to block 
these?


Thanks in advance

-Nick
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


RE: [Declude.Virus] url file extensions

2006-04-11 Thread John T \(Lists\)
You nor I nor Declude nor any one knows where that leads too. You can not
scan the destination for a url. 

John T
eServices For You

Seek, and ye shall find!

 -Original Message-
 From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]
 On Behalf Of Nick Hayer
 Sent: Tuesday, April 11, 2006 12:10 PM
 To: Declude.Virus@declude.com
 Subject: [Declude.Virus] url file extensions
 
 I been asked to remove the block I have on these - and since I have
 forgotten why I am blocking them Is there a valid reason to block
 these?
 
 Thanks in advance
 
 -Nick
 ---
 This E-mail came from the Declude.Virus mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.Virus.The archives can be found
 at http://www.mail-archive.com.

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] url file extensions

2006-04-11 Thread Bill Landry

ClamAV can be configured to scan URLs, if so desired.

Bill
- Original Message - 
From: John T (Lists) [EMAIL PROTECTED]

To: Declude.Virus@declude.com
Sent: Tuesday, April 11, 2006 12:40 PM
Subject: RE: [Declude.Virus] url file extensions



You nor I nor Declude nor any one knows where that leads too. You can not
scan the destination for a url. 


John T
eServices For You

Seek, and ye shall find!


-Original Message-
From: [EMAIL PROTECTED]

[mailto:[EMAIL PROTECTED]

On Behalf Of Nick Hayer
Sent: Tuesday, April 11, 2006 12:10 PM
To: Declude.Virus@declude.com
Subject: [Declude.Virus] url file extensions

I been asked to remove the block I have on these - and since I have
forgotten why I am blocking them Is there a valid reason to block
these?

Thanks in advance

-Nick
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] url file extensions

2006-04-11 Thread Nick Hayer




Hi John,

I was referring to file attachments that had a .url extension - I have
that extension banned in my virus.cfg and wondered why - 

-Nick



John T (Lists) wrote:

  You nor I nor Declude nor any one knows where that leads too. You can not
scan the destination for a url. 

John T
eServices For You

"Seek, and ye shall find!"

  
  
-Original Message-
From: [EMAIL PROTECTED]

  
  [mailto:[EMAIL PROTECTED]]
  
  
On Behalf Of Nick Hayer
Sent: Tuesday, April 11, 2006 12:10 PM
To: Declude.Virus@declude.com
Subject: [Declude.Virus] url file extensions

I been asked to remove the block I have on these - and since I have
forgotten why I am blocking them Is there a valid reason to block
these?

Thanks in advance

-Nick
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

  
  
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.


  





RE: [Declude.Virus] url file extensions

2006-04-11 Thread John T \(Lists\)









Yep, exactly what I meant. I ban them as
there is no way to scan them (Although Bill says ClamAV can do it) to know what
they are going to lead to.





John T

eServices For You



Seek, and ye shall
find!







-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer
Sent: Tuesday, April 11, 2006 1:09 PM
To: Declude.Virus@declude.com
Subject: Re: [Declude.Virus] url
file extensions



Hi John,

I was referring to file attachments that had a .url extension - I have that
extension banned in my virus.cfg and wondered why - 

-Nick



John T (Lists) wrote: 

You nor I nor Declude nor any one knows where that leads too. You can notscan the destination for a url. John TeServices For YouSeek, and ye shall find! 

-Original Message-From: [EMAIL PROTECTED] 

[mailto:[EMAIL PROTECTED]] 

On Behalf Of Nick HayerSent: Tuesday, April 11, 2006 12:10 PMTo: Declude.Virus@declude.comSubject: [Declude.Virus] url file extensionsI been asked to remove the block I have on these - and since I haveforgotten why I am blocking them Is there a valid reason to blockthese?Thanks in advance-Nick---This E-mail came from the Declude.Virus mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype unsubscribe Declude.Virus. The archives can be foundat http://www.mail-archive.com. 

---This E-mail came from the Declude.Virus mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype unsubscribe Declude.Virus. The archives can be foundat http://www.mail-archive.com. 








Re: [Declude.Virus] url file extensions

2006-04-11 Thread Nick Hayer

Bill,

Will you kindly elaborate?  :)
I see in clamd.conf the MailFollowURLs but the advice is not to use it -
-Nick


Bill Landry wrote:


ClamAV can be configured to scan URLs, if so desired.

Bill
- Original Message - From: John T (Lists) 
[EMAIL PROTECTED]

To: Declude.Virus@declude.com
Sent: Tuesday, April 11, 2006 12:40 PM
Subject: RE: [Declude.Virus] url file extensions


You nor I nor Declude nor any one knows where that leads too. You can 
not

scan the destination for a url.
John T
eServices For You

Seek, and ye shall find!


-Original Message-
From: [EMAIL PROTECTED]


[mailto:[EMAIL PROTECTED]


On Behalf Of Nick Hayer
Sent: Tuesday, April 11, 2006 12:10 PM
To: Declude.Virus@declude.com
Subject: [Declude.Virus] url file extensions

I been asked to remove the block I have on these - and since I have
forgotten why I am blocking them Is there a valid reason to block
these?

Thanks in advance

-Nick
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] url file extensions

2006-04-11 Thread Nick Hayer




Thanks!

-Nick

John T (Lists) wrote:

  
  
  
  
  Yep,
exactly what I meant. I ban them as
there is no way to scan them (Although Bill says ClamAV can do it) to
know what
they are going to lead to.
  
  
  John T
  eServices
For You
  
  "Seek,
and ye shall
find!"
  
  
  
  -Original
Message-
  From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Nick Hayer
  Sent: Tuesday,
April 11, 2006 1:09
PM
  To:
Declude.Virus@declude.com
  Subject: Re:
[Declude.Virus] url
file extensions
  
  Hi John,
  
I was referring to file attachments that had a .url extension - I have
that
extension banned in my virus.cfg and wondered why - 
  
-Nick
  
  
  
John T (Lists) wrote: 
  You nor I nor Declude nor any one knows where that leads too. You can not
  scan the destination for a url. 
  
  John T
  eServices For You
  
  "Seek, and ye shall find!"
  
   
  
-Original Message-
From: [EMAIL PROTECTED]
 
  
  [mailto:[EMAIL PROTECTED]]
   
  
On Behalf Of Nick Hayer
Sent: Tuesday, April 11, 2006 12:10 PM
To: Declude.Virus@declude.com
Subject: [Declude.Virus] url file extensions

I been asked to remove the block I have on these - and since I have
forgotten why I am blocking them Is there a valid reason to block
these?

Thanks in advance

-Nick
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
 
  
  
  ---
  This E-mail came from the Declude.Virus mailing list. To
  unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
  type "unsubscribe Declude.Virus". The archives can be found
  at http://www.mail-archive.com.
  
  
   
  
  





Re: [Declude.Virus] url file extensions

2006-04-11 Thread Bill Landry
Nick, it's advised not to use it because it take additional time to process 
e-mails with embedded or attached URLs, since it has to simulate a user and 
access the URL in order to scan it.  If you already have a heavily utilized 
system, then you would be wise not to enable this feature.  However, if you 
have available resources, you should be fine.


Also, at least on Linux, you need to have curl installed and compile with 
libcurl support:


Optional Packages:
 --with-PACKAGE[=ARG]use PACKAGE [ARG=yes]
 --with-libcurl  support URLs downloading with libcurl (default=no)

However, I don't know if this is the case with the Windows version of 
ClamAV, since I have never actually run it on Windows.


We have been running with this feature enabled on our two Linux gateways for 
about a year now and thus far have had no problems with it.


Bill
- Original Message - 
From: Nick Hayer [EMAIL PROTECTED]

To: Declude.Virus@declude.com
Sent: Tuesday, April 11, 2006 1:30 PM
Subject: Re: [Declude.Virus] url file extensions



Bill,

Will you kindly elaborate?  :)
I see in clamd.conf the MailFollowURLs but the advice is not to use it -
-Nick


Bill Landry wrote:


ClamAV can be configured to scan URLs, if so desired.

Bill
- Original Message - From: John T (Lists) 
[EMAIL PROTECTED]

To: Declude.Virus@declude.com
Sent: Tuesday, April 11, 2006 12:40 PM
Subject: RE: [Declude.Virus] url file extensions


You nor I nor Declude nor any one knows where that leads too. You can 
not

scan the destination for a url.
John T
eServices For You

Seek, and ye shall find!


-Original Message-
From: [EMAIL PROTECTED]


[mailto:[EMAIL PROTECTED]


On Behalf Of Nick Hayer
Sent: Tuesday, April 11, 2006 12:10 PM
To: Declude.Virus@declude.com
Subject: [Declude.Virus] url file extensions

I been asked to remove the block I have on these - and since I have
forgotten why I am blocking them Is there a valid reason to block
these?

Thanks in advance

-Nick
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] url file extensions

2006-04-11 Thread Scott Fisher
I originally had them banned, but then I got tired of reproecessing the 
legit email that had the attachments, so they are allowed in here.



- Original Message - 
From: Nick Hayer [EMAIL PROTECTED]

To: Declude.Virus@declude.com
Sent: Tuesday, April 11, 2006 2:09 PM
Subject: [Declude.Virus] url file extensions


I been asked to remove the block I have on these - and since I have 
forgotten why I am blocking them Is there a valid reason to block 
these?


Thanks in advance

-Nick
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] url file extensions

2006-04-11 Thread Nick Hayer
I enabled it on one of the windows clamav boxes. I'll see what happens. 
Thanks

-Nick

Bill Landry wrote:

Nick, it's advised not to use it because it take additional time to 
process e-mails with embedded or attached URLs, since it has to 
simulate a user and access the URL in order to scan it.  If you 
already have a heavily utilized system, then you would be wise not to 
enable this feature.  However, if you have available resources, you 
should be fine.


Also, at least on Linux, you need to have curl installed and compile 
with libcurl support:


Optional Packages:
 --with-PACKAGE[=ARG]use PACKAGE [ARG=yes]
 --with-libcurl  support URLs downloading with libcurl 
(default=no)


However, I don't know if this is the case with the Windows version of 
ClamAV, since I have never actually run it on Windows.


We have been running with this feature enabled on our two Linux 
gateways for about a year now and thus far have had no problems with it.


Bill
- Original Message - From: Nick Hayer [EMAIL PROTECTED]
To: Declude.Virus@declude.com
Sent: Tuesday, April 11, 2006 1:30 PM
Subject: Re: [Declude.Virus] url file extensions



Bill,

Will you kindly elaborate?  :)
I see in clamd.conf the MailFollowURLs but the advice is not to use 
it -

-Nick


Bill Landry wrote:


ClamAV can be configured to scan URLs, if so desired.

Bill
- Original Message - From: John T (Lists) 
[EMAIL PROTECTED]

To: Declude.Virus@declude.com
Sent: Tuesday, April 11, 2006 12:40 PM
Subject: RE: [Declude.Virus] url file extensions


You nor I nor Declude nor any one knows where that leads too. You 
can not

scan the destination for a url.
John T
eServices For You

Seek, and ye shall find!


-Original Message-
From: [EMAIL PROTECTED]



[mailto:[EMAIL PROTECTED]


On Behalf Of Nick Hayer
Sent: Tuesday, April 11, 2006 12:10 PM
To: Declude.Virus@declude.com
Subject: [Declude.Virus] url file extensions

I been asked to remove the block I have on these - and since I have
forgotten why I am blocking them Is there a valid reason to block
these?

Thanks in advance

-Nick
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.