RE: [Declude.Virus] url file extensions
You nor I nor Declude nor any one knows where that leads too. You can not scan the destination for a url. John T eServices For You "Seek, and ye shall find!" > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > On Behalf Of Nick Hayer > Sent: Tuesday, April 11, 2006 12:10 PM > To: Declude.Virus@declude.com > Subject: [Declude.Virus] url file extensions > > I been asked to remove the block I have on these - and since I have > forgotten why I am blocking them Is there a valid reason to block > these? > > Thanks in advance > > -Nick > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus".The archives can be found > at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] url file extensions
ClamAV can be configured to scan URLs, if so desired. Bill - Original Message - From: "John T (Lists)" <[EMAIL PROTECTED]> To: Sent: Tuesday, April 11, 2006 12:40 PM Subject: RE: [Declude.Virus] url file extensions You nor I nor Declude nor any one knows where that leads too. You can not scan the destination for a url. John T eServices For You "Seek, and ye shall find!" -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer Sent: Tuesday, April 11, 2006 12:10 PM To: Declude.Virus@declude.com Subject: [Declude.Virus] url file extensions I been asked to remove the block I have on these - and since I have forgotten why I am blocking them Is there a valid reason to block these? Thanks in advance -Nick --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] url file extensions
Hi John, I was referring to file attachments that had a .url extension - I have that extension banned in my virus.cfg and wondered why - -Nick John T (Lists) wrote: You nor I nor Declude nor any one knows where that leads too. You can not scan the destination for a url. John T eServices For You "Seek, and ye shall find!" -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Nick Hayer Sent: Tuesday, April 11, 2006 12:10 PM To: Declude.Virus@declude.com Subject: [Declude.Virus] url file extensions I been asked to remove the block I have on these - and since I have forgotten why I am blocking them Is there a valid reason to block these? Thanks in advance -Nick --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] url file extensions
Yep, exactly what I meant. I ban them as there is no way to scan them (Although Bill says ClamAV can do it) to know what they are going to lead to. John T eServices For You "Seek, and ye shall find!" -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer Sent: Tuesday, April 11, 2006 1:09 PM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] url file extensions Hi John, I was referring to file attachments that had a .url extension - I have that extension banned in my virus.cfg and wondered why - -Nick John T (Lists) wrote: You nor I nor Declude nor any one knows where that leads too. You can notscan the destination for a url. John TeServices For You "Seek, and ye shall find!" -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Nick HayerSent: Tuesday, April 11, 2006 12:10 PMTo: Declude.Virus@declude.comSubject: [Declude.Virus] url file extensions I been asked to remove the block I have on these - and since I haveforgotten why I am blocking them Is there a valid reason to blockthese? Thanks in advance -Nick---This E-mail came from the Declude.Virus mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.Virus". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.Virus mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.Virus". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.Virus] url file extensions
Bill, Will you kindly elaborate? :) I see in clamd.conf the "MailFollowURLs" but the advice is not to use it - -Nick Bill Landry wrote: ClamAV can be configured to scan URLs, if so desired. Bill - Original Message - From: "John T (Lists)" <[EMAIL PROTECTED]> To: Sent: Tuesday, April 11, 2006 12:40 PM Subject: RE: [Declude.Virus] url file extensions You nor I nor Declude nor any one knows where that leads too. You can not scan the destination for a url. John T eServices For You "Seek, and ye shall find!" -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer Sent: Tuesday, April 11, 2006 12:10 PM To: Declude.Virus@declude.com Subject: [Declude.Virus] url file extensions I been asked to remove the block I have on these - and since I have forgotten why I am blocking them Is there a valid reason to block these? Thanks in advance -Nick --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] url file extensions
Thanks! -Nick John T (Lists) wrote: Yep, exactly what I meant. I ban them as there is no way to scan them (Although Bill says ClamAV can do it) to know what they are going to lead to. John T eServices For You "Seek, and ye shall find!" -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Nick Hayer Sent: Tuesday, April 11, 2006 1:09 PM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] url file extensions Hi John, I was referring to file attachments that had a .url extension - I have that extension banned in my virus.cfg and wondered why - -Nick John T (Lists) wrote: You nor I nor Declude nor any one knows where that leads too. You can not scan the destination for a url. John T eServices For You "Seek, and ye shall find!" -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Nick Hayer Sent: Tuesday, April 11, 2006 12:10 PM To: Declude.Virus@declude.com Subject: [Declude.Virus] url file extensions I been asked to remove the block I have on these - and since I have forgotten why I am blocking them Is there a valid reason to block these? Thanks in advance -Nick --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] url file extensions
Nick, it's advised not to use it because it take additional time to process e-mails with embedded or attached URLs, since it has to simulate a user and access the URL in order to scan it. If you already have a heavily utilized system, then you would be wise not to enable this feature. However, if you have available resources, you should be fine. Also, at least on Linux, you need to have curl installed and compile with libcurl support: Optional Packages: --with-PACKAGE[=ARG]use PACKAGE [ARG=yes] --with-libcurl support URLs downloading with libcurl (default=no) However, I don't know if this is the case with the Windows version of ClamAV, since I have never actually run it on Windows. We have been running with this feature enabled on our two Linux gateways for about a year now and thus far have had no problems with it. Bill - Original Message - From: "Nick Hayer" <[EMAIL PROTECTED]> To: Sent: Tuesday, April 11, 2006 1:30 PM Subject: Re: [Declude.Virus] url file extensions Bill, Will you kindly elaborate? :) I see in clamd.conf the "MailFollowURLs" but the advice is not to use it - -Nick Bill Landry wrote: ClamAV can be configured to scan URLs, if so desired. Bill - Original Message - From: "John T (Lists)" <[EMAIL PROTECTED]> To: Sent: Tuesday, April 11, 2006 12:40 PM Subject: RE: [Declude.Virus] url file extensions You nor I nor Declude nor any one knows where that leads too. You can not scan the destination for a url. John T eServices For You "Seek, and ye shall find!" -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer Sent: Tuesday, April 11, 2006 12:10 PM To: Declude.Virus@declude.com Subject: [Declude.Virus] url file extensions I been asked to remove the block I have on these - and since I have forgotten why I am blocking them Is there a valid reason to block these? Thanks in advance -Nick --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] url file extensions
I originally had them banned, but then I got tired of reproecessing the legit email that had the attachments, so they are allowed in here. - Original Message - From: "Nick Hayer" <[EMAIL PROTECTED]> To: Sent: Tuesday, April 11, 2006 2:09 PM Subject: [Declude.Virus] url file extensions I been asked to remove the block I have on these - and since I have forgotten why I am blocking them Is there a valid reason to block these? Thanks in advance -Nick --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] url file extensions
I enabled it on one of the windows clamav boxes. I'll see what happens. Thanks -Nick Bill Landry wrote: Nick, it's advised not to use it because it take additional time to process e-mails with embedded or attached URLs, since it has to simulate a user and access the URL in order to scan it. If you already have a heavily utilized system, then you would be wise not to enable this feature. However, if you have available resources, you should be fine. Also, at least on Linux, you need to have curl installed and compile with libcurl support: Optional Packages: --with-PACKAGE[=ARG]use PACKAGE [ARG=yes] --with-libcurl support URLs downloading with libcurl (default=no) However, I don't know if this is the case with the Windows version of ClamAV, since I have never actually run it on Windows. We have been running with this feature enabled on our two Linux gateways for about a year now and thus far have had no problems with it. Bill - Original Message - From: "Nick Hayer" <[EMAIL PROTECTED]> To: Sent: Tuesday, April 11, 2006 1:30 PM Subject: Re: [Declude.Virus] url file extensions Bill, Will you kindly elaborate? :) I see in clamd.conf the "MailFollowURLs" but the advice is not to use it - -Nick Bill Landry wrote: ClamAV can be configured to scan URLs, if so desired. Bill - Original Message - From: "John T (Lists)" <[EMAIL PROTECTED]> To: Sent: Tuesday, April 11, 2006 12:40 PM Subject: RE: [Declude.Virus] url file extensions You nor I nor Declude nor any one knows where that leads too. You can not scan the destination for a url. John T eServices For You "Seek, and ye shall find!" -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer Sent: Tuesday, April 11, 2006 12:10 PM To: Declude.Virus@declude.com Subject: [Declude.Virus] url file extensions I been asked to remove the block I have on these - and since I have forgotten why I am blocking them Is there a valid reason to block these? Thanks in advance -Nick --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
