Rick: It seems like you want to skip mailing the email if the sender is forged. With the latest release you can do the following. This is our sender.eml file. Using skipifforging you don't have to keep tarck of the forging viruses.
Regards, kami =============== SKIPIFFORGING From: [EMAIL PROTECTED] To: %MAILFROM% Subject: WARNING: YOU MAY HAVE A VIRUS Time: %TIME% The Declude Virus software on %LOCALHOST% has reported that you sent an E-mail to: Recipients: %ALLRECIPS%, containing the %VIRUSNAME% virus in the %VIRUSFILE% attachment. The subject of the E-mail was "%SUBJECT%". The E-mail containing the virus has been deleted & not delivered to prevent further damage. Headers Follow: %HEADERS% ================= -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Thursday, February 05, 2004 5:25 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] 20 FORGINGVIRUS line limit in 1.75 and earlier releases Slightly off-topic, but since Scott just help me out with a related issue I thought I would pass it on to save some the same headache... Older versions of Declude (1.75 release has this problem...not sure which interim release fixed it) will stop functioning if you put more than 20 FORGINGVIRUS lines in the virus.cfg. So if you get the urge to do some tune-up and add all of these lines, make sure you're on the latest interim where this limit has been removed...or limit to 20 lines. Darin. ----- Original Message ----- From: "Rick Klinge" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, February 05, 2004 5:09 PM Subject: RE: [Declude.Virus] Kudos on saving me from myself Posting to my post.. Sorry.. Something like this or is mine wrong? Ommitt the dashes "-----" ~Rick ---------------------------------- SKIPIFVIRUSNAMEHAS Braid SKIPIFVIRUSNAMEHAS Bridex SKIPIFVIRUSNAMEHAS Bugbear SKIPIFVIRUSNAMEHAS Dumar SKIPIFVIRUSNAMEHAS Fizzer SKIPIFVIRUSNAMEHAS Ganda SKIPIFVIRUSNAMEHAS Holar SKIPIFVIRUSNAMEHAS Hybris SKIPIFVIRUSNAMEHAS Klez SKIPIFVIRUSNAMEHAS Lentin SKIPIFVIRUSNAMEHAS Magistr SKIPIFVIRUSNAMEHAS Mimail SKIPIFVIRUSNAMEHAS Mydoom SKIPIFVIRUSNAMEHAS Palyh SKIPIFVIRUSNAMEHAS Sober SKIPIFVIRUSNAMEHAS Sobig SKIPIFVIRUSNAMEHAS Torvil SKIPIFVIRUSNAMEHAS Trojan SKIPIFVIRUSNAMEHAS Unknown SKIPIFVIRUSNAMEHAS Vulnerability SKIPIFVIRUSNAMEHAS Yaha SKIPIFSENDER @boss.com From: [EMAIL PROTECTED] To: %MAILFROM% Subject: WARNING: YOU MAY HAVE A VIRUS The Anti Virus software on %LOCALHOST% has reported that you sent an E-mail to %ALLRECIPS%, containing the %VIRUSNAME% virus in the %VIRUSFILE% attachment. The subject of the E-mail was "%SUBJECT%". The E-mail containing the virus has been quarantined to prevent further damage. There are many freely available Anti-Virus Software programs. Please navigate to ( http://www.pandasecurity.com ) to obtain free software tools to help you remove viruses on your computer. [EMAIL PROTECTED] Headers Follow: %HEADERS% -------------------------------------------- > Umm.. Don't you need to delete the blank line(s), within your > *.eml files, right after your SKIPIFVIRUSNAMESHAS .. ?? > > ~Rick > > > > > I recently added a couple of new SKIPIFVIRUSNAMEHAS entries > > to my .eml files. Then I noticed that I was no longer > > receiving any notifications at all. Upon reviewing the > log, I found: > > > > 02/05/2004 08:29:59 Q4557000602c0a66d ERROR: No recipients in > > D:\IMail\Declude\POSTMASTER.eml (is there a To: line before > > the first blank > > line?) > > 02/05/2004 08:29:59 Q4557000602c0a66d ERROR: No recipients in > > D:\IMail\Declude\RECIP.eml (is there a To: line before the > first blank > > line?) > > 02/05/2004 08:29:59 Q4557000602c0a66d ERROR: No recipients in > > D:\IMail\Declude\SENDER.eml (is there a To: line before the > > first blank > > line?) > > > > Thanks Scott for the extra touches like this that help make > > our lives easier, in spite of our best efforts ;-) > > > ___________________________________________________________________ Virus Scanned and Filtered by http://www.FamHost.com E-Mail System. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. _____________________________________ [This E-mail virus scanned by 4C Web] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
