DEBUG logs for this would be extremely helpful David
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Tuesday, October 31, 2006 3:23 PM To: declude.virus@declude.com Subject: Re: [Declude.Virus] Hijack Question -David Since it is out there, I also have seen rare D* messages without Q* file stranded in the work folder also. For me about 2 a month. They tend to be spam (of course so does 80% of all mail). If it is a legit message, I'll just forge up a corresponding Q* message and reprocess them. I'm running Declude 4.3.14 I'm quite confident that it isn't a real-time scanning problem here. I think the virus program would probable quarantine a D* file and leave the q* file. Instead the Q* file is gone, elaving the D* file. The next time I get one, I'll check the logs for that message for anything unusual. ----- Original Message ----- From: "David Barker" <[EMAIL PROTECTED]> To: <declude.virus@declude.com> Sent: Tuesday, October 31, 2006 1:52 PM Subject: RE: [Declude.Virus] Hijack Question > 1. Make sure that the Real-Time scanner of F-prot is disabled > > 2. At a minimum you should be running Declude 3.11 > > David > > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mario > Antonio > Sent: Tuesday, October 31, 2006 2:38 PM > To: declude.virus@declude.com > Subject: Re: [Declude.Virus] Hijack Question > > David, > > I am running f-prot 3.16f > Take a look at my configs > > SCANFILE C:\f-prot_windows\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 > /PACKED /NOBOOT /DUMB /REPORT=report.txt > VIRUSCODE 3 > VIRUSCODE 6 > VIRUSCODE 8 > REPORT Infection: > > > Any suggestions? > > > Regards > > Mario Antonio > > > ----- Original Message ----- > From: "David Barker" <[EMAIL PROTECTED]> > To: <declude.virus@declude.com> > Sent: Tuesday, October 31, 2006 1:58 PM > Subject: RE: [Declude.Virus] Hijack Question > > >> There should not be orphan files I would think you are running some type > of >> virus scanner that is removing the D*.smd files from the \work directory. >> >> David B >> www.declude.com >> >> -----Original Message----- >> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mario >> Antonio >> Sent: Tuesday, October 31, 2006 11:50 AM >> To: declude.virus@declude.com >> Subject: Re: [Declude.Virus] Hijack Question >> >> David, >> >> One more question, >> >> I am seeing that some Q files remain in the spool\proc\work folder, is > this >> normal? >> why? >> Should I clean them manually? Where are the corresponding D files? >> >> Regards >> >> Mario Antonio >> >> >> >> ----- Original Message ----- >> From: "David Barker" <[EMAIL PROTECTED]> >> To: <declude.virus@declude.com> >> Sent: Tuesday, October 31, 2006 10:18 AM >> Subject: RE: [Declude.Virus] Hijack Question >> >> >> > Stop/Start the decludeproc will reset the hijack counter. >> > >> > David B >> > www.declude.com >> > >> > -----Original Message----- >> > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > Mario >> > Antonio >> > Sent: Tuesday, October 31, 2006 9:42 AM >> > To: declude.virus@declude.com >> > Subject: [Declude.Virus] Hijack Question >> > >> > Does anyone know if you have to restart the declude process after you > have >> > moved back files from the HOLD2 folder into the spool ---Declude >> > 3.0.5/Imail 8.22? >> > >> > In the Declude 2.X you had to close the foreground screen/console >> > (which >> > restarts Hijack) in order to clean all the IP addresses that have been >> > banned. >> > >> > >> > Regards >> > >> > Mario Antonio >> > >> > >> > >> > >> > >> > >> > >> > >> > >> > >> > >> > --- >> > This E-mail came from the Declude.Virus mailing list. To unsubscribe, >> just >> > send an E-mail to [EMAIL PROTECTED], and >> > type "unsubscribe Declude.Virus". The archives can be found >> > at http://www.mail-archive.com. >> > >> > >> > >> > --- >> > This E-mail came from the Declude.Virus mailing list. To >> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> > type "unsubscribe Declude.Virus". The archives can be found >> > at http://www.mail-archive.com. >> > >> > >> > >> > >> > >> >> >> >> >> >> >> >> --- >> This E-mail came from the Declude.Virus mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.Virus". The archives can be found >> at http://www.mail-archive.com. >> >> >> >> --- >> This E-mail came from the Declude.Virus mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.Virus". The archives can be found >> at http://www.mail-archive.com. >> >> >> >> >> > > > > > > > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
