Re: [Declude.Virus] MISSING_REVERSE_DNS:setting up DECLUDE
> Whoops, I didn't mean to send to the whole list! Sorry, I'm REALLY new at > this. Don't worry about it. We were all new at this at one point. Some of us just don't want to admit how long ago that was ;) Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications E-Commerce that makes sense! 360-457-9023 http://www.tenforward.com/webcam "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
RE: [Declude.Virus] MISSING_REVERSE_DNS:setting up DECLUDE
>Whoops, I didn't mean to send to the whole list! Sorry, I'm REALLY new at >this. Don't worry about it -- a lot of people join the list so that they can find out all the intricate details of Declude. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
Re: [Declude.Virus] MISSING_REVERSE_DNS:setting up DECLUDE
>If I send a message via the IMail web messaging way with an infected >attachment from my school account to an outside account it goes through - >declude doesn't catch it. IMail often uses an internal mechanism to deliver E-mail sent from web messaging, which can bypass Declude. Few viruses are spread that way, however, because spreading a virus through web messaging requires the user to intentionally attach a file that has a virus in it (it can't spread automatically using HTML, or using a mail client). All of the incoming E-mail received by web messaging will be scanned, making it unlikely that they will get a virus to spread. You can, however, use an on-access scanner to scan the \IMail\spool directory, so that any viruses that are uploaded via web messaging will be deleted. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
RE: [Declude.Virus] MISSING_REVERSE_DNS:setting up DECLUDE
Whoops, I didn't mean to send to the whole list! Sorry, I'm REALLY new at this. And I obviously need help! Thanks. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Nyla Wiebe Sent: Friday, December 07, 2001 5:12 PM To: [EMAIL PROTECTED] Subject: [Declude.Virus] MISSING_REVERSE_DNS:setting up DECLUDE Scott, I have Declude working except for one problem. If I send a message via the IMail web messaging way with an infected attachment from my school account to an outside account it goes through - declude doesn't catch it. I have several email identities so I have been sending email's back and forth trying to see what happens. If I send an email with virus attachment from another account to my school account declude catches it. Is that enough information for you to give me a hint about some setting I obviously have incorrect?? Declude is not catching infected attachments that go out using IMail web messaging. Attached is the virus.cfg file if that is useful. Nyla --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
[Declude.Virus] MISSING_REVERSE_DNS:setting up DECLUDE
Scott, I have Declude working except for one problem. If I send a message via the IMail web messaging way with an infected attachment from my school account to an outside account it goes through - declude doesn't catch it. I have several email identities so I have been sending email's back and forth trying to see what happens. If I send an email with virus attachment from another account to my school account declude catches it. Is that enough information for you to give me a hint about some setting I obviously have incorrect?? Declude is not catching infected attachments that go out using IMail web messaging. Attached is the virus.cfg file if that is useful. Nyla VIRUS.CFG Description: Binary data
Re: [Declude.Virus] Header.PHP broken?
>http://www.declude.com/tools/header.php?code=c0400202 claims: >Code: c0400202. The E-mail (code c0400202) didn't fail either the BADHEADERS >or SPAMHEADERS tests. Thanks for pointing that out. The script was apparently only working if the "C" was capitalized. It is fixed now. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
RE: [Declude.Virus] BANEXT maybe not working?
OK. I didn't understand the order. It is good this way. I too like the fact that it serves as a failsafe after the virus scan. Thanks! Dan > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of Andy Schmidt > Sent: Friday, December 07, 2001 12:02 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.Virus] BANEXT maybe not working? > > > >> the virus scanning takes priority over the banning. That is, > the E-mail > will be scanned for viruses first, and only if the E-mail is > virus-free will > the file extension banning be done. << > > Thank you and PLEASE remember to keep it in that sequence. It takes > extra CPU time to first run the virus scan - but at least it will be > detected as a virus and helps advertising the fact that we > virus-scan. The > Extension ban should just be the "final straw" when the virus scanner > fails - just as you implemented it NOW. > > Best Regards > Andy Schmidt > > H&M Systems Software, Inc. > 600 East Crescent Avenue > Suite 203 > Upper Saddle River, NJ 07458-1846 > > Phone: +1 201 934-3414 x20 (Business) > Fax:+1 201 934-9206 > > http://www.hm-software.com/ > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
[Declude.Virus] Header.PHP broken?
http://www.declude.com/tools/header.php?code=c0400202 claims: Code: c0400202. The E-mail (code c0400202) didn't fail either the BADHEADERS or SPAMHEADERS tests. yet... here is what Declude 1.28 thinks: X-Declude-Note: SMTP headers violate RFCs; This E-mail was sent from a broken mail client [c0400202]. X-RBL-WARNING: Suspected SPAM; This E-mail has headers consistent with spam [c0400202]. Best Regards Andy Schmidt H&M Systems Software, Inc. 600 East Crescent Avenue Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.hm-software.com/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
Re: [Declude.Virus] Ban Notify
Thanks Andy. This is why I read all of these messages. I will change my BanNotify.eml to reflect the changes that Scott suggested. Mike - Original Message - From: "Andy Schmidt" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, December 07, 2001 12:09 PM Subject: RE: [Declude.Virus] Ban Notify > For the BANnotify that is true. But for a Virus Notify (same feature), the > FULLMSG could contain an HTML virus in the body of the message? > > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of Mike Watchman > Sent: Friday, December 07, 2001 02:03 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.Virus] Ban Notify > > > I was thinking that the FULLMSG only sent the body text not the attachment. > If it does send the full message you are right it would be a very bad idea > to send the message. > > Mike > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". You can E-mail > [EMAIL PROTECTED] for assistance. You can visit our web > site at http://www.declude.com . > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
RE: [Declude.Virus] Ban Notify
For the BANnotify that is true. But for a Virus Notify (same feature), the FULLMSG could contain an HTML virus in the body of the message? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Mike Watchman Sent: Friday, December 07, 2001 02:03 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Ban Notify I was thinking that the FULLMSG only sent the body text not the attachment. If it does send the full message you are right it would be a very bad idea to send the message. Mike --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
RE: [Declude.Virus] Ban Notify
>The REASON why FULLMSG was NOT included in Declude/Virus was, that you >usually do NOT want to forward a mail that YOU suspect contains a virus. FYI, it looks like we will not be adding the %FULLMSG% to Declude Virus for this very reason. Instead, we will change the default BANnotify.eml to use %HEADERS% (which will display the headers of the E-mail). We may add a "%TEXTPART%" or similar variable to allow only the text segment to be displayed. With the %FULLMSG% variable the way it works in Declude JunkMail, the ful body of the E-mail would be sent. The attachments likely wouldn't be accessible, but they would be visible as "garbage". So in any case, I think the new variable would be the best option. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
Re: [Declude.Virus] Ban Notify
I was thinking that the FULLMSG only sent the body text not the attachment. If it does send the full message you are right it would be a very bad idea to send the message. Mike - Original Message - From: "Andy Schmidt" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, December 07, 2001 11:52 AM Subject: RE: [Declude.Virus] Ban Notify > Mike, > > if I may point out one thing. > > The REASON why FULLMSG was NOT included in Declude/Virus was, that you > usually do NOT want to forward a mail that YOU suspect contains a virus. > Not even to the APPARENT sender. In fact, many vira are faking the sender - > so your notification may go to someone who is NOT yet infected - with the > virus ATTACHED. > > My Virus Notifications refer to the infected message by subject, sender and > recipient, AND I include the IMail Queue ID in case I EVER need to > investigate. > > But I would certainly NEVER want to include the full message. > > Best Regards > Andy Schmidt > > H&M Systems Software, Inc. > 600 East Crescent Avenue > Suite 203 > Upper Saddle River, NJ 07458-1846 > > Phone: +1 201 934-3414 x20 (Business) > Fax:+1 201 934-9206 > > http://www.hm-software.com/ > > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of Mike Watchman > Sent: Friday, December 07, 2001 01:43 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.Virus] Ban Notify > > > I updated the version to 1.29a and it still does not add the original > message I haven't modified the BanNotify email. What should I try next? > Thanks. > > Mike > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". You can E-mail > [EMAIL PROTECTED] for assistance. You can visit our web > site at http://www.declude.com . > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
RE: [Declude.Virus] BANEXT maybe not working?
>> the virus scanning takes priority over the banning. That is, the E-mail will be scanned for viruses first, and only if the E-mail is virus-free will the file extension banning be done. << Thank you and PLEASE remember to keep it in that sequence. It takes extra CPU time to first run the virus scan - but at least it will be detected as a virus and helps advertising the fact that we virus-scan. The Extension ban should just be the "final straw" when the virus scanner fails - just as you implemented it NOW. Best Regards Andy Schmidt H&M Systems Software, Inc. 600 East Crescent Avenue Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.hm-software.com/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
Re: MISSING_REVERSE_DNS:Re: [Declude.Virus] Declude v1.29 beta released
I personally have not had any trouble running the betas, I seem to remember one being recalled a while back though. Jim Matuska Jr. Nez Perce Tribe Computer Services [EMAIL PROTECTED] - Original Message - From: "John Carter" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, December 07, 2001 8:55 AM Subject: MISSING_REVERSE_DNS:Re: [Declude.Virus] Declude v1.29 beta released > Only once, in my memory, did Scott "recall" a beta release. I usually > go with them, especially if it includes a new feature I've been > wanting. And I am still waiting to upgrade to Imail 7.x, which I > purchased last summer on faith. Sorry, I had to say it. :-( > > John > > [EMAIL PROTECTED] wrote: > > > > How stable is a Declude beta? > > > > Can we run it on a production machine or should we wait for "production" > > code. > > > > (We're scared of new production code from most vendors (iMail)) > > > > [EMAIL PROTECTED] > > > > --- > > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > > > This E-mail came from the Declude.Virus mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus". You can E-mail > > [EMAIL PROTECTED] for assistance. You can visit our web > > site at http://www.declude.com . > > --- > > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". You can E-mail > [EMAIL PROTECTED] for assistance. You can visit our web > site at http://www.declude.com . > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
Re: MISSING_REVERSE_DNS:Re: [Declude.Virus] Declude v1.29 betareleased
>is the "ONLYSENDIFLOCALRECIPIENT" option now tested and operational ? or >still a work in progress ? It's operational in 1.29, but it hasn't been thoroughly tested yet. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
Re: [Declude.Virus] BANnotify.eml
>If the attachment has a banned extension and a virus, which email >notification will be sent? Thanks. Good question! In that case, the virus notifications will go out, and the ban notification will not go out. For example, if you have "BANEXT com", and send the eicar.com file, the virus notifications will be sent as usual, but the ban notification will not be sent. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
MISSING_REVERSE_DNS:Re: [Declude.Virus] Declude v1.29 beta released
Only once, in my memory, did Scott "recall" a beta release. I usually go with them, especially if it includes a new feature I've been wanting. And I am still waiting to upgrade to Imail 7.x, which I purchased last summer on faith. Sorry, I had to say it. :-( John [EMAIL PROTECTED] wrote: > > How stable is a Declude beta? > > Can we run it on a production machine or should we wait for "production" > code. > > (We're scared of new production code from most vendors (iMail)) > > [EMAIL PROTECTED] > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". You can E-mail > [EMAIL PROTECTED] for assistance. You can visit our web > site at http://www.declude.com . > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
RE: [Declude.Virus] Declude v1.29 beta released
I always try it but then I'm not a ISP and have a low volume IMail server. Chris At 10:42 AM 12/7/01 -0600, you wrote: >How stable is a Declude beta? > >Can we run it on a production machine or should we wait for "production" >code. > >(We're scared of new production code from most vendors (iMail)) --- [This E-mail scanned for viruses by Declude/F-Prot Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
RE: [Declude.Virus] Declude v1.29 beta released
How stable is a Declude beta? Can we run it on a production machine or should we wait for "production" code. (We're scared of new production code from most vendors (iMail)) [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
[Declude.Virus] BANnotify.eml
If the attachment has a banned extension and a virus, which email notification will be sent? Thanks. Mike --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
[Declude.Virus] BANnotify.eml
If the attachment has a banned extension and a virus, which email notification will be sent? Thanks. Mike --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
RE: [Declude.Virus] Declude v1.29 beta released
I wish that all of the software we use (as a web site hosting company) was support like Declude. I would have a lot more hair - and a lot more days off :) [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
MISSING_REVERSE_DNS:Re: [Declude.Virus] Declude v1.29 beta released
hi, is the "ONLYSENDIFLOCALRECIPIENT" option now tested and operational ? or still a work in progress ? thanks - Original Message - From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, December 07, 2001 1:08 AM Subject: [Declude.Virus] Declude v1.29 beta released > We have just released Declude Virus v1.29. > > Notable new features include: > > o The ability to send a "bounce" message to people sending banned files > (BANEXT), > o A new DELETEVIRUSES configuration option to delete viruses rather than > quarantine them, > o A FOOTER option to add a footer to the bottom of scan E-mails > o TNEF support has been added > o A new BANCLSID option has been added to ban CLSID file extensions > > You can download the new beta from http://www.declude.com/virus/manual.htm . > -Scott > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". You can E-mail > [EMAIL PROTECTED] for assistance. You can visit our web > site at http://www.declude.com . > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
Re: [Declude.Virus] McAfee Virusscan command-line
Thanks, that little trick helped me out. Is there any chance I could have a peek a that update script of yours? My scripting are rather basic, I doubt it would take me less than a day to get it to work :P Joachim. >If you actually managed to find and install the command line only version of >Mcafee, it probably doesn't provide the registry hooks for SuperDat to know >where it's installed. Use sdat /E d:\McafeePath to extract the files to >your installation directory. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
Re: [Declude.Virus] Declude v1.29 beta released
Thanks for the clarification. About the only thing left on my wish list(if I hadn't rolled my own) would be an imail1 wrapper for WebMail. Jerry - Original Message - From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, December 06, 2001 10:03 PM Subject: Re: [Declude.Virus] Declude v1.29 beta released > > >Clarification please on DELETEVIRUSES. I assume it doesn't try to remove the > >attachment, but deletes the queue files. > > That's correct. It deletes the queue files, but does not attempt to remove > the attachment. >-Scott > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". You can E-mail > [EMAIL PROTECTED] for assistance. You can visit our web > site at http://www.declude.com . > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
RE: [Declude.Virus] Declude v1.29 beta released
>Regarding the footer option: > >We run multiple domains on our iMail server, and only scan certain domains >for viruses. > >Does the footer option add the footer to all emails that go through the >server or just the ones where we have virus scanning turned on for the >domain? It will be added to any E-mail that actually gets scanned. That means that it will not be added to the domains that have the scanning turned off. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
RE: [Declude.Virus] Declude v1.29 beta released
Regarding the footer option: We run multiple domains on our iMail server, and only scan certain domains for viruses. Does the footer option add the footer to all emails that go through the server or just the ones where we have virus scanning turned on for the domain? [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Thursday, December 06, 2001 7:09 PM To: [EMAIL PROTECTED] Subject: [Declude.Virus] Declude v1.29 beta released We have just released Declude Virus v1.29. Notable new features include: o The ability to send a "bounce" message to people sending banned files (BANEXT), o A new DELETEVIRUSES configuration option to delete viruses rather than quarantine them, o A FOOTER option to add a footer to the bottom of scan E-mails o TNEF support has been added o A new BANCLSID option has been added to ban CLSID file extensions You can download the new beta from http://www.declude.com/virus/manual.htm . -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
RE: [Declude.Virus] DSN:Signatures
For those that did not understand, the items in question are digital signatures, not the "signature" at the bottom of a message. John Tolmachoff, Network Engineer 211 E. Imperial Hwy., Suite 106 Fullerton, CA 92835 714-578-7999, ext. 104 [EMAIL PROTECTED] [EMAIL PROTECTED] www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Bill Landry Sent: Friday, December 07, 2001 7:32 AM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.Virus] DSN:Signatures Hmmm, this from someone that sent his signature to the list... --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
RE: [Declude.Virus] DSN:Signatures
Hmmm, this from someone that sent his signature to the list... -Original Message- From: John Tolmachoff [mailto:[EMAIL PROTECTED]] Sent: Friday, December 07, 2001 6:37 AM To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: [Declude.Virus] DSN:Signatures Importance: High To Andy and all others, please stop using signatures when sending to a list. As the list service adds to the body and changes the to and from, you signature becomes invalid and causes delays. John Tolmachoff, Network Engineer 211 E. Imperial Hwy., Suite 106 Fullerton, CA 92835 714-578-7999, ext. 104 [EMAIL PROTECTED] [EMAIL PROTECTED] www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
[Declude.Virus] DSN:Signatures
To Andy and all others, please stop using signatures when sending to a list. As the list service adds to the body and changes the to and from, you signature becomes invalid and causes delays. John Tolmachoff, Network Engineer 211 E. Imperial Hwy., Suite 106 Fullerton, CA 92835 714-578-7999, ext. 104 [EMAIL PROTECTED] [EMAIL PROTECTED] www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
RE: [Declude.Virus] MISSING_REVERSE_DNS:Imail/declude log parser...
If your vir.log files are in a different directory, then you will need
to change some paths. There are 2 sections that parse the declude log
files. The first counts the number of virus detections. Replace %spl% with
the path to your declude logfile path only in the sections below. My
comments are on lines that begin with :: and also have brackets [] around
them in the sections below and should not be in your final script. The /\
and \/ are just cheesey arrows pointing to the item to be changed. If the
section below is viewed with a fixed width font, it will be less confusing.
..
::Virus detections:
Echo.Virus Detections: >> %log%%mm%%yd%usage.log
for /f "tokens=3" %%v IN ('%sys%find /C "Virus=" %spl%vir%mm%%yd%.log') DO
SET virs=%%v
::[replace /\ this %spl% with your
vir.log path]
Echo.%virs% Viruses detected for %mm%-%yd%-%year% >> %log%%mm%%yd%usage.log
::Virus detail
::echo %day%, %mm%-%dd%-%year% yesterday: %yd%
Echo.> viri.tmp && Echo.> viri.dat
:: [replace \/ this %spl% with you
vir.log path]
FOR /f "tokens=1-3" %%v IN ('%sys%find "Virus=" %spl%vir%mm%%yd%.log') DO
ECHO.%%x | %sys%find "Q" >> viri.tmp
:: [replace \/ this %spl% as well]
FOR /f "skip=1" %%j IN (viri.tmp) DO %sys%find "%%j" %spl%vir%mm%%yd%.log
>> viri.dat
%sys%find /v "D:" viri.dat | %sys%find /v "" >> %log%%mm%%yd%usage.log
:: [replace /\ this "D:" with "" so different paths aren't an issue]
..
I hope I haven't confused anybody more.
Best regards,
Jeff
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Serge Dergham
Sent: Thursday, December 06, 2001 5:57 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] MISSING_REVERSE_DNS:Imail/declude log
parser...
thanks
I can't find domain.exe, there is a domlist.exe, but no domain.exe
can someone please post a download link.
also, I have vir.log files in a separate directory (not the spool
directory), should I change anything in the batch ?
- Original Message -
From: "Jeff Pitoniak" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, December 06, 2001 10:15 PM
Subject: RE: [Declude.Virus] MISSING_REVERSE_DNS:Imail/declude log parser...
>
> Put this usage.cmd in c:\tools (or modify paths in the scipt to match
where
> you put it)
>
> Put domain.exe in the Imail spool directory. (available on the Imail
website
> under free tools)
>
> Create a d:\logs directory for these usage logs or create your own and
> update the "log" variable in usage.cmd
>
> And finally, I installed Imail on the D:\ drive so make sure your paths
> match the script file's.
>
> Make sure that the "Task Scheduler" is set to automatic in the services
> control panel and paste this ito a command prompt to automate usage.cmd.
>
> AT 02:30 /EVERY:M,T,W,Th,F,S,Su "c:\winnt\system32\cmd.exe /c
> c:\tools\usage.cmd"
>
> (note: if you put usage.cmd somewhere else chang the AT command above to
> reflect this)
>
> Good luck.
>
> Best regards,
> Jeff
> --
> "If your only tool is a hammer, pretty soon everything starts to look like
a
> nail."-Dr. William Learner, Chiropractor
> Jeff Pitoniak - Network Administration & Security Consultant - PCE
Systems,
> Inc.
> email: [EMAIL PROTECTED]
> Ph:(248)223-4888 ext.138 Fax:(248)223-4889
>
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
RE: [Declude.Virus] MISSING_REVERSE_DNS:Imail/declude log parser...
Oops, sorry, my mistake. The prerequisite app is DOMLIST.EXE. I am sorry, I was in a hurry yesterday when I posted USAGE.CMD. You'll also find a zip file of USAGE.CMD attached. Regards, Jeff -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Jeff Pitoniak Sent: Wednesday, December 05, 2001 5:05 PM To: Declude. Virus@declude. com Subject: [Declude.Virus] MISSING_REVERSE_DNS:Imail/declude log parser... I have just completed an NT batch file that creates an email with a domain summary and virus detection exerpt. It relies on domain.exe and the rest is done with NT batch commands (whew!). I would be willing to share if anyone is interested. I set it to run every morning at 2:30am with the NT chedule service and it parses the logs from the previous day. It would probably need to be customized slightly to fit your paticular cfg. It's very rudimentary, but you should be able to customize to fit your needs. Best regards, Jeff Here's an example: Report created 4:52p 2001-12-05 by Usage.cmd on Imail server Total number of messages for Wed 12-04-2001 Incoming: 618 Outgoing: 351 Domain # In # OutBytes In Bytes Out -- needaparts.com 117 16 2639041 73815 pcesystems.com 402 85209153062419907 adminfslc.org 66 3317166830 730028 [postmaster] 0 4 0 9422 ford.com 0191 0 404437 wcspcesystems.com 25 8 50540 96391 fordmss.com5 11 13091 22933 visteon.com0 3 0 4809 pcesystems.net 3 0 4202727 0 -- Total: 618351449875353761742 Virus Detections: 2 Viruses detected for 12-04-2001 12/04/2001 18:58:55 Q633e20e Virus=: EICAR test file NOT a virus. Attachment= [-858993460] 12/04/2001 18:58:55 Q633e20e File(s) are INFECTED [13] 12/04/2001 18:58:55 Q633e20e Scanned: CONTAINS A VIRUS [MIME: 2 6209] 12/04/2001 18:58:55 Q633e20e From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] 12/04/2001 18:58:55 Q633e20e Subject: FW: EMAIL SCAN:VIRUS ALERT! IN ATTACHMENT~TEST 12/04/2001 19:54:05 Q702c2b4 Virus= the W32/Magistr.b@MM virus !!! Attachment=choose.com [0] 12/04/2001 19:54:05 Q702c2b4 File(s) are INFECTED [13] 12/04/2001 19:54:05 Q702c2b4 Scanned: CONTAINS A VIRUS [MIME: 2 62048] 12/04/2001 19:54:05 Q702c2b4 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] 12/04/2001 19:54:05 Q702c2b4 Subject: [Fwd: I have specific time set aside] -- "If your only tool is a hammer, pretty soon everything starts to look like a nail."-Dr. William Learner, Chiropractor Jeff Pitoniak - Network Administration & Security Consultant - PCE Systems, Inc. email: [EMAIL PROTECTED] Ph:(248)223-4888 ext.138 Fax:(248)223-4889 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] Usage.zip Description: Zip compressed data
