[Declude.Virus] SMTP AUTH - Imail v6.06

[Jack Taugher]

(IMail v6.06 - SMTP AUTH)

We need to enable SMTP AUTH for all of our clients -- we've found some
device/person (IP) on the outside of our network spoofing emails to lists by
the few users who are authorized list posters.

In order to do this, is it best that we just check "No Mail Relay" on the
server and make all of our users go through the few steps to do SMTP AUTH?




---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

Re: [Declude.Virus] SMTP AUTH - Imail v6.06

[R. Scott Perry]

>(IMail v6.06 - SMTP AUTH)
>
>We need to enable SMTP AUTH for all of our clients -- we've found some
>device/person (IP) on the outside of our network spoofing emails to lists by
>the few users who are authorized list posters.
>
>In order to do this, is it best that we just check "No Mail Relay" on the
>server and make all of our users go through the few steps to do SMTP AUTH?

That's the best way to make sure that you are not an open relay (you could 
instead use "Relay for Addresses", and enter some "safe" IP addresses, and 
have everyone not coming from those IPs use SMTP AUTH ).

However, I don't believe that will prevent people from sending mail to the 
list using forged return addresses, since SMTP AUTH only applies to 
outgoing (relayed) E-mail.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.Virus] SMTP AUTH - Imail v6.06

[Lists - Declude Virus]

Yes, your absolutely right.

You can include your internal addresses, if applicable, in the addresses
box to insure your own systems won't need auth if you wish.

Maintain,
Babul
 
(210) 696-1130, ext. 102
(210) 696-0572 [fax]
 
The Montopolis Group - www.montopolis.com 
"Building stronger businesses... with Technology"


-Original Message-
From: Jack Taugher [mailto:[EMAIL PROTECTED]] 
Posted At: Tuesday, May 14, 2002 12:16 PM
Posted To: Lists - Declude Virus
Conversation: [Declude.Virus] SMTP AUTH - Imail v6.06
Subject: [Declude.Virus] SMTP AUTH - Imail v6.06


(IMail v6.06 - SMTP AUTH)

We need to enable SMTP AUTH for all of our clients -- we've found some
device/person (IP) on the outside of our network spoofing emails to
lists by
the few users who are authorized list posters.

In order to do this, is it best that we just check "No Mail Relay" on
the
server and make all of our users go through the few steps to do SMTP
AUTH?




---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

[Declude.Virus] W97M/Hopper.G Virus Information??

[Jim Matuska]

Does anyone know anything about the W97M/Hopper.G Virus?  I have a user that says 
they received this via email and it was caught by declude when they tried to 
resend it after modifying it.  I have been unable to find any useful 
information on it other than the fact that F-Prot is catching it.  Is this 
a new virus?  I usually check out info at www.sarc.com but they don't even have it 
listed.  So far only one copy has been seen.  Has anyone seen this one 
or have a good link for information on this particular 
virus?
 
Jim Matuska Jr.Nez Perce TribeInformation 
Systems[EMAIL PROTECTED]

Re: [Declude.Virus] W97M/Hopper.G Virus Information??

[R. Scott Perry]

>Does anyone know anything about the W97M/Hopper.G Virus?  I have a user 
>that says they received this via email and it was caught by declude when 
>they tried to resend it after modifying it.  I have been unable to find 
>any useful information on it other than the fact that F-Prot is catching 
>it.  Is this a new virus?  I usually check out info at 
>www.sarc.com but they don't even have it listed.  So 
>far only one copy has been seen.  Has anyone seen this one or have a good 
>link for information on this particular virus?

F-Secure has information at 
http://www.europe.f-secure.com/v-descs/hopper.shtml, and McAfee has 
information at http://vil.nai.com/vil/content/v_99247.htm.  It was 
originally discovered about a year and a half ago.  Any chance that the 
user received it from another E-mail account?
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

KITHRUP:RE: [Declude.Virus] W97M/Hopper.G Virus Information??

[Jim Rooth]

I didn’t find the hopper.g but did
find several other hopper virus variations listed at http://vil.mcafee.com/alphar.asp?

 



 

Jim Rooth



-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Jim Matuska
Sent: Tuesday, May 14, 2002 1:04
PM
To: [EMAIL PROTECTED]
Subject: [Declude.Virus]
W97M/Hopper.G Virus Information??
Importance: High

 



Does anyone know anything about the W97M/Hopper.G
Virus?  I have a user that says they received this via email and it was
caught by declude when they tried to resend it after modifying it.  I have
been unable to find any useful information on it other than the fact that
F-Prot is catching it.  Is this a new virus?  I usually check out
info at www.sarc.com but they don't even have
it listed.  So far only one copy has been seen.  Has anyone seen this
one or have a good link for information on this particular virus?





 





Jim Matuska Jr.
Nez Perce Tribe
Information Systems
[EMAIL PROTECTED]










---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.361 / Virus Database: 199 - Release Date: 5/7/2002
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.361 / Virus Database: 199 - Release Date: 5/7/2002
 

Re: [Declude.Virus] W97M/Hopper.G Virus Information??

[Jim Matuska]

My first thoughts were that they came from a different email account, but
the user is saying that is not the case.  My thoughts were that perhaps the
G Variant was a new one that just came out.  I suppose it is possible that
the user was infected from another file and inadvertently infected another
file.

Jim Matuska Jr.
Nez Perce Tribe
Information Systems
[EMAIL PROTECTED]
- Original Message -
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, May 14, 2002 11:38 AM
Subject: Re: [Declude.Virus] W97M/Hopper.G Virus Information??


>
> >Does anyone know anything about the W97M/Hopper.G Virus?  I have a user
> >that says they received this via email and it was caught by declude when
> >they tried to resend it after modifying it.  I have been unable to find
> >any useful information on it other than the fact that F-Prot is catching
> >it.  Is this a new virus?  I usually check out info at
> >www.sarc.com but they don't even have it listed.  So
> >far only one copy has been seen.  Has anyone seen this one or have a good
> >link for information on this particular virus?
>
> F-Secure has information at
> http://www.europe.f-secure.com/v-descs/hopper.shtml, and McAfee has
> information at http://vil.nai.com/vil/content/v_99247.htm.  It was
> originally discovered about a year and a half ago.  Any chance that the
> user received it from another E-mail account?
>  -Scott
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> This E-mail came from the Declude.Virus mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.Virus".  You can E-mail
> [EMAIL PROTECTED] for assistance.  You can visit our web
> site at http://www.declude.com .
>
>


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

[Declude.Virus] OT junkmail

[Serge]

looking to buy junkmail pro soon, have few 
questions:
 
1- Is it as simple to install and configure as 
virus ? looking at junkmail list, it seems we will need to configure tests, 
weights, ... Will you offer a step by step 
assistance ?
 
2- After the first year, will we need 2 service 
agreement, one for junkmail and one virus ? or will one contract cover all 
declude products ?
 
3- Discount for declude virus pro owners 
?

Re: [Declude.Virus] W97M/Hopper.G Virus Information??

[R. Scott Perry]

>My first thoughts were that they came from a different email account, but
>the user is saying that is not the case.

What I would do is check the IMail SMTP log file to see if you can find the 
E-mail in there, and then check the Declude Virus log file to see if there 
is a "Virus Free" line (which would indicate that F-Prot reported the 
file(s) were virus free).  That would be the first step in trying to figure 
out what happened.

>My thoughts were that perhaps the G Variant was a new one that just came out.

That's definitely a possibility (although I haven't heard of a new Hopper 
variant being discovered recently).

>I suppose it is possible that the user was infected from another file and 
>inadvertently infected another
>file.

Often, that is the case (even if a user swears it came through E-mail).
-Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

Re: [Declude.Virus] OT junkmail

[R. Scott Perry]

>looking to buy junkmail pro soon, have few questions:
>
>1- Is it as simple to install and configure as virus ? looking at junkmail 
>list, it seems we will need to configure tests, weights, ... Will you 
>offer a step by step assistance ?

It often does require a bit of tweaking, depending on your unique 
situation.  With the new weighting system, though, it's easier than it used 
to be -- you can just set up a certain weight at which spam will get caught 
(for example, any E-mail with a total weight of 10 or higher).  We will 
certainly assist you, but you'll need to make the actual decisions (such as 
how you want spam treated -- quarantined, deleted, a warning in the 
headers, etc.).

>2- After the first year, will we need 2 service agreement, one for 
>junkmail and one virus ? or will one contract cover all declude products ?

The Service Agreements cover all the Declude products that you have, so you 
would only need one Service Agreement.

>3- Discount for declude virus pro owners ?

There is a 10% volume discount that applies starting on your second 
purchase.  The standard order page doesn't reflect it automatically unless 
you order both at the same time, so I can E-mail you instructions on how 
you can get the 10% discount.
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

[Declude.Virus] McAfee

[John Tolmachoff]

I have just installed NetShield, (full install disabled on demand,) but
I do not see a scan.exe in the directory. I do see the scan32.exe, but
according to the virus manual, that is not the one to use for command
line.

I even ran a manual scan to see if it would create it.

Ideas?

John Tolmachoff 
IT Manager, Network Engineer
211 E. Imperial Hwy., Suite 106
Fullerton, CA  92835
714-578-7999, ext. 104
[EMAIL PROTECTED]
www.reliancesoft.com
 
 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

Re: [Declude.Virus] McAfee

[R. Scott Perry]

>I have just installed NetShield, (full install disabled on demand,) but
>I do not see a scan.exe in the directory. I do see the scan32.exe, but
>according to the virus manual, that is not the one to use for command
>line.
>
>I even ran a manual scan to see if it would create it.

You may need to do a Full Install.  Also note that it may install it to a 
directory of its choosing instead of the one you tell it to, so you may 
want to search your hard drive for scan.exe.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

Re: [Declude.Virus] McAfee

[Jonathan]

It sticks it in common files, or some weird location as I recall .. do a 
full drive search for it..

Jonathan

At 06:09 PM 5/14/2002 -0400, you wrote:

>>I have just installed NetShield, (full install disabled on demand,) but
>>I do not see a scan.exe in the directory. I do see the scan32.exe, but
>>according to the virus manual, that is not the one to use for command
>>line.
>>
>>I even ran a manual scan to see if it would create it.
>
>You may need to do a Full Install.  Also note that it may install it to a 
>directory of its choosing instead of the one you tell it to, so you may 
>want to search your hard drive for scan.exe.
>-Scott
>
>---
>[This E-mail was scanned for viruses by Declude Virus 
>(http://www.declude.com)]
>
>This E-mail came from the Declude.Virus mailing list.  To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.Virus".  You can E-mail
>[EMAIL PROTECTED] for assistance.  You can visit our web
>site at http://www.declude.com .

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

Re: [Declude.Virus] McAfee

[Charles Stanley]

At 02:54 PM 05/14/02, you wrote:
>I have just installed NetShield, (full install disabled on demand,) but
>I do not see a scan.exe in the directory. I do see the scan32.exe, but
>according to the virus manual, that is not the one to use for command
>line.

My scan.exe is located in Program Files/common files/network 
associates/virusscan engine/5.0.xx


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

COMPU:AW: [Declude.Virus] SMTP AUTH - Imail v6.06

[Michael Tobisch]

Why not secure the lists(s) with a password?

Best wishes
---
Michael Tobisch
interactiveaustria
Wiesengasse 12
A-8160 Weiz
Tel +43 3172 4930
GSM +43 664 2126941
EMail [EMAIL PROTECTED]
Web http://www.iaa.at
---


> -Ursprüngliche Nachricht-
> Von: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]Im Auftrag von Jack Taugher
> Gesendet: Dienstag, 14. Mai 2002 19:16
> An: [EMAIL PROTECTED]
> Betreff: [Declude.Virus] SMTP AUTH - Imail v6.06
>
>
> (IMail v6.06 - SMTP AUTH)
>
> We need to enable SMTP AUTH for all of our clients -- we've found some
> device/person (IP) on the outside of our network spoofing emails
> to lists by
> the few users who are authorized list posters.
>
> In order to do this, is it best that we just check "No Mail Relay" on the
> server and make all of our users go through the few steps to do SMTP AUTH?
>
>
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> This E-mail came from the Declude.Virus mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.Virus".  You can E-mail
> [EMAIL PROTECTED] for assistance.  You can visit our web
> site at http://www.declude.com .
> ---
> Dieses E-Mail wurde von Declude Virus auf Virusfreiheit geprueft
> Ein Service von interactiveaustria, http://www.iaa.at
> ---
>
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .