Re: [Declude.Virus] Order of scanning
Are there any other cautions with using this feature other than releasing mail that was held by junkmail's HOLD action? Such as if junkmail uses the ROUTETO or MAILBOX action prior to the virus scanning, are there any conditions that would cause the email to not get virus scanned? Bill -Original Message- From: "R. Scott Perry" Sent: Tue, 25 Mar 2003 11:19:14 -0500 Subject: RE: [Declude.Virus] Order of scanning >To enable this feature, do we just put AVAFTERJM ON in the virus.cfg file? Correct, and: >I assume that one downside is that the spam folder could possibly contain >held spam emails that are do contain viruses, because they were held for >spam before they got scanned for viruses, right? Correct. So using the AVAFTERJM setting can be useful in cutting down CPU time, for example, but you need to be careful that if E-mail is held by Declude JunkMail, you make sure it is legitimate before delivering it (which most people do anyways). However, if an attachment is included (or an HTML virus is included), it may be hard to distinguish between legitimate and not. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Order of scanning
Is there any "back door" to declude virus or some way to release it so that is can be scanned by declude virus before it is delivered? Not after Declude JunkMail catches it. Although there is a way you could get Declude to scan the E-mail again, Declude JunkMail would catch it again. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Order of scanning
Is there any "back door" to declude virus or some way to release it so that is can be scanned by declude virus before it is delivered? Dan > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry > Sent: Tuesday, March 25, 2003 9:19 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.Virus] Order of scanning > > > > >To enable this feature, do we just put AVAFTERJM ON in the > virus.cfg file? > > Correct, and: > > >I assume that one downside is that the spam folder could possibly contain > >held spam emails that are do contain viruses, because they were held for > >spam before they got scanned for viruses, right? > > Correct. > > So using the AVAFTERJM setting can be useful in cutting down CPU > time, for > example, but you need to be careful that if E-mail is held by Declude > JunkMail, you make sure it is legitimate before delivering it (which most > people do anyways). However, if an attachment is included (or an HTML > virus is included), it may be hard to distinguish between > legitimate and not. > -Scott > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Anyone catching E-mails from walmart.com with vulnerabilities...
I had one a week ago or so. It was an online order or something for a client. Let me see if I can find it. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.Virus- > [EMAIL PROTECTED] On Behalf Of R. Scott Perry > Sent: Tuesday, March 25, 2003 9:35 AM > To: [EMAIL PROTECTED] > Subject: [Declude.Virus] Anyone catching E-mails from walmart.com with > vulnerabilities... > > If anyone is catching E-mails from walmart.com that contain the Outlook > 'CR' Vulnerability (or any other vulnerability), would it be possible to > E-mail me one of the D*.SMD files from the \Imail\spool\virus directory? I > am working with them on fixing this problem, but it seems to be sporadic, > and not occurring in the files they are sending me. > -Scott > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus".The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
[Declude.Virus] Anyone catching E-mails from walmart.com withvulnerabilities...
If anyone is catching E-mails from walmart.com that contain the Outlook 'CR' Vulnerability (or any other vulnerability), would it be possible to E-mail me one of the D*.SMD files from the \Imail\spool\virus directory? I am working with them on fixing this problem, but it seems to be sporadic, and not occurring in the files they are sending me. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Order of scanning
> I assume that one downside is that the spam folder could possibly contain > held spam emails that are do contain viruses, because they were held for > spam before they got scanned for viruses, right? My question is, what will > happen if we place them back into the queue, then they will be delivered > without ever getting scanned for viruses? > > This seems to be the biggest downside. This is correct, a big downside. That is why it is not recommended. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Order of scanning
To enable this feature, do we just put AVAFTERJM ON in the virus.cfg file? Correct, and: I assume that one downside is that the spam folder could possibly contain held spam emails that are do contain viruses, because they were held for spam before they got scanned for viruses, right? Correct. So using the AVAFTERJM setting can be useful in cutting down CPU time, for example, but you need to be careful that if E-mail is held by Declude JunkMail, you make sure it is legitimate before delivering it (which most people do anyways). However, if an attachment is included (or an HTML virus is included), it may be hard to distinguish between legitimate and not. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Order of scanning
To enable this feature, do we just put AVAFTERJM ON in the virus.cfg file? I assume that one downside is that the spam folder could possibly contain held spam emails that are do contain viruses, because they were held for spam before they got scanned for viruses, right? My question is, what will happen if we place them back into the queue, then they will be delivered without ever getting scanned for viruses? This seems to be the bggest downside. Dan Spangenberg > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Paul Navarre > Sent: Tuesday, March 25, 2003 7:55 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.Virus] Order of scanning > > > Is there anything to consider before using AVAFTERJM? We are > getting so much spam with Outlook > vulnerabilities that are currently being caught by Virus, and I'd > love to have them blocked first by > JunkMail. I just want to be sure there is no risk to doing this. > > Thanks, > > Paul Navarre > > > With v1.68 and later, using "AVAFTERJM" setting: > > [1] Declude JunkMail > > [2] Declude Virus > > [3] Declude Hijack > > > >-Scott > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Order of scanning
> Is there anything to consider before using AVAFTERJM? We are getting so much > spam with Outlook > vulnerabilities that are currently being caught by Virus, and I'd love to have them > blocked first by > JunkMail. I just want to be sure there is no risk to doing this. There is a big risk in doing this. Vulnerabilities will only be caught by Virus, not by JunkMail. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Order of scanning
What makes me worrying is that quarantined emails (declude virus) have the X-Declude Headers from Declude Junkmail. This means that they must have been scanned by junkmail, before declude virus comes in place. Am i right? Not necessarily -- the Declude JunkMail headers may get added even if Declude JunkMail doesn't scan the E-mail (since Declude knows about the Declude JunkMail headers before Declude JunkMail scans the E-mail). Unless you are using the AVAFTERJM option, Declude Virus will scan the E-mail first. Is it possible that there are emails in the junkmail directory, which are not scanned for virus? Only if you use the AVAFTERJM option. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Order of scanning
Is there anything to consider before using AVAFTERJM? Yes -- any E-mail quarantined by Declude JunkMail will not be scanned for viruses, so if you later deliver the E-mail, it could contain a virus. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Order of scanning
> I have V 1.65 in place and I do not have the term "AVAFTERJM" in any config > file. > > So, are spam mails scanned for viri although the AV quarantined emails have > the Junkmail headers? Pre 1.68 beta versions added some JunkMail headers before Virus scanning. This was changed in 1.68 beta as stated in the release notes. You should update to this version. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Order of scanning
Is there anything to consider before using AVAFTERJM? We are getting so much spam with Outlook vulnerabilities that are currently being caught by Virus, and I'd love to have them blocked first by JunkMail. I just want to be sure there is no risk to doing this. Thanks, Paul Navarre > With v1.68 and later, using "AVAFTERJM" setting: > [1] Declude JunkMail > [2] Declude Virus > [3] Declude Hijack > >-Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Order of scanning
> E-mails quarantined by Declude JunkMail will have been scanned > for viruses, > unless you change the default settings (using the AVAFTERJM > setting). Here > are the possible orders: > > With v1.67 and earlier, default settings: > [1] Declude Hijack > [2] Declude Virus > [3] Declude JunkMail > > With v1.67 and earlier, using "AVAFTERJM" setting: > [1] Declude Hijack > [2] Declude JunkMail > [3] Declude Virus > > With v1.68 and later, default settings: > [1] Declude Virus > [2] Declude Hijack > [3] Declude JunkMail > > With v1.68 and later, using "AVAFTERJM" setting: > [1] Declude JunkMail > [2] Declude Virus > [3] Declude Hijack I have V 1.65 in place and i do not have the term "AVAFTERJM" in any config file. So, are spam mails scanned for viri although the AV quarantined emails have the Junkmail headers? Hermann --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Order of scanning
> found at http://www.declude.com/junkmail/manual.htm :-) - > Processing Order > Both IMail and Declude have a number of different tests that they run on > E-mail. The order used is as follows: > > 1. IMail's Control Access file (to block IPs) > 2. IMail's Kill List (to block return addresses) > 3. Declude Hijack > 4. Declude Virus > 5. Declude JunkMail > 6. IMail's filters > --- > so Spam Virus would be found ;-) What makes me worrying is that quarantined emails (declude virus) have the X-Declude Headers from Declude Junkmail. This means that they must have been scanned by junkmail, before declude virus comes in place. Am i right? Is it possible that there are emails in the junkmail directory, which are not scanned for virus? I have to put some of them back to spool because they are false positives from junkmail, and i can`t afford unscanned mails go through our mailserver. Hermann --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Order of scanning
Can anybody tell me in which order different Declude products (virus, junkmail, hijack, ...) work on mails? Are mails, which are quarantined by junkmail, scanned for viri before? E-mails quarantined by Declude JunkMail will have been scanned for viruses, unless you change the default settings (using the AVAFTERJM setting). Here are the possible orders: With v1.67 and earlier, default settings: [1] Declude Hijack [2] Declude Virus [3] Declude JunkMail With v1.67 and earlier, using "AVAFTERJM" setting: [1] Declude Hijack [2] Declude JunkMail [3] Declude Virus With v1.68 and later, default settings: [1] Declude Virus [2] Declude Hijack [3] Declude JunkMail With v1.68 and later, using "AVAFTERJM" setting: [1] Declude JunkMail [2] Declude Virus [3] Declude Hijack -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Order of scanning
Hello, found at http://www.declude.com/junkmail/manual.htm :-) - Processing Order Both IMail and Declude have a number of different tests that they run on E-mail. The order used is as follows: 1. IMail's Control Access file (to block IPs) 2. IMail's Kill List (to block return addresses) 3. Declude Hijack 4. Declude Virus 5. Declude JunkMail 6. IMail's filters --- so Spam Virus would be found ;-) Alex > -Original Message- > From: Hermann Strassner [mailto:[EMAIL PROTECTED] > Sent: Tuesday, March 25, 2003 1:51 PM > To: Declude. Virus > Subject: [Declude.Virus] Order of scanning > > > Can anybody tell me in which order different Declude products (virus, > junkmail, hijack, ...) work on mails? > Are mails, which are quarantined by junkmail, scanned for viri before? > > Hermann > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
[Declude.Virus] Order of scanning
Can anybody tell me in which order different Declude products (virus, junkmail, hijack, ...) work on mails? Are mails, which are quarantined by junkmail, scanned for viri before? Hermann --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
