AW: [Declude.Virus] New Errors under Imail 8.03

2003-10-24 Thread Guhl, Markus (LDS)
hi,

i think it is not a problem of imail 8.*. we use imail 7.* an we get those
errors too. the volume of mail seems to be connected to the problem, we only see
them when more then 500 mails comming in nearly the same time. right now we
think the problem is connected to the hd-accesstime.

mfg
i.a.
gez. guhl

***
lds nrw
dez. 235
tel.: 0211 9449 2578 
fax.: 0211 9449 8344
mailto:[EMAIL PROTECTED]
***


 

-Ursprüngliche Nachricht-
Von: R. Scott Perry [mailto:[EMAIL PROTECTED]
Gesendet am: Freitag, 24. Oktober 2003 02:24
An: [EMAIL PROTECTED]
Betreff: RE: [Declude.Virus] New Errors under Imail 8.03

We do not have any further information on this issue yet.

It seems to only affect servers with a high volume of mail (several 
thousand E-mails per hour).
-Scott

At 06:17 PM 10/23/2003, Danny Klopfer wrote:
Scott,

Do you know if this has been resolved?  I want to upgrade to 8.03 tonight
from 7.12.  Is it a concern or should I just go for it?

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry
Sent: Thursday, October 02, 2003 6:40 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] New Errors under Imail 8.03



 Since upgrading to IMail 8.03, I began getting this error  several times
 each day -
 
 Error 183 creating temp directory D:\IMAIL\spool\Dfce20c8602461764.vir\.
 
 
 (The error is something like already exists).
 
Have been running 1.69i7 since May and never saw that error.

This is something that we are looking into.  Right now, it seems that there
is a problem with IMail v8 either locking files that it should not, or
possibly calling Declude multiple times for the same E-mail.

 -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] New Errors under Imail 8.03

2003-10-24 Thread R. Scott Perry

 It seems to only affect servers with a high volume of mail (several
 thousand E-mails per hour).
Does 1-2k per hour qualify as several thousand?
What really matters is the quantity of E-mail in a very short time period.

You could probably have 10,000 per hour if they are spaced evenly.  But if 
you have 100 per hour that come in bursts of 50 per second, you would be 
more likely to encounter this issue.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


Re: AW: [Declude.Virus] New Errors under Imail 8.03

2003-10-24 Thread R. Scott Perry

i think it is not a problem of imail 8.*. we use imail 7.* an we get those
errors too. the volume of mail seems to be connected to the problem, we 
only see
them when more then 500 mails comming in nearly the same time. right now we
think the problem is connected to the hd-accesstime.
The Error 183?  We haven't seen that one with IMail v7.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


AW: AW: [Declude.Virus] New Errors under Imail 8.03

2003-10-24 Thread Guhl, Markus (LDS)
hi,

yes its error 183. here is a part from the viruslog:
10/22/2003 15:04:54 Q7f90072a007200cc Error 183 creating temp directory
F:\IMail\spool\D7f90072a007200cc.vir\.
10/22/2003 15:04:54 Q7f90072a007200cc Scanned: Error starting scanner
10/22/2003 15:04:55 Q7f90072b007201b7 Scanned: Virus Free [MIME: 1 1965]
10/22/2003 15:04:55 Q8053025c00e8f99a Scanned: Virus Free [MIME: 1 1965]
10/22/2003 15:04:56 Q7f9007f50054010b Scanned: Virus Free [MIME: 1 1965]
10/22/2003 15:04:58 Q7f90072a007200cc Scanned: Virus Free [MIME: 1 1965]

its imail 7.15

mfg
i.a.
gez. guhl

***
lds nrw
dez. 235
tel.: 0211 9449 2578 
fax.: 0211 9449 8344
mailto:[EMAIL PROTECTED]
***


 

-Ursprüngliche Nachricht-
Von: R. Scott Perry [mailto:[EMAIL PROTECTED]
Gesendet am: Freitag, 24. Oktober 2003 13:20
An: [EMAIL PROTECTED]
Betreff: Re: AW: [Declude.Virus] New Errors under Imail 8.03


i think it is not a problem of imail 8.*. we use imail 7.* an we get those
errors too. the volume of mail seems to be connected to the problem, we 
only see
them when more then 500 mails comming in nearly the same time. right now we
think the problem is connected to the hd-accesstime.

The Error 183?  We haven't seen that one with IMail v7.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


RE: [Declude.Virus] New Errors under Imail 8.03

2003-10-24 Thread Danny Klopfer
I took the plunge early this morning and upgraded to Imail 8.03 and on a new
(faster) server.  So far all is well.  My CPU usage has dropped a lot.  It
was hitting 100% a lot with 60+ processes.

So far the processes have stayed below 40 with the CPU usage being a lot
more stable.

Now I just have to figure out was it because of the upgrade, new server, or
both.




-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry
Sent: Friday, October 24, 2003 4:19 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] New Errors under Imail 8.03



  It seems to only affect servers with a high volume of mail (several
  thousand E-mails per hour).

Does 1-2k per hour qualify as several thousand?

What really matters is the quantity of E-mail in a very short time period.

You could probably have 10,000 per hour if they are spaced evenly.  But if
you have 100 per hour that come in bursts of 50 per second, you would be
more likely to encounter this issue.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


RE: [Declude.Virus] Off Topic I think

2003-10-24 Thread John Tolmachoff \(Lists\)
Have you done a complete virus scan?

If it is a virus, by far not all virus are e-mail borne.

John Tolmachoff
Engineer/Consultant/Owner
eServices For You

 -Original Message-
 From: [EMAIL PROTECTED] [mailto:Declude.Virus-
 [EMAIL PROTECTED] On Behalf Of Link Brokers Support
 Sent: Friday, October 24, 2003 8:50 AM
 To: Declude Virus; Declude Junk Mail
 Subject: [Declude.Virus] Off Topic I think
 
 This morning our Quick Book Files were completely deleted. This happened
 automatically when  our account department started up the PC.  It just
 started deleting files.
  I DID a search on new file installed and Found a QIN and MPR file
 extension
 that showed up as new files at 5:30 am this morning.  Can anyone shed some
 light and lead me in the right direction.
 
 Do I need to ban QIN and MPR files?
 
 Kevin Shimwell
 Link Brokers Group, LLC  ( Support )
 401 Ist Ave. North
 North Myrtle Beach, SC 29582
 Phone: 843-663-1004
 Fax: 843-663-1007
 Email:  [EMAIL PROTECTED]
 24/7 Support   http://www.linkbrokers.com/support_ticket.cfm
 Support M-F  1-888-546-5631
 
 
 
 
 
 
 
 [This E-mail scanned for viruses by Link Brokers Group, Inc Virus
 Protection]
 
 ---
 [This E-mail was scanned for viruses by Declude Virus
 (http://www.declude.com)]
 
 ---
 This E-mail came from the Declude.Virus mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.Virus.The archives can be found
 at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


RE: [Declude.Virus] Off Topic I think

2003-10-24 Thread John Tolmachoff \(Lists\)
http://filext.com/detaillist.php?extdetail=mprSubmit2=Go%21
FoxPro

http://filext.com/detaillist.php?extdetail=qinSubmit2=Go%21
Unknown


John Tolmachoff
Engineer/Consultant/Owner
eServices For You


 -Original Message-
 From: [EMAIL PROTECTED] [mailto:Declude.Virus-
 [EMAIL PROTECTED] On Behalf Of Link Brokers Support
 Sent: Friday, October 24, 2003 8:50 AM
 To: Declude Virus; Declude Junk Mail
 Subject: [Declude.Virus] Off Topic I think
 
 This morning our Quick Book Files were completely deleted. This happened
 automatically when  our account department started up the PC.  It just
 started deleting files.
  I DID a search on new file installed and Found a QIN and MPR file
 extension
 that showed up as new files at 5:30 am this morning.  Can anyone shed some
 light and lead me in the right direction.
 
 Do I need to ban QIN and MPR files?
 
 Kevin Shimwell
 Link Brokers Group, LLC  ( Support )
 401 Ist Ave. North
 North Myrtle Beach, SC 29582
 Phone: 843-663-1004
 Fax: 843-663-1007
 Email:  [EMAIL PROTECTED]
 24/7 Support   http://www.linkbrokers.com/support_ticket.cfm
 Support M-F  1-888-546-5631
 
 
 
 
 
 
 
 [This E-mail scanned for viruses by Link Brokers Group, Inc Virus
 Protection]
 
 ---
 [This E-mail was scanned for viruses by Declude Virus
 (http://www.declude.com)]
 
 ---
 This E-mail came from the Declude.Virus mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.Virus.The archives can be found
 at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


[Declude.Virus] Backdoor.Coreflood Virus new variant?

2003-10-24 Thread Jim Matuska
Does anyone know whether the new variant of the Backdoor.Coreflood is
detected with F-Prot?  We have the latest version of virus definitions for
F-Prot, but one of our users received this virus and it looks like it may
have come through email.  Has anyone ran into the new variant of this virus?
It looks like it was only started to be detected by Symantec's Virus
definitions in yesterdays update and that is the only reason our user
initially picked it up.  Does anyone know if this virus even spreads via
email?

Jim Matuska Jr.
Computer Tech II
CCNA
Nez Perce Tribe
Information Systems
[EMAIL PROTECTED]


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


RE: [Declude.Virus] Off Topic I think

2003-10-24 Thread Jeff Maze - Hostmaster
What's weird is that it also appears as though the same thing happened with
the Half-Life 2 code.  E-mail was acting strange and then a portion of the
code was stolen.  I wonder if it was a Microsoft product that this person
(that working on the Half-Life 2 code) was using.


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
(Lists)
Sent: Friday, October 24, 2003 12:23 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] Off Topic I think


Have you done a complete virus scan?

If it is a virus, by far not all virus are e-mail borne.

John Tolmachoff
Engineer/Consultant/Owner
eServices For You

 -Original Message-
 From: [EMAIL PROTECTED] [mailto:Declude.Virus- 
 [EMAIL PROTECTED] On Behalf Of Link Brokers Support
 Sent: Friday, October 24, 2003 8:50 AM
 To: Declude Virus; Declude Junk Mail
 Subject: [Declude.Virus] Off Topic I think
 
 This morning our Quick Book Files were completely deleted. This 
 happened automatically when  our account department started up the PC.  
 It just started deleting files.  I DID a search on new file installed 
 and Found a QIN and MPR file extension
 that showed up as new files at 5:30 am this morning.  Can anyone shed some
 light and lead me in the right direction.
 
 Do I need to ban QIN and MPR files?
 
 Kevin Shimwell
 Link Brokers Group, LLC  ( Support )
 401 Ist Ave. North
 North Myrtle Beach, SC 29582
 Phone: 843-663-1004
 Fax: 843-663-1007
 Email:  [EMAIL PROTECTED]
 24/7 Support   http://www.linkbrokers.com/support_ticket.cfm
 Support M-F  1-888-546-5631
 
 
 
 
 
 
 
 [This E-mail scanned for viruses by Link Brokers Group, Inc Virus 
 Protection]
 
 ---
 [This E-mail was scanned for viruses by Declude Virus 
 (http://www.declude.com)]
 
 ---
 This E-mail came from the Declude.Virus mailing list.  To unsubscribe, 
 just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.Virus.The archives can be found
 at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just
send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


RE: [Declude.Virus] Off Topic I think

2003-10-24 Thread Jeff Maze - Hostmaster
http://story.news.yahoo.com/news?tmpl=storycid=569ncid=738e=3u=/nm/20031
023/tc_nm/media_videogames_halflife2_dc


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


RE: [Declude.Virus] Off Topic I think

2003-10-24 Thread Tandem Group
QIN and MPR files appear to be QucikBooks upgrade files. Do you have
anything set to do an automatic upgrade from QB?

 -Original Message-
 From: [EMAIL PROTECTED]
 [mailto:[EMAIL PROTECTED] Behalf Of Link Brokers
 Support
 Sent: Friday, October 24, 2003 08:50
 To: Declude Virus; Declude Junk Mail
 Subject: [Declude.Virus] Off Topic I think


 This morning our Quick Book Files were completely deleted.
 This happened
 automatically when  our account department started up the PC.  It just
 started deleting files.
  I DID a search on new file installed and Found a QIN and MPR
 file extension
 that showed up as new files at 5:30 am this morning.  Can
 anyone shed some
 light and lead me in the right direction.

 Do I need to ban QIN and MPR files?

 Kevin Shimwell
 Link Brokers Group, LLC  ( Support )
 401 Ist Ave. North
 North Myrtle Beach, SC 29582
 Phone: 843-663-1004
 Fax: 843-663-1007
 Email:  [EMAIL PROTECTED]
 24/7 Support   http://www.linkbrokers.com/support_ticket.cfm
 Support M-F  1-888-546-5631







 [This E-mail scanned for viruses by Link Brokers Group, Inc
 Virus Protection]

 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


[Declude.Virus] New italian virus ?

2003-10-24 Thread Piero
Hi,
First sorry for my bad english...

I've received a mail which contain the follow italian text:
Subject: Il momento è catartico

Ricevo e cortesemente inoltro, un premio per la genialità
hanno reso mitico un salva schermo scaricalo, poesie catartiche, che non
sai cosa ti perdi

ciao

The text poesie catartiche is a link to :
http://www.francescone.com/index.html which prompt to download a scr file.
F-prot updated, do not block this file.

But installing screensaver seems that a indipendent Smtp send email to
address which are in Address List in outlook.

Two question:
- How to block each email which have il momento è catartico in subject
- Someone could tell me which email address I can send this file to check if
it is a virus and to add to new definition ?

Thanks in advance.

Piero
Italy

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] New italian virus ?

2003-10-24 Thread Jim Matuska
A couple things, first F-Prot and declude on your mail server would not
block the virus, since if I read your message right is linked to a website
and not sent as an attachment.  I can think of a couple options for this
though.  First, you could setup a rule in imail to delete or forward to an
admin any messages that have that subject.  Another option if you are
running content filtering software on your internet connect would be to
block that particular website.  If you really want to get creative you can
also block the ip address for that site on a router or firewall access list
(currently the ip for that site is 66.216.74.58.  Just be aware if you block
the ip address of that server and it later changes your acl will no longer
apply, the same thing with the message subject blocking, if it changes your
filters will not longer work.

Jim Matuska Jr.
Computer Tech II
CCNA
Nez Perce Tribe
Information Systems
[EMAIL PROTECTED]
- Original Message - 
From: Piero [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, October 24, 2003 10:02 AM
Subject: [Declude.Virus] New italian virus ?


 Hi,
 First sorry for my bad english...

 I've received a mail which contain the follow italian text:
 Subject: Il momento è catartico

 Ricevo e cortesemente inoltro, un premio per la genialità
 hanno reso mitico un salva schermo scaricalo, poesie catartiche, che non
 sai cosa ti perdi

 ciao

 The text poesie catartiche is a link to :
 http://www.francescone.com/index.html which prompt to download a scr file.
 F-prot updated, do not block this file.

 But installing screensaver seems that a indipendent Smtp send email to
 address which are in Address List in outlook.

 Two question:
 - How to block each email which have il momento è catartico in subject
 - Someone could tell me which email address I can send this file to check
if
 it is a virus and to add to new definition ?

 Thanks in advance.

 Piero
 Italy

 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

 ---
 This E-mail came from the Declude.Virus mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.Virus.The archives can be found
 at http://www.mail-archive.com.




---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


RE: [Declude.Virus] New italian virus ?

2003-10-24 Thread Markus Gufler
Ciao Piero,


 I've received a mail which contain the follow italian text:
 Subject: Il momento è catartico
 
 Ricevo e cortesemente inoltro, un premio per la 
 genialità hanno reso mitico un salva schermo scaricalo, 
 poesie catartiche, che non sai cosa ti perdi


Important!!
1.) As I've seen this mass mail worm is sent only from .it domains to .it
recipients.
2.) It looks like is's spreading very very very VERY fast!

Piero: If you've in use Declude Pro you can add a filter list 

Put the follwoing line in your Global.cfg:

TEXTFILTER filter c:\imail\declude\textfilter.txt x 100 0

And create a file Textfilter.txt with the content:

BODY 0 CONTAINS poesie catartiche




More details will follow

Markus


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] New italian virus ?

2003-10-24 Thread Piero
Yes,
Sorry for very stupid question...
How can F-prot block a simple email message with a link ?  My big error...
:-(

Ok for Imal rules and firewall tips... But I manage domain for other
customer and they use they own connection to internet, so I can block IP on
firewall.

Can I use Declude Virus or Junkmail to block on the server the message for
all domains using Subject ?

Thanks.

Piero
Italy

- Original Message - 
From: Jim Matuska [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, October 24, 2003 7:12 PM
Subject: Re: [Declude.Virus] New italian virus ?


 A couple things, first F-Prot and declude on your mail server would not
 block the virus, since if I read your message right is linked to a website
 and not sent as an attachment.  I can think of a couple options for this
 though.  First, you could setup a rule in imail to delete or forward to an
 admin any messages that have that subject.  Another option if you are
 running content filtering software on your internet connect would be to
 block that particular website.  If you really want to get creative you can
 also block the ip address for that site on a router or firewall access
list
 (currently the ip for that site is 66.216.74.58.  Just be aware if you
block
 the ip address of that server and it later changes your acl will no longer
 apply, the same thing with the message subject blocking, if it changes
your
 filters will not longer work.

 Jim Matuska Jr.
 Computer Tech II
 CCNA
 Nez Perce Tribe
 Information Systems
 [EMAIL PROTECTED]
 - Original Message - 
 From: Piero [EMAIL PROTECTED]
 To: [EMAIL PROTECTED]
 Sent: Friday, October 24, 2003 10:02 AM
 Subject: [Declude.Virus] New italian virus ?


  Hi,
  First sorry for my bad english...
 
  I've received a mail which contain the follow italian text:
  Subject: Il momento è catartico
 
  Ricevo e cortesemente inoltro, un premio per la genialità
  hanno reso mitico un salva schermo scaricalo, poesie catartiche, che
non
  sai cosa ti perdi
 
  ciao
 
  The text poesie catartiche is a link to :
  http://www.francescone.com/index.html which prompt to download a scr
file.
  F-prot updated, do not block this file.
 
  But installing screensaver seems that a indipendent Smtp send email to
  address which are in Address List in outlook.
 
  Two question:
  - How to block each email which have il momento è catartico in subject
  - Someone could tell me which email address I can send this file to
check
 if
  it is a virus and to add to new definition ?
 
  Thanks in advance.
 
  Piero
  Italy
 
  ---
  [This E-mail was scanned for viruses by Declude Virus
 (http://www.declude.com)]
 
  ---
  This E-mail came from the Declude.Virus mailing list.  To
  unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
  type unsubscribe Declude.Virus.The archives can be found
  at http://www.mail-archive.com.
 
 


 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

 ---
 This E-mail came from the Declude.Virus mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.Virus.The archives can be found
 at http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.