Re: [Declude.Virus] Good list of SKIPIFVIRUSNAMEHAS
Does anyone have a good list of Virus names to put into the recip.eml file so that I do not notify the recipient that there was a virus. I am using F-Prot if it makes any difference. The sample .eml files in the manual have the ones that we are aware of, so there is no need to swap lists with others. Note that the latest beta handles this automatically. If I have SKIPIFVIRUSNAMEHAS Klez SKIPIFRECIP @DOMAIN.COM Then no one will get Klez virus notifications and everyone @DOMAIN.COM will never get any sort of notification? Is the order important? Correct, and the order is not important. Just remember that the lines must only have one space or tab in them, and they must appear before the first blank line in the .eml file. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Good list of SKIPIFVIRUSNAMEHAS
> > The sample .eml files in the manual have the ones that we are aware of, so > there is no need to swap lists with others. > The sample files that have the SKIPIFVIRUSNAMEHAS statements are sender.txt and otherpostmaster.txt. They both have the same list. I assume that I can use this list for the recip.emp > Note that the latest beta > handles this automatically. What do you mean handles it automatically? Do I not have to put in the commands? Does it not send notifications for all the types in the list in the above files? Can I still send out notifications fro the Vulnerability? Thanx Goran --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Good list of SKIPIFVIRUSNAMEHAS
> The sample .eml files in the manual have the ones that we are aware of, so > there is no need to swap lists with others. The sample files that have the SKIPIFVIRUSNAMEHAS statements are sender.txt and otherpostmaster.txt. They both have the same list. I assume that I can use this list for the recip.emp Actually, those should be sender.eml and otherpostmaster.eml (Declude doesn't use any .txt files). You can just copy those SKIPIFVIRUSNAMEHAS lines to the recip.eml file (assuming that you do not want your users notified when forging viruses are sent to them -- some people like to receive them, others do not). > Note that the latest beta > handles this automatically. What do you mean handles it automatically? It means that you don't have to do anything, and Declude Virus will automatically detect forging viruses and suppress the bogus notifications. Do I not have to put in the commands? No. Does it not send notifications for all the types in the list in the above files? It will not send out the sender/otherpostmaster notifications (the bogus ones) when forging viruses are detected. You can also add a line "SKIPIFFORGING" to other .eml files to prevent them from getting sent out. Can I still send out notifications fro the Vulnerability? It would be possible, but strongly discouraged, as you'll end up becoming a spammer by doing so. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Good list of SKIPIFVIRUSNAMEHAS
> Actually, those should be sender.eml and otherpostmaster.eml (Declude > doesn't use any .txt files). Yes I was just quoting the web site since I could not look at the eml files online :) > > >Can I still send out notifications for the Vulnerability? > > It would be possible, but strongly discouraged, as you'll end up becoming > a > spammer by doing so. > The only notifications that I would be sending out would be to the recipient and not to the sender or the postmaster of the sending domain. I think it is a waste of bandwidth. If the user gets a notification that the file contained a virus and if the user really wants the file then the user will notify the sender and get it fixed. IMHO Goran --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Good list of SKIPIFVIRUSNAMEHAS
> >Can I still send out notifications for the Vulnerability? > > It would be possible, but strongly discouraged, as you'll end up becoming > a spammer by doing so. The only notifications that I would be sending out would be to the recipient and not to the sender or the postmaster of the sending domain. I think it is a waste of bandwidth. If the user gets a notification that the file contained a virus and if the user really wants the file then the user will notify the sender and get it fixed. IMHO Ah, that makes sense. In that case, you can copy the \IMail\Declude\recip.eml file to \IMail\Declude\recip-vulnerability.eml (or whatever name you want), and use a line "ONLYSENDIFVIRUSNAMEHAS Vulnerability" (without any SKIPIFVIRUSNAMEHAS or SKIPIFFORGING lines). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Good list of SKIPIFVIRUSNAMEHAS
> Ah, that makes sense. In that case, you can copy the > \IMail\Declude\recip.eml file to \IMail\Declude\recip-vulnerability.eml > (or > whatever name you want), and use a line "ONLYSENDIFVIRUSNAMEHAS > Vulnerability" (without any SKIPIFVIRUSNAMEHAS or SKIPIFFORGING lines). > OK that is great. Now can I do this? Create a recip-vulnerability.eml with the "ONLYSENDIFVIRUSNAMEHAS Vulnerability" command in it and customize the text to talk about Vulnerabilities. Do I have to change anything in virus.cfg? Also still have the recip.eml file with a bunch of SKIPIFVIRUSNAMEHAS Klez/Vulneravility/etc and SKIPIFFORGING and customize the text in that file to talk about viruses. Will Declude send out either depending on if it is a vulnerability or a virus? Thanx Goran --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Agobot forging variant
> > [EMAIL PROTECTED] > > [EMAIL PROTECTED] > > [EMAIL PROTECTED] > > [EMAIL PROTECTED] > > Thought so. I have added Agabot to the DONOTSENDIFVIRUSNAMEHAS list. > Ahh John I thought the command is "SKIPIFVIRUSNAMEHAS Agobot" in the .eml file? Or is DONOTSENDIFVIRUSNAMEHAS a filter of some sort? Thanx Goran --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Agobot forging variant
> Ahh John I thought the command is "SKIPIFVIRUSNAMEHAS Agobot" in the > .eml file? Or is DONOTSENDIFVIRUSNAMEHAS a filter of some sort? Ah, what is in a name? That is what I get for trying to go off memory at the same time as doing 5 other things. John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Good list of SKIPIFVIRUSNAMEHAS
> Create a recip-vulnerability.eml with the "ONLYSENDIFVIRUSNAMEHAS > Vulnerability" command in it and customize the text to talk about > Vulnerabilities. Do I have to change anything in virus.cfg? > > Also still have the recip.eml file with a bunch of SKIPIFVIRUSNAMEHAS > Klez/Vulneravility/etc and SKIPIFFORGING and customize the text in that > file to talk about viruses. > > Will Declude send out either depending on if it is a vulnerability or a > virus? Correct. However, maybe I should double check my server for the correct names. ;) John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Good list of SKIPIFVIRUSNAMEHAS
This is good. I like it. Thanx Goran Jovanovic The LAN Shoppe > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.Virus- > [EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) > Sent: Tuesday, May 25, 2004 9:57 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.Virus] Good list of SKIPIFVIRUSNAMEHAS > > > Create a recip-vulnerability.eml with the "ONLYSENDIFVIRUSNAMEHAS > > Vulnerability" command in it and customize the text to talk about > > Vulnerabilities. Do I have to change anything in virus.cfg? > > > > Also still have the recip.eml file with a bunch of SKIPIFVIRUSNAMEHAS > > Klez/Vulneravility/etc and SKIPIFFORGING and customize the text in that > > file to talk about viruses. > > > > Will Declude send out either depending on if it is a vulnerability or a > > virus? > > Correct. However, maybe I should double check my server for the correct > names. ;) > > John Tolmachoff > Engineer/Consultant/Owner > eServices For You > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus".The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Agobot forging variant
OK that is fine I just thought it was a new command that I had not seen anywhere and went looking for it. :) Goran Jovanovic The LAN Shoppe > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.Virus- > [EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) > Sent: Tuesday, May 25, 2004 9:56 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.Virus] Agobot forging variant > > > Ahh John I thought the command is "SKIPIFVIRUSNAMEHAS Agobot" in the > > .eml file? Or is DONOTSENDIFVIRUSNAMEHAS a filter of some sort? > > Ah, what is in a name? That is what I get for trying to go off memory at > the > same time as doing 5 other things. > > John Tolmachoff > Engineer/Consultant/Owner > eServices For You > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus".The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
[Declude.Virus] BANnotify.eml
Hi, The documentation shows that the bannotify.eml file send mail back to %MAILFROM%. Can I just modify this to send mail to %ALLRECIPS% instead or is there another .eml file that I should be using to inform the recipient that a banned attachment was dropped? Thanx Goran Jovanovic The LAN Shoppe
Re: [Declude.Virus] BANnotify.eml
bannotify.eml is the only template used for banned extensions or banned file names. You can customize this file to be sent to anyone that you wish. Note that this will only get sent if a banned extension or banned file name is detected AND Declude virus doesn't detect a vunerability or your virus scanner doesn't detect an infection. The incidence of this being sent should be less than 1% of all Declude Virus blocked messages, and most will be the result of encoded zip files if you are configured for that (currently that can't be turned off). The general thought for this is to bounce back to the %MAILFROM% instead of to the recipient, so you can inform the sender that they have sent a type of file that is not accepted on your server, and give them instructions as to how to send the file in a way that passes your system (such as zipping up executables). If it wasn't for banned file names and encrypted archives being bounced, there would hardly be any of these sent out, and I expect that resolving that is high on Scott's list of enhancements, so the condition is hopefully temporary. If you send these notices to local users, you might run the risk of having them tell you to turn them off for their account, in which case they might not realize that a legitimate message was blocked. Maybe that all makes sense? Matt Goran Jovanovic wrote: Hi, The documentation shows that the bannotify.eml file send mail back to %MAILFROM%. Can I just modify this to send mail to %ALLRECIPS% instead or is there another .eml file that I should be using to inform the recipient that a banned attachment was dropped? Thanx Goran Jovanovic The LAN Shoppe -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
