Re: [Declude.Virus] new interim version

2004-10-01 Thread Bennie 
And where do you find these on the website???  I have been looking and cant 
seem to find them anywhere

Bennie
- Original Message - 
From: Peter Lowish [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Thursday, September 30, 2004 7:52 PM
Subject: [Declude.Virus] new interim version


I note a new interim version - Does this fix the GDI false Postive issue?
Thursday, September 30, 2004  3:27 PM   506785 Declude.exe
P
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]


---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] new interim version

2004-10-01 Thread Kami Razvan 
Bennie:

Look at Scott's email:

Yes.  v1.80 has basic (Microsoft method) detection of the GDIPlus.dll
JPEG Exploit, but their way has false positives.  The v1.80i1 interim at
http://www.declude.com/version/interim (and likely tomorrow a 1.81 release)
has full (Declude method) detection of the GDIPlus.dll JPEG Exploit, and
is expected to have no false positives.

All interims are always there.

Kami 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Bennie
Sent: Friday, October 01, 2004 6:16 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] new interim version

And where do you find these on the website???  I have been looking and cant
seem to find them anywhere

Bennie


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

Re: [Declude.Virus] new interim version

2004-10-01 Thread Kevin Rogers 
Newb question: 

How do I install an interim version of Declude?  Just replace the 
declude.exe file?

Thanks
Kevin

Kami Razvan wrote:
Bennie:
Look at Scott's email:
Yes.  v1.80 has basic (Microsoft method) detection of the GDIPlus.dll
JPEG Exploit, but their way has false positives.  The v1.80i1 interim at
http://www.declude.com/version/interim (and likely tomorrow a 1.81 release)
has full (Declude method) detection of the GDIPlus.dll JPEG Exploit, and
is expected to have no false positives.
All interims are always there.
Kami 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Bennie
Sent: Friday, October 01, 2004 6:16 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] new interim version
And where do you find these on the website???  I have been looking and cant
seem to find them anywhere
Bennie
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]

 

---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

Re: [Declude.Virus] new interim version

2004-10-01 Thread R. Scott Perry 

How do I install an interim version of Declude?  Just replace the 
declude.exe file?
That is correct.
   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

[Declude.Virus] F-Prot 3.15b break Declude Virus?

2004-10-01 Thread Don Brown 
I read the thread about this, but I didn't determine the final
conclusion.  Does F-Prot 3.15b break Declude virus?



Don Brown - Dallas, Texas USA Internet Concepts, Inc.
[EMAIL PROTECTED]   http://www.inetconcepts.net
(972) 788-2364Fax: (972) 788-5049


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

Re: [Declude.Virus] F-Prot 3.15b break Declude Virus?

2004-10-01 Thread R. Scott Perry 

I read the thread about this, but I didn't determine the final
conclusion.  Does F-Prot 3.15b break Declude virus?
I'm not aware of it breaking Declude Virus.
   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] F-Prot 3.15b break Declude Virus?

2004-10-01 Thread Kami Razvan 
We have been on B version for 2 weeks or so- no problems here.

We use 3 scanners:  F-Prot, AVG, and McAfee- all are working like one big
happy family.

Kami 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Friday, October 01, 2004 10:03 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] F-Prot 3.15b break Declude Virus?


I read the thread about this, but I didn't determine the final 
conclusion.  Does F-Prot 3.15b break Declude virus?

I'm not aware of it breaking Declude Virus.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just
send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

[Declude.Virus] More CPL Vulnerabilities

2004-10-01 Thread Bob McGregor 
Since upgrading to 1.80 I am seeing many more Invalid CPL Vulnerabilities. Is this 
just timing or is there something different for these vulnerabilities?

The interesting thing about these is that they are coming from spoofed senders 
multiple deliveries at a time.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

Re: [Declude.Virus] More CPL Vulnerabilities

2004-10-01 Thread R. Scott Perry 

Since upgrading to 1.80 I am seeing many more Invalid CPL Vulnerabilities. 
Is this just timing or is there something different for these vulnerabilities?

The interesting thing about these is that they are coming from spoofed 
senders multiple deliveries at a time.
The Invalid CPL Vulnerability detection was added to v1.80 (it was in 
1.79iXX interims as well).  I do not believe any changes were made from 
when it was first implemented.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

[Declude.Virus] Deleting Vulnerability

2004-10-01 Thread John Carter 
Now that 1.80 does not delete vulnerabilities even with DELETEVIRUSES ON,
what is the best way of deleting them?

Thanks,
John

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

Re: [Declude.Virus] More CPL Vulnerabilities

2004-10-01 Thread Bob McGregor 
strange since I had the interim versions, many of them. I do not remember seeing this 
vulnerability especially being spoofed.

I wonder though:
I added a vulnerability.eml
and have 
ONLYSENDIFVIRUSNAMEHAS JPEG Vulnerability

I assumed that the virusname would have to have JPEG Vulnerability, both
words, is this the case?


On Friday, October 1, 2004 8:55 AM, R. Scott Perry [EMAIL PROTECTED] wrote:

Since upgrading to 1.80 I am seeing many more Invalid CPL Vulnerabilities. 
Is this just timing or is there something different for these vulnerabilities?

The interesting thing about these is that they are coming from spoofed 
senders multiple deliveries at a time.

The Invalid CPL Vulnerability detection was added to v1.80 (it was in 
1.79iXX interims as well).  I do not believe any changes were made from 
when it was first implemented.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day
evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

Re: [Declude.Virus] More CPL Vulnerabilities

2004-10-01 Thread R. Scott Perry 

I wonder though:
I added a vulnerability.eml
and have
ONLYSENDIFVIRUSNAMEHAS JPEG Vulnerability
I assumed that the virusname would have to have JPEG Vulnerability, both
words, is this the case?
Correct.
   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] Declude Release 1.81 - Error on Web Site

2004-10-01 Thread Andy Schmidt 
Title: Message



Hi,

there is a slight error on the 
"download" page for your registered customers:

Both "down" arrow buttons link to the 
"automatic install" executable.

Only the "manual install" TEXT link 
actually downloads the zip file.


Use of Version 1.81 requires a Valid Service 
AgreementDownload Now 

  
  

Automatic 
  Install
  

Manual 
  Install



Best 
RegardsAndy SchmidtHM Systems Software, Inc.600 East Crescent 
Avenue, Suite 203Upper Saddle River, NJ 07458-1846Phone: +1 201 934-3414 x20 
(Business)Fax: +1 201 934-9206http://www.HM-Software.com/

RE: [Declude.Virus] Deleting Vulnerability

2004-10-01 Thread Douglas Cohn 
You can run a scheduled task that deletes the contents of the virus folder
every x minutes, hours, days.

DC 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Carter
Sent: Friday, October 01, 2004 11:02 AM
To: [EMAIL PROTECTED]
Subject: [Declude.Virus] Deleting Vulnerability

Now that 1.80 does not delete vulnerabilities even with DELETEVIRUSES ON,
what is the best way of deleting them?

Thanks,
John

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just
send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

Re: [Declude.Virus] Declude Release 1.81 - Error on Web Site

2004-10-01 Thread Jim Matuska 
Title: Message



I didn't even try the graphic links,didn't 
evenknow they were links,but after Andy's email I checked the page 
and for me indeed the graphics both pointed to the full installer link Andy's 
email said.

Jim Matuska Jr.Computer Tech IICCNANez 
Perce TribeInformation Systems[EMAIL PROTECTED]

  - Original Message - 
  From: 
  Douglas Cohn 
  
  To: [EMAIL PROTECTED] 
  Sent: Friday, October 01, 2004 3:15 
  PM
  Subject: RE: [Declude.Virus] Declude 
  Release 1.81 - Error on Web Site
  
  Not true for me.
  
  Not even true of the link you have here in the 
  email. You have some kind of caching going on locally it 
  seems.
  
  DC
  
  
  From: [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED] On Behalf Of Andy 
  SchmidtSent: Friday, October 01, 2004 6:08 PMTo: [EMAIL PROTECTED]Subject: 
  RE: [Declude.Virus] Declude Release 1.81 - Error on Web 
  Site
  
  Hi,
  
  there is a slight error on the 
  "download" page for your registered customers:
  
  Both "down" arrow buttons link to 
  the "automatic install" executable.
  
  Only the "manual install" TEXT link 
  actually downloads the zip file.
  
  
  Use of Version 1.81 requires a Valid Service 
  AgreementDownload Now 
  


  
  Automatic 
Install

  
  Manual 
Install
  
  
  
  Best 
  RegardsAndy SchmidtHM Systems Software, Inc.600 East Crescent 
  Avenue, Suite 203Upper Saddle River, NJ 07458-1846Phone: +1 201 934-3414 x20 
  (Business)Fax: +1 201 934-9206http://www.HM-Software.com/

Re: [Declude.Virus] Declude Release 1.81 - Error on Web Site

2004-10-01 Thread Darin Cox 
Title: Message



Actually, this rebuttal is not true. The 
graphic links do indeed both link to the full installer.
Darin.


- Original Message - 
From: Douglas Cohn 
To: [EMAIL PROTECTED] 
Sent: Friday, October 01, 2004 6:15 PM
Subject: RE: [Declude.Virus] Declude Release 1.81 - Error on Web 
Site

Not true for me.

Not even true of the link you have here in the email. 
You have some kind of caching going on locally it seems.

DC


From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Andy 
SchmidtSent: Friday, October 01, 2004 6:08 PMTo: [EMAIL PROTECTED]Subject: 
RE: [Declude.Virus] Declude Release 1.81 - Error on Web 
Site

Hi,

there is a slight error on the 
"download" page for your registered customers:

Both "down" arrow buttons link to the 
"automatic install" executable.

Only the "manual install" TEXT link 
actually downloads the zip file.


Use of Version 1.81 requires a Valid Service 
AgreementDownload Now 

  
  

Automatic 
  Install
  

Manual 
  Install



Best 
RegardsAndy SchmidtHM Systems Software, Inc.600 East Crescent 
Avenue, Suite 203Upper Saddle River, NJ 07458-1846Phone: +1 201 934-3414 x20 
(Business)Fax: +1 201 934-9206http://www.HM-Software.com/

RE: [Declude.Virus] Declude Release 1.81 - Error on Web Site

2004-10-01 Thread Douglas Cohn 
Title: Message



I am sorry. I misunderstood Graphic/text. I now 
see the graphic is the ARROW which I never attempted to click at 
all.

So when I said it works for me I was referring to the Text 
which for some dumb reason I took as graphic. (yes it's text). 


Both arrows definitely link to the full 
install.





I knewshould have stopped after that third hit 
before BG.


From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Andy 
SchmidtSent: Friday, October 01, 2004 6:24 PMTo: 
[EMAIL PROTECTED]Subject: RE: [Declude.Virus] Declude Release 
1.81 - Error on Web Site

DC,

may be 
my HTMLhas gotten a little rusty- but I think viewing the source 
will settle the argument:

 
TR TD width=74A 
 href="">http://www.declude.com/version/180/Declude_Setup.exe"STRONGIMG 
 height=50  
src=""https://www.declude.com/templates/60/images/orderreview/Icon_Download.gif">https://www.declude.com/templates/60/images/orderreview/Icon_Download.gif" 
 width=50 
border=0/STRONG/A/TD TD 
width=124A  href="">Automatic'>http://www.declude.com/version/181/Declude_Setup.exe"STRONGAutomatic 
 
Install/STRONG/A/TD/TR 
TR TDSTRONGA 
 href="">http://www.declude.com/version/180/Declude_Setup.exe"IMG 
height=50  src=""https://www.declude.com/templates/60/images/orderreview/Icon_Download.gif">https://www.declude.com/templates/60/images/orderreview/Icon_Download.gif" 
 width=50 
border=0/A/STRONG/TD 
TDSTRONGA  href="">Manual'>http://www.declude.com/version/181/declude1.81.zip"Manual 
 
Install/A/STRONG/TD/TR/TBODY/TABLE/DIV

Of 
course, you do realize that theymay have fixed this already (since I cc'ed 
support)?
Best 
RegardsAndy SchmidtHM Systems Software, Inc.600 East Crescent 
Avenue, Suite 203Upper Saddle River, NJ 07458-1846Phone: +1 201 934-3414 x20 
(Business)Fax: +1 201 934-9206http://www.HM-Software.com/ 

  
  -Original Message-From: 
  [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On 
  Behalf Of Douglas CohnSent: Friday, October 01, 2004 06:16 
  PMTo: [EMAIL PROTECTED]Subject: RE: 
  [Declude.Virus] Declude Release 1.81 - Error on Web 
  Site
  Not true for me.
  
  Not even true of the link you have here in the 
  email. You have some kind of caching going on locally it 
  seems.
  
  DC
  
  
  From: [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED] On Behalf Of Andy 
  SchmidtSent: Friday, October 01, 2004 6:08 PMTo: 
  [EMAIL PROTECTED]Subject: RE: [Declude.Virus] Declude 
  Release 1.81 - Error on Web Site
  
  Hi,
  
  there is a slight error on the 
  "download" page for your registered customers:
  
  Both "down" arrow buttons link to 
  the "automatic install" executable.
  
  Only the "manual install" TEXT link 
  actually downloads the zip file.
  
  
  Use of Version 1.81 requires a Valid Service 
  AgreementDownload Now 
  


  
  Automatic 
Install

  
  Manual 
Install
  
  
  
  Best 
  RegardsAndy SchmidtHM Systems Software, Inc.600 East Crescent 
  Avenue, Suite 203Upper Saddle River, NJ 07458-1846Phone: +1 201 934-3414 x20 
  (Business)Fax: +1 201 934-9206http://www.HM-Software.com/

RE: [Declude.Virus] Lines in the virus.cfg file

2004-10-01 Thread Douglas Cohn 



Now that 1.81 is released what is the recommendation by 
DECLUDE (SCOTT) regarding the config file.??

IE do we allow the AV software to scan jpegs by removing 
the line 
SKIPEXT 
 JPG 

or do we allow Declude to take care of it completely 
.

From what I understand (and I know ugotz) the infected 
jpegs are more likely to be in Web Pages then in emails. I am assuming 
from the threads here that people are catching infected jpegs. Or is it 
tests only??

DC



From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Greg 
LittleSent: Thursday, September 30, 2004 12:30 PMTo: 
[EMAIL PROTECTED]Subject: Re: [Declude.Virus] Lines in the 
virus.cfg file
I should eliminate (comment out) at least the JPG line right 
away.The new test (when it's fully ready) provides a great safty net to 
backup the AV programs. The new test will ignore these lines and bad JPEGs will 
be caught.The test is available by install a new interim version of Declude. 
(The test in the current intermin 1.80 has some problems so wait until they are 
resolved or check the other messages for details.)The best advice I've 
seen is to eliminate at least the JPG line, because these lines will prevent the 
AV programs from being called. Until last week, you could safely save some CPU 
time on your e-mail server by not scanning JPEGs.GregSharyn 
Schmidt wrote:

  
  I was looking through my virus.cfg and I noticed 
  the following: 
  # The SKIPEXT option will let you skip scanning of 
  certain file extensions. For # 
  example, a GIF file can't contain a virus, so there is no need to scan 
  it. # 
  SKIPEXT  
  GIF SKIPEXT 
   TXT SKIPEXT  JPG SKIPEXT  
  MPG 
  Should I now allow declude to scan jpg and gif 
  files or is this totally different than the new jpeg vulnerability? 

  Thanks, Sharyn --- [This E-mail scanned for viruses 
by Findlay Internet] --- [This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing 
list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
"unsubscribe Declude.Virus". The archives can be found at 
http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude 
Virus]

RE: [Declude.Virus] Lines in the virus.cfg file

2004-10-01 Thread R. Scott Perry 

Now that 1.81 is released what is the recommendation by DECLUDE (SCOTT) 
regarding the config file.??

IE do we allow the AV software to scan jpegs by removing the line
SKIPEXT JPG
or do we allow Declude to take care of it completely .
That's up to you.
In theory, it shouldn't be necessary to remove the SKIPEXT JPG line, as 
Declude Virus should detect any .JPG file with the vulnerability.  But if 
you are looking to be extra-cautious, you can remove that line.

From what I understand (and I know ugotz) the infected jpegs are more 
likely to be in Web Pages then in emails.
I can't say one way or the other.  Web pages have the disadvantage that it 
is nearly impossible to intercept the JPEG files in transit (whereas E-mail 
can be scanned easily), but then again it is much easier to send a lot of 
E-mails than to get a lot of people to go to a website.

I am assuming from the threads here that people are catching infected 
jpegs.  Or is it tests only??
Tests and false positives with the Microsoft algorithm (from 1.80).  The 
1.81 version shouldn't have any false positives.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

CBL:RE: [Declude.Virus] Deleting Vulnerability

2004-10-01 Thread Markus Gufler 

 Now that 1.80 does not delete vulnerabilities even with 
 DELETEVIRUSES ON, what is the best way of deleting them?

You can try out
www.zcom.it/decludeupdater/ictcleaner.zip 

It's small, easy to use and freeware.

Markus





---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

[Declude.Virus] Another easy one

2004-10-01 Thread Kevin Rogers 
I'm getting an error in my vXXX.log file:
10/01/2004 13:46:27 Qc22200bc00b6e28c Couldn't find console; starting... 
(2).
10/01/2004 13:46:27 Qc22200bc00b6e28c Error starting deccon.exe: 2
10/01/2004 13:46:27 Qc22200bc00b6e28c Scanned: Virus Free [MIME: 2 2058]
10/01/2004 13:46:49 Qc23200bf00b6e28e Couldn't find console; starting... 
(2).
10/01/2004 13:46:49 Qc23200bf00b6e28e Error starting deccon.exe: 2
10/01/2004 13:46:49 Qc23200bf00b6e28e Scanned: Virus Free [MIME: 2 124090]
10/01/2004 13:46:50 Qc213018200cee28b Couldn't find console; starting... 
(2).
10/01/2004 13:46:50 Qc213018200cee28b Error starting deccon.exe: 2

Over and over again.  Is it my path to F-Prot?  Shouldn't be, since it's 
actually scanning and finding viruses.

Thanks for you help.
Kevin
---
[This E-mail was scanned for viruses.]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

Re: [Declude.Virus] Another easy one

2004-10-01 Thread R. Scott Perry 

I'm getting an error in my vXXX.log file:
10/01/2004 13:46:27 Qc22200bc00b6e28c Couldn't find console; starting... (2).
10/01/2004 13:46:27 Qc22200bc00b6e28c Error starting deccon.exe: 2
This one is because you have a line CONSOLE ON in the virus.cfg file, 
which tells Declude to run the \IMail\Deccon.exe file (which displays a 
console showing recent E-mails that arrived, that is required for Declude 
Hijack).  However, that file doesn't appear.

So you can either copy the deccon.exe file to the \IMail directory, or you 
can remove the CONSOLE ON line.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

Re: [Declude.Virus] Another easy one

2004-10-01 Thread Kevin Rogers 
I didn't have anything after the LOGFILE and LOGLEVEL (no mention of 
CONSOLE at all).  So I've added a CONSOLE OFF line after that.  I don't 
have Hijack, so I assume this is the way to get around the error?

Kevin Rogers wrote:
I don't appear to have any string CONSOLE ON in my virus.cfg file
This is my scanfile line
SCANFILEC:\Progra~1\FSI\F-Prot\fpcmd.exe /TYPE /SILENT /NOMEM 
/ARCHIVE=5 /NOBOOT /DUMB /REPORT=report.txt

I just copied it off the manual.

R. Scott Perry wrote:

I'm getting an error in my vXXX.log file:
10/01/2004 13:46:27 Qc22200bc00b6e28c Couldn't find console; 
starting... (2).
10/01/2004 13:46:27 Qc22200bc00b6e28c Error starting deccon.exe: 2

This one is because you have a line CONSOLE ON in the virus.cfg 
file, which tells Declude to run the \IMail\Deccon.exe file (which 
displays a console showing recent E-mails that arrived, that is 
required for Declude Hijack).  However, that file doesn't appear.

So you can either copy the deccon.exe file to the \IMail directory, 
or you can remove the CONSOLE ON line.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail 
mailservers since 2000.
Declude Virus: Ultra reliable virus detection and the leader in 
mailserver vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses.]

---
[This E-mail was scanned for viruses.]
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses.]

---
[This E-mail was scanned for viruses.]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

Re: [Declude.Virus] Another easy one

2004-10-01 Thread R. Scott Perry 

I didn't have anything after the LOGFILE and LOGLEVEL (no mention of 
CONSOLE at all).  So I've added a CONSOLE OFF line after that.  I don't 
have Hijack, so I assume this is the way to get around the error?
Do you have a CONSOLE ON line in your global.cfg file?  It's possible 
that that could cause the error message, too.  If there is no CONSOLE ON 
line, it defaults to CONSOLE OFF, so I'm guessing the message will still 
appear.

Note that the message doesn't affect how Declude functions (except that the 
console won't appear, but that isn't something you were expecting).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

Re: [Declude.Virus] Another easy one

2004-10-01 Thread Kevin Rogers 
Just so you know.  There wasn't a CONSOLE anything in either the two 
files: global.cfg or virus.cfg. 

When I got the 1.81 upgrade, deccon.exe was put into my new Upgrade 1.81 
directory, so I decided to put it in the /Imail directory, and now 
everything is hunky-dorey.  But nonetheless, there was nothing about it 
in my default .cfg files.


R. Scott Perry wrote:

I didn't have anything after the LOGFILE and LOGLEVEL (no mention of 
CONSOLE at all).  So I've added a CONSOLE OFF line after that.  I 
don't have Hijack, so I assume this is the way to get around the error?

Do you have a CONSOLE ON line in your global.cfg file?  It's 
possible that that could cause the error message, too.  If there is no 
CONSOLE ON line, it defaults to CONSOLE OFF, so I'm guessing the 
message will still appear.

Note that the message doesn't affect how Declude functions (except 
that the console won't appear, but that isn't something you were 
expecting).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail 
mailservers since 2000.
Declude Virus: Ultra reliable virus detection and the leader in 
mailserver vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses.]

---
[This E-mail was scanned for viruses.]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

[Declude.Virus] Declude Release 1.81 - Error on Web Site

2004-10-01 Thread Andy Schmidt 
Title: Message




Ouch - even worse, note that the GRAPHICAL buttons link to version 1.80 - 
only the text buttons link to Version 1.81! Seems like someone was in a 
rush?

Everyone better check what they 
downloaded - if you clicked on the graphics, you are running a BAD 
release.

 
TR TD width=74A 
 href="">http://www.declude.com/version/180/Declude_Setup.exe"STRONGIMG 
 height=50  
src=""https://www.declude.com/templates/60/images/orderreview/Icon_Download.gif">https://www.declude.com/templates/60/images/orderreview/Icon_Download.gif" 
 width=50 
border=0/STRONG/A/TD TD 
width=124A  href="">Automatic'>http://www.declude.com/version/181/Declude_Setup.exe"STRONGAutomatic 
 
Install/STRONG/A/TD/TR 
TR TDSTRONGA 
 href="">http://www.declude.com/version/180/Declude_Setup.exe"IMG 
height=50  src=""https://www.declude.com/templates/60/images/orderreview/Icon_Download.gif">https://www.declude.com/templates/60/images/orderreview/Icon_Download.gif" 
 width=50 
border=0/A/STRONG/TD 
TDSTRONGA  href="">Manual'>http://www.declude.com/version/181/declude1.81.zip"Manual 
 
Install/A/STRONG/TD/TR/TBODY/TABLE/DIV