[Declude.Virus] Email virus scanner...
We recently moved our mail server to new hardware. We were using F-Prot version 3.15 with declude for virus scanning. I did not move F-prot over and I do not want to use it because of the license changes since we originally purchased it. We are running Declude 3.13 and was thinking of installing AVG. What version of AVG do I need to purchase and are there any installation tip for Window 2K3. Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
[Declude.Virus] Mime headers question
I have a customer who is trying to send out Midi files as an attachment and his email is getting held because of the mime headers vulnerability. He is using Entourage as his mail client. Is it something about the way he is attaching the Midi file that is causing the issue? Or is it just because it is a midi file. Chuck Schick Warp 8, Inc. 303-421-5140 www.warp8.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
[Declude.Virus] Per-user configuration....
How does declude determine the user to filter? Specifically, if an email is addressed to [EMAIL PROTECTED] but that address is an alias for [EMAIL PROTECTED] and you adjust the settings for [EMAIL PROTECTED] will declude treat the alias the same as a user? Chuck Schick Warp 8, Inc. 303-421-5140 www.warp8.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Per-user configuration....
So if I put in a line in the virus_users.txt file like: [EMAIL PROTECTED] OFF That an email addressed to [EMAIL PROTECTED] would not be scanned and go through to [EMAIL PROTECTED] even though scanning for [EMAIL PROTECTED] is turned on. Chuck Schick Warp 8, Inc. 303-421-5140 www.warp8.com > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry > Sent: Friday, May 14, 2004 2:43 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.Virus] Per-user configuration > > > > >How does declude determine the user to filter? Specifically, if > an email is > >addressed to [EMAIL PROTECTED] but that address is an alias for > >[EMAIL PROTECTED] and you adjust the settings for [EMAIL PROTECTED] will > >declude treat the alias the same as a user? > > For Declude Virus, it will check both addresses. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers > since 2000. > Declude Virus: Ultra reliable virus detection and the leader in > mailserver > vulnerability detection. > Find out what you've been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
[Declude.Virus] I do not think this should of failed.
A soccer club sent an email regarding the location of soccer practice. Declude appeared to catch it because of a yahoo map link to the soccer fields. It would seem to be a common practice for someone to use a map link for directions. Copy of logfile below. How do we prevent this from happening in the future? I do not have any clout with Yahoo so I doubt I could get them to change their nomenclature. Chuck Schick Warp 8, Inc. 303-421-5140 www.warp8.com 07/13/2004 11:22:49 Q1a685ae Scanned: Virus Free [MIME: 1 878] 07/13/2004 11:22:50 Q1a6a5ae MIME file: [text/html][quoted-printable; Length=7413 Checksum=565729] 07/13/2004 11:22:50 Q1a6a5ae MIME file: mp16_a.gif [base64; Length=195 Checksum=19772] 07/13/2004 11:22:50 Q1a6a5ae MIME file: mp16_b.gif [base64; Length=146 Checksum=17348] 07/13/2004 11:22:50 Q1a6a5ae MIME file: mp22_r.gif [base64; Length=442 Checksum=36673] 07/13/2004 11:22:50 Q1a6a5ae MIME file: mp22_l.gif [base64; Length=408 Checksum=31308] 07/13/2004 11:22:50 Q1a6a5ae Outlook 'Long Filename' Vulnerability 07/13/2004 11:22:50 Q1a6a5ae MIME file: overviewmap_OVMAPDATA=Ypg91eR32XWTWSco9NwX6snk0KVRpsRh.tpax9mLk [base64; Length=21737 Checksum=2421076] 07/13/2004 11:22:50 Q1a6a5ae MIME file: overviewmap_OVMAPData=Ypg91eR32XWTWSco9NwX6snk0KVRpsRh.tpax9mLk [base64; Length=9059 Checksum=925358] 07/13/2004 11:22:51 Q1a6a5ae File(s) are INFECTED [[Outlook 'Long Filename' Vulnerability]: 0] 07/13/2004 11:22:51 Q1a6a5ae Scanned: CONTAINS A VIRUS [MIME: 8 42955] 07/13/2004 11:22:51 Q1a6a5ae From: [Email Protected] To: [Email Protected] [incoming from 208.158.64.2] 07/13/2004 11:22:51 Q1a6a5ae Subject: FW: Training Week of July 12th 07/13/2004 11:22:52 Q1a6b5ae Warning: EOF in middle of MIME segment [] [--= Multipart Boundary 93821.2] 07/13/2004 11:22:52 Q1a6b5ae WARNING: EOF in multipart processing. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] I do not think this should of failed.
The real issue is not one with our client base rather the other quarter of a million people who are not our clients but send email to our servers. When that email does not make it through it creates a problem for me. Chuck Schick Warp 8, Inc. 303-421-5140 www.warp8.com > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Doug Anderson > Sent: Wednesday, July 14, 2004 4:33 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.Virus] I do not think this should of failed. > > > We have the same problem. > > DO NOT USE the email map link on the page > > Copy and paste the link/url into an email or email link directly from the > browser to the user. The url contains all the info for creating the map. > > - Original Message - > From: "R. Scott Perry" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Wednesday, July 14, 2004 4:13 PM > Subject: Re: [Declude.Virus] I do not think this should of failed. > > > > > > >A soccer club sent an email regarding the location of soccer practice. > > >Declude appeared to catch it because of a yahoo map link to the soccer > > >fields. It would seem to be a common practice for someone to use a map > link > > >for directions. Copy of logfile below. > > > > > >How do we prevent this from happening in the future? I do > not have any > > >clout with Yahoo so I doubt I could get them to change their > nomenclature. > > > > Unfortunately, filenames longer than 256 characters are very unsafe. If > > Yahoo chooses to use filenames greater than 256 characters, they need to > > understand that their E-mails are going to be blocked. It sounds like > > Yahoo just changed their file naming system. > > > > Note that it is fine for them to have a *link* that is longer than 256 > > characters, it is only the filename that has the problem. In this case, > > the filename was > > > "overviewmap_OVMAPDATA=Ypg91eR32XWTWSco9NwX6snk0KVRpsRh.tpax9mLk" followed > > by at least > > 158 more characters. > > > > In general, if the average person isn't going to be able to type a > filename > > without making a typo after a few tries, it shouldn't be used as a > filename. > > > > -Scott > > --- > > Declude JunkMail: The advanced anti-spam solution for IMail mailservers > > since 2000. > > Declude Virus: Ultra reliable virus detection and the leader in > mailserver > > vulnerability detection. > > Find out what you've been missing: Ask for a free 30-day evaluation. > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.Virus mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus".The archives can be found > > at http://www.mail-archive.com. > > > > *Scanned for viruses by Declude Virus* > > > > > > > *Scanned for viruses by Declude Virus* > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
[Declude.Virus] New Virus!??!
I have received two suspicious emails this morning with the attachment of newprice.zip. Obviously neither AVG on my desktop nor FProt on the server have flagged it as a virus. But since I know neither of the senders it looks like a virus. Anyone know anything about it. Chuck Schick Warp 8, Inc. 303-421-5140 www.warp8.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
[Declude.Virus] Viruses getting through...
We are running Declude Pro with Fprot and we see a lot of viruses getting through with the attachment of Joke.com, Joke.exe, Price.com - Anyone else seeing the same thing? It appears to be the beagle variant. Any suggestions on how to fix. Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
[Declude.Virus] Viruses appearing to be getting through...
I am seeing several files getting through that appear to have viruses attached as zip files. I am running Declude with F-Prot. We ban encrypted zips and I have error code 8 included. Anyone else seeing this behavior? Here is part of the log. 05/02/2005 10:34:20 Q568a382 MIME file: account_info-text.zip [base64; Length=53728 Checksum=5837399] 05/02/2005 10:34:21 Q568a382 Scanned: Virus Free [MIME: 2 53979] Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
[Declude.Virus] Is this sort of stuff necessary on a list?
I posted to list about a virus problem then I get this stupid (IMHO) challenge-response stuff. If everyone did this on all the lists I belong to - I would do a posting and then spend the next 3 days answering all the challenge-responses. I think I will report this as spam. Dear Greg Hedgepath - get a clue. Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com Dear Chuck, Thanks for your email, but at this point I have NOT actually received your message because I have implemented a challenge-response based anti-spam solution. Before I can receive your message you must respond in ONE of the ways outlined below. --- CLICK ON THE URL --- Visit the following URL and follow the simple instructions. When you do this I will receive the message you sent and ALL future messages. http://spambot.ahphosting.net/?key=6811e93e.42766ac2.5a637c50 If the above URL does not appear all on one line, copy and paste it into your browser's address bar. PLEASE NOTE: If you receive an error message when attempting to visit the above URL, it is very likely that your network is not allowing you to visit my confirmation page. If this is the case, contact your network administrator for help, or contact me by telephone. You will not have to do this again. --- REPLY TO THIS MESSAGE --- Simply reply to this email message ensuring the subject of your reply contains the subject of this message. When your reply arrives I will receive your ORIGINAL message and all FUTURE messages. Or as an alternate method follow these instructions: If you do not respond within 7 days, your message will be DELETED and I will not be able to receive messages from you in the future. I apologize for this small one-time inconvenience, but I have been forced to implement this challenge-response based anti-spam solution to eliminate 100% of the spam I receive, and it really works! To learn more about the software I am using to stop spam, please visit http://www.Zaep.com/. Zaep has stopped 100% of all the spam messages I was receiving every day. Thank you, Greg Hedgepath --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Viruses appearing to be getting through...
F-Prot Seems to be catching it now as X-Declude-Virus: Detected W32/[EMAIL PROTECTED] Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Monday, May 02, 2005 12:55 PM To: Declude.Virus@declude.com Subject: RE: [Declude.Virus] Viruses appearing to be getting through... Mine has the 01:32 PM time stamp and the last update time was at 10:00 AM which is after when I saw the problem, so I would have to say the 01:32 time stamp is the problem one. John T eServices For You > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > On Behalf Of Colbeck, Andrew > Sent: Monday, May 02, 2005 11:38 AM > To: Declude.Virus@declude.com > Subject: RE: [Declude.Virus] Viruses appearing to be getting > through... > > F-Prot may have already fixed their pattern file. My current sign.def > is timestamped: > > 05/02/2005 03:53 AM > > and checking their website and downloading the current version > manually shows that the current version is: > > 05/02/2005 01:32 PM > > Can anybody with the issue confirm which pattern file they are using > that has the problem? > > Andrew 8) > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry > Sent: Monday, May 02, 2005 11:20 AM > To: Declude.Virus@declude.com > Subject: Re: [Declude.Virus] Viruses appearing to be getting > through... > > > Yep, these are being detected by NAI (W32/[EMAIL PROTECTED]) and ClamAV > (Worm.Sober.P), but not yet being detected by TrendMicro or F-Prot > (although I have F-Prot updates disabled for now, until they get there > problem with > HTML/[EMAIL PROTECTED] fixed). > > Bill > - Original Message - > From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> > To: > Sent: Monday, May 02, 2005 11:11 AM > Subject: RE: [Declude.Virus] Viruses appearing to be getting > through... > > > >I saw a big bunch about 2 hours ago that were stopped by banned zip > >extensions. > > > > John T > > eServices For You > > > > > >> -Original Message- > >> From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] > >> On Behalf Of Chuck Schick > >> Sent: Monday, May 02, 2005 10:58 AM > >> To: Declude. Virus > >> Subject: [Declude.Virus] Viruses appearing to be getting through... > >> > >> I am seeing several files getting through that appear to have > >> viruses > > >> attached as zip files. I am running Declude with F-Prot. We ban > > encrypted > >> zips and I have error code 8 included. Anyone else seeing this > >> behavior? Here is part of the log. > >> > >> > >> 05/02/2005 10:34:20 Q568a382 MIME file: account_info-text.zip > >> [base64; Length=53728 Checksum=5837399] 05/02/2005 10:34:21 > >> Q568a382 > >> Scanned: Virus Free [MIME: 2 53979] > >> > >> Chuck Schick > >> Warp 8, Inc. > >> (303)-421-5140 > >> www.warp8.com > >> > >> --- > >> This E-mail came from the Declude.Virus mailing list. To > >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >> type "unsubscribe Declude.Virus".The archives can be found > >> at http://www.mail-archive.com. > > > > --- > > This E-mail came from the Declude.Virus mailing list. To > > unsubscribe, > > > just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus".The archives can be found > > at http://www.mail-archive.com. > > > > --- > This E-mail came from the Declude.Virus mailing list. To unsubscribe, > just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus".The archives can be found > at http://www.mail-archive.com. > --- > This E-mail came from the Declude.Virus mailing list. To unsubscribe, > just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus".The archives can be found > at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
[Declude.Virus] F-Prot Alternative
We have been running F-prot as the virus scanner with Declude for over a year but lately it seems to have more and more bugs in it. What do others recommend as low-cost scanners to work with declude? Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
