[Declude.Virus] Scanning on forwarded addresses
We run Declude Virus Standard with F-Prot and I am unsure whether a forwarded message is scanned. If an infected message is sent to a domain which is NOT set up for virus scanning, but is then forwarded to a domain which IS in the Virus_Domains list, will it then be quarantined? Thanks, Erik Erik Hjelholt, Managing Director Alberni-dot-Net, a div. of Tandem Security Inc. 4716 Roger St., Port Alberni, BC V9Y 3Z2 Phone: 250-720-8110 - Fax: 250-723-0901 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Scanning on forwarded addresses
We run Declude Virus Standard with F-Prot and I am unsure whether a forwarded message is scanned. If an infected message is sent to a domain which is NOT set up for virus scanning, but is then forwarded to a domain which IS in the Virus_Domains list, will it then be quarantined? The way that IMail works, Declude won't see forwarded E-mails. Therefore, if you set up Declude Virus not to scan an E-mail to one of your users, the E-mail that gets forwarded will not get scanned either. Declude is completely blind to the forwarding. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] Scanning attachments
Does the extension name of a file play in the proper scanning of an attachment? IE: If we rename a ZIP file to say test.ziz to get by the ban on ZIPs. Will it still get scanned ok? (Idea is if I intentional rename the extension and I tell you in the message what I and how to save it, it is not likely to come from a virus sender like MyDoom. It is inconvenient, but so is chasing down virus infected machines.) Thanks, John --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Scanning attachments
Does the extension name of a file play in the proper scanning of an attachment? IE: If we rename a ZIP file to say test.ziz to get by the ban on ZIPs. Will it still get scanned ok? That's up to the virus scanner -- it *should* detect that it is a .ZIP file. F-Prot definitely does. So if it has a virus, it will get caught, even if it is in a .ZIP file with a .ZIZ extension. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Scanning attachments
Of course if the idea catches on, the next big virus will come with a message that states Save the attached zapyou.xxx out to your local hard drive as zapyou.exe, run the program and you'll see naked pictures of Halle Berry! Just playing devil's advocate, I want to find a way to enable zip files too. - Rodney -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of John Carter Sent: Wednesday, January 28, 2004 2:24 PM To: 'Declude Anti-virus Forum' Subject: [Declude.Virus] Scanning attachments Does the extension name of a file play in the proper scanning of an attachment? IE: If we rename a ZIP file to say test.ziz to get by the ban on ZIPs. Will it still get scanned ok? (Idea is if I intentional rename the extension and I tell you in the message what I and how to save it, it is not likely to come from a virus sender like MyDoom. It is inconvenient, but so is chasing down virus infected machines.) Thanks, John --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Scanning Question
Is it possible to not scan an email from a specific sender for vulnerabilities? No. They are tripping the 'blank folding' vuln. and we quarantine it. Thanks, Why do you want them to be allowed to send E-mail with vulnerabilities? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Scanning Question
This question sure seems to come up regularly. Here's my slant: We are a smallish private company, and our clients span the spectrum from private individuals to major multinational behemoths. We have one client in particular that sends us electronic purchase orders generated by their in-house purchasing system, and every one trips the Outlook 'Blank Folding' Vulnerability. I respect the vulnerability scanning without question, and I wouldn't dream of turning it off. So, I monitor the postmaster notices closely, and I drop everything and manually place those purchase orders in the Spool and hope that nobody notices the delay. That outfit is large enough that they don't even REPLY to my hey, your system needs a tiny tweak messages, much less ridicule me for suggesting that their system isn't perfect. It's not a big deal [at least for me and my situation], and if the capability existed to relax things the bare minimum it would take to let just those through, I might not. I'd sit around wondering who would exploit that tiny opportunity, and I already have enough to worry about. But, I would consider it. And I understand why people keep asking for this capability in Declude.Virus. And, to answer your question Scott, I don't. There are just circumstances occasionally that muddy the black and white of it. The consequences of the Outlook 'Blank Folding' Vulnerability can be serious, but I'm looking at a situation where their system, not MS based, is sending an email to my business system, also not MS based. So an Outlook vulnerability isn't in play. But only I know that, I don't expect Declude to. I only expect Declude to continue to do the excellent job it does watching for the vulnerability, no matter what. Thanks. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Wednesday, 12 November 2003 5:09 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Scanning Question Is it possible to not scan an email from a specific sender for vulnerabilities? No. They are tripping the 'blank folding' vuln. and we quarantine it. Thanks, Why do you want them to be allowed to send E-mail with vulnerabilities? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Scanning Question
In this case, you can use the per-user settings to turn off virus scanning completely for the recipient. Scott, Is is possible (using per user settings) to simply suspend the vulnerability scanning, yet still keep the main virus scanning on? Thanks again for your time, Keith --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Scanning Question
Is is possible (using per user settings) to simply suspend the vulnerability scanning, yet still keep the main virus scanning on? No. The vulnerability detection can only be turned on/off globally. For an individual account (or domain), it can only be turned on/off along with virus scanning. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] scanning timeout value
Yes, IMail was processing mail through that period. We started receiving messages at our desktops that did not contain any declude headers, and that was my first indication that something was wrong. The log even shows SMTP refusals based on entries in my kill.lst file, so I'm guessing that IMail SMTP was up. Do you have a C:\Declude.gp1 or C:\Declude.gp2 file, dated when this happened (or more recent)? Unfortunately, I bounced the box before I did a whole lot more investigating at the time, so I don't have much more to go on. I did pull up the remote administrator and look at the queue, and there were many times the usual number of items in the Waiting Items box, but only a single message at a time in the processing items. That's not normal either. What I failed to do was to pull up the task manager and look at the open processes before I restarted the machine. My guess here is that IMail's SMTPD process (which listens for incoming E-mail) was working, and placing files in the spool, but never starting Declude (or the SMTP32.exe process that IMail uses to deliver the E-mail after Declude is done). That would account for why there was only 1 E-mail being processed (that would be the queue run that runs every 30 minutes or so), and a lot of E-mail in the spool. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] scanning timeout value
Nope, no c:\declude.gpx files, I looked for those first. And I agree with your conclusion about what happened, I just wish I had looked at the task manager to see if there were a boatload of smtp32.exe processes sitting in limbo. I'll bet there were. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Wednesday, 22 January 2003 1:38 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] scanning timeout value Yes, IMail was processing mail through that period. We started receiving messages at our desktops that did not contain any declude headers, and that was my first indication that something was wrong. The log even shows SMTP refusals based on entries in my kill.lst file, so I'm guessing that IMail SMTP was up. Do you have a C:\Declude.gp1 or C:\Declude.gp2 file, dated when this happened (or more recent)? Unfortunately, I bounced the box before I did a whole lot more investigating at the time, so I don't have much more to go on. I did pull up the remote administrator and look at the queue, and there were many times the usual number of items in the Waiting Items box, but only a single message at a time in the processing items. That's not normal either. What I failed to do was to pull up the task manager and look at the open processes before I restarted the machine. My guess here is that IMail's SMTPD process (which listens for incoming E-mail) was working, and placing files in the spool, but never starting Declude (or the SMTP32.exe process that IMail uses to deliver the E-mail after Declude is done). That would account for why there was only 1 E-mail being processed (that would be the queue run that runs every 30 minutes or so), and a lot of E-mail in the spool. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] Scanning Process
Title: Scanning Process We are testing two virus scanners with Declude Pro and wanted to confirm or thoughts. Is it true that the scanners scan the file first, whether you have one, two, or five and then once done, the action on the virus is taken (i.e. quarantined)? ___ Keith Johnson, MCP Network Engineer Network Advocates, Inc. Tel: 502.412.1050 Fax: 502.412.1058 Email: [EMAIL PROTECTED] Good pings come in small packets
Re: [Declude.Virus] Scanning Process
We are testing two virus scanners with Declude Pro and wanted to confirm or thoughts. Is it true that the scanners scan the file first, whether you have one, two, or five and then once done, the action on the virus is taken (i.e. quarantined)? That is correct. Declude Virus Pro will check the attachments against all the virus scanners that you have configured, and if any of them report that a virus was detected, Declude Virus will quarantine the E-mail. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] scanning ?
Hi Is this possible: On the gateway server i want to recieve the mail and when its passed to my mailserver it will be scanned by declude. So that the server just recieve the mail without scanning and first when it pass it to the other server it will be scanned on the way out ? Benny --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.Virus] scanning ?
Is this possible: On the gateway server i want to recieve the mail and when its passed to my mailserver it will be scanned by declude. So that the server just recieve the mail without scanning and first when it pass it to the other server it will be scanned on the way out ? I'm not entirely clear what you are looking to do here? With a gateway setup, the gateway server will receive an E-mail, then Declude will scan it, and then it will get delivered to your existing mailserver. Declude would only need to run on the gateway server, it would not need to run on the existing mailserver. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
DSN:Re: [Declude.Virus] scanning ?
Declude scans the e-mail when it is received by IMail. So if you set up a gateway server running Imail and Declude the gateway server will scan the e-mail before it delivers it to your other mail server. Stu At 06:10 PM 04/25/2002 +0200, you wrote: Hi Is this possible: On the gateway server i want to recieve the mail and when its passed to my mailserver it will be scanned by declude. So that the server just recieve the mail without scanning and first when it pass it to the other server it will be scanned on the way out ? Benny --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . - CSOnline Technical Support hours - Monday thru Saturday 7am - 1am CSOnline Technical Support Numbers Seneca814-677-2447 Clarion 814-227-3638 Meadville 814-425-1696 Parker724-399-1158 http://www.csonline.net http://www.cshowcase.com http://www.learncenter.com - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: Re: [Declude.Virus] scanning ?
Yes i know that but what i wanted was that Imail recived it on the gateway and on the way out it to the mailserver it would scan it. this for speeding up the receiving -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of [EMAIL PROTECTED] Sent: 25. april 2002 18:56 To: [EMAIL PROTECTED] Subject: DSN:Re: [Declude.Virus] scanning ? Declude scans the e-mail when it is received by IMail. So if you set up a gateway server running Imail and Declude the gateway server will scan the e-mail before it delivers it to your other mail server. Stu At 06:10 PM 04/25/2002 +0200, you wrote: Hi Is this possible: On the gateway server i want to recieve the mail and when its passed to my mailserver it will be scanned by declude. So that the server just recieve the mail without scanning and first when it pass it to the other server it will be scanned on the way out ? Benny --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . - CSOnline Technical Support hours - Monday thru Saturday 7am - 1am CSOnline Technical Support Numbers Seneca814-677-2447 Clarion 814-227-3638 Meadville 814-425-1696 Parker724-399-1158 http://www.csonline.net http://www.cshowcase.com http://www.learncenter.com - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
