RE: [Declude.Virus] AVG antivirus did not work

[David Barker]

The error means that the AVG database failed to initialize. Did you do a
manual upgrade? 

 

One way to try resolve this is to delete all the files in
C:\SmarterMail\declude\scanners\avg\db then restart decludeproc, wait for
the new AVG signature to come down. Once the new signature file is down does
the error go away? If not email supp...@declude.com and we can help you
resolve the problem.

 

David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 office
978.988.1311 fax
  dbar...@declude.com

 

-declude -dnsstuff

 

 

 

 

From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Mon
Mariola - Rubén
Sent: Wednesday, February 02, 2011 3:08 PM
To: declude.virus@declude.com
Subject: [Declude.Virus] AVG antivirus did not work

 

Today I have noticed that my AVG antivirus did not work. I really think a
long time that does not work.

My version of Declude was 4.10.48.
When looking at the file vir0202.log:

 

02/02/2011 00:02:07.505 453300649.eml Log Level set to MID
02/02/2011 00:02:07.520 453300649 Vulnerability flags = 343
02/02/2011 00:02:07.567 453300649 Error: AVG Initialize Fail (5)
02/02/2011 00:02:07.567 453300649 Scanned: Virus Free [MIME: 2 25857]
02/02/2011 00:02:22.677 453300650 Vulnerability flags = 343
02/02/2011 00:02:22.708 453300650 Error: AVG Initialize Fail (5)
02/02/2011 00:02:22.723 453300650 Scanned: Virus Free [MIME: 2 26260]

I upgraded Declude to version 4.10.58. Still does not run the AVG antivirus.
And the logs are showing the same error.

 

02/02/2011 20:20:32.574 453317098 Vulnerability flags = 351
02/02/2011 20:20:32.605 453317098 Error: AVG Initialize Fail (5)
02/02/2011 20:20:32.605 453317098 Scanned: Virus Free [MIME: 1 18517]
02/02/2011 20:20:56.043 453317101 Vulnerability flags = 351
02/02/2011 20:20:56.277 453317101 Error: AVG Initialize Fail (5)
02/02/2011 20:20:56.418 453317101 Scanned: Virus Free [Prescan OK][MIME: 2
959768]

I looked at the folder declude\scanners\avg\db and see this:

 

 Directorio de C:\SmarterMail\declude\scanners\avg\db

 

02/02/2011  20:26 .
02/02/2011  20:26 ..
02/02/2011  20:230 avi7.avg
02/02/2011  20:26   70.627.222 incavi.avm
02/02/2011  20:230 microavi.avg
02/02/2011  20:230 miniavi.avg
   4 archivos 70.627.222 bytes


If I stop Declude, I delete these files and I start Declude, after a few
minutes its are recreated with the same sizes.


What is the problem?

 

Rubén Martí.
Món Mariola, S.L.


---
[This E-mail was scanned by Declude] 


---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com. 




---
[This E-mail was scanned by Declude]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.


image001.png
Description: Binary data


image002.png
Description: Binary data

RE: [Declude.Virus] AVG reports "SPAM" as "VIRUS"!

[Andy Schmidt]

Dave - you are right! This appears to a matter of poor "labeling" by AVG -
and has nothing to do with Declude.

 

I have since looked through a large sample of held emails and they either
are well crafted short "Notices" about a supposed change in SMTP, POP
settings - which even lists the person's email address, and a warning to
"carefully" read the enclosed "instructions" before making changes. Then
there is a link to a ZIP file (which likely will be a virus).

 

The other group of emails deals with a supposed non-deliverable DHL package
that one needs to pick up at the post office after printing the attached
label (with the link to a zip file).

 

All appears to be emails with links to malicious pages. In that respect, one
can't argue that Declude Virus is the appropriate place to catch that (but
then it's inconsistent for AVG to detect it with a label "Spam").

 

You are further correct, that AVG has done a good job catching this one. I
ran it past ClamD and the latest McAfee hourly signature - and neither
flagged those emails.

 

 

From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David
Barker
Sent: Wednesday, May 12, 2010 12:20 PM
To: declude.virus@declude.com
Subject: RE: [Declude.Virus] AVG reports "SPAM" as "VIRUS"!

 

Looks like it is part of their virus signatures, and the only line in the
email was:http://glunis.g**glegroups.com/web/setup.zip

 

We could request that they change the name. if not we will have to make an
translation in our code to accommodate this.

 

File 45710617.eml received on 2010.05.12 16:16:29 (UTC)
Current status: Loading ... queued waiting scanning finished NOT FOUND
STOPPED 

http://www.virustotal.com/img/loader.gif

Result: 1/41 (2.44%)



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.<>

RE: [Declude.Virus] AVG reports "SPAM" as "VIRUS"!

[David Barker]

Andy,

 

My point was not that one shouldn't post to the list, we appreciate user
input no matter how we feel about it, an open forum is very important for
both Declude and users. All I am saying is if you had emailed us first then
we could stike the assumption that we "dumped" a new spam tests into virus
handling as you suggested.

 

"While I'm certainly in favor of any additional SPAM detection - but then it
needs to be PROPERLY IMPLEMENTED as part of Declude JunkMail not just
"dumped" into the regular virus handling!"

 

And then we could focus on the real issue of why is AVG reporting SPAM.
Working together to solve a problem is the goal, so let's rule out the
things we know it is not.

 

David

 

 

From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Andy
Schmidt
Sent: Wednesday, May 12, 2010 11:35 AM
To: declude.virus@declude.com
Subject: RE: [Declude.Virus] AVG reports "SPAM" as "VIRUS"!

 

Dave,

 

I'm aware it's integrated in Declude Virus - that's why I chose the CORRECT
list to discuss this.

I referenced Declude Junkmail, because IF AVG is now reporting "SPAM", the
THAT part SHOULD be handled as part of Declude Junkmail NOT as Declude
Virus.

 

I choose to use the list, whenever I have expended some time to track down a
situation and realize that this will affect all users and thus will save
everyone time from working on the same issue. That's the whole point of the
list!

 

Consequently, whenever AVG stops working altogether (which was doubted both
times when I discovered it - until eventually it was determined to have been
a problem after all), I will continue to report this on the list, because
everyone needs to be aware that their internal scanner may be
non-functioning for extended periods of time. The alternative would be for
Declude to post an alert!

 

When I notice that the Sniffer implementation has objectively incorrect or
incomplete sample files, or have sample files that don't make it obvious
that some IP based results will be triple-counted, then I feel justified in
discussing this on the list as this will benefit OTHER users who don't have
to re-learn what took me days to figure out.

 

I will post on the list whenever I'm hoping to solicit feedback from a
broader audience, to see if a situation I encountered was "isolated" or
turns out to be more widespread.

 

I will contact support@ whenever I suspect that I may have an isolated
problem that needs to be analyzed first.

 

In my opinion, I usually use the appropriate "venue". But I accept that you
may disagree and prefer that the list is quiet.

 

Best Regards,

Andy

 

From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David
Barker
Sent: Wednesday, May 12, 2010 10:59 AM
To: declude.virus@declude.com
Subject: RE: [Declude.Virus] AVG reports "SPAM" as "VIRUS"!

 

Andy,

 

AVG is not integrated with Declude JM, this is AVG reporting the name of the
virus as spam. 

 

Now, something may have changed that AVG is now detecting spam in their
signatures however we were not made aware of this by AVG I will look further
into this.

 

As much as we do appreciate your feedback which helps Identify such
problems, in some things  it may be more helpful to first approach
<mailto:supp...@declude.com> supp...@declude.com or myself
dbar...@declude.com before engaging everyone in the list, your assumptions
of  "PROPERLY IMPLEMENTED as part of Declude JunkMail not just "dumped" into
the regular virus handling!" and " Declude MUST recognize that and NOT treat
it like a virus" are rather harsh to be posting to without having all the
facts to begin with.

 

Thanks

 

David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 office
978.988.1311 fax
 <mailto:dbar...@declude.com> dbar...@declude.com

 

 

From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Andy
Schmidt
Sent: Wednesday, May 12, 2010 10:39 AM
To: declude.virus@declude.com
Subject: [Declude.Virus] AVG reports "SPAM" as "VIRUS"!
Importance: High

 

Hi,

 

For the past few days, I'm seeing AVG suddenly reporting a virus "SPAM":

 

 


Virus Scanner Summary Report (Integrated AVG Scanner)


Total Messages Processed: 19,499
Virus Infected Messages: 232
Percentage Infected: 1.19%


VIRUS

# INFECTED

PERCENTAGE



SPAM

232

1.19%



 

resulting in these SMTP headers:

 

X-Declude-Virus: Detected Spam [from IP 41.218.0.202 ([No Reverse DNS])].

 

and these reports:

 

q061a000274936c02.smd AVG Reports VIRUS: Spam

q061a000274936c02.smd File(s) are INFECTED [Spam: 7]

q061a000274936c02.smd Scanned: CONTAINS A VIRUS [MIME: 1 424]

q061a000274936c02.smd From: bloodiest...@rcbassociats.com To:
elopre...@??? [incoming from 

RE: [Declude.Virus] AVG reports "SPAM" as "VIRUS"!

[Andy Schmidt]

Dave,

 

I'm aware it's integrated in Declude Virus - that's why I chose the CORRECT
list to discuss this.

I referenced Declude Junkmail, because IF AVG is now reporting "SPAM", the
THAT part SHOULD be handled as part of Declude Junkmail NOT as Declude
Virus.

 

I choose to use the list, whenever I have expended some time to track down a
situation and realize that this will affect all users and thus will save
everyone time from working on the same issue. That's the whole point of the
list!

 

Consequently, whenever AVG stops working altogether (which was doubted both
times when I discovered it - until eventually it was determined to have been
a problem after all), I will continue to report this on the list, because
everyone needs to be aware that their internal scanner may be
non-functioning for extended periods of time. The alternative would be for
Declude to post an alert!

 

When I notice that the Sniffer implementation has objectively incorrect or
incomplete sample files, or have sample files that don't make it obvious
that some IP based results will be triple-counted, then I feel justified in
discussing this on the list as this will benefit OTHER users who don't have
to re-learn what took me days to figure out.

 

I will post on the list whenever I'm hoping to solicit feedback from a
broader audience, to see if a situation I encountered was "isolated" or
turns out to be more widespread.

 

I will contact support@ whenever I suspect that I may have an isolated
problem that needs to be analyzed first.

 

In my opinion, I usually use the appropriate "venue". But I accept that you
may disagree and prefer that the list is quiet.

 

Best Regards,

Andy

 

From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David
Barker
Sent: Wednesday, May 12, 2010 10:59 AM
To: declude.virus@declude.com
Subject: RE: [Declude.Virus] AVG reports "SPAM" as "VIRUS"!

 

Andy,

 

AVG is not integrated with Declude JM, this is AVG reporting the name of the
virus as spam. 

 

Now, something may have changed that AVG is now detecting spam in their
signatures however we were not made aware of this by AVG I will look further
into this.

 

As much as we do appreciate your feedback which helps Identify such
problems, in some things  it may be more helpful to first approach
<mailto:supp...@declude.com> supp...@declude.com or myself
dbar...@declude.com before engaging everyone in the list, your assumptions
of  "PROPERLY IMPLEMENTED as part of Declude JunkMail not just "dumped" into
the regular virus handling!" and " Declude MUST recognize that and NOT treat
it like a virus" are rather harsh to be posting to without having all the
facts to begin with.

 

Thanks

 

David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 office
978.988.1311 fax
 <mailto:dbar...@declude.com> dbar...@declude.com

 

 

From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Andy
Schmidt
Sent: Wednesday, May 12, 2010 10:39 AM
To: declude.virus@declude.com
Subject: [Declude.Virus] AVG reports "SPAM" as "VIRUS"!
Importance: High

 

Hi,

 

For the past few days, I'm seeing AVG suddenly reporting a virus "SPAM":

 

 


Virus Scanner Summary Report (Integrated AVG Scanner)


Total Messages Processed: 19,499
Virus Infected Messages: 232
Percentage Infected: 1.19%


VIRUS

# INFECTED

PERCENTAGE



SPAM

232

1.19%



 

resulting in these SMTP headers:

 

X-Declude-Virus: Detected Spam [from IP 41.218.0.202 ([No Reverse DNS])].

 

and these reports:

 

q061a000274936c02.smd AVG Reports VIRUS: Spam

q061a000274936c02.smd File(s) are INFECTED [Spam: 7]

q061a000274936c02.smd Scanned: CONTAINS A VIRUS [MIME: 1 424]

q061a000274936c02.smd From: bloodiest...@rcbassociats.com To:
elopre...@??? [incoming from 41.218.0.202]

q061a000274936c02.smd Subject: Please attention!

 

This causes a whole bunch of problems, e.g.

 

a)  I am unable to 'weigh' this "Spam" with other factors BEFORE it gets
blocked. 

b)  It bypasses the "WhiteList" feature (from the user's Webmail
Contacts)

c)   It's treated like a "Virus", hundreds of the configured virus
notices are being emailed, etc.

 

While I'm certainly in favor of any additional SPAM detection - but then it
needs to be PROPERLY IMPLEMENTED as part of Declude JunkMail not just
"dumped" into the regular virus handling!

 

If AVG reports to Declude the virus name "Spam", then Declude MUST recognize
that and NOT treat it like a virus (or at least give us a config option NOT
to.)

 

Best Regards,

Andy

 

 

 


---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.Vir

RE: [Declude.Virus] AVG reports "SPAM" as "VIRUS"!

[David Barker]

Andy,

 

AVG is not integrated with Declude JM, this is AVG reporting the name of the
virus as spam. 

 

Now, something may have changed that AVG is now detecting spam in their
signatures however we were not made aware of this by AVG I will look further
into this.

 

As much as we do appreciate your feedback which helps Identify such
problems, in some things  it may be more helpful to first approach
 supp...@declude.com or myself
dbar...@declude.com before engaging everyone in the list, your assumptions
of  "PROPERLY IMPLEMENTED as part of Declude JunkMail not just "dumped" into
the regular virus handling!" and " Declude MUST recognize that and NOT treat
it like a virus" are rather harsh to be posting to without having all the
facts to begin with.

 

Thanks

 

David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 office
978.988.1311 fax
  dbar...@declude.com

 

 

From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Andy
Schmidt
Sent: Wednesday, May 12, 2010 10:39 AM
To: declude.virus@declude.com
Subject: [Declude.Virus] AVG reports "SPAM" as "VIRUS"!
Importance: High

 

Hi,

 

For the past few days, I'm seeing AVG suddenly reporting a virus "SPAM":

 

 


Virus Scanner Summary Report (Integrated AVG Scanner)


Total Messages Processed: 19,499
Virus Infected Messages: 232
Percentage Infected: 1.19%


VIRUS

# INFECTED

PERCENTAGE



SPAM

232

1.19%



 

resulting in these SMTP headers:

 

X-Declude-Virus: Detected Spam [from IP 41.218.0.202 ([No Reverse DNS])].

 

and these reports:

 

q061a000274936c02.smd AVG Reports VIRUS: Spam

q061a000274936c02.smd File(s) are INFECTED [Spam: 7]

q061a000274936c02.smd Scanned: CONTAINS A VIRUS [MIME: 1 424]

q061a000274936c02.smd From: bloodiest...@rcbassociats.com To:
elopre...@??? [incoming from 41.218.0.202]

q061a000274936c02.smd Subject: Please attention!

 

This causes a whole bunch of problems, e.g.

 

a)  I am unable to 'weigh' this "Spam" with other factors BEFORE it gets
blocked. 

b)  It bypasses the "WhiteList" feature (from the user's Webmail
Contacts)

c)   It's treated like a "Virus", hundreds of the configured virus
notices are being emailed, etc.

 

While I'm certainly in favor of any additional SPAM detection - but then it
needs to be PROPERLY IMPLEMENTED as part of Declude JunkMail not just
"dumped" into the regular virus handling!

 

If AVG reports to Declude the virus name "Spam", then Declude MUST recognize
that and NOT treat it like a virus (or at least give us a config option NOT
to.)

 

Best Regards,

Andy

 

 

 


---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com. 



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] AVG Update

[Colbeck, Andrew]

That's very good news, David.
 
I suggest an entry on the Declude.com website, either public or in the
members' account area, that shows the current datestamp for when an
update was made available on the Declude.com webserver, and if relevant,
the update number that AVG gets it.
 
In this way, those who are out of date can see directly how far out of
date they are, and whether the problem is on their end, such as the
maintenance agreement being out of date.
 
The update number would only be of interest to users of other AVG
software, and who are perhaps used to going to the AVG website.
 
In that area of the website would also be a link to a support article
which describes the update cycle (from the point of view of a person
maintaining their Declude installation) and the entry in the declude.cfg
file.
 
 
Andrew.
 
 
 



From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of
David Barker
Sent: Monday, December 29, 2008 12:48 PM
To: declude.virus@declude.com
Subject: [Declude.Virus] AVG Update



I have tracked the issue. The process used to be automated but from what
I understand  some server changes were made and we are currently running
in manual mode, hence the reason for some delays over the holidays. I
will have this resolved and on an automated procedure with failover
checking asap. (I will have to plan this but for now I am thinking no
later than end of  January). Although we have many "to do's" on our list
this is a high priority. If there are any suggestions around this
procedure - post them to the list , I cannot promise on suggestions but
there may be something we can do.

 

David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 office
978.988.1311 fax
dbar...@declude.com  

 


---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com. 


---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] AVG update

[Andy Schmidt]

Thank you - that is helpful for our understanding.

Would it be practical to take the "human element" out of the loop and just
have a scheduled script use WGET or similar batch application check for an
updated file on their HTTP server every hour? If the returncode indicates a
new file, download it and make it available without needing manual
intervention?

That's how many of us retrieve signature updates for third party scanners
several times daily.

-Original Message-
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David
Barker
Sent: Monday, December 29, 2008 3:11 PM
To: declude.virus@declude.com
Subject: [Declude.Virus] AVG update

An FYI on the AV process.

Declude receives from AVG an email (example below) this is typically once
per day. On occasion we may get several per day or one in two days. As soon
as this email is received we download the latest definitions to our AVG
server and the definitions are available for your Decludeproc to retrieve.
Now depending on when this last check was done by your Declude - will
determine when you will get the AV sigs or what the time difference is
between release and update.



The following virus database update has been prepared for you to download. 

--- SDK VDB Update Description ---
New Viruses: 
New Trojans: 
New Virus Variants: 
New Trojan Variants: Agent.ARGZ, Downloader.Zlob.AIFA, Generic12.AGYE,
BackDoor.Hupigon4.AXIM, Agent.ARLN, BackDoor.Generic10.AFRU

--- SDK VDB Update Files ---
avgsdk_ivdb2422.zip
avgsdk_vdb2422.zip

--- SDK VDB version.nfo ---
VDB_RELEASE_VERSION: 2422
PREVIOUS_VDB_RELEASE_VERSION: 2421
SEVERITY: critical
VDB_RELEASE_DATE: 2008-12-28 14:23
MODIFIED: microavi.avg
MODIFIED: incavi.avm
VDB_FILES_VERSION: 270.10.1/1867
REQUIRED_BIN_RELEASE_VERSION: 1.3.510

--- SDK VDB Update Notification End ---



David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 office
978.988.1311 fax
dbar...@declude.com






---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] AVG Antivirus AVG7CORE.SYS IOCTL Handler Privilege Escalation

[David Barker]

Mark,

 

As we use the AVG SDK which integrates with Declude we do not use the
AVG7CORE.SYS device driver. So this should not be an issue.

 

David

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark
Reimer
Sent: Thursday, July 12, 2007 10:11 AM
To: declude.virus@declude.com
Subject: [Declude.Virus] AVG Antivirus AVG7CORE.SYS IOCTL Handler Privilege
Escalation

 

David,

Is the built-in AVG affected by this?

 

http://secunia.com/advisories/25998/

 

Mark Reimer

IT System Admin

American CareSource

972-308-6887

 


---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com. 



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] AVG Virus updates - No updates from declude since 4/7/7

[David Barker]

Having checked with AVG, they have made some structural changes to the
database this does not effect everybody, we will be providing a fix for this
today. Any customer who is running a subscription or ZEROHOUR is protected
by the added layer of virus security. Declude provides the ability for
multilayer protection by supporting up to 5 additional virus scanners. If
you are only running AVG and are affected by this change I can suggest
configuring ClamWin until you are able to do the upgrade.

1. Download and Install ClamWin to the default locations
http://superb-west.dl.sourceforge.net/sourceforge/clamwin/clamwin-0.90.1.1-s
etup.exe

2. Add the following lines to your virus.cfg file.

#CLAMAV

SCANFILE C:\Progra~1\clamwin\bin\clamscan.exe --verbose
--database="C:\docume~1\alluse~1\.clamwin\db" --tempdir="c:\Temp"
--no-summary -l report.txt

VIRUSCODE 1 

As far as the file dates are concerned. Not every file needs to have the
latest date as the updates and new virus signatures are incremental. As long
as you have a file dated 14/15 Apr 2007 you are ok, but will need to upgrade
when we do the release.

David Barker
VP Operations  |  Declude
Your Email Security is our business
O: 978.499.2933  x7007
F: 978.988.1311   
E: [EMAIL PROTECTED]




-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Monday, April 16, 2007 9:37 AM
To: declude.virus@declude.com
Subject: RE: [Declude.Virus] AVG Virus updates - No updates from declude
since 4/7/7

I will respond to this in a few minutes.

David Barker
Director of Product Management
Your Email security is our business
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]





From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell
([EMAIL PROTECTED])
Sent: Monday, April 16, 2007 8:37 AM
To: declude.virus@declude.com
Subject: Re: [Declude.Virus] AVG Virus updates - No updates from declude
since 4/7/7


Honestly, I am not sure what all the individual files are, but here are my
dates
 
incavi.avm - 4/15/2007
microavi.avg - 4/5/2007
miniavg.avg - 2/16/2007
avi7.avg - 2/21/2007
 
Howard - you can try this post from David from the Archive-
http://www.mail-archive.com/declude.virus@declude.com/msg13473.html
 
Darrell

Check out http://www.invariantsystems.com for utilities for Declude And
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG
Integration, and Log Parsers.

- Original Message - 
From: Howard Smith (N.O.R.A.D.) <mailto:[EMAIL PROTECTED]>  
To: declude.virus@declude.com 
Cc: [EMAIL PROTECTED] ; 'David Barker' <mailto:[EMAIL PROTECTED]>  
Sent: Monday, April 16, 2007 6:28 AM
Subject: [Declude.Virus] AVG Virus updates - No updates from declude
since 4/7/7


I have not had a virus update from decludes AVG builtin scanner
since 4/6/7 , has any one received any later updates , or suggestions  to
fix problem

 

 

Howard Smith

N.O.R.A.D. Inc.

P.O. Box 680116

Miami, Florida 33168  

www.norad.com 

[EMAIL PROTECTED]

 


---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com. 


---
This E-mail came from the Declude.Virus mailing list. To unsubscribe, just
send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.Virus". The archives can be found at http://www.mail-archive.com. 



---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just
send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] AVG Virus updates - No updates from declude since 4/7/7

[David Barker]

I will respond to this in a few minutes.

David Barker
Director of Product Management
Your Email security is our business
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]





From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell
([EMAIL PROTECTED])
Sent: Monday, April 16, 2007 8:37 AM
To: declude.virus@declude.com
Subject: Re: [Declude.Virus] AVG Virus updates - No updates from declude
since 4/7/7


Honestly, I am not sure what all the individual files are, but here are my
dates
 
incavi.avm - 4/15/2007
microavi.avg - 4/5/2007
miniavg.avg - 2/16/2007
avi7.avg - 2/21/2007
 
Howard - you can try this post from David from the Archive-
http://www.mail-archive.com/declude.virus@declude.com/msg13473.html
 
Darrell

Check out http://www.invariantsystems.com for utilities for Declude And
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG
Integration, and Log Parsers.

- Original Message - 
From: Howard Smith (N.O.R.A.D.) <mailto:[EMAIL PROTECTED]>  
To: declude.virus@declude.com 
Cc: [EMAIL PROTECTED] ; 'David Barker' <mailto:[EMAIL PROTECTED]>  
Sent: Monday, April 16, 2007 6:28 AM
Subject: [Declude.Virus] AVG Virus updates - No updates from declude
since 4/7/7


I have not had a virus update from decludes AVG builtin scanner
since 4/6/7 , has any one received any later updates , or suggestions  to
fix problem

 

 

Howard Smith

N.O.R.A.D. Inc.

P.O. Box 680116

Miami, Florida 33168  

www.norad.com 

[EMAIL PROTECTED]

 


---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com. 


---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com. 



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

Re: [Declude.Virus] AVG Virus updates - No updates from declude since 4/7/7

[Darrell \([EMAIL PROTECTED])]

Honestly, I am not sure what all the individual files are, but here are my dates

incavi.avm - 4/15/2007
microavi.avg - 4/5/2007
miniavg.avg - 2/16/2007
avi7.avg - 2/21/2007

Howard - you can try this post from David from the Archive-
http://www.mail-archive.com/declude.virus@declude.com/msg13473.html

Darrell

Check out http://www.invariantsystems.com for utilities for Declude And Imail.  
IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG 
Integration, and Log Parsers.
  - Original Message - 
  From: Howard Smith (N.O.R.A.D.) 
  To: declude.virus@declude.com 
  Cc: [EMAIL PROTECTED] ; 'David Barker' 
  Sent: Monday, April 16, 2007 6:28 AM
  Subject: [Declude.Virus] AVG Virus updates - No updates from declude since 
4/7/7


  I have not had a virus update from decludes AVG builtin scanner since 4/6/7 , 
has any one received any later updates , or suggestions  to fix problem

   

   

  Howard Smith

  N.O.R.A.D. Inc.

  P.O. Box 680116

  Miami, Florida 33168  

  www.norad.com 

  [EMAIL PROTECTED]

   


  ---
  This E-mail came from the Declude.Virus mailing list. To
  unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
  type "unsubscribe Declude.Virus". The archives can be found
  at http://www.mail-archive.com. 

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] AVG Vulnerability

[David Barker]

>From AVG "the update has been released for beta testing, if there are no
troubles, we publish it as an official build during the next week."
 
David B
www.declude.com

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bonno
Bloksma
Sent: Friday, November 24, 2006 4:29 PM
To: declude.virus@declude.com
Subject: Re: [Declude.Virus] AVG Vulnerability


Hi,
 
And...?

Met vriendelijke groet,
Bonno Bloksma
hoofd systeembeheer


tio hogeschool hotelmanagement en toerisme 
begijnenhof 8-12 / 5611 el eindhoven
t 040 296 28 28 / f 040 237 35 20
 <mailto:[EMAIL PROTECTED]> [EMAIL PROTECTED]  /  <http://www.tio.nl>
www.tio.nl 

- Original Message - 
From: David  <mailto:[EMAIL PROTECTED]> Barker 
To: declude.virus@declude.com 
Sent: Tuesday, November 21, 2006 10:24 PM
Subject: RE: [Declude.Virus] AVG Vulnerability

We have a request in with Grisoft remember there is a time zone difference
as they are in CZ

David 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark
Reimer
Sent: Tuesday, November 21, 2006 4:01 PM
To: declude.virus@declude.com
Subject: RE: [Declude.Virus] AVG Vulnerability

Any updates on this yet? Should we be turning off AVG scanning?

Mark Reimer
IT System Admin
American CareSource
972-308-6887
 
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Tuesday, November 21, 2006 9:24 AM
To: declude.virus@declude.com
Subject: RE: [Declude.Virus] AVG Vulnerability

Darrell,

We are currently looking into this new report and are contacting AVG we will
post here as soon as we have an answer.

David Barker
Director of Product Management
Your Email security is our business
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]
 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell
([EMAIL PROTECTED])
Sent: Tuesday, November 21, 2006 8:48 AM
To: Declude.Virus@declude.com
Subject: [Declude.Virus] AVG Vulnerability

David / Declude,

Is the integrated AVG scanner vulnerable?  How do we deterimine what version
of AVG is embedded inside of Declude?

Darrell


MODERATE: Grisoft AVG Anti-Virus Multiple Vulnerabilities

Affected: AVG Anti-Virus versions prior to 7.1.407

Description: AVG Anti-Virus, a popular anti-virus system, contains multiple
vulnerabilities. By sending a specially-crafted file through the system, an
attacker could exploit these vulnerabilities to execute arbitrary code with
the privileges of the anti-virus process. No technical details for these
vulnerabilities are currently available.
Status: Grisoft confirmed, updates available.

Council Site Actions: The affected software and/or configuration are not in
production or widespread use, or are not officially supported at any of the
council sites. They reported that no action was necessary.

References:
Grisoft Release Notes
http://www.grisoft.com/doc/36365/lng/us/tpl/tpl01
SecurityFocus BID
http://www.securityfocus.com/bid/21029



Check out http://www.invariantsystems.com for utilities for Declude And
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG
Integration, and Log Parsers. 



---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just
send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just
send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.






---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just
send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com. 


---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] AVG Vulnerability

[David Barker]

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bonno
Bloksma
Sent: Friday, November 24, 2006 4:29 PM
To: declude.virus@declude.com
Subject: Re: [Declude.Virus] AVG Vulnerability


Hi,
 
And...?

Met vriendelijke groet,
Bonno Bloksma
hoofd systeembeheer


tio hogeschool hotelmanagement en toerisme 
begijnenhof 8-12 / 5611 el eindhoven
t 040 296 28 28 / f 040 237 35 20
 <mailto:[EMAIL PROTECTED]> [EMAIL PROTECTED]  /  <http://www.tio.nl>
www.tio.nl 

- Original Message - 
From: David  <mailto:[EMAIL PROTECTED]> Barker 
To: declude.virus@declude.com 
Sent: Tuesday, November 21, 2006 10:24 PM
Subject: RE: [Declude.Virus] AVG Vulnerability

We have a request in with Grisoft remember there is a time zone difference
as they are in CZ

David 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark
Reimer
Sent: Tuesday, November 21, 2006 4:01 PM
To: declude.virus@declude.com
Subject: RE: [Declude.Virus] AVG Vulnerability

Any updates on this yet? Should we be turning off AVG scanning?

Mark Reimer
IT System Admin
American CareSource
972-308-6887
 
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Tuesday, November 21, 2006 9:24 AM
To: declude.virus@declude.com
Subject: RE: [Declude.Virus] AVG Vulnerability

Darrell,

We are currently looking into this new report and are contacting AVG we will
post here as soon as we have an answer.

David Barker
Director of Product Management
Your Email security is our business
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]
 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell
([EMAIL PROTECTED])
Sent: Tuesday, November 21, 2006 8:48 AM
To: Declude.Virus@declude.com
Subject: [Declude.Virus] AVG Vulnerability

David / Declude,

Is the integrated AVG scanner vulnerable?  How do we deterimine what version
of AVG is embedded inside of Declude?

Darrell


MODERATE: Grisoft AVG Anti-Virus Multiple Vulnerabilities

Affected: AVG Anti-Virus versions prior to 7.1.407

Description: AVG Anti-Virus, a popular anti-virus system, contains multiple
vulnerabilities. By sending a specially-crafted file through the system, an
attacker could exploit these vulnerabilities to execute arbitrary code with
the privileges of the anti-virus process. No technical details for these
vulnerabilities are currently available.
Status: Grisoft confirmed, updates available.

Council Site Actions: The affected software and/or configuration are not in
production or widespread use, or are not officially supported at any of the
council sites. They reported that no action was necessary.

References:
Grisoft Release Notes
http://www.grisoft.com/doc/36365/lng/us/tpl/tpl01
SecurityFocus BID
http://www.securityfocus.com/bid/21029



Check out http://www.invariantsystems.com for utilities for Declude And
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG
Integration, and Log Parsers. 



---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just
send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just
send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.






---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just
send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com. 


---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

Re: [Declude.Virus] AVG Vulnerability

[Bonno Bloksma]

Hi,

And...?


Met vriendelijke groet,
Bonno Bloksma
hoofd systeembeheer



tio hogeschool hotelmanagement en toerisme 
begijnenhof 8-12 / 5611 el eindhoven
t 040 296 28 28 / f 040 237 35 20
[EMAIL PROTECTED]  / www.tio.nl 
  - Original Message - 
  From: David Barker 
  To: declude.virus@declude.com 
  Sent: Tuesday, November 21, 2006 10:24 PM
  Subject: RE: [Declude.Virus] AVG Vulnerability


  We have a request in with Grisoft remember there is a time zone difference
  as they are in CZ

  David 

  -Original Message-
  From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark
  Reimer
  Sent: Tuesday, November 21, 2006 4:01 PM
  To: declude.virus@declude.com
  Subject: RE: [Declude.Virus] AVG Vulnerability

  Any updates on this yet? Should we be turning off AVG scanning?

  Mark Reimer
  IT System Admin
  American CareSource
  972-308-6887
   
  -Original Message-
  From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
  Barker
  Sent: Tuesday, November 21, 2006 9:24 AM
  To: declude.virus@declude.com
  Subject: RE: [Declude.Virus] AVG Vulnerability

  Darrell,

  We are currently looking into this new report and are contacting AVG we will
  post here as soon as we have an answer.

  David Barker
  Director of Product Management
  Your Email security is our business
  978.499.2933 office
  978.988.1311 fax
  [EMAIL PROTECTED]
   

  -Original Message-
  From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell
  ([EMAIL PROTECTED])
  Sent: Tuesday, November 21, 2006 8:48 AM
  To: Declude.Virus@declude.com
  Subject: [Declude.Virus] AVG Vulnerability

  David / Declude,

  Is the integrated AVG scanner vulnerable?  How do we deterimine what version
  of AVG is embedded inside of Declude?

  Darrell


  MODERATE: Grisoft AVG Anti-Virus Multiple Vulnerabilities

  Affected: AVG Anti-Virus versions prior to 7.1.407

  Description: AVG Anti-Virus, a popular anti-virus system, contains multiple
  vulnerabilities. By sending a specially-crafted file through the system, an
  attacker could exploit these vulnerabilities to execute arbitrary code with
  the privileges of the anti-virus process. No technical details for these
  vulnerabilities are currently available.
  Status: Grisoft confirmed, updates available.

  Council Site Actions: The affected software and/or configuration are not in
  production or widespread use, or are not officially supported at any of the
  council sites. They reported that no action was necessary.

  References:
  Grisoft Release Notes
  http://www.grisoft.com/doc/36365/lng/us/tpl/tpl01
  SecurityFocus BID
  http://www.securityfocus.com/bid/21029


  
  Check out http://www.invariantsystems.com for utilities for Declude And
  Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG
  Integration, and Log Parsers. 



  ---
  This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just
  send an E-mail to [EMAIL PROTECTED], and
  type "unsubscribe Declude.Virus".The archives can be found
  at http://www.mail-archive.com.



  ---
  This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just
  send an E-mail to [EMAIL PROTECTED], and
  type "unsubscribe Declude.Virus".The archives can be found
  at http://www.mail-archive.com.






  ---
  This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just
  send an E-mail to [EMAIL PROTECTED], and
  type "unsubscribe Declude.Virus".The archives can be found
  at http://www.mail-archive.com.



  ---
  This E-mail came from the Declude.Virus mailing list.  To
  unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
  type "unsubscribe Declude.Virus".The archives can be found
  at http://www.mail-archive.com.



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] AVG?

[David Barker]

Title: AVG?



AVG is scanner 0 run your logs on DEBUG and you will see it 
there.
David 
B
www.declude.com


From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Hirthe, 
AlexanderSent: Friday, September 22, 2006 11:25 AMCc: 
declude.virus@declude.comSubject: [Declude.Virus] 
AVG?

Hello, 
I'm not shure, If AVG is running, how can I verify 
this? (After upgrading to 4.3.7) 
In the logfile I  see this: 09/22/2006 15:08:37.046 qe051017b01b9.smd Outlook 'Space 
Gap' Vulnerability in line 36 09/22/2006 
15:08:37.875 qe051017b01b9.smd Virus scanner 1 reports exit code of 0 
09/22/2006 15:08:41.718 qe051017b01b9.smd Virus 
scanner 2 reports exit code of 0 09/22/2006 
15:08:41.718 qe051017b01b9.smd Found a bogus .com file 
?? 
Scanners are #1 = Clam, #2 = Fprot, and where is AVG? 
:-) 
Alex ---This E-mail came from the 
Declude.Virus mailing list. Tounsubscribe, just send an E-mail to 
[EMAIL PROTECTED], andtype "unsubscribe Declude.Virus". The archives can 
be foundat http://www.mail-archive.com. 

---This E-mail came from the Declude.Virus mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.Virus".The archives can be foundat http://www.mail-archive.com.

RE: [Declude.Virus] AVG Updates

[Panda Consulting S.A. Luis Alberto Arango]

incavi.avm  Sept 12, 2006 5:54 
pm
microavi.avg Sept 12, 2006 5:54 pm
miniavi.avg  Sept 6, 2006 9:33 
am
avi7.avg  Feb 21, 2006 1:27 am
 
 
    -Luis 
Arango
 
 

  
  
  From: [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED] On Behalf Of Mark ReimerSent: 
  Martes, 12 de Septiembre de 2006 04:32 p.m.To: Declude. 
  [EMAIL PROTECTED] comSubject: [Declude.Virus] AVG 
  Updates
  
  
  What are the latest AVG updates 
  that everyone has? I’m worried that my AVG stopped updating for some reason. 
  Or is it from Declude moving all their stuff 
  around?
   
  Mark Reimer
  IT Project Manager
  American CareSource
  214-596-2464
   ---This 
  E-mail came from the Declude.Virus mailing list. Tounsubscribe, just send 
  an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.Virus". 
  The archives can be foundat http://www.mail-archive.com. 


---This E-mail came from the Declude.Virus mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.Virus".The archives can be foundat http://www.mail-archive.com.

RE: [Declude.Virus] AVG Updates

[Mark Reimer]

Ok that’s what I have as well. I
know AVG has newer defs out so I wonder why we are not getting these from
Declude.

 



Mark Reimer

IT Project Manager

American CareSource

214-596-2464



 









From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher
Sent: Tuesday, September 12, 2006
4:47 PM
To: declude.virus@declude.com
Subject: Re: [Declude.Virus] AVG
Updates



 



Here are mine:





 





declude\scanners\AVG\db\avi7.avg   2/21/2006 1:27
PM





declude\scanners\AVG\db\miniavi.avg  9/6/2006 9:40 AM





declude\scanners\AVG\db\microavi.avg  9/7/2006 3:42 PM





declude\scanners\AVG\db\incavi.avm
9/8/2006  10:43 AM







- Original Message - 





From: Mark Reimer






To: Declude.
[EMAIL PROTECTED] com 





Sent: Tuesday, September
12, 2006 4:32 PM





Subject: [Declude.Virus]
AVG Updates





 



What are the latest AVG updates that everyone has? I’m
worried that my AVG stopped updating for some reason. Or is it from Declude
moving all their stuff around?

 

Mark Reimer

IT Project Manager

American CareSource

214-596-2464

 


---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED],
and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com. 








---This E-mail came from the Declude.Virus mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.Virus".The archives can be foundat http://www.mail-archive.com.
---This E-mail came from the Declude.Virus mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.Virus".The archives can be foundat http://www.mail-archive.com.

Re: [Declude.Virus] AVG Updates

[Nick Hayer]

Mine is 9/8. 

-Nick

Mark Reimer wrote:

  
  
  
  
  What are the latest AVG
updates that everyone has? I’m
worried that my AVG stopped updating for some reason. Or is it from
Declude
moving all their stuff around?
   
  Mark Reimer
  IT Project Manager
  American CareSource
  214-596-2464
   
  
  
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.




---This E-mail came from the Declude.Virus mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.Virus".The archives can be foundat http://www.mail-archive.com.

Re: [Declude.Virus] AVG Updates

[Scott Fisher]

Here are mine:
 
declude\scanners\AVG\db\avi7.avg   
2/21/2006 1:27 PM
declude\scanners\AVG\db\miniavi.avg  9/6/2006 
9:40 AM
declude\scanners\AVG\db\microavi.avg  9/7/2006 
3:42 PM
declude\scanners\AVG\db\incavi.avm 9/8/2006  
10:43 AM

  - Original Message - 
  From: 
  Mark 
  Reimer 
  To: Declude. [EMAIL PROTECTED] com 
  Sent: Tuesday, September 12, 2006 4:32 
  PM
  Subject: [Declude.Virus] AVG 
Updates
  
  
  What are the latest AVG updates 
  that everyone has? I’m worried that my AVG stopped updating for some reason. 
  Or is it from Declude moving all their stuff 
  around?
   
  Mark Reimer
  IT Project Manager
  American CareSource
  214-596-2464
   ---This 
  E-mail came from the Declude.Virus mailing list. Tounsubscribe, just send 
  an E-mail to [EMAIL PROTECTED], 
  andtype "unsubscribe Declude.Virus". The archives can be foundat 
  http://www.mail-archive.com. 

---This E-mail came from the Declude.Virus mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.Virus".The archives can be foundat http://www.mail-archive.com.

RE: [Declude.Virus] AVG not updating?

[David Barker]

Dave,

What is the IP address of you mail server ?

David B
www.declude.com


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of David Dodell
Sent: Wednesday, May 31, 2006 7:17 PM
To: Declude.Virus@declude.com
Subject: [Declude.Virus] AVG not updating?

I have the latest version of Declude installed ... have the new virus set to
update every 2 hours ... but my latest DB files are dated
5/25/06 ... I've seen F-Prot update several times in the past 6 days ... but
nothing from AVG ... doesn't make sense ... is there still a problem with
the internal scanner not updating, or something I need to check?

David
---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just
send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] AVG Database file dates?

[David Barker]

When we do a build we include the latest database files 
provided by AVG, the files consist of the main database file and the incremental 
updates, depending on when you get updates certain files will have later dates 
than others, over time the incrementals are added to the main database, that is 
why there are files with different dates.
 
David B
www.declude.com


From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of David 
DodellSent: Friday, May 26, 2006 6:47 PMTo: 
Declude.Virus@declude.comSubject: Re: [Declude.Virus] AVG Database 
file dates?
This makes no sense why we shouldn't be all on the same dates ... it 
gets me nervous that the AVG system is not updating correctly, and stuff may 
pass through ... Hopefully someone from Declude can lend an 
answer?David-Original Message-From: "John Dobbin" 
<[EMAIL PROTECTED]>Sent 5/26/2006 5:41:18 AMTo: 
Declude.Virus@declude.comSubject: RE: [Declude.Virus] AVG Database file 
dates?Mine are:Avi7.avg 2/21Incavi.avg 5/25Microavi.avg 
5/18Miniavi.avg 5/22We just upgraded to declude 4.2.12. > 
-Original Message-> From: [EMAIL PROTECTED] 
> [mailto:[EMAIL PROTECTED] On Behalf Of David 
Dodell> Sent: Thursday, May 25, 2006 10:23 PM> To: 
Declude.Virus@declude.com> Subject: [Declude.Virus] AVG Database file 
dates?> > We just started to use the AVG internal scanner with 
F-Prot > as a backup ... since I have no comparison, just wanted to 
> make sure my files were up to date;> > I have> 
> avi.avg 2/21> incavi.avm 5/25> microavi.avg 5/10> 
miniavi.avg 5/25> > Does that match?> ---> This 
E-mail came from the Declude.Virus mailing list. To > unsubscribe, just 
send an E-mail to [EMAIL PROTECTED], and> type "unsubscribe 
Declude.Virus". The archives can be found> at 
http://www.mail-archive.com.> ---This E-mail came from 
the Declude.Virus mailing list. Tounsubscribe, just send an E-mail to 
[EMAIL PROTECTED], andtype "unsubscribe Declude.Virus". The archives can 
be foundat http://www.mail-archive.com.

Re: [Declude.Virus] AVG Database file dates?

[David Dodell]

This makes no sense why we shouldn't be all on the same dates ... it gets me nervous that the AVG system is not updating correctly, and stuff may pass through ... Hopefully someone from Declude can lend an answer?David-Original Message-From: "John Dobbin" <[EMAIL PROTECTED]>Sent 5/26/2006 5:41:18 AMTo: Declude.Virus@declude.comSubject: RE: [Declude.Virus] AVG Database file dates?Mine are:Avi7.avg	2/21Incavi.avg	5/25Microavi.avg	5/18Miniavi.avg	5/22We just upgraded to declude 4.2.12. > -Original Message-> From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of David Dodell> Sent: Thursday, May 25, 2006 10:23 PM> To: Declude.Virus@declude.com> Subject: [Declude.Virus] AVG Database file dates?> > We just started to use the AVG internal scanner with F-Prot > as a backup ... since I have no comparison, just wanted to > make sure my files were up to date;> > I have> > avi.avg  2/21> incavi.avm  5/25> microavi.avg  5/10> miniavi.avg  5/25> > Does that match?> ---> This E-mail came from the Declude.Virus mailing list.  To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and> type "unsubscribe Declude.Virus".The archives can be found> at http://www.mail-archive.com.> ---This E-mail came from the Declude.Virus mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.Virus".The archives can be foundat http://www.mail-archive.com.

RE: [Declude.Virus] AVG Database file dates?

[John Dobbin]

Mine are:

Avi7.avg2/21
Incavi.avg  5/25
Microavi.avg5/18
Miniavi.avg 5/22

We just upgraded to declude 4.2.12. 

> -Original Message-
> From: [EMAIL PROTECTED] 
> [mailto:[EMAIL PROTECTED] On Behalf Of David Dodell
> Sent: Thursday, May 25, 2006 10:23 PM
> To: Declude.Virus@declude.com
> Subject: [Declude.Virus] AVG Database file dates?
> 
> We just started to use the AVG internal scanner with F-Prot 
> as a backup ... since I have no comparison, just wanted to 
> make sure my files were up to date;
> 
> I have
> 
> avi.avg  2/21
> incavi.avm  5/25
> microavi.avg  5/10
> miniavi.avg  5/25
> 
> Does that match?
> ---
> This E-mail came from the Declude.Virus mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.Virus".The archives can be found
> at http://www.mail-archive.com.
> 


---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

Re: [Declude.Virus] AVG

[Dean Lawrence]

Matt,
 
The licensing is the one bugger about Symantec. I hadn't gone with F-Prot for my real-time scanner because you cannot configure exclude directories (what a pain!). That is pretty cool though about the on-change scanning option with Symantec. I'll have to weigh the options to see which direction I want to go in. I really appreciate your input (your too, Scott).

 
Dean 
On 12/20/05, Matt <[EMAIL PROTECTED]> wrote:
Dean,I have done two sites where resumes were uploaded, and the number of infected documents was unreal, especially considering that both dealt with recruiting tech people.  It is definitely wise to virus scan.
I would use anything for the server that can be easily managed in terms of exclusions (directories and file extensions).  I also like Symantec for it's ability to be configured to only scan on-change instead of on-access.  The licensing isn't appropriate for a single machine though, you need at least 5 to make it practical.  Symantec Corporate can also be installed as a stand-alone client.
If you are looking for just one server, I would strongly consider another option with better licensing.  AVG is probably up to the task, and F-Prot might be.  The needs for a Web server scanner are not big when it comes to timely detection, so focus on configuration options and price. 
MattDean Lawrence wrote: 

Thanks Matt,
 
I'm in a similar situation where this server is not part of my internal network so the only people who would connect to it would be myself and a couple of clients via FTP. I do have a couple of web apps for recruiting clients where their candidates can upload resumes via a web form, so I want to make sure that these docs are scanned as they hit the server. 

 
Interesting point though that you make about mixed scanners on servers and clients. It sounds like you like Symantec for you server scanner, but you like it even more as a client scanner. If you choose to use it for your client solutions, what would you recommend for your server in that particular scenario? 

 
Thanks,
 
Dean 
On 12/20/05, Matt <[EMAIL PROTECTED]> wrote:
 
I use Symantec Corporate for my real-time server scans.  I like it because it is easy to manage, but my servers also don't have any users attached to them besides myself and some clients that FTP to their Web sites.  I'm a proponent of mixing virus scanners on network servers and clients.  Symantec Corporate is a killer desktop solution because of the manageability, and if you go that direction, I would put a different vendor on the servers just so you have the protection of two completely separate solutions. 
Matt 
Dean Lawrence wrote: 

Thanks Scott,
 
So the Symantec product has worked well for you as your real-time scanner? Are you using the Symantec Antivirus Corporate Edition?
 
Dean 
On 12/20/05, Scott Fisher <[EMAIL PROTECTED] 
> wrote: 

When I used AVG it was consistantly in the back of the pack for virus detections. 
It lagged so badly at the beginning of the encrypted zip days, that I had to swap it out with Clam.
It had pretty good scanning times.
 
I use FProt, Clam AV as a service and Mcafee VirusScan.
From a cost perspective ClamAV is free, and if you can find someone to sell you the command line VirusScan, it should be under $30 a year.
 
I use a real-time Virus scanner of Symantec. I'd really recommend a different vendor as a real-time a/v to provide another level of security.


- Original Message - 
From: 
Dean Lawrence 
To: 
declude.virus@declude.com 
Sent: Tuesday, December 20, 2005 7:29 AM
Subject: [Declude.Virus] AVG
 
I am looking for a new virus scanner for my Windows 2003 server and was wondering what all of thought about AVG. This is both a web server and my mail server (imail) and I would be looking at it to be both my full-time file scanner and act as a secondary Declude scanner (I already am running F-Prot). If you like it and would recommend it, which version do you use? Would it be the file server edition? 

 
Thanks,
 
Dean-- __Dean Lawrence, CIO/PartnerInternet Data Technology888.GET.IDT1 ext. 701 * fax: 888.438.4381
http://www.idatatech.com/Corporate Internet Development and Marketing Specialists -- __Dean Lawrence, CIO/Partner 
Internet Data Technology888.GET.IDT1 ext. 701 * fax: 888.438.4381http://www.idatatech.com/Corporate Internet Development and Marketing Specialists 
-- __Dean Lawrence, CIO/PartnerInternet Data Technology888.GET.IDT1 ext. 701 * fax: 888.438.4381
 http://www.idatatech.com/Corporate Internet Development and Marketing Specialists 
-- __Dean Lawrence, CIO/PartnerInternet Data Technology888.GET.IDT1 ext. 701 * fax: 888.438.4381
http://www.idatatech.com/Corporate Internet Development and Marketing Specialists 

Re: [Declude.Virus] AVG

[Matt]

Dean,

I have done two sites where resumes were uploaded, and the number of
infected documents was unreal, especially considering that both dealt
with recruiting tech people.  It is definitely wise to virus scan.

I would use anything for the server that can be easily managed in terms
of exclusions (directories and file extensions).  I also like Symantec
for it's ability to be configured to only scan on-change instead of
on-access.  The licensing isn't appropriate for a single machine
though, you need at least 5 to make it practical.  Symantec Corporate
can also be installed as a stand-alone client.

If you are looking for just one server, I would strongly consider
another option with better licensing.  AVG is probably up to the task,
and F-Prot might be.  The needs for a Web server scanner are not big
when it comes to timely detection, so focus on configuration options
and price.

Matt



Dean Lawrence wrote:

  Thanks Matt,
   
  I'm in a similar situation where this server is not part of my
internal network so the only people who would connect to it would be
myself and a couple of clients via FTP. I do have a couple of web apps
for recruiting clients where their candidates can upload resumes via a
web form, so I want to make sure that these docs are scanned as they
hit the server.
  
   
  Interesting point though that you make about mixed scanners on
servers and clients. It sounds like you like Symantec for you server
scanner, but you like it even more as a client scanner. If you choose
to use it for your client solutions, what would you recommend for your
server in that particular scenario?
  
   
  Thanks,
   
  Dean
  
 
  On 12/20/05, Matt <[EMAIL PROTECTED]> wrote:
  I
use Symantec Corporate for my real-time server scans.  I like it
because it is easy to manage, but my servers also don't have any users
attached to them besides myself and some clients that FTP to their Web
sites.  I'm a proponent of mixing virus scanners on network servers and
clients.  Symantec Corporate is a killer desktop solution because of
the manageability, and if you go that direction, I would put a
different vendor on the servers just so you have the protection of two
completely separate solutions.


Matt




Dean Lawrence wrote:

  Thanks Scott,
   
  So the Symantec product has worked well for you as your
real-time scanner? Are you using the Symantec Antivirus Corporate
Edition?
   
  Dean
  
 
  On 12/20/05, Scott Fisher <[EMAIL PROTECTED]
  > wrote:
  
When I used AVG it was
consistantly in the back of the pack for virus detections. 
It lagged so badly at the
beginning of the encrypted zip days, that I had to swap it out with
Clam.
It had pretty good scanning
times.
 
I use FProt, Clam AV as a
service and Mcafee VirusScan.
From a cost perspective ClamAV
is free, and if you can find someone to sell you the command line
VirusScan, it should be under $30 a year.
 
I use a real-time Virus
scanner of Symantec. I'd really recommend a different vendor as a
real-time a/v to provide another level of security.


  -
Original Message - 
  From:
  
Dean Lawrence 
  To:
  
declude.virus@declude.com 
  Sent:
Tuesday, December 20, 2005 7:29 AM
  Subject:
[Declude.Virus] AVG
  
 
  I am looking for a new virus scanner for my Windows 2003
server and was wondering what all of thought about AVG. This is both a
web server and my mail server (imail) and I would be looking at it to
be both my full-time file scanner and act as a secondary Declude
scanner (I already am running F-Prot). If you like it and would
recommend it, which version do you use? Would it be the file server
edition? 
   
  Thanks,
   
  Dean
  
-- 
__
Dean Lawrence, CIO/Partner
Internet Data Technology
888.GET.IDT1 ext. 701 * fax: 888.438.4381
  http://www.idatatech.com/
Corporate Internet Development and Marketing Specialists 


  
  
  
  
  
-- 
__
Dean Lawrence, CIO/Partner 
Internet Data Technology
888.GET.IDT1 ext. 701 * fax: 888.438.4381
  http://www.idatatech.com/
Corporate Internet Development and Marketing Specialists 

  
  
  
  
  
-- 
__
Dean Lawrence, CIO/Partner
Internet Data Technology
888.GET.IDT1 ext. 701 * fax: 888.438.4381
  
  http://www.idatatech.com/
Corporate Internet Development and Marketing Specialists 

Re: [Declude.Virus] AVG

[Dean Lawrence]

Thanks Matt,
 
I'm in a similar situation where this server is not part of my internal network so the only people who would connect to it would be myself and a couple of clients via FTP. I do have a couple of web apps for recruiting clients where their candidates can upload resumes via a web form, so I want to make sure that these docs are scanned as they hit the server.

 
Interesting point though that you make about mixed scanners on servers and clients. It sounds like you like Symantec for you server scanner, but you like it even more as a client scanner. If you choose to use it for your client solutions, what would you recommend for your server in that particular scenario?

 
Thanks,
 
Dean 
On 12/20/05, Matt <[EMAIL PROTECTED]> wrote:
I use Symantec Corporate for my real-time server scans.  I like it because it is easy to manage, but my servers also don't have any users attached to them besides myself and some clients that FTP to their Web sites.  I'm a proponent of mixing virus scanners on network servers and clients.  Symantec Corporate is a killer desktop solution because of the manageability, and if you go that direction, I would put a different vendor on the servers just so you have the protection of two completely separate solutions.
Matt 
Dean Lawrence wrote: 

Thanks Scott,
 
So the Symantec product has worked well for you as your real-time scanner? Are you using the Symantec Antivirus Corporate Edition?
 
Dean 
On 12/20/05, Scott Fisher <[EMAIL PROTECTED]
> wrote: 

When I used AVG it was consistantly in the back of the pack for virus detections. 
It lagged so badly at the beginning of the encrypted zip days, that I had to swap it out with Clam.
It had pretty good scanning times.
 
I use FProt, Clam AV as a service and Mcafee VirusScan.
From a cost perspective ClamAV is free, and if you can find someone to sell you the command line VirusScan, it should be under $30 a year.
 
I use a real-time Virus scanner of Symantec. I'd really recommend a different vendor as a real-time a/v to provide another level of security.


- Original Message - 
From: 
Dean Lawrence 
To: 
declude.virus@declude.com 
Sent: Tuesday, December 20, 2005 7:29 AM
Subject: [Declude.Virus] AVG
 
I am looking for a new virus scanner for my Windows 2003 server and was wondering what all of thought about AVG. This is both a web server and my mail server (imail) and I would be looking at it to be both my full-time file scanner and act as a secondary Declude scanner (I already am running F-Prot). If you like it and would recommend it, which version do you use? Would it be the file server edition? 

 
Thanks,
 
Dean-- __Dean Lawrence, CIO/PartnerInternet Data Technology888.GET.IDT1 ext. 701 * fax: 888.438.4381
http://www.idatatech.com/Corporate Internet Development and Marketing Specialists -- __Dean Lawrence, CIO/Partner 
Internet Data Technology888.GET.IDT1 ext. 701 * fax: 888.438.4381http://www.idatatech.com/Corporate Internet Development and Marketing Specialists 
-- __Dean Lawrence, CIO/PartnerInternet Data Technology888.GET.IDT1 ext. 701 * fax: 888.438.4381
http://www.idatatech.com/Corporate Internet Development and Marketing Specialists 

Re: [Declude.Virus] AVG

[Matt]

I use Symantec Corporate for my real-time server scans.  I like it
because it is easy to manage, but my servers also don't have any users
attached to them besides myself and some clients that FTP to their Web
sites.  I'm a proponent of mixing virus scanners on network servers and
clients.  Symantec Corporate is a killer desktop solution because of
the manageability, and if you go that direction, I would put a
different vendor on the servers just so you have the protection of two
completely separate solutions.

Matt



Dean Lawrence wrote:

  Thanks Scott,
   
  So the Symantec product has worked well for you as your
real-time scanner? Are you using the Symantec Antivirus Corporate
Edition?
   
  Dean
  
 
  On 12/20/05, Scott Fisher <[EMAIL PROTECTED]>
wrote:
  
When I used AVG it was
consistantly in the back of the pack for virus detections. 
It lagged so badly at the
beginning of the encrypted zip days, that I had to swap it out with
Clam.
It had pretty good scanning times.
 
I use FProt, Clam AV as a service
and Mcafee VirusScan.
From a cost perspective ClamAV is
free, and if you can find someone to sell you the command line
VirusScan, it should be under $30 a year.
 
I use a real-time Virus scanner of
Symantec. I'd really recommend a different vendor as a real-time a/v to
provide another level of security.


  -
Original Message - 
  From:
  Dean Lawrence 
  To:
  declude.virus@declude.com
  
  Sent:
Tuesday, December 20, 2005 7:29 AM
  Subject:
[Declude.Virus] AVG
  
 
  I am looking for a new virus scanner for my Windows 2003
server and was wondering what all of thought about AVG. This is both a
web server and my mail server (imail) and I would be looking at it to
be both my full-time file scanner and act as a secondary Declude
scanner (I already am running F-Prot). If you like it and would
recommend it, which version do you use? Would it be the file server
edition? 
   
  Thanks,
   
  Dean
  
-- 
__
Dean Lawrence, CIO/Partner
Internet Data Technology
888.GET.IDT1 ext. 701 * fax: 888.438.4381
  http://www.idatatech.com/
Corporate Internet Development and Marketing Specialists 


  
  
  
  
  
-- 
__
Dean Lawrence, CIO/Partner
  
Internet Data Technology
888.GET.IDT1 ext. 701 * fax: 888.438.4381
  http://www.idatatech.com/
Corporate Internet Development and Marketing Specialists 

Re: [Declude.Virus] AVG

[Dean Lawrence]

Thanks Scott,
 
So the Symantec product has worked well for you as your real-time scanner? Are you using the Symantec Antivirus Corporate Edition?
 
Dean 
On 12/20/05, Scott Fisher <[EMAIL PROTECTED]> wrote:

When I used AVG it was consistantly in the back of the pack for virus detections. 
It lagged so badly at the beginning of the encrypted zip days, that I had to swap it out with Clam.
It had pretty good scanning times.
 
I use FProt, Clam AV as a service and Mcafee VirusScan.
From a cost perspective ClamAV is free, and if you can find someone to sell you the command line VirusScan, it should be under $30 a year.
 
I use a real-time Virus scanner of Symantec. I'd really recommend a different vendor as a real-time a/v to provide another level of security.


- Original Message - 
From: Dean Lawrence 

To: declude.virus@declude.com 

Sent: Tuesday, December 20, 2005 7:29 AM
Subject: [Declude.Virus] AVG
 
I am looking for a new virus scanner for my Windows 2003 server and was wondering what all of thought about AVG. This is both a web server and my mail server (imail) and I would be looking at it to be both my full-time file scanner and act as a secondary Declude scanner (I already am running F-Prot). If you like it and would recommend it, which version do you use? Would it be the file server edition? 

 
Thanks,
 
Dean-- __Dean Lawrence, CIO/PartnerInternet Data Technology888.GET.IDT1 ext. 701 * fax: 888.438.4381
http://www.idatatech.com/Corporate Internet Development and Marketing Specialists -- __Dean Lawrence, CIO/Partner
Internet Data Technology888.GET.IDT1 ext. 701 * fax: 888.438.4381http://www.idatatech.com/Corporate Internet Development and Marketing Specialists 

Re: [Declude.Virus] AVG

[Scott Fisher]

When I used AVG it was consistantly in the back of 
the pack for virus detections. 
It lagged so badly at the beginning of the 
encrypted zip days, that I had to swap it out with Clam.
It had pretty good scanning times.
 
I use FProt, Clam AV as a service and Mcafee 
VirusScan.
From a cost perspective ClamAV is free, and if you 
can find someone to sell you the command line VirusScan, it should be under $30 
a year.
 
I use a real-time Virus scanner of Symantec. I'd 
really recommend a different vendor as a real-time a/v to provide another level 
of security.

  - Original Message - 
  From: 
  Dean Lawrence 
  
  To: declude.virus@declude.com 
  Sent: Tuesday, December 20, 2005 7:29 
  AM
  Subject: [Declude.Virus] AVG
  
  I am looking for a new virus scanner for my Windows 2003 server and was 
  wondering what all of thought about AVG. This is both a web server and my mail 
  server (imail) and I would be looking at it to be both my full-time file 
  scanner and act as a secondary Declude scanner (I already am running F-Prot). 
  If you like it and would recommend it, which version do you use? Would it be 
  the file server edition? 
   
  Thanks,
   
  Dean-- 
  __Dean Lawrence, 
  CIO/PartnerInternet Data Technology888.GET.IDT1 ext. 701 * fax: 
  888.438.4381http://www.idatatech.com/Corporate 
  Internet Development and Marketing Specialists 

Re: [Declude.Virus] AVG zip file problems/fix

[Matt]

They didn't provide a link to it.  I would imagine that you can access
it through the same page that you access the registered full versions
of their software, but that requires a serial number to access.  I
didn't check so I'm not sure it's there.

Matt



Robert Grosshandler wrote:

  
  
  
  can you point to their beta
releases?
   
  Thanks!
  
  
  From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Matt
  Sent: Monday, July 26, 2004 2:33 PM
  To: [EMAIL PROTECTED]
  Subject: [Declude.Virus] AVG zip file problems/fix
  
  
The issue with the latest AVG not scanning zip files properly because
they broke the /ARCW and /RTW switches is apparently fixed in a beta
release on their site, and they indicated that the full version will be
released soon.  Here's a quote from their support in response to a
query:
  
  "It should be working in the build 260 (in our beta
section). But you can also wait for the next official version (version
261) which will be released soon."
  
They also noted that /NOEXPORT is not coming back.  I'm not sure if
that means that they will be exporting suspicious files to AVG, or if
that just simply isn't an option for the command line scanner anymore. 
If you use this switch, it will break AVG in versions 2.51+
  
Matt
  -- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

RE: [Declude.Virus] AVG zip file problems/fix

[Robert Grosshandler]

can you point to their beta releases?
 
Thanks!


From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of 
MattSent: Monday, July 26, 2004 2:33 PMTo: 
[EMAIL PROTECTED]Subject: [Declude.Virus] AVG zip file 
problems/fix
The issue with the latest AVG not scanning zip files properly because 
they broke the /ARCW and /RTW switches is apparently fixed in a beta release on 
their site, and they indicated that the full version will be released 
soon.  Here's a quote from their support in response to a query:
"It should be working in the build 260 (in our beta section). But 
  you can also wait for the next official version (version 261) which will be 
  released soon."They also noted that /NOEXPORT is not coming 
back.  I'm not sure if that means that they will be exporting suspicious 
files to AVG, or if that just simply isn't an option for the command line 
scanner anymore.  If you use this switch, it will break AVG in versions 
2.51+Matt-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

Re: [Declude.Virus] AVG appears to be slower

[Matt]

F-Prot has always far outperformed all other virus scanners except
maybe ClamAV when run as a service.  I did though just check my scan
times for AVG and F-Prot in debug mode and AVG does appear to now be
taking about 40% longer than it did a month or so ago.  Their release
notes indicate that they have added "conservative" detection of
encrypted zip files, and this capability might be the cause.  Maybe
there are some new switches?

Matt



Butch Andrews wrote:

  
  
  After last nights update for AVG7, for the first
time I was required to re-boot. Since then it appears that the time to
execute has gone up dramatically. The debug log showing one scan below
illustrates F-Prot at 62 ms and AVG taking 515 ms. Has anyone else seen
this today? My overflow file was showing files during the 8-10 period
this morning but has settled down at this point.
   
  04/29/2004 11:42:27.893 Q3065002602eeed96
Scanning files (2 scanners)
04/29/2004 11:42:27.893 Q3065002602eeed96 Starting scanner #1:
C:\Progra~1\FSI\F-Prot\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOBOOT
/DUMB /REPORT=report.txt c:\IMAIL\spool\D30650~1.VIR\
04/29/2004 11:42:27.908 Q3065002602eeed96 Scanner to start immediately,
no need to wait for others to end.
04/29/2004 11:42:27.924 Q3065002602eeed96 Virus Scanner Started:
C:\Progra~1\FSI\F-Prot\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOBOOT
/DUMB /REPORT=report.txt c:\IMAIL\spool\D30650~1.VIR\
04/29/2004 11:42:28.158 Q3065002602eeed96 Process Time: 62ms [kernel=15
user=46]
04/29/2004 11:42:28.158 Q3065002602eeed96 Virus scanner 1 reports exit
code of 0
04/29/2004 11:42:28.158 Q3065002602eeed96 Starting scanner #2:
C:\Progra~1\Grisoft\AVG7\avgscan.exe /NOMEM /NOBOOT /NOHIMEM /NOEXPORT
/NOSELF /ARC /RT /ARCW /RTW /MACROW /REPORT=report.txt
c:\IMAIL\spool\D30650~1.VIR\
04/29/2004 11:42:28.174 Q3065002602eeed96 Scanner to start immediately,
no need to wait for others to end.
04/29/2004 11:42:28.189 Q3065002602eeed96 Virus Scanner Started:
C:\Progra~1\Grisoft\AVG7\avgscan.exe /NOMEM /NOBOOT /NOHIMEM /NOEXPORT
/NOSELF /ARC /RT /ARCW /RTW /MACROW /REPORT=report.txt
c:\IMAIL\spool\D30650~1.VIR\
04/29/2004 11:42:58.189 Q3065002602eeed96 Process Time: 515ms
[kernel=250 user=265]
04/29/2004 11:42:58.189 Q3065002602eeed96 Virus scanner 2 reports exit
code of 0
   
  -Butch


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

Re: [Declude.Virus] AVG config

[Matt]

My point was that they have two heuristics codes.

ERRORLEVEL == 4 /* suspicion detected by heuristic analysis */
ERRORLEVEL == 5 /* virus found by heuristic analysis */
I'll contact support to ask what the real difference is. From looking at 
this further, there is a /HEUR switch needed to turn this on apparently, 
so in reality I probably haven't been using this.

BTW, at LOGLEVEL DEBUG, I have found that F-Prot will scan and catch a 
NetSky.J virus in about 0.13 seconds, but it takes AVG (32-bit) more 
than 3 times as long, 0.45 seconds. F-Prot also caught about 20% more 
viruses yesterday in the NetSky.L outbreak, though both scanners were 
missing things the other picked up.

Anyone else want to do a comparison between F-Prot and another scanner 
for comparison's sake so that we can figure out which ones are the 
fastest? Just set the LOGLEVEL DEBUG and copy and paste a hit for 
NetSky.J to the list.

Matt



03/12/2004 14:55:04.292 Q158a0c4c0272caa5 Declude Virus Pro Registered
03/12/2004 14:55:04.292 Q158a0c4c0272caa5 Starting locality check 
(sender=carcitydirect.com; nr=2 ca=off).
03/12/2004 14:55:04.292 Q158a0c4c0272caa5 CL Opening 
HKEY_LOCAL_MACHINE\software\Ipswitch\IMail\Domains
03/12/2004 14:55:04.292 Q158a0c4c0272caa5 [EMAIL PROTECTED] [0] is 
local domain1
03/12/2004 14:55:04.292 Q158a0c4c0272caa5 [EMAIL PROTECTED] [0] is 
local main domain
03/12/2004 14:55:04.292 Q158a0c4c0272caa5 Local host = conversionvans.net
03/12/2004 14:55:04.292 Q158a0c4c0272caa5 [EMAIL PROTECTED] 
Offset=5 Flags=1
03/12/2004 14:55:04.292 Q158a0c4c0272caa5 [EMAIL PROTECTED] 
Offset=0 Flags=0
03/12/2004 14:55:04.308 Q158a0c4c0272caa5 Msgid: 
<[EMAIL PROTECTED]>
03/12/2004 14:55:04.308 Q158a0c4c0272caa5 Subject: Re: Details
03/12/2004 14:55:04.308 Q158a0c4c0272caa5 E:\spool\Q158a0c4c0272caa5.SMD
03/12/2004 14:55:04.308 Q158a0c4c0272caa5 Starting virus scanning section...
03/12/2004 14:55:04.308 Q158a0c4c0272caa5 MIMELAYER=0
03/12/2004 14:55:04.308 Q158a0c4c0272caa5 Exclude Default=-1
03/12/2004 14:55:04.308 Q158a0c4c0272caa5 Exclude Domain=-1
03/12/2004 14:55:04.308 Q158a0c4c0272caa5 Exclude peruser=-1
03/12/2004 14:55:04.308 Q158a0c4c0272caa5 DoAv( 
E:\spool\D158a0c4c0272caa5.SMD );
03/12/2004 14:55:04.308 Q158a0c4c0272caa5 avtempdir=E:\spool
03/12/2004 14:55:04.308 Q158a0c4c0272caa5 Temp dir set to: 
E:\spool\D158a0c4c0272caa5.vir\
03/12/2004 14:55:04.308 Q158a0c4c0272caa5 fp=44d570
03/12/2004 14:55:04.308 Q158a0c4c0272caa5 MIMELAYER++
03/12/2004 14:55:04.308 Q158a0c4c0272caa5 DOMIME START
03/12/2004 14:55:04.308 Q158a0c4c0272caa5 CT: Content-Type: 
multipart/mixed;boundary="=_NextPart_000_0
03/12/2004 14:55:04.308 Q158a0c4c0272caa5 Got boundary; 
=--=_NextPart_000_0012_2431.0497.
03/12/2004 14:55:04.308 Q158a0c4c0272caa5 DOMIME end-of-headers
03/12/2004 14:55:04.308 Q158a0c4c0272caa5 ISMULTI
03/12/2004 14:55:04.308 Q158a0c4c0272caa5 Hit boundary... Recursing... 0 
(5-0-).
03/12/2004 14:55:04.308 Q158a0c4c0272caa5 MIMELAYER++
03/12/2004 14:55:04.308 Q158a0c4c0272caa5 DOMIME START
03/12/2004 14:55:04.308 Q158a0c4c0272caa5 CT: Content-Type: 
text/plain;charset="Windows-1252"
03/12/2004 14:55:04.324 Q158a0c4c0272caa5 Got Encoding 7bit.
03/12/2004 14:55:04.324 Q158a0c4c0272caa5 DOMIME end-of-headers
03/12/2004 14:55:04.324 Q158a0c4c0272caa5 !ISMULTI
03/12/2004 14:55:04.324 Q158a0c4c0272caa5 Handling a MIME segment 
[Boundary=--=_NextPart_000_0012_2431.0497].
03/12/2004 14:55:04.324 Q158a0c4c0272caa5 Encoding type: 7bit [1/]
03/12/2004 14:55:04.324 Q158a0c4c0272caa5 Starting BASE64
03/12/2004 14:55:04.324 Q158a0c4c0272caa5 Hit new boundary (fseek)
03/12/2004 14:55:04.324 Q158a0c4c0272caa5 curpos=687
03/12/2004 14:55:04.324 Q158a0c4c0272caa5 Deleting (1) plaintext segment 
E:\spool\D158a0c4c0272caa5.vir\0..
03/12/2004 14:55:04.324 Q158a0c4c0272caa5 MIMELAYER--
03/12/2004 14:55:04.324 Q158a0c4c0272caa5 Done Recursing...
03/12/2004 14:55:04.324 Q158a0c4c0272caa5 Hit boundary... Recursing... 1 
(5-0-).
03/12/2004 14:55:04.324 Q158a0c4c0272caa5 MIMELAYER++
03/12/2004 14:55:04.324 Q158a0c4c0272caa5 DOMIME START
03/12/2004 14:55:04.324 Q158a0c4c0272caa5 CT: Content-Type: 
application/octet-stream;name="my_details.pif"
03/12/2004 14:55:04.324 Q158a0c4c0272caa5 Setting MimeName to 
my_details.pif [14].
03/12/2004 14:55:04.324 Q158a0c4c0272caa5 Got Encoding base64.
03/12/2004 14:55:04.324 Q158a0c4c0272caa5 Got disp name=my_details.pif 
[MimeName=my_details.pif].
03/12/2004 14:55:04.324 Q158a0c4c0272caa5 DOMIME end-of-headers
03/12/2004 14:55:04.324 Q158a0c4c0272caa5 !ISMULTI
03/12/2004 14:55:04.324 Q158a0c4c0272caa5 Handling a MIME segment 
[Boundary=--=_NextPart_000_0012_2431.0497].
03/12/2004 14:55:04.324 Q158a0c4c0272caa5 Encoding type: base64 [1/pif]
03/12/2004 14:55:04.324 Q158a0c4c0272caa5 Starting BASE64
03/12/2004 14:55:04.339 Q158a0c4c0272caa5 Hit new boundary (fseek)
03/12/2004 14:55:04.339 Q158a0c4c0272caa5 curpos=31072
03/12/2004 14:55:04.339 Q158a0c4c0272caa5 Ending BASE64
03/1

Re: [Declude.Virus] AVG config

[R. Scott Perry]

I noticed that you removed the "5" result code from the 32-bit AVG example 
in the manual. I'm wondering if this might be beneficial.
It's hard to say.  While heuristics can be beneficial, in general it seems 
that they rarely catch new viruses before definitions are created for them, 
and quite often they seem to have false positives.

So in this case, it would really depend on how good AVG's heuristics are.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

Re: [Declude.Virus] AVG V6 much slower than FProt and McAfee

[Adrian Hauri]

>Currently only the 16-bit version works with Declude, the 32-bit version
will soon.
>16-bit apps have a big performance hit because they run under NTVDM.

I think it's not a 16Bit/32Bit issue. My F-Prot runs also in the 16bit Dos
Version and is much faster than AVG.
(I tested it Communigate Pro and not with Imail/Declude)

Try to run AVG from the command line and then you know what I mean.
Type this at the command promt: C:\Progra~1\Grisoft\AVG6\avg.exe /NOMEM
/NOSELF /ARC /REPORT=report.txt *.123
The scanning itself takes less than 1sec, but the startup takes 2seconds.

When AVG starts up, it also shows the following:
AVG_6_0_Dos32_Init (c) GRISOFT,
s.r.o,1999-2003

Does it mean that it runs in 32bit mode or does it just detect a 32bit dos
environment?


Adrian


- Original Message -
From: Matt
To: [EMAIL PROTECTED]
Sent: Thursday, February 26, 2004 2:44 PM
Subject: Re: [Declude.Virus] AVG V6 much slower than FProt and McAfee


Currently only the 16-bit version works with Declude, the 32-bit version
will soon.  16-bit apps have a big performance hit because they run under
NTVDM.

Matt



Adrian Hauri wrote:

I just installed AVG 6.0 free edition and it seems that it takes a long time
to fire it up:

14:24:10.40 * start virus scan
14:24:11.35 * Found: EICAR test file NOT a virus. (MCAFEE 4.5)
14:24:11.95 * Infection: EICAR_Test_File (FPROT 3.5)
14:24:15.78 * identified EICAR_Test (AVG 6.0)

I used for all virus scanners the string from the declude virus manual site.

It takes AVG approx. 3 seconds to start up before scanning compared to 1
second for the other scanners. The scanning itself seems to be fast, it's
just the start-up.

Is this normal? Has anyone else the same performance problem?

Thanks for your help.

Adrian
http://www.mailpure.com/software/
=

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

Re: [Declude.Virus] AVG 7.0 32-bit scanner find...extra space???

[R. Scott Perry]

I've already written tech support asking them if there are different 
result codes for avgscan.exe, and if there are none, if they could add them.
If they do add them, please do post the information here.  :)

  Here's what the DOS version provides:

http://www.grisoft.com/faq/us_faqtext.php?id=79&sid=4

Note that I've changed my virus codes for avg.exe based on this list.  The 
options shared on the Declude site will treat an error as a virus (result 
code 2).
Thanks for pointing this out -- the defaults on the web site have been 
changed to reflect this.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

Re: [Declude.Virus] AVG 7.0 32-bit scanner find...extra space???

[Matt]

Cool, just got the answer from AVG.
Dear Sir/Madam,
  
Thank you for your email.
  
The return codes will be added in some of the next versions.


It should only be a matter of time now until this works.  Hopefully
this will be an easy change for them.

Matt





Bill Landry wrote:

  
  
  
  
  Matt, what does your report line
look like?  If it's:
   
  REPORT1    Infections:
   
  maybe try instead
   
  REPORT1   Identified
   
  without a colon ":".  Just curious
if that fixes it, since the report does not contain "Infections:", but
does contain "Identified".
   
  Bill
  
-
Original Message - 
From:
Matt

To:
[EMAIL PROTECTED] 
Sent:
Friday, February 06, 2004 11:38 PM
Subject:
[Declude.Virus] AVG 7.0 32-bit scanner find...extra space???


Ok, I've been testing things and I think I might have found why Declude
can't make use of AVG 7's 32-bit scanner, avgscan.exe.  In the 16-bit
version, the program will report:

 Virus identified EICAR_Test

In the 32-bit version, there is an extra space:

    Virus identified  EICAR_Test

Aside from that difference, I can't find anything else that would
explain it not working.  BTW, I did find that they support the /NOBOOT
switch with avgscan.exe despite the lack of this appearing in the help
output, and unlike avg.exe, it will by default scan the boot sectors.

Scott, could you tell me if the extra space is in fact the issue at
hand here?  Here's the config and the output from the report.txt file
with the 32-bit version:
- Command Line -
  C:\Progra~1\Grisoft\AVG7\avgscan.exe /NOMEM /NOBOOT /NOHIMEM
/NOEXPORT /NOSELF /ARC /RT /ARCW /RTW /MACROW /REPORT=report.txt
C:\IMail\Declude\Virus1\eicar.com
  
- Report.txt -
  AVG 7.0 Anti-Virus System
Copyright (c) GRISOFT,s.r.o. 2003
Program version 7.0  Engine: 718 database version 261.8.3
Command line: [/NOMEM /NOBOOT /NOHIMEM /NOEXPORT /NOSELF /ARC /RT /ARCW
/RTW /MACROW /REPORT=C:\report.txt /SCAN
C:\IMail\Declude\Virus\eicar.com]
"C:\IMail\Declude\Virus\eicar.com"  Virus identified  EICAR_Test
  
  

Test start 2/7/2004 2:24:36
Elapsed time 0 sec.

Scanned files  :    1
Scanned sectors    :    0
Infected    files  :    1
Infected    sectors    :    0



Thanks,

Matt
-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=
  


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

Re: [Declude.Virus] AVG 7.0 32-bit scanner find...extra space???

[Matt]

Bill,

Most everything is the same as the 16-bit version.  The following works
(won't error in Declude) with avgscan.exe except that it will never
alert Declude to a virus.
SCANFILE2
C:\Progra~1\Grisoft\AVG7\avgscan.exe /NOMEM /NOBOOT /NOHIMEM /NOEXPORT
/NOSELF /ARC /RT /ARCW /RTW /MACROW /REPORT=report.txt
  VIRUSCODE2    5
  VIRUSCODE2    6
  REPORT2       identified

I've found in the last 15 minutes that AVG has their result codes on
their site listed in conjunction with the DOS command line scanners
specifically and no mention of result codes with the 32-bit versions. 
The result codes are the same between the two versions.  I've already
written tech support asking them if there are different result codes
for avgscan.exe, and if there are none, if they could add them.  Here's
what the DOS version provides:

    http://www.grisoft.com/faq/us_faqtext.php?id=79&sid=4

Note that I've changed my virus codes for avg.exe based on this list. 
The options shared on the Declude site will treat an error as a virus
(result code 2).

I'm thinking that the absence of result codes from avgscan.exe may be
the most likely culprit.  Everything else besides that and the extra
space mentioned earlier, seems to be in order.  I'm deadset on finding
out conclusively what is at issue here.  You can tell how much less
efficient the 16-bit version is in comparison to the 32-bit version
just by calling it on an eicar test file.  The 16-bit version isn't
appropriate for any high volume environment.

Matt



Bill Landry wrote:

  
  
  
  
  Matt, what does your report line
look like?  If it's:
   
  REPORT1    Infections:
   
  maybe try instead
   
  REPORT1   Identified
   
  without a colon ":".  Just curious
if that fixes it, since the report does not contain "Infections:", but
does contain "Identified".
   
  Bill
  
-
Original Message - 
From:
Matt

To:
[EMAIL PROTECTED] 
Sent:
Friday, February 06, 2004 11:38 PM
Subject:
[Declude.Virus] AVG 7.0 32-bit scanner find...extra space???


Ok, I've been testing things and I think I might have found why Declude
can't make use of AVG 7's 32-bit scanner, avgscan.exe.  In the 16-bit
version, the program will report:

 Virus identified EICAR_Test

In the 32-bit version, there is an extra space:

    Virus identified  EICAR_Test

Aside from that difference, I can't find anything else that would
explain it not working.  BTW, I did find that they support the /NOBOOT
switch with avgscan.exe despite the lack of this appearing in the help
output, and unlike avg.exe, it will by default scan the boot sectors.

Scott, could you tell me if the extra space is in fact the issue at
hand here?  Here's the config and the output from the report.txt file
with the 32-bit version:
- Command Line -
  C:\Progra~1\Grisoft\AVG7\avgscan.exe /NOMEM /NOBOOT /NOHIMEM
/NOEXPORT /NOSELF /ARC /RT /ARCW /RTW /MACROW /REPORT=report.txt
C:\IMail\Declude\Virus1\eicar.com
  
- Report.txt -
  AVG 7.0 Anti-Virus System
Copyright (c) GRISOFT,s.r.o. 2003
Program version 7.0  Engine: 718 database version 261.8.3
Command line: [/NOMEM /NOBOOT /NOHIMEM /NOEXPORT /NOSELF /ARC /RT /ARCW
/RTW /MACROW /REPORT=C:\report.txt /SCAN
C:\IMail\Declude\Virus\eicar.com]
"C:\IMail\Declude\Virus\eicar.com"  Virus identified  EICAR_Test
  
  

Test start 2/7/2004 2:24:36
Elapsed time 0 sec.

Scanned files  :    1
Scanned sectors    :    0
Infected    files  :    1
Infected    sectors    :    0



Thanks,

Matt
-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=
  


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

Re: [Declude.Virus] AVG 7.0 32-bit scanner find...extra space???

[Bill Landry]

Matt, what does your report line look like?  
If it's:
 
REPORT1    
Infections:
 
maybe try instead
 
REPORT1   Identified
 
without a colon ":".  Just curious if that 
fixes it, since the report does not contain "Infections:", but does contain 
"Identified".
 
Bill

  - Original Message - 
  From: 
  Matt 
  To: [EMAIL PROTECTED] 
  Sent: Friday, February 06, 2004 11:38 
  PM
  Subject: [Declude.Virus] AVG 7.0 32-bit 
  scanner find...extra space???
  Ok, I've been testing things and I think I might have found why 
  Declude can't make use of AVG 7's 32-bit scanner, avgscan.exe.  In the 
  16-bit version, the program will report: 
  Virus identified EICAR_TestIn the 32-bit version, there is an 
  extra space:    Virus identified  
  EICAR_TestAside from that difference, I can't find anything else 
  that would explain it not working.  BTW, I did find that they support the 
  /NOBOOT switch with avgscan.exe despite the lack of this appearing in the help 
  output, and unlike avg.exe, it will by default scan the boot 
  sectors.Scott, could you tell me if the extra space is in fact the 
  issue at hand here?  Here's the config and the output from the report.txt 
  file with the 32-bit version:
  - Command Line 
-C:\Progra~1\Grisoft\AVG7\avgscan.exe /NOMEM /NOBOOT /NOHIMEM 
/NOEXPORT /NOSELF /ARC /RT /ARCW /RTW /MACROW /REPORT=report.txt 
C:\IMail\Declude\Virus1\eicar.com- Report.txt 
-AVG 7.0 Anti-Virus SystemCopyright (c) GRISOFT,s.r.o. 
2003Program version 7.0  Engine: 718 database version 
261.8.3Command line: [/NOMEM /NOBOOT /NOHIMEM /NOEXPORT /NOSELF /ARC /RT 
/ARCW /RTW /MACROW /REPORT=C:\report.txt /SCAN 
C:\IMail\Declude\Virus\eicar.com]"C:\IMail\Declude\Virus\eicar.com"  
Virus identified  
EICAR_TestTest 
start 2/7/2004 2:24:36Elapsed time 0 
sec.Scanned 
files  :    
1Scanned 
sectors    :    
0Infected    
files  :    
1Infected    
sectors    :    
0Thanks,Matt-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

Re: [Declude.Virus] AVG pop ups

[Scott Heath]

We pulled down 6 because it was free (they didn't want to spend money on the scanner 
during the trial)

-- Original Message --
From: Matt <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
Date:  Thu, 05 Feb 2004 16:20:29 -0500

>The new version of AVG is 7.  Maybe you picked up an old version though.
>
>In AVG 7 at least, you want to make sure that you don't install AVG 
>Resident Shield or the E-mail scanner.  It could be that your pop-ups 
>are coming from the real-time component.
>
>Also, if you are running two virus scanners, you need to be numbering 
>them like so:
>
>SCANFILE1C:\Progra~1\FSI\F-Prot\fpcmd.exe /TYPE /SILENT /NOBOOT
>/NOMEM /ARCHIVE /PACKED /DUMB /REPORT=report.txt
>VIRUSCODE13
>VIRUSCODE16
>REPORT1Infection:
>
>SCANFILE2C:\Progra~1\Grisoft\AVG7\avg.exe /NOMEM /NOSELF /ARC
>/REPORT=report.txt
>VIRUSCODE22
>VIRUSCODE26
>REPORT2identified
>
>
>I'm a much bigger fan of F-Prot because it's faster, at least in the 
>32-bit mode, easier to configure, and it's not at all expensive.  I have 
>yet to figure out how to use the 32-bit executable for AVG 7, but this 
>is likely an issue with virus codes and the report line (please someone 
>help if you know the trick for avgscan.exe).
>
>Matt
>
>
>
>Scott Heath wrote:
>
>>Its the same one on the declude site...
>>SCANFILE  
>>C:\Progra~1\Grisoft\AVG6\avg.exe /NOMEM /NOSELF /ARC /REPORT=report.txt
>>
>>VIRUSCODE 2
>>VIRUSCODE 6 
>>REPORTidentified
>>
>>
>>-- Original Message --
>>From: Matt <[EMAIL PROTECTED]>
>>Reply-To: [EMAIL PROTECTED]
>>Date:  Thu, 05 Feb 2004 16:04:44 -0500
>>
>>  
>>
>>>It would be best to share your config for that scanner.
>>>
>>>Matt
>>>
>>>
>>>
>>>Scott Heath wrote:
>>>
>>>
>>>
I'm running the demo version of declude (we will be buying it soon Scott), using 
AVG from Grisoft as our scanner. Is there a way to supress the pop ups that avg 
generates when it finds a virus?
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.


 

  

>>>-- 
>>>=
>>>MailPure custom filters for Declude JunkMail Pro.
>>>http://www.mailpure.com/software/
>>>=
>>>
>>>
>>>---
>>>[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
>>>
>>>---
>>>This E-mail came from the Declude.Virus mailing list.  To
>>>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>>>type "unsubscribe Declude.Virus".The archives can be found
>>>at http://www.mail-archive.com.
>>>
>>>
>>>
>>---
>>[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
>>
>>---
>>This E-mail came from the Declude.Virus mailing list.  To
>>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>>type "unsubscribe Declude.Virus".The archives can be found
>>at http://www.mail-archive.com.
>>
>>
>>  
>>
>
>-- 
>=
>MailPure custom filters for Declude JunkMail Pro.
>http://www.mailpure.com/software/
>=
>
>
>
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

Re: [Declude.Virus] AVG pop ups

[Matt]

The new version of AVG is 7.  Maybe you picked up an old version though.

In AVG 7 at least, you want to make sure that you don't install AVG
Resident Shield or the E-mail scanner.  It could be that your pop-ups
are coming from the real-time component.

Also, if you are running two virus scanners, you need to be numbering
them like so:

SCANFILE1    C:\Progra~1\FSI\F-Prot\fpcmd.exe /TYPE
/SILENT /NOBOOT /NOMEM /ARCHIVE /PACKED /DUMB /REPORT=report.txt
VIRUSCODE1    3
VIRUSCODE1    6
REPORT1        Infection:
  
SCANFILE2    C:\Progra~1\Grisoft\AVG7\avg.exe /NOMEM /NOSELF /ARC
/REPORT=report.txt
VIRUSCODE2    2
VIRUSCODE2    6 
REPORT2        identified


I'm a much bigger fan of F-Prot because it's faster, at least in the
32-bit mode, easier to configure, and it's not at all expensive.  I
have yet to figure out how to use the 32-bit executable for AVG 7, but
this is likely an issue with virus codes and the report line (please
someone help if you know the trick for avgscan.exe).

Matt



Scott Heath wrote:

  Its the same one on the declude site...
SCANFILE  
C:\Progra~1\Grisoft\AVG6\avg.exe /NOMEM /NOSELF /ARC /REPORT=report.txt

VIRUSCODE 2
VIRUSCODE 6 
REPORTidentified


-- Original Message --
From: Matt <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
Date:  Thu, 05 Feb 2004 16:04:44 -0500

  
  
It would be best to share your config for that scanner.

Matt



Scott Heath wrote:



  I'm running the demo version of declude (we will be buying it soon Scott), using AVG from Grisoft as our scanner. Is there a way to supress the pop ups that avg generates when it finds a virus?
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.


 

  

-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.


  
  ---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.


  


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

Re: [Declude.Virus] AVG pop ups

[Scott Heath]

Its the same one on the declude site...
SCANFILE  
C:\Progra~1\Grisoft\AVG6\avg.exe /NOMEM /NOSELF /ARC /REPORT=report.txt

VIRUSCODE 2
VIRUSCODE 6 
REPORTidentified


-- Original Message --
From: Matt <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
Date:  Thu, 05 Feb 2004 16:04:44 -0500

>It would be best to share your config for that scanner.
>
>Matt
>
>
>
>Scott Heath wrote:
>
>>I'm running the demo version of declude (we will be buying it soon Scott), using AVG 
>>from Grisoft as our scanner. Is there a way to supress the pop ups that avg 
>>generates when it finds a virus?
>>---
>>[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
>>
>>---
>>This E-mail came from the Declude.Virus mailing list.  To
>>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>>type "unsubscribe Declude.Virus".The archives can be found
>>at http://www.mail-archive.com.
>>
>>
>>  
>>
>
>-- 
>=
>MailPure custom filters for Declude JunkMail Pro.
>http://www.mailpure.com/software/
>=
>
>
>---
>[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
>
>---
>This E-mail came from the Declude.Virus mailing list.  To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.Virus".The archives can be found
>at http://www.mail-archive.com.
>
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

Re: [Declude.Virus] AVG pop ups

[Matt]

It would be best to share your config for that scanner.

Matt



Scott Heath wrote:

I'm running the demo version of declude (we will be buying it soon Scott), using AVG 
from Grisoft as our scanner. Is there a way to supress the pop ups that avg generates 
when it finds a virus?
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.
 

--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] AVG - Not identifying virus found.

[Mike Wiegers]

With version 7 I couldn't use the "avgscan.exe" (Scanned: Error starting
scanner) but it worked with

"C:\Progra~1\Grisoft\AVG7\avg.exe /NOMEM /NOSELF /ARC /REPORT=report.txt"

Thanks..
Mike

-Original Message-

>SCANFILE2  C:\Progra~1\Grisoft\AVG6\avgscan.exe /NOMEM /NOSELF /ARC
>/REPORT=report.txt
>VIRUSCODE 2
>VIRUSCODE 6
>REPORT2identified
...

>Scott will correct me if I am wrong.

Good work -- it looks like it can be done.  :)  That is good news.

-Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] AVG

[Eddie Pang]

*** AVG Anti-Virus 7.0 File Server Edition ***

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Webmaster Oilfield
Directory
Sent: Monday, August 04, 2003 9:35 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] AVG


I'm confused which avg version are you supposed to use with Declude and
Imail anyway all i saw when i selected mail server that imail wasn't
listed ... only exchange etc

please tell me which one to use...

Sheldon

- Original Message -
From: "Paul Navarre" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, August 04, 2003 6:47 PM
Subject: [Declude.Virus] AVG


> I just downloaded AVG. Has anybody found a way to automatically have AVG
update defs? Preferably
> while logged out?
>
> Thanks,
>
> Paul Navarre
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.Virus mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.Virus".The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] AVG - Not identifying virus found.

[Eddie Pang]

Thanks Fritz!!

Eddie :)


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Fritz Squib
Sent: Tuesday, August 05, 2003 2:20 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] AVG - Not identifying virus found.


Eddie,
 After some fooling around, I *THINK* this will work, at least this is how
mine is set up and it *APPEARS* to be working.

SCANFILE  c:\Progra~1\FSI\F-Prot\fpcmd.EXE -TYPE -SILENT -NOMEM -ARCHIVE
-NOBOOT -DUMB -REPORT=report.txt
VIRUSCODE 3
VIRUSCODE 6
REPORTInfection:

SCANFILE2  C:\Progra~1\Grisoft\AVG6\avgscan.exe /NOMEM /NOSELF /ARC
/REPORT=report.txt
VIRUSCODE 2
VIRUSCODE 6
REPORT2identified

The key here is REPORT2, that is the text string declude looks for to find
the virus name.

For my test I changed AVG to be my primary and I received:

The Declude Virus software on wpa.net has reported that you were sent an
E-mail from [EMAIL PROTECTED], containing the  EICAR_Test virus in
the eicar.com attachment.  The subject of the E-mail was "Test eicar.com
file [eicarplain]".
The E-mail containing the virus has been quarantined to prevent further
damage.

Scott will correct me if I am wrong.

Fritz

Frederick P. Squib, Jr.
Network Operations
Citizens Telephone Company of Kecksburg
Citizens Internet Services
http://www.wpa.net

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Eddie Pang
Sent: Tuesday, August 05, 2003 5:01 AM
To: [EMAIL PROTECTED]
Subject: [Declude.Virus] AVG - Not identifying virus found.


For those using the trial version, have you noticed that AVG is not
identifying what virus is caught.

This is a eicar.zip test file.

08/04/2003 21:48:13 Q61390032023c9aef Scanner #1 detected a virus 08/04/2003
21:48:13 Q61390032023c9aef File(s) are INFECTED [: 6] 08/04/2003 21:48:13
Q61390032023c9aef Deleting file with virus 08/04/2003 21:48:13
Q61390032023c9aef Deleting E-mail with virus! 08/04/2003 21:48:13
Q61390032023c9aef Scanned: CONTAINS A VIRUS [MIME: 2 610] 08/04/2003
21:48:13 Q61390032023c9aef From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [incoming
from 24.94.xxx.xxx] 08/04/2003 21:48:13 Q61390032023c9aef Subject: test

Is there a way to have AVG pass through the name of the virus, so that our
sender.eml will know what viruses to skip.

Sincerely,
Eddie :)

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just
send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.
---


---
[This E-mail scanned by Citizens Internet Services with Declude Virus.]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

Re: [Declude.Virus] AVG - Not identifying virus found.

[Mailing Lists]

Works great Fritz!

BTW, what is the difference between avgscan.exe and avg.exe? And which
should be used?

Peter


- Original Message - 
From: "Fritz Squib" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, August 05, 2003 8:20 AM
Subject: RE: [Declude.Virus] AVG - Not identifying virus found.


Eddie,
 After some fooling around, I *THINK* this will work, at least this is how
mine is set up and it *APPEARS* to be working.

SCANFILE  c:\Progra~1\FSI\F-Prot\fpcmd.EXE -TYPE -SILENT -NOMEM -ARCHIVE
-NOBOOT -DUMB -REPORT=report.txt
VIRUSCODE 3
VIRUSCODE 6
REPORTInfection:

SCANFILE2  C:\Progra~1\Grisoft\AVG6\avgscan.exe /NOMEM /NOSELF /ARC
/REPORT=report.txt
VIRUSCODE 2
VIRUSCODE 6
REPORT2identified

The key here is REPORT2, that is the text string declude looks for to find
the virus name.

For my test I changed AVG to be my primary and I received:

The Declude Virus software on wpa.net has reported that you were sent an
E-mail from [EMAIL PROTECTED], containing the  EICAR_Test virus in
the eicar.com attachment.  The subject of the E-mail was "Test eicar.com
file [eicarplain]".
The E-mail containing the virus has been quarantined to prevent further
damage.

Scott will correct me if I am wrong.

Fritz

Frederick P. Squib, Jr.
Network Operations
Citizens Telephone Company of Kecksburg
Citizens Internet Services
http://www.wpa.net

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Eddie Pang
Sent: Tuesday, August 05, 2003 5:01 AM
To: [EMAIL PROTECTED]
Subject: [Declude.Virus] AVG - Not identifying virus found.


For those using the trial version, have you noticed that AVG is not
identifying what virus is caught.

This is a eicar.zip test file.

08/04/2003 21:48:13 Q61390032023c9aef Scanner #1 detected a virus 08/04/2003
21:48:13 Q61390032023c9aef File(s) are INFECTED [: 6] 08/04/2003 21:48:13
Q61390032023c9aef Deleting file with virus 08/04/2003 21:48:13
Q61390032023c9aef Deleting E-mail with virus! 08/04/2003 21:48:13
Q61390032023c9aef Scanned: CONTAINS A VIRUS [MIME: 2 610] 08/04/2003
21:48:13 Q61390032023c9aef From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [incoming
from 24.94.xxx.xxx] 08/04/2003 21:48:13 Q61390032023c9aef Subject: test

Is there a way to have AVG pass through the name of the virus, so that our
sender.eml will know what viruses to skip.

Sincerely,
Eddie :)

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just
send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.
---


---
[This E-mail scanned by Citizens Internet Services with Declude Virus.]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] AVG

[Eddie Pang]

It appears avgscan is faster than avg.

If you also look at the display, of avgscan you'll see a statement
AVG7 Anti-Virus command line scanner (COM)..

I am also starting to add this as a 2nd scanner.

Eddie :)


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Fritz Squib
Sent: Monday, August 04, 2003 4:19 PM
To: [EMAIL PROTECTED]
Subject: [Declude.Virus] AVG


One more question, should we be using avg.exe (32 bit DOS) or avgscan.exe?

The command line switches look the same.

Any input is appreciated.

Fritz

Frederick P. Squib, Jr.
Network Operations
Citizens Telephone Company of Kecksburg
Citizens Internet Services
http://www.wpa.net

---
[This E-mail scanned by Citizens Internet Services with Declude Virus.]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] AVG - Not identifying virus found.

[Fritz Squib]

I'm guilty of not RTFM, please note the multiple scanner config below,

SCANFILE  c:\Progra~1\FSI\F-Prot\fpcmd.EXE -TYPE -SILENT -NOMEM -ARCHIVE
-NOBOOT -DUMB -REPORT=report.txt
VIRUSCODE 3
VIRUSCODE 6
REPORTInfection:

SCANFILE2  C:\Progra~1\Grisoft\AVG6\avgscan.exe /NOMEM /NOSELF /ARC
/REPORT=report.txt
VIRUSCODE2 2
VIRUSCODE2 6
REPORT2identified

I forgot to add a "2" to the VIRUSCODE, and was getting errors in my logfile
from the first scanner whenever the second scanner would detect a virus.

It looks to me like avg.exe is the DOS version and avgscan.exe is the true
32 bit version.

Fritz

Frederick P. Squib, Jr.
Network Operations
Citizens Telephone Company of Kecksburg
Citizens Internet Services
http://www.wpa.net

---
[This E-mail scanned by Citizens Internet Services with Declude Virus.]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] AVG - Not identifying virus found.

[Steven Copeland]

Downloaded the trial version of AVG for File Server this morning and I've
found if I use avgscan.exe Declude won't call it, but if I use avg.exe it
works.

First scanner is FProt
second scanner is AVG

With avgscan.exe

08/05/2003 10:36:41 Qcf09004301900571 Scanner 1: Virus=: EICAR_Test_File
Attachment=eicar.com [12] I
08/05/2003 10:36:42 Qcf09004301900571 Found a bogus .com file
08/05/2003 10:36:42 Qcf09004301900571 File(s) are INFECTED [:
EICAR_Test_File: 0]
08/05/2003 10:36:42 Qcf09004301900571 Deleting file with virus
08/05/2003 10:36:42 Qcf09004301900571 Deleting E-mail with virus!
08/05/2003 10:36:42 Qcf09004301900571 Scanned: CONTAINS A VIRUS [MIME: 2
684]
08/05/2003 10:36:42 Qcf09004301900571 From: [EMAIL PROTECTED] To:
[EMAIL PROTECTED] [incoming from 64.250.192.32]
08/05/2003 10:36:42 Qcf09004301900571 Subject: Test eicar.com file
[eicarplain]

with avg.exe

08/05/2003 10:38:03 Qcf5b0028015e467c Scanner 1: Virus=: EICAR_Test_File
Attachment=eicar.com [12] I
08/05/2003 10:38:05 Qcf5d00ed015a4ff2 Scanned: Virus Free [Prescan OK][MIME:
2 6620]
08/05/2003 10:38:06 Qcf5b0028015e467c Scanner 2: Virus= EICAR_Test
Attachment=eicar.com [12] I
08/05/2003 10:38:06 Qcf5b0028015e467c Found a bogus .com file
08/05/2003 10:38:06 Qcf5b0028015e467c File(s) are INFECTED [:
EICAR_Test_File: 6]
08/05/2003 10:38:06 Qcf5b0028015e467c Deleting file with virus
08/05/2003 10:38:06 Qcf5b0028015e467c Deleting E-mail with virus!
08/05/2003 10:38:06 Qcf5b0028015e467c Scanned: CONTAINS A VIRUS [MIME: 2
684]
08/05/2003 10:38:06 Qcf5b0028015e467c From: [EMAIL PROTECTED] To:
[EMAIL PROTECTED] [incoming from 64.250.192.32]
08/05/2003 10:38:06 Qcf5b0028015e467c Subject: Test eicar.com file
[eicarplain]

Steven Copeland

> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Fritz Squib
> Sent: Tuesday, August 05, 2003 10:20 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.Virus] AVG - Not identifying virus found.
>
>
> I'm guilty of not RTFM, please note the multiple scanner config below,
>
> SCANFILE  c:\Progra~1\FSI\F-Prot\fpcmd.EXE -TYPE -SILENT -NOMEM -ARCHIVE
> -NOBOOT -DUMB -REPORT=report.txt
> VIRUSCODE 3
> VIRUSCODE 6
> REPORTInfection:
>
> SCANFILE2  C:\Progra~1\Grisoft\AVG6\avgscan.exe /NOMEM /NOSELF /ARC
> /REPORT=report.txt
> VIRUSCODE2 2
> VIRUSCODE2 6
> REPORT2identified
>
> I forgot to add a "2" to the VIRUSCODE, and was getting errors in
> my logfile
> from the first scanner whenever the second scanner would detect a virus.
>
> It looks to me like avg.exe is the DOS version and avgscan.exe is the true
> 32 bit version.
>
> Fritz
>
> Frederick P. Squib, Jr.
> Network Operations
> Citizens Telephone Company of Kecksburg
> Citizens Internet Services
> http://www.wpa.net
>
> ---
> [This E-mail scanned by Citizens Internet Services with Declude Virus.]
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] AVG - Not identifying virus found.

[Fritz Squib]

Eddie,
 After some fooling around, I *THINK* this will work, at least this is how
mine is set up and it *APPEARS* to be working.

SCANFILE  c:\Progra~1\FSI\F-Prot\fpcmd.EXE -TYPE -SILENT -NOMEM -ARCHIVE
-NOBOOT -DUMB -REPORT=report.txt
VIRUSCODE 3
VIRUSCODE 6
REPORTInfection:

SCANFILE2  C:\Progra~1\Grisoft\AVG6\avgscan.exe /NOMEM /NOSELF /ARC
/REPORT=report.txt
VIRUSCODE 2
VIRUSCODE 6
REPORT2identified

The key here is REPORT2, that is the text string declude looks for to find
the virus name.

For my test I changed AVG to be my primary and I received:

The Declude Virus software on wpa.net has reported that you were sent an
E-mail from [EMAIL PROTECTED], containing the  EICAR_Test virus in
the eicar.com attachment.  The subject of the E-mail was "Test eicar.com
file [eicarplain]".  
The E-mail containing the virus has been quarantined to prevent further
damage.

Scott will correct me if I am wrong.

Fritz

Frederick P. Squib, Jr.
Network Operations
Citizens Telephone Company of Kecksburg
Citizens Internet Services
http://www.wpa.net 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Eddie Pang
Sent: Tuesday, August 05, 2003 5:01 AM
To: [EMAIL PROTECTED]
Subject: [Declude.Virus] AVG - Not identifying virus found.


For those using the trial version, have you noticed that AVG is not
identifying what virus is caught.

This is a eicar.zip test file.

08/04/2003 21:48:13 Q61390032023c9aef Scanner #1 detected a virus 08/04/2003
21:48:13 Q61390032023c9aef File(s) are INFECTED [: 6] 08/04/2003 21:48:13
Q61390032023c9aef Deleting file with virus 08/04/2003 21:48:13
Q61390032023c9aef Deleting E-mail with virus! 08/04/2003 21:48:13
Q61390032023c9aef Scanned: CONTAINS A VIRUS [MIME: 2 610] 08/04/2003
21:48:13 Q61390032023c9aef From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [incoming
from 24.94.xxx.xxx] 08/04/2003 21:48:13 Q61390032023c9aef Subject: test

Is there a way to have AVG pass through the name of the virus, so that our
sender.eml will know what viruses to skip.

Sincerely,
Eddie :)

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just
send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.
---


---
[This E-mail scanned by Citizens Internet Services with Declude Virus.]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] AVG - Grisoft Errors after installation

[Panda Consulting S.A. Luis Alberto Arango]

Got it.. corrected and works great...
Sorry to bother you...

Please ignore other email I just sent about this same topic... 
Luis Arango

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Monday, August 04, 2003 6:15 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] AVG - Grisoft Errors after installation


>However when running, I found these messages in the logs: Check the bold
lines
>
>
>08/04/2003 17:53:34.796 Qe3ee000801266a26 Starting scanner #1: 
>D:\Progra~1\Grisoft\AVG7\avg.exe /NOMEM /NOSELF /ARC 
>d:\IMail\spool\DE3EE0~1.VIR\
>08/04/2003 17:53:41.937 Qe3ee000801266a26 Starting scanner 
>#2:  d:\IMail\spool\DE3EE0~1.VIR\

The problem here is that Declude Virus knows that you have 2 scanners, but 
doesn't have a filename to use for the second one.


>SCANFILE  D:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE 
>/NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt
>VIRUSCODE 3
>VIRUSCODE 6
>REPORTInfection:
>
>SCANFILE D:\Progra~1\Grisoft\AVG7\avg.exe /NOMEM /NOSELF /ARC
>VIRUSCODE 2
>VIRUSCODE 6

The problem here is that Declude Virus doesn't know which is which (for 
example, is the "VIRUSCODE 3" line supposed to go with the first scanner or 
the second one?).  If you change it to:

SCANFILE1  D:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE 
/NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt
VIRUSCODE1 3
VIRUSCODE1 6
REPORT1Infection:

SCANFILE2 D:\Progra~1\Grisoft\AVG7\avg.exe /NOMEM /NOSELF /ARC
VIRUSCODE2 2
VIRUSCODE2 6

Then, it should work.


-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.
__
[Email scanned for viruses by Panda Consulting -www.pandacons.com-]
[Email escaneado contra virus por Panda Consulting -www.pandacons.com-]


__
[Email scanned for viruses by Panda Consulting -www.pandacons.com-]
[Email escaneado contra virus por Panda Consulting -www.pandacons.com-]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] AVG - Grisoft Errors after installation

[Panda Consulting S.A. Luis Alberto Arango]

Thanks...problem solved..

Since I was in a hurry to stop this MIMAIL virus.. I didn't do the obvious..
read the entire manual... I just saw the first initial part of it... the
Multiple Scanners part was below.. and didn't see it.

Thanks for your fast response..

Thanks to Scott again.. 

Luis

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Fritz Squib
Sent: Monday, August 04, 2003 6:21 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] AVG - Grisoft Errors after installation

http://www.declude.com/virus/manual.htm

Multiple Scanners (PRO)
Declude Virus Pro allows you to have use to 5 different virus scanners.
You add them by adding the same "SCANFILE", "VIRUSCODE", "REPORT" and
"OKCODE" lines that you would normally add, except there will be a number
after them to indicate which scanner it applies to. So, where you might have
the following now:


SCANFILEC:\Scanner\scan.exe /ALL
VIRUSCODE   13
REPORT  Found

You might change it to:


SCANFILE1   C:\Scanner\scan.exe /ALL
VIRUSCODE1  13
REPORT1 Found

SCANFILE2   C:\Scanner2\scanner.exe
VIRUSCODE2  3
VIRUSCODE2  6
REPORT2 Infection

Note that if you don't include the scanner number, "1" is assumed (so you
don't have to change the existing settings).

Fritz

Frederick P. Squib, Jr.
Network Operations
Citizens Telephone Company of Kecksburg
Citizens Internet Services
http://www.wpa.net 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Panda Consulting S.A.
Luis Alberto Arango
Sent: Monday, August 04, 2003 7:06 PM
To: [EMAIL PROTECTED]
Subject: [Declude.Virus] AVG - Grisoft Errors after installation


I installed the trial version of AVG with the settings shown below...

Here is a extract of my config lines 
# The "" in the LOGFILE option automatically gets replaced with the
month/date

LOGFILE spool\vir.log
LOGLEVELDEBUG
CONSOLE  OFF

#
# SCANFILE is the location of the command-line virus scanner. Note that it 
# must include the full path.  VIRUSCODE is the code that scanner returns if
# it finds a virus.
#

SCANFILE  D:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE
/NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt
VIRUSCODE 3
VIRUSCODE 6
REPORTInfection:

SCANFILE D:\Progra~1\Grisoft\AVG7\avg.exe /NOMEM /NOSELF /ARC
VIRUSCODE 2
VIRUSCODE 6



# WARNING:  F-Prot v3.09 and later may install a "F-Prot.PIF" file; you must
delete this if it exists.

# VIRDIR is the directory to move E-mails with viruses; by default,
# it is set to 'virus' (\IMail\spool\virus).

VIRDIRspool\virus

Any Ideas on how to have both scanners running?

Regards
Luis Arango

---
[This E-mail scanned by Citizens Internet Services with Declude Virus.]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.
__
[Email scanned for viruses by Panda Consulting -www.pandacons.com-]
[Email escaneado contra virus por Panda Consulting -www.pandacons.com-]


__
[Email scanned for viruses by Panda Consulting -www.pandacons.com-]
[Email escaneado contra virus por Panda Consulting -www.pandacons.com-]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

RE: [Declude.Virus] AVG - Grisoft Errors after installation

[Fritz Squib]

http://www.declude.com/virus/manual.htm

Multiple Scanners (PRO)
Declude Virus Pro allows you to have use to 5 different virus scanners.
You add them by adding the same "SCANFILE", "VIRUSCODE", "REPORT" and
"OKCODE" lines that you would normally add, except there will be a number
after them to indicate which scanner it applies to. So, where you might have
the following now:


SCANFILEC:\Scanner\scan.exe /ALL
VIRUSCODE   13
REPORT  Found

You might change it to:


SCANFILE1   C:\Scanner\scan.exe /ALL
VIRUSCODE1  13
REPORT1 Found

SCANFILE2   C:\Scanner2\scanner.exe
VIRUSCODE2  3
VIRUSCODE2  6
REPORT2 Infection

Note that if you don't include the scanner number, "1" is assumed (so you
don't have to change the existing settings).

Fritz

Frederick P. Squib, Jr.
Network Operations
Citizens Telephone Company of Kecksburg
Citizens Internet Services
http://www.wpa.net 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Panda Consulting S.A.
Luis Alberto Arango
Sent: Monday, August 04, 2003 7:06 PM
To: [EMAIL PROTECTED]
Subject: [Declude.Virus] AVG - Grisoft Errors after installation


I installed the trial version of AVG with the settings shown below...

Here is a extract of my config lines 
# The "" in the LOGFILE option automatically gets replaced with the
month/date

LOGFILE spool\vir.log
LOGLEVELDEBUG
CONSOLE  OFF

#
# SCANFILE is the location of the command-line virus scanner. Note that it 
# must include the full path.  VIRUSCODE is the code that scanner returns if
# it finds a virus.
#

SCANFILE  D:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE
/NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt
VIRUSCODE 3
VIRUSCODE 6
REPORTInfection:

SCANFILE D:\Progra~1\Grisoft\AVG7\avg.exe /NOMEM /NOSELF /ARC
VIRUSCODE 2
VIRUSCODE 6



# WARNING:  F-Prot v3.09 and later may install a "F-Prot.PIF" file; you must
delete this if it exists.

# VIRDIR is the directory to move E-mails with viruses; by default,
# it is set to 'virus' (\IMail\spool\virus).

VIRDIRspool\virus

Any Ideas on how to have both scanners running?

Regards
Luis Arango

---
[This E-mail scanned by Citizens Internet Services with Declude Virus.]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

Re: [Declude.Virus] AVG - Grisoft

[Bill Landry]

From: "R. Scott Perry" <[EMAIL PROTECTED]>

> This is a rare occurrence -- but one that seems completely unacceptable,
> especially given how widespread this virus was.

The strange thing is that F-Prot has release three updates since Mimail hit
(including one today) and none have resolved the failure of their virus
scanner to catch this one.  I even sent them a copy of the message.zip file
and asked for an update, and have yet to hear back from them.

Bill

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

Re: [Declude.Virus] AVG - Grisoft Errors after installation

[R. Scott Perry]

However when running, I found these messages in the logs: Check the bold lines

08/04/2003 17:53:34.796 Qe3ee000801266a26 Starting scanner #1: 
D:\Progra~1\Grisoft\AVG7\avg.exe /NOMEM /NOSELF /ARC 
d:\IMail\spool\DE3EE0~1.VIR\
08/04/2003 17:53:41.937 Qe3ee000801266a26 Starting scanner 
#2:  d:\IMail\spool\DE3EE0~1.VIR\
The problem here is that Declude Virus knows that you have 2 scanners, but 
doesn't have a filename to use for the second one.


SCANFILE  D:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE 
/NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt
VIRUSCODE 3
VIRUSCODE 6
REPORTInfection:

SCANFILE D:\Progra~1\Grisoft\AVG7\avg.exe /NOMEM /NOSELF /ARC
VIRUSCODE 2
VIRUSCODE 6
The problem here is that Declude Virus doesn't know which is which (for 
example, is the "VIRUSCODE 3" line supposed to go with the first scanner or 
the second one?).  If you change it to:

SCANFILE1  D:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE 
/NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt
VIRUSCODE1 3
VIRUSCODE1 6
REPORT1Infection:

SCANFILE2 D:\Progra~1\Grisoft\AVG7\avg.exe /NOMEM /NOSELF /ARC
VIRUSCODE2 2
VIRUSCODE2 6
Then, it should work.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

Re: [Declude.Virus] AVG - Grisoft

[R. Scott Perry]

Which executable do I use for AVG 7.0? I download the trial and want to
evaluate the differences between F-prot and AVG 7.0.
You should use the avg.exe file.  You can use the following settings:

SCANFILE C:\Progra~1\Grisoft\AVG6\avg.exe /NOMEM /NOSELF /ARC
VIRUSCODE 2
VIRUSCODE 6
I currently only have the lite version of declude virus and don't have the
cash to upgrade to pro quite yet. After 3 days F-prot still isn't catching
this virus which seems very unacceptable? I had heard such good reviews
about it and don't want to give up too quickly...does F-prot often keep
behind others, or is this a rare occurrence?
This is a rare occurrence -- but one that seems completely unacceptable, 
especially given how widespread this virus was.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

Re: [Declude.Virus] AVG

[R. Scott Perry]

>You told me the other day how to setup up avg to work correctly, but I 
>mistakenly deleted that email before I had a chance to do it. What I was 
>wanting was to setup AVG and Declude so that it would read the virus name 
>in declude currently avg reads the virus and pops up a box with its name 
>and info but declude reports the name as unknown in an unknown location. 
>You were saying something about a log or report, and I ask if anyone else 
>was familar with avg on the forum and got no replys.

In order to get AVG to report the virus name so that Declude can use it, 
there are two things that you need to do (which may or may not be possible 
with AVG).

The first is to get AVG to save a report file called "report.txt file" in 
the directory that it is scanning (you can *not* hard-code a specific 
directory).  Typing "AVG /?" from a command prompt should produce a list of 
options; one of them should be for saving a report file.  For the report 
file name, you should use just "report.txt" (but, some scanners may require 
the name as ".\report.txt").

The second step is to figure out a word/phrase that appears between the 
name of the file that was scanned and the virus name in the report.txt 
file.  For example, if the report.txt file has "...\filename.exe is 
INFECTED with Klez.", you would want use "INFECTED" as the 
word/phrase.  Then, you add a line "REPORT INFECTED" to the 
\IMail\Declude\virus.cfg file.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .