Re: [Declude.Virus] Trend and McAfee installed on same machine
One option (with Declude Virus Pro) is to ban file extensions within .ZIP files (blocking all .EXE, .PIF, .SCR, .BAT, .COM, etc. files). The other option would be to rename the .ZIP file to use another extension. So if I understand correctly, I should be able to send a zip file to somebody on my server and they will receive it? But, if it was zip file that contained a scr or pif or whatever, Declude would stop it? Again, it all depends on how you have it set up. With BANEXT EZIP, all encrypted .ZIP files are blocked (which is recommended). In that case, you can send a .ZIP file to someone on your server and they will receive it (assuming it is not an encrypted .ZIP file). If you do not want to ban all encrypted .ZIP files, you'll need to use Declude Virus Pro with BANEZIPEXTS ON (to ban file extensions within encrypted .ZIP files; you can also use BANZIPEXTS ON to ban file extensions within non-encrypted .ZIP files) and a bunch of BANEXT lines (one per extension you wish to block). Then, those extensions will be blocked in standard files, as well as encrypted .ZIP and/or standard .ZIP files. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Trend and McAfee installed on same machine
Scott: Just an idea... What if you extend the idea of Whitelist password to Declude Virus- for password protected zip files. If the subject has a code then the attachment with password protected will be skipped. If you can take the subject and delete the password before passing it on it can work great.. Sort of like the password protected list in IMail. This can solve a lot of problems.. But I am sure it can introduce more. Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Thursday, March 25, 2004 7:29 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Trend and McAfee installed on same machine One option (with Declude Virus Pro) is to ban file extensions within .ZIP files (blocking all .EXE, .PIF, .SCR, .BAT, .COM, etc. files). The other option would be to rename the .ZIP file to use another extension. So if I understand correctly, I should be able to send a zip file to somebody on my server and they will receive it? But, if it was zip file that contained a scr or pif or whatever, Declude would stop it? Again, it all depends on how you have it set up. With BANEXT EZIP, all encrypted .ZIP files are blocked (which is recommended). In that case, you can send a .ZIP file to someone on your server and they will receive it (assuming it is not an encrypted .ZIP file). If you do not want to ban all encrypted .ZIP files, you'll need to use Declude Virus Pro with BANEZIPEXTS ON (to ban file extensions within encrypted .ZIP files; you can also use BANZIPEXTS ON to ban file extensions within non-encrypted .ZIP files) and a bunch of BANEXT lines (one per extension you wish to block). Then, those extensions will be blocked in standard files, as well as encrypted .ZIP and/or standard .ZIP files. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Trend and McAfee installed on same machine
Tried to install McAfee but it squaked because Trend is installed on the computer and that it must be uninstalled, anybody know of a work around or fix? Download the latest SDAT file and extract the content. This should contain anything you need to run the command line scanner. On www.declude.com Free tools or directly under http://www.mail-archive.com/declude.virus%40declude.com/msg01673.html you can find a batch file to download the latest SDAT file and extract the content. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Trend and McAfee installed on same machine
But this seems to entail that I have a *nix box. - Original Message - From: Markus Gufler [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, March 24, 2004 10:02 AM Subject: RE: [Declude.Virus] Trend and McAfee installed on same machine Tried to install McAfee but it squaked because Trend is installed on the computer and that it must be uninstalled, anybody know of a work around or fix? Download the latest SDAT file and extract the content. This should contain anything you need to run the command line scanner. On www.declude.com Free tools or directly under http://www.mail-archive.com/declude.virus%40declude.com/msg01673.html you can find a batch file to download the latest SDAT file and extract the content. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Trend and McAfee installed on same machine
And the fact that I have to have a qualifying product on my machine which I don't because I can't get it installed. Am I missing something here? - Original Message - From: Jay Calvert [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, March 24, 2004 10:15 AM Subject: Re: [Declude.Virus] Trend and McAfee installed on same machine But this seems to entail that I have a *nix box. - Original Message - From: Markus Gufler [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, March 24, 2004 10:02 AM Subject: RE: [Declude.Virus] Trend and McAfee installed on same machine Tried to install McAfee but it squaked because Trend is installed on the computer and that it must be uninstalled, anybody know of a work around or fix? Download the latest SDAT file and extract the content. This should contain anything you need to run the command line scanner. On www.declude.com Free tools or directly under http://www.mail-archive.com/declude.virus%40declude.com/msg01673.html you can find a batch file to download the latest SDAT file and extract the content. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Trend and McAfee installed on same machine
But this seems to entail that I have a *nix box. ? This is a batch file that you can run from any Windows command line. I'm not sure if you know or don't know this already, but if you don't know it it's likely that you don't be able to adapt it for your needs. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Trend and McAfee installed on same machine
Or the fact that it uses cygwin that needs to be installed didn't cross your mind before saying that I am an idiot - Original Message - From: Markus Gufler [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, March 24, 2004 10:24 AM Subject: RE: [Declude.Virus] Trend and McAfee installed on same machine But this seems to entail that I have a *nix box. ? This is a batch file that you can run from any Windows command line. I'm not sure if you know or don't know this already, but if you don't know it it's likely that you don't be able to adapt it for your needs. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Trend and McAfee installed on same machine
I tried what Markus recommended, but this only gives me the dat files, I need to get McAfee Virus Scan installed while having Trend ServerProtect on there, How do I do that? --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Trend and McAfee installed on same machine
I tried what Markus recommended, but this only gives me the dat files, I need to get McAfee Virus Scan installed while having Trend ServerProtect on there, How do I do that? One option would be to uninstall Trend, install McAfee (making sure not to enable the McAfee on-access virus scanner), and then re-install Trend. That will ensure that McAfee won't know about Trend. Before that, though, you may want to try installing McAfee with the Trend on-access virus scanner temporarily turned off, to see if that would work. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Trend and McAfee installed on same machine
One question though, is there any way to catch those pesky zips. If I turn of BANEXT ZIP and BANEXT EZIP and run your tests, they get through. Are you running the latest interim (from http://www.declude.com/interim )? Do you have an up-to-date Service Agreement (which is required to run the latest interim)? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Trend and McAfee installed on same machine
That should have been ...If I turn off BANEXT ZIP and BANEXT EZIP and run your tests, they get through But yes, we do have the interim and a service agreement Jay - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, March 24, 2004 5:44 PM Subject: Re: [Declude.Virus] Trend and McAfee installed on same machine One question though, is there any way to catch those pesky zips. If I turn of BANEXT ZIP and BANEXT EZIP and run your tests, they get through. Are you running the latest interim (from http://www.declude.com/interim )? Do you have an up-to-date Service Agreement (which is required to run the latest interim)? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Trend and McAfee installed on same machine
That should have been ...If I turn off BANEXT ZIP and BANEXT EZIP and run your tests, they get through Ah, that's good. That's the way it should be. The eicardynamicencodedzip file (like some viruses) can only be caught by blocking encrypted .ZIP files. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Trend and McAfee installed on same machine
So the scanners can't catch them? Our company utilizes Zip files and Password Protected Zips on a daily basis. Is there anything that will catch them with Declude? Any other virus scanners? - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, March 24, 2004 5:59 PM Subject: Re: [Declude.Virus] Trend and McAfee installed on same machine That should have been ...If I turn off BANEXT ZIP and BANEXT EZIP and run your tests, they get through Ah, that's good. That's the way it should be. The eicardynamicencodedzip file (like some viruses) can only be caught by blocking encrypted .ZIP files. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Trend and McAfee installed on same machine
So the scanners can't catch them? Correct. That's why we came out with the interim release to block all encrypted .ZIP files. Without being able to do that, you can't block all viruses. There are static encrypted .ZIP files (which are always the same, and therefore always have the same file length and CRC), which can be detected with very little chance of false positives. But there are also dynamic encrypted .ZIP files, which have lengths and CRCs that change, which cannot be accurately detected (unless there is a limited number of variations). Our company utilizes Zip files and Password Protected Zips on a daily basis. Is there anything that will catch them with Declude? Any other virus scanners? No. The problem is that without a password the *only* information that the virus scanner has is the filename, the length of the file and the CRC. Given that the virus can vary all 3 pieces of information, it becomes impossible to detect (except using AI to determine the password, but virus writers are already using passwords hidden in pictures to bypass AI attempts). One option (with Declude Virus Pro) is to ban file extensions within .ZIP files (blocking all .EXE, .PIF, .SCR, .BAT, .COM, etc. files). The other option would be to rename the .ZIP file to use another extension. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Trend and McAfee installed on same machine
The problem with encrypted password protected zip files is by nature of the product. The virus scanner would have to OPEN the zip file to scan the file inside. IF they were able to do that, that could be seen as a security risk. Example, I have a client that is involved in health care. Therefore, all of their files are zipped and encrypted. If a virus scanner was able to open the zip and scan the file inside, that could be interpreted as a violation of HIPPA regulations. What Declude is able to do is see what kind of file is inside the zip and apply extension policy based on the type. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Calvert Sent: Wednesday, March 24, 2004 6:12 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Trend and McAfee installed on same machine So the scanners can't catch them? Our company utilizes Zip files and Password Protected Zips on a daily basis. Is there anything that will catch them with Declude? Any other virus scanners? - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, March 24, 2004 5:59 PM Subject: Re: [Declude.Virus] Trend and McAfee installed on same machine That should have been ...If I turn off BANEXT ZIP and BANEXT EZIP and run your tests, they get through Ah, that's good. That's the way it should be. The eicardynamicencodedzip file (like some viruses) can only be caught by blocking encrypted .ZIP files. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Trend and McAfee installed on same machine
So if I understand correctly, I should be able to send a zip file to somebody on my server and they will receive it? But, if it was zip file that contained a scr or pif or whatever, Declude would stop it? I haven't seen that work yet. I can understand the password protected zips. - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, March 24, 2004 6:31 PM Subject: Re: [Declude.Virus] Trend and McAfee installed on same machine So the scanners can't catch them? Correct. That's why we came out with the interim release to block all encrypted .ZIP files. Without being able to do that, you can't block all viruses. There are static encrypted .ZIP files (which are always the same, and therefore always have the same file length and CRC), which can be detected with very little chance of false positives. But there are also dynamic encrypted .ZIP files, which have lengths and CRCs that change, which cannot be accurately detected (unless there is a limited number of variations). Our company utilizes Zip files and Password Protected Zips on a daily basis. Is there anything that will catch them with Declude? Any other virus scanners? No. The problem is that without a password the *only* information that the virus scanner has is the filename, the length of the file and the CRC. Given that the virus can vary all 3 pieces of information, it becomes impossible to detect (except using AI to determine the password, but virus writers are already using passwords hidden in pictures to bypass AI attempts). One option (with Declude Virus Pro) is to ban file extensions within .ZIP files (blocking all .EXE, .PIF, .SCR, .BAT, .COM, etc. files). The other option would be to rename the .ZIP file to use another extension. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
