Re: [Declude.Virus] whitelisting?

2004-03-19 Thread R. Scott Perry

I have a customer that is insisting I let .zip files through (I have them
banned right now).
Is there any way to allow email to a single address to go through?  If I do
a whitelist entry for this one email address in the global.cfg, will that
work?
You could disable virus scanning for that one customer (if you are using 
Declude Virus Pro).  But it is not possible to set the banned file 
extensions or vulnerability detect on a per-user or per-domain basis.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] whitelisting?

2004-03-19 Thread Douglas Cohn
I agree with your customer.  Why do you ban all zip files?  How are they expected to 
conduct business if their business requires transferring files?  My customers required 
that I create a way for them to retrieve the infected files for them.

You could simply do that.  Allow the customer to retrieve the infected files if 
desired by creating a link and script to copy them into the spool dir.

Blocking encrypted zips is one thing but why all zip files?

Doug


-- Original Message --
From: <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
Date:  Fri, 19 Mar 2004 12:44:15 -0500

>Hi,
>
>I have a customer that is insisting I let .zip files through (I have them
>banned right now).
>
>Is there any way to allow email to a single address to go through?  If I do
>a whitelist entry for this one email address in the global.cfg, will that
>work?
>
>Thanks, andy
>thumpernet
>
>---
>[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
>
>---
>This E-mail came from the Declude.Virus mailing list.  To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.Virus".The archives can be found
>at http://www.mail-archive.com.
>---
>[This E-mail scanned for viruses by Declude Virus]
>
>
 




 
   
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] whitelisting?

2004-03-19 Thread andyb
Because I am dealing with unsophisticated uses that click on anything
attached.

There was so much confusion on the list at the time that I just banned all
zip files, better safe than sorry.

I would now need to go back and try to figure out exactly what settings I
need to stop the bad stuff and allow the good stuff.

I know, I know, go search the archives.. That is exactly why it is the
way it is.  I'm one of those people that believe telling people to go search
the archives is a waste of time.   Everytime I search the archives, I never
find what  I need and I end up asking anywayor I ask Scott off list so I
don't get ridiculed for asking (that's why I pay for a support contract, to
get support).

If things have settled down enough now so that it is OK to allow certain zip
files to go through, I'd be happy to do that if I knew concisely how.

Thanks, andy

- Original Message -
From: "Douglas Cohn" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, March 19, 2004 1:14 PM
Subject: Re: [Declude.Virus] whitelisting?


> I agree with your customer.  Why do you ban all zip files?  How are they
expected to conduct business if their business requires transferring files?
My customers required that I create a way for them to retrieve the infected
files for them.
>
> You could simply do that.  Allow the customer to retrieve the infected
files if desired by creating a link and script to copy them into the spool
dir.
>
> Blocking encrypted zips is one thing but why all zip files?
>
> Doug
>
>
> -- Original Message --
> From: <[EMAIL PROTECTED]>
> Reply-To: [EMAIL PROTECTED]
> Date:  Fri, 19 Mar 2004 12:44:15 -0500
>
> >Hi,
> >
> >I have a customer that is insisting I let .zip files through (I have them
> >banned right now).
> >
> >Is there any way to allow email to a single address to go through?  If I
do
> >a whitelist entry for this one email address in the global.cfg, will that
> >work?
> >
> >Thanks, andy
> >thumpernet
> >
> >---
> >[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
> >
> >---
> >This E-mail came from the Declude.Virus mailing list.  To
> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> >type "unsubscribe Declude.Virus".The archives can be found
> >at http://www.mail-archive.com.
> >---
> >[This E-mail scanned for viruses by Declude Virus]
> >
> >
>
>
>
>
>
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.Virus mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.Virus".The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] whitelisting?

2004-03-19 Thread andyb
I have the pro version

syntax please

Thanks, andy

- Original Message -
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, March 19, 2004 1:13 PM
Subject: Re: [Declude.Virus] whitelisting?


>
> >I have a customer that is insisting I let .zip files through (I have them
> >banned right now).
> >
> >Is there any way to allow email to a single address to go through?  If I
do
> >a whitelist entry for this one email address in the global.cfg, will that
> >work?
>
> You could disable virus scanning for that one customer (if you are using
> Declude Virus Pro).  But it is not possible to set the banned file
> extensions or vulnerability detect on a per-user or per-domain basis.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> since 2000.
> Declude Virus: Ultra reliable virus detection and the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.Virus mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.Virus".The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] whitelisting?

2004-03-19 Thread R. Scott Perry

> You could disable virus scanning for that one customer (if you are using
> Declude Virus Pro).  But it is not possible to set the banned file
> extensions or vulnerability detect on a per-user or per-domain basis.

I have the pro version

syntax please
You can add a line "[EMAIL PROTECTED]OFF" to the 
\IMail\Declude\virus_users.txt file (if that file doesn't exist, you can 
just create one, with that one line in it -- making sure that the cursor 
can go to the line below it).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] whitelisting?

2004-03-19 Thread R. Scott Perry

I would now need to go back and try to figure out exactly what settings I
need to stop the bad stuff and allow the good stuff.
FYI, the latest advice is:

[1] Run the latest interim of Declude Virus (1.78i27 or later), and
[2] Block all encrypted .ZIP files by adding a line "BANEXT EZIP" to the 
\IMail\Declude\virus.cfg file.

That shuold block all known viruses.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] whitelisting?

2004-03-19 Thread Darin Cox
Try just banning encrypted zips and allowing your virus scanner to handle
issues with non-encrypted zips.

Darin.


- Original Message - 
From: <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, March 19, 2004 1:35 PM
Subject: Re: [Declude.Virus] whitelisting?


Because I am dealing with unsophisticated uses that click on anything
attached.

There was so much confusion on the list at the time that I just banned all
zip files, better safe than sorry.

I would now need to go back and try to figure out exactly what settings I
need to stop the bad stuff and allow the good stuff.

I know, I know, go search the archives.. That is exactly why it is the
way it is.  I'm one of those people that believe telling people to go search
the archives is a waste of time.   Everytime I search the archives, I never
find what  I need and I end up asking anywayor I ask Scott off list so I
don't get ridiculed for asking (that's why I pay for a support contract, to
get support).

If things have settled down enough now so that it is OK to allow certain zip
files to go through, I'd be happy to do that if I knew concisely how.

Thanks, andy

- Original Message -
From: "Douglas Cohn" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, March 19, 2004 1:14 PM
Subject: Re: [Declude.Virus] whitelisting?


> I agree with your customer.  Why do you ban all zip files?  How are they
expected to conduct business if their business requires transferring files?
My customers required that I create a way for them to retrieve the infected
files for them.
>
> You could simply do that.  Allow the customer to retrieve the infected
files if desired by creating a link and script to copy them into the spool
dir.
>
> Blocking encrypted zips is one thing but why all zip files?
>
> Doug
>
>
> -- Original Message --
> From: <[EMAIL PROTECTED]>
> Reply-To: [EMAIL PROTECTED]
> Date:  Fri, 19 Mar 2004 12:44:15 -0500
>
> >Hi,
> >
> >I have a customer that is insisting I let .zip files through (I have them
> >banned right now).
> >
> >Is there any way to allow email to a single address to go through?  If I
do
> >a whitelist entry for this one email address in the global.cfg, will that
> >work?
> >
> >Thanks, andy
> >thumpernet
> >
> >---
> >[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
> >
> >---
> >This E-mail came from the Declude.Virus mailing list.  To
> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> >type "unsubscribe Declude.Virus".The archives can be found
> >at http://www.mail-archive.com.
> >---
> >[This E-mail scanned for viruses by Declude Virus]
> >
> >
>
>
>
>
>
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.Virus mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.Virus".The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

_
[This E-mail virus scanned by 4C Web]



_
[This E-mail virus scanned by 4C Web]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] whitelisting?

2004-03-19 Thread andyb
Thanks Scott,

Best money I ever spent ->> Declude.

Can't say enough how much your efforts are appreciated.

:)  Andy
Thumpernet

- Original Message -
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, March 19, 2004 1:41 PM
Subject: Re: [Declude.Virus] whitelisting?


>
> >I would now need to go back and try to figure out exactly what settings I
> >need to stop the bad stuff and allow the good stuff.
>
> FYI, the latest advice is:
>
> [1] Run the latest interim of Declude Virus (1.78i27 or later), and
> [2] Block all encrypted .ZIP files by adding a line "BANEXT EZIP" to the
> \IMail\Declude\virus.cfg file.
>
> That shuold block all known viruses.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> since 2000.
> Declude Virus: Ultra reliable virus detection and the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.Virus mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.Virus".The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] whitelisting?

2004-03-19 Thread andyb
and

BANEZIPEXTS  ON

is no longer needed, correct?

Thanks, Andy

- Original Message -
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, March 19, 2004 1:41 PM
Subject: Re: [Declude.Virus] whitelisting?


>
> >I would now need to go back and try to figure out exactly what settings I
> >need to stop the bad stuff and allow the good stuff.
>
> FYI, the latest advice is:
>
> [1] Run the latest interim of Declude Virus (1.78i27 or later), and
> [2] Block all encrypted .ZIP files by adding a line "BANEXT EZIP" to the
> \IMail\Declude\virus.cfg file.
>
> That shuold block all known viruses.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> since 2000.
> Declude Virus: Ultra reliable virus detection and the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.Virus mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.Virus".The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] whitelisting?

2004-03-19 Thread R. Scott Perry

BANEZIPEXTS  ON

is no longer needed, correct?
It's up to you.  :)

"BANEXT EZIP" will ban all encrypted .ZIP files.  This is the safest option.

Alternatively (with Declude Virus Pro), you can use "BANEZIPEXTS ON", which 
will ban any files in encrypted .ZIP files, if the extension is one listed 
in a BANEXT option in the \IMail\Declude\virus.cfg file (so any extensions 
you ban will be banned both in regular files, as well as in encrypted .ZIP 
files).  This isn't quite as safe (as a virus could come through with an 
extension you do not list), but allows more flexibility if people need to 
send encrypted .ZIP files.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] whitelisting?

2004-03-19 Thread Wind
>Thanks Scott,
>
>Best money I ever spent ->> Declude.
>
>Can't say enough how much your efforts are appreciated.
>
>:)  Andy
>Thumpernet

Same to me !

Thank you a lot, Scott for this great product and the excellent support!

Uwe

- Original Message -
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, March 19, 2004 1:41 PM
Subject: Re: [Declude.Virus] whitelisting?


>
> >I would now need to go back and try to figure out exactly what settings I
> >need to stop the bad stuff and allow the good stuff.
>
> FYI, the latest advice is:
>
> [1] Run the latest interim of Declude Virus (1.78i27 or later), and
> [2] Block all encrypted .ZIP files by adding a line "BANEXT EZIP" to the
> \IMail\Declude\virus.cfg file.
>
> That shuold block all known viruses.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> since 2000.
> Declude Virus: Ultra reliable virus detection and the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.Virus mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.Virus".The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.