RE: [Declude.Virus] RAR Support - why not?

2005-01-28 Thread John Tolmachoff \(Lists\)
My log files go to a separate directory (partition if available) and are zipped either weekly or monthly depending on size and when there are enough they get burned to CD then deleted. John Tolmachoff Engineer/Consultant/Owner eServices For You > -Original Message- > From: [EMAIL PROTECT

RE: [Declude.Virus] Foto.rar

2005-01-28 Thread Andy Schmidt
McAfee calls it: MultiDropper-IY an Extra.dat is available. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Friday, January 28, 2005 04:39 PM To: Declude.Virus@declude.com Subject: [Declude.Virus] Foto.rar Another variation - came wit

Re: [Declude.Virus] RAR Support - why not?

2005-01-28 Thread Darin Cox
Yeah...we had to do it previously due to log storage. It was a good thing we did it when there was still plenty of room as our logs doubled in size last November from a sudden increase in spam and dictionary attacks. Over a span of two days we went from 80% to 95% spam for about three weeks befor

Re: [Declude.Virus] RAR Support - why not?

2005-01-28 Thread Darin Cox
Hi Goran, We move them to another partition nightly, run any desired monthly reports on the 1st, zip them up on the 5th (to give time to review logs for recent days), and store for 6 months in zip format on another partition. We have plenty of disk space, so local storage hasn't been a problem ye

RE: [Declude.Virus] RAR Support - why not?

2005-01-28 Thread Andy Schmidt
I may have to start doing that. I used to be able to keep 30 days of logs - but volume, dictionary attacks and SPAM volume are making it increasingly difficult. Best Regards Andy Schmidt H&M Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1

RE: [Declude.Virus] RAR Support - why not?

2005-01-28 Thread Goran Jovanovic
Darin, What do you do with the old log files? Do you put them on another machine for processing/analysis/archiving? If you are archiving how long do you keep the data? Thanx Goran Jovanovic The LAN Shoppe > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude

RE: [Declude.Virus] RAR Support - why not?

2005-01-28 Thread Goran Jovanovic
Hi Andy, Yes I keep all virus files VIRDIR spool\virus But I have a process that runs every night and cleans out the 6th day of files. That way I only hold 5 days of files. Right now in my spool\virus directory I have 2818 files which is 1409 mail messages. Total space of 27.7 MB. Of c

Re: [Declude.Virus] RAR Support - why not?

2005-01-28 Thread William Stillwell
I would be VERY interested in this "ASP" page.. Any Ideas where I can find it ? - Original Message - From: "Goran Jovanovic" <[EMAIL PROTECTED]> To: Sent: Friday, January 28, 2005 12:48 PM Subject: RE: [Declude.Virus] RAR Support - why not? Andy, Someone posted on this list a while ago a

Re: [Declude.Virus] RAR Support - why not?

2005-01-28 Thread Darin Cox
Notices only go out for banned files. We include a statement that the email will be available to be requeued for x number of days...so automatic processes clean it up if it's unclaimed. Regarding the space problem, are you moving logs off to another partition on a nightly basis? Between that, au

RE: [Declude.Virus] RAR Support - why not?

2005-01-28 Thread Andy Schmidt
Hi Goran: Oh, I've been thinking about just that. However does that mean you hold all virus files? I don't think I could afford the additional disk space (the spool file is already too big as it is.) Best Regards Andy -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECT

[Declude.Virus] Foto.rar

2005-01-28 Thread Andy Schmidt
Another variation - came with a "foto.rar" attachment. Received: from host46.ipowerweb.com [66.235.216.140] by hm-software.com (SMTPD32-8.14) id A70B620D0124; Fri, 28 Jan 2005 14:48:27 -0500 Received: from riqotscr (168.113.230.53) by host46.ipowerweb.com; Fri, 28 Jan 2005 11:48:22 -0800

RE: [Declude.Virus] RAR Support - why not?

2005-01-28 Thread Goran Jovanovic
Andy, Someone posted on this list a while ago a small ASP page that I am using to requeue a banned file. I send out a bannotify.eml what has the link back to the server with the appropriate file name. The user says I really really want this file and clicks on the link. It gets requeued automatical