Well since you noticed it and I am setting up a new serverI will try
it tomorrow.
Goran Jovanovic
Omega Network Solutions
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
Darrell ([EMAIL PROTECTED])
Sent: Sunday, July 30, 2006 9:18 PM
, VIRUSCODE2, REPORT2 to 3. That might help
Goran Jovanovic
Omega Network Solutions
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary
Steiner
Sent: Friday, July 14, 2006 1:16 PM
To: declude.virus@declude.com
Subject: [Declude.Virus] ClamAV error
I recently
can you please add this to the to do list
Thank you
Goran Jovanovic
Omega Network Solutions
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail
David,
Any idea when it might make it as a feature in the code?
Goran Jovanovic
Omega Network Solutions
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
David
Barker
Sent: Tuesday, June 20, 2006 2:58 PM
To: declude.virus@declude.com
Subject: RE
Gary,
I have not even thought of something like that (since all my customers
are English speaking) but you are absolutely right.
So David will we be seeing this new feature next week? :)
Goran Jovanovic
Omega Network Solutions
-Original Message-
From: [EMAIL PROTECTED] [mailto
Goran Jovanovic
Omega Network Solutions
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.
PROTECTED] [outgoing from 209.239.24.62]
06/16/2006 17:55:57.295 q28de0a3700ce75a5.smd Subject: 05
Goran Jovanovic
Omega Network Solutions
Tel: 416 322-0333
Cell: 416 805-HELP (4357)
[EMAIL PROTECTED]
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf
3
VIRUSCODE1 6
VIRUSCODE 8
VIRUSCODE 9
VIRUSCODE 10
REPORT1 Infection:
Goran Jovanovic
Omega Network Solutions
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
Darrell ([EMAIL PROTECTED])
Sent: Friday, June 16
Pong
Goran Jovanovic
Omega Network Solutions
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of David Barker
Sent: Thursday, April 27, 2006 9:22 AM
To: Declude.Virus@declude.com; Declude.JunkMail@declude.com
Subject: [Declude.Virus] Testing the Boards
PING
.
From what I understand the virus and phishing
signatures are in C:\clamav-devel\share\clamav and clamscan.exe figures it out
automatically.
Am I missing something here?
Goran Jovanovic
Omega Network Solutions
I see.
Do most people run CLAM as a daemon or just call it for every message?
Goran Jovanovic
Omega Network Solutions
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED] On Behalf Of george kulman
Sent: Monday, March 06, 2006 2:26 PM
You could always put the English and Spanish messages into the same
recip.eml file. I see a lot of that type of thing up here in Canada
except it is English and French.
Goran Jovanovic
Omega Network Solutions
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL
Andrew,
Do you do anything to decrease the change of the alert message going out
to real spammers or forged addresses?
This would get sent out to e-mail that failed REVDNS and were not
deleted as SPAM?
Goran Jovanovic
Omega Network Solutions
-Original Message-
From: [EMAIL
messages
Just a thought
Goran Jovanovic
Omega Network Solutions
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew
Sent: Thursday, February 23, 2006 3:04 PM
To: Declude.Virus@declude.com
Subject: RE: [Declude.Virus
of this WMF
vulnerability.
I have not found any other release notes except for one that comes up
talking about 3.16c
http://www.f-prot.com/version_release_dates.html
3.16d and e do not have release notes on the web page.
Are there any other release notes?
Thanx
Goran Jovanovic
Omega Network
I am getting a ton of ZIP-EXE being banned.
Goran Jovanovic
Omega Network Solutions
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED] On Behalf Of John T (Lists)
Sent: Thursday, December 22, 2005 11:25 AM
To: Declude.Virus@declude.com
Subject
are not finding a virus. Where
is the place that you can send it to and have it checked out by a ton of
virus scanners?
Thanx
Goran Jovanovic
Omega Network Solutions
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]
---
This E-mail came from the Declude.Virus mailing list
I tried www.totalvirus.com and it is an ad site.
Thank you
Goran Jovanovic
Omega Network Solutions
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED] On Behalf Of Markus Gufler
Sent: Thursday, December 15, 2005 10:45 AM
To: Declude.Virus
Yup this is the one I got as well.
I just did a manual update of F-Prot and it found a new SIGN.DEF and
SIGN2.DEF
Maybe these signatures will find it now.
Goran Jovanovic
Omega Network Solutions
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED
As one of my clients like to say It is a Code 18 problem
Problem is 18 inches from the keyboard
They are a school so it is true a lot of the time :)
Goran Jovanovic
Omega Network Solutions
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED
This also fixed my logging problems that were introduced in 3.0.5.21 for
JunkMail logs.
Goran Jovanovic
Omega Network Solutions
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED] On Behalf Of David Barker
Sent: Monday, December 05, 2005 4:51 PM
and they got banned again.
Can someone point me to the right directory
Thanx
Goran Jovanovic
Omega Network Solutions
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http
I found the problem. Because my new server has the SPOOL directory on
the D drive I had to add the IUSR... account back to the directory. Now
it works copying back to the SPOOL directory
Goran Jovanovic
Omega Network Solutions
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL
Thank you I will implement that.
Goran Jovanovic
The LAN Shoppe
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED] On Behalf Of Panda Consulting S.A. Luis Alberto
Arango
Sent: Thursday, August 25, 2005 12:08 AM
To: Declude.Virus
Hi,
I just want to confirm that if I put a
SKIPIFRECIP [EMAIL PROTECTED]
In my recip-vulnerability.eml file that the person mentioned above will
not get VULNERABILITY ALERTs but every one else will.
Thanks
Goran Jovanovic
The LAN Shoppe
---
This E-mail came from
Susan,
You could also block port 25 from that IP at your firewall and that
would prevent it from even reaching your IMail server
I have had to do that in the past a couple of time.
Goran Jovanovic
The LAN Shoppe
-Original Message-
From: [EMAIL PROTECTED
Now why did I not receive an update?? I
received the update fro 3.16b a couple of months after it was out.
Maybe Canada gets notices very late?
Goran Jovanovic
The LAN Shoppe
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Douglas Cohn
Sent
Title: Message
Andrew,
I looked at the sign and sign2.def files
and they are binary junk to me. What did you use to check the def
files?
I resubscribed to the announcements and
maybe now I will get 1 announcement J
Goran Jovanovic
The LAN Shoppe
From
: Is this on the feature request
list somewhere?
Goran Jovanovic
The LAN Shoppe
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of William Stillwell
Sent: Wednesday, June 01, 2005
8:22 AM
To: Declude.Virus@declude.com
Subject: Re: [Declude.Virus] .EML
file syntax
I
Title: Message
Yes that is what I have resorted to but it
would have been nice to be able to put it as a BCC so that the recipients do
not know that it is monitored.
Declude Support has told me that this
feature is now on the which list.
Goran Jovanovic
The LAN Shoppe
Title: Message
Hi,
I know that in an .EML file you can have a
TO: %ALLRECIPS% (or whoever you want) but can you also put in a CC or better
yet a BCC? I have not found anything in the 2.0.6 manual.
Thanx
Goran Jovanovic
The LAN Shoppe
Title: Message
Urgh. I tried CC: but that did not work. I
would be nice to be able to do this.
Thanx
Goran Jovanovic
The LAN Shoppe
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of John Tolmachoff (Lists)
Sent: Tuesday, May 31, 2005 10:09
PM
Title: Message
Darin,
Not sure if you understood what I was
looking for. I want to take an EML file say for a banned file notification and
send it
TO: %ALLRECIPS%
And
BCC: me (or a monitor account).
This is the functionality that does not
exist.
Goran Jovanovic
Take a look at:
http://www.declude.com/Articles.asp?ID=100
F-Prot for DOS updater - A batch file that automatically updates F-Prot
and its virus definitions (old version here), and a Cygwin version, and
a complete .ZIPed version. Finally, a Simple version!
Goran Jovanovic
I have the same defs as Bonno
SIGN.DEF 2-may-2005, 13:32
SIGN2.DEF 2-may-2005, 16:46
Using f-prot 3.16b
Goran Jovanovic
The LAN Shoppe
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED] On Behalf Of Chuck Schick
Sent: Monday, May 02
(scanner2). I do not see any result from F-Prot (scanner1).
I am logging on high. Am I missing something here?
Goran Jovanovic
The LAN Shoppe
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Tyler Jensen
Sent: Wednesday
Odd - I did not get any notification until last week.
Thanx
Goran Jovanovic
The LAN Shoppe
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED] On Behalf Of Bill Landry
Sent: Monday, April 11, 2005 4:11 PM
To: Declude.Virus
Hi,
Anyone know anything about the new version
that just came out?
Goran Jovanovic
The LAN Shoppe
image001.gif
Title: Message
Kami,
What do you do in Global.cfg when an e-mail
fails the MS Filter? Subtract a bunch of points?
Goran Jovanovic
The LAN Shoppe
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan
Sent: Sunday, April 10, 2005 6:41
PM
at integrating into the ASP script. I used to program so I hope I
can figure it out.
In any case thank you for the REQUEUE.ASP script that you did many moons
ago.
Goran Jovanovic
The LAN Shoppe
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com
and the asp file if you wish. Let me
know
Goran Jovanovic
The LAN Shoppe
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED] On Behalf Of Andy Schmidt
Sent: Thursday, January 27, 2005 6:27 PM
To: Declude.Virus@declude.com
Subject: RE
.
Of course your mail system is MUCH bigger than mine if memory serves me
correctly.
Goran Jovanovic
The LAN Shoppe
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED] On Behalf Of Andy Schmidt
Sent: Friday, January 28, 2005 5:05 PM
Darin,
What do you do with the old log files? Do you put them on another
machine for processing/analysis/archiving?
If you are archiving how long do you keep the data?
Thanx
Goran Jovanovic
The LAN Shoppe
-Original Message-
From: [EMAIL PROTECTED
. The
difference between them is that if exit code 10 occurs then some
settings can be changed (e.g., increase the maximum allowed
archive depth) and the scanner might be able to scan the file.
If, however, exit code 9 occurs then the scanner is not able to
scan the file.
Goran Jovanovic
Well if you get an answer to this personally can you please share? :)
Thanx
Goran Jovanovic
The LAN Shoppe
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED] On Behalf Of Bonno Bloksma
Sent: Wednesday, September 08, 2004 5:12 AM
I think mine is scheduled at 37 minutes after the hour.
I saw that comment on the Frisk site.
Goran Jovanovic
The LAN Shoppe
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED] On Behalf Of Fritz Squib
Sent: Wednesday, September 08
Hi,
I am seeing my McAfee scanner catch these JS/Zerolin viruses but FProt
(3.15a) does not see them at all.
Does anyone know why that might be?
Goran Jovanovic
The LAN Shoppe
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail
] To:
[EMAIL PROTECTED] [outgoing from 218.13.55.73]
09/07/2004 01:55:10 Q4d2710a401bcc5b2 Subject: appointment reminder
Goran Jovanovic
The LAN Shoppe
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED] On Behalf Of Scott Fisher
Sent: Tuesday
folks out there using the 3.15(a) version are you seeing the
same problems or not?
Any help on this would be appreciated.
Thanx
Goran Jovanovic
The LAN Shoppe
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from
detection.
-append Append to existing report file.
-archiveScan inside .ZIP and .ARJ files.
Goran Jovanovic
The LAN Shoppe
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED] On Behalf Of Rick Davidson
Sent: Tuesday, July 27, 2004
Goran Jovanovic
The LAN Shoppe
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED] On Behalf Of Jeff Maze
Sent: Monday, July 26, 2004 10:51 AM
To: [EMAIL PROTECTED]
Subject: [Declude.Virus] New Virus?
Anyone hear of this one
Scott,
Do you want a copy of it? If so to what address?
Goran Jovanovic
The LAN Shoppe
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Monday, July 26, 2004 11:05 AM
To: [EMAIL PROTECTED]
Subject
I did not think that I had another scanner in the way but now I am going
to have to go back and check further.
Thank you for the explanation.
Goran Jovanovic
The LAN Shoppe
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED] On Behalf
the name of the virus
After the Scanner 2: Virus= it has an extra the then name of the virus
Scanner 1 is F-Prot
Scanner 2 is McAfee
Any reason why?
Goran Jovanovic
The LAN Shoppe
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came
Vulnerability]. This should have got through.
EXE in an encrypted ZIP
I actually got my BANNOTIFY on this one.
Why did the EXE only not send me the BANNOTIFY?
Why did the EXE in a ZIP send me a vulnerability message?
Thanx
Goran Jovanovic
The LAN Shoppe
---
[This E-mail was scanned
these directories but my question would be
why did they get left behind.
Thanx
Goran Jovanovic
The LAN Shoppe
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E
Wow a picture is really worth thousands of words. Seeing those stats as
a coloured graph is very informative.
Maybe one day I will get there :) for now I am going to attempt
something simpler.
Goran Jovanovic
The LAN Shoppe
-Original Message-
From: [EMAIL PROTECTED
I was just thinking about adding McAfee as the second scanner to F-Prot
and now I am rethinking that idea. :(
Goran Jovanovic
The LAN Shoppe
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED] On Behalf Of Jonathan
Sent: Wednesday, June
Andy
You ARE aware that there are well-documented situations where Imail
can
get
messages past Declude - so they never show up in the Declude logs?
This
may
be have been fixed in the latest Imail 8 fixes - but I don't know this
for
certain.
Where would I find this documented?
Goran
-Encoding: base64
Content-Disposition: attachment;
filename=Report.pdf
We stopped the 5 e-mails but why would it have triggered on a PDF file?
Also how does the client out the PDF back together???
Thanx
Goran Jovanovic
The LAN Shoppe
---
[This E-mail was scanned for viruses
I guess it would be nice to say
BANPARTIAL EXE
BANPARTIAL COM
BANPARTIAL VBS
Etc
I don't think a PDF can be infected but then again you never know so
maybe .
In any case it is almost a damned if you do damned if you don't
Thanx
Goran Jovanovic
The LAN Shoppe
Yes I looked again and you are right. So Declude would have to keep
track of e-mail to e-mail and possible out of sequence and different
clients marking the split stuff in different ways
On/Off switch is the way to go (unfortunately)
Goran Jovanovic
The LAN Shoppe
. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]
Goran Jovanovic
The LAN Shoppe
O: (416) 440-1167 x-2113
C: (416) 931-0688
E: [EMAIL
Goran Jovanovic
The LAN Shoppe
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Wednesday, May 26, 2004 12:13 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] BANnotify.eml
bannotify.eml is the only template used for banned extensions or banned file names.
You
Actually, those should be sender.eml and otherpostmaster.eml (Declude
doesn't use any .txt files).
Yes I was just quoting the web site since I could not look at the eml
files online :)
Can I still send out notifications for the Vulnerability?
It would be possible, but strongly
Ah, that makes sense. In that case, you can copy the
\IMail\Declude\recip.eml file to
\IMail\Declude\recip-vulnerability.eml
(or
whatever name you want), and use a line ONLYSENDIFVIRUSNAMEHAS
Vulnerability (without any SKIPIFVIRUSNAMEHAS or SKIPIFFORGING
lines).
OK that is great. Now can
This is good. I like it.
Thanx
Goran Jovanovic
The LAN Shoppe
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists)
Sent: Tuesday, May 25, 2004 9:57 PM
To: [EMAIL PROTECTED]
Subject: RE
OK that is fine I just thought it was a new command that I had not seen
anywhere and went looking for it. :)
Goran Jovanovic
The LAN Shoppe
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists)
Sent
Hi,
The documentation shows that the
bannotify.eml file send mail back to %MAILFROM%. Can I just modify this to send
mail to %ALLRECIPS% instead or is there another .eml file that I should be
using to inform the recipient that a banned attachment was dropped?
Thanx
Goran
and the Network Card Manufacturer.
This is not free it is part of the Engineers Toolkit
Hope this helps.
Goran Jovanovic
The LAN Shoppe
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED] On Behalf Of Jeff Pereira
Sent: Sunday, May 23, 2004 3:35
I use the BGINFO on all the servers I support. It is absolutely great
especially since I terminal server into many at a time and it very
clearly tells me what server I am on. Also tells the less sophisticated
network admins which server they are on when using the KVM switch.
Goran
I believe this is correct.
If a virus in an attachment is detected
then the whole message will be held and the recip.eml notification will be sent
out.
Is there a way to allow the e-mail to go
through to the user with a notification that the attachment was stripped?
Goran
Thanx I am going to shamelessly plagiarize.
:
Goran Jovanovic
The LAN Shoppe
2345 Yonge Street, Suite 302
Toronto, Ontario M4P 2E5
Phone: (416)
440-1167 x-2113
Cell: (416)
931-0688
E-Mail: [EMAIL PROTECTED]
From:
[EMAIL PROTECTED] [mailto:[EMAIL
Q6421067d01180f35 File(s) are INFECTED [[Outlook
'MIME Header' Vulnerability]: 3]
05/06/2004 12:13:26 Q6421067d01180f35 Scanned: CONTAINS A VIRUS [MIME: 3
30458]
Goran Jovanovic
The LAN Shoppe
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED
Hi,
I am using F-Prot and it is working but I keep getting these
unidentified viruses.
Unknown Virus virus in the Unknown File attachment
Can anyone shed any light on this?
Thanx
Goran Jovanovic
The LAN Shoppe
---
[This E-mail was scanned for viruses by Declude Virus (http
John,
Does this script delete just the files
with the banned attachments or anything over 5 days old?
Are you willing to share the script?
Goran Jovanovic
The LAN Shoppe
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists
Try restarting the machine in Safe Mode and then deleting it. You can
also try to rename it and then reboot to see if you can break the
startup of it.
Goran Jovanovic
The LAN Shoppe
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.Virus-
[EMAIL PROTECTED
77 matches
Mail list logo
