I think I understand the question.
I only get banned extension notices when there is no known virus.
I route these banned notices to a folder in my mail program for special
attention (the virus name is in the subject).
The banned e-mails get checked "by hand".
If it looks legit, I send a form lett
What is processed first?
BANEXT
or On Demand Virus Scan ?
If BanExt is First, Is there a way to CC the email
?
In my Virus.cfg file, it says BANEXT This works in the Standard and Pro
versions.
but in the Scott reply, it says BANEXT EZIP work with all version.
May I know does BANEXT scr BANEXT pif also work for all version, like lite
version?
No.
BANEXT EZIP works with all versions of Declude Virus (sinc
In my Virus.cfg file, it says BANEXT This works in the Standard and Pro
versions.
but in the Scott reply, it says BANEXT EZIP work with all version.
May I know does BANEXT scr BANEXT pif also work for all version, like lite
version?
My declude is 1.79 beta.
Regards
Brian
- Original Message
ough
Jay
- Original Message -
From: "Jay Calvert" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, March 26, 2004 10:58 AM
Subject: Re: [Declude.Virus] BANEXT EXE
> But if this is the case, how will a file be caught if somebody renames a
> .zi
> The problem here is that the mail client (a program whose name is as poor
> as its MIME handling: "Mail A.01.77") is giving out 2 different names for
> the file. In one location, it calls the file "EPM11002.FILES.CANJET", in
> the other location it calls it "EPM11002.TXT". While Declude Virus
arch 26, 2004 10:50 AM
Subject: Re: [Declude.Virus] BANEXT EXE
>
> >Hi all we just had a case where an email was banned because Declude said
it
> >had an exe in the email, when it only had a TXT.
> >
> >What happened here?
>
> The problem here is that the mail client
Hi all we just had a case where an email was banned because Declude said it
had an exe in the email, when it only had a TXT.
What happened here?
The problem here is that the mail client (a program whose name is as poor
as its MIME handling: "Mail A.01.77") is giving out 2 different names for
th
Scott,
Did you receive the second email?
Jay
- Original Message -
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, March 26, 2004 9:39 AM
Subject: Re: [Declude.Virus] BANEXT EXE
>
> >I have several examples of that from
I have several examples of that from last night as well, all the txt
attachments were anti-virus generated attachments
03/25/2004 19:11:00 Q751409530072c4c8 MIME file: DELETED0.TXT
[quoted-printable; Length=113 Checksum=12852]
03/25/2004 19:11:00 Q751409530072c4c8 Banning file deleted0.txt.
03/25/
t;Jay Calvert" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, March 26, 2004 11:56 AM
Subject: [Declude.Virus] BANEXT EXE
> Hi all we just had a case where an email was banned because Declude said
it
> had an exe in the email, when it only had a TXT.
>
&
Scott,
I just sent it to you, please look for it, it came from our systems account.
Jay
- Original Message -
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, March 26, 2004 9:17 AM
Subject: Re: [Declude.Virus] BANEXT EXE
>
>
Hi all we just had a case where an email was banned because Declude said it
had an exe in the email, when it only had a TXT.
What happened here?
What happened is that either it contained an .exe file, or it had multiple
extensions (in which case Declude Virus assumes the worst, that it is an
.ex
EMAIL PROTECTED]
> Subject: [Declude.Virus] BANEXT EXE
>
> Hi all we just had a case where an email was banned because Declude said
it
> had an exe in the email, when it only had a TXT.
>
> What happened here?
>
> Thanks.
>
> ---
> [This E-mail scanned for virus
Hi all we just had a case where an email was banned because Declude said it
had an exe in the email, when it only had a TXT.
What happened here?
Thanks.
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--
half Of R. Scott Perry
> Sent: Monday, March 08, 2004 6:44 AM
> To: [EMAIL PROTECTED]
> Subject: Re: [Declude.Virus] BANEXT question
>
>
> >No such thing as BANEXT EZIP??
>
> I believe he meant "There is no such thing as BANEZIP ON" (because there
> isn'
No such thing as BANEXT EZIP??
I believe he meant "There is no such thing as BANEZIP ON" (because there
isn't one of those). But Don re-posted the summary that I had sent out
last week, which has all the details in it.
-Scott
---
Declude JunkM
PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, March 08, 2004 2:22 AM
Subject: RE: [Declude.Virus] BANEXT question
As Don said, there is no such thing as BANEXT EZIP.
Try reading the archives again.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
> -Original Me
unday, March 07, 2004 5:23 PM
> To: [EMAIL PROTECTED]
> Subject: [Declude.Virus] BANEXT question
>
> I'm currently using: BANEXT EZIP, becuase BANEZIP ON does not work for
> me.
> I'm running the latest intrum version of Declude w/ F-Prot. I have a
> Standard Declude
ility detection.
Find out what you've been missing: Ask for a free 30-day evaluation.
- Original Message -
From: <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Sunday, March 07, 2004 7:22 PM
Subject: [Declude.Virus] BANEXT question
> I'm currently using: BANEXT
I'm currently using: BANEXT EZIP, becuase BANEZIP ON does not work for me.
I'm running the latest intrum version of Declude w/ F-Prot. I have a
Standard Declude license. Does BANEZIP ON only work for the Pro version of
Declude? If yes, I guess I should just continue to use BANEXT EZIP ?
(Such a w
Why does the BANEXT EZIP report a virus (and send the associated
notifications) instead of reporting a banned extension (and send the
bannotify.eml)??
Todd Holt
Xidix Technologies, Inc
Las Vegas, NV USA
702.319.4349
www.xidix.com
---
[This E-mail scanned for viruses by Declude Virus (http://ww
I have a question about how DV handles BANEXT. Does DV scan the message
first for viruses then check to see if an attachment is in the BANEXT list
or does it check the BANEXT list and then scan the message, or does it check
the BANEXT list and block based on that without scanning the message?
The
I have a question about how DV handles BANEXT. Does DV scan the message
first for viruses then check to see if an attachment is in the BANEXT list
or does it check the BANEXT list and then scan the message, or does it check
the BANEXT list and block based on that without scanning the message?
A
PROTECTED] Behalf Of R. Scott Perry
Sent: Tuesday, March 02, 2004 12:47 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] Banext and bannotify.eml questions
>Isn't it possible to modify the Bannotify.eml file and only include the
>recipient and postmaster? Would it still send a no
OK, I have it the other way around, does that matter?
No. Any E-mail addresses that appear after "To: " and that are separated
by commas will work.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Can I configure the bannotify.eml to not send messages to the sender of
the file, but to send them only to the recipient and to me.
Not currently.
Actually, I believe this can be done, by using a line "To:
%ALLRECIPS%,[EMAIL PROTECTED]" in the \IMail\Declude\BANnotify.eml file.
Isn't it possible to modify the Bannotify.eml file and only include the
recipient and postmaster? Would it still send a notice to the sender somehow?
The notification will be sent to anyone listed in the To: header. In this
case, you can use "To: %ALLRECIPS%,[EMAIL PROTECTED]".
Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of bill.maillists
Sent: Tuesday, March 02, 2004 12:27 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] Banext and bannotify.eml questions
Scott,
>>Can I configure the bannotify.eml to not send messages to the sen
Scott,
>>Can I configure the bannotify.eml to not send messages to the sender of
>>the file, but to send them only to the recipient and to me.
>
>Not currently.
>
Isn't it possible to modify the Bannotify.eml file and only include the recipient and
postmaster? Would it still send a notice to th
> BANEXTdata
Does not look to be executable.
http://filext.com/detaillist.php?extdetail=data&Submit3=Go%21
> BANEXTlink
No such extension found.
http://filext.com/detaillist.php?extdetail=link&goButton=Go
> BANEXTunk
No such extension found.
http
D] On Behalf Of Darin Cox
Sent: Sunday, February 01, 2004 9:23 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] BANEXT
Good list, John. Thanks for sharing.
Darin.
- Original Message -
From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Good list, John. Thanks for sharing.
Darin.
- Original Message -
From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, January 28, 2004 3:55 PM
Subject: RE: [Declude.Virus] BANEXT
> What are the recommended
Would you be willing to send the list as a text file?
Thanks, Andy
- Original Message -
From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, January 28, 2004 3:55 PM
Subject: RE: [Declude.Virus] BANEXT
> > What are t
> What are the recommended extensions to BAN?
http://www.eservicesforyou.com/documents/emailattachments.pdf
> How do you handle it if someone needs to send a file through...sometimes
> there will be legitimate files that need to be send through.
I tell them to zip it.
John Tolmachoff
Engineer/C
What are the recommended extensions to BAN?
How do you handle it if someone needs to send a file through...sometimes
there will be legitimate files that need to be send through.
Thanks, andy
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came
[EMAIL PROTECTED] [mailto:Declude.Virus-
> [EMAIL PROTECTED] On Behalf Of Robert Grosshandler
> Sent: Tuesday, January 27, 2004 6:10 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.Virus] BANEXT
>
> Well, yes! If I open a zip and catch a virus, woe on me. I'm supposed t
Rick Klinge
Sent: Monday, January 26, 2004 10:11 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] BANEXT
Geeze.. So you want the virus to only effect certain users?
~Rick
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Robert
> Gr
t; [EMAIL PROTECTED] On Behalf Of Hirthe, Alexander
> Sent: Tuesday, January 27, 2004 12:00 AM
> To: '[EMAIL PROTECTED]'
> Subject: [Declude.Virus] BANEXT ?
>
> Hello,
>
> is there a difference between
> BANEXT .ZIP
> and
> BANEXT ZIP
> ?
>
> What will h
Hello,
is there a difference between
BANEXT .ZIP
and
BANEXT ZIP
?
What will happen with a Virus.zip.exe file?
Alex
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mai
sshandler
> Sent: Monday, January 26, 2004 7:19 PM
> To: [EMAIL PROTECTED]
> Subject: [Declude.Virus] BANEXT
>
> Thanks to all for the quick notification of the new virus. We seemed to
> have escaped any harm.
>
> We immediately put BANEXT zip into our virus.cfg file, and t
Geeze.. So you want the virus to only effect certain users?
~Rick
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Robert
> Grosshandler
> Sent: Monday, January 26, 2004 9:19 PM
> To: [EMAIL PROTECTED]
> Subject: [
Thanks to all for the quick notification of the new virus. We seemed to
have escaped any harm.
We immediately put BANEXT zip into our virus.cfg file, and that seemed to be
a good thing.
Now I'm thinking about lowering our protection back to where it was.
Is it possible, with Virus Standard, and
I'm thinking of leaving the banext in place but want to allert the sender
and/or recipient when a mail is being held. I've downloaded the
BANnotify.eml file but don't see how Declude decides when to use it. Do I
need to put any extra control lines at the beginning?
Declude knows by the name of
Hi,
I'm thinking of leaving the banext in place but
want to allert the sender and/or recipient when a mail is being held. I've
downloaded the BANnotify.eml file but don't see how Declude decides when to use
it. Do I need to put any extra control lines at the beginning?
Groetjes,
Bonno B
I thought BANEXT worked before the scanner?
Both are done on all E-mail, and if a virus is found, it takes priority
over the banned file extension.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus
] Behalf Of R. Scott Perry
Sent: Wednesday, August 20, 2003 04:03 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] BANEXT to delete all .pif?
>Just like everyone else, we are getting hammered by Sobig.F. Declude seems
>to be catching and holding the virus e-mails with the attachments b
: [Declude.Virus] BANEXT to delete all .pif?
>Just like everyone else, we are getting hammered by Sobig.F. Declude seems
>to be catching and holding the virus e-mails with the attachments because
of
>the BANEXT option. The potential exists to overload our hard drive. There
>were over 3,000 h
Just like everyone else, we are getting hammered by Sobig.F. Declude seems
to be catching and holding the virus e-mails with the attachments because of
the BANEXT option. The potential exists to overload our hard drive. There
were over 3,000 held messages today (that is about 2x what we would no
Please excuse this if it has already been answered-
Just like everyone else, we are getting hammered by Sobig.F. Declude seems
to be catching and holding the virus e-mails with the attachments because of
the BANEXT option. The potential exists to overload our hard drive. There
were over 3,000 he
Is there a way to just refuse attachments of certain types? OR strip the attachment off? I don't want to bounce messages,
I'd be happy with just removing the attachment. maybe add a line to the
mail "Attachment removed" ? Is this possible? Or something we can add?
No, that isn't possible. Al
Scott.
Is there a way to just refuse attachments of certain types? OR strip the attachment off? I don't want to bounce messages,
I'd be happy with just removing the attachment. maybe add a line to the
mail "Attachment removed" ? Is this possible? Or something we can add?
Paul
---
[This E-m
I am running Declude 1.65 with F-Prot 3.12b. All virus scanning works
fine, as I receive several notifications weekly regarding infected
emails. However, the BANEXT feature does not seem to be working.
Only Declude Virus Standard and Declude Virus Pro support the banning of
file extensions.
Hello,
I am running Declude 1.65 with F-Prot 3.12b. All virus scanning works
fine, as I receive several notifications weekly regarding infected
emails. However, the BANEXT feature does not seem to be working. I
sent test emails with VBS attachments and they got through. Here's the
BANEXT portio
> Hope that helps.
Thanks John!
Sheldon
Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com
Ten Forward Communications 360-457-9023
Nationwide access, neighborhood support!
"Whenever you find yourself on the side of the majority, it's time
to pause and reflect." Mark Twai
PROTECTED]
Subject: [Declude.Virus] BANEXT SHS
I have 2 people that are mad at me for blocking the SHS extension. Are there
any web pages from anti virus companies or some such "Authority" that I can
send them on why I am blocking it?
They say they are sending a Christmas card.
Sheldon
Sheld
I have 2 people that are mad at me for blocking the SHS extension. Are there
any web pages from anti virus companies or some such "Authority" that I can
send them on why I am blocking it?
They say they are sending a Christmas card.
Sheldon
Sheldon Koehler, Owner/Partnerhttp://www.tenfor
Perry
Sent: Thursday, September 05, 2002 7:21 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] BANext for domains?
>is it possible to ban extensions on a per domain base?
>I'd like to let our customers do whatever they want, but I don't want to
get
>.mp3 files.
No --
>is it possible to ban extensions on a per domain base?
>I'd like to let our customers do whatever they want, but I don't want to get
>.mp3 files.
No -- banning files is a global option.
-Scott
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declud
Hello,
is it possible to ban extensions on a per domain base?
I'd like to let our customers do whatever they want, but I don't want to get
.mp3 files.
is this possible with declude virus pro?
Alex
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This
Thanks, will do Scott!
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Wednesday, September 04, 2002 2:07 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] BANEXT settings
>I just implimented the BANEXT in my virus.cfg
>I just implimented the BANEXT in my virus.cfg and added the bannotify.eml to
>my Declude directory. The notify only goes out to the sender and I would
>like to know when a banned extension tries to come in as well. I know I
>could just add an additional entry to the "to:" field of bannotify.em
Hello,
I just implimented the BANEXT in my virus.cfg and added the bannotify.eml to
my Declude directory. The notify only goes out to the sender and I would
like to know when a banned extension tries to come in as well. I know I
could just add an additional entry to the "to:" field of bannotify
ok scott, I'll get the latest thanks for looking into it.
Insidently, I see that all the time with mac files... spaces at the end pain in the
_ss
On Friday, August 9, 2002 11:18 AM, R. Scott Perry <[EMAIL PROTECTED]> wrote:
>
>>so, I looked at the message in the virus folder and there w
>so, I looked at the message in the virus folder and there were 4
>attachments to the message, none of them had extensions. (all mac files)
Actually, it turns out that this isn't related to the BinHex files -- the
problem has to do with the attachments not having extensions (and having
spaces
done.
On Friday, August 9, 2002 10:37 AM, R. Scott Perry <[EMAIL PROTECTED]> wrote:
>
>>I did not catch that you wanted the message How do I go about taking
>>something from the virus folder, change the recipient to [EMAIL PROTECTED]?
>>
>>just copy and change the sender in both files?
>
>I did not catch that you wanted the message How do I go about taking
>something from the virus folder, change the recipient to [EMAIL PROTECTED]?
>
>just copy and change the sender in both files?
Probably the easiest thing to do would be to send the .SMD file (from the
virus folder) as an
TED]
>[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
>Sent: Friday, August 09, 2002 8:18 AM
>To: [EMAIL PROTECTED]
>Subject: Re: [Declude.Virus] banext issue
>
>Those headers won't affect whether or not Declude bans the files -- the
>*real* filename is one you wo
]] On Behalf Of R. Scott Perry
Sent: Friday, August 09, 2002 8:18 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] banext issue
Those headers won't affect whether or not Declude bans the files -- the
*real* filename is one you won't see, becaues it is encoded.
You can send a copy of
>ok, so next question... if declude caught the attachment why did it not
>list with the %BANEXT% variable? That variable was blank. How would I
>determine what file extension was caught. I'm just trying to understand...
Once I see the file, I should be able to find out what happened. It ma
ok, so next question... if declude caught the attachment why did it not list with the
%BANEXT% variable? That variable was blank. How would I determine what file
extension was caught. I'm just trying to understand...
On Friday, August 9, 2002 9:17 AM, R. Scott Perry <[EMAIL PROTECTED]> wrote
Those headers won't affect whether or not Declude bans the files -- the
*real* filename is one you won't see, becaues it is encoded.
You can send a copy of the E-mail file to [EMAIL PROTECTED] , and I can
test it here to see what the real extensions are.
-Sco
>The catch here is that BinHex (Mac encoding) files have the filename within
>the encoded segment. So you can have a situation where the MIME filename
>is "safefile.txt", but the BinHex segment says the filename is
>"evilvirus.exe" (which you won't see, because it is encoded).
>
>so, I looked at the message in the virus folder and there were 4
>attachments to the message, none of them had extensions. (all mac files)
The catch here is that BinHex (Mac encoding) files have the filename within
the encoded segment. So you can have a situation where the MIME filename
is
I recently added multiple banext commands to my config file.
I send a message to sender and postmaster when the message is banned. This morning I
had a postmaster message and the message listed no banned extension.
so, I looked at the message in the virus folder and there were 4 attachments to
Thanks all
-Original Message-
From: Dustin Freeman [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, June 12, 2002 10:25 AM
To: '[EMAIL PROTECTED]'
Subject: RE: [Declude.Virus] BANEXT notify
Can I downoload the BANnotify.eml template from somewhere?
-Original Message-
>Can I downoload the BANnotify.eml template from somewhere?
Yes, you can download it from
http://www.declude.com/release/154/bannotify.eml . Further details on
banning file extensions can be found at
http://www.declude.com/virus/manual.htm in the "Banning files based on
extension" section.
> Can I downoload the BANnotify.eml template from somewhere?
I just wrote the following:
From: postmaster@%LOCALHOST%
To: %MAILFROM%,[EMAIL PROTECTED]
Subject: WARNING: File attachment banned
It appears you sent a file attachment that had either exe, pif or scr as an
extension. For security rea
Can I downoload the BANnotify.eml template from somewhere?
-Original Message-
From: Don Hickey [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, June 12, 2002 10:18 AM
To: [EMAIL PROTECTED]
Subject: [Declude.Virus] BANEXT notify
I have the BANEXT and the notify working fine. My question is
>I have the BANEXT and the notify working fine. My question is there a way to
>send the notify email to the postmaster (me) also to let me know that
>someone tried to send a banned extension?
You can have:
To: %MAILFROM%,[EMAIL PROTECTED]
in the \IMail\Declude\BANnotify.eml file, whic
I have the BANEXT and the notify working fine. My question is there a way to
send the notify email to the postmaster (me) also to let me know that
someone tried to send a banned extension?
Thanks
Don Hickey
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
Thi
001 12:02 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.Virus] BANEXT maybe not working?
>
>
> >> the virus scanning takes priority over the banning. That is,
> the E-mail
> will be scanned for viruses first, and only if the E-mail is
> virus-free will
> the fi
>> the virus scanning takes priority over the banning. That is, the E-mail
will be scanned for viruses first, and only if the E-mail is virus-free will
the file extension banning be done. <<
Thank you and PLEASE remember to keep it in that sequence. It takes
extra CPU time to first run the vir
83 matches
Mail list logo
