I tried this with 1,2,3 spaces and tabs between the BANZIPEXTS, BANZIPEXTS
and the ON.
Just a reminder for people who didn't see it: spaces/tabs are irrelevant
here (they are only relevant in .eml files).
Then I send myself a compress .pif file both pw protected and not pw
proteced and every si
e: [Declude.Virus] New interim Declude Virus Pro to block bogus
.bat, .com, .pif, and .scr files
> Here's a thought.
>
> Since this is working in some cases and not in others, maybe there is a
> syntax bug.
>
> I have the following:
>
> BANEZIPEXTSON
> BANEXTEXE
>
Keith Johnson wrote:
Matt,
Is yours working with the TAB, I'll try anything?
Yes, mine is working.
It's a shot in the dark, but here's my Virus.cfg attached as a text file
with the only modification being that my CODE was removed. You will
definitely want to customize the settings nearer t
But...I'm curious as to why this new Vulnerability feature is a PRO only
one. If this is truly a feature that "will cut down significantly on the
impact of future viruses in the time before new virus definitions are
available" that sounds like a feature that should be implemented for ALL
Declude u
on 3/3/04 12:13 PM, ISPhuset Nordic AS wrote:
> could you please post the link here
http://www.declude.com/interim/
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail
i just went to 1.78i9 but i still get lines like:
03/03/2004 17:42:33 Q0af90280009aab8a Invalid PIF Vulnerability
03/03/2004 17:42:33 Q0af90280009aab8a File(s) are INFECTED [:
W32/[EMAIL PROTECTED]: 3]
03/03/2004 17:42:33 Q0af90280009aab8a Scanned: CONTAINS A VIRUS [MIME: 4
18391]
but it is no
That is just wrong...the Internet is all about sharing information.
Andy
> PLEASE go to a moderated list!
>
> Rodney Bertsch
> IS Coordinator
> Kirk NationaLease Co.
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Dec
Is yours working with the TAB, I'll try anything?
FYI, tabs/spaces should not affect anything (they are only important in
.eml files, where only one space/tab per line is allowed in the commands in
the headers).
-Scott
---
Declude JunkM
thanks,
Andy
- Original Message -
From: "John Carter" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, March 03, 2004 11:37 AM
Subject: RE: [Declude.Virus] New interim Declude Virus Pro to block bogus
.bat, .com, .pif, and .scr files
> Virustrap
IL PROTECTED]
> Subject: Re: [Declude.Virus] New interim Declude Virus Pro to
> block bogus .bat, .com, .pif, and .scr files
>
> on 3/3/04 11:30 AM, Matt wrote:
>
> > Since this is working in some cases and not in others,
> maybe there is a
> > syntax bug.
&g
to block
bogus .bat, .com, .pif, and .scr files
Here's a thought.
Since this is working in some cases and not in others, maybe there is a
syntax bug.
I have the following:
BANEZIPEXTSON
BANEXTEXE
BANEXTCOM
etc.
What if someone had spaces, multiple spaces or multiple tabs? How about
a spa
Here's a thought.
Since this is working in some cases and not in others, maybe there is a
syntax bug.
I have the following:
BANEZIPEXTSON
BANEXTEXE
BANEXTCOM
etc.
What if someone had spaces, multiple spaces or multiple tabs? How about
a space or tab following one of the lines? Maybe Declude
>>Again, it is vital that people be very clear in their posts. I'm very
>>close to turning this into a moderated list until this all blows over.
Scott, I can certainly sympathize with what you are going through there.
You do an OUTSTANDING job for us and I rank Declude as #1 in my book in all
ar
Matt,
Is yours working with the TAB, I'll try anything?
Keith
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Wednesday, March 03, 2004 11:31 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] New interim Declude Virus Pro to
I will move
forward to the latest interim and do the testing you require.
Keith
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Wednesday, March 03, 2004 10:46 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] New interim Declude
I don't know that our firewall is the issue due to it working
under i7 and all prior Declude versions.
The problem is that it CANNOT be working with previous versions. The
BANZIPEXTS/BANEZIPEXTS options were just added to i8; BANEXT EZIP was just
added to i7.
You're going to need to de
sword
protected.
Keith
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Wednesday, March 03, 2004 10:16 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] New interim Declude Virus Pro to block
bogus .bat, .com, .pif, and .scr files
03/03/2004 10:19:17 Qa313025b008ed2a1 Invalid COM Vulnerability
03/03/2004 10:19:17 Qa313025b008ed2a1 File(s) are INFECTED [:
W32/[EMAIL PROTECTED]: 3]
does this mean that the "COM Vulnerability" and the virus was discovered?
Correct. v1.78i9 fixes this, so that the "Invalid COM Vulnerability"
I am not using BANEXT EZIP with i7 nor i8 per your instructions
to remove it in place of the new commands:
In that case, i7 will *not* block any encrypted .ZIP files.
BANEZIPEXTS and BANZIPEXTS ON
I used that encoded file to test it under i8 first and it went
straight through, t
Title: New interim Declude Virus Pro to block bogus .bat, .com, .pif, and .scr files
hi scott,
i know, that right now it is more important to fight this new virii, but i might have a small problem with 1.78i8.
i am using 1.78i8 (with "BANZIPEXTS ON" and "BANEZIPEXTS ON" and no BANEXT EZIP
To: [EMAIL PROTECTED]
Cc:
Subject: Re: [Declude.Virus] New interim Declude Virus Pro to block bogus
.bat, .com, .pif, and .scr files
>I'll second that. Running 1.78i8, with BANZIPEXTS and BANEZIPEXTS ON,
the
&g
. Scott Perry
Sent: Wed 3/3/2004 9:01 AM
To: [EMAIL PROTECTED]
Cc:
Subject: RE: [Declude.Virus] New interim Declude Virus Pro to block bogus
.bat, .com, .pif, and .scr files
> For whatever reason, any password laid virus
I also forwarded the original message to your email addresswith .zip
attached.
No, no, NO.
NEVER send a virus or any file that you think may be malicious to ANY
E-mail address that is not expecting it.
We have one and only one E-mail address that viruses or suspicious files
may be sent to
For whatever reason, any password laid virus zip files
containing com, pif, scr, exe, or others are not getting picked up on our
system with i8, however, they are with i7. I hope this helps.
I assume you are using "BANEXT EZIP" with i7. Are you using it with i8 as
well? Do you have
m Declude Virus Pro to block bogus
.bat, .com, .pif, and .scr files
>
> >Matt, that's how I have it setup, and one got through.
>
> What is "one"? A .ZIP file with a banned encrypted file extension? A
.ZIP
> file with a banned non-encrypted file extension? A .ZIP fi
Scott,
I believe it is only with the new encrypted (password) zip files. I saw in
my log (when running i8) that my Scanners were picking up and detecting normal zip's,
normal pifs, normal scr. etc. of all virus flavors (if there is such thing as normal).
I believe I wouldn't see (as l
lto:[EMAIL PROTECTED] On Behalf Of Keith Johnson
Sent: Wednesday, March 03, 2004 1:56 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] New interim Declude Virus Pro to block bogus
.bat, .com, .pif, and .scr files
Matt,
Thanks, I don't have the old format listed BANEXT EZIP, I pulled
I switched from i5 to i8 6 hours ago. Until now I can see two empty vir
directories. Before I've had one undeleted vir directory per month. (5000 to
7000 msgs / day)
What is in those files?
Have you checked the Declude Virus log file to see the log file entries for
those E-mails?
If we are already blocking those extensions, how would that help?
If you are already blocking .bat, .com, .pif, and .scr files, the new
interim release won't help.
However, if you are not blocking all those files (most of our customers are
not), it will help.
It can also be used if you want to
Title: RE: [Declude.Virus] New interim Declude Virus Pro to block bogus .bat, .com, .pif, and .scr files
It blocks them _inside_ of a zip file, as opposed
to regular attachments.
Darin.
- Original Message -
From: Donn Bly
To: [EMAIL PROTECTED]
Sent: Tuesday, March 02, 2004 6:57
Title: RE: [Declude.Virus] New interim Declude Virus Pro to block bogus .bat, .com, .pif, and .scr files
If we are already blocking those extensions, how would that help?
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]On Behalf Of R. Sc
Scott,
Can I have a million dollars???
:)
R. Scott Perry wrote:
We now have a new interim release 1.78i8 of Declude Virus Pro at
http://www.declude.com/interim that will look for invalid .bat, .com,
.pif, and .scr files, and will treat them as vulnerabilities. It is
expected that this wil
We now have a new interim release 1.78i8 of Declude Virus Pro at
http://www.declude.com/interim that will look for invalid .bat, .com, .pif,
and .scr files, and will treat them as vulnerabilities. It is expected
that this will cut down significantly on the impact of future viruses in
the time
33 matches
Mail list logo
