Re: [Declude.Virus] Unknown virus warnings

I have not "activated" returncode 8 for F-prot in Declude yet because I wasn't sure if we would get to many false positives. Has anyone, or maybe f-prot themselves, any info on that? Does returncode 8 generate false positives and if so, how many? I have had virus code 8 enabled for quite a while, I

RE: [Declude.Virus] Unknown virus warnings

- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Friday, October 29, 2004 11:27 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Unknown virus warnings > I have not "activated" returncode 8 for F-prot in Declude yet because > I wasn't su

RE: [Declude.Virus] Unknown virus warnings

> I have not "activated" returncode 8 for F-prot in Declude yet > because I wasn't sure if we would get to many false > positives. Has anyone, or maybe f-prot themselves, any info > on that? Does returncode 8 generate false positives and if > so, how many? Bonno, I don't know how much false

Re: [Declude.Virus] Unknown virus warnings

Hi, > > I expect that we will change the code to treat these as > > forging, so SKIPIFFORGING would catch 'em. We could also add > > a separate SKIPIF... > > option just to detect these, just to be safe. > > I believe it would be usefull for all users of F-Prot with returncode 8 > enabled to avoi

Re: [Declude.Virus] Unknown virus warnings

Markus, a third update now seems to detect ALL bagle variants. --- Franco Celli [EMAIL PROTECTED] - Original Message - From: "Markus Gufler" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, October 29, 2004 2:34 PM Subject: RE: [Declud

RE: [Declude.Virus] Unknown virus warnings

> I expect that we will change the code to treat these as > forging, so SKIPIFFORGING would catch 'em. We could also add > a separate SKIPIF... > option just to detect these, just to be safe. I believe it would be usefull for all users of F-Prot with returncode 8 enabled to avoid future unecc

RE: [Declude.Virus] Unknown virus warnings

Thanks for the clarrification. Is there anything we can do against this or would it be possible to have some fix for future releases? Something like SKIPIF... ISBLANK I expect that we will change the code to treat these as forging, so SKIPIFFORGING would catch 'em. We could also add a separate S

Re: [Declude.Virus] Unknown virus warnings

Just a note, the second update of F-PROT still does not detect all joke.* and price.* sign.def and sign2.def both with 10/29/2004 9.59 timestamp waiting for another update next few hours!? --- Franco Celli [EMAIL PROTECTED] --- [Quipo ISP - Questa E-mail e' stata controllata dal prog

Re: [Declude.Virus] Unknown virus warnings

On Behalf Of Franco Celli Sent: Friday, October 29, 2004 12:40 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Unknown virus warnings F-PROT updated (29/10) definitions detects them as Bagle.AP. --- Franco Celli [EMAIL PROTECTED] --- [Quipo ISP - Questa E-mail e' stata

RE: [Declude.Virus] Unknown virus warnings

> The problem is that F-Prot was detecting it as a "suspicious file" > (VIRUSCODE 8), but not reporting the virus name in the > report.txt file (since it did not detect a virus, it can't > know the name of it). As a result, the name of the virus was > left blank, but Declude Virus would show

RE: [Declude.Virus] Unknown virus warnings

Now the F-prot update is arrived also here. Catching it as Bagle.AP from 12:30 GMT+1 on. Mcafee is catching it as Bagle.bb from 13:05 GMT+1 on. But I still can't understand what's happened with the "Unknown virus" string...? The problem is that F-Prot was detecting it as a "suspicious file" (VIRU

RE: [Declude.Virus] Unknown virus warnings

gt; From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Franco Celli > Sent: Friday, October 29, 2004 12:40 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.Virus] Unknown virus warnings > > F-PROT updated (29/10) definitions detects them as Bagle.AP. > >

Re: [Declude.Virus] Unknown virus warnings

A new update (the second as 29/10) is available for F-PROT. With the first one, some samples remain undetected blocked only by BANEXT. --- Franco Celli [EMAIL PROTECTED] --- [Quipo ISP - Questa E-mail e' stata controllata dal programma Declude Virus] [Quipo ISP - This E-mail was scann

Re: [Declude.Virus] Unknown virus warnings

F-PROT updated (29/10) definitions detects them as Bagle.AP. --- Franco Celli [EMAIL PROTECTED] --- [Quipo ISP - Questa E-mail e' stata controllata dal programma Declude Virus] [Quipo ISP - This E-mail was scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses

RE: [Declude.Virus] Unknown virus warnings

> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of E. Ballerini > Sent: Friday, October 29, 2004 11:52 AM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.Virus] Unknown virus warnings > > Franco Celli wrote: > > >Hi Markus, &g

RE: [Declude.Virus] Unknown virus warnings

=== Seems to be a new Bagle variant but this is all very strange. Markus > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Franco Celli > Sent: Friday, October 29, 2004 11:39 AM > To: [EMAIL PROTECTED] > Subject: Re: [De

Re: [Declude.Virus] Unknown virus warnings

Franco Celli wrote: Hi Markus, I have no idea, but our server is registering a peak of incoming messages, with above-normal banned cpl extension attachments in virus folder. According to F-secure it's the new Bagle virus: New Bagle variant, Bagle.AT, has been spotted in several locations. It se

Re: [Declude.Virus] Unknown virus warnings

lt;[EMAIL PROTECTED]> Sent: Friday, October 29, 2004 10:32 AM Subject: [Declude.Virus] Unknown virus warnings > Hi all, > > Today I can see a large number of non delivery reports comming back to our > server containing the original virus warning (recip.eml) > >

[Declude.Virus] Unknown virus warnings

Hi all, Today I can see a large number of non delivery reports comming back to our server containing the original virus warning (recip.eml) This is the begin of our recip.eml file: === SKIPIFSENDER [Forged] SKIPIFVIRUSNAMEHAS Vulnerability SKIPIFVIRUSN

[Declude.Virus] unknown virus in unknown file

Hi, As Declude *does* know the name of the file it is trying to decode, maybe it could display that name, along with the fact it caught a vulnerability and not an unknow virus? Shouldn't it have reported it found: The "EOF in multipart processing" vulnerability virus in Webmaster_attach.pif I'm al

Re: [Declude.Virus] unknown virus in unknown file

As Declude *does* know the name of the file it is trying to decode, maybe it could display that name, along with the fact it caught a vulnerability and not an unknow virus? It does display the actual name. Shouldn't it have reported it found: The "EOF in multipart processing" vulnerability virus i

Re: [Declude.Virus] Unknown Virus

I'm getting LOTS of unknown viruses with Subject lines that look like W32/[EMAIL PROTECTED] http://vil.nai.com/vil/content/v_101083.htm McAfee does not yet have DAT 4335 released. Netsky.J likes to use *.pif files. The "Unknown virus" will occur when

[Declude.Virus] Unknown Virus

I'm getting LOTS of unknown viruses with Subject lines that look like W32/[EMAIL PROTECTED] http://vil.nai.com/vil/content/v_101083.htm McAfee does not yet have DAT 4335 released. Netsky.J likes to use *.pif files. Question: The new vulnerability tests for *.pif files, how do we expect them

Re: [Declude.Virus] Unknown Virus virus in Unknown File

- Original Message - From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, July 03, 2003 7:15 PM Subject: Re: [Declude.Virus] Unknown Virus virus in Unknown File > > >Hi Scott, but if not use on-acces scanner I cannot con

Re: [Declude.Virus] Unknown Virus virus in Unknown File

Hi Scott, but if not use on-acces scanner I cannot control the mail that they come sended through web-mail, just ? I bring back you of continuation an extract of a mail that you have sended to time ago: One option would be to upgrade to IMail v8, which will let Declude Virus scan web messaging E

Re: [Declude.Virus] Unknown Virus virus in Unknown File

- Original Message - From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, July 03, 2003 6:47 PM Subject: Re: [Declude.Virus] Unknown Virus virus in Unknown File > > >Hi Scott, therefore if use on-access virus scanner also usin

Re: [Declude.Virus] Unknown Virus virus in Unknown File

Hi Scott, therefore if use on-access virus scanner also using the option /report however I will not have the possibility to know the type of virus? Still thanks. That is correct. The on-access scanner will delete the attachment, without recording what virus was found or what attachment it was in

Re: [Declude.Virus] Unknown Virus virus in Unknown File

- Original Message - From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, July 03, 2003 1:52 PM Subject: Re: [Declude.Virus] Unknown Virus virus in Unknown File > > >Hi Scott and thanks for the attention, you say to add me the

Re: [Declude.Virus] Unknown Virus virus in Unknown File

Hi Scott and thanks for the attention, you say to add me the option /report, but in past I have had problems when I inserted this option and in order to resolve these problems you advised me not to use /report, in bottom to mail you I bring back the content of mail that there are exchanges to you

Re: [Declude.Virus] Unknown Virus virus in Unknown File

- Original Message - From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, July 02, 2003 3:40 PM Subject: Re: [Declude.Virus] Unknown Virus virus in Unknown File > > >Hi, I have controlled and the file of report have qualifie

Re: [Declude.Virus] Unknown Virus virus in Unknown File

Hi, I have controlled and the file of report have qualified the relative option to the name of the virus. The antivirus ones that use is NetShield / McAfee, moreover this happens with all the types of virus, if you have need of other information are to disposition. Thanks for the attention and goo

Re: [Declude.Virus] Unknown Virus virus in Unknown File

- Original Message - From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, July 01, 2003 8:39 PM Subject: Re: [Declude.Virus] Unknown Virus virus in Unknown File > > >Hi, in the last days they have arrived to me various ma

[Declude.Virus] Unknown Virus

Title: Message Scott:   We are not constantly getting the Unknown virus as alerts.   Declude Virus  [Ver: 1.70i1] caught the Unknown Virus virus in Unknown Filefrom ???@hotmail.com to:  [EMAIL PROTECTED]   is just changed to cover the user.   almost 100% of all alerts we get are lik

RE: [Declude.Virus] Unknown Virus

OK then, can we see a way to "fix" this? I would like to see that the copyall_account is always treated as meaning the official host account. "copyall_account" is what the latest beta versions of Declude use to identify an IMail "copy all" account. This can be any address on the server (and IMa

RE: [Declude.Virus] Unknown Virus

> > > As for the Outgoing, Declude Virus just looks at the first recipient for > > > making that determination (which in this case is the "copyall" account, > > > which doesn't have a domain name associated with it when processed by > > > Declude, so it won't be scanned). > > > >I thought we fixed

RE: [Declude.Virus] Unknown Virus

> As for the Outgoing, Declude Virus just looks at the first recipient for > making that determination (which in this case is the "copyall" account, > which doesn't have a domain name associated with it when processed by > Declude, so it won't be scanned). I thought we fixed that by you changing s

RE: [Declude.Virus] Unknown Virus

> As for the Outgoing, Declude Virus just looks at the first recipient for > making that determination (which in this case is the "copyall" account, > which doesn't have a domain name associated with it when processed by > Declude, so it won't be scanned). I thought we fixed that by you changing s

Re: [Declude.Virus] Unknown Virus

Declude Virus v1.66i5 caught the Unknown Virus virus in Unknown File from <> to: [EMAIL PROTECTED] "Unknown Virus" will occur if your virus scanner detects a virus, but does not report the name of it (or does not report the name of it properly). This will also appear if the attachment is de

[Declude.Virus] Unknown Virus

I received this notice: Declude Virus v1.66i5 caught the Unknown Virus virus in Unknown File from <> to: [EMAIL PROTECTED] Date: 01/21/2003 06:41:03 Subject:Mail delivery failed: returning message to sender Spool File: D5bfe055b011667bd.SMD Received: from relay2.primushost.com [207.24

Re: [Declude.Virus] unknown virus every time

We have a subscriber who gets an unknown virus in the unknown file error message from Declude 1.61 every time he attempts to send a message. Apparently this has been going on for a few weeks. His McAfee anti-virus program on his computer can't find the virus. We use Fprot on the mail server and o

[Declude.Virus] unknown virus every time

We have a subscriber who gets an unknown virus in the unknown file error message from Declude 1.61 every time he attempts to send a message. Apparently this has been going on for a few weeks. His McAfee anti-virus program on his computer can't find the virus. We use Fprot on the mail server and our

RE: [Declude.Virus] Unknown Virus ????

luglio 2002 19.47 To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Unknown Virus >I'm getting many "Unknown Virus virus in Unknown File". >Could anybody tell me what kind of virus is this? Do you mean: 'I'm always getting "Unknown Virus virus in Unknown Fil

Re: [Declude.Virus] Unknown Virus ????

>I'm getting many "Unknown Virus virus in Unknown File". >Could anybody tell me what kind of virus is this? Do you mean: 'I'm always getting "Unknown Virus virus in Unknown File"'? If you are always getting it, then there is a configuration issue (if you either E-mail me your virus.cfg file,

[Declude.Virus] Unknown Virus ????

I'm getting many "Unknown Virus virus in Unknown File". Could anybody tell me what kind of virus is this? Thank you Giuseppe Foderaro GFC consult - Internet & Web Services Via Cortina d'Ampezzo 156 - 00135 Roma - Italy Tel +39063330 Fax +390633665777 cell. +393356293150 BEGIN:VCARD VERSI

Re: [Declude.Virus] Unknown Virus is back

>Anybody else notice that all of a sudden the virus messages are stating the >old "Unknown Virus virus in Unknown File"? > >Seems like since mid-afternoon Saturday. Everything else looks normal. It's unclear exactly what this is -- whether it is a new virus, a mass mailing of a virus, or someth

[Declude.Virus] Unknown Virus is back

Anybody else notice that all of a sudden the virus messages are stating the old "Unknown Virus virus in Unknown File"? Seems like since mid-afternoon Saturday. Everything else looks normal. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came fro