nday, September 12, 2005 4:27 PM
> To: Declude.Virus@declude.com
> Subject: Re: [Declude.Virus] McAfee DailyDAT download location change.
>
> David,
>
> Information such as this is best 'pushed' rather than 'pulled'. Declude
> should have a notification list t
The FTP site doesn't have the beta DAT's listed. It is the beta DAT's
that contain the latest updates, and for an E-mail system, they are the
best thing to use. Naturally they aren't as well tested as the other
things, but they will block things more quickly and you have to weigh
that against
The Proper method to
update the dat would be to pull the "ini" file
http://download.nai.com/products/datfiles/4.x/nai/update.ini
Then Parse this
[zip] section
[ZIP]EngineVersion=0DATVersion=4579FileName=dat-4579.zipFilePath=/pub/antivirus/datfiles/4.x/FileSize=6448048Checksum=2090,BED1MD
2, 2005 3:58 PM
To: Declude.Virus@declude.com
Subject: Re: [Declude.Virus] McAfee DailyDAT download location
change.
I changed the subject so that people can be alerted to this.
Announcements of things like this would be useful to the entire Declude
customer base. I am afraid that we are a little
scanner. Not part of my Declude at all.
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
MattSent: Monday, September 12, 2005 12:58 PMTo:
Declude.Virus@declude.comSubject: Re: [Declude.Virus] McAfee
DailyDAT download location change.
I changed the subject
I have to check my script because it still works fine up to
now.
Markus
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
MattSent: Monday, September 12, 2005 9:58 PMTo:
Declude.Virus@declude.comSubject: Re: [Declude.Virus] McAfee
DailyDAT download
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
MattSent: Monday, September 12, 2005 3:58 PMTo:
Declude.Virus@declude.comSubject: Re: [Declude.Virus] McAfee DailyDAT
download location change.
I changed the subject so that people can be alerted to this.
Announcements of things like
I changed the subject so that people can be alerted to this.
Announcements of things like this would be useful to the entire Declude
customer base. I am afraid that we are a little over a month behind.
Those with a single scanner would be screwed.
I adjusted my scripts to use the link that
These pop-up in an alert box when you log into Windows 2003 using
Remote Desktop and are also logged in the Event Viewer (I believe Win2K
will do the same). Here's an example:
Faulting application SCAN.EXE, version 4.4.0.0, faulting module
MCSCAN32.DLL, version 4.4.0.0, fault address 0x00
I haven't seen anything obvious in a quick glance through today's logs.
Do you have an example?
Usually, I just force another download of the dats.
- Original Message -
From: "Matt" <[EMAIL PROTECTED]>
To:
Sent: Monday, April 25, 2005 3:42 PM
Subject: [Declude.Virus] McAfee throwing error
On Behalf Of Colbeck,
Andrew
Sent: Monday, February 07, 2005 10:54 AM
To: Declude.Virus@declude.com
Subject: RE: [Declude.Virus] McAfee and POP3 service crash
I don't mean scanning the files in the
root repetitively. In particular, FileMon was showing me that scan.ex
again).
Andrew
8)
-Original Message-From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf Of Colbeck, AndrewSent: Monday, February 07, 2005 10:54
AMTo: Declude.Virus@declude.comSubject: RE:
[Declude.Virus] McAfee and POP3 service crash
I
don't mean scanning the fi
nly part of the McAfee client that
changed!
Andrew
8)
-Original Message-From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf Of MattSent: Monday, February 07, 2005 10:35
AMTo: Declude.Virus@declude.comSubject: Re:
[Declude.Virus] McAfee and POP3 service
crashAndr
rking fine.
Andrew 8)
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Bill Landry
Sent: Monday, February 07, 2005 7:04 AM
To: Declude.Virus@declude.com
Subject: Re: [Declude.Virus] McAfee and POP3 service crash
Although I cannot explain the cause of t
Virus@declude.com
Subject: Re: [Declude.Virus] McAfee and POP3 service crash
Although I cannot explain the cause of the issues you've seen, I would
suggest that you upgrade your scan engine:
http://www.mcafeesecurity.com/us/downloads/default.asp?wt.mc_n=us_update
s&wt.mc_t=ext_li_c
Although I cannot explain the cause of the issues you've seen, I would
suggest that you upgrade your scan engine:
http://www.mcafeesecurity.com/us/downloads/default.asp?wt.mc_n=us_updates&wt.mc_t=ext_li_con&cid=10373.
Download and run the SuperDat, file which contains the latest dat and engine
upda
>
To: <[EMAIL PROTECTED]>
Sent: Friday, September 03, 2004 4:04 PM
Subject: RE: [Declude.Virus] McAfee VScan 8
> Very good Point about the enterprise version! I just say the
> subject line which indicated "McAfee VScan 8" and immediately
> reacted with a warning since I
Scott,
Looking at the logging in terms of vulnerabilities I noticed that under
certain circumstances it does not print out the "File(s) are Infected" line
when the vulnerability is found in the subject or from field. Is this by
design? Also, in terms of when it catches the vulnerability in somet
Very good Point about the enterprise version! I just say the
subject line which indicated "McAfee VScan 8" and immediately
reacted with a warning since I've had several pretty
significant problems with it do to it's limitations.
Wolf
---
[This E-mail was scanned for viruses by Declude Virus (h
] On Behalf Of Wolf Tombe
Sent: Friday, September 03, 2004 12:05 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] McAfee VScan 8
Version 8 has extremely limited user functionality (far less than version 7 had). For
example, you cannot exclude directories or applications from being scanned
Version 8 has extremely limited user functionality (far less
than version 7 had). For example, you cannot exclude
directories or applications from being scanned. And, if the
virus scanner spots something "suspicious" even though
clearly NOT a virus it stops all process of the application
in
:48 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] Mcafee command line scanner
Which Mcafee product does everyone use then?
Thanks,
Adam
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Jeff Pereira
Sent: Wednesday, July 07, 2004 11:31 AM
To: [EMAIL
Which Mcafee product does everyone use then?
Thanks,
Adam
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Jeff Pereira
Sent: Wednesday, July 07, 2004 11:31 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] Mcafee command line scanner
It will work
It will work, but you will most likely be violating their licensing
agreement.
- Original Message -
From: "Adam Hobach" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, July 07, 2004 12:31 PM
Subject: [Declude.Virus] Mcafee command line scanner
> Is this a real price for the
More info on problems with the old engine. Also sometimes (esp on Win
98) it may take some extra procedures to fully update the engine.
http://forums.mcafeehelp.com/viewtopic.php?t=27957
PS For any McAfee question this forum is a GREAT resource.
(Focused on Retail customers, but there is a small
esday, April 28, 2004 5:23 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] Mcafee NetShield Problems
I agree with Scott's response about LDAP.
The raid controller firmware I am not concerned with, although I did not
know they had a new one. I will have to check on my clients 2650 for th
Contact Microsoft. They can analyze the dumps for you. 64K dumps should be
fine.
DC
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Scott Hahn
Sent: Wednesday, April 28, 2004 3:24 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] Mcafee NetShield
Thanks
Scott Hahn
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of marc catuogno
Sent: Wednesday, April 28, 2004 10:30 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] Mcafee NetShield Problems
Start;Programs;Imail;Imail release notes -
I&#
D]
Subject: RE: [Declude.Virus] Mcafee NetShield Problems
How can I tell what hotfixes were applied to my system?
I am 8.1, I think I have HF2 (The latest)
In the meantime I have disabled LDAP to see if that helps.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On B
:38 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] Mcafee NetShield Problems
>I also opened drwatsn32. It is enabled and noticed a error I N ldap
>Application exception occurred:
Given this
> App: f:\imail\OpenLDAP\bin\slapd.exe (pid=1940)
and:
> > Imail 8.1
unit and installing it.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
> -Original Message-
> From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]
> On Behalf Of Scott Hahn
> Sent: Wednesday, April 28, 2004 12:24 PM
> To: [EMAIL PROTECTED]
> Subject: RE:
"Ever" is a long time. Yes, there have been a few problems. (But there
are a couple of false positives in the regular dats each year)
By Beta they reflect the fact that they have not had (taken) the time to
run the Full regression test suite.
Overall the quality is only a slight bit less than tha
> Are DailyDats alway at least as recent as sdat/xdat ?
> DailyDats are supposed to be beta quality. Anyone ever had a
> problem with
> these ?
Sometimes they detect the new Viruses not in all variant, and remove
information is not complete. But they are never bader than the normal
sdat.
Herman
PROTECTED]>
> Reply-To: [EMAIL PROTECTED]
> Date: Sat, 28 Feb 2004 10:57:12 -0700
> To: <[EMAIL PROTECTED]>
> Subject: RE: [Declude.Virus] Mcafee
>
> Troy,
>
> Thanks for the part numbers. I've managed too download the manual.
>
> Can I get a copy
Troy Hickerson
Sent: Wednesday, February 25, 2004 3:45 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] Mcafee
Here is some information for a McAfee VirusScan Command Line which works
well. From the testing I've done it appears to be a fast, small,
lightweight scanner with SCAN.EXE and all t
Thanks for the link. I called them to get a price and ran into another
brick wall.
McAfee is like that. Their normal MO, though, is to oversell, doing
everything short of blatant lying to do so.
What you may want to do is try asking them "I have one computer running
Windows XYZ" (for example,
VS 7.0 has both the server and
>desktop version built into the installer.
>
>Also, the current version is 7.1.
>
>Darrell
>
>-Original Message-
>From: [EMAIL PROTECTED]
>[mailto:[EMAIL PROTECTED] On Behalf Of Gene Head
>Sent: Wednesday, February 25, 2004 12:1
so, the current version is 7.1.
Darrell
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Gene Head
Sent: Wednesday, February 25, 2004 12:15 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] Mcafee
Do you have a part number/SKU for that?
I've cal
, 2004 12:15 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] Mcafee
Do you have a part number/SKU for that?
I've called Mcafee and can't seem to get them to understand what I need.
They do have a version called VirusScan ASAP but they can't tell me if it
has
t;Darrell
>
>-Original Message-
>From: [EMAIL PROTECTED]
>[mailto:[EMAIL PROTECTED] On Behalf Of Gene Head
>Sent: Wednesday, February 25, 2004 9:25 AM
>To: [EMAIL PROTECTED]
>Subject: RE: [Declude.Virus] Mcafee
>
>Scott,
>
>I've re-installed it a couple of
25, 2004 9:25 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] Mcafee
Scott,
I've re-installed it a couple of times but I haven't seen anywhere that
I can tell it to do a full install.
Does anyone have this version?
Gene Head
ACCRAM Inc.
MCP,Net+,A+,CCNA,CCDA
[EMAIL PROTECT
I've re-installed it a couple of times but I haven't seen anywhere that
I can tell it to do a full install.
You'll need to contact McAfee then to see how to do a Full Install (or at
least how to get the scan.exe file installed).
-Scott
---
Declu
lto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Wednesday, February 25, 2004 5:41 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] Mcafee
>It's Mcafee Virus Scan Ver 8.0 Build 8.0.26
>
>There isn't a scan.exe or scan32.exe on the drive.
You'll need to do a &q
It's Mcafee Virus Scan Ver 8.0 Build 8.0.26
There isn't a scan.exe or scan32.exe on the drive.
You'll need to do a "Full Install". That should get the scan.exe installed.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail ma
Dunno then. You may need to put a call into McAfee.
Bill
- Original Message -
From: "Gene Head" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, February 24, 2004 6:48 PM
Subject: RE: [Declude.Virus] Mcafee
> It's Mcafee Virus Scan Ver 8.0
t: Tuesday, February 24, 2004 6:36 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] Mcafee
Typically the McAfee command line scanned, "scan.exe", has been located
in
c:\program files\common files\Network Associates\VirusScan
Engine\4.0.xx, or
whatever version number you are running.
Typically the McAfee command line scanned, "scan.exe", has been located in
c:\program files\common files\Network Associates\VirusScan Engine\4.0.xx, or
whatever version number you are running. Here is the McAfee entry from the
Declude Virus manual at http://www.declude.com/virus/manual.htm:
SCANF
Hi Jack,
I'm running 7McAfee AV Enterprise Edition 7.1 and doing daily sdat (beta)
updates. I haven't had any problems other than with the in built
scheduler. That problem was
fixed easy enough, but shortly thereafter I went to doing an update via a
batch file and scheduler to stay up to date
Does the McAfee AV Enterprise Edition v7.1 work just as the previous with
Declude, or should we replace it with the prior installation?
As far as we know, v7.1 should work the same as the previous version, so no
changes should be necessary.
-Sco
> >Is the /clean switch in McAfee AV (Enterprise Edition 7.1) supported
> >within Declude?
Does the McAfee AV Enterprise Edition v7.1 work just as the previous with
Declude, or should we replace it with the prior installation?
---
[This E-mail was scanned for viruses by Declude Virus (http://www
Thanks for the lesson. :)
Burzin
At 11:49 AM 12/4/2003, you wrote:
About 99% of viruses that are received are ones that the virus itself sent
out, that has meaningless content. In the rare cases where someone
intentionally sends out an attachment that happens to have a virus, their
computer
Thanks John and Andy and others... :)
I realize that the situation is a statistical abnormality-- far more
extreme than John suggests.
Chalk the question up to one of curiosity more so than one of an immediate
driving technical need.
Thanks,
Burzin
At 04:57 PM 12/3/2003, you wrote:
99 times o
I was looking at the McAfee help file, and there were /mime and /mailbox
switches. Am I missing something?
You can ignore those. McAfee won't see any MIME segments or mailboxes --
Declude Virus handles all that. McAfee will just see an attachment (one
that will be deleted immediately after i
Sorry for the denseness
I was looking at the McAfee help file, and there were /mime and /mailbox
switches. Am I missing something?
Also is there an AV product that will function w. Declude AV and clean and
pass the messages along? Statistically it would probably be seldom used as
most
99 times out of 100, the message infected with a virus is not legit,
therefore there is no reason to clean and deliver.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.Virus-
> [EMAIL PROTECTED] On Behalf Of Burzi
Hi,
I think that virtually all virus infected emails nowadays contain worth
preserving, because the only thing attached is the virus itself. Cleaning
would not accomplish anything - because after the cleaning there'd be
nothing left. (Sorry to disappoint you, but that virus email that claims
th
Is the /clean switch in McAfee AV (Enterprise Edition 7.1) supported
within Declude?
No, it is not.
In other words is there a problem with adding /clean to the virus.cfg file?
Yes, there would be a problem. Specifically, McAfee will clean the decoded
attachment that Declude Virus creates, and
I did that with eicar and the On-Demand Scanner picked it up. However, when
I did it with Sobig.F, there was no attachment. Then I noticed that it was a
bounced message from another server (not using SKIPIFVIRUSNAMEHAS). I'm now
wondering if that is why McAfee On-Demand/Declude is not picking it u
After reading your post I went in and looked at my server, and the
[expletive deleted] McAfee Autoupdater hadn't successfully processed an
update since the 19th when it pulled 4286. That meant that we were on 4286
DATs and not the current 4288. I forced an update manually, and it pulled
these new d
NAI just sent me an extra.dat but I had to request it. After
installation of the extra.dat the Mcafee scanner is now detecting this
virus:
Scanner 2: Virus= the W32/Sobig@MM (ED) virus !!!
Attachment=Sample.pif [0] I
Getting several of these now.
Based on what I am seeing the treat assessm
Thanks for the update, John! That was my suspicion from reading their
license and speaking with our account rep, and why we opted not to use
McAfee on our IMail/Declude server.
Bill
-Original Message-
From: John Tolmachoff [mailto:[EMAIL PROTECTED]]
Sent: Monday, July 08, 2002 1:59 PM
T
At 02:54 PM 05/14/02, you wrote:
>I have just installed NetShield, (full install disabled on demand,) but
>I do not see a scan.exe in the directory. I do see the scan32.exe, but
>according to the virus manual, that is not the one to use for command
>line.
My scan.exe is located in Program Files/c
It sticks it in common files, or some weird location as I recall .. do a
full drive search for it..
Jonathan
At 06:09 PM 5/14/2002 -0400, you wrote:
>>I have just installed NetShield, (full install disabled on demand,) but
>>I do not see a scan.exe in the directory. I do see the scan32.exe, bu
>I have just installed NetShield, (full install disabled on demand,) but
>I do not see a scan.exe in the directory. I do see the scan32.exe, but
>according to the virus manual, that is not the one to use for command
>line.
>
>I even ran a manual scan to see if it would create it.
You may need to
I'm not sure what your asking. Update instructions are clearly described in
the virus listing on McAfee's site.
Jerry
- Original Message -
From: "Steve Spear" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, January 29, 2002 4:32 PM
Subject:
Then on the mcafee site there isn't a link for an update for the command
line scanner for the myparty virus. If there is a link, please forward
it.
Thanks,
STeve
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
This E-mail came from the Declude.Virus mailing
- Original Message -
From: "Jerry Murdock" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, January 28, 2002 6:53 PM
Subject: [Declude.Virus] McAfee Daily DAT Command
Line Scanner Update Script
> As requested a few times, attached is a script to update the engine
and dat> fi
Thanks, that little trick helped me out.
Is there any chance I could have a peek a that update script of yours?
My scripting are rather basic, I doubt it would take me less than a day to
get it to work :P
Joachim.
>If you actually managed to find and install the command line only version of
>Mc
>In the declude.cfg look for;
>
>SCANNERTIMEOUT 60
>
>I think 60 is the default so if you increase this your scanner is allowed
>more time to scan big files and thus eliminate your problem.
Actually, his problem is with the scanner itself, when it is not being used
with Declude.
The SCANNERTI
Tel: +44 (0)1223 326512
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Serge Dergham
Sent: Friday, October 12, 2001 3:20 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] McAfee NetShield Upgrade
upgraded to engine 4.1.5, but still getting the "t
upgraded to engine 4.1.5, but still getting the "timout alerts"
do you know what are these ?
- Original Message -
From: "Jerry Murdock" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, October 11, 2001 10:04 PM
Subject: Re: [Declude.Virus] M
At 01:23 PM 10/11/01, you wrote:
>1: 4.0.70 must be 2-3 years old now. Run SDAT ASAP, the scanner isn't
>worthless, but there are plenty of things that require the newer engines.
Is there a URL available for the SDAT? I've been searching McAfee's site
for way too long, no luck...
This E-mail
4100 is over a year old. Get the latest 4165 from the mcafee site.
Jerry
- Original Message -
From: "Serge Dergham" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, October 11, 2001 4:57 PM
Subject: Re: [Declude.Virus] McAfee NetShield Upgrade
ftp://ftp.nai.com/pub/antivirus/superdat/intel/sdat4164.exe
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Serge Dergham
Sent: Thursday, October 11, 2001 4:57 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] McAfee NetShield Upgrade
thanks
just
last week ?
- Original Message -
From: "Jerry Murdock" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, October 11, 2001 8:23 PM
Subject: Re: [Declude.Virus] McAfee NetShield Upgrade
> 1: 4.0.70 must be 2-3 years old now. Run SDAT ASAP, the scann
op solution to Trend
Officescan.
3: See #2
Jerry
- Original Message -
From: "Serge Dergham" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, October 11, 2001 3:22 PM
Subject: Re: [Declude.Virus] McAfee NetShield Upgrade
> Hi jerry,
>
> few questions if
>Is your comment below about Mcafee Netshield or Virusscan ?
>Or both product use the same scanner & options ?
Although the testing was done with VirusScan, we are under the impression
that all versions of VirusScan and NetShield use the same scan.exe engine.
Hi Scott
Is your comment below about Mcafee Netshield or Virusscan ?
Or both product use the same scanner & options ?
Thanks
- Original Message -
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, August 30, 2001 5:14 PM
Subject: Re: [Declude.Virus] [De
78 matches
Mail list logo
