mcafee uvscan not using /usr/local/uvscan/datfiles/current

[Remco Barendse]

To be honest, I don't know :)

I don't use the mailscanner update scripts but I fetch the daily dats
twice a day from cron because sometimes mcafee is too slow with new
datfiles.

I experienced problems in cases where there was a symlink to the binary
and/or a symlink to the datfiles (not 100% sure about the dat files).

It's kind of hard to debug because mcafee is running, and reporting that
the file is clean when run from MailScanner, checking the same file from
the commandline would find the virus. Sometimes it works, sometimes it
doesn't.

I haven't seen any reports from other mcafee users that they did have
problems with the mcafee-autoupdate script so assume it should work.

But you should definately avoid symlinks to the binaries (there is even
some remark about this in MailScanner.conf)

Someone on the list said that there was a new engine out for mcafee,
version 4.20 or so? My ISP includes a license for mcafee virusscan
included with my internet connection but they removed the *nux version
because 'mcafee is stopping development and support' for the *nix
versions. Haven't been able to confirm that though. Is mcafee indeed
phasing out?



On Wed, 28 Jan 2004, Bob Jones wrote:

> Remco Barendse wrote:
> > Uhmm, not really
> >
> > You should *not* use any symlinks at all.
> >
> > You will either get the symptoms as described (`old' dat files) or you
> > will see some (as in really some, not all!!) slipping through scanned, but
> > undetected.
> >
> > I think I was the first unfortunate person to find/report this 'feature'
> > of mcafee, there have been several reports about it since.
>
> So does this mean we shouldn't be using the mcafee-autoupdate script
> inculding in Mailscanner/libs to update our dat files?  Since it uses
> symlinks and all.  We haven't had any problems in the 4 months or so
> we've been doing this.
>
> Bob
>