NOD32 2.01 with MailScanner

[Rob Poe]

Why not ClamAV ?

>>> richard.bourque at MELLOUL.COM 5/14/2004 8:17:35 AM >>>
I've been using MailScanner with Sophos and SpamAssassin for the last
3
years, and am evaluating switching to NOD32.  (Mostly because Sophos
increased their prices 30% and my Windows users don't like it)  NOD32
for
Linux has barely any documentation, and the sales and tech departments
are
very un-helpful and un-professional in all regards.  I'm only
considering
the software because of the good reviews.

After two weeks I finally managed to get a demo licence for NOD32 on
demand scanner for Linux, Version 2.01, installed it and had to make
the
following changes in  /usr/lib/MailScanner/nod32-autoupdate to be
compatable.   (I guess Julian's still working with version 1)

$Nod32Auth  = "/etc/nod32/nod32.auth";
<snip>
# Check the auth file exists and has a username/password in it
$Nod32Auth = "$Nod32Auth";
<snip>
system("$Nod32Root/nod32_update");

I also the following in /etc/MailScanner/virus.scanners.conf
nod32-1.99      /usr/lib/MailScanner/nod32-wrapper
/usr/sbin/nod32
nod32           /usr/lib/MailScanner/nod32-wrapper
/usr/sbin/nod32

Now it's working, and catching the eicar test okay, but doesn't display
a
report like Sophos did (example: Report: SophosSAVI: eicar.zip was
infected by EICAR-AV-Test)
and EXE's inside zips get stopped now because of my no EXE rule.
What's
strange is that if I send through eicar.exe insize a zip file, I get
two
emails, one reporting the eicar virus test, and the other saying the
exe
rule stopped the attachment.

Does anybody have a working installation for NOD32 2.01?

Julian, would you like me to buy you an up to date license so you can
fix
this?  Or did I just do something stupid.

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html