McAfee uvscan 6.0.0

Fri Apr 9 11:57:28 IST 2010

Well spotted!

No we need someone to figure out how to parse the output in MailScanner,
and change the wrappers / whatever to make sure only V6 or later is
used.

Any offers, anyone? 

I'm not a perl person, alas.

Phil
--
Phil Randal | Networks Engineer
NHS Herefordshire & Herefordshire Council  | Deputy Chief Executive's
Office | I.C.T. Services Division
Thorn Office Centre, Rotherwas, Hereford, HR2 6JT
Tel: 01432 260160
email: prandal at herefordshire.gov.uk

Any opinion expressed in this e-mail or any attached files are those of
the individual and not necessarily those of Herefordshire Council.

This e-mail and any attached files are confidential and intended solely
for the use of the addressee. This communication may contain material
protected by law from being passed on. If you are not the intended
recipient and have received this e-mail in error, you are advised that
any use, dissemination, forwarding, printing or copying of this e-mail
is strictly prohibited. If you have received this e-mail in error please
contact the sender immediately and destroy all copies of it.

-----Original Message-----
From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Michael
Miller
Sent: 09 April 2010 11:29
To: MailScanner discussion
Subject: Re: McAfee uvscan 6.0.0

Hi,

I have seen the slow startup time too but have you considered the use of
the "--decompress" option. As per McAfee articles:
https://kc.mcafee.com/corporate/index?page=content&id=KB68023
https://kc.mcafee.com/corporate/index?page=content&id=KB67513

My startup times (for --version, so no scanning) have improved as a
result:
uvscan 5.3: 3.9s
uvscan 6.0 (without prior --decompress): 14.4s uvscan 6.0 (with prior
--decompress): 3.89s

To me, uvscan 6.0 still seems like a viable scanner as it appears (with
using the --decompress after DAT updates) to be no worse than uvscan
5.3.

See below for detailed timings.

user at mailserver:~/uvscan600$ time uvscan --version Virus Scan for Linux
v5.30.0 Copyright (c) 1992-2008 McAfee, Inc. All rights reserved.
(408) 988-3832  LICENSED COPY - Jun 16 2008

Scan engine v5.3.00 for Linux.
Virus data file v5937 created Mar 31 2010 Scanning for 604710 viruses,
trojans and variants.

real    0m3.913s
user    0m3.100s
sys     0m0.820s
user at mailserver:~/uvscan600$ time ./uvscan --version McAfee VirusScan
Command Line for Linux32 Version: 6.0.0.309 Copyright (C) 2009 McAfee,
Inc.
(408) 988-3832 LICENSED COPY - April 08 2010

AV Engine version: 5400.1158 for Linux32.
Dat set version: 5944 created Apr 7 2010 Scanning for 611987 viruses,
trojans and variants.

real    0m14.420s
user    0m13.100s
sys     0m1.270s
user at mailserver:~/uvscan600$ time ./uvscan --decompress McAfee VirusScan
Command Line for Linux32 Version: 6.0.0.309 Copyright (C) 2009 McAfee,
Inc.
(408) 988-3832 LICENSED COPY - April 08 2010

AV Engine version: 5400.1158 for Linux32.
Dat set version: 5944 created Apr 7 2010 Scanning for 611987 viruses,
trojans and variants.

Time: 00:00.00

real    0m22.070s
user    0m18.240s
sys     0m2.240s
user at mailserver:~/uvscan600$ time ./uvscan --version McAfee VirusScan
Command Line for Linux32 Version: 6.0.0.309 Copyright (C) 2009 McAfee,
Inc.
(408) 988-3832 LICENSED COPY - April 08 2010

AV Engine version: 5400.1158 for Linux32.
Dat set version: 5944 created Apr 7 2010 Scanning for 611987 viruses,
trojans and variants.

real    0m3.891s
user    0m3.190s
sys     0m0.700s
user at mailserver:~/uvscan600$

Randal, Phil wrote:
> Mike,
>
> When I tested it, the Virusscan V6.0 commandline Linux scanner was so 
> slow at startup to make it unusable in a MailScanner environment,
IMHO.
>
> I believe others reported similar slowness.
>
> But good catch, users of older versions of uvscan are no longer 
> supported, and should uninstall (or disable the updater).
>
> Cheers,
>
> Phil
> --
> Phil Randal | Networks Engineer
> NHS Herefordshire & Herefordshire Council  | Deputy Chief Executive's 
> Office | I.C.T. Services Division Thorn Office Centre, Rotherwas, 
> Hereford, HR2 6JT
> Tel: 01432 260160
> email: prandal at herefordshire.gov.uk
>
> Any opinion expressed in this e-mail or any attached files are those 
> of the individual and not necessarily those of Herefordshire Council.
>
> This e-mail and any attached files are confidential and intended 
> solely for the use of the addressee. This communication may contain 
> material protected by law from being passed on. If you are not the 
> intended recipient and have received this e-mail in error, you are 
> advised that any use, dissemination, forwarding, printing or copying 
> of this e-mail is strictly prohibited. If you have received this 
> e-mail in error please contact the sender immediately and destroy all
copies of it.
>
> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info
> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of 
> Michael Miller
> Sent: 09 April 2010 10:09
> To: mailscanner at lists.mailscanner.info
> Subject: McAfee uvscan 6.0.0
>
> Hi
>
> I was wondering if there was a date when we can expect MailScanner to 
> natively support the updated McAfee uvscan anti virus scanner? uvscan
> v5.3 is now EoL as DATs are no longer being released.
>
> I see a few patches were posted a few months back but they don't 
> appear to have been merged into MailScanner itself. Does anyone have 
> any more recent patches for uvscan 6.0.0?
>
> If there is interest in this, I can set about testing the patches and 
> consolidating the parsing and the updating patches and reposting if 
> they will be useful.
>
> Regards,
> Mike
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website! 
> Any opinion expressed in this e-mail or any attached files are those
of the individual and not necessarily those of Herefordshire Council.
> You should be aware that Herefordshire Council monitors its email
service.
> This e-mail and any attached files are confidential and intended
solely for the use of the addressee. This communication may contain
material protected by law from being passed on. If you are not the
intended recipient and have received this e-mail in error, you are
advised that any use, dissemination, forwarding, printing or copying of
this e-mail is strictly prohibited. If you have received this e-mail in
error please contact the sender immediately and destroy all copies of
it.
>   
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 
Any opinion expressed in this e-mail or any attached files are those of the individual and not necessarily those of Herefordshire Council.
You should be aware that Herefordshire Council monitors its email service.
This e-mail and any attached files are confidential and intended solely for the use of the addressee. This communication may contain material protected by law from being passed on. If you are not the intended recipient and have received this e-mail in error, you are advised that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please contact the sender immediately and destroy all copies of it.