McAfee uvscan 6.0.0

Fri Apr 9 12:02:33 IST 2010

Hi,

Well since there doesn't appear to be much "official" movement with this
I will take a stab at it over the weekend. If I get something useful I
will post back to the list.

The trouble with testing the update scripts is you only get a real test
once a day :)

Regards,
Mike

Randal, Phil wrote:
> Well spotted!
>
> No we need someone to figure out how to parse the output in MailScanner,
> and change the wrappers / whatever to make sure only V6 or later is
> used.
>
> Any offers, anyone? 
>
> I'm not a perl person, alas.
>
> Phil
> --
> Phil Randal | Networks Engineer
> NHS Herefordshire & Herefordshire Council  | Deputy Chief Executive's
> Office | I.C.T. Services Division
> Thorn Office Centre, Rotherwas, Hereford, HR2 6JT
> Tel: 01432 260160
> email: prandal at herefordshire.gov.uk
>
> Any opinion expressed in this e-mail or any attached files are those of
> the individual and not necessarily those of Herefordshire Council.
>
> This e-mail and any attached files are confidential and intended solely
> for the use of the addressee. This communication may contain material
> protected by law from being passed on. If you are not the intended
> recipient and have received this e-mail in error, you are advised that
> any use, dissemination, forwarding, printing or copying of this e-mail
> is strictly prohibited. If you have received this e-mail in error please
> contact the sender immediately and destroy all copies of it.
>
> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info
> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Michael
> Miller
> Sent: 09 April 2010 11:29
> To: MailScanner discussion
> Subject: Re: McAfee uvscan 6.0.0
>
> Hi,
>
> I have seen the slow startup time too but have you considered the use of
> the "--decompress" option. As per McAfee articles:
> https://kc.mcafee.com/corporate/index?page=content&id=KB68023
> https://kc.mcafee.com/corporate/index?page=content&id=KB67513
>
> My startup times (for --version, so no scanning) have improved as a
> result:
> uvscan 5.3: 3.9s
> uvscan 6.0 (without prior --decompress): 14.4s uvscan 6.0 (with prior
> --decompress): 3.89s
>
> To me, uvscan 6.0 still seems like a viable scanner as it appears (with
> using the --decompress after DAT updates) to be no worse than uvscan
> 5.3.
>
> See below for detailed timings.
>
> user at mailserver:~/uvscan600$ time uvscan --version Virus Scan for Linux
> v5.30.0 Copyright (c) 1992-2008 McAfee, Inc. All rights reserved.
> (408) 988-3832  LICENSED COPY - Jun 16 2008
>
> Scan engine v5.3.00 for Linux.
> Virus data file v5937 created Mar 31 2010 Scanning for 604710 viruses,
> trojans and variants.
>
>
> real    0m3.913s
> user    0m3.100s
> sys     0m0.820s
> user at mailserver:~/uvscan600$ time ./uvscan --version McAfee VirusScan
> Command Line for Linux32 Version: 6.0.0.309 Copyright (C) 2009 McAfee,
> Inc.
> (408) 988-3832 LICENSED COPY - April 08 2010
>
> AV Engine version: 5400.1158 for Linux32.
> Dat set version: 5944 created Apr 7 2010 Scanning for 611987 viruses,
> trojans and variants.
>
>
> real    0m14.420s
> user    0m13.100s
> sys     0m1.270s
> user at mailserver:~/uvscan600$ time ./uvscan --decompress McAfee VirusScan
> Command Line for Linux32 Version: 6.0.0.309 Copyright (C) 2009 McAfee,
> Inc.
> (408) 988-3832 LICENSED COPY - April 08 2010
>
> AV Engine version: 5400.1158 for Linux32.
> Dat set version: 5944 created Apr 7 2010 Scanning for 611987 viruses,
> trojans and variants.
>
>
> Time: 00:00.00
>
>
> real    0m22.070s
> user    0m18.240s
> sys     0m2.240s
> user at mailserver:~/uvscan600$ time ./uvscan --version McAfee VirusScan
> Command Line for Linux32 Version: 6.0.0.309 Copyright (C) 2009 McAfee,
> Inc.
> (408) 988-3832 LICENSED COPY - April 08 2010
>
> AV Engine version: 5400.1158 for Linux32.
> Dat set version: 5944 created Apr 7 2010 Scanning for 611987 viruses,
> trojans and variants.
>
>
> real    0m3.891s
> user    0m3.190s
> sys     0m0.700s
> user at mailserver:~/uvscan600$
>
>
>
> Randal, Phil wrote:
>   
>> Mike,
>>
>> When I tested it, the Virusscan V6.0 commandline Linux scanner was so 
>> slow at startup to make it unusable in a MailScanner environment,
>>     
> IMHO.
>   
>> I believe others reported similar slowness.
>>
>> But good catch, users of older versions of uvscan are no longer 
>> supported, and should uninstall (or disable the updater).
>>
>> Cheers,
>>
>> Phil
>> --
>> Phil Randal | Networks Engineer
>> NHS Herefordshire & Herefordshire Council  | Deputy Chief Executive's 
>> Office | I.C.T. Services Division Thorn Office Centre, Rotherwas, 
>> Hereford, HR2 6JT
>> Tel: 01432 260160
>> email: prandal at herefordshire.gov.uk
>>
>> Any opinion expressed in this e-mail or any attached files are those 
>> of the individual and not necessarily those of Herefordshire Council.
>>
>> This e-mail and any attached files are confidential and intended 
>> solely for the use of the addressee. This communication may contain 
>> material protected by law from being passed on. If you are not the 
>> intended recipient and have received this e-mail in error, you are 
>> advised that any use, dissemination, forwarding, printing or copying 
>> of this e-mail is strictly prohibited. If you have received this 
>> e-mail in error please contact the sender immediately and destroy all
>>     
> copies of it.
>   
>> -----Original Message-----
>> From: mailscanner-bounces at lists.mailscanner.info
>> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of 
>> Michael Miller
>> Sent: 09 April 2010 10:09
>> To: mailscanner at lists.mailscanner.info
>> Subject: McAfee uvscan 6.0.0
>>
>> Hi
>>
>> I was wondering if there was a date when we can expect MailScanner to 
>> natively support the updated McAfee uvscan anti virus scanner? uvscan
>> v5.3 is now EoL as DATs are no longer being released.
>>
>> I see a few patches were posted a few months back but they don't 
>> appear to have been merged into MailScanner itself. Does anyone have 
>> any more recent patches for uvscan 6.0.0?
>>
>> If there is interest in this, I can set about testing the patches and 
>> consolidating the parsing and the updating patches and reposting if 
>> they will be useful.
>>
>> Regards,
>> Mike
>> --
>> MailScanner mailing list
>> mailscanner at lists.mailscanner.info
>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>
>> Before posting, read http://wiki.mailscanner.info/posting
>>
>> Support MailScanner development - buy the book off the website! 
>> Any opinion expressed in this e-mail or any attached files are those
>>     
> of the individual and not necessarily those of Herefordshire Council.
>   
>> You should be aware that Herefordshire Council monitors its email
>>     
> service.
>   
>> This e-mail and any attached files are confidential and intended
>>     
> solely for the use of the addressee. This communication may contain
> material protected by law from being passed on. If you are not the
> intended recipient and have received this e-mail in error, you are
> advised that any use, dissemination, forwarding, printing or copying of
> this e-mail is strictly prohibited. If you have received this e-mail in
> error please contact the sender immediately and destroy all copies of
> it.
>   
>>   
>>     
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website! 
> Any opinion expressed in this e-mail or any attached files are those of the individual and not necessarily those of Herefordshire Council.
> You should be aware that Herefordshire Council monitors its email service.
> This e-mail and any attached files are confidential and intended solely for the use of the addressee. This communication may contain material protected by law from being passed on. If you are not the intended recipient and have received this e-mail in error, you are advised that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please contact the sender immediately and destroy all copies of it.
>   