McAfee uvscan 6.0.0

Fri Apr 9 12:18:59 IST 2010

The amended update script which was posted here worked fine, it's more
the MailScanner parsing of the output from uvscan and wrapper scripts
which need tweaking.

And a sane way of obsoleting older uvscan versions.

Maybe a mcafeev6 line in virus.scanners.conf and a way to autodetect
which version and do the right thing?

Phil

--
Phil Randal | Networks Engineer
NHS Herefordshire & Herefordshire Council  | Deputy Chief Executive's
Office | I.C.T. Services Division
Thorn Office Centre, Rotherwas, Hereford, HR2 6JT
Tel: 01432 260160
email: prandal at herefordshire.gov.uk

Any opinion expressed in this e-mail or any attached files are those of
the individual and not necessarily those of Herefordshire Council.

This e-mail and any attached files are confidential and intended solely
for the use of the addressee. This communication may contain material
protected by law from being passed on. If you are not the intended
recipient and have received this e-mail in error, you are advised that
any use, dissemination, forwarding, printing or copying of this e-mail
is strictly prohibited. If you have received this e-mail in error please
contact the sender immediately and destroy all copies of it.

-----Original Message-----
From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Michael
Miller
Sent: 09 April 2010 12:03
To: MailScanner discussion
Subject: Re: McAfee uvscan 6.0.0

Hi,

Well since there doesn't appear to be much "official" movement with this
I will take a stab at it over the weekend. If I get something useful I
will post back to the list.

The trouble with testing the update scripts is you only get a real test
once a day :)

Regards,
Mike

Randal, Phil wrote:
> Well spotted!
>
> No we need someone to figure out how to parse the output in 
> MailScanner, and change the wrappers / whatever to make sure only V6 
> or later is used.
>
> Any offers, anyone? 
>
> I'm not a perl person, alas.
>
> Phil
> --
> Phil Randal | Networks Engineer
> NHS Herefordshire & Herefordshire Council  | Deputy Chief Executive's 
> Office | I.C.T. Services Division Thorn Office Centre, Rotherwas, 
> Hereford, HR2 6JT
> Tel: 01432 260160
> email: prandal at herefordshire.gov.uk
>
> Any opinion expressed in this e-mail or any attached files are those 
> of the individual and not necessarily those of Herefordshire Council.
>
> This e-mail and any attached files are confidential and intended 
> solely for the use of the addressee. This communication may contain 
> material protected by law from being passed on. If you are not the 
> intended recipient and have received this e-mail in error, you are 
> advised that any use, dissemination, forwarding, printing or copying 
> of this e-mail is strictly prohibited. If you have received this 
> e-mail in error please contact the sender immediately and destroy all
copies of it.
>
> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info
> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of 
> Michael Miller
> Sent: 09 April 2010 11:29
> To: MailScanner discussion
> Subject: Re: McAfee uvscan 6.0.0
>
> Hi,
>
> I have seen the slow startup time too but have you considered the use 
> of the "--decompress" option. As per McAfee articles:
> https://kc.mcafee.com/corporate/index?page=content&id=KB68023
> https://kc.mcafee.com/corporate/index?page=content&id=KB67513
>
> My startup times (for --version, so no scanning) have improved as a
> result:
> uvscan 5.3: 3.9s
> uvscan 6.0 (without prior --decompress): 14.4s uvscan 6.0 (with prior
> --decompress): 3.89s
>
> To me, uvscan 6.0 still seems like a viable scanner as it appears 
> (with using the --decompress after DAT updates) to be no worse than 
> uvscan 5.3.
>
> See below for detailed timings.
>
> user at mailserver:~/uvscan600$ time uvscan --version Virus Scan for 
> Linux v5.30.0 Copyright (c) 1992-2008 McAfee, Inc. All rights
reserved.
> (408) 988-3832  LICENSED COPY - Jun 16 2008
>
> Scan engine v5.3.00 for Linux.
> Virus data file v5937 created Mar 31 2010 Scanning for 604710 viruses,

> trojans and variants.
>
>
> real    0m3.913s
> user    0m3.100s
> sys     0m0.820s
> user at mailserver:~/uvscan600$ time ./uvscan --version McAfee VirusScan 
> Command Line for Linux32 Version: 6.0.0.309 Copyright (C) 2009 McAfee,

> Inc.
> (408) 988-3832 LICENSED COPY - April 08 2010
>
> AV Engine version: 5400.1158 for Linux32.
> Dat set version: 5944 created Apr 7 2010 Scanning for 611987 viruses, 
> trojans and variants.
>
>
> real    0m14.420s
> user    0m13.100s
> sys     0m1.270s
> user at mailserver:~/uvscan600$ time ./uvscan --decompress McAfee 
> VirusScan Command Line for Linux32 Version: 6.0.0.309 Copyright (C) 
> 2009 McAfee, Inc.
> (408) 988-3832 LICENSED COPY - April 08 2010
>
> AV Engine version: 5400.1158 for Linux32.
> Dat set version: 5944 created Apr 7 2010 Scanning for 611987 viruses, 
> trojans and variants.
>
>
> Time: 00:00.00
>
>
> real    0m22.070s
> user    0m18.240s
> sys     0m2.240s
> user at mailserver:~/uvscan600$ time ./uvscan --version McAfee VirusScan 
> Command Line for Linux32 Version: 6.0.0.309 Copyright (C) 2009 McAfee,

> Inc.
> (408) 988-3832 LICENSED COPY - April 08 2010
>
> AV Engine version: 5400.1158 for Linux32.
> Dat set version: 5944 created Apr 7 2010 Scanning for 611987 viruses, 
> trojans and variants.
>
>
> real    0m3.891s
> user    0m3.190s
> sys     0m0.700s
> user at mailserver:~/uvscan600$
>
>
>
> Randal, Phil wrote:
>   
>> Mike,
>>
>> When I tested it, the Virusscan V6.0 commandline Linux scanner was so

>> slow at startup to make it unusable in a MailScanner environment,
>>     
> IMHO.
>   
>> I believe others reported similar slowness.
>>
>> But good catch, users of older versions of uvscan are no longer 
>> supported, and should uninstall (or disable the updater).
>>
>> Cheers,
>>
>> Phil
>> --
>> Phil Randal | Networks Engineer
>> NHS Herefordshire & Herefordshire Council  | Deputy Chief Executive's

>> Office | I.C.T. Services Division Thorn Office Centre, Rotherwas, 
>> Hereford, HR2 6JT
>> Tel: 01432 260160
>> email: prandal at herefordshire.gov.uk
>>
>> Any opinion expressed in this e-mail or any attached files are those 
>> of the individual and not necessarily those of Herefordshire Council.
>>
>> This e-mail and any attached files are confidential and intended 
>> solely for the use of the addressee. This communication may contain 
>> material protected by law from being passed on. If you are not the 
>> intended recipient and have received this e-mail in error, you are 
>> advised that any use, dissemination, forwarding, printing or copying 
>> of this e-mail is strictly prohibited. If you have received this 
>> e-mail in error please contact the sender immediately and destroy all
>>     
> copies of it.
>   
>> -----Original Message-----
>> From: mailscanner-bounces at lists.mailscanner.info
>> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of 
>> Michael Miller
>> Sent: 09 April 2010 10:09
>> To: mailscanner at lists.mailscanner.info
>> Subject: McAfee uvscan 6.0.0
>>
>> Hi
>>
>> I was wondering if there was a date when we can expect MailScanner to

>> natively support the updated McAfee uvscan anti virus scanner? uvscan
>> v5.3 is now EoL as DATs are no longer being released.
>>
>> I see a few patches were posted a few months back but they don't 
>> appear to have been merged into MailScanner itself. Does anyone have 
>> any more recent patches for uvscan 6.0.0?
>>
>> If there is interest in this, I can set about testing the patches and

>> consolidating the parsing and the updating patches and reposting if 
>> they will be useful.
>>
>> Regards,
>> Mike
>> --
>> MailScanner mailing list
>> mailscanner at lists.mailscanner.info
>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>
>> Before posting, read http://wiki.mailscanner.info/posting
>>
>> Support MailScanner development - buy the book off the website! 
>> Any opinion expressed in this e-mail or any attached files are those
>>     
> of the individual and not necessarily those of Herefordshire Council.
>   
>> You should be aware that Herefordshire Council monitors its email
>>     
> service.
>   
>> This e-mail and any attached files are confidential and intended
>>     
> solely for the use of the addressee. This communication may contain 
> material protected by law from being passed on. If you are not the 
> intended recipient and have received this e-mail in error, you are 
> advised that any use, dissemination, forwarding, printing or copying 
> of this e-mail is strictly prohibited. If you have received this 
> e-mail in error please contact the sender immediately and destroy all 
> copies of it.
>   
>>   
>>     
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website! 
> Any opinion expressed in this e-mail or any attached files are those
of the individual and not necessarily those of Herefordshire Council.
> You should be aware that Herefordshire Council monitors its email
service.
> This e-mail and any attached files are confidential and intended
solely for the use of the addressee. This communication may contain
material protected by law from being passed on. If you are not the
intended recipient and have received this e-mail in error, you are
advised that any use, dissemination, forwarding, printing or copying of
this e-mail is strictly prohibited. If you have received this e-mail in
error please contact the sender immediately and destroy all copies of
it.
>   
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 
Any opinion expressed in this e-mail or any attached files are those of the individual and not necessarily those of Herefordshire Council.
You should be aware that Herefordshire Council monitors its email service.
This e-mail and any attached files are confidential and intended solely for the use of the addressee. This communication may contain material protected by law from being passed on. If you are not the intended recipient and have received this e-mail in error, you are advised that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please contact the sender immediately and destroy all copies of it.