<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2719.2200" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV>
<DIV><FONT face=Courier size=2>I've tried the command you told me and it seems
to be working ok since I got a summary of files been scanned. I checked the
script and it seems to be right too. Some other clue?</FONT></DIV>
<DIV><FONT face=Courier size=2></FONT> </DIV>
<DIV><FONT face=Courier size=2></FONT> </DIV>
<DIV><FONT face=Courier size=2>Thanks</FONT></DIV></DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=mailscanner@ECS.SOTON.AC.UK
href="mailto:mailscanner@ECS.SOTON.AC.UK">Julian Field</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=MAILSCANNER@JISCMAIL.AC.UK
href="mailto:MAILSCANNER@JISCMAIL.AC.UK">MAILSCANNER@JISCMAIL.AC.UK</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Thursday, November 07, 2002 5:02
AM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Re: F-PROT problem?</DIV>
<DIV><BR></DIV>Something is going wrong in how MailScanner is calling your
copy of F-Prot.<BR>If you do these 2 commands, it should output some sort of
summary showing how many files it scanned, at the very
least.<BR><X-TAB> </X-TAB>cd
/tmp<BR><X-TAB> </X-TAB>/usr/lib/MailScaner/f-prot-wrapper
-old -archive -dumb .<BR>(don't forget the dot on the end)<BR><BR>If you get
some sort of "command not found" error, then you have installed your copy of
F-Prot somewhere different than the standard location, and you will need to
alter the f-prot-wrapper script so it calls it in the right place. That script
is very simple, you'll soon work out what you need to change in it.<BR><BR>Let
us know how you get on.<BR><BR>At 23:56 06/11/2002, you wrote:<BR>
<BLOCKQUOTE class=cite cite="" type="cite"><FONT face=courier size=2>I have
RedHat 7.1, Sendmail8.9.3, MailScanner 4.04-1 and f-prot
3.12b.</FONT><BR> <BR><FONT face=courier size=2>Everything its seems to
be working ok, but if I send a message from an external account (hotmail)
with a virus attached, I have no warning about an infected message. I tried
the EICAR_test file too, but nothing happened, I just get these lines in
maillog:</FONT><BR> <BR><FONT face=courier size=2>Nov 6 17:34:11
ns0 sendmail[5914]: RAA05914: from=<<A
href="mailto:user@hotmail.com">user@hotmail.com</A>>, size=96715,
class=0, pri=126715, nrcpts=1, msgid=<<A
href="mailto:OE17Bt3J3JCj2fBUA510000094e@hotmail.com">OE17Bt3J3JCj2fBUA510000094e@hotmail.com</A>>,
proto=ESMTP, relay=oe17.law7.hotmail.com [216.33.236.121]<BR>Nov 6
17:34:11 ns0 MailScanner[5190]: New Batch: Found 2 messages waiting
<BR>Nov 6 17:34:11 ns0 MailScanner[5190]: New Batch: Scanning 1
messages, 97125 bytes <BR>Nov 6 17:34:12 ns0 MailScanner[5190]: Virus
and Content Scanning: Starting <BR>Nov 6 17:34:12 ns0
MailScanner[5190]: Uninfected: Delivered 1 messages <BR>Nov 6 17:34:12
ns0 sendmail[5919]: RAA05914: to=<<A
href="mailto:mail_user@minar.com">mail_user@minar.com</A>>,
delay=00:00:09, xdelay=00:00:00, mailer=local, stat=Sent<BR>I tested f-prot
manually and it says the infection is there (EICAR_test and an infected file
(Magistr). I really apreciate your help to solve this
issue.<BR></FONT> <BR> <BR><FONT face=courier size=2>BTW, I got
warned about some infected messages, but they are the ones with IFrame tags
in it. </FONT><BR> <BR> <BR><FONT face=courier size=2>Thanks in
advance</FONT><BR> <BR> <BR><FONT face=courier size=2>(Sorry about
my poor English)</FONT><BR> <BR> <BR><FONT face=courier
size=2>vgm</FONT></BLOCKQUOTE><BR>
<DIV>--</DIV>
<DIV>Julian
Field
Teaching Systems Manager</DIV>
<DIV>jkf@ecs.soton.ac.uk Dept.
of Electronics & Computer Science</DIV>
<DIV>Tel. 023 8059 2817
University of
Southampton</DIV>
Southampton SO17 1BJ </BLOCKQUOTE></BODY></HTML>