<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7651.59">
<TITLE>F-prot issues</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><FONT SIZE=2 FACE="Arial">Hello,</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Hoping someone can point me in the right direction here.</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">We use MailScanner (and Mailwatch) with f-prot to scan for virus/malware at our mail gateway. The rash of E-ticket and Bill_Tax attachments has been causing us some grief. </FONT></P>
<P><FONT SIZE=2 FACE="Arial">In MailScanner.conf, I have f-prot defined as our only scanner.</FONT>
<BR> <FONT SIZE=2 FACE="Arial">Virus Scanners = f-prot</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">In virus.scanners.conf f-prot points to the correct directories</FONT>
<BR> <FONT SIZE=2 FACE="Arial">f-prot /usr/lib/MailScanner/f-prot-wrapper /usr/local/f-prot</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">f-prot is up to date (f-prot -verno )</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">F-PROT ANTIVIRUS</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Program version: 4.6.8</FONT>
<BR><FONT SIZE=2 FACE="Arial">Engine version: 3.16.16</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">VIRUS SIGNATURE FILES</FONT>
<BR><FONT SIZE=2 FACE="Arial">SIGN.DEF created 27 July 2008</FONT>
<BR><FONT SIZE=2 FACE="Arial">SIGN2.DEF created 27 July 2008</FONT>
<BR><FONT SIZE=2 FACE="Arial">MACRO.DEF created 27 July 2008</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">And a test of the wrapper returns results, which I assume mean it is working</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">/usr/lib/MailScanner/f-prot-wrapper /usr/local/f-prot/ /var/spool/MailScanner/quarantine/20080725</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial"><snip></FONT>
<BR><FONT SIZE=2 FACE="Arial">/var/spool/MailScanner/quarantine/20080725/m6P9eb7N020874/Bill_Tax______.exe is a security risk named W32/Downldr2.DBPY</FONT></P>
<P><FONT SIZE=2 FACE="Arial">/var/spool/MailScanner/quarantine/20080725/m6P9eb7N020874/message->Bill_Tax.zip->Bill_Tax___________________________N89798742344.exe is a security risk named W32/Downldr2.DBPY</FONT></P>
<P><FONT SIZE=2 FACE="Arial">/var/spool/MailScanner/quarantine/20080725/m6PIJVA4014593/E-ticket_N7399294.zip->E-ticket_N7399294_and_Invoice_for_N73992943442.exe is a destructive program named W32/Trojan2.AUFO</FONT></P>
<P><FONT SIZE=2 FACE="Arial">/var/spool/MailScanner/quarantine/20080725/m6PIJVA4014593/E-ticket_N7399294_and_Invoice_for_N73992943442.exe is a destructive program named W32/Trojan2.AUFO</FONT></P>
<P><FONT SIZE=2 FACE="Arial">/var/spool/MailScanner/quarantine/20080725/m6PIJVA4014593/message->E-ticket_N7399294.zip->E-ticket_N7399294_and_Invoice_for_N73992943442.exe is a destructive program named W32/Trojan2.AUFO</FONT></P>
<P><FONT SIZE=2 FACE="Arial">/var/spool/MailScanner/quarantine/20080725/m6PMxL55025452/E-ticket_N7399294.zip->E-ticket_N7399294_and_Invoice_for_N73992943442.exe is a destructive program named W32/Trojan2.AUFO</FONT></P>
<P><FONT SIZE=2 FACE="Arial">/var/spool/MailScanner/quarantine/20080725/m6PMxL55025452/E-ticket_N7399294_and_Invoice_for_N73992943442.exe is a destructive program named W32/Trojan2.AUFO</FONT></P>
<P><FONT SIZE=2 FACE="Arial">/var/spool/MailScanner/quarantine/20080725/m6PMxL55025452/message->E-ticket_N7399294.zip->E-ticket_N7399294_and_Invoice_for_N73992943442.exe is a destructive program named W32/Trojan2.AUFO</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Results of virus scanning:</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Files: 728</FONT>
<BR><FONT SIZE=2 FACE="Arial">MBRs: 0</FONT>
<BR><FONT SIZE=2 FACE="Arial">Boot sectors: 0</FONT>
<BR><FONT SIZE=2 FACE="Arial">Objects scanned: 870</FONT>
<BR><FONT SIZE=2 FACE="Arial">Infected: 0</FONT>
<BR><FONT SIZE=2 FACE="Arial">Suspicious: 138</FONT>
<BR><FONT SIZE=2 FACE="Arial">Disinfected: 0</FONT>
<BR><FONT SIZE=2 FACE="Arial">Deleted: 0</FONT>
<BR><FONT SIZE=2 FACE="Arial">Renamed: 0</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Time: 0:01</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">A tail /var/log/maillog -n 1000 | grep -i virus shows that MailScanner is invoking something to deal with virus scanning :</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Jul 28 11:35:34 mgw MailScanner[30149]: Virus and Content Scanning: Starting</FONT>
<BR><FONT SIZE=2 FACE="Arial">Jul 28 11:35:35 mgw MailScanner[30149]: New Batch: Scanning 1 messages, 1687 bytes</FONT>
<BR><FONT SIZE=2 FACE="Arial">Jul 28 11:35:37 mgw MailScanner[30149]: Virus and Content Scanning: Starting</FONT>
<BR><FONT SIZE=2 FACE="Arial">Jul 28 11:35:37 mgw MailScanner[30149]: New Batch: Scanning 2 messages, 2363 bytes</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">However, it does not seem to be reporting the suspicious activity, and I don't see a section in MailScanner.conf which allows me to specify what results as an "infection". </FONT></P>
<P><FONT SIZE=2 FACE="Arial">I was hoping there is a way to include ALL suspicious files as well, either through identifying the results of the scan such as "is a destructive program named", "is a security risk named", or by examining the f-prot program exit codes.</FONT></P>
<P><FONT SIZE=2 FACE="Arial">PROGRAM EXIT CODES</FONT>
<BR><FONT SIZE=2 FACE="Arial"> 0 Normal exit. Nothing found, nothing done.</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial"> 1 Unrecoverable error (e.g., missing virus signature files).</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial"> 2 Selftest failed (program has been modified).</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial"> 3 At least one virus-infected object was found.</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial"> 4 Reserved, not currently in use.</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial"> 5 Abnormal termination (scanning did not finish).</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial"> 6 At least one virus was removed.</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial"> 7 Error, out of memory.</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial"> 8 At least one suspicious object was found.</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial"> 9 At least one object was not scanned (encrypted file, unsupported/unknown compression method, unsupported/unknown file</FONT></P>
<P><FONT SIZE=2 FACE="Arial"> format, corrupted or invalid file).</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial"> 10 At lest one archive object was not scanned (contains more then N levels of nested archives, as specified with -archive</FONT></P>
<P><FONT SIZE=2 FACE="Arial"> switch).</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Any help or direction would be appreciated. </FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Regards,</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Shaun.</FONT>
</P>
</BODY>
</HTML>