Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - SpamFilter + antivirus plugin beta avail.
  FAQ FAQ  Forum Search   Register Register  Login Login

SpamFilter + antivirus plugin beta avail.

 Post Reply Post Reply Page  12>
Author
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Topic: SpamFilter + antivirus plugin beta avail.
    Posted: 03 March 2005 at 10:59pm
We have released the public beta for the new version of SpamFilter ISP v2.5. The following information, along with the download links, is also available on the beta page at www.logsat.com/sfi-beta.asp.

Major Changes introduced in SpamFilter ISP v2.5 - The new SpamFilter ISP v2.5 includes support for an anti-virus plug-in. LogSat Software has partnered with Norman to provide optional antivirus protection for email traffic.

The antivirus plug-in will be available for purchase separately from SpamFilter ISP and will be an optional component. Unlike SpamFilter ISP's licenses, the antivirus plug-in will be offered as a subscription service with a yearly subscription fee. The amount of the fee has not been finalized yet, but it will not exceed the price of a SpamFilter's license. The availability of the antivirus plug-in for the free version of SpamFilter ISP has not been determined yet.

Technical notes - SpamFilter can run with or without the antivirus plug-in. When SpamFilter starts, it will check for the plug-in files. If they are found, antivirus support will automatically be enabled. We recommend installing the antivirus plug-in after installing SpamFilter. Restart SpamFilter after installing the plug-in to activate it.

Known Issues - In this beta version, virus definition files will not be automatically updated. We may make updates available form our website in the near future. There are cases when the antivirus plug-in installation program does not update the Registry correctly. If the key HKEY_LOCAL_MACHINE\SOFTWARE\Norman Data Defense Systems is not created, please issue the following DOS command from the \SpamFilter\Norman\Nvc\Nse directory:

NSE /INSTALL

This will add the correct registry entries.

Disclaimer - This version is a pre-release beta. As such, problems are expected. 

This beta will expire on March 31, 2005.


Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
mikek View Drop Down
Senior Member
Senior Member
Avatar

Joined: 22 February 2005
Location: Switzerland
Status: Offline
Points: 133
Post Options Post Options   Thanks (0) Thanks(0)   Quote mikek Quote  Post ReplyReply Direct Link To This Post Posted: 04 March 2005 at 8:27am
I already have a Norman NVC Server Version running on the machine that SpamFilter is running on. Is it possible (or planned) to be able to configure the plug-in to use that version?
Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 04 March 2005 at 12:25pm

Mikek,

The Beta version will discover the existance of Norman and use the engine.  However, you will need to make sure that you "Exclude" the SpamFilter install folder from any real-time scanning.

Dan S.

 

The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 04 March 2005 at 2:19pm
Mikek,

Let me add on to what Dan mentioned. SpamFilter does use the existing Norman engine (provided it's engine v12 or higher). There's a few caveats in this beta build however:

The antivirus plugin consists of 3 DLLs used by SpamFilter: dwnse.dll, ncl.dll and nselapi.dll. These files are currently being installed by the antivirus plugin installation program. However the install program is currently not smart enough to see the existing Norman install, and will add another instance of the engine files in the SpamFilter\nvc\nse directory, and registry entries (the key mentioned inthe beta page). This will be fixed shortly.

If SpamFilter sees an existing install of Norman, it will use that engine, provided the 3 plugin DLLs are present in the SpamFilter directory.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
JimMeredith View Drop Down
Newbie
Newbie


Joined: 27 January 2005
Location: United States
Status: Offline
Points: 28
Post Options Post Options   Thanks (0) Thanks(0)   Quote JimMeredith Quote  Post ReplyReply Direct Link To This Post Posted: 05 March 2005 at 6:12pm

Hi Roberto,

Does the virus scan take precedence over all other checks that SpamFilter performs, including the whitelists?  If not, where does the virus scan fit in the order of blacklist/whitelist checks?  (I've quoted one of your "order of precedence" messages below for convenience.)

Originally posted by LogSat LogSat wrote:

All the white lists are checked first. If a match is found, the blacklists are skipped, the email recipients are accepted, and SpamFilter is ready to accept the data command. If none of the whitelists are matched, then the blacklists are currently searched in order below. This order is not user-definable, at least not right now.

  1. Allowed Domains
  2. Local Domain BlackList
  3. Local Emails Blacklist
  4. Local Emails TO Blacklist
  5. Not in Authorized TO Emails
  6. Country Blacklist
  7. Reject No Reverse DNS
  8. Reject Empty Mail From
  9. Reject Same To From Email address
  10. Reject Same To From Domain
  11. Recipient Count > Max RCPTTO
  12. MAPS check
  13. Keywords
  14. Bayesian Filtering

The only exception to the whitelist is the "whitelist keyword check". In order for that to work, the message has to be received first, and for this reason even if the senders is blacklisted by other filters, the email will still be received so that it can be checked against the keyword whitelist.

Once a blacklist "hits", all further blacklist checks are skipped.

Thanks,

Jim

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 06 March 2005 at 12:35am
Jim,

For now in this first beta, the antivirus filter is the last on the list. However within the next builds we'll be changing that and moving it before the keywords filter. It cannot be moved even sooner order-wise, as the email content has not been received yet when the other filters are processing the email.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
gsforsyth View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote gsforsyth Quote  Post ReplyReply Direct Link To This Post Posted: 06 March 2005 at 11:54am
Hi, After installing the new beta I am getting this error.

Could not initialize Norman A/V engine - error $00010000

During install of the Beta I get a 16bit application error from the application and the av install is missing some install required file.


Is there any instructions on how to use or what to expect?

g
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 06 March 2005 at 12:55pm
SpamFilter's error is probably caused by the incomplete av install. You can try to install the av on a different computer, and then copy the directory tree /SpamFilter/nvc/nse from the alternate computer to the one where the install fails. After the copy, from the SpamFilter/nvc/nse directory on the SpamFilter server try issuing the following command at a DOS prompt:

NSE /INSTALL

That should inistialize the av engine, and then restart SpamFilter.

Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
kspare View Drop Down
Senior Member
Senior Member


Joined: 26 January 2005
Location: Canada
Status: Offline
Points: 334
Post Options Post Options   Thanks (0) Thanks(0)   Quote kspare Quote  Post ReplyReply Direct Link To This Post Posted: 06 March 2005 at 1:40pm
So how do you know if it is working ok or not?
Back to Top
JimMeredith View Drop Down
Newbie
Newbie


Joined: 27 January 2005
Location: United States
Status: Offline
Points: 28
Post Options Post Options   Thanks (0) Thanks(0)   Quote JimMeredith Quote  Post ReplyReply Direct Link To This Post Posted: 06 March 2005 at 7:36pm

Kevin,

The first thing I did was send a message from an outside mail account with the EICAR test file attached.  The EICAR file is not a real virus, but every antivirus program is programmed to treat it as a virus for testing purposes. You can download the EICAR file from Norman's web site.

Another way is to look at your logs to see if you have had any traps.  Here is a log entry with a virus trap.

03/05/05 05:30:41:070 -- (191) Connection from: 213.171.61.35  -  Originating country : Russian Federation
03/05/05 05:30:51:845 -- (191) Resolving 213.171.61.35 - Error resolving IP address (TimedOut)
03/05/05 05:30:52:126 -- (191) Mail from:
MAILER-DAEMON@domain.com
03/05/05 05:30:52:236 -- (191) - MAPS search done... 521 Your message has been rejected by the anti-spam filter. Blacklisted by sbl-xbl.spamhaus.org. http://www.spamhaus.org/query/bl?ip=213.171.61.35
03/05/05 05:30:52:236 -- (191) 213.171.61.35 - Mail from:
MAILER-DAEMON@domain.com To: any@domain.com will be rejected
03/05/05 05:30:55:150 -- (191) EMail from
MAILER-DAEMON@domain.com to any@domain.com infected with the virus MyDoom.L@mm
03/05/05 05:30:55:300 -- (191) EMail from MAILER-DAEMON@domain.com to any@domain.com was received and quarantined. Size: 39 KB, 39936 bytes
03/05/05 05:30:55:310 -- (191) Disconnect

A SQL query should also reveal antivirus activity.

SELECT COUNT(*) 'Virus_Messages', RejectDetails FROM tblquarantine WHERE RejectID=17 GROUP BY RejectDetails ORDER BY COUNT(*) DESC

I just ran this query on my SpamFilter test server (handling traffic for one low-volume domain only) and it returned the following resultset.

Virus_Messages RejectDetails
-------------- -----------------------------------------------------
246         &nb sp;   infected with the virus
Bagle.N@mm
9           ;     infected with the virus Netsky.P@mm
6           ;     infected with the virus Sober.K@mm
5           ;     infected with the virus EICAR_Test_file_not_a_virus!
3           ;     infected with the virus
MyDoom.L@mm
1           ;     infected with the virus Netsky.C@mm

Jim

 

Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 06 March 2005 at 9:18pm

Jim,

33917  infected with the virus Sober.K@mm
25880 infected with the virus Sober.K@mm
1354 infected with the virus Netsky.P@mm
369  infected with the virus Netsky.P@mm
69 infected with the virus Netsky.D@mm
66 infected with the virus Netsky.B@mm
65 infected with the virus Netsky.C@mm
57  infected with the virus Bagle.AH@mm
55 infected with the virus Netsky.Q@mm
48 infected with the virus Lovgate.AB@mm
46 infected with the virus Lovgate.AG@mm
41 infected with the virus MyDoom.I@mm
38 infected with the virus Netsky.Z@mm
37 infected with the virus W32/Downloader
36 infected with the virus Bagle.J@mm
31 infected with the virus MyDoom.J@mm
31 infected with the virus Bifrose.D
31  infected with the virus Netsky.Q@mm
30  infected with the virus Netsky.B@mm
30 infected with the virus W32/FunLove.4099
30  infected with the virus Bagle.N@mm
30  infected with the virus Netsky.K@mm
28 infected with the virus Bagle.AH@mm
25  infected with the virus Netsky.D@mm
24 infected with the virus Netsky.K@mm
24 infected with the virus Bagle.N@mm
24 infected with the virus Bagle.BB@mm
22 infected with the virus Mytob.A
21 infected with the virus MyDoom.L@mm
21  infected with the virus Mabutu.A@mm
20 infected with the virus Bagle.AF@mm
19  infected with the virus Bagle.AR@mm
19 infected with the virus Bagle.BC@mm
19  infected with the virus Bagle.BC@mm
15 infected with the virus Mabutu.A@mm
14  infected with the virus Netsky.Z@mm
13  infected with the virus Netsky.C@mm
12  infected with the virus MyDoom.I@mm
12  infected with the virus Bagle.J@mm
12 infected with the virus Netsky.AB@mm
12 infected with the virus W32/Bagle.Gen!Zip
12 infected with the virus Bagle.AR@mm
10 infected with the virus Netsky.AD@mm
10  infected with the virus W32/Bagle.Gen!Zip
9 infected with the virus Netsky.X@mm
9  infected with the virus MyDoom.L@mm
8  infected with the virus Bagle.BB@mm
6  infected with the virus W32/FunLove.4099
6 infected with the virus Bagle.K@mm
6  infected with the virus Mytob.A
4 infected with the virus W32/MEWpacked.gen
4  infected with the virus Netsky.W@mm
4 infected with the virus W32/Valla.2048
4 infected with the virus Netsky.T@mm
4 infected with the virus Bagle.AV@mm
4  infected with the virus Bagle.AF@mm
3 infected with the virus Zafi.D@mm
3 infected with the virus Netsky.W@mm
3  infected with the virus W32/Bagle.Gen!Rar
2 infected with the virus HTML/Bagle
2 infected with the virus Netsky.N@mm
2  infected with the virus Netsky.AD@mm
2  infected with the virus Netsky.AB@mm
2  infected with the virus Zafi.D@mm
2  infected with the virus Netsky.T@mm
2  infected with the virus W95/Pinfi.A
1  infected with the virus HTML/MIME_Exploit
1 infected with the virus Bagle.AE@mm
1  infected with the virus Netsky.X@mm
1  infected with the virus MyDoom.F@mm
1 infected with the virus W32/Malware
1 infected with the virus W32/Klez.H@mm
1 infected with the virus HTML/MIME_Exploit
1 infected with the virus W32/Backdoor
1 infected with the virus W95/Maslan.C
1 infected with the virus Zafi.B@mm
1 infected with the virus MyDoom.AR@mm
1  infected with the virus W32/Magistr.A@mm
1 infected with the virus BugBear.B@mm

I think it is working.

Dan

The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Back to Top
gsforsyth View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote gsforsyth Quote  Post ReplyReply Direct Link To This Post Posted: 06 March 2005 at 9:29pm
The install on differant system worked.

Thx
Back to Top
kspare View Drop Down
Senior Member
Senior Member


Joined: 26 January 2005
Location: Canada
Status: Offline
Points: 334
Post Options Post Options   Thanks (0) Thanks(0)   Quote kspare Quote  Post ReplyReply Direct Link To This Post Posted: 06 March 2005 at 9:56pm
Antivirus is not working on my system. I did the install as suggested and just sent through the eicar test file, and it went right through. Wouldn't it make sense to have something similar to the database to show the antivirus is active? perhaps later to show the datfile version?
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 06 March 2005 at 10:32pm
This is an early beta, so things will not be perfect, but... if you check under the Settings - Anti Virus tab, you'll see, although incomplete, a few lines in a status box describing the status of the antivirus engine.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
kspare View Drop Down
Senior Member
Senior Member


Joined: 26 January 2005
Location: Canada
Status: Offline
Points: 334
Post Options Post Options   Thanks (0) Thanks(0)   Quote kspare Quote  Post ReplyReply Direct Link To This Post Posted: 06 March 2005 at 10:36pm

I checked that and its blank.

Any suggestions?

 

I installed it to c:\program files\spamfilterav if that helps at all?

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 06 March 2005 at 10:54pm
The av plugin must be installed in the same directory where SpamFilter is installed, from the path you posted it would not seem that is the case. If the directory is not the same, that would definetly not work correctly.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
kspare View Drop Down
Senior Member
Senior Member


Joined: 26 January 2005
Location: Canada
Status: Offline
Points: 334
Post Options Post Options   Thanks (0) Thanks(0)   Quote kspare Quote  Post ReplyReply Direct Link To This Post Posted: 06 March 2005 at 10:59pm
Roberto, can you please email me...
Back to Top
JimMeredith View Drop Down
Newbie
Newbie


Joined: 27 January 2005
Location: United States
Status: Offline
Points: 28
Post Options Post Options   Thanks (0) Thanks(0)   Quote JimMeredith Quote  Post ReplyReply Direct Link To This Post Posted: 06 March 2005 at 11:10pm
Originally posted by Desperado Desperado wrote:

Jim,

33917  infected with the virus Sober.K@mm
25880 infected with the virus Sober.K@mm
1354 infected with the virus Netsky.P@mm
369  infected with the virus Netsky.P@mm
... 

I think it is working.

Dan

Dan, you show-off!  Actually, I'm glad you posted your results... good to see performance under load.

But based on the resultset you posted, the query I posted earlier needs to be modified to give accurate totals by virus type.  Looks like the RejectDetails field sometimes includes a leading space, sometimes it does not... no biggie, it's easy to just trim it.

SELECT COUNT(*) 'Virus_Messages', LTRIM(RejectDetails) 'Details' FROM tblquarantine WHERE RejectID=17 GROUP BY LTRIM(RejectDetails) ORDER BY COUNT(*) DESC

Jim

Back to Top
mikek View Drop Down
Senior Member
Senior Member
Avatar

Joined: 22 February 2005
Location: Switzerland
Status: Offline
Points: 133
Post Options Post Options   Thanks (0) Thanks(0)   Quote mikek Quote  Post ReplyReply Direct Link To This Post Posted: 07 March 2005 at 3:46am

Originally posted by LogSat LogSat wrote:

Mikek,

Let me add on to what Dan mentioned. SpamFilter does use the existing Norman engine (provided it's engine v12 or higher). There's a few caveats in this beta build however:

The antivirus plugin consists of 3 DLLs used by SpamFilter: dwnse.dll, ncl.dll and nselapi.dll. These files are currently being installed by the antivirus plugin installation program. However the install program is currently not smart enough to see the existing Norman install, and will add another instance of the engine files in the SpamFilter\nvc\nse directory, and registry entries (the key mentioned inthe beta page). This will be fixed shortly.

If SpamFilter sees an existing install of Norman, it will use that engine, provided the 3 plugin DLLs are present in the SpamFilter directory.

ok, so after installing the av plugin, I delete the mentioned registry entry and the SpamFilter\nvc\nse directories, except for the 3 DLLs mentioned?

will there be a reduced license fee for users like me that only need the plugin but not the norman engine?

Back to Top
mikek View Drop Down
Senior Member
Senior Member
Avatar

Joined: 22 February 2005
Location: Switzerland
Status: Offline
Points: 133
Post Options Post Options   Thanks (0) Thanks(0)   Quote mikek Quote  Post ReplyReply Direct Link To This Post Posted: 07 March 2005 at 4:15am

already have it working! installed the beta version of spamfilter, installed the av plugin on a different machine, copied the 3 dlls into the spamfilter directory, that's it!

 

Back to Top
kspare View Drop Down
Senior Member
Senior Member


Joined: 26 January 2005
Location: Canada
Status: Offline
Points: 334
Post Options Post Options   Thanks (0) Thanks(0)   Quote kspare Quote  Post ReplyReply Direct Link To This Post Posted: 07 March 2005 at 7:58am

that worked for me too.

I did notice that, even though I block *.com files, when I sent through the eicar test virus, it blocked the file via the black list but it also found that it had a virus and ultimatly blocked the message because of the virus.

Back to Top
JimMeredith View Drop Down
Newbie
Newbie


Joined: 27 January 2005
Location: United States
Status: Offline
Points: 28
Post Options Post Options   Thanks (0) Thanks(0)   Quote JimMeredith Quote  Post ReplyReply Direct Link To This Post Posted: 07 March 2005 at 12:41pm
Originally posted by kspare kspare wrote:

I did notice that, even though I block *.com files, when I sent through the eicar test virus, it blocked the file via the black list but it also found that it had a virus and ultimatly blocked the message because of the virus.

Yes, I've noticed the same thing on all attachment types that we are allowing to be quarantined. (The attachment types that we have listed with ":null" to NOT quarantine are not even received, therefore not scanned by the antivirus... and that's fine.) The great thing about this is that the virus block becomes the reason logged in the database. I'm modifying our web interface to prevent a user from delivering a virus-infected message from quarantine.

Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 07 March 2005 at 3:27pm
Originally posted by JimMeredith JimMeredith wrote:

Originally posted by Desperado Desperado wrote:

Jim,

33917  infected with the virus Sober.K@mm
25880 infected with the virus Sober.K@mm
1354 infected with the virus Netsky.P@mm
369  infected with the virus Netsky.P@mm
... 

I think it is working.

Dan

Dan, you show-off!  Actually, I'm glad you posted your results... good to see performance under load.

But based on the resultset you posted, the query I posted earlier needs to be modified to give accurate totals by virus type.  Looks like the RejectDetails field sometimes includes a leading space, sometimes it does not... no biggie, it's easy to just trim it.

SELECT COUNT(*) 'Virus_Messages', LTRIM(RejectDetails) 'Details' FROM tblquarantine WHERE RejectID=17 GROUP BY LTRIM(RejectDetails) ORDER BY COUNT(*) DESC

Jim

Jim,

Better?

45973 infected with the virus Sober.K@mm
1880 infected with the virus Netsky.P@mm
108 infected with the virus Netsky.D@mm
104 infected with the virus Netsky.B@mm
100 infected with the virus Bagle.AH@mm
92 infected with the virus Netsky.C@mm
92 infected with the virus Netsky.Q@mm
66 infected with the virus Lovgate.AG@mm
56 infected with the virus MyDoom.I@mm
56 infected with the virus Netsky.K@mm
54 infected with the virus Bagle.N@mm
52 infected with the virus Netsky.Z@mm
51 infected with the virus Bagle.J@mm
48 infected with the virus Lovgate.AB@mm
41 infected with the virus Mabutu.A@mm
40 infected with the virus Bagle.BC@mm
37 infected with the virus W32/Downloader
37 infected with the virus W32/FunLove.4099
34 infected with the virus Bagle.AR@mm
34 infected with the virus Bagle.BB@mm
31 infected with the virus Bifrose.D
31 infected with the virus MyDoom.J@mm
29 infected with the virus MyDoom.L@mm
27 infected with the virus Mytob.A
24 infected with the virus Bagle.AF@mm
22 infected with the virus W32/Bagle.Gen!Zip
15 infected with the virus Netsky.AB@mm
13 infected with the virus Netsky.AD@mm
11 infected with the virus Netsky.X@mm
10 infected with the virus Netsky.W@mm
7 infected with the virus Zafi.D@mm
6 infected with the virus Netsky.T@mm
6 infected with the virus W32/Bagle.Gen!Rar
6 infected with the virus Bagle.K@mm
4 infected with the virus W95/Pinfi.A
4 infected with the virus Bagle.AV@mm
3 infected with the virus Netsky.N@mm
3 infected with the virus W32/Valla.2048
2 infected with the virus HTML/MIME_Exploit
2 infected with the virus HTML/Bagle
2 infected with the virus W32/MEWpacked.gen
1 infected with the virus W95/BugBear.B@mm
1 infected with the virus W32/Magistr.A@mm
1 infected with the virus W32/Klez.H@mm
1 infected with the virus W32/Malware
1 infected with the virus Bagle.AE@mm
1 infected with the virus W95/Maslan.C
1 infected with the virus W32/Backdoor
1 infected with the virus Zafi.B@mm
1 infected with the virus BugBear.B@mm
1 infected with the virus MyDoom.AR@mm
1 infected with the virus MyDoom.F@mm

Dan

The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Back to Top
kspare View Drop Down
Senior Member
Senior Member


Joined: 26 January 2005
Location: Canada
Status: Offline
Points: 334
Post Options Post Options   Thanks (0) Thanks(0)   Quote kspare Quote  Post ReplyReply Direct Link To This Post Posted: 07 March 2005 at 5:14pm

Jim, can you let me know what you come up with in regards to preventing users from forwarding on virus'

Back to Top
JimMeredith View Drop Down
Newbie
Newbie


Joined: 27 January 2005
Location: United States
Status: Offline
Points: 28
Post Options Post Options   Thanks (0) Thanks(0)   Quote JimMeredith Quote  Post ReplyReply Direct Link To This Post Posted: 07 March 2005 at 5:43pm

Kevin, I'd be glad to, but I don't think it will help, since it's not in ASP.  We have a proprietary quarantine management page and "reportlet" that is written in ColdFusion.  We don't use the SpamFilter ASP code at all.

Back to Top
mikek View Drop Down
Senior Member
Senior Member
Avatar

Joined: 22 February 2005
Location: Switzerland
Status: Offline
Points: 133
Post Options Post Options   Thanks (0) Thanks(0)   Quote mikek Quote  Post ReplyReply Direct Link To This Post Posted: 08 March 2005 at 3:59am
Originally posted by kspare kspare wrote:

Jim, can you let me know what you come up with in regards to preventing users from forwarding on virus'

I have my own quarantine front-end as well, but for my part I just modified the SQL SELECT to include a WHERE RejectID<>17 and the user never sees mails that were blocked because of viruses...

Back to Top
dcook View Drop Down
Senior Member
Senior Member
Avatar

Joined: 31 January 2005
Location: United States
Status: Offline
Points: 174
Post Options Post Options   Thanks (0) Thanks(0)   Quote dcook Quote  Post ReplyReply Direct Link To This Post Posted: 08 March 2005 at 12:18pm

I have had the Beta running successfully under moderate load.  I am increasing the load on the beta today.  I had about 40 discovered and blocked viruses.  I agree filtering on file extensions is preventing a higher count.

The install was smooth on both windows 2000 and 2003 server.  Everything registered correctly.  So far vary stable.

Will the final release include the ability for signature to be updated on a schedule?

Dwight

 

Dwight
www.vividmix.com
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 08 March 2005 at 4:16pm
Dwight,

Absolutely yes on the automatic updates. We're still working the details with Norman (the AV engine owners) on how this will work, but the next beta will probably have this feature enabled.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
kspare View Drop Down
Senior Member
Senior Member


Joined: 26 January 2005
Location: Canada
Status: Offline
Points: 334
Post Options Post Options   Thanks (0) Thanks(0)   Quote kspare Quote  Post ReplyReply Direct Link To This Post Posted: 08 March 2005 at 6:49pm
A bit off topic, but does this version or others support dual or quad cpus?
Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 09 March 2005 at 1:47pm

I am running with Quad xeon which looks like 8 CPUs as far as the OS sees it.

San

The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Back to Top
 Post Reply Post Reply Page  12>
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.094 seconds.