I looked at it for a second when the Declude virusname/virusfile tokens were
introduced, but to be honest, I haven't really tried. Because I use F-Prot as
my "first in line" and I bypass the subsequent tests upon finding a virus, I
decided to just let Declude handle the f-prot report.
For the few files (and until yesterday I hadn't had any) that f-prot doesn't
catch, I'm not worried about proper virusname/virusfile info being in the
notification message.
The file I sent was a cut-down version of what I actually run. I append the
report.txt to a daily log of all scanning activity to fall back on for
reference and debugging, as well as handle tnef attachments.
There were several reasons to I chose to run f-prot "first" when the other two
were obviously available to me:
1: I am still not comfortable with the McAfee "server" licensing clause.
F-Prot has the cleanest licensing. Leaving it last makes it the easiest to
remove.
2: The client is actually licensed sufficiently for Trend, but keeping the
.exe file updated is problematic(signatures are easy). F-Prot is easier to
keep updated automatically.
3: I specifically want to get a track record of what slips through f-prot.
For the next client that needs scanning, will I feel comfortable recommending
an f-prot only scanning solution?
Jerry
----- Original Message -----
From: "Bill Doyle" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, August 14, 2001 10:38 AM
Subject: REVDNS:Re: [Declude.Virus] Can declude use two scanners?
> Hello Jerry,
>
> Thanks for sharing your batch file. I have done something similar.
>
> What I'm curious to know is have you sucessfully gotten a correct virus name
> to display when using the report from Trends PCSCAN?
>
> I have not and what I believe I have determined is this. Declude expects
> the Virus FileName to be first on the report line then the Virus Name.
> Trend displays it the other way around. I have thrown together a Quick and
> Dirty VB program that reads in the Report.TXT and produces a new file with
> just the File name then the VirusName. (Then deleting report.txt and naming
> my report to report.txt) When it returns to Declude he is happy.
>
> Below is an exampe of the report that PCSCAN generates.
>
> -----------
>
> Scanning for viruses.
>
> Found a virus 'TROJ_W95NUKER' in Winnuke.exe of C:\TEMP\WINNUKE.ZIP
> (Non-Cleanable)
> Action taken on virus file C:\TEMP\WINNUKE.ZIP : (Leave alone)
> Found a virus 'TROJ_W95NUKER' in C:\TEMP\WINNUKE.EXE (Non-Cleanable)
> Action taken on virus file C:\TEMP\WINNUKE.EXE : (Leave alone)
>
> -----------
>
> -Bill Doyle [[EMAIL PROTECTED]]
>
>
> ----- Original Message -----
> From: "Jerry Murdock" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Monday, August 13, 2001 3:42 PM
> Subject: Re: [Declude.Virus] Can declude use two scanners?
>
>
> > Yes.
> >
> > My simplified batch file is attached, along with one support utility that
> sets
> > the errorlevel to "EE" hex.
> >
> > Rename the ErrEE.co_ to ErrEE.com.
> >
> > Use VIRUSCODE 238 in virus.cfg.
> >
> > This is completely unsupported, use at your own risk, your mileage may
> vary,
> > etc.
> >
> > Jerry
> >
> > ----- Original Message -----
> > From: "Dan Spangenberg" <[EMAIL PROTECTED]>
> > To: <[EMAIL PROTECTED]>
> > Sent: Monday, August 13, 2001 1:16 PM
> > Subject: [Declude.Virus] Can declude use two scanners?
> >
> >
> > > Scott,
> > > I've watched this list and the imail with interest the last several
> weeks
> > > over the many discussions regarding which virus solution to use with
> imail
> > > (we all know the right answer to that!) and also which scanning program
> to
> > > use. It seems like each one has its strengths and weaknesses. My
> question
> > > is, would it be possible for declude to call two seperate scanners and
> > > provide some redundancy? This may be a nightmare to implement, but this
> way
> > > we wouldn't have to rely on just one.
> > >
> > > I am still using Dr. Solomon and it seems to work pretty well. It
> updates
> > > daily and I really haven't seen anything get through. But with all the
> > > discussion lately I do wonder if I should be using one of these others.
> > >
> > > Thanks
> > > Dan
> > >
> > >
> > >
> > > This E-mail came from the Declude.Virus mailing list. To
> > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > type "unsubscribe Declude.Virus". You can E-mail
> > > [EMAIL PROTECTED] for assistance. You can visit our web
> > > site at http://www.declude.com .
> >
>
> This E-mail came from the Declude.Virus mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.Virus". You can E-mail
> [EMAIL PROTECTED] for assistance. You can visit our web
> site at http://www.declude.com .
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
