RE: [Declude.Virus] Problems with catching Virus

[Kevin G. Ryan]

Title: Problems with catching Virus

You might also check your realtime monitor settings for Innoculate.  I found what was happening was that declude would decode the attachment and innoculate would delete it before it could be tested.  From there the only logical response for declude and imail were that the file was not infected. 

 

I've switched to f-prot for the command line scan and Innoculan for all other functions.  Realtime I keep out of the decode area so it doesn't interfere.

Kevin

 

Kevin G. Ryan
Plattsburgh City Schools
Plattsburgh, NY
NERIC/Coordinator Network Services

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Keith Johnson
Sent: Tuesday, December 10, 2002 1:02 PM
To: [EMAIL PROTECTED]
Subject: [Declude.Virus] Problems with catching Virus

Scott,
        We are in the testing phase of deploying the antivirus across our Imail  server, thus we are using the virus domains file to limit testing to a few domains.  We are using the Computer Associates InoculateIT 6.0 engine to scan for viruses.  Our scanner reads:

C:\Progra~1\CA\Common\ScanEn~1\inocmd32.exe /ARC /LIS:report.txt

        To test this, we simply copied down the EICAR test virus into a directory on the local machine (Imail Server w/Declude).  I ran the the command line above to test the virus to ensure it would detect it and it did (no on-access scanning is running, has been disabled).   I opened up the Imail Client on the default domain and emailed my username on my domain (which is included in the virus domains file as ON).  I received the email and the virus attached to the email.  Once I popped it off the Imail Server, my onboard Antivirus caught it.  I checked the virxx.log file and it showed it was scanned as OK.  Is there anything else I can check to see what it going on.  I could increase the logging to DEBUG from MID.  Thanks for the aid.

_______________________

Keith Johnson, MCP
Network Engineer
Network Advocates, Inc.
Tel:       502.412.1050
Fax:      502.412.1058
Email:  [EMAIL PROTECTED]

"Good pings come in small packets"