Guys,
let me explain our problem. We're using Trendmicro's
Interscan Viruswall CVP Server. It's running in conjunction with
CheckPoint's FW-1 v4.1 SP2 on the same machine, a Sun Enterprise
Server 250 with 2 CPUs and 512 MB of RAM and Solaris 2.6. We're
using the CVP version of Viruswall.
Our experiments are done with a second Viruswall installation on a
server different from the firewall machine. This is also a
multiprocessor sparc computer (e450, 4 CPUs, lots of memory) running
solaris 2.6. The behaviour of both setups is the same.
Since about the time we upgraded from FW-1 V 4.0 SP5 to Checkpoint
2000 (a.k.a. FW-1 V 4.1 SP1) and the following installation of SP2,
we're experiencing corrupted files after the virus scanning.
The most reproduceable case is a HTTP download, where, if a file gets
corrupted once, it will never go through undamaged. We found out, that
the original download from the server to the interscan host is
complete:
iscvpAAPmfdq6h 11292480
This is the original filesize (11292138 bytes) plus the HTTP header
(342 bytes).
The file after the scan is also complete:
iscvpBAPnfdq6h 11292138
but now the HTTP header is missing. We believe that this is intended.
While the download is proceeding, the second file disappears from the
directory. This leads us to the conclusion, that not the scanned file,
but the original file is sent back to the firewall after the scanning
is complete.
However, the file arrives corrupted. I've made 6 test runs and the
results are 11273578, 11272938, 11273322, 11273450, 11273322 and
11273450 bytes.
Something similar happens to attached .xls and .doc files, though I
wasn't able to reproduce that. I'm still waiting for a damaged file
along with the undamaged original to do further investigations.
Has anybody similar problems?
Kind regards,
J�rg
>Date: Mon, 13 Nov 2000 11:59:50 +0100
>From: "Volker Tanger" <[EMAIL PROTECTED]>
>X-Accept-Language: de,en-GB,en,en-US
>To: Joerg Oertel <[EMAIL PROTECTED]>
>CC: [EMAIL PROTECTED]
>Subject: Re: [FW1] Any Trendmicro Viruswall users here?
>Content-Transfer-Encoding: 7bit
>
>
>Greetings!
>
>Joerg Oertel wrote:
>
>> we're still having massive problems with Trendmicro's Interscan
>> Viruswall CVP software. Are there any users of this software in
this
>> group to share experiences and know-how?
>
>What's the problem?
>
>Bye
> Volker
>
>--
>
>Volker Tanger <[EMAIL PROTECTED]>
>--------------------------------------------
>Sr. Security Engineer Tel. +49-69-92901-570
>--------------------------------------------
>Global One
> Global Security
> Global Service Engineering
>
>
>
>
>=====================================================================
===========
> To unsubscribe from this mailing list, please see the
instructions at
> http://www.checkpoint.com/services/mailing.html
>=====================================================================
===========
// pallas GmbH ............ Joerg Oertel ...........
Hermuelheimer Str. 10 System engineer
D-50321 Bruehl, Germany [EMAIL PROTECTED]
phone +49-(0)2232-1896-0
http://www.pallas.de fax +49-(0)2232-1896-29
........................................................
================================================================================
To unsubscribe from this mailing list, please see the instructions at
http://www.checkpoint.com/services/mailing.html
================================================================================
