RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers
Evans, I use F-Prot, ClamWin, AVG and NOD32, in that order. I don't use ClamWin to do scheduled scans and it doesn't do on-access scanning, so it doesn't interfere with F-Prot in any way. George -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Evans Martin Sent: Friday, January 27, 2006 9:41 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] OT: Virus Scanning For Your Servers What do you guys use for virus protection on your servers? I am trying to use ClamWin but it is competing with Declude Virus/FProt. I looked for a place to exclude my mail folders and it doesn't seem to allow directories to be excluded, only filenames. I'm trying to stay open source or really cheap because of the number of machines that I have and Clam has always worked well on my X machines. Thanks, Evans Martin EVANS MARTIN [EMAIL PROTECTED] HOSTING: http://www.martek.net http://www.martek.net/ PROGRAMMING: http://www.martekware.com http://www.martekware.com/ iPlus Info Browser - IPB's IMail Migration Tool, password browser, reporting suite make IPlus Info Browser something no IMail administrator should be without. http://www.martek.net/Default.aspx?tabid=96 --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers
If ClamWin doesn't do on access scanning and it is the only virus scanner running on my system, to what can I attribute the errors in this log segment? 01/22/2006 00:11:52.187 42470405 Vulnerability flags = 0 01/22/2006 00:11:52.234 42470405 Error 87 starting scanner [C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOFLOPPY /NOBOOT /DUMB /PACKED /REPORT=report.txt c:\SMARTE~1\Spool\proc\work\42470405.vir\]; NOT SCANNING ATTACHMENTS! Error String: [The parameter is incorrect.] 01/22/2006 00:11:52.234 42470405 1 [1 of 2 not deleted] files were deleted. You should not use an on-access virus scanner that scans the \IMail directory or sub-directories. 01/22/2006 00:11:52.234 42470405 Scanned: Error starting scanner 01/22/2006 00:12:32.312 42470406 Vulnerability flags = 0 01/22/2006 00:12:32.343 42470406 Error 87 starting scanner [C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOFLOPPY /NOBOOT /DUMB /PACKED /REPORT=report.txt c:\SMARTE~1\Spool\proc\work\42470406.vir\]; NOT SCANNING ATTACHMENTS! Error String: [The parameter is incorrect.] 01/22/2006 00:12:32.343 42470406 1 [1 of 2 not deleted] files were deleted. You should not use an on-access virus scanner that scans the \IMail directory or sub-directories. 01/22/2006 00:12:32.343 42470406 Scanned: Error starting scanner 01/22/2006 00:12:42.437 42470407 Vulnerability flags = 0 01/22/2006 00:12:42.453 42470407 Scanned: Virus Free [Prescan OK][MIME: 1 3031] 01/22/2006 00:12:47.593 42470408 Vulnerability flags = 0 01/22/2006 00:12:47.625 42470408 Error 87 starting scanner [C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOFLOPPY /NOBOOT /DUMB /PACKED /REPORT=report.txt c:\SMARTE~1\Spool\proc\work\42470408.vir\]; NOT SCANNING ATTACHMENTS! Error String: [The parameter is incorrect.] 01/22/2006 00:12:47.625 42470408 1 [1 of 2 not deleted] files were deleted. You should not use an on-access virus scanner that scans the \IMail directory or sub-directories. 01/22/2006 00:12:47.625 42470408 Scanned: Error starting scanner 01/22/2006 00:13:27.718 42470409 Vulnerability flags = 0 01/22/2006 00:13:27.734 42470409 MIME file: [text/html][*DEFAULT*; Length=2063 Checksum=158746] 01/22/2006 00:13:27.734 42470409 Scanned: Virus Free [Prescan OK][MIME: 2 3360] 01/22/2006 00:13:47.890 42470410 Vulnerability flags = 0 01/22/2006 00:13:47.906 42470410 Error 87 starting scanner [C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOFLOPPY /NOBOOT /DUMB /PACKED /REPORT=report.txt c:\SMARTE~1\Spool\proc\work\42470410.vir\]; NOT SCANNING ATTACHMENTS! Error String: [The parameter is incorrect.] 01/22/2006 00:13:47.906 42470410 1 [1 of 2 not deleted] files were deleted. You should not use an on-access virus scanner that scans the \IMail directory or sub-directories. 01/22/2006 00:13:47.906 42470410 Scanned: Error starting scanner Thanks, Evans Martin --- EVANS MARTIN [EMAIL PROTECTED] HOSTING: http://www.martek.net PROGRAMMING: http://www.martekware.com iPlus Info Browser - IPB's IMail Migration Tool, password browser, reporting suite make IPlus Info Browser something no IMail administrator should be without. http://www.martek.net/Default.aspx?tabid=96 -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of george Sent: Saturday, January 28, 2006 12:47 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers Evans, I use F-Prot, ClamWin, AVG and NOD32, in that order. I don't use ClamWin to do scheduled scans and it doesn't do on-access scanning, so it doesn't interfere with F-Prot in any way. George -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Evans Martin Sent: Friday, January 27, 2006 9:41 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] OT: Virus Scanning For Your Servers What do you guys use for virus protection on your servers? I am trying to use ClamWin but it is competing with Declude Virus/FProt. I looked for a place to exclude my mail folders and it doesn't seem to allow directories to be excluded, only filenames. I'm trying to stay open source or really cheap because of the number of machines that I have and Clam has always worked well on my X machines. Thanks, Evans Martin EVANS MARTIN [EMAIL PROTECTED] HOSTING: http://www.martek.net http://www.martek.net/ PROGRAMMING: http://www.martekware.com http://www.martekware.com/ iPlus Info Browser - IPB's IMail Migration Tool, password browser, reporting suite make IPlus Info Browser something no IMail administrator should be without. http://www.martek.net/Default.aspx?tabid=96 --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED
RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers
1. You should be using fpcmd.exe which is the 32bit scanner of F-Prot not the f-prot.exe which is the 16 bit version. 2. Remove the /NOFLOPPY and /PACKED options from the switches 3. Ensure that the Real Time protector of F-Prot is not installed. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Evans Martin Sent: Saturday, January 28, 2006 4:05 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers If ClamWin doesn't do on access scanning and it is the only virus scanner running on my system, to what can I attribute the errors in this log segment? 01/22/2006 00:11:52.187 42470405 Vulnerability flags = 0 01/22/2006 00:11:52.234 42470405 Error 87 starting scanner [C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOFLOPPY /NOBOOT /DUMB /PACKED /REPORT=report.txt c:\SMARTE~1\Spool\proc\work\42470405.vir\]; NOT SCANNING ATTACHMENTS! Error String: [The parameter is incorrect.] 01/22/2006 00:11:52.234 42470405 1 [1 of 2 not deleted] files were deleted. You should not use an on-access virus scanner that scans the \IMail directory or sub-directories. 01/22/2006 00:11:52.234 42470405 Scanned: Error starting scanner 01/22/2006 00:12:32.312 42470406 Vulnerability flags = 0 01/22/2006 00:12:32.343 42470406 Error 87 starting scanner [C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOFLOPPY /NOBOOT /DUMB /PACKED /REPORT=report.txt c:\SMARTE~1\Spool\proc\work\42470406.vir\]; NOT SCANNING ATTACHMENTS! Error String: [The parameter is incorrect.] 01/22/2006 00:12:32.343 42470406 1 [1 of 2 not deleted] files were deleted. You should not use an on-access virus scanner that scans the \IMail directory or sub-directories. 01/22/2006 00:12:32.343 42470406 Scanned: Error starting scanner 01/22/2006 00:12:42.437 42470407 Vulnerability flags = 0 01/22/2006 00:12:42.453 42470407 Scanned: Virus Free [Prescan OK][MIME: 1 3031] 01/22/2006 00:12:47.593 42470408 Vulnerability flags = 0 01/22/2006 00:12:47.625 42470408 Error 87 starting scanner [C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOFLOPPY /NOBOOT /DUMB /PACKED /REPORT=report.txt c:\SMARTE~1\Spool\proc\work\42470408.vir\]; NOT SCANNING ATTACHMENTS! Error String: [The parameter is incorrect.] 01/22/2006 00:12:47.625 42470408 1 [1 of 2 not deleted] files were deleted. You should not use an on-access virus scanner that scans the \IMail directory or sub-directories. 01/22/2006 00:12:47.625 42470408 Scanned: Error starting scanner 01/22/2006 00:13:27.718 42470409 Vulnerability flags = 0 01/22/2006 00:13:27.734 42470409 MIME file: [text/html][*DEFAULT*; Length=2063 Checksum=158746] 01/22/2006 00:13:27.734 42470409 Scanned: Virus Free [Prescan OK][MIME: 2 3360] 01/22/2006 00:13:47.890 42470410 Vulnerability flags = 0 01/22/2006 00:13:47.906 42470410 Error 87 starting scanner [C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOFLOPPY /NOBOOT /DUMB /PACKED /REPORT=report.txt c:\SMARTE~1\Spool\proc\work\42470410.vir\]; NOT SCANNING ATTACHMENTS! Error String: [The parameter is incorrect.] 01/22/2006 00:13:47.906 42470410 1 [1 of 2 not deleted] files were deleted. You should not use an on-access virus scanner that scans the \IMail directory or sub-directories. 01/22/2006 00:13:47.906 42470410 Scanned: Error starting scanner Thanks, Evans Martin --- EVANS MARTIN [EMAIL PROTECTED] HOSTING: http://www.martek.net PROGRAMMING: http://www.martekware.com iPlus Info Browser - IPB's IMail Migration Tool, password browser, reporting suite make IPlus Info Browser something no IMail administrator should be without. http://www.martek.net/Default.aspx?tabid=96 -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of george Sent: Saturday, January 28, 2006 12:47 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers Evans, I use F-Prot, ClamWin, AVG and NOD32, in that order. I don't use ClamWin to do scheduled scans and it doesn't do on-access scanning, so it doesn't interfere with F-Prot in any way. George -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Evans Martin Sent: Friday, January 27, 2006 9:41 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] OT: Virus Scanning For Your Servers What do you guys use for virus protection on your servers? I am trying to use ClamWin but it is competing with Declude Virus/FProt. I looked for a place to exclude my mail folders and it doesn't seem to allow directories to be excluded, only filenames. I'm trying to stay open source or really cheap because of the number of machines that I have and Clam has always worked well on my X machines. Thanks, Evans Martin EVANS MARTIN [EMAIL PROTECTED] HOSTING: http
RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers
The F-Prot default setup does do on-access scanning. You should either disable that which is the recommended Declude method, exclude the IMail directory and sub-directories from the F-Prot On-access scan. I've enclosed excerpts from the Declude EVA Manual for your information. George 3. F-Prot Help If you are using the F-Prot virus scanner, Declude Virus uses the F-Prot command line scanner, which is included in both their DOS and Windows version (the command line scanner in both is identical). The Windows version also includes a scheduler for automated downloading of updates, which can be very useful. 3.1 Windows Version When installing the Windows version, you need to make sure that it does not install the RealTime Protector (their on-access scanner), since it can interfere with Declude's operation. To prevent it from installing, do a Full Install, and unselect the RealTime Protector. 3.2 DOS Version When installing the DOS version, you need to make sure to delete the F-Prot.PIF file that F-Prot installs (it is installed in the same directory as F-Prot.EXE). Note that if you are using Windows Explorer and have it set to hide file extensions, you may need to enable the file extensions in order to distinguish the F-Prot.PIF from the F-Prot.EXE file. 6.4 Virus scanners that delete files Declude EVA does not officially support virus scanners that scan files as they are written to the disk (on access scanners, these are not command line virus scanners). This is because we can not be sure exactly when the files are scanned, and when it is safe to assume that a file that has not been deleted is virus-free. Although they should work, we do not recommend using them. 12. Types of Virus Scanners There are two main types of virus scanners: on-access scanners, and on-demand scanners. Command-line scanners (the type Declude uses) are on-demand scanners. An on-demand scanner is run when the user requests it. It can either be a command-line scanner, or a standard Windows program. The command line scanner works well with Declude because it can be set to scan specific files, and be configured in Declude by adding command line parameters to the file name. An on-access scanner scans all files that are written to the hard drive. These usually just cause unnecessary overhead when run with Declude, as the files will end up getting scanned twice. It is possible to use an on-access scanner with Declude, although it is not recommended. Once we have done more testing to determine the safety of using on-access scanners, we may recommend this type of a setup. The problem is that Declude has no way of knowing how long to wait to determine if the scanner has scanned the file. In most cases, though, this should work. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Evans Martin Sent: Saturday, January 28, 2006 4:05 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers If ClamWin doesn't do on access scanning and it is the only virus scanner running on my system, to what can I attribute the errors in this log segment? 01/22/2006 00:11:52.187 42470405 Vulnerability flags = 0 01/22/2006 00:11:52.234 42470405 Error 87 starting scanner [C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOFLOPPY /NOBOOT /DUMB /PACKED /REPORT=report.txt c:\SMARTE~1\Spool\proc\work\42470405.vir\]; NOT SCANNING ATTACHMENTS! Error String: [The parameter is incorrect.] 01/22/2006 00:11:52.234 42470405 1 [1 of 2 not deleted] files were deleted. You should not use an on-access virus scanner that scans the \IMail directory or sub-directories. 01/22/2006 00:11:52.234 42470405 Scanned: Error starting scanner 01/22/2006 00:12:32.312 42470406 Vulnerability flags = 0 01/22/2006 00:12:32.343 42470406 Error 87 starting scanner [C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOFLOPPY /NOBOOT /DUMB /PACKED /REPORT=report.txt c:\SMARTE~1\Spool\proc\work\42470406.vir\]; NOT SCANNING ATTACHMENTS! Error String: [The parameter is incorrect.] 01/22/2006 00:12:32.343 42470406 1 [1 of 2 not deleted] files were deleted. You should not use an on-access virus scanner that scans the \IMail directory or sub-directories. 01/22/2006 00:12:32.343 42470406 Scanned: Error starting scanner 01/22/2006 00:12:42.437 42470407 Vulnerability flags = 0 01/22/2006 00:12:42.453 42470407 Scanned: Virus Free [Prescan OK][MIME: 1 3031] 01/22/2006 00:12:47.593 42470408 Vulnerability flags = 0 01/22/2006 00:12:47.625 42470408 Error 87 starting scanner [C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOFLOPPY /NOBOOT /DUMB /PACKED /REPORT=report.txt c:\SMARTE~1\Spool\proc\work\42470408.vir\]; NOT SCANNING ATTACHMENTS! Error String: [The parameter is incorrect.] 01/22/2006 00:12:47.625 42470408 1 [1 of 2 not deleted] files were deleted. You should not use an on-access
RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers
I'm using the old 16-bit DOS version. It only runs when Declude kicks it off. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of george Sent: Saturday, January 28, 2006 3:29 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers The F-Prot default setup does do on-access scanning. You should either disable that which is the recommended Declude method, exclude the IMail directory and sub-directories from the F-Prot On-access scan. I've enclosed excerpts from the Declude EVA Manual for your information. George 3. F-Prot Help If you are using the F-Prot virus scanner, Declude Virus uses the F-Prot command line scanner, which is included in both their DOS and Windows version (the command line scanner in both is identical). The Windows version also includes a scheduler for automated downloading of updates, which can be very useful. 3.1 Windows Version When installing the Windows version, you need to make sure that it does not install the RealTime Protector (their on-access scanner), since it can interfere with Declude's operation. To prevent it from installing, do a Full Install, and unselect the RealTime Protector. 3.2 DOS Version When installing the DOS version, you need to make sure to delete the F-Prot.PIF file that F-Prot installs (it is installed in the same directory as F-Prot.EXE). Note that if you are using Windows Explorer and have it set to hide file extensions, you may need to enable the file extensions in order to distinguish the F-Prot.PIF from the F-Prot.EXE file. 6.4 Virus scanners that delete files Declude EVA does not officially support virus scanners that scan files as they are written to the disk (on access scanners, these are not command line virus scanners). This is because we can not be sure exactly when the files are scanned, and when it is safe to assume that a file that has not been deleted is virus-free. Although they should work, we do not recommend using them. 12. Types of Virus Scanners There are two main types of virus scanners: on-access scanners, and on-demand scanners. Command-line scanners (the type Declude uses) are on-demand scanners. An on-demand scanner is run when the user requests it. It can either be a command-line scanner, or a standard Windows program. The command line scanner works well with Declude because it can be set to scan specific files, and be configured in Declude by adding command line parameters to the file name. An on-access scanner scans all files that are written to the hard drive. These usually just cause unnecessary overhead when run with Declude, as the files will end up getting scanned twice. It is possible to use an on-access scanner with Declude, although it is not recommended. Once we have done more testing to determine the safety of using on-access scanners, we may recommend this type of a setup. The problem is that Declude has no way of knowing how long to wait to determine if the scanner has scanned the file. In most cases, though, this should work. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Evans Martin Sent: Saturday, January 28, 2006 4:05 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers If ClamWin doesn't do on access scanning and it is the only virus scanner running on my system, to what can I attribute the errors in this log segment? 01/22/2006 00:11:52.187 42470405 Vulnerability flags = 0 01/22/2006 00:11:52.234 42470405 Error 87 starting scanner [C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOFLOPPY /NOBOOT /DUMB /PACKED /REPORT=report.txt c:\SMARTE~1\Spool\proc\work\42470405.vir\]; NOT SCANNING ATTACHMENTS! Error String: [The parameter is incorrect.] 01/22/2006 00:11:52.234 42470405 1 [1 of 2 not deleted] files were deleted. You should not use an on-access virus scanner that scans the \IMail directory or sub-directories. 01/22/2006 00:11:52.234 42470405 Scanned: Error starting scanner 01/22/2006 00:12:32.312 42470406 Vulnerability flags = 0 01/22/2006 00:12:32.343 42470406 Error 87 starting scanner [C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOFLOPPY /NOBOOT /DUMB /PACKED /REPORT=report.txt c:\SMARTE~1\Spool\proc\work\42470406.vir\]; NOT SCANNING ATTACHMENTS! Error String: [The parameter is incorrect.] 01/22/2006 00:12:32.343 42470406 1 [1 of 2 not deleted] files were deleted. You should not use an on-access virus scanner that scans the \IMail directory or sub-directories. 01/22/2006 00:12:32.343 42470406 Scanned: Error starting scanner 01/22/2006 00:12:42.437 42470407 Vulnerability flags = 0 01/22/2006 00:12:42.453 42470407 Scanned: Virus Free [Prescan OK][MIME: 1 3031] 01/22/2006 00:12
RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers
Evans, As David just said, you should be using the 32 bit version, not the 16 bit version. It still fits the 'low-budget' criteria. George -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Evans Martin Sent: Saturday, January 28, 2006 4:39 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers I'm using the old 16-bit DOS version. It only runs when Declude kicks it off. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of george Sent: Saturday, January 28, 2006 3:29 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers The F-Prot default setup does do on-access scanning. You should either disable that which is the recommended Declude method, exclude the IMail directory and sub-directories from the F-Prot On-access scan. I've enclosed excerpts from the Declude EVA Manual for your information. George 3. F-Prot Help If you are using the F-Prot virus scanner, Declude Virus uses the F-Prot command line scanner, which is included in both their DOS and Windows version (the command line scanner in both is identical). The Windows version also includes a scheduler for automated downloading of updates, which can be very useful. 3.1 Windows Version When installing the Windows version, you need to make sure that it does not install the RealTime Protector (their on-access scanner), since it can interfere with Declude's operation. To prevent it from installing, do a Full Install, and unselect the RealTime Protector. 3.2 DOS Version When installing the DOS version, you need to make sure to delete the F-Prot.PIF file that F-Prot installs (it is installed in the same directory as F-Prot.EXE). Note that if you are using Windows Explorer and have it set to hide file extensions, you may need to enable the file extensions in order to distinguish the F-Prot.PIF from the F-Prot.EXE file. 6.4 Virus scanners that delete files Declude EVA does not officially support virus scanners that scan files as they are written to the disk (on access scanners, these are not command line virus scanners). This is because we can not be sure exactly when the files are scanned, and when it is safe to assume that a file that has not been deleted is virus-free. Although they should work, we do not recommend using them. 12. Types of Virus Scanners There are two main types of virus scanners: on-access scanners, and on-demand scanners. Command-line scanners (the type Declude uses) are on-demand scanners. An on-demand scanner is run when the user requests it. It can either be a command-line scanner, or a standard Windows program. The command line scanner works well with Declude because it can be set to scan specific files, and be configured in Declude by adding command line parameters to the file name. An on-access scanner scans all files that are written to the hard drive. These usually just cause unnecessary overhead when run with Declude, as the files will end up getting scanned twice. It is possible to use an on-access scanner with Declude, although it is not recommended. Once we have done more testing to determine the safety of using on-access scanners, we may recommend this type of a setup. The problem is that Declude has no way of knowing how long to wait to determine if the scanner has scanned the file. In most cases, though, this should work. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Evans Martin Sent: Saturday, January 28, 2006 4:05 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers If ClamWin doesn't do on access scanning and it is the only virus scanner running on my system, to what can I attribute the errors in this log segment? 01/22/2006 00:11:52.187 42470405 Vulnerability flags = 0 01/22/2006 00:11:52.234 42470405 Error 87 starting scanner [C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOFLOPPY /NOBOOT /DUMB /PACKED /REPORT=report.txt c:\SMARTE~1\Spool\proc\work\42470405.vir\]; NOT SCANNING ATTACHMENTS! Error String: [The parameter is incorrect.] 01/22/2006 00:11:52.234 42470405 1 [1 of 2 not deleted] files were deleted. You should not use an on-access virus scanner that scans the \IMail directory or sub-directories. 01/22/2006 00:11:52.234 42470405 Scanned: Error starting scanner 01/22/2006 00:12:32.312 42470406 Vulnerability flags = 0 01/22/2006 00:12:32.343 42470406 Error 87 starting scanner [C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOFLOPPY /NOBOOT /DUMB /PACKED /REPORT=report.txt c:\SMARTE
RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers
Ok. Just purchased it. Thanks for the info. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of george Sent: Saturday, January 28, 2006 3:56 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers Evans, As David just said, you should be using the 32 bit version, not the 16 bit version. It still fits the 'low-budget' criteria. George -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Evans Martin Sent: Saturday, January 28, 2006 4:39 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers I'm using the old 16-bit DOS version. It only runs when Declude kicks it off. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of george Sent: Saturday, January 28, 2006 3:29 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers The F-Prot default setup does do on-access scanning. You should either disable that which is the recommended Declude method, exclude the IMail directory and sub-directories from the F-Prot On-access scan. I've enclosed excerpts from the Declude EVA Manual for your information. George 3. F-Prot Help If you are using the F-Prot virus scanner, Declude Virus uses the F- Prot command line scanner, which is included in both their DOS and Windows version (the command line scanner in both is identical). The Windows version also includes a scheduler for automated downloading of updates, which can be very useful. 3.1 Windows Version When installing the Windows version, you need to make sure that it does not install the RealTime Protector (their on-access scanner), since it can interfere with Declude's operation. To prevent it from installing, do a Full Install, and unselect the RealTime Protector. 3.2 DOS Version When installing the DOS version, you need to make sure to delete the F-Prot.PIF file that F-Prot installs (it is installed in the same directory as F-Prot.EXE). Note that if you are using Windows Explorer and have it set to hide file extensions, you may need to enable the file extensions in order to distinguish the F-Prot.PIF from the F-Prot.EXE file. 6.4 Virus scanners that delete files Declude EVA does not officially support virus scanners that scan files as they are written to the disk (on access scanners, these are not command line virus scanners). This is because we can not be sure exactly when the files are scanned, and when it is safe to assume that a file that has not been deleted is virus-free. Although they should work, we do not recommend using them. 12. Types of Virus Scanners There are two main types of virus scanners: on-access scanners, and on-demand scanners. Command-line scanners (the type Declude uses) are on-demand scanners. An on-demand scanner is run when the user requests it. It can either be a command-line scanner, or a standard Windows program. The command line scanner works well with Declude because it can be set to scan specific files, and be configured in Declude by adding command line parameters to the file name. An on-access scanner scans all files that are written to the hard drive. These usually just cause unnecessary overhead when run with Declude, as the files will end up getting scanned twice. It is possible to use an on-access scanner with Declude, although it is not recommended. Once we have done more testing to determine the safety of using on-access scanners, we may recommend this type of a setup. The problem is that Declude has no way of knowing how long to wait to determine if the scanner has scanned the file. In most cases, though, this should work. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Evans Martin Sent: Saturday, January 28, 2006 4:05 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers If ClamWin doesn't do on access scanning and it is the only virus scanner running on my system, to what can I attribute the errors in this log segment? 01/22/2006 00:11:52.187 42470405 Vulnerability flags = 0 01/22/2006 00:11:52.234 42470405 Error 87 starting scanner [C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOFLOPPY /NOBOOT /DUMB /PACKED /REPORT=report.txt c:\SMARTE~1\Spool\proc\work\42470405.vir\]; NOT SCANNING ATTACHMENTS! Error String: [The parameter is incorrect.] 01/22/2006 00:11:52.234 42470405 1 [1 of 2 not deleted
Re: [Declude.JunkMail] OT: Virus Scanning For Your Servers
I wouldn't recommend removing the /PACKED switch. Here are the switches I have been using on both of our IMail/Declude/F-Prot servers for the past couple of years without issue: C:\Progra~1\FSI\F-Prot\fpcmd.exe -AI -ARCHIVE=5 -DUMB -NOBOOT -NOBREAK -NOMEM -PACKED -SAFEREMOVE -SERVER -SILENT -REPORT=report.txt Bill - Original Message - From: David Barker [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Saturday, January 28, 2006 1:24 PM Subject: RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers 1. You should be using fpcmd.exe which is the 32bit scanner of F-Prot not the f-prot.exe which is the 16 bit version. 2. Remove the /NOFLOPPY and /PACKED options from the switches 3. Ensure that the Real Time protector of F-Prot is not installed. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Evans Martin Sent: Saturday, January 28, 2006 4:05 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers If ClamWin doesn't do on access scanning and it is the only virus scanner running on my system, to what can I attribute the errors in this log segment? 01/22/2006 00:11:52.187 42470405 Vulnerability flags = 0 01/22/2006 00:11:52.234 42470405 Error 87 starting scanner [C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOFLOPPY /NOBOOT /DUMB /PACKED /REPORT=report.txt c:\SMARTE~1\Spool\proc\work\42470405.vir\]; NOT SCANNING ATTACHMENTS! Error String: [The parameter is incorrect.] 01/22/2006 00:11:52.234 42470405 1 [1 of 2 not deleted] files were deleted. You should not use an on-access virus scanner that scans the \IMail directory or sub-directories. 01/22/2006 00:11:52.234 42470405 Scanned: Error starting scanner 01/22/2006 00:12:32.312 42470406 Vulnerability flags = 0 01/22/2006 00:12:32.343 42470406 Error 87 starting scanner [C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOFLOPPY /NOBOOT /DUMB /PACKED /REPORT=report.txt c:\SMARTE~1\Spool\proc\work\42470406.vir\]; NOT SCANNING ATTACHMENTS! Error String: [The parameter is incorrect.] 01/22/2006 00:12:32.343 42470406 1 [1 of 2 not deleted] files were deleted. You should not use an on-access virus scanner that scans the \IMail directory or sub-directories. 01/22/2006 00:12:32.343 42470406 Scanned: Error starting scanner 01/22/2006 00:12:42.437 42470407 Vulnerability flags = 0 01/22/2006 00:12:42.453 42470407 Scanned: Virus Free [Prescan OK][MIME: 1 3031] 01/22/2006 00:12:47.593 42470408 Vulnerability flags = 0 01/22/2006 00:12:47.625 42470408 Error 87 starting scanner [C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOFLOPPY /NOBOOT /DUMB /PACKED /REPORT=report.txt c:\SMARTE~1\Spool\proc\work\42470408.vir\]; NOT SCANNING ATTACHMENTS! Error String: [The parameter is incorrect.] 01/22/2006 00:12:47.625 42470408 1 [1 of 2 not deleted] files were deleted. You should not use an on-access virus scanner that scans the \IMail directory or sub-directories. 01/22/2006 00:12:47.625 42470408 Scanned: Error starting scanner 01/22/2006 00:13:27.718 42470409 Vulnerability flags = 0 01/22/2006 00:13:27.734 42470409 MIME file: [text/html][*DEFAULT*; Length=2063 Checksum=158746] 01/22/2006 00:13:27.734 42470409 Scanned: Virus Free [Prescan OK][MIME: 2 3360] 01/22/2006 00:13:47.890 42470410 Vulnerability flags = 0 01/22/2006 00:13:47.906 42470410 Error 87 starting scanner [C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOFLOPPY /NOBOOT /DUMB /PACKED /REPORT=report.txt c:\SMARTE~1\Spool\proc\work\42470410.vir\]; NOT SCANNING ATTACHMENTS! Error String: [The parameter is incorrect.] 01/22/2006 00:13:47.906 42470410 1 [1 of 2 not deleted] files were deleted. You should not use an on-access virus scanner that scans the \IMail directory or sub-directories. 01/22/2006 00:13:47.906 42470410 Scanned: Error starting scanner Thanks, Evans Martin --- EVANS MARTIN [EMAIL PROTECTED] HOSTING: http://www.martek.net PROGRAMMING: http://www.martekware.com iPlus Info Browser - IPB's IMail Migration Tool, password browser, reporting suite make IPlus Info Browser something no IMail administrator should be without. http://www.martek.net/Default.aspx?tabid=96 -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of george Sent: Saturday, January 28, 2006 12:47 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers Evans, I use F-Prot, ClamWin, AVG and NOD32, in that order. I don't use ClamWin to do scheduled scans and it doesn't do on-access scanning, so it doesn't interfere with F-Prot in any way. George -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Evans Martin Sent: Friday, January 27, 2006 9:41 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] OT: Virus Scanning
RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers
Evans, You can check the F-Prot documentation, but I don't believe that you can selectively turn off On-Access scanning. George -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Evans Martin Sent: Saturday, January 28, 2006 5:24 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers Is there any way to exclude the mail directories? I would like to leave the on access scanner running to watch the rest of the files on the server but exclude the mail processing directories. I haven't found a place to exclude directories yet. Evans Martin --- EVANS MARTIN [EMAIL PROTECTED] HOSTING: http://www.martek.net PROGRAMMING: http://www.martekware.com iPlus Info Browser - IPB's IMail Migration Tool, password browser, reporting suite make IPlus Info Browser something no IMail administrator should be without. http://www.martek.net/Default.aspx?tabid=96 -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of george Sent: Saturday, January 28, 2006 3:29 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers The F-Prot default setup does do on-access scanning. You should either disable that which is the recommended Declude method, exclude the IMail directory and sub-directories from the F-Prot On-access scan. I've enclosed excerpts from the Declude EVA Manual for your information. George 3. F-Prot Help If you are using the F-Prot virus scanner, Declude Virus uses the F-Prot command line scanner, which is included in both their DOS and Windows version (the command line scanner in both is identical). The Windows version also includes a scheduler for automated downloading of updates, which can be very useful. 3.1 Windows Version When installing the Windows version, you need to make sure that it does not install the RealTime Protector (their on-access scanner), since it can interfere with Declude's operation. To prevent it from installing, do a Full Install, and unselect the RealTime Protector. 3.2 DOS Version When installing the DOS version, you need to make sure to delete the F-Prot.PIF file that F-Prot installs (it is installed in the same directory as F-Prot.EXE). Note that if you are using Windows Explorer and have it set to hide file extensions, you may need to enable the file extensions in order to distinguish the F-Prot.PIF from the F-Prot.EXE file. 6.4 Virus scanners that delete files Declude EVA does not officially support virus scanners that scan files as they are written to the disk (on access scanners, these are not command line virus scanners). This is because we can not be sure exactly when the files are scanned, and when it is safe to assume that a file that has not been deleted is virus-free. Although they should work, we do not recommend using them. 12. Types of Virus Scanners There are two main types of virus scanners: on-access scanners, and on-demand scanners. Command-line scanners (the type Declude uses) are on-demand scanners. An on-demand scanner is run when the user requests it. It can either be a command-line scanner, or a standard Windows program. The command line scanner works well with Declude because it can be set to scan specific files, and be configured in Declude by adding command line parameters to the file name. An on-access scanner scans all files that are written to the hard drive. These usually just cause unnecessary overhead when run with Declude, as the files will end up getting scanned twice. It is possible to use an on-access scanner with Declude, although it is not recommended. Once we have done more testing to determine the safety of using on-access scanners, we may recommend this type of a setup. The problem is that Declude has no way of knowing how long to wait to determine if the scanner has scanned the file. In most cases, though, this should work. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Evans Martin Sent: Saturday, January 28, 2006 4:05 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers If ClamWin doesn't do on access scanning and it is the only virus scanner running on my system, to what can I attribute the errors in this log segment? 01/22/2006 00:11:52.187 42470405 Vulnerability flags = 0 01/22/2006 00:11:52.234 42470405 Error 87 starting scanner [C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOFLOPPY /NOBOOT /DUMB /PACKED /REPORT=report.txt c:\SMARTE~1\Spool\proc\work\42470405.vir\]; NOT SCANNING ATTACHMENTS! Error String: [The parameter is incorrect.] 01/22/2006
RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers
I found something in their FAQ that says just that. It sure would be useful if they would allow exclusions. We need to let them know that as a community. Evans Martin -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of george Sent: Saturday, January 28, 2006 4:47 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers Evans, You can check the F-Prot documentation, but I don't believe that you can selectively turn off On-Access scanning. George -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Evans Martin Sent: Saturday, January 28, 2006 5:24 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers Is there any way to exclude the mail directories? I would like to leave the on access scanner running to watch the rest of the files on the server but exclude the mail processing directories. I haven't found a place to exclude directories yet. Evans Martin --- EVANS MARTIN [EMAIL PROTECTED] HOSTING: http://www.martek.net PROGRAMMING: http://www.martekware.com iPlus Info Browser - IPB's IMail Migration Tool, password browser, reporting suite make IPlus Info Browser something no IMail administrator should be without. http://www.martek.net/Default.aspx?tabid=96 -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of george Sent: Saturday, January 28, 2006 3:29 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers The F-Prot default setup does do on-access scanning. You should either disable that which is the recommended Declude method, exclude the IMail directory and sub-directories from the F-Prot On-access scan. I've enclosed excerpts from the Declude EVA Manual for your information. George 3. F-Prot Help If you are using the F-Prot virus scanner, Declude Virus uses the F- Prot command line scanner, which is included in both their DOS and Windows version (the command line scanner in both is identical). The Windows version also includes a scheduler for automated downloading of updates, which can be very useful. 3.1 Windows Version When installing the Windows version, you need to make sure that it does not install the RealTime Protector (their on-access scanner), since it can interfere with Declude's operation. To prevent it from installing, do a Full Install, and unselect the RealTime Protector. 3.2 DOS Version When installing the DOS version, you need to make sure to delete the F-Prot.PIF file that F-Prot installs (it is installed in the same directory as F-Prot.EXE). Note that if you are using Windows Explorer and have it set to hide file extensions, you may need to enable the file extensions in order to distinguish the F-Prot.PIF from the F-Prot.EXE file. 6.4 Virus scanners that delete files Declude EVA does not officially support virus scanners that scan files as they are written to the disk (on access scanners, these are not command line virus scanners). This is because we can not be sure exactly when the files are scanned, and when it is safe to assume that a file that has not been deleted is virus-free. Although they should work, we do not recommend using them. 12. Types of Virus Scanners There are two main types of virus scanners: on-access scanners, and on-demand scanners. Command-line scanners (the type Declude uses) are on-demand scanners. An on-demand scanner is run when the user requests it. It can either be a command-line scanner, or a standard Windows program. The command line scanner works well with Declude because it can be set to scan specific files, and be configured in Declude by adding command line parameters to the file name. An on-access scanner scans all files that are written to the hard drive. These usually just cause unnecessary overhead when run with Declude, as the files will end up getting scanned twice. It is possible to use an on-access scanner with Declude, although it is not recommended. Once we have done more testing to determine the safety of using on-access scanners, we may recommend this type of a setup. The problem is that Declude has no way of knowing how long to wait to determine if the scanner has scanned the file. In most cases, though, this should work. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Evans Martin Sent: Saturday, January 28, 2006 4:05 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Virus
[Declude.JunkMail] OT: Virus Scanning For Your Servers
What do you guys use for virus protection on your servers? I am trying to use ClamWin but it is competing with Declude Virus/FProt. I looked for a place to exclude my mail folders and it doesnt seem to allow directories to be excluded, only filenames. Im trying to stay open source or really cheap because of the number of machines that I have and Clam has always worked well on my X machines. Thanks, Evans Martin EVANS MARTIN [EMAIL PROTECTED] HOSTING: http://www.martek.net PROGRAMMING: http://www.martekware.com iPlus Info Browser IPBs IMail Migration Tool, password browser, reporting suite make IPlus Info Browser something no IMail administrator should be without. http://www.martek.net/Default.aspx?tabid=96
Re: [Declude.JunkMail] OT: Virus Scanning For Your Servers
What do you guys use for virus protection on your servers? I'm down with NOD32 these days. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.imprimia.com/products/software/freeutils/exchange2aliases/download/release/ http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/release/ --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
