Re: [Declude.Virus] F-prot 3.14c Error 5
Got this from frisk today any Dear Serge, According to our development team, no changes were done to the error codes in our command line scanners. Error code '5' generally means Scan aborted by Ctrl+C or Esc. - Original Message - From: David Dodell [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, February 27, 2004 11:35 PM Subject: Re: [Declude.Virus] F-prot 3.14c Error 5 Hiw does one determine if they are are having this problem? Version 3.14c seems fine to me You'll see the Error 5 in your declude virus log. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] F-prot 3.14c Error 5
Somehow I don't think the server is generating those by itself...grin. I've used the no changes line many times myself...I've been wrong more than I've been right in that dept. Darin. - Original Message - From: Serge [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Sunday, February 29, 2004 2:35 PM Subject: Re: [Declude.Virus] F-prot 3.14c Error 5 Got this from frisk today any Dear Serge, According to our development team, no changes were done to the error codes in our command line scanners. Error code '5' generally means Scan aborted by Ctrl+C or Esc. - Original Message - From: David Dodell [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, February 27, 2004 11:35 PM Subject: Re: [Declude.Virus] F-prot 3.14c Error 5 Hiw does one determine if they are are having this problem? Version 3.14c seems fine to me You'll see the Error 5 in your declude virus log. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. _ [This E-mail virus scanned by 4C Web] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] F-prot 3.14c Error 5
Scott, if Declude Virus encounters an Error 5 with scanner 1, does it not even attempt to run the message through the second scanner? Normal virus detected without Error 5: = 02/25/2004 05:32:05 Qa3d35c70b2d0 Scanner 1: Virus= W32/[EMAIL PROTECTED] Attachment=part3.zip [14] O 02/25/2004 05:32:05 Qa3d35c70b2d0 Scanner 2: Virus= [ WORM_MYDOOM.F](1) in M:\IMail\spool\DA3D35~1.VIR\0.zip,(part3.jpg.pif) Attachment=part3.zip [14] O 02/25/2004 05:32:05 Qa3d35c70b2d0 File(s) are INFECTED [ W32/[EMAIL PROTECTED]: 1] 02/25/2004 05:32:05 Qa3d35c70b2d0 Scanned: CONTAINS A VIRUS [MIME: 2 35275] 02/25/2004 05:32:05 Qa3d35c70b2d0 From: [Forged] To: [EMAIL PROTECTED] [outgoing from 204.189.38.3] 02/25/2004 05:32:05 Qa3d35c70b2d0 Subject: Read now! = Virus detected with Error 5: = 02/25/2004 08:50:21 Qd23b256a001cfa29 Could not find parse string Infection: in report.txt 02/25/2004 08:50:21 Qd23b256a001cfa29 Error 5 in virus scanner 1. 02/25/2004 08:50:23 Qd23b256a001cfa29 Scanned: Error in virus scanner. [MIME: 2 5911] = The second scanner is not called? Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] F-prot 3.14c Error 5
Scott, if Declude Virus encounters an Error 5 with scanner 1, does it not even attempt to run the message through the second scanner? It should call both scanners, no matter what. 02/25/2004 08:50:21 Qd23b256a001cfa29 Could not find parse string Infection: in report.txt 02/25/2004 08:50:21 Qd23b256a001cfa29 Error 5 in virus scanner 1. 02/25/2004 08:50:23 Qd23b256a001cfa29 Scanned: Error in virus scanner. [MIME: 2 5911] Here, you see the Error 5 in virus scanner 1 since there was an error detected. The Scanned: line reports the error instead of Virus Free (even though *both* occurred, due to the multiple scanners). Note the file size of 5,911 bytes, so this one almost certainly did not have an actual virus. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] F-prot 3.14c Error 5
We're seeing the same thing David did - random error 5's on the newest F-prot. I backed off to the previous version. Is there a way to rescan the error 5's using Declude from the command line if I create a batch file? You could try copying the files back to the spool directory, and then running Declude Virus from a batch file, like: d:\IMail\declude.exe D:\IMail\spool\Q1234567.SMD Note that IMail may try delivering the E-mails on the next queue run, if you did not call Declude Virus quickly enough. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] F-prot 3.14c Error 5
We're seeing the same thing David did - random error 5's on the newest F-prot. I backed off to the previous version. Same thing here. While going back to 3.14b I've noticed that the missing fpcmd.exe causes the following lines in the logfile: (3.14c must be removed before reinstalling 3.14b) 02/25/2004 18:27:47 Qdb13034400eaacd3 Your virus scanner DOES NOT EXIST (at C:\Progra~1\FSI\F-Prot\fpcmd.exe ... NOT SCANNING ATTACHMENTS! [2] 02/25/2004 18:27:47 Qdb13034400eaacd3 Scanned: Error starting scanner Stop. And the second scanner? Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] F-prot 3.14c Error 5
Can Declude be run from a folder other than the main IMail spool folder? - in which case a good message would not be moved to a virus subfolder. Alternatively, can I temporarily stop the queue manager to run the scan? Thanks, You could try copying the files back to the spool directory, and then running Declude Virus from a batch file, like: d:\IMail\declude.exe D:\IMail\spool\Q1234567.SMD Note that IMail may try delivering the E-mails on the next queue run, if you did not call Declude Virus quickly enough. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] F-prot 3.14c Error 5
Can Declude be run from a folder other than the main IMail spool folder? - in which case a good message would not be moved to a virus subfolder. The Declude.exe file should be in the \IMail directory, and the scanned files really should be in the spool. Using other directories may work, but is not recommended. Alternatively, can I temporarily stop the queue manager to run the scan? Yes, that should work. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
