I've just looked in to the V2 code and I'm missing a line
($this->{averror}=$AvError . " - $res";) - I think while doing some
cosmetics after testing, I've deleted this line, so the SMTP responds is
wrong for this reason.
The code is ported from V2 in to V1 - and you are right, &ThreadYield() is
only available (and needed) in V2 - Fritz will change this.
>FileScanBad:=Infected files: [1-9]+
>FileScanGood:=Infected files: 0
If you are using both - both must match / not match! The checks are :
failed if FileScanBad is defined and matches
failed if FileScanGood is defined and does not match <- this is the case
in your log
so defining both, does not make sense in 95% cases.
>The FileScanBad regex matches erroneously
>to: [email protected] diagnostic: FileScan returned <- here should follow
the returned string !!!!
What should we do, if nothing returns from the command?
I recommend writing your own small shell script to do the scan stuff and
writing there some usefull strings to STDOUT or STDERR!
Thomas
"Steve Moss" <[email protected]>
22.03.2009 11:30
Bitte antworten an
ASSP development mailing list <[email protected]>
An
<[email protected]>
Kopie
Thema
[Assp-test] Here's Just How Bad DoFileScan Is
OK, here's a more comprehensive report of the multiple problems with
DoFileScan in ASSP 1.5.1.0 0.08.
1. asspl.pl contains calls to $ThreadYield(), on lines 17786 and 17794,
but $ThreadYield is not defined anywhere. For further testing I
commented out these two bad lines.
2. The FileScanBad regex matches erroneously, as the following log lines
suggest (email addresses changed for privacy reasons):
Mar-22-09 10:09:34 id-16573-07653 65.54.246.175 <[email protected]>
to: [email protected] MessageScore is now -25, after adding -25 (SPFpass)
Mar-22-09 10:09:34 id-16573-07653 65.54.246.175 <[email protected]>
to: [email protected] diagnostic: FileScan will run
Mar-22-09 10:09:34 id-16573-07653 65.54.246.175 <[email protected]>
to: [email protected] diagnostic: FileScan returned
Mar-22-09 10:09:34 id-16573-07653 65.54.246.175 <[email protected]>
to: [email protected] FileScan: scanned 4069 bytes in whitelisted message
Mar-22-09 10:09:34 id-16573-07653 65.54.246.175 <[email protected]>
to: [email protected] MessageScore is now 25, after adding 50 (virus
detected: 'FileScan' - )
Mar-22-09 10:09:34 id-16573-07653 [VIRUS] 65.54.246.175
<[email protected]> to: [email protected] [spam found] (virus
detected: 'FileScan' - ) [Test];
The relevant config settings are as follows:
DoFileScan:=1
FileScanDir:=d:\assp\virusscan
FileScanCMD:="C:\Program Files\ClamWin\bin\ClamScan.exe" -d
"C:\Documents and Settings\All Users\.clamwin\db" --remove --stdout
FILENAME
FileScanBad:=Infected files: [1-9]+
FileScanGood:=Infected files: 0
3. ASSP returns an invalid SMTP response to the sending MTA, as seen
here by the NDR generated by the sender's MTA:
Reporting-MTA: dns;bay0-omc2-s39.bay0.hotmail.com
Received-From-MTA: dns;BAY116-W52
Arrival-Date: Sun, 22 Mar 2009 03:09:32 -0700
Final-Recipient: rfc822;[email protected]
Action: failed
Status: 5.5.0
Diagnostic-Code: smtp;500 Non RFC-compliant response received
----
It is clear this code has not been tested in the slightest, and I am
amazed it could be offered as part of a so-called RC release.
------------------------------------------------------------------------------
Apps built with the Adobe(R) Flex(R) framework and Flex Builder(TM) are
powering Web 2.0 with engaging, cross-platform capabilities. Quickly and
easily build your RIAs with Flex Builder, the Eclipse(TM)based development
software that enables intelligent coding and step-through debugging.
Download the free 60 day trial. http://p.sf.net/sfu/www-adobe-com
_______________________________________________
Assp-test mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-test
DISCLAIMER:
*******************************************************
This email and any files transmitted with it may be confidential, legally
privileged and protected in law and are intended solely for the use of the
individual to whom it is addressed.
This email was multiple times scanned for viruses. There should be no
known virus in this email!
*******************************************************
------------------------------------------------------------------------------
Apps built with the Adobe(R) Flex(R) framework and Flex Builder(TM) are
powering Web 2.0 with engaging, cross-platform capabilities. Quickly and
easily build your RIAs with Flex Builder, the Eclipse(TM)based development
software that enables intelligent coding and step-through debugging.
Download the free 60 day trial. http://p.sf.net/sfu/www-adobe-com
_______________________________________________
Assp-test mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-test
