Is the virus being replaced ?
Thomas
Von: Louis Carreiro <quantumsch...@outlook.com>
An: ASSP Mailing List <assp-user@lists.sourceforge.net>,
Datum: 03.04.2013 21:09
Betreff: Re: [Assp-user] Antwort: Re: ASSP_AFC plugin and EICAR
Right... that's what I wanted. What I'm not seeing is anything showing up
in the ClamAV logs like with the regular ClamAV module. Also, its not
catching and scoring and the spam emails with the sanesecurity databases.
Its like nothing is getting moved over to the ClamAV socket.
v/r,
Louis
----------------------------------------
To: assp-user@lists.sourceforge.net
From: thomas.ecka...@thockar.com
Date: Wed, 3 Apr 2013 20:54:45 +0200
Subject: [Assp-user] Antwort: Re: ASSP_AFC plugin and EICAR
>ASSP_AFCReplViriParts:=1
This will replace the virus by a text file !
Thomas
Von: Louis Carreiro <quantumsch...@outlook.com>
An: ASSP Mailing List <assp-user@lists.sourceforge.net>,
Datum: 03.04.2013 20:38
Betreff: Re: [Assp-user] ASSP_AFC plugin and EICAR
Thomas,
Thanks for the quick reply. For the settings are as follows:
DoASSP_AFC:=1
ASSP_AFCSelect:=3
ASSP_AFCPriority:=6
ASSP_AFCReplBadAttach:=
ASSP_AFCReplBadAttachText:=The attached file (FILENAME) was removed from
this email by ASSP for policy reasons!
ASSP_AFCReplViriParts:=1
ASSP_AFCReplViriPartsText:=There was a virus removed from this email
(attachment FILENAME) by ASSP!
ASSP_AFCMSGSIZEscore:=
ASSP_AFCDetectSpamAttachRe:=file:files/ASSP_AFCDetectSpamAttachReimage.txt
ASSP_AFCWebScript:=
ASSP_AFCinsize:=1024
ASSP_AFCoutsize:=1024
I've tried ASSP_AFCinsize to 10 as well with same result.
v/r,
Louis
>what are the stting for the AFC-plugin ?
>
>Thomas
> From: quantumsch...@outlook.com
> To: assp-user@lists.sourceforge.net
> Date: Wed, 3 Apr 2013 10:20:42 -0400
> Subject: [Assp-user] ASSP_AFC plugin and EICAR
>
> Hey all,
>
> With everything running okay on my new ASSPv2 implementation, I started
adding in the plugins. ASSP_OCR and ASSP_DCC are bothing running
flawlessly. The problem I'm having is with the ASSP_AFC plugin. I
currently have the ClamAV plugin working extremely well and I'm pulling
down the SaneSecurity DB's and its pulling all sorts of spam out. When I
turn on ASSP_AFC, everything from a ClamAV perspective gets quiet. I've
tried sending a plain text email through with the EICAR string in the body
and it doesn't get it. If I disble the ASSP_AFC plugin and let the ClamAV
plugin take back over, it catches it. I'm not quite sure where to go with
this... Any help would be greatly appreciated!
>
> Thanks in advance!
> Louis
>
------------------------------------------------------------------------------
> Minimize network downtime and maximize team effectiveness.
> Reduce network management and security costs.Learn how to hire
> the most talented Cisco Certified professionals. Visit the
> Employer Resources Portal
> http://www.cisco.com/web/learning/employer_resources/index.html
> _______________________________________________
> Assp-user mailing list
> Assp-user@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/assp-user
------------------------------------------------------------------------------
Minimize network downtime and maximize team effectiveness.
Reduce network management and security costs.Learn how to hire
the most talented Cisco Certified professionals. Visit the
Employer Resources Portal
http://www.cisco.com/web/learning/employer_resources/index.html
_______________________________________________
Assp-user mailing list
Assp-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-user
DISCLAIMER:
*******************************************************
This email and any files transmitted with it may be confidential, legally
privileged and protected in law and are intended solely for the use of the
individual to whom it is addressed.
This email was multiple times scanned for viruses. There should be no
known virus in this email!
*******************************************************
------------------------------------------------------------------------------
Minimize network downtime and maximize team effectiveness.
Reduce network management and security costs.Learn how to hire
the most talented Cisco Certified professionals. Visit the
Employer Resources Portal
http://www.cisco.com/web/learning/employer_resources/index.html
_______________________________________________
Assp-user mailing list
Assp-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-user
------------------------------------------------------------------------------
Minimize network downtime and maximize team effectiveness.
Reduce network management and security costs.Learn how to hire
the most talented Cisco Certified professionals. Visit the
Employer Resources Portal
http://www.cisco.com/web/learning/employer_resources/index.html
_______________________________________________
Assp-user mailing list
Assp-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-user
DISCLAIMER:
*******************************************************
This email and any files transmitted with it may be confidential, legally
privileged and protected in law and are intended solely for the use of the
individual to whom it is addressed.
This email was multiple times scanned for viruses. There should be no
known virus in this email!
*******************************************************
------------------------------------------------------------------------------
Minimize network downtime and maximize team effectiveness.
Reduce network management and security costs.Learn how to hire
the most talented Cisco Certified professionals. Visit the
Employer Resources Portal
http://www.cisco.com/web/learning/employer_resources/index.html
_______________________________________________
Assp-user mailing list
Assp-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-user
