The F-Prot default setup does do on-access scanning. You should either
disable that which is the recommended Declude method, exclude the IMail
directory and sub-directories from the F-Prot On-access scan. I've enclosed
excerpts from the Declude EVA Manual for your information.
George
3. F-Prot Help
If you are using the F-Prot virus scanner, Declude Virus uses the F-Prot
command line scanner, which is included in both their DOS and Windows
version (the command line scanner in both is identical). The Windows version
also includes a scheduler for automated downloading of updates, which can be
very useful.
3.1 Windows Version
When installing the Windows version, you need to make sure that it does not
install the "RealTime Protector" (their on-access scanner), since it can
interfere with Declude's operation. To prevent it from installing, do a Full
Install, and unselect the "RealTime Protector".
3.2 DOS Version
When installing the DOS version, you need to make sure to delete the
F-Prot.PIF file that F-Prot installs (it is installed in the same directory
as F-Prot.EXE). Note that if you are using Windows Explorer and have it set
to hide file extensions, you may need to enable the file extensions in order
to distinguish the F-Prot.PIF from the F-Prot.EXE file.
6.4 Virus scanners that delete files
Declude EVA does not officially support virus scanners that scan files as
they are written to the disk ("on access" scanners, these are not command
line virus scanners). This is because we can not be sure exactly when the
files are scanned, and when it is safe to assume that a file that has not
been deleted is virus-free. Although they should work, we do not recommend
using them.
12. Types of Virus Scanners
There are two main types of virus scanners: on-access scanners, and
on-demand scanners. Command-line scanners (the type Declude uses) are
on-demand scanners.
An on-demand scanner is run when the user requests it. It can either be a
command-line scanner, or a standard Windows program. The command line
scanner works well with Declude because it can be set to scan specific
files, and be configured in Declude by adding command line parameters to the
file name.
An on-access scanner scans all files that are written to the hard drive.
These usually just cause unnecessary overhead when run with Declude, as the
files will end up getting scanned twice.
It is possible to use an on-access scanner with Declude, although it is not
recommended. Once we have done more testing to determine the safety of using
on-access scanners, we may recommend this type of a setup. The problem is
that Declude has no way of knowing how long to wait to determine if the
scanner has scanned the file. In most cases, though, this should work.
> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Evans Martin
> Sent: Saturday, January 28, 2006 4:05 PM
> To: [email protected]
> Subject: RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers
>
> If ClamWin doesn't do on access scanning and it is the only virus scanner
> running on my system, to what can I attribute the errors in this log
> segment?
>
> 01/22/2006 00:11:52.187 42470405 Vulnerability flags = 0
> 01/22/2006 00:11:52.234 42470405 Error 87 starting scanner
> [C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5
> /NOFLOPPY
> /NOBOOT /DUMB /PACKED /REPORT=report.txt
> c:\SMARTE~1\Spool\proc\work\42470405.vir\]; NOT SCANNING ATTACHMENTS!
> Error
> String: [The parameter is incorrect.]
> 01/22/2006 00:11:52.234 42470405 1 [1 of 2 not deleted] files were
> deleted.
> You should not use an on-access virus scanner that scans the \IMail
> directory or sub-directories.
> 01/22/2006 00:11:52.234 42470405 Scanned: Error starting scanner
> 01/22/2006 00:12:32.312 42470406 Vulnerability flags = 0
> 01/22/2006 00:12:32.343 42470406 Error 87 starting scanner
> [C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5
> /NOFLOPPY
> /NOBOOT /DUMB /PACKED /REPORT=report.txt
> c:\SMARTE~1\Spool\proc\work\42470406.vir\]; NOT SCANNING ATTACHMENTS!
> Error
> String: [The parameter is incorrect.]
> 01/22/2006 00:12:32.343 42470406 1 [1 of 2 not deleted] files were
> deleted.
> You should not use an on-access virus scanner that scans the \IMail
> directory or sub-directories.
> 01/22/2006 00:12:32.343 42470406 Scanned: Error starting scanner
> 01/22/2006 00:12:42.437 42470407 Vulnerability flags = 0
> 01/22/2006 00:12:42.453 42470407 Scanned: Virus Free [Prescan OK][MIME: 1
> 3031]
> 01/22/2006 00:12:47.593 42470408 Vulnerability flags = 0
> 01/22/2006 00:12:47.625 42470408 Error 87 starting scanner
> [C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5
> /NOFLOPPY
> /NOBOOT /DUMB /PACKED /REPORT=report.txt
> c:\SMARTE~1\Spool\proc\work\42470408.vir\]; NOT SCANNING ATTACHMENTS!
> Error
> String: [The parameter is incorrect.]
> 01/22/2006 00:12:47.625 42470408 1 [1 of 2 not deleted] files were
> deleted.
> You should not use an on-access virus scanner that scans the \IMail
> directory or sub-directories.
> 01/22/2006 00:12:47.625 42470408 Scanned: Error starting scanner
> 01/22/2006 00:13:27.718 42470409 Vulnerability flags = 0
> 01/22/2006 00:13:27.734 42470409 MIME file: [text/html][*DEFAULT*;
> Length=2063 Checksum=158746]
> 01/22/2006 00:13:27.734 42470409 Scanned: Virus Free [Prescan OK][MIME: 2
> 3360]
> 01/22/2006 00:13:47.890 42470410 Vulnerability flags = 0
> 01/22/2006 00:13:47.906 42470410 Error 87 starting scanner
> [C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE=5
> /NOFLOPPY
> /NOBOOT /DUMB /PACKED /REPORT=report.txt
> c:\SMARTE~1\Spool\proc\work\42470410.vir\]; NOT SCANNING ATTACHMENTS!
> Error
> String: [The parameter is incorrect.]
> 01/22/2006 00:13:47.906 42470410 1 [1 of 2 not deleted] files were
> deleted.
> You should not use an on-access virus scanner that scans the \IMail
> directory or sub-directories.
> 01/22/2006 00:13:47.906 42470410 Scanned: Error starting scanner
>
> Thanks,
> Evans Martin
>
> ---
> EVANS MARTIN <[EMAIL PROTECTED]>
> HOSTING: http://www.martek.net
> PROGRAMMING: http://www.martekware.com
>
> iPlus Info Browser - IPB's IMail Migration Tool, password browser,
> reporting
> suite make IPlus Info Browser something no IMail administrator should be
> without. http://www.martek.net/Default.aspx?tabid=96
>
>
> > -----Original Message-----
> > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> > [EMAIL PROTECTED] On Behalf Of george
> > Sent: Saturday, January 28, 2006 12:47 PM
> > To: [email protected]
> > Subject: RE: [Declude.JunkMail] OT: Virus Scanning For Your Servers
> >
> > Evans,
> >
> > I use F-Prot, ClamWin, AVG and NOD32, in that order.
> >
> > I don't use ClamWin to do scheduled scans and it doesn't do on-access
> > scanning, so it doesn't interfere with F-Prot in any way.
> >
> > George
> >
> > > -----Original Message-----
> > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> > > [EMAIL PROTECTED] On Behalf Of Evans Martin
> > > Sent: Friday, January 27, 2006 9:41 PM
> > > To: [email protected]
> > > Subject: [Declude.JunkMail] OT: Virus Scanning For Your Servers
> > >
> > > What do you guys use for virus protection on your servers? I am
> trying
> > to
> > > use ClamWin but it is competing with Declude Virus/FProt. I looked
> for
> > a
> > > place to exclude my mail folders and it doesn't seem to allow
> > directories
> > > to be excluded, only filenames. I'm trying to stay open source or
> > really
> > > cheap because of the number of machines that I have and Clam has
> always
> > > worked well on my X machines.
> > >
> > >
> > >
> > > Thanks,
> > >
> > > Evans Martin
> > >
> > >
> > >
> > > EVANS MARTIN [EMAIL PROTECTED]
> > >
> > > HOSTING: http://www.martek.net <http://www.martek.net/>
> > >
> > > PROGRAMMING: http://www.martekware.com <http://www.martekware.com/>
> > >
> > >
> > >
> > > iPlus Info Browser - IPB's IMail Migration Tool, password browser,
> > > reporting suite make IPlus Info Browser something no IMail
> administrator
> > > should be without. http://www.martek.net/Default.aspx?tabid=96
> > >
> > >
> >
> >
> > ---
> > [This E-mail was scanned for viruses by Declude EVA www.declude.com]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list. To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail". The archives can be found
> > at http://www.mail-archive.com.
> > ---
> > [This E-mail scanned for viruses by Declude Virus]
>
>
>
> ---
> [This E-mail scanned for viruses by Declude Virus]
>
>
> ---
> [This E-mail scanned for viruses by Declude Virus]
>
> ---
> [This E-mail was scanned for viruses by Declude EVA www.declude.com]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail". The archives can be found
> at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
