I changed the lines as you had in the email and still test virus comes through. So I take out the line and works fine. So here is a copy of the config again and the log with both scanners when it is not catching and a log with the original setup that works
Paul Ingram CI Travel, IT Systems Analyst 888.461.0022 ext.826 mailto:[EMAIL PROTECTED]
01/31/2002 16:27:23 Qb6b92c8 Scanned: Error starting scanner 01/31/2002 16:27:38 Qb6c82c8 Your virus scanner DOES NOT EXIST (at C:\Progra~1\FSI\F-Prot2\F-Prot.exe /TYPE /SILENT /NOMEM/ARCHIVE /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt d:\Imail\spool\Db6c82c8.vir\); NOT SCANNING ATTACHMENTS! [3] 01/31/2002 16:27:38 Qb6c82c8 Scanned: Error starting scanner 01/31/2002 16:28:00 Qb6df2c8 Scanner 1: Virus=: EICAR test file NOT a virus. Attachment= [-858993460] 01/31/2002 16:28:00 Qb6df2c8 File(s) are INFECTED [13] 01/31/2002 16:28:00 Qb6df2c8 Scanned: CONTAINS A VIRUS [MIME: 2 594] 01/31/2002 16:28:00 Qb6df2c8 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] 01/31/2002 16:28:00 Qb6df2c8 Subject: Test eicar.com file [eicarzip] 01/31/2002 16:28:23 Qb6f6112 Scanner 1: Virus=: EICAR test file NOT a virus. Attachment=[BinHex Attachment] [1] 01/31/2002 16:28:23 Qb6f6112 Found a bogus .com file 01/31/2002 16:28:23 Qb6f6112 File(s) are INFECTED [13] 01/31/2002 16:28:24 Qb6f6112 Scanned: CONTAINS A VIRUS [BINHEX: 1 105] 01/31/2002 16:28:24 Qb6f6112 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] 01/31/2002 16:28:24 Qb6f6112 Subject: Test eicar.com file [eicarbinhex]
01/31/2002 16:21:42 Qb56325c Your virus scanner DOES NOT EXIST (at C:\Progra~1\FSI\F-Prot2\F-Prot.exe /TYPE /SILENT /NOMEM/ARCHIVE /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt d:\Imail\spool\Db56325c.vir\); NOT SCANNING ATTACHMENTS! [3] 01/31/2002 16:21:42 Qb56325c Scanned: Error starting scanner 01/31/2002 16:21:43 Qb56425c Your virus scanner DOES NOT EXIST (at C:\Progra~1\FSI\F-Prot2\F-Prot.exe /TYPE /SILENT /NOMEM/ARCHIVE /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt d:\Imail\spool\Db56425c.vir\); NOT SCANNING ATTACHMENTS! [3] 01/31/2002 16:21:43 Qb56425c Scanned: Error starting scanner 01/31/2002 16:21:43 Qb56428a Your virus scanner DOES NOT EXIST (at C:\Progra~1\FSI\F-Prot2\F-Prot.exe /TYPE /SILENT /NOMEM/ARCHIVE /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt d:\Imail\spool\Db56428a.vir\); NOT SCANNING ATTACHMENTS! [3] 01/31/2002 16:21:43 Qb56428a Scanned: Error starting scanner 01/31/2002 16:21:44 Qb56514e Your virus scanner DOES NOT EXIST (at C:\Progra~1\FSI\F-Prot2\F-Prot.exe /TYPE /SILENT /NOMEM/ARCHIVE /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt d:\Imail\spool\Db56514e.vir\); NOT SCANNING ATTACHMENTS! [3] 01/31/2002 16:21:44 Qb56514e Scanned: Error starting scanner 01/31/2002 16:22:09 Qb57e144 Your virus scanner DOES NOT EXIST (at C:\Progra~1\FSI\F-Prot2\F-Prot.exe /TYPE /SILENT /NOMEM/ARCHIVE /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt d:\Imail\spool\Db57e144.vir\); NOT SCANNING ATTACHMENTS! [3] 01/31/2002 16:22:09 Qb57e144 Scanned: Error starting scanner 01/31/2002 16:22:14 Qb58424e Your virus scanner DOES NOT EXIST (at C:\Progra~1\FSI\F-Prot2\F-Prot.exe /TYPE /SILENT /NOMEM/ARCHIVE /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt d:\Imail\spool\Db58424e.vir\); NOT SCANNING ATTACHMENTS! [3] 01/31/2002 16:22:14 Qb58424e Scanned: Error starting scanner 01/31/2002 16:22:22 Qb58c20a Your virus scanner DOES NOT EXIST (at C:\Progra~1\FSI\F-Prot2\F-Prot.exe /TYPE /SILENT /NOMEM/ARCHIVE /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt d:\Imail\spool\Db58c20a.vir\); NOT SCANNING ATTACHMENTS! [3] 01/31/2002 16:22:22 Qb58c20a Scanned: Error starting scanner 01/31/2002 16:22:33 Qb598346 Your virus scanner DOES NOT EXIST (at C:\Progra~1\FSI\F-Prot2\F-Prot.exe /TYPE /SILENT /NOMEM/ARCHIVE /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt d:\Imail\spool\Db598346.vir\); NOT SCANNING ATTACHMENTS! [3] 01/31/2002 16:22:33 Qb598346 Scanned: Error starting scanner 01/31/2002 16:22:36 Qb59b1f8 Your virus scanner DOES NOT EXIST (at C:\Progra~1\FSI\F-Prot2\F-Prot.exe /TYPE /SILENT /NOMEM/ARCHIVE /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt d:\Imail\spool\Db59b1f8.vir\); NOT SCANNING ATTACHMENTS! [3] 01/31/2002 16:22:36 Qb59b1f8 Scanned: Error starting scanner 01/31/2002 16:23:52 Qb5e60c8 Your virus scanner DOES NOT EXIST (at C:\Progra~1\FSI\F-Prot2\F-Prot.exe /TYPE /SILENT /NOMEM/ARCHIVE /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt d:\Imail\spool\Db5e60c8.vir\); NOT SCANNING ATTACHMENTS! [3] 01/31/2002 16:23:52 Qb5e60c8 Scanned: Error starting scanner 01/31/2002 16:24:04 Qb5f20d0 Your virus scanner DOES NOT EXIST (at C:\Progra~1\FSI\F-Prot2\F-Prot.exe /TYPE /SILENT /NOMEM/ARCHIVE /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt d:\Imail\spool\Db5f20d0.vir\); NOT SCANNING ATTACHMENTS! [3] 01/31/2002 16:24:04 Qb5f20d0 Scanned: Error starting scanner 01/31/2002 16:24:34 Qb61123a Your virus scanner DOES NOT EXIST (at C:\Progra~1\FSI\F-Prot2\F-Prot.exe /TYPE /SILENT /NOMEM/ARCHIVE /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt d:\Imail\spool\Db61123a.vir\); NOT SCANNING ATTACHMENTS! [3] 01/31/2002 16:24:35 Qb61123a Scanned: Error starting scanner 01/31/2002 16:24:55 Qb62528c Scanner 1: Virus=: EICAR test file NOT a virus. Attachment= [-858993460] 01/31/2002 16:24:55 Qb62528c Your virus scanner DOES NOT EXIST (at C:\Progra~1\FSI\F-Prot2\F-Prot.exe /TYPE /SILENT /NOMEM/ARCHIVE /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt d:\Imail\spool\Db62528c.vir\); NOT SCANNING ATTACHMENTS! [3] 01/31/2002 16:24:55 Qb62528c Could not find parse string Infection in report.txt 01/31/2002 16:24:55 Qb62528c Scanned: Error starting scanner 01/31/2002 16:25:13 Qb6382b8 Your virus scanner DOES NOT EXIST (at C:\Progra~1\FSI\F-Prot2\F-Prot.exe /TYPE /SILENT /NOMEM/ARCHIVE /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt d:\Imail\spool\Db6382b8.vir\); NOT SCANNING ATTACHMENTS! [3] 01/31/2002 16:25:13 Qb6382b8 Scanned: Error starting scanner
# The "####" in the LOGFILE option automatically gets replaced with the month/date LOGFILE D:\IMail\spool\declude_log\vir####.log LOGLEVEL MID CONSOLE OFF LOG_OK NONE # # SCANFILE is the location of the command-line virus scanner. Note that it # must include the full path. VIRUSCODE is the code that scanner returns if # it finds a virus. # SCANFILE C:\progra~1\common~1\networ~1\viruss~1\4.0.xx\scan.exe /ALL/NOMEM/NOBEEP/NOBREAK/UNZIP/SILENT/NODDA/REPORT report.txt VIRUSCODE 13 REPORT1 Found SCANFILE2 C:\Progra~1\FSI\F-Prot2\F-Prot.exe /TYPE /SILENT /NOMEM/ARCHIVE /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt VIRUSCODE2 3 VIRUSCODE2 6 VIRUSCODE2 8 REPORT2 Infection # VIRDIR is the directory to move E-mails with viruses; by default, # it is set to 'virus' (\IMail\spool\virus). VIRDIR D:\IMail\spool\virus # The MAXATONCE option limits the number of AV processes. For example, # MAXATONCE 1 will only allow 1 AV process to run at once (IE for licensing # purposes). A value of 0 (or commenting it out) allows unlimited processes # to run at the same time. MAXATONCE 0 # # The following options allow you to limit scanning to only incoming or outgoing # E-mail. # INCOMING ON OUTGOING ON # # The ONACCESS option should be set to OFF unless you have an on-access virus scanner # that will be deleting attachments with viruses. # ONACCESS OFF # # The SCANNERTIMEOUT option lets you choose the number of seconds that Declude will # wait for the virus scanner to finish. The minimum value is 10 seconds. Most # scanners will not need to take that long. This option is mainly to prevent # defective scanners (that never finish) from interfering with your outgoing E-mail. # Raising this will NOT help if your virus scanner always times out. # SCANNERTIMEOUT 30 # # The SKIPEXT option will let you skip scanning of certain file extensions. For # example, a GIF file can't contain a virus, so there is no need to scan it. # SKIPEXT GIF SKIPEXT TXT SKIPEXT JPG SKIPEXT MPG SKIPEXT PNG # # The BANEXT option will let you ban file extensions. E-mails containing attachments # with these file extensions will be quarantined, and if you have a BANnotify.EML file # (version 1.29 and higher), it will be sent out. # BANEXT pif BANEXT vbs BANEXT lnk BANEXT scr BANEXT shs BANEXT wsh BANEXT vbx BANEXT bat BANEXT cab BANEXT nws BANEXT asp BANEXT dll BANEXT cmd BANEXT xml BANEXT sys BANEXT swf BANEXT asd BANEXT chm BANEXT ocx BANEXT vbe BANEXT wsf BANEXT js BANEXT com BANEXT exe # # Declude Virus Pro v1.27 and higher allow you to pre-scan HTML files. If no dangerous # code is detected, the virus scanner will not get called. This can cut down on CPU usage # tremendously. # PRESCAN ON # # Declude Virus v1.29 and higher can block treat files using CLSID extensions as viruses. # This type of extension will force a certain type of program to be run, while making the # file appear to be a .TXT or other safe file. There is no known legitimate reason to # send this type of file through E-mail. # BANCLSID ON # # The FOOTER lines will add a footer to the bottom of E-mails that are scanned. v1.30 and higher. # FOOTER --- FOOTER [This E-mail scanned for viruses by Declude Virus/McAfee] # # The DELETEVIRUSES option, when set to ON, will delete viruses, rather than quarantine them. # It is recommended to leave this at OFF. Works with v1.30 and higher. # DELETEVIRUSES OFF # # The DELIVERERRORS option, when set to ON, will treat errors from the virus scanner as if no # virus was found. When set to ON, this could cause viruses to get through in rare situations, # but will also prevent legitimate mail from being quarantined due to an error in the scanner. # It is recommend to leave this at ON. Works with v1.30 and higher. # DELIVERERRORS ON
