RE: [Declude.Virus] MAXATONCE Switch

[Douglas Cohn]

I am also using /SERVER and /ARCHIVE=5   I have no idea if it is doing anything worthwhile but it has not created any false positives so I leave it in.  I actually got the config from users on this list.   I am being cautious regarding Viruscode 8 and excel and word files.  So far so good.   SCANFILE  C:\Progra~1\FSI\F-Prot\Fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE=5 /NOBOOT /DUMB /SERVER /REPORT=report.txt)   VIRUSCODE 3 VIRUSCODE 6 VIRUSCODE 8 REPORT    Infection: From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Panda Consulting S.A. Luis Alberto Arango Sent: Saturday, April 17, 2004 12:38 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] MAXATONCE Switch The switch you should remove is /NOFLOPPY if you are using fpcmd.exe. Otherwise an error in the virus log will show up like this 1 [1 of 2 not deleted] files were deleted   here is my new configuration with fprot 32 bits. And it works fine. SCANFILE [PATH]fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOBOOT /DUMB /REPORT=report.txt   [PATH]=where ever you fpcmd.exe is in your server.   In one post in the list a while ago, Scott suggested to remove the /NOBOOT switch along with /NOFLOPPY. But in the declude manual the /NOBOOT option is there, so I keep it in my scanfile line.   As I say it works very well now, and faster than ever.   We also have the new MSFT patches installed.                           -Luis Arango   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Friday, April 16, 2004 11:50 PM To: [EMAIL PROTECTED] Subject: X-SPAM-Phrase Re: [Declude.Virus] MAXATONCE Switch   Doug, I'm not sure about the NOMEM option, but I verified several months ago that while NOBOOT isn't listed, fpcmd.exe will scan the boot sectors unless you use that switch.  You should definitely use both of these switches. Matt Douglas Cohn wrote: First of all I am a putz cause I completely ignored the first line since my path was more like the second <G>.   But if you type fpcmd /? It does not show the NOMEM or NOBOOT options.   Weird.   I will switch it now.   DAMN  Now I know why my mail was so slow.....  What a moron I yam..............   Thanks   DC   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Mike Hyslip Sent: Friday, April 16, 2004 11:45 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] MAXATONCE Switch   As listed at http://www.declude.com/virus/manual.htm   F-Prot - SCANFILE C:\Progra~1\Comman~1\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOBOOT /DUMB /REPORT=report.txt (or SCANFILE C:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOFLOPPY /NOBOOT /DUMB /REPORT=report.txt)   VIRUSCODE 3 VIRUSCODE 6 REPORT    Infection:   Definitely works a lot better than the 16-bit version :)   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Douglas Cohn Sent: Friday, April 16, 2004 11:36 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] MAXATONCE Switch   Scott   Why does your sample F-prot command line use the 16 bit scanner instead of the 32 bit one?   Do you have a recommended command line for FPcmd and do you recommend that we always use it instead of F-prot.exe.  I have not patched my Imail server with the current Microsft patches because I am concerned as well. I have seen some odd behavior on other systems with those updates.   I see /noboot /nofloppy and others are not available under fpcmd.   TIA   Doug   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Friday, April 16, 2004 10:48 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] MAXATONCE Switch       Your recommendation is MAXATONCE O allows unlimited processes to run at the same time.       Correct.     Setting the switch to 8 or 10 will make SMTP hangs or become slower?       It is unlikely to make much of a difference, because [1] SMTP hangs should not be related to the resources used by the virus scanner, and [2] it is unlikely that you will have 8-10 virus scanners processes running at the same time.   The MAXATONCE option was originally designed for people who have licensing arrangements where they can only have a certain number of copies of the virus scanner running simultaneously.     Is you recommendation to set it to unlimited?       Yes.     SMTP is now very slow after applying MSFT patches (apr 14). Sometimes smtp service just hangs.       For some reason, some servers have a horrible time handling too many 16-bit processes, and end up causing serious delays in TCP/IP connections like you describe.   Are you using a 16-bit virus scanner (such as F-Prot.exe) with Declude Virus?  If so, I would recommend switching to a 32-bit scanner (such as F-Prot's fpcmd.exe), which will likely help alleviate the problem.                                                       -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation.   --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]   --- This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".    The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus]     --- [This E-mail scanned for viruses by Declude Virus]   --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]   --- This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".    The archives can be found at http://www.mail-archive.com.   --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]   --- This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".    The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus]     --- [This E-mail scanned for viruses by Declude Virus]   --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]   --- This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".    The archives can be found at http://www.mail-archive.com.       -- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================