Sent:
Thursday, April 28, 2005 8:18 PM
Subject:
RE: [Declude.Virus] F-Prot missing viruses and is slow (renamed)
I downloaded and manually scanned the file with
F-Prot and McAfee multiple times.
Desktop, WXP SP2, P4, 2.8 GHz
F-Prot - 5 seconds
McAfee - 0.4 seconds
Server, W2K SP4, P3, 866 Hz
F-Prot - 10.1 seconds
McAfee - 1.21 seconds
F-Prot is indeed returning an errorlevel of 8 on
this, and it's definitely way out of line with the scanning time on
this file.
I'm enclosing the batch file I use to manually
scan (and not clean) files. I monkeyed with all of the documented
options and could not reduce the F-Prot scanning time. On the bright
side, reviewing the parameters revealed that if you're not mindful and
specify both the /type and /dumb options, the last one in the line wins
(oops, I did that in my virus.cfg). Also, I learned that /packed is
always on.
I'm going to check for a similar malware
detection, and submit it to F-Prot as a bug.
I did get a reply on my previous report to them
(after 6 days); they brought my request to the attention of the
developers, but then reminded me that any non-zero return code is
"undesirable". The request was to re-classify Mitglieder from
"suspicious" to "virus" so that I could get the correct return code and
thus the correct handling in my Declude Virus.
Andrew 8)
p.s. I use the TimeThis.exe command line utility
from Microsoft to get sub-second intervals in batch files.
Ok, I've captured
one of these files and confirmed from a manual scan that it is still
taking an excessive amount of time...but wait, there's more. The
report.txt file that it creates shows that it detected Mytob, but every
test where I send this to myself in E-mail results in no virus detected
by F-Prot using VIRUSCODE 3, 6, 8, 9 or 10. I haven't gone as far as
coding something up that can capture the exit code from the command
line yet, but I would be curious what if any was returned.
Here's what Declude Virus shows for this file when I send it to myself:
04/28/2005 17:40:57 Q58666795008E87C7 MIME
file: [text/html][7bit; Length=695 Checksum=54365]
04/28/2005 17:40:57 Q58666795008E87C7 MIME file: doc.zip
[base64; Length=56432 Checksum=6987426]
--- 10 second gap while F-Prot scans ---
04/28/2005 17:41:07 Q58666795008E87C7 Could not find
parse string Infection: in report.txt
04/28/2005 17:41:08 Q58666795008E87C7 Scanner 2:
Virus=the W32/[EMAIL PROTECTED] Attachment= [0] I
04/28/2005 17:41:08 Q58666795008E87C7 File(s) are
INFECTED [the W32/[EMAIL PROTECTED]: 13]
04/28/2005 17:41:08 Q58666795008E87C7 Scanned: CONTAINS
A VIRUS [Prescan OK][MIME: 3 57490]
04/28/2005 17:41:08 Q58666795008E87C7 From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
[incoming from 192.168.100.100]
04/28/2005 17:41:08 Q58666795008E87C7 Subject: [Fwd:
Mail Delivery System]
Here's a link to the virus for those that might want to test it out for
themselves. Turn off your real-time virus scanner, right click the
file and press save as, and rename it as doc.zip (it's not really a
text file).
http://administration.mailpure.com/virus/doc.txt
Here's the command line for F-Prot that I was using with the file
located in C:\test\doc.zip:
C:\Progra~1\FSI\F-Prot\fpcmd.exe /TYPE /SILENT
/NOBOOT /NOMEM /ARCHIVE=5 /PACKED /DUMB /REPORT=C:\test\report.txt
C:\test\doc.zip
Here's the output from the report.txt file when manually scanned:
Virus scanning report - 28 April 2005 @ 17:45
F-PROT ANTIVIRUS
Program version: 3.16b
Engine version: 3.16.6
VIRUS SIGNATURE FILES
SIGN.DEF created 28 April 2005
SIGN2.DEF created 28 April 2005
MACRO.DEF created 20 April 2005
Search: C:\test\doc.zip
Action: Report only
Files: "Dumb" scan of all files
Switches: /ARCHIVE /PACKED /SERVER /REPORT=C:\test\report.txt /SILENT
/NOBOOT /NOMEM
Memory was not scanned.
Hard disk boot sectors were not scanned.
C:\test\doc.zip->doc.scr->(Packed) is a security risk named
W32/[EMAIL PROTECTED]
Results of virus scanning:
Files: 1
MBRs: 0
Boot sectors: 0
Objects scanned: 2
Infected: 0
Suspicious: 1
Disinfected: 0
Deleted: 0
Renamed: 0
Time: 0:10
So it takes 10 seconds, find a "security risk named W32/[EMAIL PROTECTED]"
and says it is "Suspicious", but I have Declude configured to treat an
exit code of 8 as a virus currently, and that's what Suspicious files
are supposedly marked as. I don't know if there is a different code
being returned, or if F-Prot is just bugging out and not returning a
code. Maybe some of you can clear that part up.
Matt
--
=====================================================
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=====================================================
