Well, here is an example of what I was hoping not to see. 05/27/2005 23:35:14 Q112105DF00002AB2 Vulnerability flags = 0 05/27/2005 23:35:14 Q112105DF00002AB2 Outlook 'CR' vulnerability [Subject: H] in line 15 05/27/2005 23:35:15 Q112105DF00002AB2 Virus scanner 1 reports exit code of 0 05/27/2005 23:35:15 Q112105DF00002AB2 File(s) are INFECTED [[Outlook 'CR' Vulnerability]: 0] 05/27/2005 23:35:36 Q112105DF00002AB2 Scanned: CONTAINS A VIRUS 05/27/2005 23:35:36 Q112105DF00002AB2 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [incoming from x.x.x.x] 05/27/2005 23:35:36 Q112105DF00002AB2 Subject: How is Rebecca doing?
In this case, the subject line is the last line for the message in the Declude Virus log in HIGH and it apparently shows that scanners 2 & 3 were not called. If it finds a vulnerability, it still should fire the scanners to see if one of them finds an actual virus. John T eServices For You > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > On Behalf Of David Franco-Rocha [ Declude ] > Sent: Friday, May 27, 2005 7:21 AM > To: Declude.Virus@declude.com > Subject: Re: [Declude.Virus] EXITSCANONVIRUS > > John, > > There is a processing loop wherein all the scanners are called in > succession. It is independent of vulnerability checking. This directive > merely tells Declude to break out of the external virus scanner execution > loop. If you use this directive to exit the scanning loop on virus detection > and (1) you have 5 scanners listed in your cfg file and (2) a virus is > detected by the first scanner listed, then the effect is exactly the same in > processing as if you had a single scanner listed and a virus were detected > by that single scanner. > > David Franco-Rocha > Declude Technical Support > > ----- Original Message ----- > From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> > To: <Declude.Virus@declude.com> > Sent: Friday, May 27, 2005 2:50 AM > Subject: [Declude.Virus] EXITSCANONVIRUS > > > A question about this new feature. > > Am I correct in thinking that as soon as a scanner reports a virus, the next > scanner(s) in line will not be called and the message will be processed > accordingly, and that it will not be affected by Declude first finding a > banned attachment before having it scanned by a scanner? > > John T > eServices For You > > > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
