RE: [Declude.Virus] 4.2.3 Built-in scanner

2006-05-09 Thread John Shacklett
Just for fun, I completely commented out the three scanners in my virus.cfg and resent the eicar plain test file, and it made it to my Inbox. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Shacklett Sent: Tuesday, 09 May 2006 9:58 AM To: Declude.Vir

RE: [Declude.Virus] 4.2.3 Built-in scanner

2006-05-09 Thread David Barker
Uwe, I will look into this - what I do know that if "Unknown Virus in Unknown File" means that the virus scanner is not reporting the name of the virus, I see this a lot with Clamav however I will have to check on the AVG David B www.declude.com -Original Message- From: [EMAIL PROTECTED]

Re: [Declude.Virus] 4.2.3 Built-in scanner

2006-05-09 Thread Info Wind
Dear David, since I use 4.2.3 I get always "Unknown Virus in Unknown File" in the message. It seems that the Virusname variables have a problem. Could you check this? Thank you, Uwe - Original Message - From: "David Barker" <[EMAIL PROTECTED]> To: Sent: Tuesday, May 09, 2006 3:13

RE: [Declude.Virus] 4.2.3 Built-in scanner

2006-05-09 Thread mhiltner
Really? I read this as AVG detected a virus, and then went on to scanners #1 and #2. 05/09/2006 10:20:59.531 qb3591c200020536d.smd AVG Reports VIRUS: EICAR_Test 05/09/2006 10:20:59.531 qb3591c200020536d.smd AVG Reports Not Healable 05/09/2006 10:20:59.531 qb3591c200020536d.smd Starting scanner #1

RE: [Declude.Virus] 4.2.3 Built-in scanner

2006-05-09 Thread David Barker
That is true except for the built in scanner which if it finds a virus does not call the additional scanners. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Shacklett Sent: Tuesday, May 09, 2006 9:49 AM To: Declude.Virus@dec

RE: [Declude.Virus] 4.2.3 Built-in scanner

2006-05-09 Thread John Shacklett
Forget my last post, I have different problems. Sorry. I followed John C's suggestion and sent myself a standard base64 MIME encoded eicar.com file [which should have occurred to me earlier], and I ended up with the following lines in the debug output: 05/09/2006 09:50:57.007 q9e3d01cb331c.sm

RE: [Declude.Virus] 4.2.3 Built-in scanner

2006-05-09 Thread John Shacklett
I sent myself a test virus after installing the update, and it was stopped by my existing scanner. I don't see any indication of additional log lines as a result of adding AVG. The default virus.cfg file states that "The default behavior is for Declude to call all scanners" and I have the "EXITSCA

RE: [Declude.Virus] 4.2.3 Built-in scanner

2006-05-09 Thread John Carter
Temporarily go to LOGLEVEL DEBUG and use the test virus sender. It should show AVG working. MID and HIGH levels didn't show which scanner caught EICAR, but DEBUG did. John C 05/09/2006 08:34:55.687 q9a7b016d30e4.smd AVG Virus detected. Not continuing with any remaining scanners. 05/09/2006

RE: [Declude.Virus] 4.2.3 Built-in scanner

2006-05-09 Thread mhiltner
Declude/scanners/avg I disabled my other test, which would leave AVG the only running one. Logs showed scanning activity with test virus. I assumed all was working as intended. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Shacklett Sent: Tuesday

RE: [Declude.Virus] 4.2.3 Built-in scanner

2006-05-09 Thread David Barker
1. Use the test virus sender http://www.declude.com/Articles.asp?ID=99 2. Check your virus logs 3. Declude\Scanners\AVG\DB 4. Check the date on the database files David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Shacklett Sent

[Declude.Virus] 4.2.3 Built-in scanner

2006-05-09 Thread John Shacklett
How do I determine if the built-in scanner is working? Where do the virus signature files live? How do I tell if those files are being updated? -- John S --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe De