RE: [Declude.Virus] Parsing of Report.txt
Hi Andy we will certainly look at this, although to be clear, it is very
presumptions to say that adding this will only be 2 min work. Please be
careful when making statements like this because it raises a false
expectation for others. You have no idea about the complexity of the code,
other items being worked on, priorities, resource allocation, support,
issues, costs or time available.
Thanks
David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 office
978.988.1311 fax
mailto:dbar...@declude.com dbar...@declude.com
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Andy
Schmidt
Sent: Thursday, February 05, 2009 12:44 PM
To: declude.virus@declude.com
Subject: [Declude.Virus] Parsing of Report.txt
Sensitivity: Personal
Hi,
With the ability of ClamD to run at lightning speed as a native Windows
service (e.g., http://oss.netfarm.it/clamav, without CygWin), offering
frequent updates during the day (quite contrary to the internal scanner that
often lags days behind) and has acceptable licensing terms - it certainly is
a highly attractive external scanner that should be fully supported by
Declude after ClamAV has been around for all these years.
Sadly, since Declude hasn't seen any feature updates in ages, the virus.cfg
parameter REPORT still can't parse the virus reports generated by
ClamDScan. Consequently, the Declude virus log files and virus notification
emails are missing file and virus name info.
I took 2 minutes and created a small .JS script that parses the ClamDScan
report file and then outputs a McAfee lookalike just to make Declude
happy. But that means that yet another batch process is now chewing up
Windows' limited resources.
To justify THIS year's maintenance renewal money, can PLEASE have someone
spend the same 2 minutes in the Declude source code to correctly parse the
ClamDScan output:
--
c:\maintenance\eicar.com: Eicar-Test-Signature FOUND
Thanks in advance.
Best Regards,
Andy Schmidt
www.Anamera.com
// RunClam.js
// Launches ClamD and reformats output to compensate
// for Decludes inability to correctly parse the report
// (Declude is no longer actively maintained.)
// Application Constants
var strClamAV = C:\\Program Files\\ClamAV\\ClamDScan.exe;
// Get Command Line Parameter
if ( WScript.Arguments.Count() == 0 )
// nothing to scan
WScript.Quit( 2 );
var strPath = WScript.Arguments(0);
// Run ClamAV
var objShell = new ActiveXObject(WScript.Shell);
var objExec = objShell.Exec( strClamAV + + strPath );
var strLine;
var nSeperator, nFound;
var bHaveFound = false;
while ( !objExec.StdOut.AtEndOfStream )
{
// Process ClamAV Output
strLine = objExec.StdOut.ReadLine();
if ( bHaveFound )
continue;
nFound = strLine.indexOf( FOUND );
if ( nFound 0 )
{
nSeperator = strLine.indexOf( : );
if ( nSeperator 1 )
continue;
// Appears to be a possible virus report
bHaveFound = true;
var objFS = new
ActiveXObject(Scripting.FileSystemObject);
objTS = objFS.CreateTextFile( Report.txt );
// Create Declude Report File
objTS.WriteLine( strLine.substring( 0, nSeperator ) +
FOUND + strLine.substring( nSeperator + 2, nFound ) );
objTS.Close();
}
}
// Wait for completion to be able to obtain exit code
while ( objExec.Status != 1 )
WScript.Sleep(100);
WScript.Quit( objExec.ExitCode );
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.Virus. The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.
RE: [Declude.Virus] Parsing of Report.txt
I think you missed the real point of Andy's email.
The last official Declude release was 4.4.0 on 3/17/2008. It's already
Febuary 2009, so it's about a year with no with no official releases. That
doesn't make me feel like I'm getting much out of my maintenance renewal
money.
Scott Fisher
Director of IT
Farm Progress Companies
255 38th Avenue, Suite P
St. Charles IL 60174-5410
630/462-2323
fax 630/462-2957
sfis...@farmprogress.com
www.farmprogress.com http://www.farmprogress.com/
This email message, including any attachments, is for the sole use of the
intended recipient(s) and may contain confidential and privileged
information. Any unauthorized review, use, disclosure or distribution is
prohibited. If you are not the intended recipient, please contact the sender
by reply email and destroy all copies of the original message. Although Farm
Progress Companies has taken reasonable precautions to ensure no viruses are
present in this email, the company cannot accept responsibility for any loss
or damage arising from the use of this email or attachments.
-Original Message-
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David
Barker
Sent: Thursday, February 05, 2009 12:02 PM
To: declude.virus@declude.com
Subject: RE: [Declude.Virus] Parsing of Report.txt
Sensitivity: Personal
Hi Andy we will certainly look at this, although to be clear, it is very
presumptions to say that adding this will only be 2 min work. Please be
careful when making statements like this because it raises a false
expectation for others. You have no idea about the complexity of the code,
other items being worked on, priorities, resource allocation, support,
issues, costs or time available.
Thanks
David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 office
978.988.1311 fax
mailto:dbar...@declude.com dbar...@declude.com
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Andy
Schmidt
Sent: Thursday, February 05, 2009 12:44 PM
To: declude.virus@declude.com
Subject: [Declude.Virus] Parsing of Report.txt
Sensitivity: Personal
Hi,
With the ability of ClamD to run at lightning speed as a native Windows
service (e.g., http://oss.netfarm.it/clamav, without CygWin), offering
frequent updates during the day (quite contrary to the internal scanner that
often lags days behind) and has acceptable licensing terms - it certainly is
a highly attractive external scanner that should be fully supported by
Declude after ClamAV has been around for all these years.
Sadly, since Declude hasn't seen any feature updates in ages, the virus.cfg
parameter REPORT still can't parse the virus reports generated by
ClamDScan. Consequently, the Declude virus log files and virus notification
emails are missing file and virus name info.
I took 2 minutes and created a small .JS script that parses the ClamDScan
report file and then outputs a McAfee lookalike just to make Declude
happy. But that means that yet another batch process is now chewing up
Windows' limited resources.
To justify THIS year's maintenance renewal money, can PLEASE have someone
spend the same 2 minutes in the Declude source code to correctly parse the
ClamDScan output:
--
c:\maintenance\eicar.com: Eicar-Test-Signature FOUND
Thanks in advance.
Best Regards,
Andy Schmidt
www.Anamera.com
// RunClam.js
// Launches ClamD and reformats output to compensate
// for Decludes inability to correctly parse the report
// (Declude is no longer actively maintained.)
// Application Constants
var strClamAV = C:\\Program Files\\ClamAV\\ClamDScan.exe;
// Get Command Line Parameter
if ( WScript.Arguments.Count() == 0 )
// nothing to scan
WScript.Quit( 2 );
var strPath = WScript.Arguments(0);
// Run ClamAV
var objShell = new ActiveXObject(WScript.Shell);
var objExec = objShell.Exec( strClamAV + + strPath );
var strLine;
var nSeperator, nFound;
var bHaveFound = false;
while ( !objExec.StdOut.AtEndOfStream )
{
// Process ClamAV Output
strLine = objExec.StdOut.ReadLine();
if ( bHaveFound )
continue;
nFound = strLine.indexOf( FOUND );
if ( nFound 0 )
{
nSeperator = strLine.indexOf( : );
if ( nSeperator 1 )
continue;
// Appears to be a possible virus report
bHaveFound = true;
var objFS = new
ActiveXObject(Scripting.FileSystemObject);
objTS = objFS.CreateTextFile( Report.txt );
// Create Declude Report File
objTS.WriteLine( strLine.substring( 0, nSeperator ) +
FOUND + strLine.substring( nSeperator + 2, nFound ) );
objTS.Close();
}
}
// Wait
RE: [Declude.Virus] Parsing of Report.txt
Scott I got that point. There have been interims throughout the year we are
now on 4.4.25 which is available to all with service agreements. I can roll
this up into an official release.
David B
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Scott
Fisher
Sent: Thursday, February 05, 2009 1:24 PM
To: declude.virus@declude.com
Subject: RE: [Declude.Virus] Parsing of Report.txt
Sensitivity: Personal
I think you missed the real point of Andy's email.
The last official Declude release was 4.4.0 on 3/17/2008. It's already
Febuary 2009, so it's about a year with no with no official releases. That
doesn't make me feel like I'm getting much out of my maintenance renewal
money.
Scott Fisher
Director of IT
Farm Progress Companies
255 38th Avenue, Suite P
St. Charles IL 60174-5410
630/462-2323
fax 630/462-2957
sfis...@farmprogress.com
www.farmprogress.com http://www.farmprogress.com/
This email message, including any attachments, is for the sole use of the
intended recipient(s) and may contain confidential and privileged
information. Any unauthorized review, use, disclosure or distribution is
prohibited. If you are not the intended recipient, please contact the sender
by reply email and destroy all copies of the original message. Although Farm
Progress Companies has taken reasonable precautions to ensure no viruses are
present in this email, the company cannot accept responsibility for any loss
or damage arising from the use of this email or attachments.
-Original Message-
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David
Barker
Sent: Thursday, February 05, 2009 12:02 PM
To: declude.virus@declude.com
Subject: RE: [Declude.Virus] Parsing of Report.txt
Sensitivity: Personal
Hi Andy we will certainly look at this, although to be clear, it is very
presumptions to say that adding this will only be 2 min work. Please be
careful when making statements like this because it raises a false
expectation for others. You have no idea about the complexity of the code,
other items being worked on, priorities, resource allocation, support,
issues, costs or time available.
Thanks
David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 office
978.988.1311 fax
mailto:dbar...@declude.com dbar...@declude.com
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Andy
Schmidt
Sent: Thursday, February 05, 2009 12:44 PM
To: declude.virus@declude.com
Subject: [Declude.Virus] Parsing of Report.txt
Sensitivity: Personal
Hi,
With the ability of ClamD to run at lightning speed as a native Windows
service (e.g., http://oss.netfarm.it/clamav, without CygWin), offering
frequent updates during the day (quite contrary to the internal scanner that
often lags days behind) and has acceptable licensing terms - it certainly is
a highly attractive external scanner that should be fully supported by
Declude after ClamAV has been around for all these years.
Sadly, since Declude hasn't seen any feature updates in ages, the virus.cfg
parameter REPORT still can't parse the virus reports generated by
ClamDScan. Consequently, the Declude virus log files and virus notification
emails are missing file and virus name info.
I took 2 minutes and created a small .JS script that parses the ClamDScan
report file and then outputs a McAfee lookalike just to make Declude
happy. But that means that yet another batch process is now chewing up
Windows' limited resources.
To justify THIS year's maintenance renewal money, can PLEASE have someone
spend the same 2 minutes in the Declude source code to correctly parse the
ClamDScan output:
--
c:\maintenance\eicar.com: Eicar-Test-Signature FOUND
Thanks in advance.
Best Regards,
Andy Schmidt
www.Anamera.com
// RunClam.js
// Launches ClamD and reformats output to compensate
// for Decludes inability to correctly parse the report
// (Declude is no longer actively maintained.)
// Application Constants
var strClamAV = C:\\Program Files\\ClamAV\\ClamDScan.exe;
// Get Command Line Parameter
if ( WScript.Arguments.Count() == 0 )
// nothing to scan
WScript.Quit( 2 );
var strPath = WScript.Arguments(0);
// Run ClamAV
var objShell = new ActiveXObject(WScript.Shell);
var objExec = objShell.Exec( strClamAV + + strPath );
var strLine;
var nSeperator, nFound;
var bHaveFound = false;
while ( !objExec.StdOut.AtEndOfStream )
{
// Process ClamAV Output
strLine = objExec.StdOut.ReadLine();
if ( bHaveFound )
continue;
nFound = strLine.indexOf( FOUND );
if ( nFound 0 )
{
nSeperator = strLine.indexOf( : );
if ( nSeperator 1 )
continue;
// Appears to be a possible virus report
RE: [Declude.Virus] Parsing of Report.txt
Gary, I apologize the latest is 4.4.24. Yes you are correct the readme.txt does have the following note. Interim releases are stable and tested but as they are not official I guess you have a point... if I could give you an analogy - it is for the same reason Google has not taken GMAIL out of Beta yet. I can have the current interim release be official, what I am communicating to you is that it would be exactly the same as what you have now 4.4.24 this is not being disingenuous, but rather the exact opposite, perhaps you could accuse me of being too honest. But for argument sake I will officially make 4.4.24 official and have it released in the next week or 2. David B -Original Message- From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Gary Steiner Sent: Thursday, February 05, 2009 3:33 PM To: declude.virus@declude.com Subject: RE: [Declude.Virus] Parsing of Report.txt David, If 4.4.25 is available to all with service agreements, where is it? Declude's main download page shows 4.4.0, and the interim page shows versions 4.4.23 and 4.4.24. And, as your readme.txt file in your interim directory says, Interim releases are versions of Declude that are released between betas (some software companies refer to these as alphas). They have one major advantage to betas and released versions: they allow our customers to get fixes and new features very, very quickly. We can often have a fix in less than an hour. However, there are a number of drawbacks... Interim releases are not production releases. You cannot substitute a production release with an interim release. And trying to equate an interim release with an official production release is disingenuous. If there is a stable release with significant bug fixes (such as deleting the .txt files being left in the work directory by AVG), then why has it taken this long for Declude to release it officially? Declude's answer for a problem should not be to tell me to install an alpha or beta version of their product on my production server. Gary Steiner Original Message From: David Barker dbar...@declude.com Sent: Thursday, February 05, 2009 11:03 AM To: declude.virus@declude.com Subject: RE: [Declude.Virus] Parsing of Report.txt Scott I got that point. There have been interims throughout the year we are now on 4.4.25 which is available to all with service agreements. I can roll this up into an official release. David B From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Scott Fisher Sent: Thursday, February 05, 2009 1:24 PM To: declude.virus@declude.com Subject: RE: [Declude.Virus] Parsing of Report.txt Sensitivity: Personal I think you missed the real point of Andy's email. The last official Declude release was 4.4.0 on 3/17/2008. It's already Febuary 2009, so it's about a year with no with no official releases. That doesn't make me feel like I'm getting much out of my maintenance renewal money. Scott Fisher Director of IT Farm Progress Companies 255 38th Avenue, Suite P St. Charles IL 60174-5410 630/462-2323 fax 630/462-2957 sfis...@farmprogress.com www.farmprogress.com http://www.farmprogress.com/ This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. Although Farm Progress Companies has taken reasonable precautions to ensure no viruses are present in this email, the company cannot accept responsibility for any loss or damage arising from the use of this email or attachments. -Original Message- From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David Barker Sent: Thursday, February 05, 2009 12:02 PM To: declude.virus@declude.com Subject: RE: [Declude.Virus] Parsing of Report.txt Sensitivity: Personal Hi Andy we will certainly look at this, although to be clear, it is very presumptions to say that adding this will only be 2 min work. Please be careful when making statements like this because it raises a false expectation for others. You have no idea about the complexity of the code, other items being worked on, priorities, resource allocation, support, issues, costs or time available. Thanks David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax mailto:dbar...@declude.com dbar...@declude.com From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Andy Schmidt Sent: Thursday, February 05, 2009 12:44 PM To: declude.virus@declude.com Subject: [Declude.Virus] Parsing of Report.txt Sensitivity: Personal Hi
