Hey Rob, Riiiight.... whoops :) I'm playing with XAV now (with this helpful new info!), as I'd prefer to be running a C app over emails than a Windows Script... but have hit another problem.
When running XMail in debug mode, and sending an email thru with a virused attachment, the XAV app is returning a value of 0, so the infected email is still going through. With debugging enabled in the xav.ini file, the log file shows: [2003-12-04 15:08:30] XAVMessage=[Your email was rejected due to a virus attachment.] [2003-12-04 15:08:30] AntivirusPath=[d:\Apps\f-prot\f-prot.exe] [2003-12-04 15:08:30] AntivirusCommand= [/COLLECT /DUMB /AI /ARCHIVE /NOBOOT /NOMEM /PACKED /NOFLOPPY /SILENT] [2003-12-04 15:08:30] AntivirusReturn=[3] [2003-12-04 15:08:30] DecoderPath=[d:\Apps\xav\mpack\munpack.exe] [2003-12-04 15:08:30] DecoderCommand=[] [2003-12-04 15:08:30] DecoderReturn=[1] [2003-12-04 15:08:30] Creating temp folder D:\Apps\xav\tmp-1070579309708- 3620-swing Any ideas? :) Cheers, John :) -----Original Message----- From: "Rob Arends" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Date: Thu, 4 Dec 2003 01:10:42 +1100 Subject: [xmail] Re: XAV help? > John, > > The Retcode in the quotes on the xav.tab is actually a number. > It is the number you want xav to return to xmail in the case of a virus > being found. > This means you could use "4", "5", or "6", etc. > > Rob :-) > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of John Bishop > > Sent: Thursday, November 27, 2003 3:11 PM > > To: [EMAIL PROTECTED] > > Subject: [xmail] XAV help? > > > > Hi guys, > > > > I'm a long-time mail admin that's just discovered and started > > migrating > > to XMail - it's a great app. Also, kudos to those of you that > > have put > > so much useful advice online (web pages, forums, custom apps > > etc) - it > > makes life a *lot* easier for us newbs :) > > > > I'm currently trying to the the XAV AV filter working on my > > new server > > (Windows 2003). I've downloaded F-Prot for DOS, and this is > > working fine > > at detecting viruses on it's own (tested with Eicar's dummy > > virus file). > > > > I've placed the following line in my filters-in.tab file: > > "*" {tab} "*" {tab} "0.0.0.0/0" {tab} "0.0.0.0/0" {tab} "xav.tab" > > > > And I've placed a xav.tab file in my /filters folder, containing: > > "d:\apps\xav\xav.exe" {tab} "d:\apps\xav" {tab} "@@FILE" > > {tab} "@@FROM" > > {tab} "@@RCPT" {tab} "Retcode" > > > > After sending an email thru the server with the Eicar dummy > > virus file > > attached, the mail does not get rejected... the xav.log file > contains: > > > > [2003-11-27 11:55:53] XAVMessage=[Your email was rejected due > > to a virus > > attachment.] > > [2003-11-27 11:55:53] AntivirusPath=[d:\Apps\f-prot\f-prot.exe] > > [2003-11-27 11:55:53] AntivirusCommand= > > [/COLLECT /DUMB /AI /ARCHIVE /NOBOOT /NOMEM /PACKED /NOFLOPPY > /SILENT] > > [2003-11-27 11:55:53] AntivirusReturn=[3] > > [2003-11-27 11:55:53] DecoderPath=[d:\Apps\xav\mpack\munpack.exe] > > [2003-11-27 11:55:53] DecoderCommand=[] > > [2003-11-27 11:55:53] DecoderReturn=[1] > > [2003-11-27 11:55:53] Creating temp folder > > d:\Apps\xav\tmp-1069962953079- > > 1572-swing > > > > > > ...So! Any suggestions as to what I need to do to get this > > working guys? > > Sorry for the long email, just wanted to make sure I was > > giving you all > > the info you might need to help me diagnose this problem. > > > > Cheers all, > > John :) > > > > - > > To unsubscribe from this list: send the line "unsubscribe xmail" in > > the body of a message to [EMAIL PROTECTED] > > For general help: send the line "help" in the body of a message to > > [EMAIL PROTECTED] > > > > > > - > To unsubscribe from this list: send the line "unsubscribe xmail" in > the body of a message to [EMAIL PROTECTED] > For general help: send the line "help" in the body of a message to > [EMAIL PROTECTED] - To unsubscribe from this list: send the line "unsubscribe xmail" in the body of a message to [EMAIL PROTECTED] For general help: send the line "help" in the body of a message to [EMAIL PROTECTED]
