We installed the qmail-scanner f-secure subroutine patch by Jyri (see qmail-scanner archives for 2/14/04) and it stops the Beagle J virus. However, the method used does not really identify the virus - it quarantines the email on the basis that the attachment cannot be opened. This is a satisfactory temporary solution. It would be nicer if F-Secure could update their engine and truly be able to identify the beast. Perhaps they can call Symantec and find out how Norton AV does it.
At 01:55 PM 3/9/2004, you wrote:
On Tue, Mar 09, 2004 at 11:08:20AM -0500, Jeff Koch wrote:
> Hi Pasi:
>
> Perhaps you can explain a little further. F-Secure reports it found an
> attachment it could not open because it was password protected and thus
> cannot scan it. If it can't scan the attachment how will it ever determine
> it was infected with the Beagle J virus? What kind of return code would you
> be looking for?
>
> On the other hand Norton AV scans the email and reports it as being the
> Beagle J virus. It seems to me the question is whether Norton has a
> superior scanning engine.
>
Please check qmail-scanner list archives for this subject:
Re: [Qmail-scanner-general]Qmail-scanner + f-secure invalid error code handling!
Jyri has wrote correctly working f-secure sub for qmail-scanner, which handles suspicious files correctly, and also treats password protected files as suspicious..
- Pasi Kärkkäinen
> > At 05:15 AM 3/9/2004, you wrote: > >On Mon, Mar 08, 2004 at 01:14:54PM -0500, Jeff Koch wrote: > >> > >> Our Qmail-Scanner (1.20) with F-Secure (4.52) seems unable to catch > >emails > >> with this virus. The qmail-queue.log shows and error that F-Secure was > >> unable to open a password protected zip file. However, the email is then > >> passed as clear. Have we configured something wrong or is it F-Secure? > >> Norton AV catches the virus just fine at our PC's. > >> > > > >The default f-secure scanner sub in qmailscanner is broken. The next > >version > >will include version that checks properly for all the f-secure return > >codes. > > > >-- Pasi Kärkkäinen > > > > ^ > > . . > > Linux > > / - \ > > Choice.of.the > > .Next.Generation. > > Best Regards, > > Jeff Koch, Intersessions > >
--
^ . . Linux / - \ Choice.of.the .Next.Generation.
Best Regards,
Jeff Koch, Intersessions
------------------------------------------------------- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id70&alloc_id638&op=click _______________________________________________ Qmail-scanner-general mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
