F-Prot users be aware...

Discussions on webmail and the Professional version.
Post Reply
Craig Emmitt
Posts: 8
Joined: Wed Jun 26, 2002 7:43 am

F-Prot users be aware...

Post by Craig Emmitt » Sun Nov 10, 2002 12:47 am

F-Prot cannot delete or disinfect virus infected files contained in an archive (.zip, .arj, etc.) and will not delete the archive file itself.

If an email has a .zip file attached that contains a virus infected file it will not be deleted and it will make it to the recipient's mailbox unless you modify the default configuration so that Mail Enable deletes infected files instead of F-Prot.

Example:

Code: Select all

[HKEY_LOCAL_MACHINE\SOFTWARE\Mail Enable\Mail Enable\Agents\MTA\Filters\MEAVFPI]
"Status"=dword:00000001
"Antivirus Notification Message"="<<- Attachment was removed because it appears to contain a virus ->>"
"Antivirus Scratch Directory"="C:\\Program Files\\Mail Enable\\Scratch"
"Antivirus Parameters"="\"[AGENT]\" \"[FILENAME]\" /ARCHIVE /PACKED /NOBOOT /NOMEM"
"Antivirus Agent"="C:\\F-Prot\\fpcmd.exe"
"Provider DLL"="MEAVGEN.DLL"
"Program Name"="F-Prot"
"Program Info"="F-Prot is produced by Frisk Software International. Visit www.f-prot.com for information."
"Exit Code Enabled"=dword:00000001
"Exit Codes Error Inclusive"=dword:00000001
"Exit Codes"="3"
F-Prot always returns an errorlevel of 3 when a virus is found, even if it was inside an archive file. With this configuration ME will check F-Prot's exit code and delete the file if it was 3.

If you also want to delete files that F-Prot detemines are suspicious modify the Exit Codes as follows:

Code: Select all

"Exit Codes"="3 8"

Craig Emmitt

Post Reply