MXScan for Mailenable (AntiVirus and AntiSpam Plugin)

[supra2800]

Thanks for the update.

But, do I have to enter my name, company and email address in these fields everytime I want to download an update?
http://www.mxuptime.com/register.aspx?type=mxscanliteme

[polarisie]

Thanks for the update.

But, do I have to enter my name, company and email address in these fields everytime I want to download an update?
http://www.mxuptime.com/register.aspx?type=mxscanliteme

For now yes, as it lets me track the downloads. Only takes few seconds though

[supra2800]

Okay, just checking

[ANdyK]

One of the largest service providers here in Australia is the national phone carrier, Telstra. Their Internet services operate under the domain "bigpond". This can be bigpond.com, bigpond.com.au etc. depending on whether it's a broadband or dial-up service. Unfortunately there is a major problem with the inbuilt and non-editable Chinese character filter in MXscan ... it triggers on the word bigpond with a "match found for ?big5?"

I have several other issues with MX scan (the professional, not the free version) but this is the major one at the moment and I don't like to raise more than one issue per post. I should add that I'm extremely impressed with this product ... it is getting very close indeed to 100% accuracy despite the default settings having been only minimally tweaked since installation a couple of weeks ago.

[polarisie]

One of the largest service providers here in Australia is the national phone carrier, Telstra. Their Internet services operate under the domain "bigpond". This can be bigpond.com, bigpond.com.au etc. depending on whether it's a broadband or dial-up service. Unfortunately there is a major problem with the inbuilt and non-editable Chinese character filter in MXscan ... it triggers on the word bigpond with a "match found for ?big5?"

I have several other issues with MX scan (the professional, not the free version) but this is the major one at the moment and I don't like to raise more than one issue per post. I should add that I'm extremely impressed with this product ... it is getting very close indeed to 100% accuracy despite the default settings having been only minimally tweaked since installation a couple of weeks ago.

Hi AndyK

Good feedback! Thank you

Can you zip and send as an attachment these messages via email and any other thoughts/suggetions you have regarding MxScan.

I am always open to suggestions and the application is continuously being developed and refined where possible.

Cheers

[ANdyK]

Many thanks for such a quick response.

I will email you directly with an example of an offending message including the header, however it's quite easy to test. Just bring up the content filters and select the Chinese character filter. Open the test and type the word bigpond, then click to test the text. You'll find you get a match. This is rather inconvenient as I receive many legitimate emails from people @bigpond.com and each of these triggers the Chinese character filter.

I will outlne some of my other questions and concerns directly to you by email.

Andy.

[polarisie]

Many thanks for such a quick response.

I will email you directly with an example of an offending message including the header, however it's quite easy to test. Just bring up the content filters and select the Chinese character filter. Open the test and type the word bigpond, then click to test the text. You'll find you get a match. This is rather inconvenient as I receive many legitimate emails from people @bigpond.com and each of these triggers the Chinese character filter.

I will outlne some of my other questions and concerns directly to you by email.

Andy.

Thanks andy, I'll look into this.

[lothar]

Hi,
I tried installing MXscan 1.5.618 on our server with the intent of buying it if everything went well. Our antivirus software is due for renewal tomorrow, so I finally pulled myself together to try out this new solution out.

The install seemed to go fine, and i got into the configuration manager without problems, but when I quit the application an error dialog popped up which I unfortunately did not manage to read before closing it (it was hidden behind a lot of mailenable dialogs, and I was on a roll clicking little x's)

When I tried to restart the configuration manager it took a long while, showing the splash screen, and a new error appeared "Error in [Form Load]. Object reference not set to an instance of an object." However upon clicking OK the manager started, but many of the settings were gone.

I did not think it was wise to test the software by guessing my way to pages of settings, as this would probably not work out too well, so I decided to do a repair, in the hope that the possibly corrupted configuration file would be overwritten with a fresh one.

When I ran the installer, I got an error 2324, which usually means that the installer is having trouble finding a file, and the repair failed. I then tried to uninstall the application with the same error and result.

Does anyone have any manual uninstallation instructions or other information that might help me either fix the current install or get rid of the software in preperation for installing a fresh copy.

Thanks in advance.

[polarisie]

Hi,
I tried installing MXscan 1.5.618 on our server with the intent of buying it if everything went well. Our antivirus software is due for renewal tomorrow, so I finally pulled myself together to try out this new solution out.

The install seemed to go fine, and i got into the configuration manager without problems, but when I quit the application an error dialog popped up which I unfortunately did not manage to read before closing it (it was hidden behind a lot of mailenable dialogs, and I was on a roll clicking little x's)

When I tried to restart the configuration manager it took a long while, showing the splash screen, and a new error appeared "Error in [Form Load]. Object reference not set to an instance of an object." However upon clicking OK the manager started, but many of the settings were gone.

I did not think it was wise to test the software by guessing my way to pages of settings, as this would probably not work out too well, so I decided to do a repair, in the hope that the possibly corrupted configuration file would be overwritten with a fresh one.

When I ran the installer, I got an error 2324, which usually means that the installer is having trouble finding a file, and the repair failed. I then tried to uninstall the application with the same error and result.

Does anyone have any manual uninstallation instructions or other information that might help me either fix the current install or get rid of the software in preperation for installing a fresh copy.

Thanks in advance.

Hi there

Can you contact me offline via email (for security reasons) and we'll see what we can do to take care of this?

Cheers

[trusnock]

Hello,
I noticed today that mxscan seems to have a lot of trouble starting clamd.exe, and sometimes fails. It seems to check the VERSION command too early (after clamd.exe started but before it has started listening on port 3310). It USUALLY succeeds on a later attempt.

However, on several occasions, mxscan determined that clamd.exe was permanently unavailable and disabled the virus checking. I would really like to get a pop-up to warn me that virus checking was disabled, rather than just a log file entry. As it stands now, the "Started Successfully" popup is displayed before mxscan even tries to run clamd.exe and spamd.exe.

Here is a log showing a failed attempt...

06/25/08 09:54:38 Attempting to Start ClamDaemon ...
06/25/08 09:54:45 ClamDaemon started...
06/25/08 09:54:53 Error in [ClamD_SocketScan]! No connection could be made because the target machine actively refused it 127.0.0.1:3310
06/25/08 09:54:53 Checking to see if ClamDaemon has responded correctly.
06/25/08 09:55:03 Did not receive correct ClamDaemon response.
06/25/08 09:55:13 Second Attempt to query ClamD for correct response.
06/25/08 09:55:24 Error in [ClamD_SocketScan]! No connection could be made because the target machine actively refused it 127.0.0.1:3310
06/25/08 09:55:24 Checking to see if ClamDaemon has responded correctly.
06/25/08 09:55:26 Error in [ClamD_1]. Unable to start ClamDaemon...
06/25/08 09:55:26 Setting blnClamDPermentantFailure = True. All future ClamD checks disabled. Please ensure that the ClamAV is properly configured and that nothing is blocking the port 3310

Has anyone else seen this happen? (Search your mxscan-service_{date}.log file for "blnClamDPermentantFailure")

Our server is not under very much load now (thanks to mxscan's overall efficiency as compared to F-Prot 6!), so I don't think this is just a slow server issue. Regardless, I think mxscan should alert us with a pop-up and/or an e-mail when something this serious happens. Perhaps a longer (or configurable) startup delay should also be included to wait for clamd.exe to start listening.

As a result of this discovery, we are now checking port 3310 with our monitoring software to make sure clamd.exe is responding (telnet to 3310, send "PING" and you should receive "PONG" back). We probably should have done this from the beginning.

-Tom Rusnock

[polarisie]

Hello,
I noticed today that mxscan seems to have a lot of trouble starting clamd.exe, and sometimes fails. It seems to check the VERSION command too early (after clamd.exe started but before it has started listening on port 3310). It USUALLY succeeds on a later attempt.

However, on several occasions, mxscan determined that clamd.exe was permanently unavailable and disabled the virus checking. I would really like to get a pop-up to warn me that virus checking was disabled, rather than just a log file entry. As it stands now, the "Started Successfully" popup is displayed before mxscan even tries to run clamd.exe and spamd.exe.

Here is a log showing a failed attempt...

06/25/08 09:54:38 Attempting to Start ClamDaemon ...
06/25/08 09:54:45 ClamDaemon started...
06/25/08 09:54:53 Error in [ClamD_SocketScan]! No connection could be made because the target machine actively refused it 127.0.0.1:3310
06/25/08 09:54:53 Checking to see if ClamDaemon has responded correctly.
06/25/08 09:55:03 Did not receive correct ClamDaemon response.
06/25/08 09:55:13 Second Attempt to query ClamD for correct response.
06/25/08 09:55:24 Error in [ClamD_SocketScan]! No connection could be made because the target machine actively refused it 127.0.0.1:3310
06/25/08 09:55:24 Checking to see if ClamDaemon has responded correctly.
06/25/08 09:55:26 Error in [ClamD_1]. Unable to start ClamDaemon...
06/25/08 09:55:26 Setting blnClamDPermentantFailure = True. All future ClamD checks disabled. Please ensure that the ClamAV is properly configured and that nothing is blocking the port 3310

Has anyone else seen this happen? (Search your mxscan-service_{date}.log file for "blnClamDPermentantFailure")

Our server is not under very much load now (thanks to mxscan's overall efficiency as compared to F-Prot 6!), so I don't think this is just a slow server issue. Regardless, I think mxscan should alert us with a pop-up and/or an e-mail when something this serious happens. Perhaps a longer (or configurable) startup delay should also be included to wait for clamd.exe to start listening.

As a result of this discovery, we are now checking port 3310 with our monitoring software to make sure clamd.exe is responding (telnet to 3310, send "PING" and you should receive "PONG" back). We probably should have done this from the beginning.

-Tom Rusnock

Hi Tom

The ClamAV package that is included in the bundle is the build from SOSDG which runs in Cygwin emulation mode. I have also noticed that on certain servers due to the cygwin emulation it takes more effort to get it started the first time around. However once this overcomed it will continue to run on future restarts without issue. Sometimes a reboot also helps.

Another thing to check is to make sure that you have no other TSR software running at background like a Resident Antivirus or Software Firewall

MxScan has been designed to retry for 5 times and then disable the ClamD service so that it does not get in the way if it fails to start for whatever reason. However, i will take your suggestion under consideration and see if there is a safe/proper way to alert the user via a pop up in the event it fails. I will also look into extending the "ping command" for the service so that it has more time to start

Cheers

[trusnock]

Thanks for the quick response. We do have a memory-resident AV program, but it excludes all MailEnable-related directories (ME, mxuptime, MERO) from it's real-time scanning. Is this still a problem?

I temporarily enabled clamd.exe logging to get some statistics: Our ClamAV takes 23 seconds to load the definitions, and 47 seconds before it processes the first e-mail (log included below). I can see the memory usage ramp up slowly during this period in Task Manager.

At least in our case, it seems mxcan should be much more patient when checking to see if clamd.exe is running.


Here's the clamd.exe log...

Wed Jun 25 10:53:57 2008 -> +++ Started at Wed Jun 25 10:53:57 2008
Wed Jun 25 10:53:57 2008 -> clamd daemon SOSDG_0.93-1/devel-20080416 (OS: cygwin, ARCH: i386, CPU: i686)
Wed Jun 25 10:53:57 2008 -> Log file size limited to 1048576 bytes.
Wed Jun 25 10:53:57 2008 -> Reading databases from C:\PROGRA~1\MxUptime\MxScanME\clam\share\clamav
Wed Jun 25 10:53:57 2008 -> Not loading PUA signatures.
Wed Jun 25 10:54:20 2008 -> Loaded 345456 signatures.
Wed Jun 25 10:54:20 2008 -> TCP: Bound to address 127.0.0.1 on port 3310
Wed Jun 25 10:54:20 2008 -> TCP: Setting connection queue length to 30
Wed Jun 25 10:54:20 2008 -> Limits: Global size limit set to 10485760 bytes.
Wed Jun 25 10:54:20 2008 -> Limits: File size limit set to 5242880 bytes.
Wed Jun 25 10:54:20 2008 -> Limits: Recursion level limit set to 5.
Wed Jun 25 10:54:20 2008 -> Limits: Files limit set to 500.
Wed Jun 25 10:54:20 2008 -> Archive support enabled.
Wed Jun 25 10:54:20 2008 -> Algorithmic detection enabled.
Wed Jun 25 10:54:20 2008 -> Portable Executable support enabled.
Wed Jun 25 10:54:20 2008 -> ELF support enabled.
Wed Jun 25 10:54:20 2008 -> Mail files support enabled.
Wed Jun 25 10:54:20 2008 -> OLE2 support enabled.
Wed Jun 25 10:54:20 2008 -> PDF support disabled.
Wed Jun 25 10:54:20 2008 -> HTML support enabled.
Wed Jun 25 10:54:20 2008 -> Self checking every 1800 seconds.
Wed Jun 25 10:54:44 2008 -> C:\Program Files\Mail Enable\QUEUES\SMTP\Inbound\Messages\mxscan_hold_1\0313D2E425984A70A626E2DB25D8AB6D.MAI: Email.Hdr.Sanesecurity.08041600.BobaxSpam FOUND
Wed Jun 25 10:54:45 2008 -> C:\Program Files\Mail Enable\QUEUES\SMTP\Inbound\Messages\mxscan_hold_1\0B3A9D54166C469E959E212B0CA81255.MAI: Email.Spam.Gen3478.Sanesecurity.08062103 FOUND


-Tom

[polarisie]

Thanks for the quick response. We do have a memory-resident AV program, but it excludes all MailEnable-related directories (ME, mxuptime, MERO) from it's real-time scanning. Is this still a problem?

I temporarily enabled clamd.exe logging to get some statistics: Our ClamAV takes 23 seconds to load the definitions, and 47 seconds before it processes the first e-mail (log included below). I can see the memory usage ramp up slowly during this period in Task Manager.

At least in our case, it seems mxcan should be much more patient when checking to see if clamd.exe is running.


Here's the clamd.exe log...

Wed Jun 25 10:53:57 2008 -> +++ Started at Wed Jun 25 10:53:57 2008
Wed Jun 25 10:53:57 2008 -> clamd daemon SOSDG_0.93-1/devel-20080416 (OS: cygwin, ARCH: i386, CPU: i686)
Wed Jun 25 10:53:57 2008 -> Log file size limited to 1048576 bytes.
Wed Jun 25 10:53:57 2008 -> Reading databases from C:\PROGRA~1\MxUptime\MxScanME\clam\share\clamav
Wed Jun 25 10:53:57 2008 -> Not loading PUA signatures.
Wed Jun 25 10:54:20 2008 -> Loaded 345456 signatures.
Wed Jun 25 10:54:20 2008 -> TCP: Bound to address 127.0.0.1 on port 3310
Wed Jun 25 10:54:20 2008 -> TCP: Setting connection queue length to 30
Wed Jun 25 10:54:20 2008 -> Limits: Global size limit set to 10485760 bytes.
Wed Jun 25 10:54:20 2008 -> Limits: File size limit set to 5242880 bytes.
Wed Jun 25 10:54:20 2008 -> Limits: Recursion level limit set to 5.
Wed Jun 25 10:54:20 2008 -> Limits: Files limit set to 500.
Wed Jun 25 10:54:20 2008 -> Archive support enabled.
Wed Jun 25 10:54:20 2008 -> Algorithmic detection enabled.
Wed Jun 25 10:54:20 2008 -> Portable Executable support enabled.
Wed Jun 25 10:54:20 2008 -> ELF support enabled.
Wed Jun 25 10:54:20 2008 -> Mail files support enabled.
Wed Jun 25 10:54:20 2008 -> OLE2 support enabled.
Wed Jun 25 10:54:20 2008 -> PDF support disabled.
Wed Jun 25 10:54:20 2008 -> HTML support enabled.
Wed Jun 25 10:54:20 2008 -> Self checking every 1800 seconds.
Wed Jun 25 10:54:44 2008 -> C:\Program Files\Mail Enable\QUEUES\SMTP\Inbound\Messages\mxscan_hold_1\0313D2E425984A70A626E2DB25D8AB6D.MAI: Email.Hdr.Sanesecurity.08041600.BobaxSpam FOUND
Wed Jun 25 10:54:45 2008 -> C:\Program Files\Mail Enable\QUEUES\SMTP\Inbound\Messages\mxscan_hold_1\0B3A9D54166C469E959E212B0CA81255.MAI: Email.Spam.Gen3478.Sanesecurity.08062103 FOUND


-Tom

Have u tried restarting? also, depending on your server i would eventually disable the clamD logging, I've seen funny IO issues on slower server

[trusnock]

Are you asking about restarting the server, the AV, or mxscan?

We have not restarted the server yet; we just discovered the issue this morning so it will have to wait until tonight.

We have not restarted the memory-resident AV scanner.

I have restarted the mxscan service several times today and clamd.exe fails about 25% of the time.

I only turned the clamd.exe logging on for a few minutes because I assumed you had it disabled for a reason.

-Tom

[polarisie]

Are you asking about restarting the server, the AV, or mxscan?

We have not restarted the server yet; we just discovered the issue this morning so it will have to wait until tonight.

We have not restarted the memory-resident AV scanner.

I have restarted the mxscan service several times today and clamd.exe fails about 25% of the time.

I only turned the clamd.exe logging on for a few minutes because I assumed you had it disabled for a reason.

-Tom

I was referring to the Server. Is the server CPU multicore or Hyperthreading?