McAfee Enterprise 8.5i
-
- Posts: 52
- Joined: Sun Sep 20, 2009 4:24 pm
McAfee Enterprise 8.5i
Has anyone successfully gotten the command line to work on this version with MailEnable 4.x?
I have tried many different options and it never seems to work.
I do know that scan.exe is no longer available and the options have been changed.
If anyone can provide the right settings, I would really appreciate it!
Michael
I have tried many different options and it never seems to work.
I do know that scan.exe is no longer available and the options have been changed.
If anyone can provide the right settings, I would really appreciate it!
Michael
-
- Posts: 5858
- Joined: Fri Jan 16, 2004 6:49 am
- Location: Melbourne
Here is some help with McAfee;
http://www.mailenable.com/kb/Content/Ar ... D=me020287
With version 8 there have been some changes made by McAfee that change the configuration of the command line scanner for MailEnable.
For the command line options you need to change then to the following;
"agent" /target "filename" /analyse /unzip /archive /delete
Also use csscan.exe as the executable.
If not already the option to let the scanner delete the message needs to be selected also.
Let us know if you are unsure of anything above.
http://www.mailenable.com/kb/Content/Ar ... D=me020287
With version 8 there have been some changes made by McAfee that change the configuration of the command line scanner for MailEnable.
For the command line options you need to change then to the following;
"agent" /target "filename" /analyse /unzip /archive /delete
Also use csscan.exe as the executable.
If not already the option to let the scanner delete the message needs to be selected also.
Let us know if you are unsure of anything above.
Regards,
Product Services
MailEnable Pty Ltd
To keep track of all ME company updates and version releases you should subscribe to the MailEnable list at http://www.mailenable.com or the RSS feed http://www.mailenable.com/rss.
Product Services
MailEnable Pty Ltd
To keep track of all ME company updates and version releases you should subscribe to the MailEnable list at http://www.mailenable.com or the RSS feed http://www.mailenable.com/rss.
Re: McAfee Enterprise 8.5i
Help!
I can't seem to get this to work. Here's the error log:
Error scanning attachment - Command Line Scanner Process ("C:\Program Files\McAfee\VirusScan Enterprise\csscan.exe" /target "D:\PROGRA~1\MAILEN~1\Scratch\AA2D2D~1.MAI\1.ATT" /ANALYSE /unzip /archive /delete) took too long and needed to be terminated, but failed with error 5
What do I do?
I can't seem to get this to work. Here's the error log:
Error scanning attachment - Command Line Scanner Process ("C:\Program Files\McAfee\VirusScan Enterprise\csscan.exe" /target "D:\PROGRA~1\MAILEN~1\Scratch\AA2D2D~1.MAI\1.ATT" /ANALYSE /unzip /archive /delete) took too long and needed to be terminated, but failed with error 5
What do I do?
---
Shaun Rieman
Advanced Micro Technologies, LLC
Shaun Rieman
Advanced Micro Technologies, LLC
-
- Posts: 5858
- Joined: Fri Jan 16, 2004 6:49 am
- Location: Melbourne
Re: McAfee Enterprise 8.5i
Error 5 is usually due to a permissions error on the MailEnable folders. Make sure the MTA service is running under the IME_SYSTEM account and that this has full control permissions on the MailEnable\Scratch folder. Or in your case the D:\PROGRA~1\MAILEN~1\Scratch folder.
Also ensure that you do not have a resident anti virus program checking these same folders as it could be locking the file and preventing access to the command line scanner. Also reduce your MTA threads to 1 while you are testing to rule out any mulitple threading issues with the scanner.
Also ensure that you do not have a resident anti virus program checking these same folders as it could be locking the file and preventing access to the command line scanner. Also reduce your MTA threads to 1 while you are testing to rule out any mulitple threading issues with the scanner.
Regards,
Product Services
MailEnable Pty Ltd
To keep track of all ME company updates and version releases you should subscribe to the MailEnable list at http://www.mailenable.com or the RSS feed http://www.mailenable.com/rss.
Product Services
MailEnable Pty Ltd
To keep track of all ME company updates and version releases you should subscribe to the MailEnable list at http://www.mailenable.com or the RSS feed http://www.mailenable.com/rss.
Re: McAfee Enterprise 8.5i
MTA is using "Local System" ... How do I set IMA_SYSTEM as the login account if i don't have the password for IMA_SYSTEM?
---
Shaun Rieman
Advanced Micro Technologies, LLC
Shaun Rieman
Advanced Micro Technologies, LLC
-
- Posts: 5858
- Joined: Fri Jan 16, 2004 6:49 am
- Location: Melbourne
Re: McAfee Enterprise 8.5i
What version of MailEnable are you using?
Regards,
Product Services
MailEnable Pty Ltd
To keep track of all ME company updates and version releases you should subscribe to the MailEnable list at http://www.mailenable.com or the RSS feed http://www.mailenable.com/rss.
Product Services
MailEnable Pty Ltd
To keep track of all ME company updates and version releases you should subscribe to the MailEnable list at http://www.mailenable.com or the RSS feed http://www.mailenable.com/rss.
Re: McAfee Enterprise 8.5i
Enterprise 4.22. I'm running MEinstaller right now, I've gone through actions 2-4 and am about to start action 1. I figured I'd also do 12. Any other recommendations? Thanks!
---
Shaun Rieman
Advanced Micro Technologies, LLC
Shaun Rieman
Advanced Micro Technologies, LLC
-
- Posts: 5858
- Joined: Fri Jan 16, 2004 6:49 am
- Location: Melbourne
Re: McAfee Enterprise 8.5i
Actually Local System should be OK for the MTA service but make sure it does have permission to the folder in question. It would not hurt to use the IME_SYSTEM account now that you know the password anyway. Local System is the default account for the MTA service sorry about my confusion I forgot for a second that only outward facing services are configured to use the IME_SYSTEM account.
If the above does not help then you may need to run Process Monitor (Http://www.sysinternals.com) and then filter on the scratch directory to see if you can pick up any permissions denied errors while either the command line or the MTA is accessing the Scratch folder.
If the above does not help then you may need to run Process Monitor (Http://www.sysinternals.com) and then filter on the scratch directory to see if you can pick up any permissions denied errors while either the command line or the MTA is accessing the Scratch folder.
Regards,
Product Services
MailEnable Pty Ltd
To keep track of all ME company updates and version releases you should subscribe to the MailEnable list at http://www.mailenable.com or the RSS feed http://www.mailenable.com/rss.
Product Services
MailEnable Pty Ltd
To keep track of all ME company updates and version releases you should subscribe to the MailEnable list at http://www.mailenable.com or the RSS feed http://www.mailenable.com/rss.
Re: McAfee Enterprise 8.5i
I see csscan accessing the scratch directory but it's not removing a test virus file. One thing i did notice is that when i do csscan d:\ from the command prompt, even though it's only 3 files it takes over 6000ms to load the scan engine. Would load time be an issue?
---
Shaun Rieman
Advanced Micro Technologies, LLC
Shaun Rieman
Advanced Micro Technologies, LLC
-
- Posts: 5858
- Joined: Fri Jan 16, 2004 6:49 am
- Location: Melbourne
Re: McAfee Enterprise 8.5i
Possibly, you could try to increase the timeout for the AV scan process. The setting is stored in decimal milliseconds in the following registry key:
HKLM->Software->MailEnable->MailEnable->Agents->MTA->Filters->Process Timeout by default the setting is 20,000 milliseconds.
HKLM->Software->MailEnable->MailEnable->Agents->MTA->Filters->Process Timeout by default the setting is 20,000 milliseconds.
Regards,
Product Services
MailEnable Pty Ltd
To keep track of all ME company updates and version releases you should subscribe to the MailEnable list at http://www.mailenable.com or the RSS feed http://www.mailenable.com/rss.
Product Services
MailEnable Pty Ltd
To keep track of all ME company updates and version releases you should subscribe to the MailEnable list at http://www.mailenable.com or the RSS feed http://www.mailenable.com/rss.
Re: McAfee Enterprise 8.5i
No this just isn't working. Here's exactly what i see...
command line arguments:
"[AGENT]" /target "[FILENAME]" /analyse /unzip /archive /delete
i click - test settings and get:
Error: AV-1005 Antivirus Checker Failed - Virus Not Detected
in the log i see
02/18/10 12:20:17 Error scanning attachment - Command Line Scanner Process ("C:\Program Files\McAfee\VirusScan Enterprise\csscan.exe" /target "D:\PROGRA~1\MAILEN~1\Scratch\730A24~1.MAI\1.ATT" /analyse /unzip /archive /delete) took too long and needed to be terminated, but failed with error 5
I changed the timeout to 50,000ms but just a note, the failure on test happens instantly, there is no delay to failure.
command line arguments:
"[AGENT]" /target "[FILENAME]" /analyse /unzip /archive /delete
i click - test settings and get:
Error: AV-1005 Antivirus Checker Failed - Virus Not Detected
in the log i see
02/18/10 12:20:17 Error scanning attachment - Command Line Scanner Process ("C:\Program Files\McAfee\VirusScan Enterprise\csscan.exe" /target "D:\PROGRA~1\MAILEN~1\Scratch\730A24~1.MAI\1.ATT" /analyse /unzip /archive /delete) took too long and needed to be terminated, but failed with error 5
I changed the timeout to 50,000ms but just a note, the failure on test happens instantly, there is no delay to failure.
---
Shaun Rieman
Advanced Micro Technologies, LLC
Shaun Rieman
Advanced Micro Technologies, LLC
Re: McAfee Enterprise 8.5i
Ok now this is upsetting. I purchase panda command line scanner, uncompressed it, updated it to the latest DAT and though the test is successfull i'm getting this in the log:
02/18/10 15:15:09 Error scanning attachment - Command Line Scanner Process ("D:\Panda\pavcl32\Pavcl.exe" "D:\PROGRA~1\MAILEN~1\Scratch\7A4395~1.MAI\1.ATT" /nom /nob /cmp /heu /nos /aex /aut /nor /clv) took too long and was terminated
02/18/10 15:15:09 Error scanning attachment - Command Line Scanner Process ("D:\Panda\pavcl32\Pavcl.exe" "D:\PROGRA~1\MAILEN~1\Scratch\7A4395~1.MAI\1.ATT" /nom /nob /cmp /heu /nos /aex /aut /nor /clv) took too long and was terminated
---
Shaun Rieman
Advanced Micro Technologies, LLC
Shaun Rieman
Advanced Micro Technologies, LLC
-
- Posts: 1
- Joined: Thu Feb 18, 2010 9:02 pm
Re: McAfee Enterprise 8.5i
I feel your pain, been working on this baby for the last few hours. One thing I see, you are using the switch /Delete. This gave me an error and I switched it to /Primary Delete. I sent a file with a zipped EICAR and it blocked it and logged it accordingly.
Program Path: C:\Program Files\McAfee\VirusScan Enterprise\csscan.exe
Command Line Args: "[AGENT]" /target "[FILENAME]" /analyse /multiext /allapps /unzip /archive /mime /primary delete
Also i bumped up the timeout to 60k ms.
However, it looks like I'm still getting errors with regular attachments (Not the eicar thingee)
Here is the one that it handled correctly:
02/18/10 15:53:56 Cleaned 11DC50625507445A9F3DE5E56A11089E.MAI SMTP MTAFILTER 0 xxxxxx.com myemail@xxxxxx.com xx.xxx.20.37
The rest all look like this:
02/18/10 15:56:09 Error scanning attachment - Command Line Scanner Process ("C:\Program Files\McAfee\VirusScan Enterprise\csscan.exe" /target "D:\MAILEN~1\Scratch\959B61~1.MAI\1.ATT" /analyse /multiext /allapps /unzip /archive /mime /primary delete) took too long and needed to be terminated, but failed with error 5
Program Path: C:\Program Files\McAfee\VirusScan Enterprise\csscan.exe
Command Line Args: "[AGENT]" /target "[FILENAME]" /analyse /multiext /allapps /unzip /archive /mime /primary delete
Also i bumped up the timeout to 60k ms.
However, it looks like I'm still getting errors with regular attachments (Not the eicar thingee)
Here is the one that it handled correctly:
02/18/10 15:53:56 Cleaned 11DC50625507445A9F3DE5E56A11089E.MAI SMTP MTAFILTER 0 xxxxxx.com myemail@xxxxxx.com xx.xxx.20.37
The rest all look like this:
02/18/10 15:56:09 Error scanning attachment - Command Line Scanner Process ("C:\Program Files\McAfee\VirusScan Enterprise\csscan.exe" /target "D:\MAILEN~1\Scratch\959B61~1.MAI\1.ATT" /analyse /multiext /allapps /unzip /archive /mime /primary delete) took too long and needed to be terminated, but failed with error 5
Re: McAfee Enterprise 8.5i
This is just terrible. Mailenable simply doesn't work with AV scanners anymore. Not McAfee, not Panda...
This needs to be fixed immediately.
This needs to be fixed immediately.
---
Shaun Rieman
Advanced Micro Technologies, LLC
Shaun Rieman
Advanced Micro Technologies, LLC
Re: McAfee Enterprise 8.5i
Any news? I have the same problem with McAfee 8.7i