McAfee Enterprise 8.5i

Discussions on webmail and the Professional version.
sales@cavallocomm.com
Posts: 52
Joined: Sun Sep 20, 2009 4:24 pm

McAfee Enterprise 8.5i

Post by sales@cavallocomm.com »

Has anyone successfully gotten the command line to work on this version with MailEnable 4.x?

I have tried many different options and it never seems to work.

I do know that scan.exe is no longer available and the options have been changed.
If anyone can provide the right settings, I would really appreciate it!

Michael

MailEnable-Ben
Posts: 5858
Joined: Fri Jan 16, 2004 6:49 am
Location: Melbourne

Post by MailEnable-Ben »

Here is some help with McAfee;

http://www.mailenable.com/kb/Content/Ar ... D=me020287

With version 8 there have been some changes made by McAfee that change the configuration of the command line scanner for MailEnable.

For the command line options you need to change then to the following;

"agent" /target "filename" /analyse /unzip /archive /delete

Also use csscan.exe as the executable.

If not already the option to let the scanner delete the message needs to be selected also.

Let us know if you are unsure of anything above.
Regards,

Product Services
MailEnable Pty Ltd

To keep track of all ME company updates and version releases you should subscribe to the MailEnable list at http://www.mailenable.com or the RSS feed http://www.mailenable.com/rss.

webshaun
Posts: 246
Joined: Wed May 25, 2005 8:37 pm
Location: NJ
Contact:

Re: McAfee Enterprise 8.5i

Post by webshaun »

Help!

I can't seem to get this to work. Here's the error log:

Error scanning attachment - Command Line Scanner Process ("C:\Program Files\McAfee\VirusScan Enterprise\csscan.exe" /target "D:\PROGRA~1\MAILEN~1\Scratch\AA2D2D~1.MAI\1.ATT" /ANALYSE /unzip /archive /delete) took too long and needed to be terminated, but failed with error 5

What do I do?
---
Shaun Rieman
Advanced Micro Technologies, LLC

MailEnable-Ben
Posts: 5858
Joined: Fri Jan 16, 2004 6:49 am
Location: Melbourne

Re: McAfee Enterprise 8.5i

Post by MailEnable-Ben »

Error 5 is usually due to a permissions error on the MailEnable folders. Make sure the MTA service is running under the IME_SYSTEM account and that this has full control permissions on the MailEnable\Scratch folder. Or in your case the D:\PROGRA~1\MAILEN~1\Scratch folder.

Also ensure that you do not have a resident anti virus program checking these same folders as it could be locking the file and preventing access to the command line scanner. Also reduce your MTA threads to 1 while you are testing to rule out any mulitple threading issues with the scanner.
Regards,

Product Services
MailEnable Pty Ltd

To keep track of all ME company updates and version releases you should subscribe to the MailEnable list at http://www.mailenable.com or the RSS feed http://www.mailenable.com/rss.

webshaun
Posts: 246
Joined: Wed May 25, 2005 8:37 pm
Location: NJ
Contact:

Re: McAfee Enterprise 8.5i

Post by webshaun »

MTA is using "Local System" ... How do I set IMA_SYSTEM as the login account if i don't have the password for IMA_SYSTEM?
---
Shaun Rieman
Advanced Micro Technologies, LLC

MailEnable-Ben
Posts: 5858
Joined: Fri Jan 16, 2004 6:49 am
Location: Melbourne

Re: McAfee Enterprise 8.5i

Post by MailEnable-Ben »

What version of MailEnable are you using?
Regards,

Product Services
MailEnable Pty Ltd

To keep track of all ME company updates and version releases you should subscribe to the MailEnable list at http://www.mailenable.com or the RSS feed http://www.mailenable.com/rss.

webshaun
Posts: 246
Joined: Wed May 25, 2005 8:37 pm
Location: NJ
Contact:

Re: McAfee Enterprise 8.5i

Post by webshaun »

Enterprise 4.22. I'm running MEinstaller right now, I've gone through actions 2-4 and am about to start action 1. I figured I'd also do 12. Any other recommendations? Thanks!
---
Shaun Rieman
Advanced Micro Technologies, LLC

MailEnable-Ben
Posts: 5858
Joined: Fri Jan 16, 2004 6:49 am
Location: Melbourne

Re: McAfee Enterprise 8.5i

Post by MailEnable-Ben »

Actually Local System should be OK for the MTA service but make sure it does have permission to the folder in question. It would not hurt to use the IME_SYSTEM account now that you know the password anyway. Local System is the default account for the MTA service sorry about my confusion I forgot for a second that only outward facing services are configured to use the IME_SYSTEM account.

If the above does not help then you may need to run Process Monitor (Http://www.sysinternals.com) and then filter on the scratch directory to see if you can pick up any permissions denied errors while either the command line or the MTA is accessing the Scratch folder.
Regards,

Product Services
MailEnable Pty Ltd

To keep track of all ME company updates and version releases you should subscribe to the MailEnable list at http://www.mailenable.com or the RSS feed http://www.mailenable.com/rss.

webshaun
Posts: 246
Joined: Wed May 25, 2005 8:37 pm
Location: NJ
Contact:

Re: McAfee Enterprise 8.5i

Post by webshaun »

I see csscan accessing the scratch directory but it's not removing a test virus file. One thing i did notice is that when i do csscan d:\ from the command prompt, even though it's only 3 files it takes over 6000ms to load the scan engine. Would load time be an issue?
---
Shaun Rieman
Advanced Micro Technologies, LLC

MailEnable-Ben
Posts: 5858
Joined: Fri Jan 16, 2004 6:49 am
Location: Melbourne

Re: McAfee Enterprise 8.5i

Post by MailEnable-Ben »

Possibly, you could try to increase the timeout for the AV scan process. The setting is stored in decimal milliseconds in the following registry key:

HKLM->Software->MailEnable->MailEnable->Agents->MTA->Filters->Process Timeout by default the setting is 20,000 milliseconds.
Regards,

Product Services
MailEnable Pty Ltd

To keep track of all ME company updates and version releases you should subscribe to the MailEnable list at http://www.mailenable.com or the RSS feed http://www.mailenable.com/rss.

webshaun
Posts: 246
Joined: Wed May 25, 2005 8:37 pm
Location: NJ
Contact:

Re: McAfee Enterprise 8.5i

Post by webshaun »

No this just isn't working. Here's exactly what i see...
command line arguments:
"[AGENT]" /target "[FILENAME]" /analyse /unzip /archive /delete

i click - test settings and get:
Error: AV-1005 Antivirus Checker Failed - Virus Not Detected

in the log i see

02/18/10 12:20:17 Error scanning attachment - Command Line Scanner Process ("C:\Program Files\McAfee\VirusScan Enterprise\csscan.exe" /target "D:\PROGRA~1\MAILEN~1\Scratch\730A24~1.MAI\1.ATT" /analyse /unzip /archive /delete) took too long and needed to be terminated, but failed with error 5

I changed the timeout to 50,000ms but just a note, the failure on test happens instantly, there is no delay to failure.
---
Shaun Rieman
Advanced Micro Technologies, LLC

webshaun
Posts: 246
Joined: Wed May 25, 2005 8:37 pm
Location: NJ
Contact:

Re: McAfee Enterprise 8.5i

Post by webshaun »

Ok now this is upsetting. I purchase panda command line scanner, uncompressed it, updated it to the latest DAT and though the test is successfull i'm getting this in the log:

02/18/10 15:15:09 Error scanning attachment - Command Line Scanner Process ("D:\Panda\pavcl32\Pavcl.exe" "D:\PROGRA~1\MAILEN~1\Scratch\7A4395~1.MAI\1.ATT" /nom /nob /cmp /heu /nos /aex /aut /nor /clv) took too long and was terminated
---
Shaun Rieman
Advanced Micro Technologies, LLC

WillieD123
Posts: 1
Joined: Thu Feb 18, 2010 9:02 pm

Re: McAfee Enterprise 8.5i

Post by WillieD123 »

I feel your pain, been working on this baby for the last few hours. One thing I see, you are using the switch /Delete. This gave me an error and I switched it to /Primary Delete. I sent a file with a zipped EICAR and it blocked it and logged it accordingly.

Program Path: C:\Program Files\McAfee\VirusScan Enterprise\csscan.exe
Command Line Args: "[AGENT]" /target "[FILENAME]" /analyse /multiext /allapps /unzip /archive /mime /primary delete

Also i bumped up the timeout to 60k ms.

However, it looks like I'm still getting errors with regular attachments (Not the eicar thingee)

Here is the one that it handled correctly:
02/18/10 15:53:56 Cleaned 11DC50625507445A9F3DE5E56A11089E.MAI SMTP MTAFILTER 0 xxxxxx.com myemail@xxxxxx.com xx.xxx.20.37

The rest all look like this:
02/18/10 15:56:09 Error scanning attachment - Command Line Scanner Process ("C:\Program Files\McAfee\VirusScan Enterprise\csscan.exe" /target "D:\MAILEN~1\Scratch\959B61~1.MAI\1.ATT" /analyse /multiext /allapps /unzip /archive /mime /primary delete) took too long and needed to be terminated, but failed with error 5

webshaun
Posts: 246
Joined: Wed May 25, 2005 8:37 pm
Location: NJ
Contact:

Re: McAfee Enterprise 8.5i

Post by webshaun »

This is just terrible. Mailenable simply doesn't work with AV scanners anymore. Not McAfee, not Panda...

This needs to be fixed immediately.
---
Shaun Rieman
Advanced Micro Technologies, LLC

froman
Posts: 1
Joined: Sat May 29, 2010 12:30 am

Re: McAfee Enterprise 8.5i

Post by froman »

Any news? I have the same problem with McAfee 8.7i

Post Reply