On Jan 29, Norman (our antivirus partner), released an upgrade of the antivirus engine. We have been made aware that there is an issue when receiving some emails containing PDF attachments. Depending on how the MIME attachments are added to the emails, the antivirus plugin may cause the email to be rejected even if the PDF file is legitimate, without adding the email to the quarantine. The sender will however be notified of the delivery problem.

While we work with Norman to solve this issue, if you are experiencing the problems described, you may follow the procedure below to revert back to the previous version of the antivirus plugin.

Download a copy of the previous AV plugin files from:

http://www.logsat.com/spamfilter/pub/temp/nse-1-28-09.zip

To downgrade, you will need to:

1. Stop SpamFilter
2. Extract the contents of the zip files above in the \SpamFilter\Nse\Bin directory, replacing all the existing files with the new ones.
3. Edit the SpamFilter.ini file, and look for the section [NVC]. Underneath it, you will see entries similar to:

NvcBinDate=1/28/2009 10:12:02 AM
NvcIncrDate=1/31/2009 3:11:16 PM
NvcMacroDate=1/28/2009 9:56:54 AM
Nse_w32Date=1/16/2009 2:00:52 PM
NCLDate=4/28/2008 11:55:50 AM

4. You will need to change those dates to a date in the future, so that SpamFilter will not attempt to download updates, for example:

NvcBinDate=1/28/2010 10:12:02 AM
NvcIncrDate=1/31/2010 3:11:16 PM
NvcMacroDate=1/28/2010 9:56:54 AM
Nse_w32Date=1/16/2010 2:00:52 PM
NCLDate=4/28/2010 11:55:50 AM

5. Then restart SpamFilter.


Please note that if you do follow this procedure, you will need to manually revert back the dates in the SpamFilter.ini file to receive the correct files when we solve this problem (hopefully within the next few hours). We will update this thread as soon as we have new information.

Update - We have received reports of this issue occurring with valid PDF files as well. Norman is working trying to find a solution soon, and we are looking for workarounds within SpamFilter itself.

We've placed a copy of the previous AV plugin files with updated virus definitions at:

http://www.logsat.com/spamfilter/pub/temp/nse-2-3-09.zip

Update - Normal almost beat us in releasing a patch .

We've received an updated nse_w32.dll (v6.0.6.0) that solves the issue discovered in the buggy nse_w32.dll v6.0.2.0.

This update will be deployed automatically during the next AV update cycle that occurs hourly.


If you have manually deployed the *previous* version of the antivirus plugin (the one having the Nse_w32.dll v 5.93) to temporarily solve this issue as mentioned in the earlier posts in the forum, all you need to do is to edit the SpamFilter.ini file and restore the older settings in the [NVC] section of this file:

NvcBinDate=1/28/2009 10:12:02 AM
NvcIncrDate=1/31/2009 3:11:16 PM
NvcMacroDate=1/28/2009 9:56:54 AM
Nse_w32Date=1/16/2009 2:00:52 PM
NCLDate=4/28/2008 11:55:50 AM

There is no need to restart SpamFilter after making these changes. Once this is done, within 60 minutes SpamFilter will automatically download the updates.

If you wish, you can also trigger the download of the new antivirus files manually by going to the "AntiVirus" tab in SpamFilter and click on the "Update Now" button. PLEASE NOTE THAT YOU WILL NEED TO WAIT 60 SECONDS AFTER SAVING THE SPAMFILTER.INI FILE BEFORE TRIGGERING THE MANUAL UPDATE. This is because SpamFilter may take up to 60 seconds before re-importing the settings in the SpamFilter.ini file.

It is to be noted that Norman provided us the patch in v6.0.6.0 in a "beta" status, as the update has not gone thru their normal QA process. We feel however that the bug present in the "official v6.0.2.0 version is serious enough, and with the potential of causing other issues not detected yet, that it is safer to use the latest beta rather than the buggy release. If you do not wish to use the beta version, simply follow the procedures in the previous posts to download the previous v5 of the Norma antivirus plugin.

Edited by LogSat - 04 February 2009 at 4:30pm