Major Changes introduced in SpamFilter ISP v2.5 - The new SpamFilter ISP v2.5 includes support for an anti-virus plug-in. LogSat Software has partnered with Norman to provide optional antivirus protection for email traffic.

The antivirus plug-in will be available for purchase separately from SpamFilter ISP and will be an optional component. Unlike SpamFilter ISP's licenses, the antivirus plug-in will be offered as a subscription service with a yearly subscription fee. The amount of the fee has not been finalized yet, but it will not exceed the price of a SpamFilter's license. The availability of the antivirus plug-in for the free version of SpamFilter ISP has not been determined yet.

Technical notes - SpamFilter can run with or without the antivirus plug-in. When SpamFilter starts, it will check for the plug-in files. If they are found, antivirus support will automatically be enabled. We recommend installing the antivirus plug-in after installing SpamFilter. Restart SpamFilter after installing the plug-in to activate it.

Known Issues - In this beta version, virus definition files will not be automatically updated. We may make updates available form our website in the near future. There are cases when the antivirus plug-in installation program does not update the Registry correctly. If the key HKEY_LOCAL_MACHINE\SOFTWARE\Norman Data Defense Systems is not created, please issue the following DOS command from the \SpamFilter\Norman\Nvc\Nse directory:

NSE /INSTALL

This will add the correct registry entries.

Disclaimer - This version is a pre-release beta. As such, problems are expected. 

This beta will expire on March 31, 2005.

Mikek,

The Beta version will discover the existance of Norman and use the engine.  However, you will need to make sure that you "Exclude" the SpamFilter install folder from any real-time scanning.

Dan S.

Hi Roberto,

Does the virus scan take precedence over all other checks that SpamFilter performs, including the whitelists?  If not, where does the virus scan fit in the order of blacklist/whitelist checks?  (I've quoted one of your "order of precedence" messages below for convenience.)

LogSat wrote: All the white lists are checked first. If a match is found, the blacklists are skipped, the email recipients are accepted, and SpamFilter is ready to accept the data command. If none of the whitelists are matched, then the blacklists are currently searched in order below. This order is not user-definable, at least not right now. Allowed Domains Local Domain BlackList Local Emails Blacklist Local Emails TO Blacklist Not in Authorized TO Emails Country Blacklist Reject No Reverse DNS Reject Empty Mail From Reject Same To From Email address Reject Same To From Domain Recipient Count > Max RCPTTO MAPS check Keywords Bayesian Filtering The only exception to the whitelist is the "whitelist keyword check". In order for that to work, the message has to be received first, and for this reason even if the senders is blacklisted by other filters, the email will still be received so that it can be checked against the keyword whitelist. Once a blacklist "hits", all further blacklist checks are skipped.

Thanks,

Jim

Jim,

33917  infected with the virus Sober.K@mm
25880 infected with the virus Sober.K@mm
1354 infected with the virus Netsky.P@mm
369  infected with the virus Netsky.P@mm
69 infected with the virus Netsky.D@mm
66 infected with the virus Netsky.B@mm
65 infected with the virus Netsky.C@mm
57  infected with the virus Bagle.AH@mm
55 infected with the virus Netsky.Q@mm
48 infected with the virus Lovgate.AB@mm
46 infected with the virus Lovgate.AG@mm
41 infected with the virus MyDoom.I@mm
38 infected with the virus Netsky.Z@mm
37 infected with the virus W32/Downloader
36 infected with the virus Bagle.J@mm
31 infected with the virus MyDoom.J@mm
31 infected with the virus Bifrose.D
31  infected with the virus Netsky.Q@mm
30  infected with the virus Netsky.B@mm
30 infected with the virus W32/FunLove.4099
30  infected with the virus Bagle.N@mm
30  infected with the virus Netsky.K@mm
28 infected with the virus Bagle.AH@mm
25  infected with the virus Netsky.D@mm
24 infected with the virus Netsky.K@mm
24 infected with the virus Bagle.N@mm
24 infected with the virus Bagle.BB@mm
22 infected with the virus Mytob.A
21 infected with the virus MyDoom.L@mm
21  infected with the virus Mabutu.A@mm
20 infected with the virus Bagle.AF@mm
19  infected with the virus Bagle.AR@mm
19 infected with the virus Bagle.BC@mm
19  infected with the virus Bagle.BC@mm
15 infected with the virus Mabutu.A@mm
14  infected with the virus Netsky.Z@mm
13  infected with the virus Netsky.C@mm
12  infected with the virus MyDoom.I@mm
12  infected with the virus Bagle.J@mm
12 infected with the virus Netsky.AB@mm
12 infected with the virus W32/Bagle.Gen!Zip
12 infected with the virus Bagle.AR@mm
10 infected with the virus Netsky.AD@mm
10  infected with the virus W32/Bagle.Gen!Zip
9 infected with the virus Netsky.X@mm
9  infected with the virus MyDoom.L@mm
8  infected with the virus Bagle.BB@mm
6  infected with the virus W32/FunLove.4099
6 infected with the virus Bagle.K@mm
6  infected with the virus Mytob.A
4 infected with the virus W32/MEWpacked.gen
4  infected with the virus Netsky.W@mm
4 infected with the virus W32/Valla.2048
4 infected with the virus Netsky.T@mm
4 infected with the virus Bagle.AV@mm
4  infected with the virus Bagle.AF@mm
3 infected with the virus Zafi.D@mm
3 infected with the virus Netsky.W@mm
3  infected with the virus W32/Bagle.Gen!Rar
2 infected with the virus HTML/Bagle
2 infected with the virus Netsky.N@mm
2  infected with the virus Netsky.AD@mm
2  infected with the virus Netsky.AB@mm
2  infected with the virus Zafi.D@mm
2  infected with the virus Netsky.T@mm
2  infected with the virus W95/Pinfi.A
1  infected with the virus HTML/MIME_Exploit
1 infected with the virus Bagle.AE@mm
1  infected with the virus Netsky.X@mm
1  infected with the virus MyDoom.F@mm
1 infected with the virus W32/Malware
1 infected with the virus W32/Klez.H@mm
1 infected with the virus HTML/MIME_Exploit
1 infected with the virus W32/Backdoor
1 infected with the virus W95/Maslan.C
1 infected with the virus Zafi.B@mm
1 infected with the virus MyDoom.AR@mm
1  infected with the virus W32/Magistr.A@mm
1 infected with the virus BugBear.B@mm

I think it is working.

Dan

I checked that and its blank.

Any suggestions?

I installed it to c:\program files\spamfilterav if that helps at all?

LogSat wrote: Mikek, Let me add on to what Dan mentioned. SpamFilter does use the existing Norman engine (provided it's engine v12 or higher). There's a few caveats in this beta build however: The antivirus plugin consists of 3 DLLs used by SpamFilter: dwnse.dll, ncl.dll and nselapi.dll. These files are currently being installed by the antivirus plugin installation program. However the install program is currently not smart enough to see the existing Norman install, and will add another instance of the engine files in the SpamFilter\nvc\nse directory, and registry entries (the key mentioned inthe beta page). This will be fixed shortly. If SpamFilter sees an existing install of Norman, it will use that engine, provided the 3 plugin DLLs are present in the SpamFilter directory.

ok, so after installing the av plugin, I delete the mentioned registry entry and the SpamFilter\nvc\nse directories, except for the 3 DLLs mentioned?

will there be a reduced license fee for users like me that only need the plugin but not the norman engine?

that worked for me too.

I did notice that, even though I block *.com files, when I sent through the eicar test virus, it blocked the file via the black list but it also found that it had a virus and ultimatly blocked the message because of the virus.

JimMeredith wrote: Desperado wrote: Jim, 33917  infected with the virus Sober.K@mm 25880 infected with the virus Sober.K@mm 1354 infected with the virus Netsky.P@mm 369  infected with the virus Netsky.P@mm ...  I think it is working. Dan Dan, you show-off!  Actually, I'm glad you posted your results... good to see performance under load. But based on the resultset you posted, the query I posted earlier needs to be modified to give accurate totals by virus type.  Looks like the RejectDetails field sometimes includes a leading space, sometimes it does not... no biggie, it's easy to just trim it. SELECT COUNT(*) 'Virus_Messages', LTRIM(RejectDetails) 'Details' FROM tblquarantine WHERE RejectID=17 GROUP BY LTRIM(RejectDetails) ORDER BY COUNT(*) DESC Jim

Jim,

Better?

45973 infected with the virus Sober.K@mm
1880 infected with the virus Netsky.P@mm
108 infected with the virus Netsky.D@mm
104 infected with the virus Netsky.B@mm
100 infected with the virus Bagle.AH@mm
92 infected with the virus Netsky.C@mm
92 infected with the virus Netsky.Q@mm
66 infected with the virus Lovgate.AG@mm
56 infected with the virus MyDoom.I@mm
56 infected with the virus Netsky.K@mm
54 infected with the virus Bagle.N@mm
52 infected with the virus Netsky.Z@mm
51 infected with the virus Bagle.J@mm
48 infected with the virus Lovgate.AB@mm
41 infected with the virus Mabutu.A@mm
40 infected with the virus Bagle.BC@mm
37 infected with the virus W32/Downloader
37 infected with the virus W32/FunLove.4099
34 infected with the virus Bagle.AR@mm
34 infected with the virus Bagle.BB@mm
31 infected with the virus Bifrose.D
31 infected with the virus MyDoom.J@mm
29 infected with the virus MyDoom.L@mm
27 infected with the virus Mytob.A
24 infected with the virus Bagle.AF@mm
22 infected with the virus W32/Bagle.Gen!Zip
15 infected with the virus Netsky.AB@mm
13 infected with the virus Netsky.AD@mm
11 infected with the virus Netsky.X@mm
10 infected with the virus Netsky.W@mm
7 infected with the virus Zafi.D@mm
6 infected with the virus Netsky.T@mm
6 infected with the virus W32/Bagle.Gen!Rar
6 infected with the virus Bagle.K@mm
4 infected with the virus W95/Pinfi.A
4 infected with the virus Bagle.AV@mm
3 infected with the virus Netsky.N@mm
3 infected with the virus W32/Valla.2048
2 infected with the virus HTML/MIME_Exploit
2 infected with the virus HTML/Bagle
2 infected with the virus W32/MEWpacked.gen
1 infected with the virus W95/BugBear.B@mm
1 infected with the virus W32/Magistr.A@mm
1 infected with the virus W32/Klez.H@mm
1 infected with the virus W32/Malware
1 infected with the virus Bagle.AE@mm
1 infected with the virus W95/Maslan.C
1 infected with the virus W32/Backdoor
1 infected with the virus Zafi.B@mm
1 infected with the virus BugBear.B@mm
1 infected with the virus MyDoom.AR@mm
1 infected with the virus MyDoom.F@mm

Dan

Kevin, I'd be glad to, but I don't think it will help, since it's not in ASP.  We have a proprietary quarantine management page and "reportlet" that is written in ColdFusion.  We don't use the SpamFilter ASP code at all.

I have had the Beta running successfully under moderate load.  I am increasing the load on the beta today.  I had about 40 discovered and blocked viruses.  I agree filtering on file extensions is preventing a higher count.

The install was smooth on both windows 2000 and 2003 server.  Everything registered correctly.  So far vary stable.

Will the final release include the ability for signature to be updated on a schedule?

Dwight