1. Please take a little time for this simple survey! Thank you for participating!
    Dismiss Notice
  2. Dear Pleskians, please read this carefully! New attachments and other rules Thank you!
    Dismiss Notice
  3. Dear Pleskians, I really hope that you will share your opinion in this Special topic for chatter about Plesk in the Clouds. Thank you!
    Dismiss Notice

drweb and hundreds automatic mails

Discussion in 'Plesk 9.x for Linux Issues, Fixes, How-To' started by anthony vasileioy, Oct 31, 2009.

  1. anthony vasileioy

    anthony vasileioy Guest

    0
     
    since I upgrade to Plesk 9.2.3 I have a really annoying situation.
    Drweb sends mails for its updates to drweb@xxxxmy-server.com (non-existent mail) almost every hour.
    All of them return. Imagine what happens to my mailbox.
    How can I stop this antivirus send me mails ???
     
  2. Nataliya Zagr

    Nataliya Zagr Regular Pleskian

    21
    87%
    Joined:
    Apr 14, 2009
    Messages:
    242
    Likes Received:
    0
    Hello Anthony,

    It is possible to disable notifications from DrWeb. In order to do so, several corrections should be made in the Parallels Plesk Panel (PP) database:

    1.Connect to the database

    2. Make sure that the record regarding antivirus notifications exists in psa.misc table. It can be verified using the following SQL query:

    > select val from misc where param = 'AntivirusNotifyAdmin';

    The query should return one of the values below:

    0 - notifications are disabled;
    1 - notifications are enabled;

    Notification can be enabled or disabled by switching the parameter using one of the queries below:

    To disable notifications
    > update misc set val='0' where param = 'AntivirusNotifyAdmin';

    To enable notifications
    > update misc set val='1' where param = 'AntivirusNotifyAdmin';

    Non-existent record can be inserted using the query:
    > insert into misc values ('AntivirusNotifyAdmin','0');

    Please, check the following article for more information:

    http://kb.odin.com/en/970

    Thank you
     
  3. trialotto

    trialotto Golden Pleskian Plesk Guru

    37
     
    Joined:
    Sep 28, 2009
    Messages:
    1,445
    Likes Received:
    206
    Alternative solution?

    With some surprise I am reading the above. Nice to know that we can alter the database, but it seems to me that exactly the same settings can be changed in drweb configuration files.

    Maybe I am mistaken, but is changing the part:

    #########################
    # Notifications section #
    #########################
    [VirusNotifications]
    # Enable or disable sending notifications to persons (yes/no)
    SenderNotify = yes
    AdminNotify = yes
    RcptsNotify = yes

    ....

    in the file drweb_handler.conf not exactly the same as changing the database entries?

    Please explain Parallels and explain why you choose to inform us to change the database!
     
  4. anthony vasileioy

    anthony vasileioy Guest

    0
     
    Natalia,
    I made this INSERT in MISC table (value=0) but even with this way Drweb keep sending emails.
    I removed completely Drweb and it is done
     
  5. anthony vasileioy

    anthony vasileioy Guest

    0
     
    Please click one of the Quick Reply icons in the posts above to activate Quick Reply.
     
  6. anthony vasileioy

    anthony vasileioy Guest

    0
     
    It is not possible !!!!!!
    1) I stop drweb update crons, still got drweb mails
    2) I stop drweb services, still got drweb mails
    3) I removed drweb!!!!, still got drweb mails
    4) I removed every remained drweb directory with any kind of ini, pl, and everything has to do with this drweb thing
    Still send mails every hour now !!!
    5) Did what Natalyia said, still got drweb mails every HALF hour now !!! WHAT is this???
    .. at last I found a /etc/cron.d/drweb-update that has:
    I deleted file and.. wait to see.
    There are 2 options:
    a) Mails are going to stop
    b) Mails are going to continue but.. every minute !!! hehehehe

    Conclusion: DrWeb Antivirus is .. a Virus
     
  7. internezzo

    internezzo New Pleskian

    19
    85%
    Joined:
    Feb 1, 2010
    Messages:
    15
    Likes Received:
    0
    Hi

    We made the database change and deactivated almost all notifications in:
    /etc/drweb/drweb_handler.conf

    but the mails persist. Is there really no solution from Parallels?

    Best regards
    Marcel
     
  8. IgorG

    IgorG Forums Analyst Staff Member

    49
    24%
    Joined:
    Oct 27, 2009
    Messages:
    24,572
    Likes Received:
    1,243
    Location:
    Novosibirsk, Russia
  9. internezzo

    internezzo New Pleskian

    19
    85%
    Joined:
    Feb 1, 2010
    Messages:
    15
    Likes Received:
    0
    Hi Igor

    The workaround with "CronSummary = No" seems to work. Thanks!

    Best regards
    Marcel
     
  10. WebW

    WebW Guest

    0
     
    Did the CronSummary workaround - now I have more problems

    Hi,

    I was having this same problem, found the CronSummary = No workaround, did that, and it worked great...for a about a week. Now I get a new message, still from Dr. Web, and I get about 15 of these a day.


    I still want to receive errors from email addresses that don't work, I have some of those come through, and they are very helpful in diagnosing problems with some of our contact forms, so I don't want to just shut off all notifications.

    Is there anything I can do to fix this??

    Thank you,

    Steve
     
  11. trialotto

    trialotto Golden Pleskian Plesk Guru

    37
     
    Joined:
    Sep 28, 2009
    Messages:
    1,445
    Likes Received:
    206
    Solution to try....

    In essence, the discussion about drweb being a pain in the *** is somewhat inapropriate.

    DrWeb does what is told to, messaging everyday about (cron-based) updates.

    Solution in general (all involving a change of the drweb32.ini file):
    - update messages will not be sent: CronSummary = no
    - update messages will be sent, reducing the interval: in earlier sections, change the notifications sections to weekly or another interval (instead of everyday).

    (Naturally, restart drwebd if changing drweb32.ini !!!!)

    However, what most people think of as disturbing, is NOT the notification by drweb updater. They ARE bothered by failures in their mail server, being (mostly) non-existing receiver address drweb@domain.tld

    A better solution is to keep drweb32ini unchanged and add a drweb@domain.tld address to your mail server (and clean up regularly). No problems then, at all.

    So, it is not drweb that is the problem. It is the installation of drweb in the qmail system.

    In my opinion, keep all information that is required and create the additional mailbox.

    As a final note, in linux (suse) systems, the updates are also logged in var/log directory, in one or more files. So, my advice is just an advice to prevent all those failure messages from the mail-daemon.
     
  12. WebW

    WebW Guest

    0
     
    Thanks for that response trialotto, that makes sense. However, the Plesk in question hosts many different websites and many different emails, and from the error message, it looks like drweb is sending to <drweb@ip-97-74-195-167.ip.secureserver.net> -- where would I create this "catchall" email account? Can it be on any of the accounts within the server? And it's just drweb@domain.tld?

    Thanks again!
     
  13. Smithy_Dave

    Smithy_Dave Guest

    0
     
    If the workaround with "CronSummary = No" doesn't appear to work check your email mail queue...

    It can store upto 7 days of drweb emails making it look like the cronsummary edit hasn't worked.

    Thank you to the poster who first mentioned the cronsummary drove us mad for months - delete delete arrrgh!
     
  14. trialotto

    trialotto Golden Pleskian Plesk Guru

    37
     
    Joined:
    Sep 28, 2009
    Messages:
    1,445
    Likes Received:
    206
    @Smithy_Dave,

    The solution regarding " cronsummary " is one of the things Parallels suggests.

    As mentioned in my earlier posts, it is not a solution to the cause of drweb mail inconvenience.

    You can do several things, but just creating the drweb@domain.tld mail account is most convenient.

    And furthermore, do not forget to restart drweb daemon if you use the "cronsummary" approach.

    Kind regards....
     
  15. Smithy_Dave

    Smithy_Dave Guest

    0
     
    We did already restart the drweb daemon, but thanks all the same. It always tends to be the small things you forget when making changes.
     
  16. trialotto

    trialotto Golden Pleskian Plesk Guru

    37
     
    Joined:
    Sep 28, 2009
    Messages:
    1,445
    Likes Received:
    206
    @Smithy_Dave,

    That also happens often at Parallels, since the drweb issue is a persistent issue, not resolved in various updates.

    Kind regards....
     
  17. ShankB

    ShankB Guest

    0
     
    If you don't want to get emails about fails of updater, just comment in subroutine 'Log' following line:
    print "ERROR: Dr.Web ® Updater: cell phone tracking $msg !\n" if 'error' eq $level
     
    Last edited by a moderator: Oct 7, 2011
  18. betteres

    betteres New Pleskian

    24
    57%
    Joined:
    Apr 4, 2006
    Messages:
    17
    Likes Received:
    0
    Location:
    Los Angeles
    where is that file located please?
     
Loading...