DrWeb and SmarterMail

[GARMTECH]

Dear forum users and staff,

Here's our situation. We run Plesk 8.6.0.1 with ClamWin and SmarterMail 4 on Windows 2003 Std R2. Recently we decided move to DrWeb. It wasn't installed, so we run Plesk 8.6.0 setup executable and as "update" option installed DrWeb from there. After rescan of components Plesk found DrWeb and we choose it as antivirus. Then we purchased and installed DrWeb license (DrWeb log shows that correct license key is successfully attached). DrWeb Update executes fine, Plesk see updated virus database. But it seems that DrWeb isn't connected to SmarterMail in any way (so doesn't scan email). I state that because: there's no antivirus configured in smartermail admin web interface, on email arrival drweb process doesn't grow in CPU usage and System>Mail>Statistics>Virus statistics show all zeros. How to enable DrWeb antivirus for SmarterMail4? Please help!

PS: Also we use SmarterMail SpamAssassin. System>Mail>Statistics>Spam Statistics also show all zeros. Is it okay?

 

[sergius]

Dear forum users and staff,

Here's our situation. We run Plesk 8.6.0.1 with ClamWin and SmarterMail 4 on Windows 2003 Std R2. Recently we decided move to DrWeb. It wasn't installed, so we run Plesk 8.6.0 setup executable and as "update" option installed DrWeb from there. After rescan of components Plesk found DrWeb and we choose it as antivirus. Then we purchased and installed DrWeb license (DrWeb log shows that correct license key is successfully attached). DrWeb Update executes fine, Plesk see updated virus database. But it seems that DrWeb isn't connected to SmarterMail in any way (so doesn't scan email). I state that because: there's no antivirus configured in smartermail admin web interface, on email arrival drweb process doesn't grow in CPU usage and System>Mail>Statistics>Virus statistics show all zeros. How to enable DrWeb antivirus for SmarterMail4? Please help!

PS: Also we use SmarterMail SpamAssassin. System>Mail>Statistics>Spam Statistics also show all zeros. Is it okay?

Hello GARMTECH,

Please be sure the server-wide and/or personal mail protection settings are enabled: Plesk > Server > Mail > Spam Filtering and Plesk > Server > Mail > Antivirus

 

[GARMTECH]

Mail>Antivirus: Scan both incoming and outgoing mail.
Mail>Spam Filtering: This feature is not supported by license key. But we use SmarterMail SpamAssassin and not PSA SpamAssassin that requires key.

Please help!

 

[sergius]

Mail>Antivirus: Scan both incoming and outgoing mail.
Mail>Spam Filtering: This feature is not supported by license key. But we use SmarterMail SpamAssassin and not PSA SpamAssassin that requires key.

Please help!

Hello GARMTECH,

We cannot reproduce the issue in our lab. Could you provide more detailed scenario?

 

[GARMTECH]

It's a usual Windows 2003 Server Standard R2 (latest windows updates), Plesk 8.6.001, SmarterMail 4.3.3048 and DrwebCom 4.44.0.1017. I've tested antivirus by sending eicar.com file and it wasn't blocked. Server-wide settings set to Scan both incoming and outgoing mail. How can I debug email checking? How DrwebCom is connected with SmarterMail? Your help badly needed!

PS: Looks like SmarterMail doesn't know anything about DrWeb presence at all.

 

[sergius]

It's a usual Windows 2003 Server Standard R2 (latest windows updates), Plesk 8.6.001, SmarterMail 4.3.3048 and DrwebCom 4.44.0.1017. I've tested antivirus by sending eicar.com file and it wasn't blocked. Server-wide settings set to Scan both incoming and outgoing mail. How can I debug email checking? How DrwebCom is connected with SmarterMail? Your help badly needed!

PS: Looks like SmarterMail doesn't know anything about DrWeb presence at all.

Hello GARMTECH,

Could you share SmarterMail > Settings > General Settings > Spool options here?
Please be sure Command-Line file to run on new mail oprtion is Enabled and equals %plesk_bin%smmailfilter.exe %filepath.

 

[GARMTECH]

Dear sergius,

There was a problem. "Command-line file to run on new mail" wasn't enabled, but even after I clicked "Enable" and "Save", eicar.com file to local mailbox wasn't blocked. Nothing new in DrWeb log file in Plesk directory and Mail>Virus statistics all zeros. So here's config:

Spool directory: c:\SmarterMail\Spool\
SubSpools: 10
Sending delay: 120 sec
Time Between Retries: 15, 30, 60, 90 minutes
Command-line file to run on new mail: %plesk_bin%\smmailfilter.exe %filepath [x] Enabled
Command-line timeout: 60 sec

Btw, "Security>Antivirus>ClamAV", "Security>Antivirus>Real-time AV" and "Security>Antivirus>Command Line AV" are disabled (nothing there).

Any possibility to debug drweb functional? Does DrwebCom writes checks or infected found to log file?

 

[sergius]

Dear sergius,

There was a problem. "Command-line file to run on new mail" wasn't enabled, but even after I clicked "Enable" and "Save", eicar.com file to local mailbox wasn't blocked. Nothing new in DrWeb log file in Plesk directory and Mail>Virus statistics all zeros. So here's config:

Spool directory: c:\SmarterMail\Spool\
SubSpools: 10
Sending delay: 120 sec
Time Between Retries: 15, 30, 60, 90 minutes
Command-line file to run on new mail: %plesk_bin%\smmailfilter.exe %filepath [x] Enabled
Command-line timeout: 60 sec

Btw, "Security>Antivirus>ClamAV", "Security>Antivirus>Real-time AV" and "Security>Antivirus>Command Line AV" are disabled (nothing there).

Please try to do followings:

1. replace %plesk_bin% with actual path.
1. restart Plesk Management Service and watch some time Plesk > Server > Mail > Statistics.

Any possibility to debug drweb functional? Does DrwebCom writes checks or infected found to log file?

[HKLM\SOFTWARE\PLESK\PSA Config\Config]
"Debug"=dword:0x00000001

Next watch Plesk Application log via Windows Event Viewer.

 

[GARMTECH]

Dear sergius,

Thanks for help! Changing path to actual one (so it was before I changed to %plesk_bin%) and Plesk Management Service restart solved problem. Looks like it's all about service restart.

Could you please also explain me how to disable DrWeb notifications for sender and recipient on virus found? It's a real spam generator.

"The Doctor Web Anti-Virus has found viruses:
EICAR Test File (NOT a Virus!)
.

in the e-mail coming from "[email protected]" to your address. The message was deleted.

The Doctor Web Anti-Virus on "web2.bigblackhost.net" has found viruses:
EICAR Test File (NOT a Virus!)
.

in the e-mail coming from your address. The message was not delivered.

 

[sergius]

Dear sergius,

Thanks for help! Changing path to actual one (so it was before I changed to %plesk_bin%) and Plesk Management Service restart solved problem. Looks like it's all about service restart.

Could you please also explain me how to disable DrWeb notifications for sender and recipient on virus found? It's a real spam generator.

Please try to

INSERT INTO psa.misc VALUES ('AntivirusNotifyAdmin', '0');
INSERT INTO psa.misc VALUES ('AntivirusNotifySender', '0');
INSERT INTO psa.misc VALUES ('AntivirusNotifyRecipients', '0');