DrWeb not doing its job on Plesk/MailEnable

[blizz81]

We've had some reports of clients who've received emails off our Plesk server that have tripped up on their local Symantec for having virus-ridden attachments.


Back in the DrWeb update fiasco of November 05 (http://forum.swsoft.com/showthread.php?s=&threadid=28525) , we edited a registry entry (HKLM\SOFTWARE\Mail Enable\Mail Enable\Connectors\SF\Process Mailbox Events) to disable mailbox events. At some point, we turned this back on, and although I can't remember, I'm guessing we applied the drwebpatch that was released in November.


We haven't had the loopback issues return, but it seems as though drweb is missing virus emails. It doesn't seem like there's much to any config or console of any sort with DrWeb - it just works or it doesn't. I can't even verify for sure that it's running outside of noting the DrWebCom service is started.

Any suggestions? Thanks in advance.

 

[mike108]

i have a recent clean install and im also getting loads of viruses on mailboxes that have drweb enabled

 

[Gris@]

as I've understood you've made clean Plesk installation and DrWeb does not work?
you should check DrWeb log. Probably it has not detected it's key

 

[mike108]

Hi

where is drweb log located???

 

[Skeeter]

Hi, Mike

The DRWeb logs can be found in

Plesk\DrWeb\drcom.log

This one contains info on detected Plesk license, available virus bases, version and service status.

 

[blizz81]

Forgot I had even posted this thread.


Looking at it now, I do notice that whenever the DrWeb service restarts itself (which appears to be every 10 minutes, not sure why), the log shows a "Key file isn't found" message. There's a plesk.key in the directory that contains what appears to be a key. Not sure if that needs to be reinitialized, or what. It appears to scan emails in the log, but claims that since it's under eval, its only 'protecting' a pretty limited amount of mailboxes.