Sophos Anti-Virus Config Problem

tstrike2000 · Post by **tstrike2000** » 2005-12-07 21:38

I've tried configuring Sophos in the external virusscan settings of hMailServer but haven't gotten it to work. I've tried many different settings and return values to no avail. Has anyone gotten Sophos to work correctly with hMailServer?

hMailserver 4.1.1 Stable and newest Sophos for Windows 2k/XP.

Post by **martin** » 2005-12-07 21:40

Have you read this?
http://www.hmailserver.com/documentatio ... eturnvalue

tstrike2000 · Post by **tstrike2000** » 2005-12-07 23:52

Yes, I read that first but was unable to get a return value to show up in the logs. I didn't work too long on that though and have switched to clamav through a How-To I saw and it seems to be working pretty well.

Post by **martin** » 2005-12-07 23:54

Alright. So this doesn't really matter any more? I don't have Sophos scanner myself and have no idéa whether it includes a command line scanner.

tstrike2000 · Post by **tstrike2000** » 2005-12-08 04:15

Yeah, Sophos does include a command line scanner, sav32cli.exe. I found a couple of examples of command line switches people have used with sav32cli in different instances, but I could never get it to work with hMailServer. When I read the documentation for external virusscan I tried using 250 for a return value but could never get a usable result to show up in the application and debug logs. However, I saw that AVG and Avast both work with hMailServer. I then saw the How-To for ClamAV and that is working great and uses a lot less resources.

ric melia · Post by **ric melia** » 2005-12-08 10:51

this might be of use:

http://www.mailenable.com/kb/Content/Ar ... D=me020288

i haven't got round to trying it out yet, so let me know if you get it working!

tstrike2000 · Post by **tstrike2000** » 2005-12-08 19:20

Thanks, I looked at that article in the past for reference and still had the problem. However, now it works! I needed to add the -archive option to the scan command which I thought I had done before. The return value for Sophos is 3. Use switches -s for silent, -rec for recursive scan and the -archive switch, then it worked. I thought I tried all those combinations before but could never get it to detect the test virus until now.

tommyk203 · Post by **tommyk203** » 2005-12-28 16:33

I too use sophos antivirus. ive been trying to get sophos to work with hmail, but no lock. below is the syntax i've been using

executable:
"C:\Program Files\Sophos\Sophos Anti-Virus\sav32cli.exe" -s -rec -archive

return value: 3

or
executable: C:\Program Files\Sophos\Sophos Anti-Virus\sav32cli.exe -s -rec -archive

return value: 3

what am i doing wrong. tstrike2000 seemed to get it to work. Any suggestions.

tstrike2000 · Post by **tstrike2000** » 2005-12-28 22:18

You have to point it to a path so it knows what to scan. Use the path to the executable without quotes and then put "%FILE%" -s -rec -archive after it. Only the %FILE% variable will be in quotes. Then try sending an eicar test virus and you should be golden.

Dkø · Post by **Dkø** » 2006-01-13 17:17

I use Avast! et i would like to know if it's possible to make a table with the return value of many antivirus in order to not have to search it for the new users ?

Dkø · Post by **Dkø** » 2006-01-14 20:19

I found the page with configuration of some antivirus :
--> http://hmailserver.com/documentation/?p ... s_external

But unfortunately the are only 3 antivirus and not Avast! 4.

If would be cool if people completed the list

tstrike2000 · Post by **tstrike2000** » 2006-01-14 23:24

The first thing to see is if Avast has a command line scanning option. If so, then try different switches and return values. If you do a search on the forums for Avast you may find someone that has it working.

Dkø · Post by **Dkø** » 2006-01-14 23:40

I searched but I didn't find anything

I found how to look for the return value i the documentation but it seems a little bit abstract for me it's why that i thought that if someone managed to configure for any antivirus it would be good to complete the list of the previous link...

tommyk203 · Post by **tommyk203** » 2006-01-16 03:43

I've been using sophos flawlessly for some time now. use the following info.

scanner executable copy and paste, quotes and everything

"C:\Program Files\Sophos\Sophos Anti-Virus\sav32cli.exe" -s -rec -archive "%FILE%"

return value 3

Tom

Dkø · Post by **Dkø** » 2006-01-16 22:14

It would be good to add it to the list et to complete the list with other people info

thx tommyk203