Anti-Viral Plugin (AVP) for SCSMFILTER PLUS

Virus filter for EMWAC IMS mail servers
Page Last Updated: November 25, 2008

Other EMWAC IMS Resources: Zaxalon IMS Support Page EMWAC Internet Mail Server (IMS) 1- Docs 2- Download 3-SMTPRCV ente.limmat.ch^1,2 Swedish University Network² Online Publikationsverbund Stuttgart¹fast351.com³Klint Gore³Korea Server Manager Group¹

Background:

AVP is a program for internet mail servers.

It is designed to block computer viruses, worms and trojans from propagating through internet mail servers - specifically, through internet mail service providers running EMWAC IMS, a freeware internet mail server for Windows NT generously placed in the public domain by the University of Edinburgh's European Microsoft Windows NT Academic Centre (EMWAC).

In order to use AVP, you must already have the freeware EMWAC Internet Mail Server (IMS) and freeware SCSMFILTER Plus (mail filtering) service for EMWAC installed (AVP also works with Rockliffe "MailSite", a derivative of IMS, when used with SCSMfilter). In addition to the useful defaults, there are many cool third party filters available for SCSMFILTER PLUS that allow you to do things like prevent mail relaying and block junk mail from blacklisted spam hosts on the sbl and much more. EMWAC IMS can act as a standalone mail server or even be configured, when used in conjunction with SCSMFILTER, to act as a pre-filtering front end relay to other mail servers (even MS Exchange Server) within an organization.

The discussion which follows assumes you have already installed EMWAC IMS and SCSMFILTER Plus, and are somewhat familiar with them.

How to Obtain AVP:

Please be sure to have read the current AVP License Agreement and Disclaimer before continuing.

Download AVP Full Install Program (4,073,472 bytes). The current (full installer) release is version 2.3.0

AVP 2.3.1 Executable Only Update to the above (you must be running AVP 2.3 release before updating avp.exe to 2.3.1 with this executable). Adds the following bogus domain check to CheckMX functionality:- If MX RDNS of sender domain is 127.0.0.1, trash message. Beside catching spam, this eliminates a major mail looping bug in EMWAC IMS.

AVP 2.0.0-2.2.2 UPGRADERS: You may download a self-extracting archive that will upgrade you from any AVP 2.0.0-2.2.0 to AVP 2.2.1, using this link (206,848 bytes). If upgrading from 2.0.X, you MUST in most cases add *.TMP at the end of your "current" Engine Arguments or re-select the recommended defaults for your scanner. In AVP 2.0.X, *.TMP was appended to the scanner invocation command line by AVP independent of the Engine Arguments. In newer AVP versions, this is instead part of the "Use Defaults For" list of suggested Engine Argument settings, and is not automatically added independent of these settings as was in AVP 2.0.X.

AVP 1.X UPGRADERS: If you have a 1.X version of AVP installed, you should (1) Remove the AVP.EXE entry from filterb.plu, in your c:\install\mfilter directory -- You will use the new AVP control panel applet to activate AVP 2.X in SCSMFILTER. (2) Stop the SCSMFILTER service, (3) Uninstall Anti-Viral Plugin through the Windows Control Panel, Add/Remove Software applet and 3) install the newer version from a saved copy of the Full Install Program (link above). (4) Follow the installation instructions below - AVP will restart the SCSMfilter service for you through its control panel.

How AVP works:

AVP works by decoding the MIME attachments within the messages received by IMS to a temporary directory. After decoding, it recursively looks for archives (ZIP / CAB / UUencoded files) within those attachments and in turn decodes or decompresses those attachments. AVP scans the attachments for virii with one or more standard virus scanners (of your choice - see suggestions below), and checks the attachments for infection. If an infection is found, the message is moved to the trash directory, and AVP notifies the sender and recipient of the e-mail, as well as the postmaster, that the message was blocked with details of the virus. AVP also includes a sophisticated trash bin management system, integrated trash bin and black-list statistical reporting, spam analysis tools, and a warning cache to prevent excessive warning.

How to install AVP:

a) You must first Install a virus scanning engine with command line automation. When an infected file is scanned with the virus software, the program must return an error level upon exit to indicate as such. You set the parameters AVP passes to the scanning engine and the error level AVP checks for when the engine's scan is complete through AVP's control panel.

For example, eTrust EZ-Antivirus from Computer Associates is one good choice. It is an excellent, fast virus scanner which offers frequent virus signature updates, and presently costs $39.95 (which includes a year of these updates.) A fully functional evaluation copy can be downloaded. AVP's comes pre-configured to work with this engine, and several other virus scanners reported to work well with AVP. AVP includes a pull down list where you can choose from several commercial scanning engines, or you can follow the documenting tool-tip text in the AVP control panel or the scanners guideline page to see how to interface AVP with other scanning engines not listed.

If you are using an unlisted scanner and are able to follow the guidelines so that it works with AVP, please let us know via your AVP control panel's Engine Tab settings that you used to integrate that engine. We'll likely add it to the default list in a future release.

b) Run the AVP installation and setup program (download link at top of page).

Once installed, a shortcut to AVP will appear on your start menu - use this link to launch the AVP control panel. Configure your system using the Configuration and Scan Engine tabs in the AVP control panel. For foreign language support, configure the Message tab. Next, activate and test AVP using the buttons on the Activate tab.

How to test:

Use the Test AVP button on the Activate tab to have the system e-mail you the eicar test pattern. This pattern, also known as the "eicar test string", is not a real virus, but virtually all virus scanners have been programmed for test purposes to treat the eicar test pattern as one.

AVP Will not function properly if real-time virus scanning is installed on your server, unless the temp subdirectory of the AVP program installation directory is excluded from this real-time scanning.
If you are using Mike's SMTPRCV replacement receiver service (instead of the stock IMS "SMTPRS" service), you must add an "Accept Mail For" of "127.0.0.1" into your EMWAC IMS control panel, "Misc" tab, in order for AVP's "Self Test" and "Blitz Test" functions to work.
AVP is multi-thread safe, however resource sensitive scanning engines can generate false negatives if your server becomes low on memory or CPU resources. Too many threads running AVP and those engines could cause these resources to run low. This means that if you have configured SCSMFilter 0.33 to multi-thread too many plugins, false negatives could occur - which would result in a virus escaping the filter. To prevent this from happening, we STRONGLY recommend that you keep the "c:\install\mfilter\thread.cfg" setting for minimum and maximum threads both at 1. Increase the minimum and maximum threads only if you know your scanning engine and hardware (i.e. RAM resources) will behave well under multi-threading conditions. If you want to know for sure how your scanner performs with your particular hardware or with higher thread.cfg multithreading settings, you can try the click the Blitz Test button of the Activation tab which will give you a good gauge of the system under very heavy load.

Support

The EMWAC IMS self-help mailing list is hosted by Rockliffe and is a good resource for those seeking support in configuration of AVP, other SCSMFILTER plugins, or in any aspect of EMWAC IMS. Once subscribed, your correspondence to imsusers@rockliffe.com will go to a large group of experienced IMS users.... a great support resource!

Join the IMS users mailing list
Leave the IMS users mailing list

Licensing AVP

AVP is now freeware . The 2.3 license at the bottom of this note supersedes any previous AVP software license agreements. Use the following license number, to remove the product evaluation period.

11YB-JE1LHB-JPBB1S

This license number should be entered into the AVP control panel.

Your comments are welcome. Please email any comments to:

WITHOUT YOUR FEEDBACK OF SUCCESSFUL DEPLOYMENTS AND ENGINE TAB SETTINGS FOR OTHER VIRUS ENGINES, WE CANNOT IMPROVE THIS DOCUMENTATION SO AS TO ASSIST OTHERS!

Major / Recent Release History

April 3, 2006 - v 2.3.0
Modified: License agreement: AVP 2.3.0 is once again released as freeware, as was the original AVP 1.X
Added logging. Added CheckMX functionality. Misc fixes to trashbin viewer.

June 10, 2003 - v 2.2.2
Bug fix for one known virus's intentionally malformed message causing an AVP "instance crash" when the message cache feature is enabled..

February 5, 2003 - v 2.2.
Fix for two GUI configuration issues implemented; reselecting same engine and multiple "Found Virus Error Levels". Updated recommended engines list to include new e-Trust 6.1 and Dr. Web engine settings.

October 11, 2002 - v 2.2.0
Multiple scanner, exit and infection code support. Console output redirection Engine Arguments parameter added. Improved DOS scanner support. Fix to cache viewer sorting functionality. Updated recommended engine arguments. Warning message footer customizable for paid licensees.

August 9, 2002 - v 2.1.1
Fix to clean up AVP temporary directories left behind when infected message detected and "Trash" infected option was selected.

August 7, 2002 - v 2.1.0
Complete scanner engine parameter flexibility, to resolve compatibility issues with McAfee VirusScan. *.TMP is no longer automatically appended to to the command line used to invoke the scanner - instead, this must be part of your Engine Arguments and has been added to the default "Use Settings For" settings for listed scanners. Added $MSGTEMP Engine Argument parameter, which if used is replaced with message specific temporary directory at run time (added because McAfee ignores the O.S. "current directory" environment setting.) Fixed bug that would cause the AVP "Self Test" function to fail. Added tighter MMS SMTPRCV (IMS SMTPRS service replacement) support with black-list filter statistics. Added warning message cache and limits. Added license activation requirement. Added last selected tab memory. Fixed message specific temporary directory cleanup bug, when zip archives contained read-only files. Fixed a multi-thread registry contention issue. Modified: License agreement.

Mar 15, 2002 - v 2.0.1
Fix for trashbin vieweing crash when MAX HEADER EXCEEDED spam log entry was present. Fix for $ReportFile long file name DOS scanner incompatibility.

Feb 19, 2002 v2
New: Control panel, customizable warning messages, anti-spam tools, statistics, CAB support.
Modified: License agreement.

May 14, 2001 v1
Initial Release

AVP includes licensed UUDeview technology.

Sica Consulting created the IMS Mail filtering service.

Mike VanMeeteren created the SMTPRCV (SMTPRS replacement) service.

AVP Logos

E-Mail Protected by AVP

Anti-Viral Plugin for IMS

If you like AVP, we ask that you place one of these logos on the home page of your web site linking back to this page.

Zaxalon AVP 2.3.0 Software License Agreement:

This Zaxalon.com ("Zaxalon") End-User License Agreement ("EULA") is a legal agreement between you ("you") and Zaxalon for the software product ("Software") mentioned above. By installing, copying, or otherwise using the Software, you agree to be bound by the terms of this EULA. The Software is protected by copyright laws and international copyright treaties, as well as other intellectual property laws and treaties. The Software is licensed, not sold, and ALL SOFTWARE IS PROVIDED "AS IS."

1. GRANT OF LICENSE: This EULA grants you the following rights:

· Installation and Use: You may install and use an unlimited number of copies of the Software. Any copies of the Software which this License authorizes you to make are subject to this EULA.

· Reproduction and Distribution: You may not reproduce and distribute copies of the Software without the express written consent of Zaxalon.com.

2. DESCRIPTION OF OTHER RIGHTS AND LIMITATIONS:

· Limitations on Reverse Engineering, Decompilation, and Disassembly: You may not reverse engineer, decompile or disassemble the Software except and only to the extent that such activity is expressly permitted by applicable law notwithstanding this limitation.

· Support Services: Zaxalon.com will not provide you with support services ("Support Services") related to the Software.

· Software Transfer: You may permanently transfer all of your rights under this EULA, provided the recipient agrees to the terms of this EULA.

· Termination: Without prejudice to any other rights of Zaxalon's, your rights under this EULA will terminate automatically without notice from Zaxalon if you fail to comply with any term(s) of this EULA. In such event you must destroy all copies of the Software and any related materials.

3. COPYRIGHT: All right, title and interest in and to the Software (including the copyrights in the Software and including, but not limited to, any images, photographs, animations, video, audio, music, text, and "applets" incorporated into the Software), the accompanying printed materials (if any), and any copies of the Software are owned by Zaxalon.com. The Software is protected by copyright laws and international treaty provisions. Except as permitted by applicable law and this License, you may not modify, rent, lease, loan, sublicense, or create derivative works from the Software.

4. Disclaimer of Warranty on Software. You expressly acknowledge and agree that use of the Software is at your sole risk. The Software is provided "AS IS" and without warranty of any kind and ZAXALON EXPRESSLY DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. ZAXALON DOES NOT WARRANT THAT THE FUNCTIONS CONTAINED IN THE SOFTWARE WILL MEET YOUR REQUIREMENTS, OR THAT THE OPERATION OF THE SOFTWARE WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT DEFECTS IN THE SOFTWARE WILL BE CORRECTED. FURTHERMORE, ZAXALON DOES NOT WARRANT OR MAKE ANY REPRESENTATIONS REGARDING THE USE OR THE RESULTS OF THE USE OF THE SOFTWARE OR RELATED DOCUMENTATION IN TERMS OF THEIR CORRECTNESS, ACCURACY, RELIABILITY, OR OTHERWISE. NO ORAL OR WRITTEN INFORMATION OR ADVICE GIVEN BY ZAXALON OR AN AUTHORIZED REPRESENTATIVE OF ZAXALON.COM SHALL CREATE A WARRANTY OR IN ANY WAY INCREASE THE SCOPE OF THIS WARRANTY. SHOULD THE SOFTWARE PROVE DEFECTIVE, YOU (AND NOT ZAXALON.COM OR AN AUTHORIZED REPRESENTATIVE OF ZAXALON.COM) ASSUME THE ENTIRE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES, SO THE ABOVE EXCLUSION MAY NOT APPLY TO YOU. THE ENTIRE RISK ARISING OUT OF USE OR PERFORMANCE OF THE SOFTWARE REMAINS WITH YOU.

5. Limitation of Liability. UNDER NO CIRCUMSTANCES, INCLUDING NEGLIGENCE, SHALL ZAXALON OR ITS SUPPLIERS BE LIABLE FOR ANY INCIDENTAL, SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF BUSINESS PROFITS, BUSINESS INTERRUPTION, LOSS OF BUSINESS INFORMATION, OR ANY OTHER PECUNIARY LOSS) ARISING OUT OF OR RELATING TO THIS LICENSE, EVEN IF ZAXALON HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME JURISDICTIONS DO NOT ALLOW THE LIMITATION OF INCIDENTAL OR CONSEQUENTIAL DAMAGES SO THIS LIMITATION MAY NOT APPLY TO YOU. IN NO EVENT SHALL ZAXALON.COM'S TOTAL LIABILITY TO YOU FOR ALL DAMAGES EXCEED THE AMOUNT PAID FOR THIS LICENSE TO THE SOFTWARE. THE ENTIRE RISK ARISING OUT OF USE OR PERFORMANCE OF THE SOFTWARE REMAINS WITH YOU.

6. Fault Tolerance. The Software is not fault tolerant and is not designed, manufactured, or intended for use or resale as on-line control equipment in hazardous environments requiring fail-safe performance, such as the operation of nuclear facilities, aircraft navigation or communications systems, air traffic control, direct life support machines, or weapons systems, in which the failure of the Software could lead directly to death, personal injury, or severe physical or environmental damage ("High Risk Activities"). Zaxalon specifically disclaims any express or implied warranty of fitness for High Risk Activities.

7. Export Law Assurances. You may not use or otherwise export or reexport the Software except as authorized by United States law and the laws of the jurisdiction in which the Software was obtained. In particular, but without limitation, none of the Software may be used or otherwise exported or reexported (i) into (or to a national or resident of) a United States embargoed country or (ii) to anyone on the U.S. Treasury Department's list of Specially Designated Nationals or the U.S. Department of Commerce's Table of Denial Orders. By using the Software, you represent and warrant that you are not located in, under control of, or a national or resident of any such country or on any such list.

8. Government End Users. If the Software is supplied to the United States Government, the Software is classified as "restricted computer software" as defined in clause 52.227-19 of the FAR. The United States Government's rights to the Software are as provided in clause 52.227-19 of the FAR.

9. MISCELLANEOUS: If for any reason a court of competent jurisdiction finds any provision, or portion of this EULA, to be unenforceable, the remainder of this EULA shall continue in full force and effect. This EULA constitutes the entire agreement between the parties with respect to the use of the Software and supersedes all prior or contemporaneous understandings regarding such subject matter. No amendment to or modification of this EULA will be binding unless in writing and signed by Zaxalon.com.