[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Warning: in file [ROOT]/includes/functions.php on line 4688: Cannot modify header information - headers already sent by (output started at [ROOT]/includes/functions.php:3823)
[phpBB Debug] PHP Warning: in file [ROOT]/includes/functions.php on line 4690: Cannot modify header information - headers already sent by (output started at [ROOT]/includes/functions.php:3823)
[phpBB Debug] PHP Warning: in file [ROOT]/includes/functions.php on line 4691: Cannot modify header information - headers already sent by (output started at [ROOT]/includes/functions.php:3823)
[phpBB Debug] PHP Warning: in file [ROOT]/includes/functions.php on line 4692: Cannot modify header information - headers already sent by (output started at [ROOT]/includes/functions.php:3823)
Poco Forums • View topic - Turning off incoming virus scans

Turning off incoming virus scans

Help and advice on using PocoMail

Moderators: Eric, Tomas, robin

Postby Hogyt » Sat Aug 14, 2004 12:50 am

frazmi wrote:Regarding manual AV scans, all I can say is this: I had Norton AV 2004 set to scan incoming email, and also set to autoprotect. (I didn't have outgoing email scanning turned on.) Many times, when I did a full system scan, NAV reported viruses in attachments in the Poco Attach directory. Symantec was unable (or unwilling) to give me any answers to the question of how NAV missed the incoming virus. So I conclude: Manual AV scans (or periodic automatic scans if you wish) must be done to ensure that my PC (and perhaps yours as well) is free of viruses.


That could be because you received the files at the start of a virus outbreak, before the virus definitions were updated. A later full scan, with updated virus definitions, would then have found them.

Another possibility is that your auto-protect settings are different to your manual scan settings. Perhaps you have auto-protect set to smart scan and manual set to comprehensive scan or perhaps auto-protect has some exclusions?
Mat
Hogyt
Poco Enthusiast
 
Posts: 241
Joined: Thu Jul 29, 2004 11:22 am
Location: England

Postby frazmi » Sat Aug 14, 2004 1:24 am

Good ideas, but the AV scan was finding old variants. Also, I've had the experience of scanning the attachment folder minutes after receiving mail, and finding a virus that NAV did not catch.

Believe me, I did not give up NAV lightly. I've used the product for years, since the very first release of the product. And although I don't like the interface of Mcafee very much, as best I can tell it's not missing virus-infected messages (so far, anyway).
frazmi
Poco Enthusiast
 
Posts: 248
Joined: Tue Jul 27, 2004 1:27 am
Location: South Korea

Postby Hogyt » Sat Aug 14, 2004 1:37 am

If your auto-protect options were the same as your manual scan options then that is very weird! I can't say i've ever noticed the same problem but i'll keep a closer eye on it from now on.
Mat
Hogyt
Poco Enthusiast
 
Posts: 241
Joined: Thu Jul 29, 2004 11:22 am
Location: England

Postby frazmi » Sat Aug 14, 2004 2:14 am

Yes, autoprotect and manual scan settings were identical.
frazmi
Poco Enthusiast
 
Posts: 248
Joined: Tue Jul 27, 2004 1:27 am
Location: South Korea

Postby Hogyt » Sat Aug 14, 2004 3:12 am

It appears that Nortons Auto-Protect does not scan within zip files whereas the manual scan (as long as the option is turned on) and incoming email scan do. Can you remember if they were zips you had problems with Frazmi?

Even if this is correct i still don't have a problem with disabling incoming email scanning since both the manual scan and trying to run the infected files were picked up by Norton, which means that you are still fully protected but, in some cases, instead of being alerted to the virus immediately you are alerted at a later date. It may also be that the email scanning also protects against specific exploits but since PocoMail does not execute any code we are again fully protected.

Edit: Just found this here
The "Enable Auto-Protect to scan inside of compressed files" entry only appears on Windows 2000 or XP. It is not possible for Auto-Protect to scan compressed files on Windows 98 or Me.

So it looks like Auto-Protect will scan inside zips but perhaps this is new to NAV 2004 (i have 2003 and can't see this option).
Mat
Hogyt
Poco Enthusiast
 
Posts: 241
Joined: Thu Jul 29, 2004 11:22 am
Location: England

Postby frazmi » Sat Aug 14, 2004 8:57 pm

Some of the virus-infected messages had attached zip files, but most of them were ordinary messages with embedded attachments -- pif and scr extensions.
frazmi
Poco Enthusiast
 
Posts: 248
Joined: Tue Jul 27, 2004 1:27 am
Location: South Korea

Postby Hogyt » Sun Aug 15, 2004 3:16 am

Maybe we should do some testing on www.testvirus.org to establish which virus killers work best and with which PocoMail settings.
Mat
Hogyt
Poco Enthusiast
 
Posts: 241
Joined: Thu Jul 29, 2004 11:22 am
Location: England

Postby Pete » Mon Aug 16, 2004 7:39 am

frazmi wrote:A couple of questions surface in my mind.
Do you leave attachments encoded in your message?
Do you run background AV checks (either automatic or manual)?

frazmi wrote:So I conclude: Manual AV scans (or periodic automatic scans if you wish) must be done to ensure that my PC (and perhaps yours as well) is free of viruses.

I leave attachments encoded with messages. I rarely run manual scans, but when I have run them, my system has always been clean. This is because I validate attachments when I receive them. If it's spam, I don't run the attachment and I delete the whole message. If it's from a known sender and appears to be authentic and I want to run the attachment, then I run it right away by double-clicking it in the Attachment Pane. If it's a virus, NAV notifies me at this point and handles the situation, then I delete the attachment and/or the whole message. By following this strategy, it seems to me that a manual system scan should never be necessary for PocoMail.

If you run system-wide scans for other purposes, and if there's a chance that this scan could run before you've checked all of the attachments in PocoMail, then I agree with Mat and I recommend that you either exclude all of PocoMail's mailbox files or that you disable "Comprehensive File Scanning" (more about this later).

So to summarize my approach, I let AutoProtect automatically check for viruses (in the background) when I run attachments but I disable Incoming Email Scanning and I do not run system-wide virus scans (either manually or with scheduled checks). Anything more, in my opinion, is superfluous. (FYI, I also don't use the "BloodHound" feature.)


frazmi wrote:You said,
PocoMail never automatically runs things in messages,
How does Poco handle an embedded attachment?

The last time that I checked, PocoMail keeps the attachment in the .mbx file and nowhere else (because I do not automatically decode attachments to the Attach folder). When I double-click on an attachment in PocoMail's Attachment Pane, I believe that this is what happens:

1) PocoMail decodes the attachment and saves the result to the Cache folder.

2) PocoMail issues a command to Windows to run the attachment in the Cache folder.

3) NAV AutoProtect interrupts the process and scans the attachment in the Cache folder.

4) If no virus exists, then NAV allows Windows to run the attachment.


frazmi wrote:Also, since NAV (based on your comments -- I've never really been 100% sure of when exactly NAV runs) runs a virus check whenever a file is opened, wouldn't it therefore run a virus check when Poco opens the mbx file? And thereby (potentially) triggering my scenario?

I agree that NAV is confusing in this regard. In the past, it had explicit options that allowed you to specify the exact situations in which you wanted AutoProtect to check for viruses. Symantec eliminated that level of detail in NAV 2003 (which I use), so the only relevant option that I see is the choice between "Comprehensive File Scanning" and "Scan Files Using SmartScan". I use the second option because then AutoProtect should only scan files that you can run, so it should ignore text files such as PocoMail's .mbx files. Note that I highly recommend that people choose the second option for performance reasons also. I've noticed significant slowdowns on my system (even when simply reading large .txt files) that happened with "Comprehensive File Scanning".

---------------------------------------------------------------------------------

Regarding mailbox compression, assuming that the .mbx and .idx files are valid and complete, PocoMail will only automatically compress a mailbox when the selected mailbox contains 50% or more slack space. I believe that PocoMail only checks for a mailbox's slack space when it opens or changes a mailbox (at startup, during mail checks, when the user clicks on a mailbox, etc.). So, if PocoMail compresses a mailbox at startup, then it's a coincidence, not a rule. Jim probably knows this but didn't mention it explicitly in the quoted text (perhaps) because he didn't want to overly complicate the discussion in the other topic where he wrote it.
Pete
 

Postby Sandy » Mon Aug 16, 2004 9:36 am

So to summarize my approach, I let AutoProtect automatically check for viruses (in the background) when I run attachments but I disable Incoming Email Scanning and I do not run system-wide virus scans (either manually or with scheduled checks). Anything more, in my opinion, is superfluous. (FYI, I also don't use the "BloodHound" feature.)

Comprehensive File Scanning" and "Scan Files Using SmartScan". I use the second option....."


I'm sold Pete. I've turned off all these "beyond what is necessary" options in NAV2003 too now after reading your analysis. I've had all of them on in the past and have had no problems; but your approach seems very realistic to me, so I'm adopting it. (P.S. I do, however, decode attachments into an attachments folder.)
Sandy
 

Postby vamp07 » Mon Aug 16, 2004 10:30 am

There something about this discussion I don't understand. Doesn't poco automatically save all attachments to the attachments folder? When it does this won't any resident antivirus software pick up on the problem (I happen to use nod32). I though all attachments were striped out of the mbx files as they arrived?
vamp07
Frequent Visitor
 
Posts: 66
Joined: Mon Jul 26, 2004 11:31 am

Postby Hogyt » Mon Aug 16, 2004 10:37 am

It depends on your settings in Options->Encoding Options whether the attachments are saved in the attachments folder. Then it depends on your scanner if any virus is picked up when the attachment is saved, eg. NAV 2003 doesn't scan compressed files as they are written to disk (but it does scan them during a manual scan). If you want a comprehensive test of how your virus scanner performs with your PocoMail settings when it receives a virus then check out the link i gave above.
Mat
Hogyt
Poco Enthusiast
 
Posts: 241
Joined: Thu Jul 29, 2004 11:22 am
Location: England

Postby frazmi » Mon Aug 16, 2004 12:57 pm

One point to add about leaving attachments encoded in the message, versus stripping them out and saving as an attachment: If you do a lot of searching on anything other than headers, and if you have a lot of email to search, then search time goes up significantly as you save messages with large attachments.

OTOH, if you put the attachments in the Attach directory, individual messages tend to stay small (except for HTML bloated messages) and search speeds are much faster (still slow, just faster).

I'm also guessing that compress mailbox function will take longer -- how much longer I don't know, but it makes sense that if the mbx files have attachments (therefore more bytes) they will take longer to process than if they don't.
frazmi
Poco Enthusiast
 
Posts: 248
Joined: Tue Jul 27, 2004 1:27 am
Location: South Korea

Previous

Return to PocoMail Help and How-To

Who is online

Users browsing this forum: No registered users and 3 guests

cron