|NST and Sophos [message #247]
||Tue, 16 August 2005 21:00
Registered: August 2005
has anyone got any experience setting up anti virus filter with Sophos?
The problem I've encountered is that Sophos always returns exit code '0' when used in conjunction with NST. Weather is send a test virus message or test spam message the exit code is the same. Common sense tells me it shouldn't be like that. Moreover, when I use Sophos in DOS, it happily detects virus in test file I used for NST. My command line sintax for anti virus filter looks like this:
"C:\Program Files\Sophos\Sophos Anti-Virus\sav32cli.exe" "%IN%"
When I look at console output in NST I can see Sophos responses but the virus is simply not detected. Here's what I get.
Version 3.86.0 [Win32/Intel]
Virus data version 3.96, August 2005
Includes detection for 108398 viruses, trojans and worms
Copyright (c) 1989-2005 Sophos Plc, www.sophos.com
System time 19:37:15, System date 16 August 2005
IDE directory is: C:\Program Files\Sophos\Sophos Anti-Virus
Using IDE file ablnk-ae.ide
Using IDE file zotob-c.ide
1 file swept in 2 seconds.
No viruses were discovered.
Ending Sophos Anti-Virus.
Log output on the filter configuration test screen looks like this:
Aug 16, 2005, 19:37:13 Session 0: (Anti Virus) Executing: "C:\Program Files\Sophos\Sophos Anti-Virus\sav32cli.exe" "C:\DOCUME~1\admin\LOCALS~1\Temp\AV0i.msg"
Aug 16, 2005, 19:37:15 Session 0: (Anti Virus) Command line exit code is 0
Aug 16, 2005, 19:37:15 Session 0: (Anti Virus) Filter result is accept/deliver
To add insult to the injury even when I apply settings with av filter accepting all messages irrespective of the exit code, I can't see av filter being used by NST at all. However, I do see messages traversing attachment filter and spam assassin filter. The av filter is the last one in the chain but it doesn't seem to be used by NST.
Needless to say, this is becoming a nightmare. I would greatly appreciate if someone could suggest a possible solution or perhaps share some thoughts.