Virus not being blocked

Admiral_Ron · 04-15-2009, 06:23 AM

Please help!!! I am using the email virus test at GFI.COM and Untangle does not block the emails containing viruses. I have removed the Kaspersky and the ClamAV and rebooted the machine and then added them back again. The same results. In the logs it stated that of the 24 emails, all but 5 have viruses and it says it blocks them, but it passes all the emails through except the 5 that it says does not have viruses. Those 5 emails it actually quarantines. Those 5 emails are the EICAR virus. The rest of the emails are various ones like HTA files and such.

Any help is appreciated.

Also... The EICAR files that say no virus which are blocked are blocked because of detected SPAM.

Thanks
Ron

Admiral_Ron · 04-15-2009, 11:53 AM

I downloaded the latest 6.1 ISO and reinstalled the entire server. I backed up the config before hand and restore the config. I tested again and I am getting the same results. I was wondering if anyone else has tried http://www.gfi.com/emailsecuritytest/
to see if you get the same results?

Update... I have researched further and apparently if I change the settings to "Remove Infection" instead of "Block Messasge" more of the emails come through with the ones that were in the log as being blocked now coming through with the virus removed. The rest that came through before are coming through not being scanned as having a virus. MY FAULT because I thought when you chose "Block" it would send it to Quarantine and not fully block it. So...

It is blocking some of the viruses but not all. Any suggestions?

Thanks
Ron

MockY · 05-26-2009, 02:40 PM

I am surprised no one haven't given you an input to your concerns. I am about to go forward with Kaspersky but if it doesn't block obvious viruses from a virus test site, then I highly doubt it is any effective at all. So waste of money in other words.

dmorris · 05-26-2009, 03:17 PM

"GFI guarantees that these tests are very safe and do not do anything dangerous."

They aren't viruses and most of them won't be detected as such.

The only valid "test" i know for both kav and clam is the eicar test.
If you want to test that just download it from the site and then email it to yourself from the outside.

04-15-2009, 06:23 AM	#1 (permalink)
Admiral_Ron Untangler Join Date: Mar 2008 URLs submitted: 1 Posts: 58	Virus not being blocked Please help!!! I am using the email virus test at GFI.COM and Untangle does not block the emails containing viruses. I have removed the Kaspersky and the ClamAV and rebooted the machine and then added them back again. The same results. In the logs it stated that of the 24 emails, all but 5 have viruses and it says it blocks them, but it passes all the emails through except the 5 that it says does not have viruses. Those 5 emails it actually quarantines. Those 5 emails are the EICAR virus. The rest of the emails are various ones like HTA files and such. Any help is appreciated. Also... The EICAR files that say no virus which are blocked are blocked because of detected SPAM. Thanks Ron Last edited by Admiral_Ron; 04-15-2009 at 06:35 AM..

04-15-2009, 11:53 AM	#2 (permalink)
Admiral_Ron Untangler Join Date: Mar 2008 URLs submitted: 1 Posts: 58	Follow up... I downloaded the latest 6.1 ISO and reinstalled the entire server. I backed up the config before hand and restore the config. I tested again and I am getting the same results. I was wondering if anyone else has tried http://www.gfi.com/emailsecuritytest/ to see if you get the same results? Update... I have researched further and apparently if I change the settings to "Remove Infection" instead of "Block Messasge" more of the emails come through with the ones that were in the log as being blocked now coming through with the virus removed. The rest that came through before are coming through not being scanned as having a virus. MY FAULT because I thought when you chose "Block" it would send it to Quarantine and not fully block it. So... It is blocking some of the viruses but not all. Any suggestions? Thanks Ron Last edited by Admiral_Ron; 04-15-2009 at 12:58 PM..

05-26-2009, 03:17 PM	#4 (permalink)
dmorris Untangle Junkie Join Date: Nov 2006 Location: San Mateo, CA URLs submitted: 10 Posts: 10,614	"GFI guarantees that these tests are very safe and do not do anything dangerous." They aren't viruses and most of them won't be detected as such. The only valid "test" i know for both kav and clam is the eicar test. If you want to test that just download it from the site and then email it to yourself from the outside. __________________ Attention: Support and help on the Untangle Forums is provided by volunteers and community members like yourself. If you need Untangle support please call or email support@untangle.com

Protect

Filter

Perform

Connect

Manage

Add-Ons

05-26-2009, 02:40 PM	#3 (permalink)
MockY Newbie Join Date: May 2009 Posts: 7	I am surprised no one haven't given you an input to your concerns. I am about to go forward with Kaspersky but if it doesn't block obvious viruses from a virus test site, then I highly doubt it is any effective at all. So waste of money in other words.