Contents:
~~~~~~~~~
0) Why should I upgrade my drwebd version? The old version works perfectly.

1) The è virus is not detected. Why?

2) I experience the following problem: if update.pl is launched from the command line everything is updated, 
and nothing gets updated if it is launched from the cron, though the logs show the cron completes its tasks 
without fault...

3) What is in the UpdatePath? 

4) Version prior to 4.30. The log shows
   Jul 3 13:50:18 mail drweb-smf: dwlib: scan: message sent by <alex@gamma> is passed
   Jul 3 13:50:18 mail drweb-smf: [g639oGJI030655]: processing message from <alex@gamma> completed (exit code 3)
   What does (exit code 3) mean? 

5) One of my clients (and only one!) experiences the following -
   mail is not sent no matter how many times 
   he presses the "Wait" button in Outlook.
   The following is written to the maillog by sendmail:
   drweb-smf: message from <address@domain> is aborted
   Please explain if something goes wrong with sendmail or Dr.Web?

6) I have installed drweb with qmail. All works well, but the sender of a virus receives two messages: the one 
reads that there is a virus in the message, the other - that the message can not be delivered: Remote host 
said: 554
   mail server permanently rejected message (#5.3.0)
      Can I somehow disable sending of such messages as users may think there is an error on the server..

7) What do the question marks in drweb-smf.log mean?
   Nov 26 14:36:13 proba drweb-smf: [???]: ...

8) What do the Expires= and the SubscriptionExpires= fields 
   in the key file (for example drwebd.key) mean?

9) Can I use virus bases of version 4.30 with version 4.31?

10) drweb.tmp.60gkxo/$ARCHIVE_NAME/$FILE_IN_ARCHIVE - compression ratio is too high (2770944 : 
35154)
    ...
    Dr.Web scanning statistics:
    Evaluation key used !
    Archive restriction : 21
    ...

What does it mean and what should I do in this situation?


11) I tried to bundle  Dr.Web and Postfix. The mail does not go through at all. 
When I have checked the logs one line seemed suspicious
Jul 17 12:55:01 mailhub sendmail[29437]: h6H9t0sh029437: Authentication-Warning: host.domain.tld: drweb 
set sender
or:
Apr 20 17:32:31 mailhub sendmail[33617]: h3KDWVlV033617: from=name@example.com, size=38592, 
class=0, nrcpts=1, msgid=<msg-id4358035@example.com>, relay=drweb@localhost                                       
What can be the reason of the problem?

12) I have drweb-sendmail-4.30 installed. From time to time the following error message is displayed:
Nov 9 22:55:49 mail drweb-smf: drweb_smf.c(667) - FATAL ERROR: cannot extract private data from 
context
Please, explain!

13) When a message with a file attached is sent, the daemon checks all correctly, here goes an extract of 
the log:
Nov 5 14:59:27 relay sendmail[22756]: hA5CxRIm022756: from=<foo@example.com>, size=15600, 
class=0, nrcpts=1, msgid=<msg-id#@example.com>, proto=ESMTP, daemon=MTA, relay=domain.tld 
[10.0.0.1]

But, when the same message is sent and  NAV scans all outgoing messages (the clinet from which I sent 
the message from) the following is reported:

Nov 5 14:58:48 relay sendmail[22751]: hA5CwlIm022751:from=<foo@example.com>, size=0, class=0, 
nrcpts=1,proto=ESMTP, daemon=MTA, relay=domain.tld [10.0.0.2]
Nov 5 14:58:48 relay drweb-smf: [hA5CwlIm022751]: message from foo@example.com is aborted
s

14) I have drweb-4.29.5 installed. A strange thing happened: I received a mail with Gibe.2:

    Wed Nov 12 08:56:20 2003 [1459] /var/spool/filter/drweb.tmp.HM5dmX/[text:html] - Ok                        
    Wed Nov 12 08:56:20 2003 [1459] >>/var/spool/filter/drweb.tmp.HM5dmX/cgmgf.exe - Ok   

    At the same time, the on-line check (http://online.drweb.com):
    ...
    cgmgf.exe packed by UPX
    >cgmgf.exe infected with Win32.HLLM.Gibe.2

15) I have Dr.Web daemon + Dr.Web for CGP installed; the headings filtering is enabled (RuleFilter = on + 
RuleFitlerAlert = reject),
but for some blocked messages notifications are not received by the sender and the administrator receives 
two messages:

16) I have Dr.Web for Sendmail (version prior to 4.30.1 or compiled from the supplied source code) installed. 
Sometimes the filter terminates without any visible reasons. What can it be?


17) I have the Dr.Web mail filter installed. For infected objects the discard action (Infected = discard) is set, 
but notifications are still received. Why?  I don't want them to be sent.


18) I have installed your mail filter and sent a message with a virus (a friend of mine has given it to me). The 
virus was detected, but only the administrator has received a notification, though I have enabled notifications 
for all. Why is that?


19) I have Dr.Web Daemon & Dr.Web for Sendmail installed. The mail messages are not checked for 
viruses and the mail log has the following entries:
    ...
    Nov 24 19:11:48 vulture sendmail[878]: hAO9Bmvr000878: milter_read(drweb-filter): cmd read returned 
4, expecting 5

20) I have received an interesting file called "something.jpg      .exe". The on-line check reports it is clean. 
Where can I check it?

21) I have installed a mail filter, but notifications are received by the administrator only, though in 
drweb_{mta}.conf:
...
[VirusNotification]
SenderNotify = yes
RcptsNotify = yes
AdminNotify = yes
...
the masks are specified and available. What is the reason of the problem?


22 It is difficult to understand your licensing policy. Which programs and licenses are suitable for what?

23) FreeBSD 4.x (x =< 7) system. I have installed version 4.31 and receive:
/usr/libexec/ld-elf.so.1: Undefined symbol "__stdoutp"
    referenced from COPY relocation in /usr/local/drweb/drweb-smf

24) I have installed Dr.Web for Sendmail, but it does not check the mail. The daemon log reads:    
    ===
    Daemon is loaded, active interfaces:  127.0.0.1:3000
    Unknown command received: 13
    ===
or
    ===
    Daemon is installed, active interfaces:  127.0.0.1:3000
    Unknown command received: 13!
    ===
What should I do ?

25) The FreeBSD system. The rules filter (RejectCondition) in daemon does not work if the Russian 
language is used in rules? What should I do?

26) I decided to check the Dr.Web filter at http://www.testvirus.org, but in 25 tests made Dr.Web have 
missed some variants. How can you comment this?

27) After installing some virus database update version 4.29.2 (4.29.5) has got trapped at a large amount of 
messages. Why?

28) I have installed Dr.Web Daemon and Dr.Web Filter for Sendmail. It seems to be configured
properly but filter doesn't run and I see folling messages in /var/log/messages:
 Jun 10 13:24:04 host drweb-smf: Dr.Web (R) Filter for sendmail ver.4.32: Unable to bind to port 3000@localhost: Address already in use
 Jun 10 13:24:04 host drweb-smf: Dr.Web (R) Filter for sendmail ver.4.32: Unable to create listening socket on conn 3000@localhost
or 
 Jun 10 13:24:04 host drweb-smf: Dr.Web (R) Filter for sendmail ver.4.32: Unable to bind to port local:/var/drweb/run/.daemon: Address already in use
 Jun 10 13:24:04 host drweb-smf: Dr.Web (R) Filter for sendmail ver.4.32: Unable to create listening socket on conn local:/var/drweb/run/.daemon

29) I have installed Dr.Web daemon and mail filter. Sometimes I receive alerts about
unchecked messages with reason:
===
 The filter cannot connect to the DrWEB daemon
===
What can I do to avoid this problem ?

Contents:
~~~~~~~~~
0) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: Why should I upgrade? The old version works perfectly.

A: It will work for the some time only. There are several reasons for an upgrade:
- the new virus search module (drweb32.dll) is used in new versions; some new features can be added: new 
packers (for example, in version 4.30 the FSG packer), new archivers (example: 4.30 - LHA), new curing 
procedures of viruses (it is more important for Windows versions, though), and the old version may not 
detect much of new viruses (example: 4.29 does not detect Win32.HLLM.Dumaru, as it is packed with FSG).
- though the updates within the main version (4.29 and 4.30 have a common main version 4.xx) are 
compatible, the efficiency and ability to detect viruses by old versions with new updates are not tested.


1) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: The è virus is not detected. Why?

A: Firstly, try to scan the virus at our on-line virus check on http://online.drweb.com. If the virus is not 
detected, then send it to our virus analyzers. If the virus is detected, then make sure that:
1) all bases are enabled (the most common mistake with the main base drwebase.vdb).
---
Fri Feb  1 14:45:26 2002 Key file: /etc/drweb/drwebd.key
Fri Feb  1 14:45:26 2002 Registration info:
Fri Feb  1 14:45:26 2002 0100000002
Fri Feb  1 14:45:26 2002 Evaluation Key (ID Anti-Virus Lab. Ltd, St.Petersburg)
Fri Feb  1 14:45:26 2002 This is an EVALUATION version with limited functionality!
Fri Feb  1 14:45:26 2002 To get your registration key, call regional dealer.
Fri Feb  1 14:45:26 2002 Loading /var/drweb/bases/drwtoday.vdb - Ok, virus records: 56
Fri Feb  1 14:45:27 2002 Loading /var/drweb/bases/drw42702.vdb - Ok, virus records: 116
Fri Feb  1 14:45:27 2002 Loading /var/drweb/bases/drw42701.vdb - Ok, virus records: 90
Fri Feb  1 14:45:28 2002 Daemon is installed, TCP socket created on port 3000

2) a valid key is loaded (it can also be a trial  key)
Note: starting from version 4.30 the daemon will not be loaded if a valid key is not found. 
Examples when the key is not loaded:
--- there is no key at all, for example, the wrong path is set
Fri Feb  1 14:43:33 2002 This is an EVALUATION version with limited functionality!
Fri Feb  1 14:43:33 2002 To get your registration key, call regional dealer.
Fri Feb  1 14:43:33 2002 Loading /var/drweb/bases/drwtoday.vdb - Ok, virus records: 56
Fri Feb  1 14:43:34 2002 Loading /var/drweb/bases/drw42702.vdb - Ok, virus records: 116
--- the key is incorrect (for example, the misprint in drweb32.ini)
Fri Feb  1 14:45:26 2002 Key file: /etc/drweb/drweb.key
Fri Feb  1 14:45:26 2002 Registration info:
Fri Feb  1 14:45:26 2002 0100000002
Fri Feb  1 14:45:26 2002 Evaluation Key (ID Anti-Virus Lab. Ltd, St.Petersburg)
Fri Feb  1 14:43:33 2002 Registration key mismatches application!
Fri Feb  1 14:45:26 2002 This is an EVALUATION version with limited functionality!
Fri Feb  1 14:45:26 2002 To get your registration key, call regional dealer.
Fri Feb  1 14:45:26 2002 Loading /var/drweb/bases/drwtoday.vdb - Ok, virus records: 56
Fri Feb  1 14:45:27 2002 Loading /var/drweb/bases/drw42702.vdb - Ok, virus records: 116
Fri Feb  1 14:45:27 2002 Loading /var/drweb/bases/drw42701.vdb - Ok, virus records: 90
Fri Feb  1 14:45:27 2002 Loading /var/drweb/bases/drwebase.vdb - Ok, virus records: 27860
Fri Feb  1 14:45:28 2002 Daemon is installed, TCP socket created on port 3000

When the daemon is loaded with the correct key it looks as follows:
---
Fri Feb  1 14:45:26 2002 Key file: /etc/drweb/drwebd.key
Fri Feb  1 14:45:26 2002 Registration info:
Fri Feb  1 14:45:26 2002 0100000002
Fri Feb  1 14:45:26 2002 Evaluation Key (ID Anti-Virus Lab. Ltd, St.Petersburg)
Fri Feb  1 14:45:26 2002 This is an EVALUATION version with limited functionality!
Fri Feb  1 14:45:26 2002 To get your registration key, call regional dealer.
Fri Feb  1 14:45:26 2002 Loading /var/drweb/bases/drwtoday.vdb - Ok, virus records: 56
Fri Feb  1 14:45:27 2002 Loading /var/drweb/bases/drw42702.vdb - Ok, virus records: 116
Fri Feb  1 14:45:27 2002 Loading /var/drweb/bases/drw42701.vdb - Ok, virus records: 90
Fri Feb  1 14:45:27 2002 Loading /var/drweb/bases/drwebase.vdb - Ok, virus records: 27860
Fri Feb  1 14:45:28 2002 Daemon is installed, TCP socket created on port 3000

2) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: I experience the problem: if update.pl is launched from the command line everything is updated, and 
nothing gets updated if it is launched from the cron, though the logs show the cron works well 

A: The environment variables of the cron are different, you should define the full path to wget, 
for example /usr/bin/wget 

3) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: What is in UpdatePath? 

A: The path to the catalogue the new components will be stored in, which can be substituted automatically, 
or if the location for them is unknown (for example, new files of the Documentation).

4) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: version prior to 4.30. Log messages
   Jul 3 13:50:18 mail drweb-smf: dwlib: scan: message sent by <alex@gamma> is passed
   Jul 3 13:50:18 mail drweb-smf: [g639oGJI030655]: processing message from <alex@gamma> completed 
(exit code 3)
   What does (exit code 3) mean? 

A: Exit code 3 means the filter's answer to sendmail, that the message must be passed (PASS). The code is 
internal; it will be soon removed from the message.

5) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: One of the clients (only one) experience the following - 
   the mail is not sent no matter how many times he 
   presses the "Wait" button in Outlook.
   The following is written to the maillog by sendmail:
   drweb-smf: message from <address@domain> is aborted
   Please, explain, is something goes wrong with sendmail, Dr.Web or the user?


A: The filter has definitely nothing to do with this situation. This message means the sendmail said the filter 
that all the data associated with this mail can be released - and the mail processing is interrupted. The filter 
cannot determine what caused the interruption of processing (the client or the sendmail).
{sendmail}/libmilter/docs/xxfi_abort.html
        ...
	xxfi_abort is only called if the message is aborted OUTSIDE the
	filter's control and the filter has not completed its
	message-oriented processing. ...

Hint: It is most likely, that Norton Personal Firewall
or Norton Information Security (NIS) are installed; they begin every mail session with an empty message, 
such messages are not accepted by sendmail.

Q: Yesterday evening I have disabled, just for test purposes, drweb on MTA.
   The result is depressing: no "aborted" up till present!

A: No wonder - the filter performs such  diagnostics. 
"Is aborted" is written by the filter when Sendmail "said" the filter to suspend the processing (for example, 
due to the break in connection). 
Check the logs before "is aborted" and, most likely, you will see the reason  yourself.


6) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: I have installed drweb with qmail. But the sender of a virus receives two messages: the one reads that 
there is a virus in the message, the other - that the message can not be delivered: Remote host said: 554
   mail server permanently rejected message (#5.3.0)
   Can I somehow disable sending of such message as the user may think there is an error on the server

A: This is a problem (or maybe not a problem) with all filters. And there is a strong reason to do it as it is 
done now: the mail message MUST NOT disappear. If to enable the discard option (that is what you 
propose, i.e. to accept the virus, not to move it somewhere, write a notification and say that everything is 
ïë), then the message will disappear.

7) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: What do the question marks in drweb-smf.log mean?
   Nov 26 14:36:13 proba drweb-smf: [???]: ...

A: This means, that the filter could not define the message-id (this is an internal ID for sendmail) of this 
message. In version 8.11 of sendmail this could not be avoided, in sendmail-8.12, to enable the filter to write 
sendmail's message-id to the log you have to add the following line should be included to sendmail.cf:

------------------- cut ---------------------
O Milter.macros.envfrom=i, ...
------------------- cut ---------------------

(the dots mean other parameters, their values are not important).

8) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: What does the Expires= and the SubscriptionExpires= fields 
   in the key file (for example drwebd.key) mean?

A: 1. The key will work with all versions issued before the SubscriptionExpires date, and during this term 
there is a possibility to update from the commercial updates area (for more details contact the distributor).
2. The key becomes null and void after the Expires date, starting from version 4.30 the daemon will not be 
loaded at all, the prior versions shifted to the "without key" mode (when the mail was not checked).

9) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: Do databases of version 4.31 match the bases of version 4.30?

A: It is best to upgrade. Why? Read the answer to question #0 of this FAQ.
Only adds-on are compatible, the main bases are NOT compatible; thus the set of the loaded bases for 
version 4.30 is as follows:
+ drwebase.vdb v.4.30
+ all adds-on v.4.30 (drw430xx.vdb xx=01..26)
+ all adds-on v.4.31,(drw430yy.vdb yy=02..current) 
  !Important drw43101.vdb is not necessary in v.4.30
+ drwtoday.vdb

The standard updating script update.pl creates this very configuration of bases...
 
10) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Definitions in question:
$MTA - the name of the mail system (CGP, Sendmail, Postfix and so on)
$ARCHIVE_NAME - the name of the archive in the message (for example docs.zip, demo.ppt and so on)
$FILE_IN_ARCHIVE - the name o the file inside the archive (for example otchet.doc, Storage0 and so on)

Q: I have an $MTA and mail filter installed on the server. 
Today I receive a message which reads as follows:
--- cut ---
This message was not delivered as an object breaking the restrictions set for archives has been found.

Sender = sender@domain.com
Recipients = receiver@domain.com
Subject =  Subject
Identificator =  msg-id-NNNN@domain.com

--- Dr.Web report ---
Detailed Dr.Web report:
...
drweb.tmp.60gkxo/$ARCHIVE_NAME/$FILE_IN_ARCHIVE - compression ratio is too high (2770944 : 
35154)
...

Dr.Web Scanning statistics:
Evaluation key used !
Archive restriction : 21
--- cut ---

What does it mean and what should I do in this situation?

A:
This means, that in drweb_$MTA.conf:
[Actions]
ArchiveRestriction = reject or quarantine

And in  drweb32.ini:

[Daemon]
...
The MaxCompressionRatio is less than 78 (divide 2770944 by 35154)

Below goes what you should do:
There are two solutions of the problem:
Á) Expand the MaxCompressionRatio (say, to 200-500) and restart the daemon. You can also comment the 
parameter (which means it should be infinite). But mind, that in this case an attack at your mail system with 
the aim to temporary disable it becomes possible; when a malefactor will send the so-called "mail bombs", 
their check will take a substantial time and a huge portion (or even all) disk space.

Â) Set ArchiveRestriction = pass 
In this case, the virus can be sent inside the archive, if it can be compressed more than the 
MaxCompressionRatio (a script virus, for example).

11) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: I tried to bundle  Dr.Web with Postfix. The mail does not goes through at all. 
When I have checked the logs one line seemed suspicious
Jul 17 12:55:01 mailhub sendmail[29437]: h6H9t0sh029437: Authentication-Warning: host.domain.tld: drweb 
set sender
or:
Apr 20 17:32:31 mailhub sendmail[33617]: h3KDWVlV033617: from=name@example.com, size=38592, 
class=0, nrcpts=1, msgid=<msg-id4358035@example.com>, relay=drweb@localhost                                       
What can be the reason of the problem?

A: The reason lies in incorrect mail system setting:
sendmail[....]: .... - this log belongs to sendmail (www.sendmail.org), but not to the postfix substitutor of 
sendmail (it is supplied with postfix).
That is why in drweb_postfix.conf:
[Mailer]
Sendmail = ...
Set the path to the postfix substitutor of sendmail.
For example, if installed using the source code  it is located somewhere in /usr/libexec/postfix/sendmail

PS: By the way, it is quite strange that you have postfix, but in /usr/sbin the real sendmail is located.

12) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: I have drweb-sendmail-4.30 installed. From time to time the following error message is displayed:
Nov 9 22:55:49 mail drweb-smf: drweb_smf.c(667) - FATAL ERROR: cannot extract private data from 
context
Please, explain!

A: This is an error. To remove it, you can either
1. set drweb_smf.conf:
HeloInReceived = no

2. or upgrade the version.

13) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: When a message with a file attached is sent, the daemon checks all correctly, here goes an extract of the 
log:
Nov 5 14:59:27 relay sendmail[22756]: hA5CxRIm022756: from=<foo@example.com>, size=15600, 
class=0, nrcpts=1, msgid=<msg-id#@example.com>, proto=ESMTP, daemon=MTA, relay=domain.tld 
[10.0.0.1]

But, when the same message is sent, NAV checks out-going messages (the clinet from which I sent the 
message from) and the following is reported:

Nov 5 14:58:48 relay sendmail[22751]: hA5CwlIm022751:from=<foo@example.com>, size=0, class=0, 
nrcpts=1,proto=ESMTP, daemon=MTA, relay=domain.tld [10.0.0.2]
Nov 5 14:58:48 relay drweb-smf: [hA5CwlIm022751]: message from foo@example.com is aborted

A: NAV is trying, for some reason, (I don't know why) to send an empty message, i.e. it is completely empty 
and does not have any heading. Sendmail does not like it and it terminates the receipt of this message and 
notifies a filter about it. The filter simply ascertains the fact.  See also the question #5

14) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: I have drweb-4.29.5 installed. A strange thing happened: I received a mail with Gibe.2:

Wed Nov 12 08:56:20 2003 [1459] /var/spool/filter/drweb.tmp.HM5dmX/[text:html] - Ok                        
Wed Nov 12 08:56:20 2003 [1459] >>/var/spool/filter/drweb.tmp.HM5dmX/cgmgf.exe - Ok   

At the same time, on-line check (http://online.drweb.com):
...
cgmgf.exe packed by UPX
>cgmgf.exe infected with Win32.HLLM.Gibe.2
Scan report for "cgmgf.exe":
Scanned : 1 Cured : 0 
Infected : 1 Deleted : 0 
...

Here goes the daemon load log:

Wed Nov 12 04:02:07 2003 SIGHUP received, reloading...                                                     
Wed Nov 12 04:02:07 2003 Dr.Web (R) daemon for Linux, version 4.29.5 (January 6, 2003)                     
...
Wed Nov 12 04:02:08 2003 Key file: /opt/drweb/drwebd.key                                                   
Wed Nov 12 04:02:08 2003 Registration info:                                                                
Wed Nov 12 04:02:08 2003 0100000003                                                                        
Wed Nov 12 04:02:08 2003 Evaluation key ID Anti-virus Lab St.Petersburg                                    
Wed Nov 12 04:02:08 2003 Your registration key has expired!
...
Wed Nov 12 04:02:08 2003 This is an EVALUATION version with limited 
...

A: The demo-keys are issued:
Á) for a particular version, i.e. the key for another version will not be valid  
b) they are valid for a limited period of time (on 01.02.2004 this term equals to 1 year), 
after its expiration the key becomes void.
The cited error message says that the daemon will operate without the key, it will detect only the unpacked 
viruses. By the way, starting from version 4.30 the daemon will not be loaded if the valid key is not available.

And here is an explanation why the viruses are not detected. The first level MIME is unpacked without the 
key (this is an error of version 4.29.È), but all other checks follow the key permissions, accordingly, all 
archives (RAR, ZIP, etc.), and packers UPX, DIET, etc.) and attached MIMEs are not checked.

15) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: I have Dr.Web daemon + Dr.Web for CommuniGatePro installed; the headings filtering is enabled 
(RuleFilter = on + RuleFitlerAlert = reject), but for some blocked messages notifications are not 
received by a sender, but the administrator receives two messages:

Subject: Rule rejected message
Date: Thu, 13 Nov 2003 17:18:02 +0300
From: DrWeb-DAEMON <DrWEB-DAEMON@example.com>
To: System Administrator <postmaster@example.com>

Sender = <> (may be forged)
Recipients = postmaster@example.com
...

A: This happens, if, among the rules, there are rules regulating the 
Subject: header. As CommuniGatePro in the notification to a sender (and the administrator) uses the old header, 
the notifications have been also blocked by the filter.

16) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: I have Dr.Web for Sendmail (version prior to 4.30.1 or compiled from the source code) installed. 
Sometimes the filter terminates without any visible reasons. What can it be?

A: Yes, this may happen. The reason lies in the libmilter (written by the sendmail authors). It usually 
happens when the server is overloaded, then system logs may have the messages as follows:
Nov 20 19:54:09 name drweb-smf: Dr.WEB Sendmail filter VER: malloc(ctx) failed (12), abort
ÉÌÉ 
Nov 20 19:54:09 name drweb-smf: Dr.WEB Sendmail filter VER: thread_create() failed: 11, abort

Starting from version 4.30.1 we use the modified version of the libmilter. We also issued a patch for the 
original version of sendmail-8.12.9. There is no other way of solution of the problem so far.

Write to us if you believe this is not the reason of the  filter termination, we shall examine the case.

17) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: I have the Dr.Web mail filter installed. For the infected objects the discard action (Infected = discard) is 
set, but notifications are still received. Why?  I don't want them to be sent.

A: The actions set in the [Actions] section and the notifications set in the [...Notifications] sections work 
independently: the action is needed for the filter to know what to answer your mail server; the notifications 
may be sent not depending upon the action set (Exception: the pass action -
notifications are not sent). Thus, if you do not want to receive notifications you should disable them in the 
correspondent section. For your particular case:
[VirusNotifications]
SenderNotify = no
AdminNotify = no
RcptsNotify = no
...

18) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: I have installed your mail filter and sent a message with a virus (a friend of mine has given it to me). The 
virus was detected, but only the administrator has received a notification, though I have enabled notifications 
for all. Why is that?

A: Most likely, the notification policy for the virus you have sent, is changed in the configuration file 
/etc/drweb/viruses.conf (more precisely, with the help of the configuration file defined in the 
UnnotificableVirusesList parameter in the main configuration file).

19) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: I have Dr.Web Daemon & Dr.Web for Sendmail installed. The mail messages are not checked for viruses 
and the mail log has the following entries:
...
Nov 24 19:11:20 vulture sendmail[873]: /etc/mail/aliases: 37 aliases, longest 12 bytes, 423 bytes total
Nov 24 19:11:48 vulture sendmail[878]: hAO9Bmvr000878: milter_read(drweb-filter): cmd read returned 4, 
expecting 5
Nov 24 19:11:48 vulture sendmail[878]: hAO9Bmvr000878: Milter (drweb-filter): to error state
Nov 24 19:11:48 vulture sendmail[878]: hAO9Bmvr000878: Milter (drweb-filter): init failed to open
Nov 24 19:11:48 vulture sendmail[878]: hAO9Bmvr000878: Milter (drweb-filter): to error state
Nov 24 19:11:48 vulture sendmail[878]: hAO9Bmvr000878: from=<adm@test.ru>, size=803, class=0, 
nrcpts=1, msgid=<60270330044.20031124191101@100h.ru>, proto=ESMTP, daemon=MTA, 
relay=[192.168.*.**]
Nov 24 19:11:48 vulture sendmail[880]: hAO9Bmvr000878: to=<shest@test.ru>, ctladdr=<adm@test.ru> 
(1012/6), delay=00:00:00, xdelay=00:00:00, mailer=local, pri=31026, relay=local, dsn=2.0.0, stat=Sent

A:
You have connected the filter incorrectly. In sendmail.cf (.mc) you have defined the address of the daemon 
(drwebd), but you should define the address where the filter (drweb-smf) will wait for requests from sendmail 
- the same address is listed in the MilterAddress parameter in the [Mailer] section of file drweb_smf.conf. 
The daemon address is shown in drweb32.ini in the Socket parameter and in the Address parameter of the 
[DaemonCommunication] section of drweb_smf.conf.
Besides, to generate the correct additions to sendmail.cf (.mc)
And the script for the automatic filter startup you can use the {drweb}/doc/sendmail/configure utility.

20) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: I have received an interesting file called "something.jpg      .exe". The on-line check reports it is clean. 
Where can I check it?

A: There is an address for suspicious files and attachments:
newvirus@drweb.com. It is best to pack the suspicious file in the password-protected archive.
Please include the password and the brief information on your suspicions in the accompanying message.

21) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: I have installed a mail filter, but notifications are received by the administrator only, though in 
drweb_{mta}.conf:
...
[VirusNotification]
SenderNotify = yes
RcptsNotify = yes
AdminNotify = yes
...
the masks are specified and available. What is the reason of the problem?

A: The reason is that most viruses received through the mail are the so-called "worms", the notifications 
policy for such viruses is changed in viruses.conf (or in the file defined in drweb_{mta}.conf -> [Actions]
-> UnnotificableVirusesList) (the entry Win32.HLLM). The reason is that the "worms" usually spoof the 
sender's addresses and the recipient's address is randomly chosen (from the victim's address book, as a 
rule). That's why the notification to a sender is considered as a "spam".

22) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: It is difficult to understand what kind of program and license you offer is needed for?

A: At present, there are three types of programs available:
- scanner (drweb)
- daemon (drwebd)
- mail filters (drweb-smf, drweb-postfix, ...) 
  and file filters(smb_spider, drweb-icapd)

The scanner checks files on the drive. The list of files to be checked is either specified in the parameters, or 
is read from a standard input stream. You need a separate license for the scanner. 

Filters do not check themselves, they can only "intercept" the mail (CommuniGate, Sendmail, ... ) and files 
(Samba, Squid) from correspondent programs. 
There is no need in separate license for them. And more, the source codes for some of them are available at 
our site. Thus, without active daemon the filters are useless.


The Daemon checks the files on the drive and the data received through the network connections from filters 
or other programs on a special protocol. There are two types of licenses for the daemon - the "mail license" 
(it checks addresses and traffic) and the "file license". You need the "mail license" if the daemon will be 
bundled with mail filters.
You need the "file license" if the daemon will be bundled with file filters (Samba, Squid). 

PS: If the "file license" is purchased the daemon will NOT check the mail, and visa versa. You can buy both 
licenses with one key.

23) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: The FreeBSD 4.x (x =< 7) system. I have installed version 4.31 and receive:
/usr/local/drweb > ./drweb-smf.sh start
/usr/libexec/ld-elf.so.1: Undefined symbol "__stdoutp"
    referenced from COPY relocation in /usr/local/drweb/drweb-smf
What should I do?

A: Use drweb-smf.static, the same goes with other filters. 

24) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: I have installed Dr.Web Sendmail, but it does not check the mail. The daemon log reads:
===
Daemon is installed, active interfaces:  127.0.0.1:3000
Unknown command received: 13!
===
(asv: or, if the use of russian.dwl is enabled)
===
Daemon is loaded, active interfaces:  127.0.0.1:3000
Unknown command received: 13
===
What should I do?

A: Read the answer to question #19, your experience the same problem.

25) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: The FreeBSD system. The rules filter (RejectCondition) in daemon does not work if the Russian language 
is used in rules? What should I do?

A:  Firstly, the rules should be set in the KOI8-R encoding. 
Secondly, understand, that if the header you want to filter (for example, Subject:) is 8bit encoded (which 
means it breaks the standard for mail, as it must be encoded =?koi8-r?B?..?= or =?cp1251?Q?..?=, i.e. you 
have to specify the encoding), 
it will be compared without taking into account the encoding. Such messages (8bit encoded) can also be 
blocked by the filter:
RejectCondition Subject = "8bit"
And finally, the locale should be correctly set to KOI8-R for the user with whose rights the daemon is 
launched:

1. Add to file /etc/login.conf (though it is usually present):
#
# Russian Users Accounts. Setup proper environment variables.
#
russian:Russian Users Accounts:\
        :charset=KOI8-R:\
        :lang=ru_RU.KOI8-R:\
        :tc=default:

For updating /etc/login.conf.db:
# cap_mkdb /etc/login.conf

2. Now, the drweb user should indicate that it belongs to class russian:
# pw usermod drweb -L russian

3. Sometimes it is necessary, in the daemon launching script, to add before the line "case "$1" in"

LC_ALL=ru_RU.KOI8-R
export LC_ALL

4. Restart the daemon...

26) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: I decided to check the Dr.Web filter at http://www.testvirus.org, but in 25 tests made Dr.Web have missed 
some variants. What can you say to that?

A: As on May 19, 2004, as the site could have changed, and the tests as well, we have missed the following 
tests:

Test #12: Eicar virus within a password protected ZIP file
Test #24: Test for the "Partial (Fragmented) Vulnerability". This does not include Eicar virus, 
          but your mail server still must block this since it can break a virus into multiple 
          emails and reassemble it in your inbox.

- It may be blocked, if the SkipObject option is switched from pass to any other action
Test #14: Eicar virus sent in a Microsoft TNEF file (winmail.dat)

- The TNEF  is not parsed at present.

Test #25: Attachment with a CLSID extension, which may hide the real file extension. This does not 
          include the Eicar virus, but your mail server still must block this since it can hide the true extension of 
a file

- The message does not contain a viral code.

Test #16: Eicar string in HTML, to ensure that your mail server scans HTML segments
Test #19: Eicar virus within zip file hidden using the "Blank Folding Vulnerability"
Test #21: Eicar virus within zip file hidden using the "Long MIME Boundary Vulnerability"
Test #23: Eicar virus within zip file hidden using the "Empty MIME Boundary Vulnerability"

- Being such, the virus is not dangerous and will not proliferate, it can simply be called a garbage. 
By the way, in samples #16 and #21 the scanner does detect the virus, but the daemon parses the mail 
more quickly and simply.

27) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: After the usual update the version 4.29.2 (or 4.29.5) has become unstable under high load (large number 
of messages) Why?

A: The problem does not lie in bases, (this can easily be checked if to launch the daemon from the main 
base only and the "problem" update); this is an error of version 4.29 (particularly, of drweb32.dll of version 
4.29). Thus, the upgrade is the only possible solution, as we do not issue fixes for old versions. The reason 
is explained in question #0.

28) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: I've installed Dr.Web Daemon and Dr.Web Filter for Sendmail. It seems to be configured
properly but filter doesn't run and I see folling messages in /var/log/messages:

Jun 10 13:24:04 host drweb-smf: Dr.Web (R) Filter for sendmail ver.4.32: Unable to bind to port 3000@localhost: Address already in use
Jun 10 13:24:04 host drweb-smf: Dr.Web (R) Filter for sendmail ver.4.32: Unable to create listening socket on conn 3000@localhost

or

Jun 10 13:24:04 host drweb-smf: Dr.Web (R) Filter for sendmail ver.4.32: Unable to bind to port local:/var/drweb/run/.daemon: Address already in use
Jun 10 13:24:04 host drweb-smf: Dr.Web (R) Filter for sendmail ver.4.32: Unable to create listening socket on conn local:/var/drweb/run/.daemon

A: You have speficied Dr.Web Daemons connections definition in option MilterAddress (section
[Mailer] of drweb_smf.conf) instead definition of connection is used for communication
between filter and sendmail (this definition also is specified in sendmail.cf). So you 
should have something like this:
in drweb32.ini
Socket = 3000 localhost

in drweb_smf.conf:
[DaemonCommunication]
Address = inet:3000@localhost
...
[Mailer]
...
MilterAddress = inet:3001@localhost

and in sendmail.cf:
Xdrweb-filter,  S=inet:3001@localhost, F=T, T=C:1m;S:5m;R:5m;E:1h

29) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q: I have installed Dr.Web daemon and mail filter. Sometimes I receive alerts about
unchecked messages with reason:
===
The filter cannot connect to the DrWEB daemon
===
What can I do to avoid this problem ?

A: We have known two general reason for this problem:
a) Daemons incoming queue overflows if load has sharply increased.
b) Daemon is not ready for some reasons.
So you have two ways to avoid these problems. Second way more general and reliable.
i) Use two or more sockets for communication between daemon and filter. 
Configurations example:
drweb32.ini:
Socket = /var/drweb/run/.drwebd
Socket = 3000 localhost

drweb_{mta}.conf:  ({mta} = smf, cgp, postfix, exim, qmail, zmailer, courier or mio)
[DaemonCommunication]
Address = local:/var/drweb/run/.drwebd, inet:3000@localhost

ii) Use reserved daemon (on same host or on another host that more reliable) would 
smooth load burstness or works while first daemon is not ready.
Configurations example:
drweb_{mta}.conf:  ({mta} = smf, cgp, postfix, exim, qmail, zmailer, courier or mio)
[DaemonCommunication]
Address = local:/var/drweb/run/.drwebd, inet:3000@another.myhost.example.com

NOTE: LocalScan mode is not available for second socket in filter even if socket
is used by daemon is installed on same host. 
See daemon and filter documentation for details.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Author: Sergey Akhapkin <asv@drweb.com>

$Revision: 1.3 $ 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

