:
~~~~~~~~~~~
0)      ?      .

1)    .   ?

2)  -   update.pl     ,
       cron - ,  cron   
     ...

3)    UpdatePath? 

4)   4.30.   :
   Jul 3 13:50:18 mail drweb-smf: dwlib: scan: message sent by <alex@gamma> is passed
   Jul 3 13:50:18 mail drweb-smf: [g639oGJI030655]: processing message from <alex@gamma> completed (exit code 3)
     (exit code 3)? 

5)   ( )   :
            Outlook
   "" -  .
    maillog     :
   drweb-smf: message from <@> is aborted
   , , " " - ,   ?

6)  drweb  qmail.   ,   
      -     ,    ,
        : Remote host said: 554
   mail server permanently rejected message (#5.3.0).
   -  ,     ?  
       ,  -  
    ..

7)   drweb-smf.log   ?
   Nov 26 14:36:13 proba drweb-smf: [???]: ...

8) ,    Expires=  SubscriptionExpires=
      ( drwebd.key)?

9)    4.31    4.30?

10) drweb.tmp.60gkxo/$ARCHIVE_NAME/$FILE_IN_ARCHIVE - compression ratio is too high (2770944 : 35154)
    ...
      Dr.Web:
    Evaluation key used !
    Archive restriction : 21
    ...
       ?      ?

11)    Dr.Web + Postfix.    . 
     ,   :
    Jul 17 12:55:01 mailhub sendmail[29437]: h6H9t0sh029437: Authentication-Warning: host.domain.tld: drweb set sender
     :
    Apr 20 17:32:31 mailhub sendmail[33617]: h3KDWVlV033617: from=name@example.com, size=38592, class=0, nrcpts=1, msgid=<msg-id4358035@example.com>, relay=drweb@localhost                                       
        ?

12)  drweb-sendmail-4.30,      :
    Nov 9 22:55:49 mail drweb-smf: drweb_smf.c(667) - FATAL ERROR: cannot extract private data from context

13)      ,   
    ,  :
    Nov 5 14:59:27 relay sendmail[22756]: hA5CxRIm022756: from=<foo@example.com>, size=15600, class=0, nrcpts=1, msgid=<msg-id#@example.com>, proto=ESMTP, daemon=MTA, relay=domain.tld [10.0.0.1]

          ,    
    NAV-   ( ,   ),  :

    Nov 5 14:58:48 relay sendmail[22751]: hA5CwlIm022751:from=<foo@example.com>, size=0, class=0, nrcpts=1,proto=ESMTP, daemon=MTA, relay=domain.tld [10.0.0.2]
    Nov 5 14:58:48 relay drweb-smf: [hA5CwlIm022751]: message from foo@example.com is aborted

14)  drweb-4.29.5.   :      
      Gibe.2:

    Wed Nov 12 08:56:20 2003 [1459] /var/spool/filter/drweb.tmp.HM5dmX/[text:html] - Ok                        
    Wed Nov 12 08:56:20 2003 [1459] >>/var/spool/filter/drweb.tmp.HM5dmX/cgmgf.exe - Ok   

          (http://online.drweb.com):
    ...
    cgmgf.exe packed by UPX
    >cgmgf.exe infected with Win32.HLLM.Gibe.2

15)     Dr.Web daemon + Dr.Web for 1,   
       (RuleFilter = on + RuleFitlerAlert = reject),
           
      ,     .

16)    Dr.Web for Sendmail (  4.30.1  
       ),       
     -  .    ?

17)      Dr.Web,    
      discard (Infected = discard),    
      . ?   ,   .

18)           (  
     ,    ..),   ,   
      ,       . 
    ?

19)  Dr.Web Daemon & Dr.Web for Sendmail,      
     ,     :
    ...
    Nov 24 19:11:48 vulture sendmail[878]: hAO9Bmvr000878: milter_read(drweb-filter): cmd read returned 4, expecting 5
    

20)      
    ...
       ?

21)    ,     .
    ...
      ?
        
22)      ,   .    ?

23)  FreeBSD 4.x (x =< 7).   4.31.    
     : /usr/libexec/ld-elf.so.1: Undefined symbol "__stdoutp"
    referenced from COPY relocation in /usr/local/drweb/drweb-smf.

24)  Dr.Web Sendmail,     .   :
    ===
     ,  :  127.0.0.1:3000
      : 13
    ===
    
    ===
    Daemon is installed, active interfaces:  127.0.0.1:3000
    Unknown command received: 13!
    ===
     ?

25)  FreeBSD.     (RejectCondition)  , 
        .  ?

26)   http://www.testvirus.org     Dr.Web, 
     25  Dr.Web   .    ?

27)     4.29.2 ( 4.29.5)  ""  
    - .  ?

28)   Dr.Web Daemon & Dr.Web Filter for Sendmail,    
       ,   /var/log/messages  :
    Jun 10 13:24:04 host drweb-smf: Dr.Web (R) Filter for sendmail ver.4.32: Unable to bind to port 3000@localhost: Address already in use
    Jun 10 13:24:04 host drweb-smf: Dr.Web (R) Filter for sendmail ver.4.32: Unable to create listening socket on conn 3000@localhost
    
    Jun 10 13:24:04 host drweb-smf: Dr.Web (R) Filter for sendmail ver.4.32: Unable to bind to port local:/var/drweb/run/.daemon: Address already in use
    Jun 10 13:24:04 host drweb-smf: Dr.Web (R) Filter for sendmail ver.4.32: Unable to create listening socket on conn local:/var/drweb/run/.daemon

29)     Dr.Web   ,      
    ,  -      :
    The filter cannot connect to the DrWEB daemon
          ?
    

:
~~~~~~~~~~~
0) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:      ?      .

:     .   :
-        (drweb32.dll),  
  :   (: 4.30 -  FSG),  
 (: 4.30 - LHA),     ( 
 Windows ), -        
 (: 4.29   Win32.HLLM.Dumaru, ..   FSG).
-      (4.29  4.30     
4.) ,        
        .


1) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:    .   ?

: ,   :  online-  
http://online.drweb.com
   ,   .
  ,   :
)      (    
  drwebase.vdb).
---
Fri Feb  1 14:45:26 2002 Key file: /etc/drweb/drwebd.key
Fri Feb  1 14:45:26 2002 Registration info:
Fri Feb  1 14:45:26 2002 0100000002
Fri Feb  1 14:45:26 2002 Evaluation Key (ID Anti-Virus Lab. Ltd, St.Petersburg)
Fri Feb  1 14:45:26 2002 This is an EVALUATION version with limited functionality!
Fri Feb  1 14:45:26 2002 To get your registration key, call regional dealer.
Fri Feb  1 14:45:26 2002 Loading /var/drweb/bases/drwtoday.vdb - Ok, virus records: 56
Fri Feb  1 14:45:27 2002 Loading /var/drweb/bases/drw42702.vdb - Ok, virus records: 116
Fri Feb  1 14:45:27 2002 Loading /var/drweb/bases/drw42701.vdb - Ok, virus records: 90
Fri Feb  1 14:45:28 2002 Daemon is installed, TCP socket created on port 3000

)    (  -  )
:    4.30    ,   
 . 
,    :
---   , ,   
Fri Feb  1 14:43:33 2002 This is an EVALUATION version with limited functionality!
Fri Feb  1 14:43:33 2002 To get your registration key, call regional dealer.
Fri Feb  1 14:43:33 2002 Loading /var/drweb/bases/drwtoday.vdb - Ok, virus records: 56
Fri Feb  1 14:43:34 2002 Loading /var/drweb/bases/drw42702.vdb - Ok, virus records: 116
---   (,   drweb32.ini)
Fri Feb  1 14:45:26 2002 Key file: /etc/drweb/drweb.key
Fri Feb  1 14:45:26 2002 Registration info:
Fri Feb  1 14:45:26 2002 0100000002
Fri Feb  1 14:45:26 2002 Evaluation Key (ID Anti-Virus Lab. Ltd, St.Petersburg)
Fri Feb  1 14:43:33 2002 Registration key mismatches application!
Fri Feb  1 14:45:26 2002 This is an EVALUATION version with limited functionality!
Fri Feb  1 14:45:26 2002 To get your registration key, call regional dealer.
Fri Feb  1 14:45:26 2002 Loading /var/drweb/bases/drwtoday.vdb - Ok, virus records: 56
Fri Feb  1 14:45:27 2002 Loading /var/drweb/bases/drw42702.vdb - Ok, virus records: 116
Fri Feb  1 14:45:27 2002 Loading /var/drweb/bases/drw42701.vdb - Ok, virus records: 90
Fri Feb  1 14:45:27 2002 Loading /var/drweb/bases/drwebase.vdb - Ok, virus records: 27860
Fri Feb  1 14:45:28 2002 Daemon is installed, TCP socket created on port 3000

      :
---
Fri Feb  1 14:45:26 2002 Key file: /etc/drweb/drwebd.key
Fri Feb  1 14:45:26 2002 Registration info:
Fri Feb  1 14:45:26 2002 0100000002
Fri Feb  1 14:45:26 2002 Evaluation Key (ID Anti-Virus Lab. Ltd, St.Petersburg)
Fri Feb  1 14:45:26 2002 This is an EVALUATION version with limited functionality!
Fri Feb  1 14:45:26 2002 To get your registration key, call regional dealer.
Fri Feb  1 14:45:26 2002 Loading /var/drweb/bases/drwtoday.vdb - Ok, virus records: 56
Fri Feb  1 14:45:27 2002 Loading /var/drweb/bases/drw42702.vdb - Ok, virus records: 116
Fri Feb  1 14:45:27 2002 Loading /var/drweb/bases/drw42701.vdb - Ok, virus records: 90
Fri Feb  1 14:45:27 2002 Loading /var/drweb/bases/drwebase.vdb - Ok, virus records: 27860
Fri Feb  1 14:45:28 2002 Daemon is installed, TCP socket created on port 3000

2) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:  -   update.pl     ,
       cron - ,  cron   
     ...

:     ,     wget,
, /usr/bin/wget 

3) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:    UpdatePath? 

: ,     ,    
,      (,  
).

4) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:   4.30.   :
   Jul 3 13:50:18 mail drweb-smf: dwlib: scan: message sent by <alex@gamma> is passed
   Jul 3 13:50:18 mail drweb-smf: [g639oGJI030655]: processing message from <alex@gamma> completed (exit code 3)
     (exit code 3)? 

: exit code 3 -    sendmail-,     
 (PASS) .  ,     .

5) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:   ( )   :-
            Outlook
   "" -  .
    maillog     :
   drweb-smf: message from <@> is aborted
   , , " " - ,   ?

:   ,    (  ) -   , 
 sendmail  ,   ,    , 
   -   .  -    
 sendmail -  .
{sendmail}/libmilter/docs/xxfi_abort.html
        ...
	xxfi_abort is only called if the message is aborted OUTSIDE the
	filter's control and the filter has not completed its
	message-oriented processing. ...

Hint:   ,     Norton Personal Firewall
 Norton Information Security (NIS),    
   ,  sendmail-  .

:  ,  ,  drweb  MTA.
    ,   "aborted"    !

, ..     .   , 
is aborted  ,  0 ""    
(, -  ). 
    is aborted ,  ,   
  .


6) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:  drweb  qmail.   ,   
      -     ,    ,
        : Remote host said: 554
   mail server permanently rejected message (#5.3.0).
   -  ,     ?  
       ,  -  
    ..

:   (  )   . ,  , 
    -     .  
  discard (,    - ..  ,  
  ,      ),   .

7) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:   drweb-smf.log   ?
   Nov 26 14:36:13 proba drweb-smf: [???]: ...

:  ,      message-id (  ID
 sendmail)  .   sendmail-8.11   ,  
 sendmail-8.12  ,         
 sendmails message-id, ,   sendmail.cf  
 :

------------------- cut ---------------------
O Milter.macros.envfrom=i, ...
------------------- cut ---------------------

(    -    ).

8) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
: ,    Expires=  SubscriptionExpires=
       ( drwebd.key)?

: 1.      ,    SubscriptionExpires,
          
 (   ).
2.      Expires,    4.30 
  ,        " " ( 
   ).

9) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:    4.31    4.30?

:    ,    -  #0  FAQ.
C  ,    ,
 ,      4.30   :
+ drwebase.vdb  4.30
+    4.30 (drw430xx.vdb xx=01..26)
+    4.31,(drw430yy.vdb yy=02..) 
  ! drw43101.vdb     4.30
+ drwtoday.vdb

   update.pl  
   ...
 
10) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
  :
$MTA -    (1, Sendmail, Postfix  ..)
$ARCHIVE_NAME -     (, docs.zip, demo.ppt  ..)
$FILE_IN_ARCHIVE -     (, otchet.doc, Storage0  ..)

:      $MTA   . 
    :
--- cut ---
   ,    , 
  ,   .

 = sender@domain.com
 = receiver@domain.com
 =  Subject
 =  msg-id-NNNN@domain.com

--- Dr.Web report ---
  Dr.Web:
...
drweb.tmp.60gkxo/$ARCHIVE_NAME/$FILE_IN_ARCHIVE - compression ratio is too high (2770944 : 35154)
...

  Dr.Web:
Evaluation key used !
Archive restriction : 21
--- cut ---

   ?      ?

:
 ,   drweb_$MTA.conf:
[Actions]
ArchiveRestriction = reject  quarantine

  drweb32.ini:

[Daemon]
...
MaxCompressionRatio ,  78 (2770944   35154)

,    .
 2 .
)    MaxCompressionRatio (  200-500) 
  .     (
,    ).   ,  
          
    ,    
  "" ,     
  - ? -  .

)  ArchiveRestriction = pass 
       ,     
 MaxCompressionRatio (,  ).

11) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:    Dr.Web + Postfix.    . 
 ,   :
Jul 17 12:55:01 mailhub sendmail[29437]: h6H9t0sh029437: Authentication-Warning: host.domain.tld: drweb set sender
 :
Apr 20 17:32:31 mailhub sendmail[33617]: h3KDWVlV033617: from=name@example.com, size=38592, class=0, nrcpts=1, msgid=<msg-id4358035@example.com>, relay=drweb@localhost                                       
    ?

:      :
sendmail[....]: .... -   sendmail (www.sendmail.org),   postfix-
 sendmail (   postfix).
  drweb_postfix.conf:
[Mailer]
Sendmail = ...
   postfix-  sendmail.
,       -  
/usr/libexec/postfix/sendmail

PS:   ,    postfix,   /usr/sbin  
sendmail.

12) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:  drweb-sendmail-4.30,      :
Nov 9 22:55:49 mail drweb-smf: drweb_smf.c(667) - FATAL ERROR: cannot extract private data from context
!

:  .    , :
1)    drweb_smf.conf:
HeloInReceived = no

2)     .

13) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:      ,   
,  :
Nov 5 14:59:27 relay sendmail[22756]: hA5CxRIm022756: from=<foo@example.com>, size=15600, class=0, nrcpts=1, msgid=<msg-id#@example.com>, proto=ESMTP, daemon=MTA, relay=domain.tld [10.0.0.1]

      ,    
NAV-   ( ,   ),  :

Nov 5 14:58:48 relay sendmail[22751]: hA5CwlIm022751:from=<foo@example.com>, size=0, class=0, nrcpts=1,proto=ESMTP, daemon=MTA, relay=domain.tld [10.0.0.2]
Nov 5 14:58:48 relay drweb-smf: [hA5CwlIm022751]: message from foo@example.com is aborted

: NAV  - ( , ,   )   
,  ..  ,   . Sendmail-   , 
     ,    .   
  . .    #5

14) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:  drweb-4.29.5:   :      
  Gibe.2:

Wed Nov 12 08:56:20 2003 [1459] /var/spool/filter/drweb.tmp.HM5dmX/[text:html] - Ok                        
Wed Nov 12 08:56:20 2003 [1459] >>/var/spool/filter/drweb.tmp.HM5dmX/cgmgf.exe - Ok   

      (http://online.drweb.com):
...
cgmgf.exe packed by UPX
>cgmgf.exe infected with Win32.HLLM.Gibe.2
Scan report for "cgmgf.exe":
Scanned : 1 Cured : 0 
Infected : 1 Deleted : 0 
...

   :

Wed Nov 12 04:02:07 2003 SIGHUP received, reloading...                                                     
Wed Nov 12 04:02:07 2003 Dr.Web (R) daemon for Linux, version 4.29.5 (January 6, 2003)                     
...
Wed Nov 12 04:02:08 2003 Key file: /opt/drweb/drwebd.key                                                   
Wed Nov 12 04:02:08 2003 Registration info:                                                                
Wed Nov 12 04:02:08 2003 0100000003                                                                        
Wed Nov 12 04:02:08 2003 Evaluation key ID Anti-virus Lab St.Petersburg                                    
Wed Nov 12 04:02:08 2003 Your registration key has expired!
...
Wed Nov 12 04:02:08 2003 This is an EVALUATION version with limited 
...

: - :
)   , ..       ;
)    ( 01.02.2004    1 ), 
      .
     ,      , 
..    ,    .
,   4.30    ,    
.

,     -   MIME 
   (   4.29.),      
 ,    (RAR, ZIP etc),  (UPX, DIET etc) 
 MIME  .

15) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:     Dr.Web daemon + Dr.Web for 1,   
   (RuleFilter = on + RuleFitlerAlert = reject),
,       
  ,     :

Subject: Rule rejected message
Date: Thu, 13 Nov 2003 17:18:02 +0300
From: DrWeb-DAEMON <DrWEB-DAEMON@example.com>
To: System Administrator <postmaster@example.com>

Sender = <> (may be forged)
Recipients = postmaster@example.com
...

:  ,       ,  
Subject:, . . 1    ( )  
 ,      .

16) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:    Dr.Web for Sendmail (  4.30.1  
   ),        
-  .    ?

: ,   .     libmilter ( 
sendmail).     ,    
,        :
Nov 20 19:54:09 name drweb-smf: Dr.WEB Sendmail filter VER: malloc(ctx) failed (12), abort
 
Nov 20 19:54:09 name drweb-smf: Dr.WEB Sendmail filter VER: thread_create() failed: 11, abort

   4.30.1     libmilter,  
      sendmail-8.12.9. - 
 ,  ,   .

  ,  ""      ,   -
 .

17) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:      Dr.Web,    
  discard (Infected = discard), ,   
 . ?   ,   .

: ,    [Actions],  ,    
[...Notifications],  :    ,  
,      ,    
     . (:  pass -
  ).  ,      
,      .   :
[VirusNotifications]
SenderNotify = no
AdminNotify = no
RcptsNotify = no
...

18) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:           (  
 ,    ..),   ,   
 ,       . ?

:  ,  ,   ,   
     /etc/drweb/viruses.conf (,  
  ,    UnnotificableVirusesList 
   ).

19) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:  Dr.Web Daemon & Dr.Web for Sendmail,      
 ,     :
...
Nov 24 19:11:20 vulture sendmail[873]: /etc/mail/aliases: 37 aliases, longest 12 bytes, 423 bytes total
Nov 24 19:11:48 vulture sendmail[878]: hAO9Bmvr000878: milter_read(drweb-filter): cmd read returned 4, expecting 5
Nov 24 19:11:48 vulture sendmail[878]: hAO9Bmvr000878: Milter (drweb-filter): to error state
Nov 24 19:11:48 vulture sendmail[878]: hAO9Bmvr000878: Milter (drweb-filter): init failed to open
Nov 24 19:11:48 vulture sendmail[878]: hAO9Bmvr000878: Milter (drweb-filter): to error state
Nov 24 19:11:48 vulture sendmail[878]: hAO9Bmvr000878: from=<adm@test.ru>, size=803, class=0, nrcpts=1, msgid=<60270330044.20031124191101@100h.ru>, proto=ESMTP, daemon=MTA, relay=[192.168.*.**]
Nov 24 19:11:48 vulture sendmail[880]: hAO9Bmvr000878: to=<shest@test.ru>, ctladdr=<adm@test.ru> (1012/6), delay=00:00:00, xdelay=00:00:00, mailer=local, pri=31026, relay=local, dsn=2.0.0, stat=Sent

:
   .  sendmail.cf (.mc)    
(drwebd),    ,    (drweb-smf)   
  sendmail -       MilterAddress  
 [Mailer]  drweb_smf.conf.     drweb32.ini
  Socket    Address   [DaemonCommunication] 
 drweb_smf.conf.
  ,      sendmail.cf (.mc)
        
{drweb}/doc/sendmail/configure.

20) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:      "something.jpg.exe",
     .    ?

:      , :
newvirus@drweb.com
        .
          .

21) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:    ,     ,
  drweb_{mta}.conf:
...
[VirusNotification]
SenderNotify = yes
RcptsNotify = yes
AdminNotify = yes
...
   .   ?

:     ,   ,   , 
  "",   viruses.conf (  ,   
drweb_{mta}.conf->[Actions]->UnnotificableVirusesList)   
   ( Win32.HLLM).    , 
""    ,    
  (    ),  
      "".

22) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:      ,   .    ?

:       3  :
-  (drweb)
-  (drwebd)
-   (drweb-smf, drweb-postfix, ...) 
    (smb_spider, drweb-icapd)

      ,       
,      .     
. 

    ,  " "  
(CommuniGate, Sendmail, ... )   (Samba, Squid)   . 
    ,          .
 ,      .


 -            
       .     
 , " ( ,  )"  "". 
""  ,         
.
""  ,        
 (Samba, Squid). 

PS:   "" ,      ,
 .        .

23) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:  FreeBSD 4.x (x =< 7).   4.31. :
/usr/local/drweb > ./drweb-smf.sh start
/usr/libexec/ld-elf.so.1: Undefined symbol "__stdoutp"
    referenced from COPY relocation in /usr/local/drweb/drweb-smf
 ?

:  drweb-smf.static,      
. 

24) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:  Dr.Web Sendmail,     .   :
===
Daemon is installed, active interfaces:  127.0.0.1:3000
Unknown command received: 13!
===
(asv: ,    russian.dwl)
===
 ,  :  127.0.0.1:3000
  : 13
===
 ?

:     #19,      .

25) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:  FreeBSD.     (RejectCondition)  , 
    ?  ?

:  -,       KOI8-R. 
-,  ,    ( Subject:),   
 ,   8bit (..     , ..  
  =?koi8-r?B?..?=  =?cp1251?Q?..?=, ..   ), 
      .   (  8bit)   
   :
RejectCondition Subject = "8bit"
  ,  ,     ,   
   KOI8-R:

1.   /etc/login.conf  (   ):
#
# Russian Users Accounts. Setup proper environment variables.
#
russian:Russian Users Accounts:\
        :charset=KOI8-R:\
        :lang=ru_RU.KOI8-R:\
        :tc=default:

  /etc/login.conf.db:
# cap_mkdb /etc/login.conf

2.   drweb  ,      russian:
# pw usermod drweb -L russian

3.          "case "$1" in"

LC_ALL=ru_RU.KOI8-R
export LC_ALL

4.   ...

26) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:   http://www.testvirus.org     Dr.Web, 
 25  Dr.Web   .    ?

:      19  2004 , ..      , 
     :

Test #12: Eicar virus within a password protected ZIP file
Test #24: Test for the "Partial (Fragmented) Vulnerability". This does not include Eicar virus, 
          but your mail server still must block this since it can break a virus into multiple 
          emails and reassemble it in your inbox.

-   ,   SkipObject   pass  
  .

Test #14: Eicar virus sent in a Microsoft TNEF file (winmail.dat)

-  TNEF     .

Test #25: Attachment with a CLSID extension which may hide the real file extension. This does not 
          include Eicar virus, but your mail server still must block this since it can hide the 
          true extension of a file

-     .

Test #16: Eicar string in HTML, to ensure that your mail server scans HTML segments
Test #19: Eicar virus within zip file hidden using the "Blank Folding Vulnerability"
Test #21: Eicar virus within zip file hidden using the "Long MIME Boundary Vulnerability"
Test #23: Eicar virus within zip file hidden using the "Empty MIME Boundary Vulnerability"

-          ,  ,   . 
,      #16  #21,         .

27) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:     4.29.2 ( 4.29.5)  ""  
- .  ?

:     (  ,         
"" ) -    4.29 (  drweb32.dll  4.29).  , 
        , ..     
  .    ,     #0.

28) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:   Dr.Web Daemon & Dr.Web Filter for Sendmail,    
   ,   /var/log/messages  :

Jun 10 13:24:04 host drweb-smf: Dr.Web (R) Filter for sendmail ver.4.32: Unable to bind to port 3000@localhost: Address already in use
Jun 10 13:24:04 host drweb-smf: Dr.Web (R) Filter for sendmail ver.4.32: Unable to create listening socket on conn 3000@localhost



Jun 10 13:24:04 host drweb-smf: Dr.Web (R) Filter for sendmail ver.4.32: Unable to bind to port local:/var/drweb/run/.daemon: Address already in use
Jun 10 13:24:04 host drweb-smf: Dr.Web (R) Filter for sendmail ver.4.32: Unable to create listening socket on conn local:/var/drweb/run/.daemon

:     MilterAddress  [Mailer]  drweb_smf.conf  
  ,         
sendmail,      sendmail.cf. ..   :
 drweb32.ini
Socket = 3000 localhost

 drweb_smf.conf:
[DaemonCommunication]
Address = inet:3000@localhost
...
[Mailer]
...
MilterAddress = inet:3001@localhost

  sendmail.cf:
Xdrweb-filter,  S=inet:3001@localhost, F=T, T=C:1m;S:5m;R:5m;E:1h

29) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:     Dr.Web   ,      
,  -      :
The filter cannot connect to the DrWEB daemon
      ?

:   ,     .
)          .
) ,  -    .
     .     (   ).
i)       .  :
drweb32.ini:
Socket = /var/drweb/run/.drwebd
Socket = 3000 localhost

drweb_{mta}.conf:  ({mta} = smf, cgp, postfix, exim, qmail, zmailer, courier or mio)
[DaemonCommunication]
Address = local:/var/drweb/run/.drwebd, inet:3000@localhost

     :        (  ), 
      .

ii)       -    
(    ,    ),        
 . 
drweb_{mta}.conf:  ({mta} = smf, cgp, postfix, exim, qmail, zmailer, courier or mio)
[DaemonCommunication]
Address = local:/var/drweb/run/.drwebd, inet:3000@another.myhost.example.com

:    (LocalScan = yes)       
           .

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
:   <asv@drweb.com>

$Revision: 1.6 $ 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
