Re: Newbie issues with Sylpheed-Claws Win 32.

On Sun, 20 Apr 2003 12:21:01 +0700 Brian Durant (BD) wrote:

[ ...]

> What I am unsure of is whether NAV 2003 still protects enough without
> scanning the e-mails as it does with other programs. I have no special
> knowledge about the security issues vis a vis e-mail, except for
> attachments. I don't know how vulnerable SC is using NAV 2003, so
> there is a big question mark hanging over my head. This would actually
> be relevant for inclusion in a new FAQ, where the issues are spelled
> out in plain English that an average user can understand.

AV Engine for Mail/message actually the same as AV Engine for file which
known since long time ago, the main different is for Mail we need to
'Open the Envelope' (decode) first before AV Engine can effectively scan
the content, the program to decode this commonly name 'glue program'.
After scanning, the glue program re-encode again in RFC-2822 format.
Commonly glue program will intercept while message in queue (for Mail
server) or in temp folder (for mailclient) hence this kind of program
said as Queue Base AV for MailServer.

Glue program for MUA actually doesn't need to do decode/encode process,
because MUA already have decode/encode engine, what he need to do is
scan the file after MUA decode it, iow when MUA store message to
harddisk.
Since around 2 years ago, new concept of AV engine comes up, namely
Socket Layer Base Anti Virus. This AV sniffing tcp port 25 and 110 and
do scanning the mail/message while still in memory using 'heuristic
analysis'. This AV only scan not disinfect the virus because, as
mentioned above, the message still enveloped by message format, to
disinfect he should do after the message decode by MUA. NAV200x is one
of example who used this kind of trick if you enable 'real time
scanner'.

As far as the message size is small (and pure plain text), there is no
problem with Real Time Scanner but if the size going large many time out
happened.
 
> I know that Sylpheed and SC has roots in Linux, but why concentrate
> on a command line scanner? What is wrong with getting SC to work with
> what most users are comfortable with - a GUI AV app?

As I and Thorsten said, if you insist to use NAV200x with sylpheed you
just need disable Real Time Scanner and let sylpheed decode the message
then NAV scanning when message store to harddisk. Or choose another GUI
AV such AVG, KAV, NOD32, FProt.


-- 
syafril
-------
Syafril Hermansyah<syafril-at-dutaint.co.id>


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf