2003 Svr, Domino 6.5.1, MS 0.99c, VET AV

Subject text OK

Body text is a combination of the body text from the previous RC entry and the correct body text.

With VET we have, among others, 4, 8 and 16. 16 is the most commonly occuring RC. I moved the position of 4 and 8 to prove the text was from the previous entry and not the number '8' entry.

————–

02-09-2004 08:36:14 AM: MailScan-Addin: Startup……

02-09-2004 08:36:14 AM: MailScan-Addin: OpenMailScan Version 0.99c, Copyright © 2004 Hans-Georg Franke

02-09-2004 08:36:14 AM: MailScan-Addin: OpenMailScan comes with ABSOLUTELY NO WARRANTY;

02-09-2004 08:36:14 AM: MailScan-Addin: This is free software, and you are welcome to redistribute it under certain conditions;

02-09-2004 08:36:14 AM: MailScan-Addin: For details see included file "license.txt"

02-09-2004 08:36:14 AM: MailScan-Addin: DebugLevel: 3

02-09-2004 08:36:17 AM: MailScan-Addin: Calling scanner with "c:\vet\vet32.exe"

02-09-2004 08:36:17 AM: MailScan-Addin: Calling with Param "/display=none/nobootscan [FULLFILENAME]"

02-09-2004 08:36:17 AM: MailScan-Addin: Working directory MailScan

02-09-2004 08:36:17 AM: MailScan-Addin: ReturnCode0: 0 - Text: ""

02-09-2004 08:36:17 AM: MailScan-Addin: Handling before0: 0

02-09-2004 08:36:17 AM: MailScan-Addin: Deleting file with rc0: 0

02-09-2004 08:36:17 AM: MailScan-Addin: Replacing text for rc0: Suspicous attachment removed:

02-09-2004 08:36:17 AM: MailScan-Addin: Send mail for rc0: noone@nowhere

02-09-2004 08:36:17 AM: MailScan-Addin: ReturnCode1: 1 - Text: " VIRUS SCAN FAILED "

02-09-2004 08:36:17 AM: MailScan-Addin: Handling before1: 1

02-09-2004 08:36:17 AM: MailScan-Addin: Deleting file with rc1: 0

02-09-2004 08:36:17 AM: MailScan-Addin: Replacing text for rc1: Suspicous attachment removed:

02-09-2004 08:36:17 AM: MailScan-Addin: Send mail for rc1: noone@nowhere

02-09-2004 08:36:17 AM: MailScan-Addin: ReturnCode2: 2 - Text: "VET WAS UNABLE TO ACCESS DISK OR FILE"

02-09-2004 08:36:17 AM: MailScan-Addin: Handling before2: 1

02-09-2004 08:36:17 AM: MailScan-Addin: Deleting file with rc2: 0

02-09-2004 08:36:17 AM: MailScan-Addin: Replacing text for rc2: Suspicous attachment removed:

02-09-2004 08:36:17 AM: MailScan-Addin: Send mail for rc2: noone@nowhere

02-09-2004 08:36:17 AM: MailScan-Addin: ReturnCode3: 3 - Text: " (VIRUS PRESENT CLEANED {3})"

02-09-2004 08:36:17 AM: MailScan-Addin: Handling before3: 0

02-09-2004 08:36:17 AM: MailScan-Addin: Deleting file with rc3: 0

02-09-2004 08:36:17 AM: MailScan-Addin: Replacing text for rc3: Suspicous attachment removed:

02-09-2004 08:36:17 AM: MailScan-Addin: Send mail for rc3: noone@nowhere

02-09-2004 08:36:17 AM: MailScan-Addin: ReturnCode4: 8 - Text: "VIRUS IN MEMORY - VET DISABLED - {8} "

02-09-2004 08:36:17 AM: MailScan-Addin: Handling before4: 0

02-09-2004 08:36:17 AM: MailScan-Addin: Deleting file with rc4: 2

02-09-2004 08:36:17 AM: MailScan-Addin: Replacing text for rc4: Attachments have been removed.

02-09-2004 08:36:17 AM: MailScan-Addin: Send mail for rc4: keithl@mcq.com.au

02-09-2004 08:36:17 AM: MailScan-Addin: ReturnCode5: 4 - Text: "(VIRUS PRESENT CLEANED {4})"

02-09-2004 08:36:17 AM: MailScan-Addin: Handling before5: 0

02-09-2004 08:36:17 AM: MailScan-Addin: Deleting file with rc5: 0

02-09-2004 08:36:17 AM: MailScan-Addin: Replacing text for rc5: Suspicous attachment removed:

02-09-2004 08:36:17 AM: MailScan-Addin: Send mail for rc5: noone@nowhere

02-09-2004 08:36:17 AM: MailScan-Addin: ReturnCode6: 16 - Text: "FILE CLEANED by VET {16} "

02-09-2004 08:36:17 AM: MailScan-Addin: Handling before6: 1

02-09-2004 08:36:17 AM: MailScan-Addin: Deleting file with rc6: 0

02-09-2004 08:36:17 AM: MailScan-Addin: Replacing text for rc6: Suspicous attachment removed:

02-09-2004 08:36:17 AM: MailScan-Addin: Send mail for rc6: noone@nowhere

02-09-2004 08:36:17 AM: MailScan-Addin: ReturnCode7: 32 - Text: "VIRUS IN HARD DISK BOOT SECTOR CLEANED {32} "

02-09-2004 08:36:17 AM: MailScan-Addin: Handling before7: 1

02-09-2004 08:36:17 AM: MailScan-Addin: Deleting file with rc7: 0

02-09-2004 08:36:17 AM: MailScan-Addin: Replacing text for rc7: Suspicous attachment removed:

02-09-2004 08:36:17 AM: MailScan-Addin: Send mail for rc7: noone@nowhere

02-09-2004 08:36:17 AM: MailScan-Addin: ReturnCode8: 64 - Text: "VIRUS FOUND {64} "

02-09-2004 08:36:17 AM: MailScan-Addin: Handling before8: 1

02-09-2004 08:36:17 AM: MailScan-Addin: Deleting file with rc8: 2

02-09-2004 08:36:17 AM: MailScan-Addin: Replacing text for rc8: VIRUS FOUND - Attachment removed VET: code 64

02-09-2004 08:36:17 AM: MailScan-Addin: Send mail for rc8: noone@nowhere

02-09-2004 08:36:17 AM: MailScan-Addin: Other Configuration Error: "(ERROR OCCURED scanning for viruses)"

02-09-2004 08:36:17 AM: MailScan-Addin: Initialization complete.

02-09-2004 08:36:17 AM: MailScan-Addin: Searching for Mailboxes.

02-09-2004 08:36:17 AM: MailScan-Addin: No Multiple Mailboxes.

02-09-2004 08:36:17 AM: MailScan-Addin: Startup Completed.

———————-

02-09-2004 10:51:18 AM: MailScan-Addin: Scanning Attachment

02-09-2004 10:51:18 AM: MailScan-Addin: Filename 454543403.zip



02-09-2004 10:51:18 AM: MailScan-Addin: Creating Directory d:\lotus\domino\data\MailScan\266982

02-09-2004 10:51:18 AM: MailScan-Addin: Cleaning directory d:\lotus\domino\data\MailScan\266982

02-09-2004 10:51:18 AM: MailScan-Addin: Extracting to d:\lotus\domino\data\MailScan\266982\454543403.zip

02-09-2004 10:51:18 AM: MailScan-Addin: Starting scanner with command:

02-09-2004 10:51:18 AM: MailScan-Addin: Extracting to d:\lotus\domino\data\MailScan\266982\454543403.zip

02-09-2004 10:51:18 AM: MailScan-Addin: Directory d:\lotus\domino\data\MailScan\266982

02-09-2004 10:51:20 AM: MailScan-Addin: Directory d:\lotus\domino\data\MailScan\266982

02-09-2004 10:51:20 AM: MailScan-Addin: Returncode of virusscanner: 16

02-09-2004 10:51:20 AM: MailScan-Addin: Directory d:\lotus\domino\data\MailScan\266982

02-09-2004 10:51:20 AM: MailScan-Addin: Processing returncode

02-09-2004 10:51:20 AM: MailScan-Addin: Start of processRC

02-09-2004 10:51:20 AM: MailScan-Addin: Processing Subject

02-09-2004 10:51:20 AM: MailScan-Addin: Manipulating Subject by adding FILE CLEANED by VET {16} for rc16 before=1

02-09-2004 10:51:20 AM: MailScan-Addin: Processing Body

02-09-2004 10:51:20 AM: MailScan-Addin: Directory d:\lotus\domino\data\MailScan\266982

02-09-2004 10:51:20 AM: MailScan-Addin: Getting next attachment

02-09-2004 10:51:20 AM: MailScan-Addin: Directory d:\lotus\domino\data\MailScan\266982

02-09-2004 10:51:20 AM: MailScan-Addin: Processing delete

02-09-2004 10:51:20 AM: MailScan-Addin: Start of processDelete

02-09-2004 10:51:20 AM: MailScan-Addin: Processing Bodies

02-09-2004 10:51:20 AM: MailScan-Addin: Calling EnumCompositeBuffer

02-09-2004 10:51:20 AM: MailScan-Addin: ProcessOneCDRecord

02-09-2004 10:51:20 AM: MailScan-Addin: Advancing pointer

02-09-2004 10:51:20 AM: MailScan-Addin: ProcessOneCDRecord

02-09-2004 10:51:20 AM: MailScan-Addin: Advancing pointer

02-09-2004 10:51:20 AM: MailScan-Addin: ProcessOneCDRecord

02-09-2004 10:51:20 AM: MailScan-Addin: Advancing pointer

02-09-2004 10:51:20 AM: MailScan-Addin: ProcessOneCDRecord

02-09-2004 10:51:20 AM: MailScan-Addin: Advancing pointer

02-09-2004 10:51:20 AM: MailScan-Addin: ProcessOneCDRecord

02-09-2004 10:51:20 AM: MailScan-Addin: Advancing pointer

02-09-2004 10:51:20 AM: MailScan-Addin: Calling EnumCompositeBuffer

02-09-2004 10:51:20 AM: MailScan-Addin: ProcessOneCDRecord

02-09-2004 10:51:20 AM: MailScan-Addin: Advancing pointer

02-09-2004 10:51:20 AM: MailScan-Addin: ProcessOneCDRecord

02-09-2004 10:51:20 AM: MailScan-Addin: Advancing pointer

02-09-2004 10:51:20 AM: MailScan-Addin: ProcessOneCDRecord

02-09-2004 10:51:20 AM: MailScan-Addin: Advancing pointer

02-09-2004 10:51:20 AM: MailScan-Addin: ProcessOneCDRecord

02-09-2004 10:51:20 AM: MailScan-Addin: SIG_CD_HOTSPOTBEGIN found

02-09-2004 10:51:20 AM: MailScan-Addin: HOTSPOTREC_TYPE_FILE found

02-09-2004 10:51:20 AM: MailScan-Addin: found length one: 13

02-09-2004 10:51:20 AM: MailScan-Addin: attachment filename: 454543403.zip

02-09-2004 10:51:20 AM: MailScan-Addin: found file - length two: 13

02-09-2004 10:51:20 AM: MailScan-Addin: original filename: 454543403.zip

02-09-2004 10:51:20 AM: MailScan-Addin: written text: Virus found in attachment was cleaned by VET: code 4 454543403.zip

02-09-2004 10:51:20 AM: MailScan-Addin: Advancing pointer

02-09-2004 10:51:20 AM: MailScan-Addin: ProcessOneCDRecord

02-09-2004 10:51:20 AM: MailScan-Addin: ProcessOneCDRecord

02-09-2004 10:51:20 AM: MailScan-Addin: ProcessOneCDRecord

02-09-2004 10:51:20 AM: MailScan-Addin: ProcessOneCDRecord

02-09-2004 10:51:20 AM: MailScan-Addin: ProcessOneCDRecord

02-09-2004 10:51:20 AM: MailScan-Addin: ProcessOneCDRecord

02-09-2004 10:51:20 AM: MailScan-Addin: ProcessOneCDRecord

02-09-2004 10:51:20 AM: MailScan-Addin: End of SIG_CD_HOTSPOT found

02-09-2004 10:51:20 AM: MailScan-Addin: ProcessOneCDRecord

02-09-2004 10:51:20 AM: MailScan-Addin: Advancing pointer

02-09-2004 10:51:20 AM: MailScan-Addin: Calling EnumCompositeBuffer

02-09-2004 10:51:20 AM: MailScan-Addin: ProcessOneCDRecord

02-09-2004 10:51:20 AM: MailScan-Addin: Advancing pointer

02-09-2004 10:51:20 AM: MailScan-Addin: ProcessOneCDRecord

02-09-2004 10:51:20 AM: MailScan-Addin: Advancing pointer

02-09-2004 10:51:20 AM: MailScan-Addin: ProcessOneCDRecord

02-09-2004 10:51:20 AM: MailScan-Addin: Advancing pointer

02-09-2004 10:51:20 AM: MailScan-Addin: Ready with body-items

02-09-2004 10:51:20 AM: MailScan-Addin: Deleting old Body-Items

02-09-2004 10:51:20 AM: MailScan-Addin: Appending new Body-Items

02-09-2004 10:51:20 AM: MailScan-Addin: Ready Appending new Body-Items

02-09-2004 10:51:20 AM: MailScan-Addin: Remove-filecode 1936286767

02-09-2004 10:51:20 AM: MailScan-Addin: Removing Attachment 454543403.zip from mail for returncode 16

02-09-2004 10:51:20 AM: MailScan-Addin: Directory d:\lotus\domino\data\MailScan\266982

02-09-2004 10:51:20 AM: MailScan-Addin: Attachments ready

02-09-2004 10:51:20 AM: MailScan-Addin: Removing directory d:\lotus\domino\data\MailScan\266982

02-09-2004 10:51:20 AM: MailScan-Addin: processNote ready

————

Remove file was not selected in either the previous or the correct instruction group (RC16) but the attachment is removed anyway (not really a bad thing).

The message ends up looking like this:



Subject: FILE CLEANED by VET {16} what's up?

Body: email text

Virus found in attachment was cleaned by VET: code 4 454543403.zip

VET found a virus and cleaned it. VET: code 16