![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
|||||
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
|
![]() |
Avast Antivirus
How do I install
Currently the Windows and Linux procedures are slightly different:
On Windows (implemented as scanning libraries loaded directly by SurgeMail):
- Click install on the common settings page
- Wait until installed and updated to latest version (check status on settings page or advanced status page)
- Enable SurgeMail integration by ticking the checkbox "Enable Avast integration", press save.
- Confirm that it is scanning mail and blocking viruses (by sending in eicar.com as an attachment, or using one of the online virus testing pages: eg. declude.com)
On Linux (implemented as av_avast vpipe scanner that interfaces to the Avast libraries):
- Download the Avast linux distribution, uncompress and run ./install.sh from the temp directory
- Check that you have avast running (and have the library prerequisites) by running "./av_avast -test" in the SurgeMail directory
- Enable surgemail integration by adding to surgemail.ini
- g_virus_filter cmd="av_avast" type=""
note: if using admin interface you would set "Filter command line" to "av_avast"
- g_virus_avast "true"
and optionally
- g_virus_avast_hour "0,6,12,18"- Restart surgemail
- Confirm that it is scanning mail and blocking viruses (by sending in eicar.com as an attachment, or using one of the online virus testing pages: eg. declude.com)
Scanning Engine Updates on Linux
On windows the scanning engine is automatically updated with the virus database. On linux this must be done manually periodically. If you are getting errors in the log files along the lines of "vpipe failures 25 in a row av_avast" and / or "Avast initialisation failed, avworkInitialize returned 42000" then you must upgrade the avast engine as described here.
- Download the updated Avast linux distribution (ftp://netwinsite.com/pub/surgemail/util/avast4surgemail_linux_engine470.tar.gz).
- Install the distribution by running the ./install.sh script and answering yes to all questions.
Here is a detailed example of this test and upgrade process.
Note: If the avast engine on linux continues to crash for you make sure you are runnig the 4.7 version of the scannign engine and not the 4.6 version.
To test which version of the scanning engine you are running against on linux, list the following file in your default libraries location:
eg: running against 4.7.0 version of scanning engine:
[root@linux surgemail]# ls -l /usr/lib/libavastengine.so
lrwxrwxrwx 1 root root 25 Jan 10 11:22 /usr/lib/libavastengine.so -> libavastengine-4.so.7.0.0
What do the displayed statistics mean?
AVAST antivirus blocked 956 of 11723 messages (max concurrent=limited to 1)
Scanned message size: av=8.5kb peak=3.1mb scantime: av=0.0s peak=3.1s
av_avast version: 1.0
Avast engine version: unknown
Avast virus database version: 416-1 (15.04.2004)
Last update run 0.8 hrs ago SUCCESS(with upgrade)
Avast scanner uptime 2 days 00:06:42
Messages stored as: failed=0 slow=0 (see http://netwinsite.com/surgemail/help/avast.htm)
Authent module resets 0
Vpipe scanner restarts 0
Viruses blocked: g_virus_cmd=0 g_virus_fprot=0 g_vpipe=956A bunch of statistics are displayed on the behaviour of Avast antivirus. The most important information displayed is the number of messages processed and blocked because they were classified as unwanted (infected, unmonitorable etc). eg: above "blocked 956 of 11723 messages"
In addition you should check that the database is getting regularly updated. The current virus database version is displayed "416-1 (15.04.2004)" and the last time this was updated with the result of the update. The result of the update can be:
- SUCCESS(with upgrade) - A new virus database update was found and was successfully installed
- SUCCESS(no upgrade) - A new virus database update was not found
- FAILED(reason) - The upgrade failed and the reason is displayed. Check log files
- In Progress - The upgrade is currently in progress
- (none since startup) - No updates have been run since startup
- (disabled) - Automatic updates are only run by surgemail if g_virus_avast "true" is set. In addition the frequency can be modified with g_virus_avast_hour.
Further information is available on the performance of your Avast virus scanner. This includes average and peak scan time and message size, the uptime of this vpipe instance of the running scanner. If any problems have been encountered scanning messages these are stored as surgemail/avast/avast_failure_n.msg and avast_slow_n.msg. If you are getting vpipe scanner restarts or any messages stored as failed or many messages stored as slow this should discussed with surgemail-support@netwinsite.com.
Avast status warning: n MESSAGES FAILED TO BE SCANNED AND BLOCKED
If you receive this warning on the advanced status page this means that you are running Avast antivirus and an error condition has been encountered that prevented the message from being scanned. The message will have been bounced and stored as avast_failureNN.msg for analysis.
You should first check that you do not have another realtime filesystem level virus scanner installed (such as Norton Antivirus). If you do, you need to prevent the avast temp directory ("_avast4_") from getting scanned. You will find this somewhere in a Windows temp folder like c:\windows\TEMP\_avast4_.
If you have checked the above and continue to receive this error, please report this to surgemail-support@netwinsite.com such that appropriate action can be taken (ie Netwin will report the problem to Alwil software).
Log files
Av_avast logs all information to av_avast.log file. This is a log file that allows different log levels and control of what is logged to this file. To change the av_avast logging behaviour change the av_avast.ini settings. The default av_avast.ini file has an explanation and an example of all configuration settings.
The avast.log and avast.stat are the log files used (for a similar purpose but less control over what was logged) by the version of Avast integrated with SurgeMail on windows.
Notes
Avast is a third party product developed and maintained by ALWIL Software, and is based on ALWIL antivirus technology. We endeavour to resolve any issues in short order by working closely with ALWIL Software but the maintenance of the virus database and actual scanning technology is not under NetWin control and as such NetWin does provide any guarantees on the ability for Avast Antivirus to catch all viruses.
Previously Avast was only available on Windows. Now Avast is available on Windows and Linux. The Linux version is implemented as a vpipe filter. The Windows version was previously run by loading all the Avast dlls into the SurgeMail process.