Another KAV Email question

Forum for support for the Kaspersky AntiVirus for WinGate plugin

Moderator: Qbik Staff

Another KAV Email question

Postby rgnet5 » May 26 08 1:05 pm

OK, I have seen this posted in here before, but cannot find the right answer to fix my issue: I am evaluating WinGate as a possible replacement for WinProxy, so far I have found that no matter what I do, the Kaspersky AV plug-in does not scan POP3 email. I have configured the POP3 proxy to use the transparent proxy intercept via ENS. I have made sure that the AV plug-in is enabled. But it does not seem to scan email. I see no Kaspersky AV headers in any of the email headers, and when I send myself a test EICAR virus email, it goes right through. The EICAR test via the web browser works fine, and the Kaspersky AV catches it right away. Scanning emails for viruses is a very important feature for me. If I cannot get this to work, I probably won't buy the product. Thank you very much.
rgnet5
 
Posts: 2
Joined: May 26 08 1:00 pm

Re: Another KAV Email question

Postby Nev » May 27 08 12:55 pm

Hi,

What I do is to purely proxy all email and filtering is ok.

Try setting the client to access the remote pop account like this:

Username: user@mail.isp.com#mailserver.isp.com
Server: wingate [or IP if Wingate's internal NIC eg: 192.168.0.1 or localhost if tried directly on the server itself // 127.0.0.1]

Disable the Intercept for NAT.

Try to attach the test file in an email.
--
Nev.
Nev
WinGate Guru
 
Posts: 858
Joined: Sep 22 03 11:35 pm
Location: Mudgee ~ NSW ~ Australia

Re: Another KAV Email question

Postby rgnet5 » May 28 08 2:45 pm

Thank you for the info, but that didn't work either. I am giving up my evaluation of this product. This is not working and I have already spent 4 days on this. I'll look at Wingate again after the next major release.

Thanks again.
rgnet5
 
Posts: 2
Joined: May 26 08 1:00 pm

Re: Another KAV Email question

Postby Nev » May 28 08 7:53 pm

Hi, probably not the case but the plugin is enabled in the POP3 proxy and or refreshed.
--
Nev.
Nev
WinGate Guru
 
Posts: 858
Joined: Sep 22 03 11:35 pm
Location: Mudgee ~ NSW ~ Australia

Re: Another KAV Email question

Postby alyork » Jul 15 08 3:53 am

Yikes - I hope that POP3 email is being scanned.

We've already converted a number of Winproxy clients over to Wingate.

I checked that the Kaspersky plugin is checked on in the POP3.Proxy.Sever Service and looked at the POP3 logs and saw lots of incoming activity logged.

What is missing or I don't know where to look is for some kind of hit counter showing how many times Kaspersky has scanned POP3 email and how many virus or spyware hits is being detected.

The Kaspersky logs are less than helpful.

Unfortunately, we are running on faith that the emails are being protected.

- Al
alyork
 
Posts: 95
Joined: Jun 13 08 3:57 pm
Location: Vancouver, Canada

Re: Another KAV Email question

Postby Nev » Jul 16 08 4:10 pm

Hi,

What I have done is to send a test email // file to the scanning plugin such as the Eicar test file.

There is a few sites which provide this service and they should hit a quarantine in KAV for Wingate.
--
Nev.
Nev
WinGate Guru
 
Posts: 858
Joined: Sep 22 03 11:35 pm
Location: Mudgee ~ NSW ~ Australia

Re: Another KAV Email question

Postby alyork » Aug 03 08 4:07 pm

I was hoping for an easier way to tell if Kaspersky is working. Like some kind of statistics from Kaspersky or Wingate.

Or am I dreaming again?
alyork
 
Posts: 95
Joined: Jun 13 08 3:57 pm
Location: Vancouver, Canada

Re: Another KAV Email question

Postby adrien » Aug 09 08 1:38 pm

Hi

The current version of KAV for WinGate doesn't stamp the messages as having been scanned.

POP3 scanning always has difficulties, due to the fact that POP3 (protocol) was not designed for it.

What it currently does, is send X-Scanning headers every 20s whilst the message is being downloaded and scanned. If you are downloading any large emails from slow POP3 servers, you'd see these in the email message headers. This is to stop POP3 clients from timing out.

The recommended way to deal with POP3 is actually to get WinGate to download the POP3 mail, and make it available in a local mailbox. This doesn't suit everyone however.

Regards

Adrien de Croy
adrien
Qbik Staff
 
Posts: 5215
Joined: Sep 03 03 2:54 pm
Location: Auckland

Re: Another KAV Email question

Postby adrien » Aug 09 08 2:00 pm

one other potential gotcha with the plugins (KAV and PureSight). The users tab (in the plugin itself) If you don't have the user selected for scanning, then that could be a problem.
adrien
Qbik Staff
 
Posts: 5215
Joined: Sep 03 03 2:54 pm
Location: Auckland


Return to Kaspersky AntiVirus for WinGate

Who is online

Users browsing this forum: No registered users and 1 guest