Product: All

Version & Build: All

 

 

 

Background:

 

Vircom has identified an issue whereby quarantined messages are being labeled as “Possible Virus”.  This only affects Modus installations running the McAfee anti-virus solution.

 

There are two possible reasons for this:

 

1. Messages were caught by Vircom scripts which are run after virus scanning
2. The McAfee engine scanning timed out while scanning the messages

 

 

Modus sets a 10-second maximum time limit for virus scanning.  In most cases, virus scanning can be accomplished within 10 seconds.  However, decompression bomb viruses take much more time.  Decompression bombs are designed to create DoS attacks on the given scanner.  The consumed disk space or memory could be so high that the server could fail.

 

If a message has not been fully scanned within 10 seconds, the message is labeled as “Possible Virus”.  If the Modus server is experiencing a heavy load or if a decompression bomb is being scanned, scanning may require more than 10 seconds to complete and, because of this, messages may be incorrectly identified as “Possible Virus”.

 

 

 

Solution:

 

Increase the scanning time-out in the Registry.

 

• On your Modus server, open the Registry Editor
• Go to HKEY_LOCAL_MACHINE\SOFTWARE\Vircom\VopMail and double-click on the DWORD key value McAfeeMaxBombScanTime
• Change the default setting of 10 seconds to a higher value (15-20 seconds)