<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Na also:<div class=""><br class=""></div><div class=""><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Menlo; color: rgb(102, 255, 102); background-color: rgba(25, 25, 25, 0.8);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">554 5.7.1 sophos: virus found: "EICAR-AV-Test"</span></div></div><div class=""><br class=""><div class=""><br class="webkit-block-placeholder"></div><div class=""><br class=""></div><div class="">Also vielen Dank an alle!</div><div class=""><br class=""></div><div class="">Das sollte vl. mal dokumentiert werden, ich schreibe den <span style="caret-color: rgb(79, 85, 89);" class="">Vsevolod Stakhov m</span><span style="caret-color: rgb(79, 85, 89); font-size: 13px;" class="">al an.</span></div><div class=""><br class=""></div><div class=""><br class="webkit-block-placeholder"></div><div class="">
<div dir="auto" style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Viele Grüße!<br class="">Frank</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">-- <br class="">Frank Fiene</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">IT-Security Manager VEKA Group</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class="">Fon: +49 2526 29-6200<br class="">Fax: +49 2526 29-16-6200<br class="">mailto: <a href="mailto:ffiene@veka.com" class="">ffiene@veka.com</a><br class=""><a href="http://www.veka.com" class="">http://www.veka.com</a><br class=""><br class=""></div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">PGP-ID: 62112A51<br class="">PGP-Fingerprint: 7E12 D61B 40F0 212D 5A55 765D 2A3B B29B 6211 2A51</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Threema: VZK5NDWW<br class=""><br class="">VEKA AG<br class="">Dieselstr. 8<br class="">48324 Sendenhorst<br class="">Deutschland/Germany<br class=""><br class="">Vorstand/Executive Board: Andreas Hartleif (Vorsitzender/CEO),<br class="">Dr. Andreas W. Hillebrand, Bonifatius Eichwald, Elke Hartleif, Dr. Werner Schuler,<br class="">Vorsitzender des Aufsichtsrates/Chairman of Supervisory Board: Ulrich Weimer<br class="">HRB 8282 AG Münster/District Court of Münster</div></div></div></div></div></div></div></div>
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">Am 04.12.2018 um 19:22 schrieb Frank Fiene <<a href="mailto:ffiene@veka.com" class="">ffiene@veka.com</a>>:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Ich meinte natürlich SSSP. <div class=""><br class=""></div><div class="">Ich habe mal die Requests mitgelogt.</div><div class=""><br class=""></div><div class=""><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Menlo; color: rgb(102, 255, 102); background-color: rgba(25, 25, 25, 0.8);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">181204:192035 [5C06A00C] 00038402 New session</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Menlo; color: rgb(102, 255, 102); background-color: rgba(25, 25, 25, 0.8);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">181204:192035 [5C06A00C/1] 00030406 Client request</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Menlo; color: rgb(102, 255, 102); background-color: rgba(25, 25, 25, 0.8);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> SSSP/1.0</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Menlo; color: rgb(102, 255, 102); background-color: rgba(25, 25, 25, 0.8);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">181204:192035 [5C06A00C/2] 00030406 Client request</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Menlo; color: rgb(102, 255, 102); background-color: rgba(25, 25, 25, 0.8);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> SCANDATA 9585</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Menlo; color: rgb(102, 255, 102); background-color: rgba(25, 25, 25, 0.8);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">181204:192035 [5C06A00C/3] 00030406 Client request</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Menlo; color: rgb(102, 255, 102); background-color: rgba(25, 25, 25, 0.8);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> BYE</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Menlo; color: rgb(102, 255, 102); background-color: rgba(25, 25, 25, 0.8);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">181204:192035 [5C06A00C] 00038403 Session ended</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Menlo; color: rgb(102, 255, 102); background-color: rgba(25, 25, 25, 0.8);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">181204:192035 [5C06A00C] 00038401 Connection ended</span></div><div class=""><br class="webkit-block-placeholder"></div><div class=""><br class="webkit-block-placeholder"></div><div class="">Das sieht doch eigentlich gut aus, oder?</div><div class=""><br class=""></div><div class="">Muss nochmal den EICAR durchjagen.</div><div class=""><br class=""></div><div class=""><br class="webkit-block-placeholder"></div><div class="">
<div dir="auto" style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Viele Grüße!<br class="">Frank</div><div style="font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">-- <br class="">Frank Fiene</div><div style="font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">IT-Security Manager VEKA Group</div><div style="font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class="">Fon: +49 2526 29-6200<br class="">Fax: +49 2526 29-16-6200<br class="">mailto: <a href="mailto:ffiene@veka.com" class="">ffiene@veka.com</a><br class=""><a href="http://www.veka.com/" class="">http://www.veka.com</a><br class=""><br class=""></div><div style="font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">PGP-ID: 62112A51<br class="">PGP-Fingerprint: 7E12 D61B 40F0 212D 5A55 765D 2A3B B29B 6211 2A51</div><div style="font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Threema: VZK5NDWW<br class=""><br class="">VEKA AG<br class="">Dieselstr. 8<br class="">48324 Sendenhorst<br class="">Deutschland/Germany<br class=""><br class="">Vorstand/Executive Board: Andreas Hartleif (Vorsitzender/CEO),<br class="">Dr. Andreas W. Hillebrand, Bonifatius Eichwald, Elke Hartleif, Dr. Werner Schuler,<br class="">Vorsitzender des Aufsichtsrates/Chairman of Supervisory Board: Ulrich Weimer<br class="">HRB 8282 AG Münster/District Court of Münster</div></div></div></div></div></div></div></div>
</div>
<div class=""><br class=""><blockquote type="cite" class=""><div class="">Am 04.12.2018 um 17:52 schrieb Frank Fiene <<a href="mailto:ffiene@veka.com" class="">ffiene@veka.com</a>>:</div><br class="Apple-interchange-newline"><div class=""><div class="">Ja, ich habe auch gerade das Scanner Protocol auf SSCP umgestellt.<br class=""><br class="">Ich habe bei rspamd nicht gefunden, ob Sophie oder SSCP benutzt wird.<br class=""><br class="">-- <br class="">Frank Fiene<br class="">IT-Security Manager VEKA Group<br class=""><br class="">Fon: +49 2526 29-6200<br class="">Fax: +49 2526 29-16-6200<br class="">mailto: <a href="mailto:ffiene@veka.com" class="">ffiene@veka.com</a><br class=""><a href="http://www.veka.com/" class="">http://www.veka.com</a><br class=""><br class="">PGP-ID: 62112A51<br class="">PGP-Fingerprint: 7E12 D61B 40F0 212D 5A55 765D 2A3B B29B 6211 2A51<br class=""><br class="">VEKA AG<br class="">Dieselstr. 8<br class="">48324 Sendenhorst<br class="">Deutschland/Germany<br class=""><br class="">Vorstand/Executive Board: Andreas Hartleif (Vorsitzender/CEO),<br class="">Dr. Andreas W. Hillebrand, Bonifatius Eichwald, Elke Hartleif, Dr. Werner Schuler,<br class="">Vorsitzender des Aufsichtsrates/Chairman of Supervisory Board: Ulrich Weimer<br class="">HRB 8282 AG Münster/District Court of Münster<br class=""><br class=""><blockquote type="cite" class="">Am 04.12.2018 um 16:17 schrieb Michael Wuttke <<a href="mailto:mwuttke@beuth-hochschule.de" class="">mwuttke@beuth-hochschule.de</a>>:<br class=""><br class="">Hallo,<br class=""><br class="">noch mal als Nachtrag, da es Nachfragen gab:<br class=""><br class="">Wir haben bei uns das SSSP-Protokoll von Sophos in Amavis auf dem Port<br class="">4010 eingebunden. Daher haben wir den unten genannten Schaltet für den<br class="">channel for SSSP konfiguriert.<br class=""><br class="">Und da dieser Schalter für SAVDI bislang undokumentiert ist, bitte<br class="">einfach den unten stehenden contextstr-Schnipsel im scanner-Block vom IP<br class="">channel for SSSP hinzufügen.<br class=""><br class="">Danke & Gruß,<br class="">Michael Wuttke<br class=""><br class=""><blockquote type="cite" class="">Am 04.12.18 um 10:19 schrieb Michael Wuttke:<br class="">Hallo,<br class=""><br class="">sehr hilfreich ist noch in der SAVDI Konfigurationsdatei savdid.conf<br class="">folgende Einstellung hinzuzufügen, die zum einen aus der<br class="">DFN-Mail-AK-Liste stammt und mir aber auch von einem Enterprise Account<br class="">Executive von sophos bestätigt wurde:<br class=""><br class="">/ /<br class="">/CXMail is our context based detection/<br class="">/ /<br class=""><br class="">/This particular detection is fired on Microsoft office<br class="">attachments(often compressed) that have macros inside. These macros<br class="">work as a file dropper/downloader and access the internet to download<br class="">a malware payload. The URL's accessed by these attachments change on a<br class="">regular basis and will automatically switch to a new one if the<br class="">existing one is blocked. /<br class=""><br class="">scanner {<br class=""><br class="">...<br class=""> contextstr: Genes/Extn/ProdVer OEM:Email:1.0.0<br class="">...<br class="">}<br class=""><br class="">Die Erkennungsrate von Macro-Viren ist bei uns seit dem deutlich nach<br class="">oben gegangen. ;-)<br class=""><br class="">Danke & Gruß,<br class="">Michael<br class=""><br class=""><blockquote type="cite" class="">Am 04.12.18 um 08:32 schrieb Frank Fiene:<br class="">Moin,<br class=""><br class="">Ich habe ein paar Fragen, ich möchte gerne einen zusätzlichen Virenscanner testen neben Clamav und da ist mir Sophos in dein Sinn gekommen.<br class="">Grund ist, dass immer mehr Viren durchkommen, die weder Clamav noch Trendmicro (im Backend) erkennen, selbst ältere.<br class=""><br class=""><br class="">1.) Was benötige ich alles, auf den Gateways läuft Postfix und amavisd-new?<br class=""><br class="">2.) Installiere ich den Sophos Virenscanner auf einer eigenen Maschine oder auf jedem Gateway?<br class=""><br class="">3.) Gibt es Testversionen ohne Einschränkungen?<br class=""><br class="">4.) Was kostet das, wenn sagen wir mal 10.000 Mails pro Tag gescannt werden müssen, also durch die anderen Abwehrmaßnahmen durchgekommen sind?<br class=""><br class=""><br class=""><br class="">Viele Grüße!<br class="">Frank<br class=""><br class=""></blockquote><br class=""></blockquote><br class=""></blockquote><br class=""></div></div></blockquote></div><br class=""></div></div></div></blockquote></div><br class=""></div></body></html>