########################################################################### # The configuration file for Sophos Antivirus Plugin for CommuniGate Pro. # Originator page: # # Mail your suggestions and bug reports to ########################################################################### # What to do with the infected mesages. # Possible values: Reject, Discard, AddHeader # Note: Discard and AddHeader modes require CommnuniGate Pro 4.0.6 or later. Mode = Reject; # The location of the "Submitted" directory, absolute or relative to the Base directory. # For Unix, e.g. "/var/CommuniGate/Submitted" # For Windows, e.g. "C:\\CommuniGate Files\\Submitted" SubmittedDirectory = "Submitted"; # The post-processing application which is launched when an infection # found. In the command line arguments the ^1 is replaced with the # infected message file name from Queue directory and ^2 is replaced with # the name of the first virus found in the message. The application must not # print or cause the OS to print to stderr, and all stdout output should # start with '*' character. If you can't guarantee that, redirect all stdout # and stderr output to somewhere as shown in the example. # e.g. PostProcess="perl myScript.pl ^1 ^2 1>>log.txt 2>>log.txt"; PostProcess=""; # What to do when it detects an internal problem in the scanning Engine # Possible values: # Ignore - try to ignore the problem and continue # Exit - quit but try to complete the messages being scanned # Quit - quit immediately. OnProblem=Quit; # The maximum number of simultaneous scanning processes. # min: 1, max: 20 # You may want to decrease this value if the plugin is using too much CPU, # and increase if you have a multi-processor machine. # Note that the number of simultaneously scanned messages is also limited by the # number of Enqueuer processes in CommuniGatePro settings in SETTINGS->Queue page. MaxScanningThreads=5; # The maximum time it can scan a message # min: 120 sec, max: 1200 sec. MaxScanningTime=1200; # The options for 'Reject' mode. # The infected message is bounced by the server, the sender is notified. RejectOptions = { NotifyRecipients=YES; }; # The options for 'Discard' mode. # The infected message is silently discarded, the sender is not notified. DiscardOptions = { NotifyRecipients=NO; }; # The options for 'AddHeader' mode. # The header is added to the infected message and it goes through. # Neither sender nor recipeints notified. AddHeaderOptions = { Header="X-Sophos-Antivirus: ALERT! ^1 is infected with ^2"; }; # The contents of a notificaiton message NotificationMessage = { Caption = "Virus(es) found.\e"; FileInfo = "^1 is infected with ^2\e"; Aborted = "... more than 10 infected files. Scanning aborted\e"; Summary = "Total infections: ^1\e"; Footer = "\eCaptured by Sophos antivirus plugin running on CommuniGate Pro (TM) mail server \e"; }; # The parameters of the recipients notification message # Note: the sender notificaiton message is mailed not by the plugin but # by the Server itself, so there's no parameters for it. NotifyRecipientsOptions = { From="MAILER-DAEMON"; Subject="Virus warning"; ExtraHeaders="X-Auto-Generated: Sophos antivirus plugin"; Description=( "", "A message which was sent to you was discarded by Sophos antivirus plugin", "running on CommuniGate Pro mail server ", "", "The details of what was detected and the original message header are below.", "For your protection, the original message has been destroyed.", "", ); SenderInfo="The sender is <^1> (may be faked)\e"; HeaderTitle="--- The message header follows: ---"; }; # The parameters of the daily report message DailyReport = { Enabled=YES; From="MAILER-DAEMON"; To="postmaster"; Subject="Sophos daily report for ^1"; ExtraHeaders="X-Auto-Generated: report"; ReportSources=YES; ReportSourcesMax=10000; ReportTargets=YES; ReportTargetsMax=10000; }; # The file name and the interval in seconds for saving the statistics into a file. # Value of 0 disables this feature. StatDumpInterval=10; StatDumpFile="statistics.dat"; # The parameters of the event report messages EventsReports = { From="MAILER-DAEMON"; To="postmaster"; ExtraHeaders="X-Auto-Generated: report"; Started = { Enabled=YES; Subject="Sophos plugin started on ^1"; }; Stopped = { Enabled=YES; Subject="Sophos plugin stopped on ^1"; }; # this report is sent when virus definition files are updated. DatsUpdated = { Enabled=YES; Subject="Sophos plugin virus definition files updated on ^1"; }; # this report is sent when a message is delayed for more than 10 minutes, maximum once per hour. LicenseLimitReached = { Enabled=YES; Subject="Sophos plugin License Limit reached on ^1"; }; ProblemOccured = { Enabled=YES; Subject="Sophos plugin problem detected on ^1"; }; }; EngineOptions = { # Enables scanning of databases saved in Microsoft Access format. Default=1 Access=1; # Enables the detection of macro viruses within MS Office documents saved in # ActiveMime document format. Default=1 #ActiveMimeHandling=1; # By default, errors in loading virus data are treated as fatal and scanning is not allowed. # Setting this option to 1 means such errors are treated as warnings, and scanning using a # partial virus data set is possible. Default=0 #AllowPartialVirusData=0; # Enables scanning of Macintosh files saved as a single file in situations where # support for Macintosh dual forks is not possible (e.g. MIME files). Default=1 #AppleSingle=1; # Enables decompression of Arj archives. Defalut=0 ArjDecompression=1; # Enables scanning inside ASPack self-extracting executable archives. Default=1 #ASPack=1; # Enables scanning of files encoded using the BASE64 scheme in situations where # this is not flagged by, for example, a MIME header line. Default=0 Base64=1; # Enable generic detection of malware based on Sophos Behavioural Genotype Detection. # Note - detection of malware will be significantly reduced if this option is # turned off. Default=1 #BehaviourMalware=1; # Enables decompression of BZip2 archives. Default=0 Bzip2=1; # Certain file formats (e.g. .bmp bitmap files) cannot contain viruses. These # options enable files of the corresponding types to be positively identified # and scanning of them to be stopped. This results in more efficient scanning # of these file types. Default=1 #CleanBmp=1; #CleanGif=1; #CleanJpeg=1; #CleanPng=1; #CleanRiff=1; #CleanTiff=1; #CleanMp3=1; #CleanMpeg=1; # Extends processing of multiple archive files which have been concatenated # together so that they are all processed, even if they are separated by some # junk data. NB can increase scan times slightly. Default=0 #ConcatenatedArchives=0; # Enables decompression of Cmz archives. Default=0 CmzDecompression=1; # Decompress the text part of a VBA5 project before scanning. This area is often # corrupted, but can help positive identification of some viruses. Default=1 #DecompressVBA5=1; # Controls the ability to scan inside supported types of dynamically compressed # executables. This type of files appear to be a normal executable. The main part # of the program is compressed and extracted into memory at run-time. Sophos # recommends this option should be turned on. Default=1 #DynamicDecompression=1; # Controls the module that interprets ELF binary files. This format is used for # many Linux and FreeBSD executable files. Default=1 #Elf=1; # Enables the 16-bit x86 emulation engine, which assists in the detection of # polymorphic executable file viruses. Sophos recommends this option should be # turned on. Default=1 #Emulation=1; # Enables scanning of Symbian format mobile device executables. Default=1 #Epoc=1; # Enables scanning of Excel formulas for known formula viruses. Formulas # occupy cells on the worksheet and should not be confused with macros. Default=1 #ExcelFormulaHandling=1; # Enables scanning inside FSG self-extracting executable archives. Default=1 #Fsg=1; # Enables a fallback mechanism that has been deployed in the past when new file # structures are encountered. Sophos recommends that you keep this option turned # off. Default=0 #FullMacroSweep=0; # Enables every part of a PDF file to be scanned, not just the embedded file # streams. This takes longer. Default=0 #FullPdf=0; # Enables full sweeping, which performs extensive fixed pattern matching as well # as the standard intelligent virus search. Turning this option may have # severe performance implications. Default=0 FullSweep=0; # Enables decompression of Gzipped files. Default=0 GZipDecompression=1; # Enables scanning of files embedded in Microsoft Help files. Default=1 HelpHandling=0; # Controls the ability to extract files in BinHex archives. Default=0 HqxDecompression=1; # Controls the module that optimises scanning in HTML files. Default=1 #Html=1; # Microsoft Office documents that contain executable macros will usually have # a single bit in the file header set to 1 to indicate the presence of executable # code. Under normal circumstances macros contained in a file that does not have # this bit set are not able to execute. If this option is turned off, the Virus # Engine will scan only files with this template bit set to 1. Sophos recommends # that you keep this option turned on. Default=1 #IgnoreTemplateBit=1; # Enables decompression of Cabinet files created using the InstallShield # compression format (e.g. _sys1.cab). Default=0 #ISCabinet=0; # Increases detection reliability in old format InstallShield files, but with # a slight performance overhead. Default=1 #ISCabinetFull=1; # Enables scanning of Microsoft Compressed Help files (.chm, .hxs). Default=0 #ITSS=0; # Enables scanning of Java class files. Default=1 #Java=1; # Enables decompression of Lha archives. Default=0 Lha=1; # Controls SAVI's ability to scan inside certain types of container file # (e.g. FAT container files or disk image files such as are found in CD boot # sectors or on OpenVMS). Default=0 #LoopBackEnabled=0; # Enables scanning of Mach-O executables (used on Mac OS X). Note that 'O' is the # letter, not a zero. Default=1 #MachO=1; # Controls the maximum number of times the engine will recurse into archives when # they are found (e.g. when a zip file is compressed within another zip file). # The maximum value is 100, but the engine internally has some extra levels of # recursion to cover internal data streams found within some file types.Default=16 #MaxRecursionDepth=16; # As per MaxRecursionDepth but applying to internal data streams. Default=25 #MaxIntRecDepth=25; # Controls the ability to look inside MacBinary archives. Default=0 MbinDecompression=1; # To enable scanning of email embedded inside another email rather than # anattachment. Default=1 #MimeEmbedded=1; # Maximum number of embedded file streams that can be extracted from a MIME # file. Default=25 #MimeEmbedLimit=25; # The maximum number of lines MIME source to scan looking for embedded objects # (inline BASE64). Default=500 #MimeEmbedLines=500; # Enables decompression of Microsoft Cabinet files (cab). (Partial files at the # beginning and end of multi-part cabinet files will not be fully scanned). # Default=0 MSCabinet=1; # Controls the ability to scan inside files compressed with the Microsoft # compression utility. Default=0 MSCompress=1; # Enable scanning of MS Installer files. This needs other options, such as MSCabinet, # to be set to be effective depending on the file content. Default=0 #Msi=0; # Controls handling of Macintosh (resource + data fork) files and archives (on # platforms where these are supported). Default=0 #NamespaceSupport=1; # Enables support for "OpenDocument" format, (generally consisting of XML within a # zip archive). This includes both StarOffice/OpenOffice and Microsoft OpenXML # formats (see Sdoc and Oxml options). Default=1; #Odoc=1; # Controls the ability of the engine to understand Microsoft Office 2001 files. # This version of Office was only released on the Macintosh platform. Default=1 #Office2001Handling=1; # Password-protected Office 95 documents are encrypted with a very simple # algorithm. Enabling this option causes the virus engine to break this # encryption to search for viruses.Default=1 #OF95DecryptHandling=1; # Enables scanning of files saved in HTML format from Microsoft Office. Default=1 #OleDataMsoHandling=1; # Enables scanning of other OLE types (e.g. messages saved in Microsoft Outlook). # Default=1 #OleRawHandling=1; # Enables scanning of Access macros. Default=1 #OleScriptHandling=1; # Enables the intelligent scanning of OLE2 (Microsoft Office) format documents. # Sophos recommends that this option should be turned on. Default=1 #Ole2Handling=1; # Enables detection and opening of Mac resource forks in all file types scanned. # Default=1 #OpenMacRf=1; # Enables scanning of file contained within Outlook Express mailboxes. Default=0 #OutlookExpress=0; # Enables canning of Microsof OpenXML documents (use in conjunction with Odoc option). # Default=1 #Oxml=1; # Enables the scanning of Palm Pilot format files (.prc). Default=1 #PalmPilotHandling=1; # Controls the PDF file interpretation module. Default=1 #Pdf=1; # Enables scanning inside PECompact self-extracting executable archives. # Default=1 #PECompact=1; # Enables the 32 bit executable emulator. This is required to support some # advanced virus detection modes in 32 bit executable files. Default=1 #PeEmulator=1; # Enables the intelligent scanning of Win32/PE format files. This is the standard # format for Windows executable binaries such as .exe and .dll. Default=1 #PEHandling=1; # Enables the scanning of files embedded within Microsoft PowerPoint # presentations. Default=1 #PowerPointEmbeddedHandling=1; # Enables the scanning of macros in PowerPoint presentations. Default=1 #PowerPointMacroHandling=1; # Enables the scanning of VBA macros in Microsoft Project. Default=1 #ProjectHandling=1; # Enables decompression of RAR archives. Default=0 RarDecompression=1; # Enables the scanning of distribution archives in RedHat Package Manager format. # NB: to scan .rpm files, set the GZipDecompression and UnixArchive options # as well. Default=0 Rpm=1; # Enables scanning for objects that may be embedded inside Rich Text Format # files. Default=1 #Rtf=1; # Enable scanning of VMS 'saveset' archives. Default=0 #Saveset=0; # Enables the handling of scrap objects that are used in the transfer of data # between certain applications. Default=1 #ScrapObjectHandling=1; # Enable scanning of StarOffice/OpenOffice documents (use in conjunction # with Odoc option). Default=1 #Sdoc=1; # Enables the virus engine to search in supported types of self-extracting # archive. Default=0 SfxArchives=1; # Enables canning of 'SIS' (Symbian Installation System) files as used on # some mobile devices. Default=1 #Sis=1 # Deals with another type of data within Office documents. Default=1 #SrpStreamHandling=1; # Enables decompression of Stuffit archives. Default=0 Stuffit=1; # Causes SAVI to report ...FORMAT_NOT_SUPPORTED if the Virus Engine encounters # data in a PDF file encoded with an unrecognised 'customfilter'. Default is to # scan the stream without decoding it. Default=0 #StrictPdf=0; # Causes SAVI to report ..CORRUPT if it encounters sections within a PDF file # which cannot be interpreted by the Virus Engine. Default=0 #StrongPdf=0; # Enables scanning inside Unix tar archives. Default=0 TarDecompression=1; # Enables decoding of files encoded with the Microsoft TNEF format, used by # some mail client applications. Default=0 TnefAttachmentHandling=1; # Enables scanning of TNEF files embedded within another mail file. The # Microsoft TNEF format is used by some mail client applications. Default=0 TnefEmbedHandling=1; # Enables scanning inside Unix archive types (ar, cpio). Default=0 UnixArchive=1; # Enables scanning inside UPX-compressed self-extracting executable archives. # Default=1 #Upx=1; # Enables scanning of web pages created using UTF16 (Unicode) character encoding. # Default=1 #UTF16=1; # Enables the virus engine to decode UUEncoded files. The UUEncode portion # must start within the first 4k of the document. Default=0 UueDecompression=1; # Enable the scanning of versions of Microsoft Visual Basic for Applications # embedded in supported file types, like Office and Visio documents. Default=1 #VBA3Handling=1; #VBA5Handling=1; # Enables detection of macros in p-code (compiled Visual Basic) as well as # in Visual Basic source code. Default=0 #Vba5p=0; # Enable scanning of files containing only VisualBasic for Applications # (e.g. PowerPoint PPAfiles). Default=0 #VbaOnly=0; # Enables scanning of Word document table streams. Default=1 #VbaTable=1 # Enables the scanning of encoded VBScript files. Default=1 #Vbe=1; # Enables canonicalisation of Visual Basic code. This increases the detection # efficiency of the other Visual Basic for Applications (VBA) plugins. Default=0 #VbFiltering=0; # Enables scanning files embedded inside Microsoft Visio files. Default=0 #VisioEmbedHandling=0; # Enables scanning of Microsoft Visio files. Default=1 #VisioFileHandling=1; # Enables scanning of WordBasic. Default=1 #WordB=1; # Enables scanning of files saved in XML format (e.g. by Microsoft Office 11). # Default=0 #Xml=0; # Enables detection of OpenDocument files (and subsequent processing) without # requiring the XML plugin (Xml option) to be enabled first. Default=1 XmlOdoc=1; # Enables scanning inside Zip archives. Default=0 ZipDecompression=1; # Improves reliability of scanning of Zip files created in a non-standard way # (local file directory invalid). Default=1 #ZipUseChd=1; }; #EngineOptions