Re: [FW1] Any Trendmicro Viruswall users here?

[Joerg Oertel <Joerg.Oertel@FW1-NOSPAMpallas.com>]

Guys,

let me explain our problem. We're using Trendmicro's 
Interscan Viruswall CVP Server. It's running in conjunction with 
CheckPoint's FW-1 v4.1 SP2 on the same machine, a Sun Enterprise 
Server 250 with 2 CPUs and 512 MB of RAM and Solaris 2.6. We're 
using the CVP version of Viruswall.

Our experiments are done with a second Viruswall installation on a 
server different from the firewall machine. This is also a 
multiprocessor sparc computer (e450, 4 CPUs, lots of memory) running 
solaris 2.6. The behaviour of both setups is the same.

Since about the time we upgraded from FW-1 V 4.0 SP5 to Checkpoint 
2000 (a.k.a. FW-1 V 4.1 SP1) and the following installation of SP2, 
we're experiencing corrupted files after the virus scanning.

The most reproduceable case is a HTTP download, where, if a file gets 
corrupted once, it will never go through undamaged. We found out, that 
the original download from the server to the interscan host is 
complete:
iscvpAAPmfdq6h	11292480
This is the original filesize (11292138 bytes) plus the HTTP header 
(342 bytes).
The file after the scan is also complete:
iscvpBAPnfdq6h	11292138
but now the HTTP header is missing. We believe that this is intended.
While the download is proceeding, the second file disappears from the 
directory. This leads us to the conclusion, that not the scanned file, 
but the original file is sent back to the firewall after the scanning 
is complete.

However, the file arrives corrupted. I've made 6 test runs and the 
results are 11273578, 11272938, 11273322, 11273450, 11273322 and 
11273450 bytes.

Something similar happens to attached .xls and .doc files, though I 
wasn't able to reproduce that. I'm still waiting for a damaged file 
along with the undamaged original to do further investigations. 


Has anybody similar problems?

Kind regards,

Jörg

>Date: Mon, 13 Nov 2000 11:59:50 +0100
>From: "Volker Tanger" <Volker.Tanger@globalone.net>
>X-Accept-Language: de,en-GB,en,en-US
>To: Joerg Oertel <Joerg.Oertel@pallas.com>
>CC: fw-1-mailinglist@lists.us.checkpoint.com
>Subject: Re: [FW1] Any Trendmicro Viruswall users here?
>Content-Transfer-Encoding: 7bit
>
>
>Greetings!
>
>Joerg Oertel wrote:
>
>> we're still having massive problems with Trendmicro's Interscan
>> Viruswall CVP software. Are there any users of this software in 
this
>> group to share experiences and know-how?
>
>What's the problem?
>
>Bye
>    Volker
>
>--
>
>Volker Tanger  <volker.tanger@globalone.net>
>--------------------------------------------
>Sr. Security Engineer  Tel. +49-69-92901-570
>--------------------------------------------
>Global One
>  Global Security
>    Global Service Engineering
>
>
>
>
>=====================================================================
===========
>     To unsubscribe from this mailing list, please see the 
instructions at
>               http://www.checkpoint.com/services/mailing.html
>=====================================================================
===========

// pallas  GmbH  ............  Joerg Oertel  ...........
   Hermuelheimer Str. 10       System engineer                   
   D-50321 Bruehl, Germany     Joerg.Oertel@pallas.com           
                               phone  +49-(0)2232-1896-0 
   http://www.pallas.de        fax   +49-(0)2232-1896-29
........................................................



================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================