Virus scanners page bug for ESETSEFS scanner

[gregecslo]

Hi.
Installed efa V5 and when I go to: "Search and reports" --> Virus report (mailscanner/rep_viruses.php)
ESETSEFS is not displayed correctly, in fact it does not work at all.

Solution:

Add:

case 'esetsefs':
            $scanner[$vscanner]['name'] = 'ESET';
            $scanner[$vscanner]['regexp'] = "/found (?P<virus>\S+) in (?P<file>\S+)/";
            break;

to mailscanner/rep_viruses.php

Result after:

Can this be fixed in next mailwatch?

Thanks!

[endelwar]

Hi @gregecslo,
this is a misalignment between functions.php and rep_viruses.php ths have to be fixed.

Can you confirm that the regex in functions.php is correct? It actually is:

/Esets: found (?P<virus>\S+) in (?P<file>\S+)/

While looking for this issue I've found other antivirus engines that are not aligned between functions.php and rep_viruses.php:

--- functions.txt
+++ rep_viruses.txt
@@ -5,19 +5,13 @@
 clamav
 clamavmodule
 clamd
-esets
-esetsefs
 etrust
 f-prot
-f-prot-6
-f-protd-6
 f-secure
-f-secure-12
 kaspersky-4.5
 mcafee
 mcafee6
 nod32-1.99
-none
 norman
 sophos
 sophossavi

And some other supported by MailScanner but not by MailWatch (some are legacy engines that we should keep):

--- functions.txt
+++ mailscanner_virus_scanners_conf.txt
@@ -1,24 +1,19 @@
-antivir
 avast
+avastd
 avg
 bitdefender
 clamav
 clamavmodule
 clamd
+drweb
 esets
 esetsefs
-etrust
-f-prot
-f-prot-6
-f-protd-6
 f-secure
 f-secure-12
-kaspersky-4.5
-mcafee
-mcafee6
-nod32-1.99
+f-secured
+generic
+kaspersky
+kse
 none
-norman
 sophos
 sophossavi
-trend

[gregecslo]

Hi, my regex works 100% I cannot say if one in functions works ok .. Regards,Gregor

…

________________________________ From: Manuel Dalla Lana ***@***.***> Sent: Tuesday, September 10, 2024 16:38 To: mailwatch/MailWatch Cc: Grega; Mention Subject: Re: [mailwatch/MailWatch] Virus scanners page bug for ESETSEFS scanner (Issue #1308) Hi @gregecslo<https://github.com/gregecslo>, this is a misalignment between functions.php and rep_viruses.php ths have to be fixed. Can you confirm that the regex in functions.php is correct? It actually is: /Esets: found (?P<virus>\S+) in (?P<file>\S+)/ While looking for this issue I've found other antivirus engines that are not aligned between functions.php and rep_viruses.php:

--- functions.txt +++ rep_viruses.txt @@ -5,19 +5,13 @@ clamav clamavmodule clamd -esets -esetsefs etrust f-prot -f-prot-6 -f-protd-6 f-secure -f-secure-12 kaspersky-4.5 mcafee mcafee6 nod32-1.99 -none norman sophos sophossavi And some other supported by MailScanner but not by MailWatch (some are legacy engines that we should keep):

--- functions.txt +++ mailscanner_virus_scanners_conf.txt @@ -1,24 +1,19 @@ -antivir avast +avastd avg bitdefender clamav clamavmodule clamd +drweb esets esetsefs -etrust -f-prot -f-prot-6 -f-protd-6 f-secure f-secure-12 -kaspersky-4.5 -mcafee -mcafee6 -nod32-1.99 +f-secured +generic +kaspersky +kse none -norman sophos sophossavi -trend — Reply to this email directly, view it on GitHub<#1308 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BDPHP3BR7VHNIUHFHZH6PLLZV376BAVCNFSM6AAAAABN5776BGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDGNBRGA2DCMRVG4>. You are receiving this because you were mentioned.Message ID: <mailwatch/MailWatch/issues/1308 ***@***.***> [ { ***@***.***": "http://schema.org", ***@***.***": "EmailMessage", "potentialAction": { ***@***.***": "ViewAction", "target": "#1308 (comment)", "url": "#1308 (comment)", "name": "View Issue" }, "description": "View this Issue on GitHub", "publisher": { ***@***.***": "Organization", "name": "GitHub", "url": "https://github.com" } } ]

[endelwar]

What's the output of esetsefs cli command (it should be /opt/eset/efs/bin/odscan) when scanning a virus file?

[gregecslo]

This is what I have in mail log:
Sep 9 19:06:09 efa MailScanner[1543823]: Esets::INFECTED::PowerShell/TrojanDownloader.Agent.JFW
Sep 9 19:06:09 efa MailScanner[1543823]: Viruses marked as silent: Esets: found PowerShell/TrojanDownloader.Agent.JFW in rfq_last_quater_product_purchase_order_import_list_09_09_2024_00000024.7z

Sou your regex is also OK.