  	Cover Letter for vFastScan V3.1  N *** PLEASE READ THIS COVER LETTER BEFORE UPGRADING OR INSTALLING VFASTSCAN ***   OpenVMS Versions  4 This version of the vFastScan virus sweeper runs on:  8 OpenVMS Alpha Version 7.2-1 or later (tested on V7.3-2).) OpenVMS VAX 7.2 or later (tested on V7.2) / OpenVMS IA64 8.2-1 (tested on OpenVMS IA64 8.3)   N vFastScan normally requires a license PAK before it can be used.  If you don'tC have such a key, you can obtain a free evaluation key by contacting    	fastscan@eurokom.ie  J If you don't have a license key, you can still run vFastScan in LITE mode,E which offers most of the performance benefits of the symbiont without H requiring the purchase of a license (it does, however, require that  youB have a valid PMDF or PMDF-MTA license loaded).  The limitations of vFastScan Lite are:   I * vFastScan Lite does not include the use of the dedicated virus scanning :   channel (only the use of conversion scripts is allowed).  I * vFastScan Lite limits you to no more than 1 symbiont queue per cluster.   O Note that the full version of vFastScan requires a standard OpenVMS LMF license H PAK.  It does *not* use the same LICENSE.TXT file used by version 2.x ofO vFastScan .  If you are upgrading from an earlier version, it is very important L that you obtain and load a VFASTSCAN license PAK (not relevent for vFastScan Lite).  = You can upgrade vFastScan from 2.x or 3.0 to 3.1 in one step.   O Note that V3.x evaluation licenses cannot be used on 2.x versions of vFastScan.   H This archive should only be UNZIPped on the OpenVMS platform.  UnzippingD the file on a different platform and transferring the saveset is notG supported.  However, if this is impractical, the following should work:   = * transfer the savesets (.A etc) files to VMS in BINARY mode. 5 * change the attributes of the file using the command   : 	$ Set File FASTSCAN030.% /attribute=(mrs:32256,lrl:32256)  
 Documentation   E The text version of the documentation is included in this ZIP archive L (FASTSCAN.TXT).  The kit itself contains PostScript & HTML versions as well.K If you want to extract these before installing the kit, issue the following  command:  3 	$ BACKUP FASTSCAN031.A/SAVE/SELECT=(*.PS,*.HTML) *    Web Site & Queries  B The customer area for vFastScan is http://www.eurokom.ie/vfastscan3 Queries should be addressed to fastscan@eurokom.ie.      Support   E Support for licensed vFastScan customers under current maintenance is I provided by EuroKom, or your local distributer.  EuroKom can be contacted  at:    Email:	help.desk@eurokom.ie  Phone:	+353-1-296-9696  I Office hours are 08:00 to 18:00 WET (note Western European Time, which is ( 5 hours ahead of Eastern Standard Time).  : Support for vFastScan Lite is via the PMDF discussion list info-pmdf@process.com     	Release Notes for FastScan V3.1   Features added to V3.0  0 * Provision of vFastScan Lite license free mode.  ? --------------------------------------------------------------- ! New features as of vFastScan V3.0    Optional Virus Scanning Channel   E Increased performance can be obtained by using a custom written virus G scanning channel provided with this version of vFastScan.  This channel K is more efficient that the conversion channel, as it does not need to spawn F a subprocess for each attachment that is scanned.  It also offers someM features that are not possible with the conversion channel, such as modifying H the message's Subject header, inserting additional headers, and scanning4 for viruses in incorrectly demarcated MIME segments.  K Detected viruses can be replaced by warning files, or the infected messages  may be discarded.   F Approximate measurements of performance showed the elapsed time of theL customized channel in scanning 20 messages with one attachment each was halfE that of using vFastScan within the conversion channel (vFastScan with K conversion showed anything from 5-15 times smaller elapsed times than using  VSWEEP with conversion).  H The SCAN command, and use of vFastScan within conversion continues to beF supported, and there are no plans to phase this out, as the conversionJ channel offers scope for far greater levels of customization of attachment processing.    Content Filtering.  I This channel also supports the replacement of certain files (allowing the J removing of .VBS & .PIF files etc) by warning texts, depending on the file name or MIME type/subtype.     Scanning for MIME 'Blobs'   C A MIME 'Blob' is a chunk of BASE64 encoded data that appears within H a text bodypart due to incorrect boundary headers.  Such badly formattedJ messages are often generated by viruses (e.g. Magister & Sober).  ScanningB for viruses via the conversion channel does not always catch theseF viruses, as PMDF will decompose the message using MIME boundaries, andI the Sophos MIME option will not always detect such Blobs when they appear F in the middle of text bodyparts.  The vFastScan's own scanning programE has an option to look for such Blobs in a bodypart, and scan them for G viruses.  This catches many instances of viruses not detected by normal E conversion channel scanning.  Although the risk of infection is small E (depending on the mail client, it may or may not correctly detect the C Blob as an attachment), there have been reports of such Blobs being 8 detected by desktop scanners after passing through PMDF.  & Support for OpenVMS VAX & OpenVMS IA64  B vFastScan is supported on OpenVMS VAX 7.2, OpenVMS Alpha 7.3-1 and? OpenVMS IA64 8.2-1. The installation procedure will install the I appropriate images for the current architecture, and offers the option of L installing images for the other architecture as well.  Use in a heterogenous cluster is supported.   ) OpenVMS License Management Facility (LMF)   D Previous versions of vFastScan used a LICENSE.TXT file placed in theH FASTSCAN_DIR directory to authorize activation of the product. V3.0 doesL *NOT* use this method, but uses standard LMF PAKs.  YOU MUST ENSURE THAT YOUN HAVE A VALID LMF PAK BEFORE UPGRADING.  Failure to do this will leave you withC an upgraded system that will not run.  Replacement LMF PAKs will be K distributed free of charge to sites whose current licenses are still valid. G If you have not received one, please contact EuroKom or your authorized  distributer or reseller.   Logging Facility  F vFastScan symbionts now generate log files (separate log file for eachL queue). The log files contain informational messages (e.g. version of SophosF and no of IDE files, when queues are started or stopped etc) and errorI messages which can be useful when diagnosing problems.  The documentation C contains a section with detailed descriptions of each message type.    Option Files  K vFastScan V3.0 has many options, which can be enabled or disabled depending L on the site policy.  There are two level of option files, a per-queue optionJ file, and a default option file.  Options in the former type only apply to: a specific queue, and override options in the latter type.   Detection of IDE files  K vFastScan symbionts prior to V3.0 required to be restarted any time new IDE H files were added.  V3.0 provides the option whereby in exchange for someK extra overhead, the symbiont can automatically reload the IDE and VDL files L when changes to the IDE files are detected.  Note that vFastScan queues mustH still be restarted when Sophos VSWEEP is upgraded (in particular, if theG LIBSAVI_VAX/LIBSAVI_AXP/LIBSAVI_I64  shareable images are replaced, the H queues must be restarted, as the symbionts have activated these images).  / Counters of Files Scanned and Viruses Detected.   L vFastScan V3.0 provides an option whereby each queue stores in shared memoryM the total number of files it has scanned, and viruses it has detected.  These B counters may be accessed through the API or by a supplied utility.  ( Enhanced Handling of Sophos Error Codes.  I Prior to V3.0, any errors returned by the SAVI API are passed back to the J SCAN program as a ESAVI__SAVAPIERR status code, with the actual error codeF returned in the VIRUS_NAME symbol.  Most files that generate SAVAPIERRL return codes will generate similar error messages when processed by a VSWEEPH command.  V3.0 has the option of detecting Out-of-Memory and Out-of-DiskL return codes, and can attempt a SAVI reload followed by a retry of the scan.4 The exact behavior is controlled by the option file.  5 Ability to Enable or Disable Sophos Scanning Options.   L Prior to V3.0, vFastScan enabled all SAVI options except those that were notM relevent (e.g. disinfect options) or those that Sophos explicitly recommended M against enabling.  V3.0 allows you to modify which scanning options are used. L Note that only scanning options are supported - vFastScan does not disinfect infected files.   # Application Program Interface (API)   F vFastScan V3.0 provides a programmer interface (API) for the following operations:  	- scan a file for viruses 	- obtain scanning statistics   H The documentation describes the interface specification, and a shareable) image and linker option file is provided.   - Documentation of Sophos VSWEEP_MAIN_VDATA_DIR   K With the October 2003 release of Sophos VSWEEP, Sophos provided support for G this logical, which points at the directory containing the VDL*.* virus D definition files.  Use of this logical obviates the need to copy theI VDL*.* files to SYS$COMMON:[SYSEXE] (without the logical the VDL*.* files I must reside in the same directory as the image that calls the SAVI; since H symbionts must reside in SYS$SYSTEM the data files had to be there too).I Although use of this logical is fully supported with existing versions of G vFastScan, it was not included in the documentation (apart from notices M on the web site).  A description of this logical (and its recommended use) is + now included in the standard documentation.    Minor Version changes    3.0-4	2006-04-13= 	Fixed a bug in the LMF routines which would fail to detect a ) 	PMDF (as opposed to a PMDF-MTA) license. ( 3.0-5	Improved BLOB searching algorithm.K 3.0-6	Truncate any file names in MIME headers to 128 characters, preserving B 	the file type where possible (fixed a problem with pathologicallyC 	long file names from causing the PMDF mapping probe to crash out).   H 3.0-7	Fixed a bug in the encoding of Quoted-Printable binary attachments5 	(can happen with XML or HTML files with long lines). A 	Fixed a bug in the error message output, which could ACCVIO when 8 	trying to report an unexpected error from the PMDF API.@ 	Fixed a bug whereby an extra blank subject line was inserted ifA 	a virus was found, and there was no modified subject template in  	the channel option file.   K 3.0-8	Fixed a bug which would result in incorrect encoding in the following 
 	scenario: 	- text bodypart 	- Base64 encodingD 	- another bodypart which is replaced by the channel (content filter 	or virus warning text).  H 3.0-9   Added %Y, %M, %D directives to Archive flags in channel program.B 	Updated documentation for above, and corrected faulty examples in 	KOM_REPLACE_FILE mapping.= 	SAVISMB now sends an OPCOM message if it exits unexpectedly.   < 3.0-10	Change to internal undocumented routine (EUROKOM/MIN)