MBF Knowledge Base

How to bypass vulnerability scanning in Declude

A vulnerability is a method that people can use to bypass virus scanning. Declude EVA will catch all vulnerabilities as if they were viruses. At times, a good message will be caught. There are a few ways to allow vulnerabilities to be sent/received through your server. If a message is caught by Declude's vulnerability scanning, you will see a line such as the following in the header of the message and your Declude log (if in DEBUG mode):

Declude Virus v4.12.11 caught the [Outlook 'CR' Vulnerability] virus in [No attachment]

There are 3 ways to resolve this.

Option 1:

Open your virus.cfg file which is located in your Declude directory. Find the following line and remove the # from in front of it: #ALLOWVULNERABILITY       OLCR

This will allow all messages with this vulnerability to come through for all users on your server.

Option 2:

Open your virus.cfg file and find the following example line:

#ALLOWVULNERABILITIESTO                       webmaster-vir@declude.com

Under that line, add the following line:

ALLOWVULNERABILITIESTO                          youruser@domain.com

This will allow all messages with any vulnerability to come through when sent to youruser@domain.com.

Option 3:

Open your virus.cfg file and find the following example line:

#ALLOWVULNERABILITIESFROM                       webmaster-vir@declude.com

 Under that line, add the following line:

ALLOWVULNERABILITIESFROM                          sender@domain.com

This will allow all messages with any vulnerability to come through when sent from sender@domain.com.

To release caught vulnerabilities, go to your \Spool\Virus directory. Copy the file pair and drop them in \Spool for delivery.