Thanks for advice.
I can not use declude junkmail, as I can remember, that is
a different package which i did not pay for.
in the other hand, the problem is solved by using ClamAV,
it works just great now.
----- Original Message -----
From: "Darin Cox" <[EMAIL PROTECTED]>
To: <declude.virus@declude.com>
Sent: Saturday, June 14, 2008 11:05 PM
Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
Ahh... so the solution is to use Declude Junkmail instead of IMail's poor
anti-spam. Then you could use the AVAFTERJM to work effectively with AV
scanning.
Darin.
----- Original Message -----
From: "Brian Lin" <[EMAIL PROTECTED]>
To: <declude.virus@declude.com>
Sent: Saturday, June 14, 2008 9:37 AM
Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
I have bought declude anti-virus, not declude anti-spam.
----- Original Message -----
From: "Darin Cox" <[EMAIL PROTECTED]>
To: <declude.virus@declude.com>
Sent: Saturday, June 14, 2008 12:55 AM
Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
The reason for it not working is that the scanner doesn't recognize the
incorrect parameters, and aborts.
We're not seeing the CPU spikes you are, however that may be a difference
with running AV over all messages vs. only on messages that spam
filtering.
I'm curious... you say you don't have Declude, but you're subscribed to
the
Declude email discussion list, and you previously stated you had an
"antique
version declude and
imail"???
Darin.
----- Original Message -----
From: "Brian Lin" <[EMAIL PROTECTED]>
To: <declude.virus@declude.com>
Sent: Friday, June 13, 2008 10:38 AM
Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
I do not have declude anti-spam, imail already has
anti-spam function.
Anyway, previous in F-prot 3.0 do not have such issue,
and now clamav also work perfectly over the same traffic,
only F-prot 6.0 has this issue, I have tried to reduce
maxonce to just 1, reduce scanlevel=1 /heurlevel=0,
all can not work.
Only when I add in noboot or nomem, the CPU immediate
get releaf, but this is not working, because with noboot or nomen.
the scanner simply not working at all.
----- Original Message -----
From: "Darin Cox" <[EMAIL PROTECTED]>
To: <declude.virus@declude.com>
Sent: Friday, June 13, 2008 9:10 PM
Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
AVAFTERJM has been around a long time. I don't remember what version,
but
it was a 1.x version.
Are you familiar with the setting? It tells Declude to run Anti-Virus
after
Junkmail. It then only runs AV after checking to see if the message is
spam. With the spam load these days, I would expect that to be the
desired
config, resulting in AV scanning on only about 10% of incoming mail
instead
of 100%. However, it is not the default setting, which runs AV first,
then
Junkmail.
That could easily account for yours and Kathy's 70-100% CPU.
Darin.
----- Original Message -----
From: "Brian Lin" <[EMAIL PROTECTED]>
To: <declude.virus@declude.com>
Sent: Friday, June 13, 2008 8:55 AM
Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
No, I am still using antique version declude and
imail.
----- Original Message -----
From: "Darin Cox" <[EMAIL PROTECTED]>
To: <declude.virus@declude.com>
Sent: Friday, June 13, 2008 8:07 PM
Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
Interesting that you are also seeing the 70-100% CPU with F-Prot 6,
where
we
are not.
Are you running AVAFTERJM?
Darin.
----- Original Message -----
From: "Brian Lin" <[EMAIL PROTECTED]>
To: <declude.virus@declude.com>
Sent: Friday, June 13, 2008 5:23 AM
Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
I just terminate my F-Prot 6, and installed ClamAV SOSDG
Before that, my CPU usage is always run to skyhigh,
at around 70%-100%, now using ClamAV, reduce
to 5%-20%, still catching all the testing virus.
F-prot 6 do not provide option like noboot, nomem,
I guess these become the default setting, and cause
very high CPU and harddisk usage.
Alex instruction dated at 6 June 2008 for ClamAV installation
is very helpful, thanks!
The main tricks in clamav are:
1: need to install the contributors' tools, then get
two dedicated tools for declude, can run the
clamdscan as service.
2: need to remove --mbox, if this is there, it will
not function.
Brian
----- Original Message -----
From: "Brian Lin" <[EMAIL PROTECTED]>
To: <declude.virus@declude.com>
Sent: Friday, June 13, 2008 10:02 AM
Subject: Re: [Declude.Virus] F-PROT 6
I think VIRUSCODE 1 need to be added too?
http://www.f-prot.com/support/windows/fpwin_faq/310.html
Anyway, using F-Prot 6 seems very slow compare with previous F-Prot 3,
I do not know the exact reason. I have try to reduce scanlevel,
heulevel,
archive to 0 or 1, still very slow, I guess it is now scanning memory
by
default?
Another question is , for REPORT=report.txt
do we need < >? REPORT=<report.txt>
from instruction here, looks like need < >
http://www.f-prot.com/support/windows/fpwin_faq/445.html
but most users online post seems < > is not necessary.
----- Original Message -----
From: "Darin Cox" <[EMAIL PROTECTED]>
To: <declude.virus@declude.com>
Sent: Wednesday, June 04, 2008 2:34 AM
Subject: Re: [Declude.Virus] F-PROT 6
Assuming the default location for program installation, here you go.
SCANFILE C:\PROGRA~1\FRISKS~1\F-PROT~1\fpscan.exe /VERBOSE=0
/ARCHIVE=5
/scanlevel=4 /heurlevel=3 /REPORT=report.txt
/VERBOSE=0 corresponds to the old /SILENT switch
/TYPE is assumed now
/ARCHIVE has changed to /ARCHIVE=5
/NOMEM, /NOBOOT, /DUMB, /AI, and /SERVER are defunct
/SCANLEVEL and /HEURLEVEL are new switches. The values above are
recommended
See the FProt 6 manual for more info on conversion of switches, and
desired
settings
Also, while the old
VIRUSCODE 3
VIRUSCODE 6
VIRUSCODE 8
is most likely sufficient, we added
VIRUSCODE 3
VIRUSCODE 5
VIRUSCODE 6
VIRUSCODE 7
VIRUSCODE 8
VIRUSCODE 9
VIRUSCODE 10
VIRUSCODE 11
VIRUSCODE 13
VIRUSCODE 14
VIRUSCODE 15
VIRUSCODE 17
VIRUSCODE 18
VIRUSCODE 19
VIRUSCODE 21
VIRUSCODE 22
VIRUSCODE 23
VIRUSCODE 25
VIRUSCODE 26
VIRUSCODE 27
VIRUSCODE 29
VIRUSCODE 30
VIRUSCODE 31
VIRUSCODE 33
VIRUSCODE 34
VIRUSCODE 35
VIRUSCODE 37
VIRUSCODE 38
VIRUSCODE 39
VIRUSCODE 41
VIRUSCODE 42
VIRUSCODE 43
VIRUSCODE 45
VIRUSCODE 46
VIRUSCODE 47
VIRUSCODE 49
VIRUSCODE 50
VIRUSCODE 51
VIRUSCODE 53
VIRUSCODE 54
VIRUSCODE 55
VIRUSCODE 57
VIRUSCODE 58
VIRUSCODE 59
VIRUSCODE 61
VIRUSCODE 62
VIRUSCODE 63
for completeness.
Hope this helps,
Darin.
----- Original Message -----
From: "David Barker" <[EMAIL PROTECTED]>
To: <declude.virus@declude.com>
Sent: Tuesday, June 03, 2008 11:46 AM
Subject: [Declude.Virus] F-PROT 6
Can anyone provide a SCANFILE line that they know works with F-PROT 6
?
Thanks
David B
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
