Len Conrad wrote:
We've been running f-prot on Imail/Windows. No problems, no users
reporting email viruses.
But the content-scanning on Imail has been really bogging the box down.
So we set up an amavis/spamassassin/ClamAV content-scanning box in front
of the Imail box, with the intention of turning off f-prot/win in favor
of clam/fbsd.
1. Internet
2. MX box (multiple)
3. amavis/spamassassin/clamav box (multiple)
4. Imail box (multiple)
When we saw spamassassin and ClamAV showing tagged spam and blocked
viruses in the maillog, we turned off f-prot on the Imail box.
A few hours later, we started getting complaints about users' desktop AV
detecting email viruses where they have never reported them to us under
f-prot. We're trying to get the details of those msgs and what viruses
they had. The f-prot-good vs clamav-bad difference was clear and
quick. But we're sure where the problem is. We have assumed clam is a
good as f-prot.
We've turned f-prot back on, to see what f-prot detects that gets past
clam.
Assuming we've made some mistake in configuring clamav (rather than clam
not detecting viruses that Norton desktop detects) or some other screw
up, any suggestions?
Len
Your description is missing important information in my opinion: what is
the name of virus detected by Norton desktop or F-prot which ClamAV does
not detect in this case ?
Did you check it with online multi-AV WWW page (like Jotti or
http://www.virustotal.com) and send sample for investigation at
http://www.clamav.net/sendvirus.html
Regards
Boguslaw
_______________________________________________
http://lurker.clamav.net/list/clamav-users.html
