Ahh... so the solution is to use Declude Junkmail instead of IMail's poor anti-spam. Then you could use the AVAFTERJM to work effectively with AV scanning.
Darin. ----- Original Message ----- From: "Brian Lin" <[EMAIL PROTECTED]> To: <[email protected]> Sent: Saturday, June 14, 2008 9:37 AM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG I have bought declude anti-virus, not declude anti-spam. ----- Original Message ----- From: "Darin Cox" <[EMAIL PROTECTED]> To: <[email protected]> Sent: Saturday, June 14, 2008 12:55 AM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > The reason for it not working is that the scanner doesn't recognize the > incorrect parameters, and aborts. > > We're not seeing the CPU spikes you are, however that may be a difference > with running AV over all messages vs. only on messages that spam > filtering. > > I'm curious... you say you don't have Declude, but you're subscribed to > the > Declude email discussion list, and you previously stated you had an > "antique > version declude and > imail"??? > > Darin. > > > ----- Original Message ----- > From: "Brian Lin" <[EMAIL PROTECTED]> > To: <[email protected]> > Sent: Friday, June 13, 2008 10:38 AM > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > > > I do not have declude anti-spam, imail already has > anti-spam function. > > Anyway, previous in F-prot 3.0 do not have such issue, > and now clamav also work perfectly over the same traffic, > only F-prot 6.0 has this issue, I have tried to reduce > maxonce to just 1, reduce scanlevel=1 /heurlevel=0, > all can not work. > Only when I add in noboot or nomem, the CPU immediate > get releaf, but this is not working, because with noboot or nomen. > the scanner simply not working at all. > > > ----- Original Message ----- > From: "Darin Cox" <[EMAIL PROTECTED]> > To: <[email protected]> > Sent: Friday, June 13, 2008 9:10 PM > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > > >> AVAFTERJM has been around a long time. I don't remember what version, >> but >> it was a 1.x version. >> >> Are you familiar with the setting? It tells Declude to run Anti-Virus >> after >> Junkmail. It then only runs AV after checking to see if the message is >> spam. With the spam load these days, I would expect that to be the >> desired >> config, resulting in AV scanning on only about 10% of incoming mail >> instead >> of 100%. However, it is not the default setting, which runs AV first, >> then >> Junkmail. >> >> That could easily account for yours and Kathy's 70-100% CPU. >> >> Darin. >> >> >> ----- Original Message ----- >> From: "Brian Lin" <[EMAIL PROTECTED]> >> To: <[email protected]> >> Sent: Friday, June 13, 2008 8:55 AM >> Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG >> >> >> No, I am still using antique version declude and >> imail. >> >> ----- Original Message ----- >> From: "Darin Cox" <[EMAIL PROTECTED]> >> To: <[email protected]> >> Sent: Friday, June 13, 2008 8:07 PM >> Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG >> >> >>> Interesting that you are also seeing the 70-100% CPU with F-Prot 6, >>> where >>> we >>> are not. >>> >>> Are you running AVAFTERJM? >>> >>> Darin. >>> >>> >>> ----- Original Message ----- >>> From: "Brian Lin" <[EMAIL PROTECTED]> >>> To: <[email protected]> >>> Sent: Friday, June 13, 2008 5:23 AM >>> Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG >>> >>> >>> I just terminate my F-Prot 6, and installed ClamAV SOSDG >>> >>> Before that, my CPU usage is always run to skyhigh, >>> at around 70%-100%, now using ClamAV, reduce >>> to 5%-20%, still catching all the testing virus. >>> >>> F-prot 6 do not provide option like noboot, nomem, >>> I guess these become the default setting, and cause >>> very high CPU and harddisk usage. >>> >>> Alex instruction dated at 6 June 2008 for ClamAV installation >>> is very helpful, thanks! >>> The main tricks in clamav are: >>> 1: need to install the contributors' tools, then get >>> two dedicated tools for declude, can run the >>> clamdscan as service. >>> >>> 2: need to remove --mbox, if this is there, it will >>> not function. >>> >>> Brian >>> >>> ----- Original Message ----- >>> From: "Brian Lin" <[EMAIL PROTECTED]> >>> To: <[email protected]> >>> Sent: Friday, June 13, 2008 10:02 AM >>> Subject: Re: [Declude.Virus] F-PROT 6 >>> >>> >>>>I think VIRUSCODE 1 need to be added too? >>>> http://www.f-prot.com/support/windows/fpwin_faq/310.html >>>> >>>> Anyway, using F-Prot 6 seems very slow compare with previous F-Prot 3, >>>> I do not know the exact reason. I have try to reduce scanlevel, >>>> heulevel, >>>> archive to 0 or 1, still very slow, I guess it is now scanning memory >>>> by >>>> default? >>>> >>>> Another question is , for REPORT=report.txt >>>> do we need < >? REPORT=<report.txt> >>>> >>>> from instruction here, looks like need < > >>>> http://www.f-prot.com/support/windows/fpwin_faq/445.html >>>> >>>> but most users online post seems < > is not necessary. >>>> >>>> >>>> >>>> ----- Original Message ----- >>>> From: "Darin Cox" <[EMAIL PROTECTED]> >>>> To: <[email protected]> >>>> Sent: Wednesday, June 04, 2008 2:34 AM >>>> Subject: Re: [Declude.Virus] F-PROT 6 >>>> >>>> >>>>> Assuming the default location for program installation, here you go. >>>>> >>>>> SCANFILE C:\PROGRA~1\FRISKS~1\F-PROT~1\fpscan.exe /VERBOSE=0 >>>>> /ARCHIVE=5 >>>>> /scanlevel=4 /heurlevel=3 /REPORT=report.txt >>>>> >>>>> /VERBOSE=0 corresponds to the old /SILENT switch >>>>> /TYPE is assumed now >>>>> /ARCHIVE has changed to /ARCHIVE=5 >>>>> /NOMEM, /NOBOOT, /DUMB, /AI, and /SERVER are defunct >>>>> /SCANLEVEL and /HEURLEVEL are new switches. The values above are >>>>> recommended >>>>> >>>>> See the FProt 6 manual for more info on conversion of switches, and >>>>> desired >>>>> settings >>>>> >>>>> Also, while the old >>>>> >>>>> VIRUSCODE 3 >>>>> VIRUSCODE 6 >>>>> VIRUSCODE 8 >>>>> >>>>> is most likely sufficient, we added >>>>> >>>>> VIRUSCODE 3 >>>>> VIRUSCODE 5 >>>>> VIRUSCODE 6 >>>>> VIRUSCODE 7 >>>>> VIRUSCODE 8 >>>>> VIRUSCODE 9 >>>>> VIRUSCODE 10 >>>>> VIRUSCODE 11 >>>>> VIRUSCODE 13 >>>>> VIRUSCODE 14 >>>>> VIRUSCODE 15 >>>>> VIRUSCODE 17 >>>>> VIRUSCODE 18 >>>>> VIRUSCODE 19 >>>>> VIRUSCODE 21 >>>>> VIRUSCODE 22 >>>>> VIRUSCODE 23 >>>>> VIRUSCODE 25 >>>>> VIRUSCODE 26 >>>>> VIRUSCODE 27 >>>>> VIRUSCODE 29 >>>>> VIRUSCODE 30 >>>>> VIRUSCODE 31 >>>>> VIRUSCODE 33 >>>>> VIRUSCODE 34 >>>>> VIRUSCODE 35 >>>>> VIRUSCODE 37 >>>>> VIRUSCODE 38 >>>>> VIRUSCODE 39 >>>>> VIRUSCODE 41 >>>>> VIRUSCODE 42 >>>>> VIRUSCODE 43 >>>>> VIRUSCODE 45 >>>>> VIRUSCODE 46 >>>>> VIRUSCODE 47 >>>>> VIRUSCODE 49 >>>>> VIRUSCODE 50 >>>>> VIRUSCODE 51 >>>>> VIRUSCODE 53 >>>>> VIRUSCODE 54 >>>>> VIRUSCODE 55 >>>>> VIRUSCODE 57 >>>>> VIRUSCODE 58 >>>>> VIRUSCODE 59 >>>>> VIRUSCODE 61 >>>>> VIRUSCODE 62 >>>>> VIRUSCODE 63 >>>>> >>>>> for completeness. >>>>> >>>>> Hope this helps, >>>>> >>>>> Darin. >>>>> >>>>> >>>>> ----- Original Message ----- >>>>> From: "David Barker" <[EMAIL PROTECTED]> >>>>> To: <[email protected]> >>>>> Sent: Tuesday, June 03, 2008 11:46 AM >>>>> Subject: [Declude.Virus] F-PROT 6 >>>>> >>>>> >>>>> Can anyone provide a SCANFILE line that they know works with F-PROT 6 >>>>> ? >>>>> >>>>> Thanks >>>>> David B >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> --- >>>>> This E-mail came from the Declude.Virus mailing list. To >>>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>>> type "unsubscribe Declude.Virus". The archives can be found >>>>> at http://www.mail-archive.com. >>>>> >>>>> >>>>> >>>>> >>>>> --- >>>>> This E-mail came from the Declude.Virus mailing list. To >>>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>>> type "unsubscribe Declude.Virus". The archives can be found >>>>> at http://www.mail-archive.com. >>>>> >>>>> >>>> >>>> >>>> >>>> --- >>>> This E-mail came from the Declude.Virus mailing list. To >>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>> type "unsubscribe Declude.Virus". The archives can be found >>>> at http://www.mail-archive.com. >>>> >>>> >>> >>> >>> --- >>> This E-mail came from the Declude.Virus mailing list. To >>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>> type "unsubscribe Declude.Virus". The archives can be found >>> at http://www.mail-archive.com. >>> >>> >>> >>> >>> --- >>> This E-mail came from the Declude.Virus mailing list. To >>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>> type "unsubscribe Declude.Virus". The archives can be found >>> at http://www.mail-archive.com. >>> >>> >> >> >> >> --- >> This E-mail came from the Declude.Virus mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.Virus". The archives can be found >> at http://www.mail-archive.com. >> >> >> >> >> --- >> This E-mail came from the Declude.Virus mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.Virus". The archives can be found >> at http://www.mail-archive.com. >> >> > > > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > > > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
