In my opinion two scanners is a must. For yesterday here is some stats for the virus scanners we use. While both caught almost the same amount of viruses Mcafee caught 5 that F-Prot did not. That very well could have been your Exploit-MIME.gen.c .
Virus Scanner Summary Report (Mcafee) Total Messages Processed: 61,398 Virus Infected Messages: 1,101 Percentage Infected: 1.79% Virus Scanner Summary Report (F-Prot) Total Messages Processed: 61,398 Virus Infected Messages: 1,096 Percentage Infected: 1.79% Darrell ------------------------------------------- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. ----- Original Message ----- From: "Mario Antonio" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Saturday, December 18, 2004 11:53 AM Subject: Re: [Declude.Virus] Exploit-MIME.gen.c > Kami, > > Thanks for your reply. > I am just using F-prot as the engine scanner for Declude. > I have been postponing to add a second scanner (afraid of performance > issues). It seems that it is time for me to think of it seriously. > > Regards > > Mario Antonio > > > > ----- Original Message ----- > From: "Kami Razvan" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Saturday, December 18, 2004 11:31 AM > Subject: RE: [Declude.Virus] Exploit-MIME.gen.c > > > > Mario: > > > > What virus software are you using? > > Are you using only one scanner? > > > > If you are using only one scanner I highly recommend you add another > > scanner. I have seen F-Prot for example not catch a virus and ClamAV > does. > > We use AVG, F-Prot, ClamAV, and McAfee- but we don't have a heavy traffic > on > > our server and can afford the CPU usage by 4 scanners. I think a lot of > > people use at least 2 or 3 scanners together. > > > > Regards, > > Kami > > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of Mario Antonio > > Sent: Saturday, December 18, 2004 10:23 AM > > To: [EMAIL PROTECTED] > > Subject: [Declude.Virus] Exploit-MIME.gen.c > > > > Dear List, > > > > One of our customers got the following message from a external Mail-gate > > anti-virus system: > > "Virus Scanner found the Exploit-MIME.gen.c (Malicious Mobile Code) > virus" > > > > It seems as if this virus was not caught by our Declude Virus system. > > > > Do you know if this type of virus forges the From address? > > > > Regards > > Mario Antonio > > > > > > --- > > [This e-mail was scanned for viruses by Webjogger's AntiVirus Protection > > System] > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.Virus mailing list. To unsubscribe, > just > > send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus". The archives can be found > > at http://www.mail-archive.com. > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.Virus mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus". The archives can be found > > at http://www.mail-archive.com. > > --- > > [This e-mail was scanned for viruses by Webjogger's AntiVirus Protection > System] > > > > > > --- > [This e-mail was scanned for viruses by Webjogger's AntiVirus Protection System] > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
