The reason for it not working is that the scanner doesn't recognize the incorrect parameters, and aborts.
We're not seeing the CPU spikes you are, however that may be a difference with running AV over all messages vs. only on messages that spam filtering. I'm curious... you say you don't have Declude, but you're subscribed to the Declude email discussion list, and you previously stated you had an "antique version declude and imail"??? Darin. ----- Original Message ----- From: "Brian Lin" <[EMAIL PROTECTED]> To: <declude.virus@declude.com> Sent: Friday, June 13, 2008 10:38 AM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG I do not have declude anti-spam, imail already has anti-spam function. Anyway, previous in F-prot 3.0 do not have such issue, and now clamav also work perfectly over the same traffic, only F-prot 6.0 has this issue, I have tried to reduce maxonce to just 1, reduce scanlevel=1 /heurlevel=0, all can not work. Only when I add in noboot or nomem, the CPU immediate get releaf, but this is not working, because with noboot or nomen. the scanner simply not working at all. ----- Original Message ----- From: "Darin Cox" <[EMAIL PROTECTED]> To: <declude.virus@declude.com> Sent: Friday, June 13, 2008 9:10 PM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > AVAFTERJM has been around a long time. I don't remember what version, but > it was a 1.x version. > > Are you familiar with the setting? It tells Declude to run Anti-Virus > after > Junkmail. It then only runs AV after checking to see if the message is > spam. With the spam load these days, I would expect that to be the > desired > config, resulting in AV scanning on only about 10% of incoming mail > instead > of 100%. However, it is not the default setting, which runs AV first, > then > Junkmail. > > That could easily account for yours and Kathy's 70-100% CPU. > > Darin. > > > ----- Original Message ----- > From: "Brian Lin" <[EMAIL PROTECTED]> > To: <declude.virus@declude.com> > Sent: Friday, June 13, 2008 8:55 AM > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > > > No, I am still using antique version declude and > imail. > > ----- Original Message ----- > From: "Darin Cox" <[EMAIL PROTECTED]> > To: <declude.virus@declude.com> > Sent: Friday, June 13, 2008 8:07 PM > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > > >> Interesting that you are also seeing the 70-100% CPU with F-Prot 6, where >> we >> are not. >> >> Are you running AVAFTERJM? >> >> Darin. >> >> >> ----- Original Message ----- >> From: "Brian Lin" <[EMAIL PROTECTED]> >> To: <declude.virus@declude.com> >> Sent: Friday, June 13, 2008 5:23 AM >> Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG >> >> >> I just terminate my F-Prot 6, and installed ClamAV SOSDG >> >> Before that, my CPU usage is always run to skyhigh, >> at around 70%-100%, now using ClamAV, reduce >> to 5%-20%, still catching all the testing virus. >> >> F-prot 6 do not provide option like noboot, nomem, >> I guess these become the default setting, and cause >> very high CPU and harddisk usage. >> >> Alex instruction dated at 6 June 2008 for ClamAV installation >> is very helpful, thanks! >> The main tricks in clamav are: >> 1: need to install the contributors' tools, then get >> two dedicated tools for declude, can run the >> clamdscan as service. >> >> 2: need to remove --mbox, if this is there, it will >> not function. >> >> Brian >> >> ----- Original Message ----- >> From: "Brian Lin" <[EMAIL PROTECTED]> >> To: <declude.virus@declude.com> >> Sent: Friday, June 13, 2008 10:02 AM >> Subject: Re: [Declude.Virus] F-PROT 6 >> >> >>>I think VIRUSCODE 1 need to be added too? >>> http://www.f-prot.com/support/windows/fpwin_faq/310.html >>> >>> Anyway, using F-Prot 6 seems very slow compare with previous F-Prot 3, >>> I do not know the exact reason. I have try to reduce scanlevel, >>> heulevel, >>> archive to 0 or 1, still very slow, I guess it is now scanning memory by >>> default? >>> >>> Another question is , for REPORT=report.txt >>> do we need < >? REPORT=<report.txt> >>> >>> from instruction here, looks like need < > >>> http://www.f-prot.com/support/windows/fpwin_faq/445.html >>> >>> but most users online post seems < > is not necessary. >>> >>> >>> >>> ----- Original Message ----- >>> From: "Darin Cox" <[EMAIL PROTECTED]> >>> To: <declude.virus@declude.com> >>> Sent: Wednesday, June 04, 2008 2:34 AM >>> Subject: Re: [Declude.Virus] F-PROT 6 >>> >>> >>>> Assuming the default location for program installation, here you go. >>>> >>>> SCANFILE C:\PROGRA~1\FRISKS~1\F-PROT~1\fpscan.exe /VERBOSE=0 /ARCHIVE=5 >>>> /scanlevel=4 /heurlevel=3 /REPORT=report.txt >>>> >>>> /VERBOSE=0 corresponds to the old /SILENT switch >>>> /TYPE is assumed now >>>> /ARCHIVE has changed to /ARCHIVE=5 >>>> /NOMEM, /NOBOOT, /DUMB, /AI, and /SERVER are defunct >>>> /SCANLEVEL and /HEURLEVEL are new switches. The values above are >>>> recommended >>>> >>>> See the FProt 6 manual for more info on conversion of switches, and >>>> desired >>>> settings >>>> >>>> Also, while the old >>>> >>>> VIRUSCODE 3 >>>> VIRUSCODE 6 >>>> VIRUSCODE 8 >>>> >>>> is most likely sufficient, we added >>>> >>>> VIRUSCODE 3 >>>> VIRUSCODE 5 >>>> VIRUSCODE 6 >>>> VIRUSCODE 7 >>>> VIRUSCODE 8 >>>> VIRUSCODE 9 >>>> VIRUSCODE 10 >>>> VIRUSCODE 11 >>>> VIRUSCODE 13 >>>> VIRUSCODE 14 >>>> VIRUSCODE 15 >>>> VIRUSCODE 17 >>>> VIRUSCODE 18 >>>> VIRUSCODE 19 >>>> VIRUSCODE 21 >>>> VIRUSCODE 22 >>>> VIRUSCODE 23 >>>> VIRUSCODE 25 >>>> VIRUSCODE 26 >>>> VIRUSCODE 27 >>>> VIRUSCODE 29 >>>> VIRUSCODE 30 >>>> VIRUSCODE 31 >>>> VIRUSCODE 33 >>>> VIRUSCODE 34 >>>> VIRUSCODE 35 >>>> VIRUSCODE 37 >>>> VIRUSCODE 38 >>>> VIRUSCODE 39 >>>> VIRUSCODE 41 >>>> VIRUSCODE 42 >>>> VIRUSCODE 43 >>>> VIRUSCODE 45 >>>> VIRUSCODE 46 >>>> VIRUSCODE 47 >>>> VIRUSCODE 49 >>>> VIRUSCODE 50 >>>> VIRUSCODE 51 >>>> VIRUSCODE 53 >>>> VIRUSCODE 54 >>>> VIRUSCODE 55 >>>> VIRUSCODE 57 >>>> VIRUSCODE 58 >>>> VIRUSCODE 59 >>>> VIRUSCODE 61 >>>> VIRUSCODE 62 >>>> VIRUSCODE 63 >>>> >>>> for completeness. >>>> >>>> Hope this helps, >>>> >>>> Darin. >>>> >>>> >>>> ----- Original Message ----- >>>> From: "David Barker" <[EMAIL PROTECTED]> >>>> To: <declude.virus@declude.com> >>>> Sent: Tuesday, June 03, 2008 11:46 AM >>>> Subject: [Declude.Virus] F-PROT 6 >>>> >>>> >>>> Can anyone provide a SCANFILE line that they know works with F-PROT 6 ? >>>> >>>> Thanks >>>> David B >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> --- >>>> This E-mail came from the Declude.Virus mailing list. To >>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>> type "unsubscribe Declude.Virus". The archives can be found >>>> at http://www.mail-archive.com. >>>> >>>> >>>> >>>> >>>> --- >>>> This E-mail came from the Declude.Virus mailing list. To >>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>> type "unsubscribe Declude.Virus". The archives can be found >>>> at http://www.mail-archive.com. >>>> >>>> >>> >>> >>> >>> --- >>> This E-mail came from the Declude.Virus mailing list. To >>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>> type "unsubscribe Declude.Virus". The archives can be found >>> at http://www.mail-archive.com. >>> >>> >> >> >> --- >> This E-mail came from the Declude.Virus mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.Virus". The archives can be found >> at http://www.mail-archive.com. >> >> >> >> >> --- >> This E-mail came from the Declude.Virus mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.Virus". The archives can be found >> at http://www.mail-archive.com. >> >> > > > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > > > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
