On Wed, Mar 02, 2005 at 12:53:03PM -0500, John Peacock wrote: > Has anyone already written a plugin to call either the Sophos sweep CLI > or the Sophie daemon? > > I'm going to be evaulating AV packages over the next month or so, and > I'd appreciate any recommendations that you can give. In particular, I > am interested in the following criteria:
We use Sophos, not in qpsmtpd though. They aren't always the first one to get a virus but they do seem to get most of them quickly. I don't know how they fit the other requirements you had. I'd thoroughly recommend using sophie rather than sweep. The startup time for sweep is far longer than any other av I've tried (10 seconds on an idle Celery 300). You could look how amavisd-new uses the sophie socket interface to save re-inventing the wheel. We also use F-Secure for Gateways but are somewhat unimpressed with that at the moment: since they split off from F-prot their replacement heuristic scanner catches almost nothing. Clamav has to be the best value for money on the market, and it has occasionally beaten the other two to first catch ! Nick
