RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
On the devlist but not to be expected soon David B From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T Sent: Friday, July 04, 2008 7:43 PM To: declude.virus@declude.com Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Any update or information on this? John T eServices For You -Original Message- From: "David Barker" <[EMAIL PROTECTED]> Sent 6/23/2008 11:36:40 AM To: declude.virus@declude.com Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG I will see what we can do for a new directive for the HOLD to be excluded or included by the admin. David From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Monday, June 23, 2008 2:17 PM To: declude.virus@declude.com Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG I have complained about this for a while now. This process of fix the configuration the place in the proc folder only works if you are constantly pouring through your hold folders. We do not do that. We send an email to our users with the message they have in their hold. They then have the option to deliver the message to their inbox, when they click the recover link the message is placed in the spool folder and a copy of the raw email is sent to our admin to then look at the configuration. This process makes the hold folder completely hands off. How about an option to VIRUSSCANONHOLD. This would make everyone happy. Kevin Bilbee From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Monday, June 23, 2008 9:57 AM To: declude.virus@declude.com Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG For what it's worth, I never move messages from HOLD to SPOOL. When I do move false positives out, I fix the problem in my configuration, so that the same circumstance doesn't happen again, and then I move the files from the HOLD to the PROC folder. By re-scanning them, they get virus scanned and I am sure that I have saved time by getting spam scanned as well; it would cost me more time to repeat the procedure next time than it takes me to override my text filters and re-queue the messages now. Very few messages get pulled out of the HOLD folder, so not scanning those messages for viruses saves me a lot of processing power. Andrew. _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Monday, June 23, 2008 9:00 AM To: declude.virus@declude.com Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Correct if you send held email directly to the spool there is a potential for a virus to bypass if running AVAFTERJM this is why it is important to correct the issue that caused the false positive then reprocess via Declude. OR alternately ensure you virus scan your HOLD folders. If you are asking to only to apply AVAFTERJM only to Deleted emails this would reduce it’s effectiveness as not every Declude customer uses Delete. David From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bonno Bloksma Sent: Monday, June 23, 2008 11:30 AM To: declude.virus@declude.com Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Hi David, Could you explain this: We have chosen not to do this otherwise your users will end up with viruses in their junkmail folders By NOT scanning held junkmail the virus WILL end up in a users mailbox if I have to reque the mail because it was a FP. Of course you don't have to scan deleted mail. Met vriendelijke groet, Bonno Bloksma hoofd systeembeheer tio hogeschool hospitality en toerisme begijnenhof 8-12 / 5611 el eindhoven t 040 296 28 28 / f 040 237 35 20 <mailto:[EMAIL PROTECTED]> [EMAIL PROTECTED] / <http://www.tio.nl/> www.tio.nl - Original Message - From: David Barker <mailto:[EMAIL PROTECTED]> To: declude.virus@declude.com Sent: Monday, June 23, 2008 4:28 PM Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Dear Bonno, It is not that we can’t do this. We have chosen not to do this otherwise your users will end up with viruses in their junkmail folders. AVAFTERJM will skip messages on DELETE and HOLD actions only. David From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bonno Bloksma Sent: Monday, June 23, 2008 4:20 AM To: declude.virus@declude.com Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Hi, (Open mail request) Dear Declude people. I have asked this before and with the current spam levels kan we PLEASE have this feature now ASAP? We all want to use AVAFTERJM but could you PLEASE make it scan all mail which is not deleted? If that is a to big step at first becasue of all the possible copy, routeto, etc statements can we at least have it for the HOLD action asap? Met vriendelijke groet, Bonno Bloksma hoofd systeembeheer tio hogeschool hospitality en toerisme begijnenhof 8-1
Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
Any update or information on this?John T
eServices For You
-Original Message-
From: "David Barker" <[EMAIL PROTECTED]>
Sent 6/23/2008 11:36:40 AM
To: declude.virus@declude.com
Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
I will see what we can do for a new directive for the HOLD to be excluded or
included by the admin.
David From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin
BilbeeSent: Monday, June 23, 2008 2:17 PMTo: [EMAIL PROTECTED]: RE:
[Declude.Virus] F-PROT 6 vs ClamAV SOSDG I have complained about this for a
while now. This process of fix the configuration the place in the proc folder
only works if you are constantly pouring through your hold folders. We do not
do that. We send an email to our users with the message they have in their
hold. They then have the option to deliver the message to their inbox, when
they click the recover link the message is placed in the spool folder and a
copy of the raw email is sent to our admin to then look at the
configuration. This process makes the hold folder completely hands off. How
about an option to VIRUSSCANONHOLD. This would make everyone happy. Kevin
Bilbee From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck,
AndrewSent: Monday, June 23, 2008 9:57 AMTo: [EMAIL PROTECTED]: RE:
[Declude.Virus] F-PROT 6 vs ClamAV SOSDG For what it's worth, I never move
messages from HOLD to SPOOL. When I do move false positives out, I fix the
problem in my configuration, so that the same circumstance doesn't happen
again, and then I move the files from the HOLD to the PROC folder. By
re-scanning them, they get virus scanned and I am sure that I have saved time
by getting spam scanned as well; it would cost me more time to repeat the
procedure next time than it takes me to override my text filters and re-queue
the messages now. Very few messages get pulled out of the HOLD folder, so not
scanning those messages for viruses saves me a lot of processing
power. Andrew. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
David BarkerSent: Monday, June 23, 2008 9:00 AMTo: [EMAIL PROTECTED]: RE:
[Declude.Virus] F-PROT 6 vs ClamAV SOSDGCorrect if you send held email directly
to the spool there is a potential for a virus to bypass if running AVAFTERJM
this is why it is important to correct the issue that caused the false positive
then reprocess via Declude. OR alternately ensure you virus scan your HOLD
folders. If you are asking to only to apply AVAFTERJM only to Deleted emails
this would reduce it’s effectiveness as not every Declude customer uses Delete.
David From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bonno
BloksmaSent: Monday, June 23, 2008 11:30 AMTo: [EMAIL PROTECTED]: Re:
[Declude.Virus] F-PROT 6 vs ClamAV SOSDG Hi David, Could you explain this:We
have chosen not to do this otherwise your users will end up with viruses in
their junkmail folders By NOT scanning held junkmail the virus WILL end up in a
users mailbox if I have to reque the mail because it was a FP. Of course you
don't have to scan deleted mail. Met vriendelijke groet,
Bonno Bloksma
hoofd systeembeheer tio hogeschool hospitality en toerisme begijnenhof 8-12 /
5611 el eindhoven
t 040 296 28 28 / f 040 237 35 [EMAIL PROTECTED] / www.tio.nl- Original
Message - From:David BarkerTo:[EMAIL PROTECTED]: Monday, June 23, 2008 4:28
PMSubject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Dear Bonno, It is not
that we can’t do this. We have chosen not to do this otherwise your users will
end up with viruses in their junkmail folders. AVAFTERJM will skip messages on
DELETE and HOLD actions only. David From:[EMAIL PROTECTED] [mailto:[EMAIL
PROTECTED] On Behalf Of Bonno BloksmaSent: Monday, June 23, 2008 4:20 AMTo:
[EMAIL PROTECTED]: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Hi, (Open mail
request)Dear Declude people. I have asked this before and with the current spam
levels kan we PLEASE have this feature now ASAP? We all want to use AVAFTERJM
but could you PLEASE make it scan all mail which is not deleted?If that is a to
big step at first becasue of all the possible copy, routeto, etc statements can
we at least have it for the HOLD action asap? Met vriendelijke groet,
Bonno Bloksma
hoofd systeembeheer tio hogeschool hospitality en toerisme begijnenhof 8-12 /
5611 el eindhoven
t 040 296 28 28 / f 040 237 35 [EMAIL PROTECTED] / www.tio.nl- Original
Message - From:Kevin BilbeeTo:[EMAIL PROTECTED]: Friday, June 13, 2008 5:25
PMSubject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Be careful with this
setting. If a message gets held as spam it will not be
virus scanned. Make sure you scan any message moved back into the delivery
queue for viruses before placing it in the delivery queue folder.
Kevin
Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
Hi Andrew,
Hey hold it, that's something new. I was not aware there was a difference in
putting a mail back in the spool or the proc folder.
As it has been put to me using the "Old Declude": I had to put the D and Q file
back in spool and Imail would process it once again and Declude would ignore it
because it had seen the message before. That would prevent it from getting
caught again.
I assumed there would be no difference from putting it back in proc as that is
just the next step in the chain.
If I read your reply correct what you say is: If I put in spool IMail will
handle it without passing it to Declude, if I put in proc then Declude will
handle it once again.
About "fixing the problem", sometimes I don't want to do that as there is
nothing to fix. The sender may be listed in several anti spam databases and
there is nothing I want to fix but the message needs to be delivered anyway. So
if it gets caught again because the sender ip is still listed... that is not
what I want, I need to have it delivered to the users mailbox.
Met vriendelijke groet,
Bonno Bloksma
hoofd systeembeheer
tio hogeschool hospitality en toerisme
begijnenhof 8-12 / 5611 el eindhoven
t 040 296 28 28 / f 040 237 35 20
[EMAIL PROTECTED] / www.tio.nl
- Original Message -
From: Colbeck, Andrew
To: declude.virus@declude.com
Sent: Monday, June 23, 2008 6:56 PM
Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
For what it's worth, I never move messages from HOLD to SPOOL. When I do move
false positives out, I fix the problem in my configuration, so that the same
circumstance doesn't happen again, and then I move the files from the HOLD to
the PROC folder.
By re-scanning them, they get virus scanned and I am sure that I have saved
time by getting spam scanned as well; it would cost me more time to repeat the
procedure next time than it takes me to override my text filters and re-queue
the messages now.
Very few messages get pulled out of the HOLD folder, so not scanning those
messages for viruses saves me a lot of processing power.
Andrew.
--
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker
Sent: Monday, June 23, 2008 9:00 AM
To: declude.virus@declude.com
Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
Correct if you send held email directly to the spool there is a potential for
a virus to bypass if running AVAFTERJM this is why it is important to correct
the issue that caused the false positive then reprocess via Declude. OR
alternately ensure you virus scan your HOLD folders.
If you are asking to only to apply AVAFTERJM only to Deleted emails this
would reduce it's effectiveness as not every Declude customer uses Delete.
David
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bonno Bloksma
Sent: Monday, June 23, 2008 11:30 AM
To: declude.virus@declude.com
Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
Hi David,
Could you explain this:
We have chosen not to do this otherwise your users will end up with viruses
in their junkmail folders
By NOT scanning held junkmail the virus WILL end up in a users mailbox if I
have to reque the mail because it was a FP. Of course you don't have to scan
deleted mail.
Met vriendelijke groet,
Bonno Bloksma
hoofd systeembeheer
tio hogeschool hospitality en toerisme
begijnenhof 8-12 / 5611 el eindhoven
t 040 296 28 28 / f 040 237 35 20
[EMAIL PROTECTED] / www.tio.nl
- Original Message -
From: David Barker
To: declude.virus@declude.com
Sent: Monday, June 23, 2008 4:28 PM
Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
Dear Bonno,
It is not that we can't do this. We have chosen not to do this otherwise
your users will end up with viruses in their junkmail folders.
AVAFTERJM will skip messages on DELETE and HOLD actions only.
David
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bonno Bloksma
Sent: Monday, June 23, 2008 4:20 AM
To: declude.virus@declude.com
Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
Hi,
(Open mail request)
Dear Declude people.
I have asked this before and with the current spam levels kan we PLEASE
have this feature now ASAP? We all want to use AVAFTERJM but could you PLEASE
make it scan all mail which is not deleted?
If that is a to big step at first becasue of all the possible copy,
routeto, etc statements can we at least have it for the HOLD action asap?
Met vriendelijke groet,
Bonno Bloksma
hoofd systeembeheer
tio hogeschool hospitality en toerisme
begijnenhof 8-12 / 5611 el eindhoven
t 040 296 28 2
Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
One side note - if this feature is added please make sure this feature
is "configurable" so we can disable it if we choose (which I would). I
have customers who "hold" all spam for a certain period of time and than
we delete. If anything needs to be returned to the queue it is scanned
manually or returned to the proc for reprocessing. Virus scanning on
all messages held would defeat the whole purpose of AVAFTERJM for their
implementation.
Darrell
--
Check out http://www.invariantsystems.com for utilities for Declude,
Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring,
SURBL/URI integration, MRTG Integration, and Log Parsers.
Bonno Bloksma wrote:
Hi,
(Open mail request)
Dear Declude people.
I have asked this before and with the current spam levels kan we PLEASE
have this feature now ASAP? We all want to use AVAFTERJM but could you
PLEASE make it scan all mail which is not deleted?
If that is a to big step at first becasue of all the possible copy,
routeto, etc statements can we at least have it for the HOLD action asap?
Met vriendelijke groet,
Bonno Bloksma
hoofd systeembeheer
tio hogeschool hospitality en toerisme
begijnenhof 8-12 / 5611 el eindhoven
t 040 296 28 28 / f 040 237 35 20
[EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> / www.tio.nl
<http://www.tio.nl>
- Original Message -
*From:* Kevin Bilbee <mailto:[EMAIL PROTECTED]>
*To:* declude.virus@declude.com <mailto:declude.virus@declude.com>
*Sent:* Friday, June 13, 2008 5:25 PM
*Subject:* RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
Be careful with this setting. If a message gets held as spam it will
not be
virus scanned. Make sure you scan any message moved back into the
delivery
queue for viruses before placing it in the delivery queue folder.
Kevin Bilbee
> -Original Message-
> From: [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]>
[mailto:[EMAIL PROTECTED] On Behalf Of
> Darin Cox
> Sent: Friday, June 13, 2008 6:10 AM
> To: declude.virus@declude.com <mailto:declude.virus@declude.com>
> Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
>
> AVAFTERJM has been around a long time. I don't remember what
version,
> but
> it was a 1.x version.
>
> Are you familiar with the setting? It tells Declude to run
Anti-Virus
> after
> Junkmail. It then only runs AV after checking to see if the
message is
> spam. With the spam load these days, I would expect that to be the
> desired
> config, resulting in AV scanning on only about 10% of incoming mail
> instead
> of 100%. However, it is not the default setting, which runs AV
first,
> then
> Junkmail.
>
> That could easily account for yours and Kathy's 70-100% CPU.
>
> Darin.
>
>
> - Original Message -
> From: "Brian Lin" <[EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]>>
> To: mailto:declude.virus@declude.com>>
> Sent: Friday, June 13, 2008 8:55 AM
> Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
>
>
> No, I am still using antique version declude and
> imail.
>
> ----- Original Message -----
> From: "Darin Cox" <[EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]>>
> To: mailto:declude.virus@declude.com>>
> Sent: Friday, June 13, 2008 8:07 PM
> Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
>
>
> > Interesting that you are also seeing the 70-100% CPU with F-Prot 6,
> where
> > we
> > are not.
> >
> > Are you running AVAFTERJM?
> >
> > Darin.
> >
> >
> > - Original Message -
> > From: "Brian Lin" <[EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]>>
> > To: mailto:declude.virus@declude.com>>
> > Sent: Friday, June 13, 2008 5:23 AM
> > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
> >
> >
> > I just terminate my F-Prot 6, and installed ClamAV SOSDG
> >
> > Before that, my CPU usage is always run to skyhigh,
> > at around 70%-100%, now using ClamAV, reduce
> > to 5%-20%, still catching all the testing virus.
> >
> > F-prot 6 do not provide option like noboot, nomem,
> > I guess these become the default setting, and cause
> > very high CPU and harddisk usage.
> >
> > Alex instruction dated at 6 June 2008 for ClamAV installation
>
RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
I will see what we can do for a new directive for the HOLD to be excluded or included by the admin. David From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Monday, June 23, 2008 2:17 PM To: declude.virus@declude.com Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG I have complained about this for a while now. This process of fix the configuration the place in the proc folder only works if you are constantly pouring through your hold folders. We do not do that. We send an email to our users with the message they have in their hold. They then have the option to deliver the message to their inbox, when they click the recover link the message is placed in the spool folder and a copy of the raw email is sent to our admin to then look at the configuration. This process makes the hold folder completely hands off. How about an option to VIRUSSCANONHOLD. This would make everyone happy. Kevin Bilbee From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Monday, June 23, 2008 9:57 AM To: declude.virus@declude.com Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG For what it's worth, I never move messages from HOLD to SPOOL. When I do move false positives out, I fix the problem in my configuration, so that the same circumstance doesn't happen again, and then I move the files from the HOLD to the PROC folder. By re-scanning them, they get virus scanned and I am sure that I have saved time by getting spam scanned as well; it would cost me more time to repeat the procedure next time than it takes me to override my text filters and re-queue the messages now. Very few messages get pulled out of the HOLD folder, so not scanning those messages for viruses saves me a lot of processing power. Andrew. _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Monday, June 23, 2008 9:00 AM To: declude.virus@declude.com Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Correct if you send held email directly to the spool there is a potential for a virus to bypass if running AVAFTERJM this is why it is important to correct the issue that caused the false positive then reprocess via Declude. OR alternately ensure you virus scan your HOLD folders. If you are asking to only to apply AVAFTERJM only to Deleted emails this would reduce it’s effectiveness as not every Declude customer uses Delete. David From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bonno Bloksma Sent: Monday, June 23, 2008 11:30 AM To: declude.virus@declude.com Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Hi David, Could you explain this: We have chosen not to do this otherwise your users will end up with viruses in their junkmail folders By NOT scanning held junkmail the virus WILL end up in a users mailbox if I have to reque the mail because it was a FP. Of course you don't have to scan deleted mail. Met vriendelijke groet, Bonno Bloksma hoofd systeembeheer tio hogeschool hospitality en toerisme begijnenhof 8-12 / 5611 el eindhoven t 040 296 28 28 / f 040 237 35 20 <mailto:[EMAIL PROTECTED]> [EMAIL PROTECTED] / <http://www.tio.nl/> www.tio.nl - Original Message - From: David Barker <mailto:[EMAIL PROTECTED]> To: declude.virus@declude.com Sent: Monday, June 23, 2008 4:28 PM Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Dear Bonno, It is not that we can’t do this. We have chosen not to do this otherwise your users will end up with viruses in their junkmail folders. AVAFTERJM will skip messages on DELETE and HOLD actions only. David From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bonno Bloksma Sent: Monday, June 23, 2008 4:20 AM To: declude.virus@declude.com Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Hi, (Open mail request) Dear Declude people. I have asked this before and with the current spam levels kan we PLEASE have this feature now ASAP? We all want to use AVAFTERJM but could you PLEASE make it scan all mail which is not deleted? If that is a to big step at first becasue of all the possible copy, routeto, etc statements can we at least have it for the HOLD action asap? Met vriendelijke groet, Bonno Bloksma hoofd systeembeheer tio hogeschool hospitality en toerisme begijnenhof 8-12 / 5611 el eindhoven t 040 296 28 28 / f 040 237 35 20 <mailto:[EMAIL PROTECTED]> [EMAIL PROTECTED] / <http://www.tio.nl> www.tio.nl - Original Message - From: Kevin Bilbee <mailto:[EMAIL PROTECTED]> To: declude.virus@declude.com Sent: Friday, June 13, 2008 5:25 PM Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Be careful with this setting. If a message gets held as spam it will not be virus scanned. Make sure you scan any message moved back into the
RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
I have complained about this for a while now. This process of fix the configuration the place in the proc folder only works if you are constantly pouring through your hold folders. We do not do that. We send an email to our users with the message they have in their hold. They then have the option to deliver the message to their inbox, when they click the recover link the message is placed in the spool folder and a copy of the raw email is sent to our admin to then look at the configuration. This process makes the hold folder completely hands off. How about an option to VIRUSSCANONHOLD. This would make everyone happy. Kevin Bilbee From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Monday, June 23, 2008 9:57 AM To: declude.virus@declude.com Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG For what it's worth, I never move messages from HOLD to SPOOL. When I do move false positives out, I fix the problem in my configuration, so that the same circumstance doesn't happen again, and then I move the files from the HOLD to the PROC folder. By re-scanning them, they get virus scanned and I am sure that I have saved time by getting spam scanned as well; it would cost me more time to repeat the procedure next time than it takes me to override my text filters and re-queue the messages now. Very few messages get pulled out of the HOLD folder, so not scanning those messages for viruses saves me a lot of processing power. Andrew. _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Monday, June 23, 2008 9:00 AM To: declude.virus@declude.com Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Correct if you send held email directly to the spool there is a potential for a virus to bypass if running AVAFTERJM this is why it is important to correct the issue that caused the false positive then reprocess via Declude. OR alternately ensure you virus scan your HOLD folders. If you are asking to only to apply AVAFTERJM only to Deleted emails this would reduce it’s effectiveness as not every Declude customer uses Delete. David From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bonno Bloksma Sent: Monday, June 23, 2008 11:30 AM To: declude.virus@declude.com Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Hi David, Could you explain this: We have chosen not to do this otherwise your users will end up with viruses in their junkmail folders By NOT scanning held junkmail the virus WILL end up in a users mailbox if I have to reque the mail because it was a FP. Of course you don't have to scan deleted mail. Met vriendelijke groet, Bonno Bloksma hoofd systeembeheer tio hogeschool hospitality en toerisme begijnenhof 8-12 / 5611 el eindhoven t 040 296 28 28 / f 040 237 35 20 <mailto:[EMAIL PROTECTED]> [EMAIL PROTECTED] / <http://www.tio.nl/> www.tio.nl - Original Message - From: David Barker <mailto:[EMAIL PROTECTED]> To: declude.virus@declude.com Sent: Monday, June 23, 2008 4:28 PM Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Dear Bonno, It is not that we can’t do this. We have chosen not to do this otherwise your users will end up with viruses in their junkmail folders. AVAFTERJM will skip messages on DELETE and HOLD actions only. David From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bonno Bloksma Sent: Monday, June 23, 2008 4:20 AM To: declude.virus@declude.com Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Hi, (Open mail request) Dear Declude people. I have asked this before and with the current spam levels kan we PLEASE have this feature now ASAP? We all want to use AVAFTERJM but could you PLEASE make it scan all mail which is not deleted? If that is a to big step at first becasue of all the possible copy, routeto, etc statements can we at least have it for the HOLD action asap? Met vriendelijke groet, Bonno Bloksma hoofd systeembeheer tio hogeschool hospitality en toerisme begijnenhof 8-12 / 5611 el eindhoven t 040 296 28 28 / f 040 237 35 20 <mailto:[EMAIL PROTECTED]> [EMAIL PROTECTED] / <http://www.tio.nl> www.tio.nl - Original Message - From: Kevin Bilbee <mailto:[EMAIL PROTECTED]> To: declude.virus@declude.com Sent: Friday, June 13, 2008 5:25 PM Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Be careful with this setting. If a message gets held as spam it will not be virus scanned. Make sure you scan any message moved back into the delivery queue for viruses before placing it in the delivery queue folder. Kevin Bilbee > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > Darin Cox > Sent: Friday, June 13, 2008 6:10 AM > To: declude.virus@declude.com > Subject: Re: [Declude.Virus
RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
For what it's worth, I never move messages from HOLD to SPOOL. When I do
move false positives out, I fix the problem in my configuration, so that
the same circumstance doesn't happen again, and then I move the files
from the HOLD to the PROC folder.
By re-scanning them, they get virus scanned and I am sure that I have
saved time by getting spam scanned as well; it would cost me more time
to repeat the procedure next time than it takes me to override my text
filters and re-queue the messages now.
Very few messages get pulled out of the HOLD folder, so not scanning
those messages for viruses saves me a lot of processing power.
Andrew.
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
David Barker
Sent: Monday, June 23, 2008 9:00 AM
To: declude.virus@declude.com
Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
Correct if you send held email directly to the spool there is a
potential for a virus to bypass if running AVAFTERJM this is why it is
important to correct the issue that caused the false positive then
reprocess via Declude. OR alternately ensure you virus scan your HOLD
folders.
If you are asking to only to apply AVAFTERJM only to Deleted emails this
would reduce it's effectiveness as not every Declude customer uses
Delete.
David
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
Bonno Bloksma
Sent: Monday, June 23, 2008 11:30 AM
To: declude.virus@declude.com
Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
Hi David,
Could you explain this:
We have chosen not to do this otherwise your users will end up with
viruses in their junkmail folders
By NOT scanning held junkmail the virus WILL end up in a users mailbox
if I have to reque the mail because it was a FP. Of course you don't
have to scan deleted mail.
Met vriendelijke groet,
Bonno Bloksma
hoofd systeembeheer
tio hogeschool hospitality en toerisme
begijnenhof 8-12 / 5611 el eindhoven
t 040 296 28 28 / f 040 237 35 20
[EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> / www.tio.nl
<http://www.tio.nl/>
- Original Message -
From: David Barker <mailto:[EMAIL PROTECTED]>
To: declude.virus@declude.com
Sent: Monday, June 23, 2008 4:28 PM
Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
Dear Bonno,
It is not that we can't do this. We have chosen not to do this
otherwise your users will end up with viruses in their junkmail folders.
AVAFTERJM will skip messages on DELETE and HOLD actions only.
David
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf
Of Bonno Bloksma
Sent: Monday, June 23, 2008 4:20 AM
To: declude.virus@declude.com
Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
Hi,
(Open mail request)
Dear Declude people.
I have asked this before and with the current spam levels kan we
PLEASE have this feature now ASAP? We all want to use AVAFTERJM but
could you PLEASE make it scan all mail which is not deleted?
If that is a to big step at first becasue of all the possible
copy, routeto, etc statements can we at least have it for the HOLD
action asap?
Met vriendelijke groet,
Bonno Bloksma
hoofd systeembeheer
tio hogeschool hospitality en toerisme
begijnenhof 8-12 / 5611 el eindhoven
t 040 296 28 28 / f 040 237 35 20
[EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> / www.tio.nl
<http://www.tio.nl>
- Original Message -
From: Kevin Bilbee
<mailto:[EMAIL PROTECTED]>
To: declude.virus@declude.com
Sent: Friday, June 13, 2008 5:25 PM
Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
Be careful with this setting. If a message gets held as
spam it will not be
virus scanned. Make sure you scan any message moved back
into the delivery
queue for viruses before placing it in the delivery
queue folder.
Kevin Bilbee
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of
> Darin Cox
> Sent: Friday, June 13, 2008 6:10 AM
> To: declude.virus@declude.com
> Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
>
> AVAFTERJM has been around a long time. I don't
remember what version,
> but
> it was a 1.x version.
>
> Are you familiar with the setting? It tells Declude
to run Anti-Virus
RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
Correct if you send held email directly to the spool there is a potential for a virus to bypass if running AVAFTERJM this is why it is important to correct the issue that caused the false positive then reprocess via Declude. OR alternately ensure you virus scan your HOLD folders. If you are asking to only to apply AVAFTERJM only to Deleted emails this would reduce it's effectiveness as not every Declude customer uses Delete. David From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bonno Bloksma Sent: Monday, June 23, 2008 11:30 AM To: declude.virus@declude.com Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Hi David, Could you explain this: We have chosen not to do this otherwise your users will end up with viruses in their junkmail folders By NOT scanning held junkmail the virus WILL end up in a users mailbox if I have to reque the mail because it was a FP. Of course you don't have to scan deleted mail. Met vriendelijke groet, Bonno Bloksma hoofd systeembeheer tio hogeschool hospitality en toerisme begijnenhof 8-12 / 5611 el eindhoven t 040 296 28 28 / f 040 237 35 20 <mailto:[EMAIL PROTECTED]> [EMAIL PROTECTED] / <http://www.tio.nl/> www.tio.nl - Original Message - From: David Barker <mailto:[EMAIL PROTECTED]> To: declude.virus@declude.com Sent: Monday, June 23, 2008 4:28 PM Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Dear Bonno, It is not that we can't do this. We have chosen not to do this otherwise your users will end up with viruses in their junkmail folders. AVAFTERJM will skip messages on DELETE and HOLD actions only. David From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bonno Bloksma Sent: Monday, June 23, 2008 4:20 AM To: declude.virus@declude.com Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Hi, (Open mail request) Dear Declude people. I have asked this before and with the current spam levels kan we PLEASE have this feature now ASAP? We all want to use AVAFTERJM but could you PLEASE make it scan all mail which is not deleted? If that is a to big step at first becasue of all the possible copy, routeto, etc statements can we at least have it for the HOLD action asap? Met vriendelijke groet, Bonno Bloksma hoofd systeembeheer tio hogeschool hospitality en toerisme begijnenhof 8-12 / 5611 el eindhoven t 040 296 28 28 / f 040 237 35 20 <mailto:[EMAIL PROTECTED]> [EMAIL PROTECTED] / <http://www.tio.nl> www.tio.nl - Original Message - From: Kevin Bilbee <mailto:[EMAIL PROTECTED]> To: declude.virus@declude.com Sent: Friday, June 13, 2008 5:25 PM Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Be careful with this setting. If a message gets held as spam it will not be virus scanned. Make sure you scan any message moved back into the delivery queue for viruses before placing it in the delivery queue folder. Kevin Bilbee > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > Darin Cox > Sent: Friday, June 13, 2008 6:10 AM > To: declude.virus@declude.com > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > > AVAFTERJM has been around a long time. I don't remember what version, > but > it was a 1.x version. > > Are you familiar with the setting? It tells Declude to run Anti-Virus > after > Junkmail. It then only runs AV after checking to see if the message is > spam. With the spam load these days, I would expect that to be the > desired > config, resulting in AV scanning on only about 10% of incoming mail > instead > of 100%. However, it is not the default setting, which runs AV first, > then > Junkmail. > > That could easily account for yours and Kathy's 70-100% CPU. > > Darin. > > > ----- Original Message - > From: "Brian Lin" <[EMAIL PROTECTED]> > To: > Sent: Friday, June 13, 2008 8:55 AM > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > > > No, I am still using antique version declude and > imail. > > - Original Message - > From: "Darin Cox" <[EMAIL PROTECTED]> > To: > Sent: Friday, June 13, 2008 8:07 PM > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > > > > Interesting that you are also seeing the 70-100% CPU with F-Prot 6, > where > > we > > are not. > > > > Are you running AVAFTERJM? > > > > Darin. > > > > > > - Original Message - > > From: "Brian Lin" <[EMAIL PROTECTED]> > > To: > > Sent: Friday, June 13, 2008 5:23 AM > > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > > > > > > I just terminate my F-Prot 6, and installed ClamAV SOSDG > > > > Before
Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
Hi David,
Could you explain this:
We have chosen not to do this otherwise your users will end up with viruses in
their junkmail folders
By NOT scanning held junkmail the virus WILL end up in a users mailbox if I
have to reque the mail because it was a FP. Of course you don't have to scan
deleted mail.
Met vriendelijke groet,
Bonno Bloksma
hoofd systeembeheer
tio hogeschool hospitality en toerisme
begijnenhof 8-12 / 5611 el eindhoven
t 040 296 28 28 / f 040 237 35 20
[EMAIL PROTECTED] / www.tio.nl
- Original Message -
From: David Barker
To: declude.virus@declude.com
Sent: Monday, June 23, 2008 4:28 PM
Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
Dear Bonno,
It is not that we can't do this. We have chosen not to do this otherwise your
users will end up with viruses in their junkmail folders.
AVAFTERJM will skip messages on DELETE and HOLD actions only.
David
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bonno Bloksma
Sent: Monday, June 23, 2008 4:20 AM
To: declude.virus@declude.com
Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
Hi,
(Open mail request)
Dear Declude people.
I have asked this before and with the current spam levels kan we PLEASE have
this feature now ASAP? We all want to use AVAFTERJM but could you PLEASE make
it scan all mail which is not deleted?
If that is a to big step at first becasue of all the possible copy, routeto,
etc statements can we at least have it for the HOLD action asap?
Met vriendelijke groet,
Bonno Bloksma
hoofd systeembeheer
tio hogeschool hospitality en toerisme
begijnenhof 8-12 / 5611 el eindhoven
t 040 296 28 28 / f 040 237 35 20
[EMAIL PROTECTED] / www.tio.nl
- Original Message -
From: Kevin Bilbee
To: declude.virus@declude.com
Sent: Friday, June 13, 2008 5:25 PM
Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
Be careful with this setting. If a message gets held as spam it will not be
virus scanned. Make sure you scan any message moved back into the delivery
queue for viruses before placing it in the delivery queue folder.
Kevin Bilbee
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
> Darin Cox
> Sent: Friday, June 13, 2008 6:10 AM
> To: declude.virus@declude.com
> Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
>
> AVAFTERJM has been around a long time. I don't remember what version,
> but
> it was a 1.x version.
>
> Are you familiar with the setting? It tells Declude to run Anti-Virus
> after
> Junkmail. It then only runs AV after checking to see if the message is
> spam. With the spam load these days, I would expect that to be the
> desired
> config, resulting in AV scanning on only about 10% of incoming mail
> instead
> of 100%. However, it is not the default setting, which runs AV first,
> then
> Junkmail.
>
> That could easily account for yours and Kathy's 70-100% CPU.
>
> Darin.
>
>
> - Original Message -
> From: "Brian Lin" <[EMAIL PROTECTED]>
> To:
> Sent: Friday, June 13, 2008 8:55 AM
> Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
>
>
> No, I am still using antique version declude and
> imail.
>
> - Original Message -
> From: "Darin Cox" <[EMAIL PROTECTED]>
> To:
> Sent: Friday, June 13, 2008 8:07 PM
> Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
>
>
> > Interesting that you are also seeing the 70-100% CPU with F-Prot 6,
> where
> > we
> > are not.
> >
> > Are you running AVAFTERJM?
> >
> > Darin.
> >
> >
> > - Original Message -
> > From: "Brian Lin" <[EMAIL PROTECTED]>
> > To:
> > Sent: Friday, June 13, 2008 5:23 AM
> > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
> >
> >
> > I just terminate my F-Prot 6, and installed ClamAV SOSDG
> >
> > Before that, my CPU usage is always run to skyhigh,
> > at around 70%-100%, now using ClamAV, reduce
> > to 5%-20%, still catching all the testing virus.
> >
> > F-prot 6 do not provide option like noboot, nomem,
> > I guess these become the default setting, and cause
> > very high CPU and harddisk usage.
> >
> > Alex instruction dated at 6 June 2008 for ClamAV installation
> > is very helpful, thanks!
RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
Dear Bonno, It is not that we can't do this. We have chosen not to do this otherwise your users will end up with viruses in their junkmail folders. AVAFTERJM will skip messages on DELETE and HOLD actions only. David From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bonno Bloksma Sent: Monday, June 23, 2008 4:20 AM To: declude.virus@declude.com Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Hi, (Open mail request) Dear Declude people. I have asked this before and with the current spam levels kan we PLEASE have this feature now ASAP? We all want to use AVAFTERJM but could you PLEASE make it scan all mail which is not deleted? If that is a to big step at first becasue of all the possible copy, routeto, etc statements can we at least have it for the HOLD action asap? Met vriendelijke groet, Bonno Bloksma hoofd systeembeheer tio hogeschool hospitality en toerisme begijnenhof 8-12 / 5611 el eindhoven t 040 296 28 28 / f 040 237 35 20 <mailto:[EMAIL PROTECTED]> [EMAIL PROTECTED] / <http://www.tio.nl> www.tio.nl - Original Message - From: Kevin Bilbee <mailto:[EMAIL PROTECTED]> To: declude.virus@declude.com Sent: Friday, June 13, 2008 5:25 PM Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Be careful with this setting. If a message gets held as spam it will not be virus scanned. Make sure you scan any message moved back into the delivery queue for viruses before placing it in the delivery queue folder. Kevin Bilbee > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > Darin Cox > Sent: Friday, June 13, 2008 6:10 AM > To: declude.virus@declude.com > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > > AVAFTERJM has been around a long time. I don't remember what version, > but > it was a 1.x version. > > Are you familiar with the setting? It tells Declude to run Anti-Virus > after > Junkmail. It then only runs AV after checking to see if the message is > spam. With the spam load these days, I would expect that to be the > desired > config, resulting in AV scanning on only about 10% of incoming mail > instead > of 100%. However, it is not the default setting, which runs AV first, > then > Junkmail. > > That could easily account for yours and Kathy's 70-100% CPU. > > Darin. > > > - Original Message ----- > From: "Brian Lin" <[EMAIL PROTECTED]> > To: > Sent: Friday, June 13, 2008 8:55 AM > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > > > No, I am still using antique version declude and > imail. > > - Original Message - > From: "Darin Cox" <[EMAIL PROTECTED]> > To: > Sent: Friday, June 13, 2008 8:07 PM > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > > > > Interesting that you are also seeing the 70-100% CPU with F-Prot 6, > where > > we > > are not. > > > > Are you running AVAFTERJM? > > > > Darin. > > > > > > - Original Message - > > From: "Brian Lin" <[EMAIL PROTECTED]> > > To: > > Sent: Friday, June 13, 2008 5:23 AM > > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > > > > > > I just terminate my F-Prot 6, and installed ClamAV SOSDG > > > > Before that, my CPU usage is always run to skyhigh, > > at around 70%-100%, now using ClamAV, reduce > > to 5%-20%, still catching all the testing virus. > > > > F-prot 6 do not provide option like noboot, nomem, > > I guess these become the default setting, and cause > > very high CPU and harddisk usage. > > > > Alex instruction dated at 6 June 2008 for ClamAV installation > > is very helpful, thanks! > > The main tricks in clamav are: > > 1: need to install the contributors' tools, then get > > two dedicated tools for declude, can run the > > clamdscan as service. > > > > 2: need to remove --mbox, if this is there, it will > > not function. > > > > Brian > > > > - Original Message - > > From: "Brian Lin" <[EMAIL PROTECTED]> > > To: > > Sent: Friday, June 13, 2008 10:02 AM > > Subject: Re: [Declude.Virus] F-PROT 6 > > > > > >>I think VIRUSCODE 1 need to be added too? > >> http://www.f-prot.com/support/windows/fpwin_faq/310.html > >> > >> Anyway, using F-Prot 6 seems very slow compare with previous F-Prot > 3, > >> I do not know the exact reason. I have try to reduce scanlevel, > heulevel, > >> archive to 0 or 1, still very slow, I guess it is now scanning > memory by > >> default? > >&g
Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
Hi, (Open mail request) Dear Declude people. I have asked this before and with the current spam levels kan we PLEASE have this feature now ASAP? We all want to use AVAFTERJM but could you PLEASE make it scan all mail which is not deleted? If that is a to big step at first becasue of all the possible copy, routeto, etc statements can we at least have it for the HOLD action asap? Met vriendelijke groet, Bonno Bloksma hoofd systeembeheer tio hogeschool hospitality en toerisme begijnenhof 8-12 / 5611 el eindhoven t 040 296 28 28 / f 040 237 35 20 [EMAIL PROTECTED] / www.tio.nl - Original Message - From: Kevin Bilbee To: declude.virus@declude.com Sent: Friday, June 13, 2008 5:25 PM Subject: RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Be careful with this setting. If a message gets held as spam it will not be virus scanned. Make sure you scan any message moved back into the delivery queue for viruses before placing it in the delivery queue folder. Kevin Bilbee > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > Darin Cox > Sent: Friday, June 13, 2008 6:10 AM > To: declude.virus@declude.com > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > > AVAFTERJM has been around a long time. I don't remember what version, > but > it was a 1.x version. > > Are you familiar with the setting? It tells Declude to run Anti-Virus > after > Junkmail. It then only runs AV after checking to see if the message is > spam. With the spam load these days, I would expect that to be the > desired > config, resulting in AV scanning on only about 10% of incoming mail > instead > of 100%. However, it is not the default setting, which runs AV first, > then > Junkmail. > > That could easily account for yours and Kathy's 70-100% CPU. > > Darin. > > > - Original Message - > From: "Brian Lin" <[EMAIL PROTECTED]> > To: > Sent: Friday, June 13, 2008 8:55 AM > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > > > No, I am still using antique version declude and > imail. > > - Original Message ----- > From: "Darin Cox" <[EMAIL PROTECTED]> > To: > Sent: Friday, June 13, 2008 8:07 PM > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > > > > Interesting that you are also seeing the 70-100% CPU with F-Prot 6, > where > > we > > are not. > > > > Are you running AVAFTERJM? > > > > Darin. > > > > > > - Original Message - > > From: "Brian Lin" <[EMAIL PROTECTED]> > > To: > > Sent: Friday, June 13, 2008 5:23 AM > > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > > > > > > I just terminate my F-Prot 6, and installed ClamAV SOSDG > > > > Before that, my CPU usage is always run to skyhigh, > > at around 70%-100%, now using ClamAV, reduce > > to 5%-20%, still catching all the testing virus. > > > > F-prot 6 do not provide option like noboot, nomem, > > I guess these become the default setting, and cause > > very high CPU and harddisk usage. > > > > Alex instruction dated at 6 June 2008 for ClamAV installation > > is very helpful, thanks! > > The main tricks in clamav are: > > 1: need to install the contributors' tools, then get > > two dedicated tools for declude, can run the > > clamdscan as service. > > > > 2: need to remove --mbox, if this is there, it will > > not function. > > > > Brian > > > > - Original Message - > > From: "Brian Lin" <[EMAIL PROTECTED]> > > To: > > Sent: Friday, June 13, 2008 10:02 AM > > Subject: Re: [Declude.Virus] F-PROT 6 > > > > > >>I think VIRUSCODE 1 need to be added too? > >> http://www.f-prot.com/support/windows/fpwin_faq/310.html > >> > >> Anyway, using F-Prot 6 seems very slow compare with previous F-Prot > 3, > >> I do not know the exact reason. I have try to reduce scanlevel, > heulevel, > >> archive to 0 or 1, still very slow, I guess it is now scanning > memory by > >> default? > >> > >> Another question is , for REPORT=report.txt > >> do we need < >? REPORT= > >> > >> from instruction here, looks like need < > > >> http://www.f-prot.com/support/windows/fpwin_faq/445.html > >> > >> but most users online post seems
Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
Thanks for advice. I can not use declude junkmail, as I can remember, that is a different package which i did not pay for. in the other hand, the problem is solved by using ClamAV, it works just great now. - Original Message - From: "Darin Cox" <[EMAIL PROTECTED]> To: Sent: Saturday, June 14, 2008 11:05 PM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Ahh... so the solution is to use Declude Junkmail instead of IMail's poor anti-spam. Then you could use the AVAFTERJM to work effectively with AV scanning. Darin. - Original Message - From: "Brian Lin" <[EMAIL PROTECTED]> To: Sent: Saturday, June 14, 2008 9:37 AM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG I have bought declude anti-virus, not declude anti-spam. - Original Message - From: "Darin Cox" <[EMAIL PROTECTED]> To: Sent: Saturday, June 14, 2008 12:55 AM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG The reason for it not working is that the scanner doesn't recognize the incorrect parameters, and aborts. We're not seeing the CPU spikes you are, however that may be a difference with running AV over all messages vs. only on messages that spam filtering. I'm curious... you say you don't have Declude, but you're subscribed to the Declude email discussion list, and you previously stated you had an "antique version declude and imail"??? Darin. - Original Message - From: "Brian Lin" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 10:38 AM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG I do not have declude anti-spam, imail already has anti-spam function. Anyway, previous in F-prot 3.0 do not have such issue, and now clamav also work perfectly over the same traffic, only F-prot 6.0 has this issue, I have tried to reduce maxonce to just 1, reduce scanlevel=1 /heurlevel=0, all can not work. Only when I add in noboot or nomem, the CPU immediate get releaf, but this is not working, because with noboot or nomen. the scanner simply not working at all. - Original Message - From: "Darin Cox" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 9:10 PM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG AVAFTERJM has been around a long time. I don't remember what version, but it was a 1.x version. Are you familiar with the setting? It tells Declude to run Anti-Virus after Junkmail. It then only runs AV after checking to see if the message is spam. With the spam load these days, I would expect that to be the desired config, resulting in AV scanning on only about 10% of incoming mail instead of 100%. However, it is not the default setting, which runs AV first, then Junkmail. That could easily account for yours and Kathy's 70-100% CPU. Darin. - Original Message - From: "Brian Lin" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 8:55 AM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG No, I am still using antique version declude and imail. ----- Original Message - From: "Darin Cox" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 8:07 PM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Interesting that you are also seeing the 70-100% CPU with F-Prot 6, where we are not. Are you running AVAFTERJM? Darin. - Original Message - From: "Brian Lin" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 5:23 AM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG I just terminate my F-Prot 6, and installed ClamAV SOSDG Before that, my CPU usage is always run to skyhigh, at around 70%-100%, now using ClamAV, reduce to 5%-20%, still catching all the testing virus. F-prot 6 do not provide option like noboot, nomem, I guess these become the default setting, and cause very high CPU and harddisk usage. Alex instruction dated at 6 June 2008 for ClamAV installation is very helpful, thanks! The main tricks in clamav are: 1: need to install the contributors' tools, then get two dedicated tools for declude, can run the clamdscan as service. 2: need to remove --mbox, if this is there, it will not function. Brian - Original Message - From: "Brian Lin" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 10:02 AM Subject: Re: [Declude.Virus] F-PROT 6 I think VIRUSCODE 1 need to be added too? http://www.f-prot.com/support/windows/fpwin_faq/310.html Anyway, using F-Prot 6 seems very slow compare with previous F-Prot 3, I do not know the exact reason. I have try to reduce scanlevel, heulevel, archive to 0 or 1, still very slow, I guess it is now scanning memory by default? Another question is , for REPORT=report.txt do we need < >? REPORT= from instruction here, looks like need < > http://www.f-prot.com/support/windows/fpwin_faq/445.html but most users online post seems &
Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
Ahh... so the solution is to use Declude Junkmail instead of IMail's poor anti-spam. Then you could use the AVAFTERJM to work effectively with AV scanning. Darin. - Original Message - From: "Brian Lin" <[EMAIL PROTECTED]> To: Sent: Saturday, June 14, 2008 9:37 AM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG I have bought declude anti-virus, not declude anti-spam. - Original Message - From: "Darin Cox" <[EMAIL PROTECTED]> To: Sent: Saturday, June 14, 2008 12:55 AM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > The reason for it not working is that the scanner doesn't recognize the > incorrect parameters, and aborts. > > We're not seeing the CPU spikes you are, however that may be a difference > with running AV over all messages vs. only on messages that spam > filtering. > > I'm curious... you say you don't have Declude, but you're subscribed to > the > Declude email discussion list, and you previously stated you had an > "antique > version declude and > imail"??? > > Darin. > > > ----- Original Message - > From: "Brian Lin" <[EMAIL PROTECTED]> > To: > Sent: Friday, June 13, 2008 10:38 AM > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > > > I do not have declude anti-spam, imail already has > anti-spam function. > > Anyway, previous in F-prot 3.0 do not have such issue, > and now clamav also work perfectly over the same traffic, > only F-prot 6.0 has this issue, I have tried to reduce > maxonce to just 1, reduce scanlevel=1 /heurlevel=0, > all can not work. > Only when I add in noboot or nomem, the CPU immediate > get releaf, but this is not working, because with noboot or nomen. > the scanner simply not working at all. > > > - Original Message - > From: "Darin Cox" <[EMAIL PROTECTED]> > To: > Sent: Friday, June 13, 2008 9:10 PM > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > > >> AVAFTERJM has been around a long time. I don't remember what version, >> but >> it was a 1.x version. >> >> Are you familiar with the setting? It tells Declude to run Anti-Virus >> after >> Junkmail. It then only runs AV after checking to see if the message is >> spam. With the spam load these days, I would expect that to be the >> desired >> config, resulting in AV scanning on only about 10% of incoming mail >> instead >> of 100%. However, it is not the default setting, which runs AV first, >> then >> Junkmail. >> >> That could easily account for yours and Kathy's 70-100% CPU. >> >> Darin. >> >> >> - Original Message ----- >> From: "Brian Lin" <[EMAIL PROTECTED]> >> To: >> Sent: Friday, June 13, 2008 8:55 AM >> Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG >> >> >> No, I am still using antique version declude and >> imail. >> >> - Original Message - >> From: "Darin Cox" <[EMAIL PROTECTED]> >> To: >> Sent: Friday, June 13, 2008 8:07 PM >> Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG >> >> >>> Interesting that you are also seeing the 70-100% CPU with F-Prot 6, >>> where >>> we >>> are not. >>> >>> Are you running AVAFTERJM? >>> >>> Darin. >>> >>> >>> - Original Message - >>> From: "Brian Lin" <[EMAIL PROTECTED]> >>> To: >>> Sent: Friday, June 13, 2008 5:23 AM >>> Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG >>> >>> >>> I just terminate my F-Prot 6, and installed ClamAV SOSDG >>> >>> Before that, my CPU usage is always run to skyhigh, >>> at around 70%-100%, now using ClamAV, reduce >>> to 5%-20%, still catching all the testing virus. >>> >>> F-prot 6 do not provide option like noboot, nomem, >>> I guess these become the default setting, and cause >>> very high CPU and harddisk usage. >>> >>> Alex instruction dated at 6 June 2008 for ClamAV installation >>> is very helpful, thanks! >>> The main tricks in clamav are: >>> 1: need to install the contributors' tools, then get >>> two dedicated tools for declude, can run the >>> clamdscan as service. >>> >>> 2: need to remove --mbox, if this is there, it will >>> not function. >>> >>> Brian >>> >>> - Original Message - >>> From: "Brian Lin" <[EMAIL PR
Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
I have bought declude anti-virus, not declude anti-spam. - Original Message - From: "Darin Cox" <[EMAIL PROTECTED]> To: Sent: Saturday, June 14, 2008 12:55 AM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG The reason for it not working is that the scanner doesn't recognize the incorrect parameters, and aborts. We're not seeing the CPU spikes you are, however that may be a difference with running AV over all messages vs. only on messages that spam filtering. I'm curious... you say you don't have Declude, but you're subscribed to the Declude email discussion list, and you previously stated you had an "antique version declude and imail"??? Darin. - Original Message - From: "Brian Lin" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 10:38 AM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG I do not have declude anti-spam, imail already has anti-spam function. Anyway, previous in F-prot 3.0 do not have such issue, and now clamav also work perfectly over the same traffic, only F-prot 6.0 has this issue, I have tried to reduce maxonce to just 1, reduce scanlevel=1 /heurlevel=0, all can not work. Only when I add in noboot or nomem, the CPU immediate get releaf, but this is not working, because with noboot or nomen. the scanner simply not working at all. - Original Message - From: "Darin Cox" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 9:10 PM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG AVAFTERJM has been around a long time. I don't remember what version, but it was a 1.x version. Are you familiar with the setting? It tells Declude to run Anti-Virus after Junkmail. It then only runs AV after checking to see if the message is spam. With the spam load these days, I would expect that to be the desired config, resulting in AV scanning on only about 10% of incoming mail instead of 100%. However, it is not the default setting, which runs AV first, then Junkmail. That could easily account for yours and Kathy's 70-100% CPU. Darin. - Original Message ----- From: "Brian Lin" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 8:55 AM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG No, I am still using antique version declude and imail. - Original Message - From: "Darin Cox" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 8:07 PM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Interesting that you are also seeing the 70-100% CPU with F-Prot 6, where we are not. Are you running AVAFTERJM? Darin. - Original Message ----- From: "Brian Lin" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 5:23 AM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG I just terminate my F-Prot 6, and installed ClamAV SOSDG Before that, my CPU usage is always run to skyhigh, at around 70%-100%, now using ClamAV, reduce to 5%-20%, still catching all the testing virus. F-prot 6 do not provide option like noboot, nomem, I guess these become the default setting, and cause very high CPU and harddisk usage. Alex instruction dated at 6 June 2008 for ClamAV installation is very helpful, thanks! The main tricks in clamav are: 1: need to install the contributors' tools, then get two dedicated tools for declude, can run the clamdscan as service. 2: need to remove --mbox, if this is there, it will not function. Brian - Original Message - From: "Brian Lin" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 10:02 AM Subject: Re: [Declude.Virus] F-PROT 6 I think VIRUSCODE 1 need to be added too? http://www.f-prot.com/support/windows/fpwin_faq/310.html Anyway, using F-Prot 6 seems very slow compare with previous F-Prot 3, I do not know the exact reason. I have try to reduce scanlevel, heulevel, archive to 0 or 1, still very slow, I guess it is now scanning memory by default? Another question is , for REPORT=report.txt do we need < >? REPORT= from instruction here, looks like need < > http://www.f-prot.com/support/windows/fpwin_faq/445.html but most users online post seems < > is not necessary. - Original Message - From: "Darin Cox" <[EMAIL PROTECTED]> To: Sent: Wednesday, June 04, 2008 2:34 AM Subject: Re: [Declude.Virus] F-PROT 6 Assuming the default location for program installation, here you go. SCANFILE C:\PROGRA~1\FRISKS~1\F-PROT~1\fpscan.exe /VERBOSE=0 /ARCHIVE=5 /scanlevel=4 /heurlevel=3 /REPORT=report.txt /VERBOSE=0 corresponds to the old /SILENT switch /TYPE is assumed now /ARCHIVE has changed to /ARCHIVE=5 /NOMEM, /NOBOOT, /DUMB, /AI, and /SERVER are defunct /SCANLEVEL and /HEURLEVEL are new switches. The values above are recommended See the FProt 6 manual for more info on conversion of switches, and desired settings Also, while the old VIRUSCODE 3 VI
Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
The reason for it not working is that the scanner doesn't recognize the incorrect parameters, and aborts. We're not seeing the CPU spikes you are, however that may be a difference with running AV over all messages vs. only on messages that spam filtering. I'm curious... you say you don't have Declude, but you're subscribed to the Declude email discussion list, and you previously stated you had an "antique version declude and imail"??? Darin. - Original Message - From: "Brian Lin" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 10:38 AM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG I do not have declude anti-spam, imail already has anti-spam function. Anyway, previous in F-prot 3.0 do not have such issue, and now clamav also work perfectly over the same traffic, only F-prot 6.0 has this issue, I have tried to reduce maxonce to just 1, reduce scanlevel=1 /heurlevel=0, all can not work. Only when I add in noboot or nomem, the CPU immediate get releaf, but this is not working, because with noboot or nomen. the scanner simply not working at all. - Original Message - From: "Darin Cox" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 9:10 PM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > AVAFTERJM has been around a long time. I don't remember what version, but > it was a 1.x version. > > Are you familiar with the setting? It tells Declude to run Anti-Virus > after > Junkmail. It then only runs AV after checking to see if the message is > spam. With the spam load these days, I would expect that to be the > desired > config, resulting in AV scanning on only about 10% of incoming mail > instead > of 100%. However, it is not the default setting, which runs AV first, > then > Junkmail. > > That could easily account for yours and Kathy's 70-100% CPU. > > Darin. > > > - Original Message - > From: "Brian Lin" <[EMAIL PROTECTED]> > To: > Sent: Friday, June 13, 2008 8:55 AM > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > > > No, I am still using antique version declude and > imail. > > - Original Message - > From: "Darin Cox" <[EMAIL PROTECTED]> > To: > Sent: Friday, June 13, 2008 8:07 PM > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > > >> Interesting that you are also seeing the 70-100% CPU with F-Prot 6, where >> we >> are not. >> >> Are you running AVAFTERJM? >> >> Darin. >> >> >> - Original Message - >> From: "Brian Lin" <[EMAIL PROTECTED]> >> To: >> Sent: Friday, June 13, 2008 5:23 AM >> Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG >> >> >> I just terminate my F-Prot 6, and installed ClamAV SOSDG >> >> Before that, my CPU usage is always run to skyhigh, >> at around 70%-100%, now using ClamAV, reduce >> to 5%-20%, still catching all the testing virus. >> >> F-prot 6 do not provide option like noboot, nomem, >> I guess these become the default setting, and cause >> very high CPU and harddisk usage. >> >> Alex instruction dated at 6 June 2008 for ClamAV installation >> is very helpful, thanks! >> The main tricks in clamav are: >> 1: need to install the contributors' tools, then get >> two dedicated tools for declude, can run the >> clamdscan as service. >> >> 2: need to remove --mbox, if this is there, it will >> not function. >> >> Brian >> >> - Original Message - >> From: "Brian Lin" <[EMAIL PROTECTED]> >> To: >> Sent: Friday, June 13, 2008 10:02 AM >> Subject: Re: [Declude.Virus] F-PROT 6 >> >> >>>I think VIRUSCODE 1 need to be added too? >>> http://www.f-prot.com/support/windows/fpwin_faq/310.html >>> >>> Anyway, using F-Prot 6 seems very slow compare with previous F-Prot 3, >>> I do not know the exact reason. I have try to reduce scanlevel, >>> heulevel, >>> archive to 0 or 1, still very slow, I guess it is now scanning memory by >>> default? >>> >>> Another question is , for REPORT=report.txt >>> do we need < >? REPORT= >>> >>> from instruction here, looks like need < > >>> http://www.f-prot.com/support/windows/fpwin_faq/445.html >>> >>> but most users online post seems < > is not necessary. >>> >>> >>> >>> - Original Message - >>> From: "Darin Cox" <[EMAIL PROTECTED]> >>> To: >>> Sent: Wednesday, June 04, 2008
Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
Kevin, Just to be more specific, if you use the HOLD action, those messages that are held will not be virus scanned. On our system, we use a combination of COPYFILE and ROUTETO, and they are in fact virus scanned when using AVAFTERJM. Matt Kevin Bilbee wrote: Be careful with this setting. If a message gets held as spam it will not be virus scanned. Make sure you scan any message moved back into the delivery queue for viruses before placing it in the delivery queue folder. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Friday, June 13, 2008 6:10 AM To: declude.virus@declude.com Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG AVAFTERJM has been around a long time. I don't remember what version, but it was a 1.x version. Are you familiar with the setting? It tells Declude to run Anti-Virus after Junkmail. It then only runs AV after checking to see if the message is spam. With the spam load these days, I would expect that to be the desired config, resulting in AV scanning on only about 10% of incoming mail instead of 100%. However, it is not the default setting, which runs AV first, then Junkmail. That could easily account for yours and Kathy's 70-100% CPU. Darin. - Original Message - From: "Brian Lin" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 8:55 AM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG No, I am still using antique version declude and imail. - Original Message - From: "Darin Cox" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 8:07 PM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Interesting that you are also seeing the 70-100% CPU with F-Prot 6, where we are not. Are you running AVAFTERJM? Darin. - Original Message - From: "Brian Lin" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 5:23 AM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG I just terminate my F-Prot 6, and installed ClamAV SOSDG Before that, my CPU usage is always run to skyhigh, at around 70%-100%, now using ClamAV, reduce to 5%-20%, still catching all the testing virus. F-prot 6 do not provide option like noboot, nomem, I guess these become the default setting, and cause very high CPU and harddisk usage. Alex instruction dated at 6 June 2008 for ClamAV installation is very helpful, thanks! The main tricks in clamav are: 1: need to install the contributors' tools, then get two dedicated tools for declude, can run the clamdscan as service. 2: need to remove --mbox, if this is there, it will not function. Brian - Original Message - From: "Brian Lin" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 10:02 AM Subject: Re: [Declude.Virus] F-PROT 6 I think VIRUSCODE 1 need to be added too? http://www.f-prot.com/support/windows/fpwin_faq/310.html Anyway, using F-Prot 6 seems very slow compare with previous F-Prot 3, I do not know the exact reason. I have try to reduce scanlevel, heulevel, archive to 0 or 1, still very slow, I guess it is now scanning memory by default? Another question is , for REPORT=report.txt do we need < >? REPORT= from instruction here, looks like need < > http://www.f-prot.com/support/windows/fpwin_faq/445.html but most users online post seems < > is not necessary. - Original Message - From: "Darin Cox" <[EMAIL PROTECTED]> To: Sent: Wednesday, June 04, 2008 2:34 AM Subject: Re: [Declude.Virus] F-PROT 6 Assuming the default location for program installation, here you go. SCANFILE C:\PROGRA~1\FRISKS~1\F-PROT~1\fpscan.exe /VERBOSE=0 /ARCHIVE=5 /scanlevel=4 /heurlevel=3 /REPORT=report.txt /VERBOSE=0 corresponds to the old /SILENT switch /TYPE is assumed now /ARCHIVE has changed to /ARCHIVE=5 /NOMEM, /NOBOOT, /DUMB, /AI, and /SERVER are defunct /SCANLEVEL and /HEURLEVEL are new switches. The values above are recommended See the FProt 6 manual for more info on conversion of switches, and desired settings Also, while the old VIRUSCODE 3 VIRUSCODE 6 VIRUSCODE 8 is most likely sufficient, we added VIRUSCODE 3 VIRUSCODE 5 VIRUSCODE 6 VIRUSCODE 7 VIRUSCODE 8 VIRUSCODE 9 VIRUSCODE 10 VIRUSCODE 11 VIRUSCODE 13 VIRUSCODE 14 VIRUSCODE 15 VIRUSCODE 17 VIRUSCODE 18 VIRUSCODE 19 VIRUSCODE 21 VIRUSCODE 22 VIRUSCODE 23 VIRUSCODE 25 VIRUSCODE 26 VIRUSCODE 27 VIRUSCODE 29 VIRUSCODE 30 VIRUSCODE 31 VIRUSCODE 33 VIRUSCODE 34 VIRUSCODE 35 VIRUSCODE 37 VIRUSCODE 38 VIRUSCODE 39 VIRUSCODE 41 VIRUSCODE 42 VIRUSCODE 43 VIRUSCODE 45 VIRUSCODE 46 VIRUSCODE 47 VIRUSCODE 49 VIRUSCODE 50 VIRUSCODE 51 VIRUSCODE 53 VIRUSCODE 54 VIRUSCODE 55 VIRUSCODE 57 VIRUSCODE 58 VIRUSCODE 59 VIRUSCODE 61 VIRUSCODE 62 VIRUSCODE 63 for completeness. Hope this helps, Darin. - Original Message ---
RE: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
Be careful with this setting. If a message gets held as spam it will not be virus scanned. Make sure you scan any message moved back into the delivery queue for viruses before placing it in the delivery queue folder. Kevin Bilbee > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > Darin Cox > Sent: Friday, June 13, 2008 6:10 AM > To: declude.virus@declude.com > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > > AVAFTERJM has been around a long time. I don't remember what version, > but > it was a 1.x version. > > Are you familiar with the setting? It tells Declude to run Anti-Virus > after > Junkmail. It then only runs AV after checking to see if the message is > spam. With the spam load these days, I would expect that to be the > desired > config, resulting in AV scanning on only about 10% of incoming mail > instead > of 100%. However, it is not the default setting, which runs AV first, > then > Junkmail. > > That could easily account for yours and Kathy's 70-100% CPU. > > Darin. > > > - Original Message - > From: "Brian Lin" <[EMAIL PROTECTED]> > To: > Sent: Friday, June 13, 2008 8:55 AM > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > > > No, I am still using antique version declude and > imail. > > ----- Original Message - > From: "Darin Cox" <[EMAIL PROTECTED]> > To: > Sent: Friday, June 13, 2008 8:07 PM > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > > > > Interesting that you are also seeing the 70-100% CPU with F-Prot 6, > where > > we > > are not. > > > > Are you running AVAFTERJM? > > > > Darin. > > > > > > - Original Message - > > From: "Brian Lin" <[EMAIL PROTECTED]> > > To: > > Sent: Friday, June 13, 2008 5:23 AM > > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > > > > > > I just terminate my F-Prot 6, and installed ClamAV SOSDG > > > > Before that, my CPU usage is always run to skyhigh, > > at around 70%-100%, now using ClamAV, reduce > > to 5%-20%, still catching all the testing virus. > > > > F-prot 6 do not provide option like noboot, nomem, > > I guess these become the default setting, and cause > > very high CPU and harddisk usage. > > > > Alex instruction dated at 6 June 2008 for ClamAV installation > > is very helpful, thanks! > > The main tricks in clamav are: > > 1: need to install the contributors' tools, then get > > two dedicated tools for declude, can run the > > clamdscan as service. > > > > 2: need to remove --mbox, if this is there, it will > > not function. > > > > Brian > > > > - Original Message - > > From: "Brian Lin" <[EMAIL PROTECTED]> > > To: > > Sent: Friday, June 13, 2008 10:02 AM > > Subject: Re: [Declude.Virus] F-PROT 6 > > > > > >>I think VIRUSCODE 1 need to be added too? > >> http://www.f-prot.com/support/windows/fpwin_faq/310.html > >> > >> Anyway, using F-Prot 6 seems very slow compare with previous F-Prot > 3, > >> I do not know the exact reason. I have try to reduce scanlevel, > heulevel, > >> archive to 0 or 1, still very slow, I guess it is now scanning > memory by > >> default? > >> > >> Another question is , for REPORT=report.txt > >> do we need < >? REPORT= > >> > >> from instruction here, looks like need < > > >> http://www.f-prot.com/support/windows/fpwin_faq/445.html > >> > >> but most users online post seems < > is not necessary. > >> > >> > >> > >> - Original Message - > >> From: "Darin Cox" <[EMAIL PROTECTED]> > >> To: > >> Sent: Wednesday, June 04, 2008 2:34 AM > >> Subject: Re: [Declude.Virus] F-PROT 6 > >> > >> > >>> Assuming the default location for program installation, here you > go. > >>> > >>> SCANFILE C:\PROGRA~1\FRISKS~1\F-PROT~1\fpscan.exe /VERBOSE=0 > /ARCHIVE=5 > >>> /scanlevel=4 /heurlevel=3 /REPORT=report.txt > >>> > >>> /VERBOSE=0 corresponds to the old /SILENT switch > >>> /TYPE is assumed now > >>> /ARCHIVE has changed to /ARCHIVE=5 > >>> /NOMEM, /NOBOOT, /DUMB, /AI, and /SERVER are defunct > >>> /SCANLEVEL and /HEURLEVEL are new switches. The values above are > >>> recommended > >>> > >>> See
Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
I do not have declude anti-spam, imail already has anti-spam function. Anyway, previous in F-prot 3.0 do not have such issue, and now clamav also work perfectly over the same traffic, only F-prot 6.0 has this issue, I have tried to reduce maxonce to just 1, reduce scanlevel=1 /heurlevel=0, all can not work. Only when I add in noboot or nomem, the CPU immediate get releaf, but this is not working, because with noboot or nomen. the scanner simply not working at all. - Original Message - From: "Darin Cox" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 9:10 PM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG AVAFTERJM has been around a long time. I don't remember what version, but it was a 1.x version. Are you familiar with the setting? It tells Declude to run Anti-Virus after Junkmail. It then only runs AV after checking to see if the message is spam. With the spam load these days, I would expect that to be the desired config, resulting in AV scanning on only about 10% of incoming mail instead of 100%. However, it is not the default setting, which runs AV first, then Junkmail. That could easily account for yours and Kathy's 70-100% CPU. Darin. - Original Message - From: "Brian Lin" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 8:55 AM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG No, I am still using antique version declude and imail. - Original Message - From: "Darin Cox" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 8:07 PM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Interesting that you are also seeing the 70-100% CPU with F-Prot 6, where we are not. Are you running AVAFTERJM? Darin. - Original Message - From: "Brian Lin" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 5:23 AM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG I just terminate my F-Prot 6, and installed ClamAV SOSDG Before that, my CPU usage is always run to skyhigh, at around 70%-100%, now using ClamAV, reduce to 5%-20%, still catching all the testing virus. F-prot 6 do not provide option like noboot, nomem, I guess these become the default setting, and cause very high CPU and harddisk usage. Alex instruction dated at 6 June 2008 for ClamAV installation is very helpful, thanks! The main tricks in clamav are: 1: need to install the contributors' tools, then get two dedicated tools for declude, can run the clamdscan as service. 2: need to remove --mbox, if this is there, it will not function. Brian - Original Message - From: "Brian Lin" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 10:02 AM Subject: Re: [Declude.Virus] F-PROT 6 I think VIRUSCODE 1 need to be added too? http://www.f-prot.com/support/windows/fpwin_faq/310.html Anyway, using F-Prot 6 seems very slow compare with previous F-Prot 3, I do not know the exact reason. I have try to reduce scanlevel, heulevel, archive to 0 or 1, still very slow, I guess it is now scanning memory by default? Another question is , for REPORT=report.txt do we need < >? REPORT= from instruction here, looks like need < > http://www.f-prot.com/support/windows/fpwin_faq/445.html but most users online post seems < > is not necessary. - Original Message - From: "Darin Cox" <[EMAIL PROTECTED]> To: Sent: Wednesday, June 04, 2008 2:34 AM Subject: Re: [Declude.Virus] F-PROT 6 Assuming the default location for program installation, here you go. SCANFILE C:\PROGRA~1\FRISKS~1\F-PROT~1\fpscan.exe /VERBOSE=0 /ARCHIVE=5 /scanlevel=4 /heurlevel=3 /REPORT=report.txt /VERBOSE=0 corresponds to the old /SILENT switch /TYPE is assumed now /ARCHIVE has changed to /ARCHIVE=5 /NOMEM, /NOBOOT, /DUMB, /AI, and /SERVER are defunct /SCANLEVEL and /HEURLEVEL are new switches. The values above are recommended See the FProt 6 manual for more info on conversion of switches, and desired settings Also, while the old VIRUSCODE 3 VIRUSCODE 6 VIRUSCODE 8 is most likely sufficient, we added VIRUSCODE 3 VIRUSCODE 5 VIRUSCODE 6 VIRUSCODE 7 VIRUSCODE 8 VIRUSCODE 9 VIRUSCODE 10 VIRUSCODE 11 VIRUSCODE 13 VIRUSCODE 14 VIRUSCODE 15 VIRUSCODE 17 VIRUSCODE 18 VIRUSCODE 19 VIRUSCODE 21 VIRUSCODE 22 VIRUSCODE 23 VIRUSCODE 25 VIRUSCODE 26 VIRUSCODE 27 VIRUSCODE 29 VIRUSCODE 30 VIRUSCODE 31 VIRUSCODE 33 VIRUSCODE 34 VIRUSCODE 35 VIRUSCODE 37 VIRUSCODE 38 VIRUSCODE 39 VIRUSCODE 41 VIRUSCODE 42 VIRUSCODE 43 VIRUSCODE 45 VIRUSCODE 46 VIRUSCODE 47 VIRUSCODE 49 VIRUSCODE 50 VIRUSCODE 51 VIRUSCODE 53 VIRUSCODE 54 VIRUSCODE 55 VIRUSCODE 57 VIRUSCODE 58 VIRUSCODE 59 VIRUSCODE 61 VIRUSCODE 62 VIRUSCODE 63 for completeness. Hope this helps, Darin. - Original Message - From: "David Barker" <[EMAIL PROTECTED]> To: Sent: Tuesday, June 03, 2008 11:46 AM Subject: [Declude.Virus] F-PROT 6 Can anyone provide a SCANFILE line th
Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
AVAFTERJM has been around a long time. I don't remember what version, but it was a 1.x version. Are you familiar with the setting? It tells Declude to run Anti-Virus after Junkmail. It then only runs AV after checking to see if the message is spam. With the spam load these days, I would expect that to be the desired config, resulting in AV scanning on only about 10% of incoming mail instead of 100%. However, it is not the default setting, which runs AV first, then Junkmail. That could easily account for yours and Kathy's 70-100% CPU. Darin. - Original Message - From: "Brian Lin" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 8:55 AM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG No, I am still using antique version declude and imail. - Original Message - From: "Darin Cox" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 8:07 PM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > Interesting that you are also seeing the 70-100% CPU with F-Prot 6, where > we > are not. > > Are you running AVAFTERJM? > > Darin. > > > - Original Message - > From: "Brian Lin" <[EMAIL PROTECTED]> > To: > Sent: Friday, June 13, 2008 5:23 AM > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > > > I just terminate my F-Prot 6, and installed ClamAV SOSDG > > Before that, my CPU usage is always run to skyhigh, > at around 70%-100%, now using ClamAV, reduce > to 5%-20%, still catching all the testing virus. > > F-prot 6 do not provide option like noboot, nomem, > I guess these become the default setting, and cause > very high CPU and harddisk usage. > > Alex instruction dated at 6 June 2008 for ClamAV installation > is very helpful, thanks! > The main tricks in clamav are: > 1: need to install the contributors' tools, then get > two dedicated tools for declude, can run the > clamdscan as service. > > 2: need to remove --mbox, if this is there, it will > not function. > > Brian > > - Original Message - > From: "Brian Lin" <[EMAIL PROTECTED]> > To: > Sent: Friday, June 13, 2008 10:02 AM > Subject: Re: [Declude.Virus] F-PROT 6 > > >>I think VIRUSCODE 1 need to be added too? >> http://www.f-prot.com/support/windows/fpwin_faq/310.html >> >> Anyway, using F-Prot 6 seems very slow compare with previous F-Prot 3, >> I do not know the exact reason. I have try to reduce scanlevel, heulevel, >> archive to 0 or 1, still very slow, I guess it is now scanning memory by >> default? >> >> Another question is , for REPORT=report.txt >> do we need < >? REPORT= >> >> from instruction here, looks like need < > >> http://www.f-prot.com/support/windows/fpwin_faq/445.html >> >> but most users online post seems < > is not necessary. >> >> >> >> - Original Message - >> From: "Darin Cox" <[EMAIL PROTECTED]> >> To: >> Sent: Wednesday, June 04, 2008 2:34 AM >> Subject: Re: [Declude.Virus] F-PROT 6 >> >> >>> Assuming the default location for program installation, here you go. >>> >>> SCANFILE C:\PROGRA~1\FRISKS~1\F-PROT~1\fpscan.exe /VERBOSE=0 /ARCHIVE=5 >>> /scanlevel=4 /heurlevel=3 /REPORT=report.txt >>> >>> /VERBOSE=0 corresponds to the old /SILENT switch >>> /TYPE is assumed now >>> /ARCHIVE has changed to /ARCHIVE=5 >>> /NOMEM, /NOBOOT, /DUMB, /AI, and /SERVER are defunct >>> /SCANLEVEL and /HEURLEVEL are new switches. The values above are >>> recommended >>> >>> See the FProt 6 manual for more info on conversion of switches, and >>> desired >>> settings >>> >>> Also, while the old >>> >>> VIRUSCODE 3 >>> VIRUSCODE 6 >>> VIRUSCODE 8 >>> >>> is most likely sufficient, we added >>> >>> VIRUSCODE 3 >>> VIRUSCODE 5 >>> VIRUSCODE 6 >>> VIRUSCODE 7 >>> VIRUSCODE 8 >>> VIRUSCODE 9 >>> VIRUSCODE 10 >>> VIRUSCODE 11 >>> VIRUSCODE 13 >>> VIRUSCODE 14 >>> VIRUSCODE 15 >>> VIRUSCODE 17 >>> VIRUSCODE 18 >>> VIRUSCODE 19 >>> VIRUSCODE 21 >>> VIRUSCODE 22 >>> VIRUSCODE 23 >>> VIRUSCODE 25 >>> VIRUSCODE 26 >>> VIRUSCODE 27 >>> VIRUSCODE 29 >>> VIRUSCODE 30 >>> VIRUSCODE 31 >>> VIRUSCODE 33 >>> VIRUSCODE 34 >>> VIRUSCODE 35 >>> VIRUSCODE 37 >>> VIRUSCODE 38 >>> VIRUSCODE 39 >>> VIRUSCODE 41 >>
Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
No, I am still using antique version declude and imail. - Original Message - From: "Darin Cox" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 8:07 PM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG Interesting that you are also seeing the 70-100% CPU with F-Prot 6, where we are not. Are you running AVAFTERJM? Darin. - Original Message - From: "Brian Lin" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 5:23 AM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG I just terminate my F-Prot 6, and installed ClamAV SOSDG Before that, my CPU usage is always run to skyhigh, at around 70%-100%, now using ClamAV, reduce to 5%-20%, still catching all the testing virus. F-prot 6 do not provide option like noboot, nomem, I guess these become the default setting, and cause very high CPU and harddisk usage. Alex instruction dated at 6 June 2008 for ClamAV installation is very helpful, thanks! The main tricks in clamav are: 1: need to install the contributors' tools, then get two dedicated tools for declude, can run the clamdscan as service. 2: need to remove --mbox, if this is there, it will not function. Brian - Original Message - From: "Brian Lin" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 10:02 AM Subject: Re: [Declude.Virus] F-PROT 6 I think VIRUSCODE 1 need to be added too? http://www.f-prot.com/support/windows/fpwin_faq/310.html Anyway, using F-Prot 6 seems very slow compare with previous F-Prot 3, I do not know the exact reason. I have try to reduce scanlevel, heulevel, archive to 0 or 1, still very slow, I guess it is now scanning memory by default? Another question is , for REPORT=report.txt do we need < >? REPORT= from instruction here, looks like need < > http://www.f-prot.com/support/windows/fpwin_faq/445.html but most users online post seems < > is not necessary. - Original Message - From: "Darin Cox" <[EMAIL PROTECTED]> To: Sent: Wednesday, June 04, 2008 2:34 AM Subject: Re: [Declude.Virus] F-PROT 6 Assuming the default location for program installation, here you go. SCANFILE C:\PROGRA~1\FRISKS~1\F-PROT~1\fpscan.exe /VERBOSE=0 /ARCHIVE=5 /scanlevel=4 /heurlevel=3 /REPORT=report.txt /VERBOSE=0 corresponds to the old /SILENT switch /TYPE is assumed now /ARCHIVE has changed to /ARCHIVE=5 /NOMEM, /NOBOOT, /DUMB, /AI, and /SERVER are defunct /SCANLEVEL and /HEURLEVEL are new switches. The values above are recommended See the FProt 6 manual for more info on conversion of switches, and desired settings Also, while the old VIRUSCODE 3 VIRUSCODE 6 VIRUSCODE 8 is most likely sufficient, we added VIRUSCODE 3 VIRUSCODE 5 VIRUSCODE 6 VIRUSCODE 7 VIRUSCODE 8 VIRUSCODE 9 VIRUSCODE 10 VIRUSCODE 11 VIRUSCODE 13 VIRUSCODE 14 VIRUSCODE 15 VIRUSCODE 17 VIRUSCODE 18 VIRUSCODE 19 VIRUSCODE 21 VIRUSCODE 22 VIRUSCODE 23 VIRUSCODE 25 VIRUSCODE 26 VIRUSCODE 27 VIRUSCODE 29 VIRUSCODE 30 VIRUSCODE 31 VIRUSCODE 33 VIRUSCODE 34 VIRUSCODE 35 VIRUSCODE 37 VIRUSCODE 38 VIRUSCODE 39 VIRUSCODE 41 VIRUSCODE 42 VIRUSCODE 43 VIRUSCODE 45 VIRUSCODE 46 VIRUSCODE 47 VIRUSCODE 49 VIRUSCODE 50 VIRUSCODE 51 VIRUSCODE 53 VIRUSCODE 54 VIRUSCODE 55 VIRUSCODE 57 VIRUSCODE 58 VIRUSCODE 59 VIRUSCODE 61 VIRUSCODE 62 VIRUSCODE 63 for completeness. Hope this helps, Darin. - Original Message - From: "David Barker" <[EMAIL PROTECTED]> To: Sent: Tuesday, June 03, 2008 11:46 AM Subject: [Declude.Virus] F-PROT 6 Can anyone provide a SCANFILE line that they know works with F-PROT 6 ? Thanks David B --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
Interesting that you are also seeing the 70-100% CPU with F-Prot 6, where we are not. Are you running AVAFTERJM? Darin. - Original Message - From: "Brian Lin" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 5:23 AM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG I just terminate my F-Prot 6, and installed ClamAV SOSDG Before that, my CPU usage is always run to skyhigh, at around 70%-100%, now using ClamAV, reduce to 5%-20%, still catching all the testing virus. F-prot 6 do not provide option like noboot, nomem, I guess these become the default setting, and cause very high CPU and harddisk usage. Alex instruction dated at 6 June 2008 for ClamAV installation is very helpful, thanks! The main tricks in clamav are: 1: need to install the contributors' tools, then get two dedicated tools for declude, can run the clamdscan as service. 2: need to remove --mbox, if this is there, it will not function. Brian - Original Message - From: "Brian Lin" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 10:02 AM Subject: Re: [Declude.Virus] F-PROT 6 >I think VIRUSCODE 1 need to be added too? > http://www.f-prot.com/support/windows/fpwin_faq/310.html > > Anyway, using F-Prot 6 seems very slow compare with previous F-Prot 3, > I do not know the exact reason. I have try to reduce scanlevel, heulevel, > archive to 0 or 1, still very slow, I guess it is now scanning memory by > default? > > Another question is , for REPORT=report.txt > do we need < >? REPORT= > > from instruction here, looks like need < > > http://www.f-prot.com/support/windows/fpwin_faq/445.html > > but most users online post seems < > is not necessary. > > > > - Original Message - > From: "Darin Cox" <[EMAIL PROTECTED]> > To: > Sent: Wednesday, June 04, 2008 2:34 AM > Subject: Re: [Declude.Virus] F-PROT 6 > > >> Assuming the default location for program installation, here you go. >> >> SCANFILE C:\PROGRA~1\FRISKS~1\F-PROT~1\fpscan.exe /VERBOSE=0 /ARCHIVE=5 >> /scanlevel=4 /heurlevel=3 /REPORT=report.txt >> >> /VERBOSE=0 corresponds to the old /SILENT switch >> /TYPE is assumed now >> /ARCHIVE has changed to /ARCHIVE=5 >> /NOMEM, /NOBOOT, /DUMB, /AI, and /SERVER are defunct >> /SCANLEVEL and /HEURLEVEL are new switches. The values above are >> recommended >> >> See the FProt 6 manual for more info on conversion of switches, and >> desired >> settings >> >> Also, while the old >> >> VIRUSCODE 3 >> VIRUSCODE 6 >> VIRUSCODE 8 >> >> is most likely sufficient, we added >> >> VIRUSCODE 3 >> VIRUSCODE 5 >> VIRUSCODE 6 >> VIRUSCODE 7 >> VIRUSCODE 8 >> VIRUSCODE 9 >> VIRUSCODE 10 >> VIRUSCODE 11 >> VIRUSCODE 13 >> VIRUSCODE 14 >> VIRUSCODE 15 >> VIRUSCODE 17 >> VIRUSCODE 18 >> VIRUSCODE 19 >> VIRUSCODE 21 >> VIRUSCODE 22 >> VIRUSCODE 23 >> VIRUSCODE 25 >> VIRUSCODE 26 >> VIRUSCODE 27 >> VIRUSCODE 29 >> VIRUSCODE 30 >> VIRUSCODE 31 >> VIRUSCODE 33 >> VIRUSCODE 34 >> VIRUSCODE 35 >> VIRUSCODE 37 >> VIRUSCODE 38 >> VIRUSCODE 39 >> VIRUSCODE 41 >> VIRUSCODE 42 >> VIRUSCODE 43 >> VIRUSCODE 45 >> VIRUSCODE 46 >> VIRUSCODE 47 >> VIRUSCODE 49 >> VIRUSCODE 50 >> VIRUSCODE 51 >> VIRUSCODE 53 >> VIRUSCODE 54 >> VIRUSCODE 55 >> VIRUSCODE 57 >> VIRUSCODE 58 >> VIRUSCODE 59 >> VIRUSCODE 61 >> VIRUSCODE 62 >> VIRUSCODE 63 >> >> for completeness. >> >> Hope this helps, >> >> Darin. >> >> >> - Original Message - >> From: "David Barker" <[EMAIL PROTECTED]> >> To: >> Sent: Tuesday, June 03, 2008 11:46 AM >> Subject: [Declude.Virus] F-PROT 6 >> >> >> Can anyone provide a SCANFILE line that they know works with F-PROT 6 ? >> >> Thanks >> David B >> >> >> >> >> >> >> >> --- >> This E-mail came from the Declude.Virus mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.Virus".The archives can be found >> at http://www.mail-archive.com. >> >> >> >> >> --- >> This E-mail came from the Declude.Virus mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.Virus".The archives can be found >> at http://www.mail-archive.com. >> >> > > > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus".The archives can be found > at http://www.mail-archive.com. > > --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG
I just terminate my F-Prot 6, and installed ClamAV SOSDG Before that, my CPU usage is always run to skyhigh, at around 70%-100%, now using ClamAV, reduce to 5%-20%, still catching all the testing virus. F-prot 6 do not provide option like noboot, nomem, I guess these become the default setting, and cause very high CPU and harddisk usage. Alex instruction dated at 6 June 2008 for ClamAV installation is very helpful, thanks! The main tricks in clamav are: 1: need to install the contributors' tools, then get two dedicated tools for declude, can run the clamdscan as service. 2: need to remove --mbox, if this is there, it will not function. Brian - Original Message - From: "Brian Lin" <[EMAIL PROTECTED]> To: Sent: Friday, June 13, 2008 10:02 AM Subject: Re: [Declude.Virus] F-PROT 6 I think VIRUSCODE 1 need to be added too? http://www.f-prot.com/support/windows/fpwin_faq/310.html Anyway, using F-Prot 6 seems very slow compare with previous F-Prot 3, I do not know the exact reason. I have try to reduce scanlevel, heulevel, archive to 0 or 1, still very slow, I guess it is now scanning memory by default? Another question is , for REPORT=report.txt do we need < >? REPORT= from instruction here, looks like need < > http://www.f-prot.com/support/windows/fpwin_faq/445.html but most users online post seems < > is not necessary. - Original Message - From: "Darin Cox" <[EMAIL PROTECTED]> To: Sent: Wednesday, June 04, 2008 2:34 AM Subject: Re: [Declude.Virus] F-PROT 6 Assuming the default location for program installation, here you go. SCANFILE C:\PROGRA~1\FRISKS~1\F-PROT~1\fpscan.exe /VERBOSE=0 /ARCHIVE=5 /scanlevel=4 /heurlevel=3 /REPORT=report.txt /VERBOSE=0 corresponds to the old /SILENT switch /TYPE is assumed now /ARCHIVE has changed to /ARCHIVE=5 /NOMEM, /NOBOOT, /DUMB, /AI, and /SERVER are defunct /SCANLEVEL and /HEURLEVEL are new switches. The values above are recommended See the FProt 6 manual for more info on conversion of switches, and desired settings Also, while the old VIRUSCODE 3 VIRUSCODE 6 VIRUSCODE 8 is most likely sufficient, we added VIRUSCODE 3 VIRUSCODE 5 VIRUSCODE 6 VIRUSCODE 7 VIRUSCODE 8 VIRUSCODE 9 VIRUSCODE 10 VIRUSCODE 11 VIRUSCODE 13 VIRUSCODE 14 VIRUSCODE 15 VIRUSCODE 17 VIRUSCODE 18 VIRUSCODE 19 VIRUSCODE 21 VIRUSCODE 22 VIRUSCODE 23 VIRUSCODE 25 VIRUSCODE 26 VIRUSCODE 27 VIRUSCODE 29 VIRUSCODE 30 VIRUSCODE 31 VIRUSCODE 33 VIRUSCODE 34 VIRUSCODE 35 VIRUSCODE 37 VIRUSCODE 38 VIRUSCODE 39 VIRUSCODE 41 VIRUSCODE 42 VIRUSCODE 43 VIRUSCODE 45 VIRUSCODE 46 VIRUSCODE 47 VIRUSCODE 49 VIRUSCODE 50 VIRUSCODE 51 VIRUSCODE 53 VIRUSCODE 54 VIRUSCODE 55 VIRUSCODE 57 VIRUSCODE 58 VIRUSCODE 59 VIRUSCODE 61 VIRUSCODE 62 VIRUSCODE 63 for completeness. Hope this helps, Darin. - Original Message - From: "David Barker" <[EMAIL PROTECTED]> To: Sent: Tuesday, June 03, 2008 11:46 AM Subject: [Declude.Virus] F-PROT 6 Can anyone provide a SCANFILE line that they know works with F-PROT 6 ? Thanks David B --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
