Re: ClamAV or another?

[Gerry Doris <gdoris rogers com>]

On Mon, 2004-02-02 at 17:37, Ed Wilts wrote:
> On Mon, Feb 02, 2004 at 02:10:16PM -0800, Mike McMullen wrote:
> > From: "Ed Wilts" <ewilts ewilts org>
> > > I use f-prot at home.  It's not open source, but is free for
> > > non-commercial use.  I don't know if that's good enough for you.  It's
> > > already caught over 600 copies of the MyDoom virus heading my way.
> > >
> > >         .../Ed
> > > -- 
> > Hi Ed,
> 
> > Well I have several email accounts on this system. Does it scan
> > incoming email at the inbound sendmail level or when a message is
> > downloaded to a mailbox via popd or imapd? I  need something that
> > checks as the message is coming in.
> 
> I use MailScanner which invokes f-prot.  All my mail is scanned before
> it is delivered to any end user.  You have a bunch of options if a
> message is infected, from dropping the mail in the bitbucket to
> automatically notifying the sender of the infection (a feature I hate
> since I get several of these per day from other sites that don't realize
> that the from address for the MyDoom worm is forged).  I simply strip
> the virus, deliver the remaining pieces, and quarantine the infected
> hunks for subsequent purging (automatic) or inspection.

The newest version of MailScanner has the bounce function removed for
exactly the reason you specify.  You can also use multiple virus
scanners.  I personally use ClamAV and TrendMicro as well as F-Prot. 
All are free for personal use.  I believe that ClamAV was one of the
first to be updated to catch the MyDoom virus.  It is open source and is
very good!

-- 
Gerry Doris <gdoris rogers com>