WOOT! - Virus Scanning

[rcordray]

I'm curious what kind of experience people are having with the virus filtering.

I've noticed

1) practically no apparent reduction in viruses received. The latest trick seems to be to create a legitimate looking message notifying you that your e-mail account has been deleted, and with instructions about how to restore it in a password-protected zip file attachment. The password is supplied in the e-mail. I've been receiving 5-10 infected messages per day through several accounts which are being caught by Norton AV locally.

2) at least one pure text/non virus text message was filtered as if it had a virus. This was a large data transmission from a client, a pure text file containing billing records.

Any efforts to reduce virus traffic are appreciated.

Rick
(reseller)

[Silverbug]

Ironicly, since the virus scanning has been setup ive started receiving viruses in my email (being picked up by NAV) and before that i havent had one in the last 4 years. oh well at least there being picked up.

Mail1 has some issues with it so its using the old "block executable" thing. The other machines are still rnning it.

[joseane]

In the last 2 days I'm receiving lot of virus through mail4

hrm Ill look into it.. there is a bug in clamav that just crashes the daemon, so i am just waiting for the day to update.

[obyone89]

I've noticed with a lot of my clients, both W32.Netsky.C@mm and W32.Dumaru@mm viruses are still getting through you scanner setup. The alerts I receive both mention these viruses are coming in as .exe attachments. Hopefully your program will be updated to catch these soon.

Thanks!

P.S. I'm not complaining, I welcome the idea of virus scanning before it gets to my client's servers (which scan as well), I just wanted to let you know.

[QuickStart]

Happy to hear this news. I know that this is harder to implement on cpanel accounts, but..... do you think it is coming in the near future?

[generic]

just received a new virus thru mail 2

Dear user of yourdomainname.com gateway e-mail server,

Our main mailing server will be temporary unavaible for next two days,
to continue receiving mail in these days you have to configure our free
auto-forwarding service.

For more information see the attached file.

Have a good day,
The Tracewebdesign.com team http://www.yourdomainname.com

attachment is a .pif
caught by mcafee email scan.
Now I gotta see if they sent this to my clients. Nice

The problem is a mix between ClamD crashing (It will start back up the next minute) and the rate of viruses coming out. If clamd crashes 15 seconds into the minute, the 45 seconds will let messages through. We're working on a solution, but mainly its just waiting for ClamAV to fix the bug.

Signatures aren't so much of a problem because we run freshclam which will download the latest signatures as soon ast hey come out... ClamAV is #5 in Virus scanners for updating their sigs... Norton, McAffee, TrendMico and other commercial scanners are WELL below ClamAV (10th, 15th, etc.).

[newmem]

Originally Posted by Silverbug

Ironicly, since the virus scanning has been setup ive started receiving viruses in my email (being picked up by NAV) and before that i havent had one in the last 4 years. oh well at least there being picked up.

I don't know if it's a coincidence, but even I have experienced the same.

[mresell]

Still receiving viruses, but honestly can't scientifical say anymore or less. Not reliably tracking it. Not that it would really matter, since other variables cannot be rulled out. Just giving feedback on virus setup.

[chadlnc]

I have client who also said they are receiving viruses. I haven't mentioned to any of them that virus scanning is on the server so no big deal, just thought I would let you know. I think they are getting the mydoom virus.

I'm starting to sound like a broken record, but here it is again for everyone to read:

Although we do have virus scanning on all the mail servers, a small percentage of virus emails may still slip through due to the necessity to ensure that 100% of all legimitimate is delivered. We could block 100% of the viruses, but at the expense of losing some legitimate mail. I assure you, we are blocking tens of thousands of virus emails everyday on each server.

Just a quick note, as of 5pm here are stats:

mail - 10711
mail1 - 4584
mail2 - 13820
mail3 - 10291
mail4 - 10479

As you can see, mail1 is a bit low, but thats due to the slow-drive issue. We have a new drive setup and it will be installed in the next few days.

[mresell]

Originally Posted by Bladesnitz

Just a quick note, as of 5pm here are stats:

mail - 10711
mail1 - 4584
mail2 - 13820
mail3 - 10291
mail4 - 10479

As you can see, mail1 is a bit low, but thats due to the slow-drive issue. We have a new drive setup and it will be installed in the next few days.

Got it...good to know it is blocking most.