AV Engine Licence

[shrek-m at gmx.de]

Jim Robinson wrote:

>I have over 12 mail servers with MailScanner installed and ClamAV catches
>more than Sophos.
>
>

and your sophos is always up2date ?
clamav has a lot of false_positive,
see below

>Just my zero cents worth (As ClamAV is free)
>
>I would stick with ClamAV, sleep easy and have more budget left to spend.
>
>

i could not sleep very well with your suggestion  ;-)


http://www.tekit.de/tekit-aktuelles.html
http://www.tekit.de/pdf/testbericht_tekit-v7.pdf


catched in_the_wild_viruses in the lab and via email:


gmx.de  +  sophos  = 100%
1und1.de  +  symantec  = 100%


web.de  +  clamav  = 55%
freenet.de  +  clamav  = 55%


short-summary:
clamav as only av-solution is *not* recommended
clamav has a lot of false_positive


>Having said that, you still need good AV on the desktops unless you remove
>all CD/DVD and Floppy drives and ban all external email and webmail access.
>Even then it might be an idea to ban users on them too  as you'll still find
>some chump who can get a virus frorm a web page.  :)
>
>Anyway, joking aside, even with the best AV on your mail server your
>desktops still need good AV at the desktop level as well.  A decent IDS on
>the network perimeter (Snort) really helps with Virus issues but I'm getting
>off topic!
>
>


--
shrek-m