mytob worm only picked up by clamav

[Steen, Glenn]

> -----Original Message-----
> From: MailScanner mailing list 
> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of James Gray
> Sent: den 2 maj 2005 07:14
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: mytob worm only picked up by clamav
> 
> 
> On Mon, 2 May 2005 12:14 pm, Scott Farrell wrote:
> > Hi,
> >
> > I have 4 virus scanners running, and only clamav is picking this up.
> >
> > Luckily the .pif file extensions is also killing it.
> >
> > What engines are you using that can pick this up, for 
> linux, and I'll go
> > buy another engine?
> >
> > How about bitdefender, does it pick it up?
BitDefender is a free download/install, so you should be using that
already, regardless:-). Look in the wiki for instruktions
http://wiki.mailscanner.info/doku.php?id=documentation:anti_virus:bitdef
ender:install
(that should be on one line, if "auto-linewrap" mangles it:)

> 
> I've been catching it with both ClamAV (0.84) and McAfee/NAI 
> VirusScan (engine
> 4.40.0).  Given NAI's lack of speed in releasing signature 
> updates, I don't
> think they are the best option in terms of bangs-for-bucks.  
> They do release
> "extra" files when an outbreak occurrs, but these are a pain 
> to deal with in
> any automated fashion
Very true about the extra.dat things. But... since a while back
mcafee went to daily updates, so the slowness isn't as bad as it
used to be.

And there we have them, the three I use: clam, bdc and uvscan.
Works ok for me. And if from time to time only one detects a
certain virus, that isn't really a reason to "jump out of ones
shorts"... As long as it gets caught and isn't a FP:-).

-- Glenn

> 
> HTH,
> 
> James
> --
> <xtifr> Athena Desktop Environment!  In your hearts, you 
> *know* it's the
>         right choice! :)
> * Knghtbrd THWAPS xtifr
> 
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 
> Support MailScanner development - buy the book off the website!
> 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!