Virii detection very low

[Scott Silva]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Ken Goods spake the following on 10/25/2005 2:12 PM:
> Glenn Steen wrote:
> 
>>On 25/10/05, Ken Goods <KGoods at aiainsurance.com> wrote:
>>
>>>Ed Bruce wrote:
>>>
>>>>We only get about 2k-3k incoming email/day - but over the last 15
>>>>days no virii were detected. Normally we get around 2-3 infected
>>>>emails/day. Anybody else seeing a lot fewer infected emails then
>>>>normal? I just get a little worried when nothing is seen.
>>>>
>>>>later,
>>>>Ed
>>>>
>>>
>>>Funny... I was just getting ready to post a message exactly like
>>>this. We too process 2-5k messages per day and I haven't seen a
>>>virus since I upgraded MailScanner a week ago Friday. I received 14
>>>the day before the upgrade. Thought something went wrong with the
>>>upgrade so I used GFI to send myself the virus laden test emails and
>>>they were caught (and I was notified) perfectly. But still, I went
>>>from an average of 7 per day to zero! A little concerning.... Then
>>>again, I have the luxury of being able to block several countries at
>>>the firewall and that cut them to about 10% of what I was seeing
>>>before.  
>>>
>>>Still keeping a close watch though... seems a little to coincidental.
>>>
>>>Ken Goods
>>>Network Administrator
>>>AIA/CropUSA Insurance, Inc.
>>>
>>
>>About the same load, and pretty much only see some stray Mytobs (short
>>bursts of 2-10 evrey third day or so)... And clam catching the normal
>>2-5 phishes/day. You do run clamav?
> 
> 
> Yes, MailScanner/Spamassassin/ClamAV. All upgraded Friday before last. Hence
> the strange coincidence.... maillog looks fine stating that virus scanning
> is happening and like I said, the GFI email virus tests were all caught
> correctly... strange. But now that I think about it I'm not getting the
> normal amount of bad filetype/content/phish notification messages from
> MailScanner nor any Phish notification messages from Clam (via MailScanner).
> But they are getting caught as I just received a phish that MailScanner
> caught and modified the message (with no postmaster notification). So it
> looks like I'm just not getting the notifications like I did before. Also
> mailScanner-MRTG is not reporting any viruses....
> 
> I did look through the notification section of MailScanner.conf and nothing
> has changed that I could see. (ran upgrade_MailScanner_conf after the
> upgrade)
> 
> hummm.... back to Sherlock Holmes mode..... 
> 
> Ken Goods
> Network Administrator
> AIA/CropUSA Insurance, Inc.
> 
You could also add the Bitdefender package. It is also free, and can be
an added safety net just in case a wild Clam update renders it useless
for a day or more.

-- 

/-----------------------\           |~~\_____/~~\__  |
| MailScanner; The best |___________ \N1____====== )-+
| protection on the net!|                   ~~~|/~~  |
\-----------------------/                      ()

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!