Anti-Virus Recommendations

[sterling]

Hi, I am running AMS on Windows 2003 Server and was wondering which anti-virus software other people use.

Thanks!

[MikeG]

I use ClamAV with AMS on a Windows 2003 server. The main reasons are because its very fast, uses very up-to-date definitions, uses very small amounts of memory, has so far never missed a virus, and its free!
Also, I wanted a virus checker to ONLY check the emails that AMS tells it to check, and not get involved in the monitoring of other files on the server.
Only slight problem is that its a port from a Linux project, so some of the documentation is aimed more towards Linux users rather than Windows users, but installation is relatively painless.
http://www.sosdg.org/clamav-win32

[m1byo]

I am using AVG on Windows Server 2003, once you have installed it on windows, integrating it with AMS is very easy as all of the recomended settings are already included and you just need to add the path of the AVG installation.

[sterling]

Thank you both for your recommendations. I will give them both a try and see which works out the best for us.

Thanks again!

[waterman34]

I've tried AVG with approximately 600 email addresses and the memory usage was too intensive, it was almost at 100% capacity the whole time so I'm not sure I'd recommend AVG for a high number of users.

The other one could be worth a try as well though if you do have alot of users.

[Marc]

I run AVG, and 99% of the time its fine. However a couple of times it would spawn lots of AVGSCAN processes and the server would be on its knees. However I have reduced the max number of concurrent scales right down and not had the problem since.

Ta,

[m1byo]

out of curiosity, what did you reduce your no. simltaneous scans to??

thanks

Ian

[Marc]

Currently set to 3.

[THX_1138]

Hi,

We used AVG for a while but it just kept crashing the server even with everything scaled down. We have a lot of users so I would agree that AVG is not necessarily the best for large servers. We ended up using Computer Associates etrust anti virus which we have had running for about a year now and fingers crossed have had no problems.

Regards

Jay

[Pugglewuggle]

Use ESET NOD32 Antivirus. It's the most efficient AV software on the market with the best detection (proactive!) and lowest resource utilization. It won the AV-Comparitives.org best AV product award.

Check it out!

ESET's homepage is http://www.eset.com. Try the demo free for 30 days. I did over a year ago and was amazed at the results - the server runs much more smoothly too. We had Symantec before that and then we tried a bunch of others including McAfee, AVG, Bit Defender, Kaspersky, and others. NOD32 won hands down. Pretty darn cool.

I've been using version 2.7 on my Windows Server 2003 machine, but they just came out with version 3.0. I'm testing that to see how it works.

P.S.: They have domestic support for all countries they do business in, so no talking to India if you're from the US or UK!

[sterling]

Pugglewuggle,

Were you able to get the v3 of NOD32 running on 2003? I tried to install it on 2003 but it told me the operating system wasn't supported. I had used v2.7 before but I kept getting error messages in the Windows Event Viewer every time a message would be scanned, it did seem that the messages were scanned it would just log some message.

Thanks!

[Pugglewuggle]

I was. Please see my instructions here:

http://code-crafters.com/forum/viewtopic.php?f=6&t=200&p=612#p612

Cheers!

[Pugglewuggle]

Hey, I'm sorry! I forgot to tell you that you have to use the business version. You can download it and use it with the regular $39.00 license. Just go to the download part of their site and select the NOD32 for business and enter your username/password. The Home one won't work on Windows Server.

Cheers!

[gretchendv]

I’m running Ability 2 Mail server version2.61. Yesterday I downloaded ESET NOD32 v3 and added it as the Antivirus scanner and configured according to the information here. It worked for about an hour and then it started stripping the attachments and text out of ALL email! HELP! I turned off all virus scanning of email until this is resolved so my system is vulnerable. Do you know what would cause this problem??? I need immediate help!

Thanks!
Gretchen

[gretchendv]

Here's what I've figured out so far. ESET's command line program ecls.exe is returning 101 - archive error for every email scanned. Since the return value range was set to 1:* it is of course picking up the 101 and flagging the email as having a virus. I removed the action of "stripping all infected parts" of the emails, so the content is no longer being deleted. My Return Value range is currently set to 100:101 - if I understand the syntax correctly this should only capture return values between 100 and 101. Since the only valid return value in that range is 101, I assume this is the value ESET is returning. What I am attempting to find out from ESET is what causes an 101 error. I changed the parameters to include "no-arch" hoping this would solve the issue, but it hasn't. Here's my current configuration:
Application Path: C:\Program Files\ESET\ESET NOD32 Antivirus\ecls.exe
Parameters: "%s"/base-dir="C:\Program Files\ESET\ESET NOD32 Antivirus"/files/no-boots/no-arch/rtp/sfx/mail/adware/unsafe/unwanted/pattern/heur/adv-heur

Return Value: 100:101

With this configuration everything is being classified as having a virus.

Please let me know if anyone have any insights into this situation!

Thanks

[gretchendv]

Is there anyway email messages can be recovered as they existed before the antivirus scan stripped the "infected" content?

[rob]

Unfortunatly once the mail as been processed and stripped of any bad parts, there is no way to recover these. It could be an option to save a copy of infected mails in a special user account, by adding additional actions to the antivirus action list, but this is potentially dangerous for the obvious reasons.

[gretchendv]

Well I finally got it working. The parameters syntax is very picky! I was typing in the settings that pugglewuggle gave, but I didn't put the spaces in the right places. I recommend copying and pasting the parameters! Here's what works:

"%s" /base-dir="C:\Program Files\ESET\ESET NOD32 Antivirus" /files /no-boots /arch /rtp /sfx /mail /adware /unsafe /unwanted /pattern /heur /adv-heur /action=clean


don't type it, copy and paste it!!

[nmewarlok]

I also recommend NOD32 , we started with AVG but like other users after a certain point that was resource intensive, switched to clamwin, but something about the new version, ever AV process spawned used 1 CPU (we run our mail server on a Xeon Quad Core), for a total of 4 total emails at one time. Also took between 15 and 20 second per message to scan. This simply will not work with a user enviroment of 1600, Im not sure what bug the latest verision has but it did not work for me. Switched to NOD32 .. problem with CPU util ceased, now running 10-14% with about 1-3 seconds per "normal" message, a bit longer on large attachments, etc.

[Pugglewuggle]

I'm glad to see you guys are liking NOD32. I love it!
Just remember to use the Business version on Windows Server.