Re: missing viruses

On Tue, May 11, 2004 at 08:11:37AM -0500, Trey Nolen wrote:
> We are running Sophie 3.81 with the newest version of Sophie, and recently
> have been noticing a lot of worms getting through.  I have especially seen
> several variants of Bagle that Sophos is supposed to stop making it past,
> but I also have seen what Norton recognized as MHTMLRedir.Exploit come
> through email.  Anyone else having this trouble?  I have sent several sample
> messages to Sophos support, but haven't heard anything back yet and it has
> been a couple of days.  I was thinking about running Clam as a backup (scan
> things twice).  Does anyone know if Clam would catch these that are getting
> through?

Are you running amavisd-new too? You need the very latest  version  to
catch malware in encrypted zips. Older versions will just skip them in
"most" cases (not all - not sure why).

Our  mail  gateway   runs   both   Sophie/Sophos   and   Trophie/Trend
ServerProtect(*) behind amavisd-new. I don't have exact figures but it
seems  that  in  many  cases, yes, Trophie catches malware that Sophie
doesn't yet. This may have to do with the fact  that  I  update  Trend
patterns both from the official  VPNs  and  the  "early  access"  CPRs
(Controlled Pattern Releases) using a script I have made  public  here
(and which nears a real release now).

Trophie/Trend is a very good scanning back-end once you figure it out.
I understand that the lack of maintenance and support from Trend might
make it break at any time with a new release  of  the  Trend  scanning
engine, though.

Due  to  the  traffic and the specs of the box, I can't afford using a
command-line scanner except as a very last resort degraded mode.

Greets,
_Alain_

(*) yes I know that's a poor choice of a Trend product for this purpose. I
just use the scanning engine actually and I happened to have a license
for this.