I think I figured out why ClamAV has gone to hell....

Problem reported by Joe Wolf - 2/26/2015 at 10:06 AM

Submitted

ClamAV used to be a pretty good antivirus product (especially considering it's free), but I couldn't figure out why it has gone so bad lately. Recent reports show it only catching about 62% of infected files.

Maybe everyone else knew, but I didn't... Cisco took over the group that put ClamAV together in 2014. Knowing Cisco I doubt they have any resources devoted to ClamAV.

This also answers why the ClamAV no longer replies to viruses submitted to http://cgi.clamav.net/sendvirus.cgi

All the old information regarding the parameters to incorporate 3rd party command line scanners was deleted with the old forum data. The easiest and economical was F-Prot but the were bought out too and their new command line scanner won't work with SmarterMail. The most effective seems to be Avira and they have a command line scanner that would probably work with SmarerMail, but so far I haven't come up with a proper command line to make it work (plus it costs about $100 per year). I'm open to any other options.

I tried to work with AVG command line for a while, but didn't get it to work.

Thanks,
-Joe

7 Replies

Reply to Thread

Steve Reid Replied

2/26/2015 at 10:48 AM

Yeah I attempted AVG a couple years back and had nothing but major issues...

I might follow your lead and try avira. However I really wish there was a free solution.

Webio Replied

2/26/2015 at 11:11 PM

Hello,

I'm using Avast with good result. I have 3 incoming/outgoing gateways and one offsite backup mx too and Avast cost about 175USD for 5 licenses and it allows to install them on servers too (so actually if you have one mail server then you can use other 4 licenses on home or work workstations). I'm using it with Declude but it can be without any problems used as a command line scanner from SmarterMail too. Downside of SmarterMail command line scanning is that there is no way to "tell" SmarterMail that virus was found so there will be no stats for that (that's why I use Declude where I have proper logs and messages moved to virus folder). I've already sent some suggestions to SmarterMail regarding command line scanning (basically we need to have possibility to enter AV command line util return codes to let SM know if message was or wasnt infected).

Command line for AVAST:

..........\ashCmd.exe /a /c /t=A /_

Product page:

https://www.avast.com/en-us/endpoint-protection-suite

Regards

Webio Replied

2/26/2015 at 11:16 PM

Maybe Declude AV document will help you here: http://mailsbestfriend.com/downloads/docs/Declude_AV_Manual.pdf It contains various command lines on 2-4 page (but this informations may be outdated).

Joe Wolf Replied

2/27/2015 at 7:08 AM

Yes, I've looked at those documents, and most of them are outdated. Until 2013 I used F-Prot but then they were taken over by Cyren and released a new version and the command line scanner is completely different and can't scan an individual file. I've tried to get AVG, but they've also changed some parameters, but if I had access to the old SmarterMail forum info I think I could make AVG work.

Thanks, -Joe

Andrew Stein Replied

2/27/2015 at 9:52 AM

Would it make sense to disable Clam to save resources until a suitable replacement is found?

Joe Wolf Replied

2/27/2015 at 9:57 AM

No, something is better than nothing. ClamAV is not totally useless and does catch some malware, trojans, viruses. If you disable it you'll just be wide open.

Thanks, -Joe

Andrew Stein Replied

2/27/2015 at 10:08 AM

I'm testing out Message Sniffer which apparently includes malware and virus scanning. I'm trying to figure out how effective it has been. If all goes well, I'll be able to disable clam.

Back to Community Threads

Please leave this box unchecked

7 Replies

Reply to Thread

Tags

Related Knowledge Base Articles