Scott,
I have had at times, with both scanners (up to date sig files,
both catching mydoom) taking a pounding (we are getting mydoom.a in 1
every second), when Scanner1 (f-prot) would pick up the virus and
Scanner2 (InoculateIT) would not show anything, and at other times
Scanner1 would not pick it up, but Scanner2 would, as well as both
Scanners picking it up. I figured it was due to the volume we are
receiving on this and the Scanners could not keep up.
Keith
-----Original Message-----
From: R. Scott Perry [mailto:[EMAIL PROTECTED]
Sent: Friday, January 30, 2004 1:02 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] Multi-scanner Question
>If they are run in series, then wouldn't it be best to run the next
>scanner only if the previous scanner passed? In other words why scan
>the email again if it already failed one of the scanners?
The logic behind that is the only a small fraction of E-mail contains a
virus. Since the majority of E-mail has to go through both scanners,
having the viruses go through both doesn't take much extra resources.
The benefit is that you can tell from the log files if both scanners are
detecting viruses, and if one is not able to report the virus/file name,
the information from the other can be used.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list. To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
