AVAFTERJM has been around a long time. I don't remember what version, but it was a 1.x version.
Are you familiar with the setting? It tells Declude to run Anti-Virus after Junkmail. It then only runs AV after checking to see if the message is spam. With the spam load these days, I would expect that to be the desired config, resulting in AV scanning on only about 10% of incoming mail instead of 100%. However, it is not the default setting, which runs AV first, then Junkmail. That could easily account for yours and Kathy's 70-100% CPU. Darin. ----- Original Message ----- From: "Brian Lin" <[EMAIL PROTECTED]> To: <declude.virus@declude.com> Sent: Friday, June 13, 2008 8:55 AM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG No, I am still using antique version declude and imail. ----- Original Message ----- From: "Darin Cox" <[EMAIL PROTECTED]> To: <declude.virus@declude.com> Sent: Friday, June 13, 2008 8:07 PM Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > Interesting that you are also seeing the 70-100% CPU with F-Prot 6, where > we > are not. > > Are you running AVAFTERJM? > > Darin. > > > ----- Original Message ----- > From: "Brian Lin" <[EMAIL PROTECTED]> > To: <declude.virus@declude.com> > Sent: Friday, June 13, 2008 5:23 AM > Subject: Re: [Declude.Virus] F-PROT 6 vs ClamAV SOSDG > > > I just terminate my F-Prot 6, and installed ClamAV SOSDG > > Before that, my CPU usage is always run to skyhigh, > at around 70%-100%, now using ClamAV, reduce > to 5%-20%, still catching all the testing virus. > > F-prot 6 do not provide option like noboot, nomem, > I guess these become the default setting, and cause > very high CPU and harddisk usage. > > Alex instruction dated at 6 June 2008 for ClamAV installation > is very helpful, thanks! > The main tricks in clamav are: > 1: need to install the contributors' tools, then get > two dedicated tools for declude, can run the > clamdscan as service. > > 2: need to remove --mbox, if this is there, it will > not function. > > Brian > > ----- Original Message ----- > From: "Brian Lin" <[EMAIL PROTECTED]> > To: <declude.virus@declude.com> > Sent: Friday, June 13, 2008 10:02 AM > Subject: Re: [Declude.Virus] F-PROT 6 > > >>I think VIRUSCODE 1 need to be added too? >> http://www.f-prot.com/support/windows/fpwin_faq/310.html >> >> Anyway, using F-Prot 6 seems very slow compare with previous F-Prot 3, >> I do not know the exact reason. I have try to reduce scanlevel, heulevel, >> archive to 0 or 1, still very slow, I guess it is now scanning memory by >> default? >> >> Another question is , for REPORT=report.txt >> do we need < >? REPORT=<report.txt> >> >> from instruction here, looks like need < > >> http://www.f-prot.com/support/windows/fpwin_faq/445.html >> >> but most users online post seems < > is not necessary. >> >> >> >> ----- Original Message ----- >> From: "Darin Cox" <[EMAIL PROTECTED]> >> To: <declude.virus@declude.com> >> Sent: Wednesday, June 04, 2008 2:34 AM >> Subject: Re: [Declude.Virus] F-PROT 6 >> >> >>> Assuming the default location for program installation, here you go. >>> >>> SCANFILE C:\PROGRA~1\FRISKS~1\F-PROT~1\fpscan.exe /VERBOSE=0 /ARCHIVE=5 >>> /scanlevel=4 /heurlevel=3 /REPORT=report.txt >>> >>> /VERBOSE=0 corresponds to the old /SILENT switch >>> /TYPE is assumed now >>> /ARCHIVE has changed to /ARCHIVE=5 >>> /NOMEM, /NOBOOT, /DUMB, /AI, and /SERVER are defunct >>> /SCANLEVEL and /HEURLEVEL are new switches. The values above are >>> recommended >>> >>> See the FProt 6 manual for more info on conversion of switches, and >>> desired >>> settings >>> >>> Also, while the old >>> >>> VIRUSCODE 3 >>> VIRUSCODE 6 >>> VIRUSCODE 8 >>> >>> is most likely sufficient, we added >>> >>> VIRUSCODE 3 >>> VIRUSCODE 5 >>> VIRUSCODE 6 >>> VIRUSCODE 7 >>> VIRUSCODE 8 >>> VIRUSCODE 9 >>> VIRUSCODE 10 >>> VIRUSCODE 11 >>> VIRUSCODE 13 >>> VIRUSCODE 14 >>> VIRUSCODE 15 >>> VIRUSCODE 17 >>> VIRUSCODE 18 >>> VIRUSCODE 19 >>> VIRUSCODE 21 >>> VIRUSCODE 22 >>> VIRUSCODE 23 >>> VIRUSCODE 25 >>> VIRUSCODE 26 >>> VIRUSCODE 27 >>> VIRUSCODE 29 >>> VIRUSCODE 30 >>> VIRUSCODE 31 >>> VIRUSCODE 33 >>> VIRUSCODE 34 >>> VIRUSCODE 35 >>> VIRUSCODE 37 >>> VIRUSCODE 38 >>> VIRUSCODE 39 >>> VIRUSCODE 41 >>> VIRUSCODE 42 >>> VIRUSCODE 43 >>> VIRUSCODE 45 >>> VIRUSCODE 46 >>> VIRUSCODE 47 >>> VIRUSCODE 49 >>> VIRUSCODE 50 >>> VIRUSCODE 51 >>> VIRUSCODE 53 >>> VIRUSCODE 54 >>> VIRUSCODE 55 >>> VIRUSCODE 57 >>> VIRUSCODE 58 >>> VIRUSCODE 59 >>> VIRUSCODE 61 >>> VIRUSCODE 62 >>> VIRUSCODE 63 >>> >>> for completeness. >>> >>> Hope this helps, >>> >>> Darin. >>> >>> >>> ----- Original Message ----- >>> From: "David Barker" <[EMAIL PROTECTED]> >>> To: <declude.virus@declude.com> >>> Sent: Tuesday, June 03, 2008 11:46 AM >>> Subject: [Declude.Virus] F-PROT 6 >>> >>> >>> Can anyone provide a SCANFILE line that they know works with F-PROT 6 ? >>> >>> Thanks >>> David B >>> >>> >>> >>> >>> >>> >>> >>> --- >>> This E-mail came from the Declude.Virus mailing list. To >>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>> type "unsubscribe Declude.Virus". The archives can be found >>> at http://www.mail-archive.com. >>> >>> >>> >>> >>> --- >>> This E-mail came from the Declude.Virus mailing list. To >>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>> type "unsubscribe Declude.Virus". The archives can be found >>> at http://www.mail-archive.com. >>> >>> >> >> >> >> --- >> This E-mail came from the Declude.Virus mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.Virus". The archives can be found >> at http://www.mail-archive.com. >> >> > > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > > > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
