I wouldn't pretend to do anywhere near the number of email a day as most of you do. 1,000 a day would be a heavy day well over 50% of that is spam. Yet in months of using the Symantec AntiVirus, I have yet to see a single virus caught. Now on the flipside, I have yet to have one pass through either. I have the system setup to notify me and the user if a virus is detected, but it's never triggered. Logs don't show any detection either.
Although it is technically possible that no viruses were sent, it's highly unlikely. Viruses now get E-mail addresses from a wide enough variety of sources that it is extremely rare for a domain not to receive any viruses over long periods of time.
However, the *first* thing you should do after installing an AV program is test it. Otherwise, you're wasting your money. There are a lot of ways any AV program can not work properly. You can go to http://www.declude.com/tools and use the Test Virus Sender to send the test eicar.com file to see if your server blocks it (yes, it works even if you are not running Declude Virus <G>). I'm guessing that you won't receive the eicar.com file, but will get one of those "NULL body" notices.
In the last several weeks I have all the sudden seen a number of emails come in with NULL Bodies, or no attached messaged. In most cases, the header isn't even complete. I can find nothing in the logs that lead me to believe this was a virus incoming, but I am wondering why I see several of these a day now when I never saw them a month ago (8.05?).
It sounds like you have an on-access virus scanner doing something it shouldn't. If you are running an on-access virus scanner on the IMail server, it should be set up not to scan the spool directory or any user directories.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
