--On Wednesday 20 March 2002 19:51 +0000 Chris Benson <[EMAIL PROTECTED]> wrote:
> On Wed, Mar 20, 2002 at 06:43:17PM -0000, Jonathan McKeown wrote: >> >> It has certainly caught everything that's been thrown at it here (about 1 >> in 650 of our incoming messages is infected). > XXXXXXXXXXX has a non-8.3 filename, > is perl-5.6.1.tar.gz (didn't this trigger all sorts of virus scanners?), > or other false positive. OK, I've picked this message to reply to with a round-up: I realise the irony of mocking a virus-scanner in a message with a `virus-scanned' banner at the bottom; it was not our virus scanner that blocked the non-8.3 filename, but the scanner at a London university. I am as suspicious of vendors as the next man^Wperson, but I'm happy enough with Star/Messagelabs to pay them to keep checking my organisation's email. Without wanting to sound like one of their marketroids, this is why: In addition to virus signatures from three different AV vendors, they also have a rules-based scanner which examines and scores emails on a variety of criteria and blocks at a certain level. For example, they claim that this scanner was the first to intercept the ILOVEYOU virus, blocking it ten hours before the first signature was available from AV vendors: they claim that no Messagelabs client received this particular virus. They have an entertaining page of graphics mapping the spread of various viruses around the world over time based on copies they intercepted - can be found at http://www.messagelabs.com/viruseye/outbreak.asp Blocked emails are retained for 30 days, and I have a web interface to the virus pen, so I can get stats on the level of detected virus activity, and if we get a false positive, I can release the message to the original recipient. So far they're doing OK - in 18 months no incoming virus has been delivered to our domain, nor have I yet had a false positive. On that basis I don't regard their claim of scanning for all viruses as either false or misleading, and while All Software Sucks, I'm not aware of any other virus scanner with a money-back guarantee. I already have a copy of 42.zip - but I haven't dared test them with it! Jonathan -- Jonathan McKeown, System Administrator. The College of Optometrists, 42 Craven Street London WC2N 5NG. Tel: +20 7839 6000 Fax: +20 7839 6800 Incorporated by Royal Charter and registered as a Charity No 1060431 http://www.college-optometrists.org mailto:[EMAIL PROTECTED] ________________________________________________________________________ This e-mail has been scanned for all viruses by Star Internet. The service is powered by MessageLabs. For more information on a proactive anti-virus service working around the clock, around the globe, visit: http://www.star.net.uk ________________________________________________________________________
