4 ms·
"before that the inbound email is scanned for viruses (ClamAV)" We moved away from ClamAV because it detected less than a tenth of virus samples we tested in p
by jorangreef 7y ago
"before that the inbound email is scanned for viruses (ClamAV)"
We moved away from ClamAV because it detected less than a tenth of virus samples we tested in practice. Simple things like EXEs, ISOs, VBAs and JS attachments.
VirusTotal uploads showed the same single digit detection rate for ClamAV.
I thought ClamAV was a better scanner, have things stagnated?
- wielebny 7y agoDid you use anything else than stock rules?
- jorangreef 7y agoNothing other than stock settings and the latest signatures, same as VirusTotal's ClamAV I think?
- amaccuish 7y agoI use the free version of sophos for linux plugged into rspamd. Hopefully it has a better detection rate since Sophos. I did it this way since I read about the poor detection rate of ClamAV. Tbh we've blanket banned exes and their ilk so I'm not even sure if we need it anymore.