[Mimedefang] Anyone using File::Scan?

[Matthew S. Cramer]

On Tue, Feb 15, 2005 at 09:46:57PM -0500, David F. Skoll wrote:

> Does anyone use File::Scan with MIMEDefang?  It seems to cause a lot
> of problems with false positives.

I've never heard from a user about a false positive, and we are in the
2 Million or so inbound mails per month range.

I scan first with File::Scan because of its speed, then ClamAV, and
finally McAfee.  Here are my last 5 months of virus volume from
Internet mail, and the amount detected per scanner:

month          sep     oct     nov     dec     jan
File::Scan    7588    11599   21210   29947   4969
ClamAV        2914    6065    12914   11455   4564
McAfee        1642    1626    92      267     18

Due to its speed I will continue to use it as my first scanner.


Matt

-- 
Matthew S. Cramer <mscramer at armstrong.com>          Office: 717-396-5032
Infrastructure Security Analyst                     Fax:    717-396-5590
Armstrong World Industries, Inc.                    Cell:   717-917-7099