Linux Workstation Antivirus Software

[davidck]

My mail server had never had any virus on it.

as for users it's not that easy to say from where the virus came, but as far as i know my users had had no viral e-mails since i installed antispam/antivirus on server.

[Chris]

I use it for 2 - 3 month's now and I think it does it's job well.

though I havn't done in depth research, I DID test it.

I recive less noise from dumb users, and I guess it's not because number of viruses and warms for win32 has decriesed with time.

and I choose it over kaspersky and Dr.Web as I use only free(open source) software (on machines under my responsibility).

I haven't used any other antivirus on linux, so I can't provide comparisons.

if it works for me doesn't nessarily mean that it will for you, but I think it defenetly might.

I am running f-prot now. I will DL the Linux version of Clam and test the two side by side for a month or so and let you know what I find.

[simon]

well i've just downloaded f-prot, and clamAV is next up. my first impression is to like clamAV because it has debian packages that are packaged my a known maintainer and they are going to be included in the next official release of debian (sarge). which also means they adhear to a strict guideline of "opensouceness" ;)

f-prot does have deb packages as well, but not official or ever going to be. their liscense is more restrictive but not really a real issue for any "home user". also the deb package dumps everything in /usr/local/f-prot, although i would have expected and at least liked the option to have the conf files or def put in /etc and maybe the def update scripts put in /usr/bin. anyway, some particulars. all can be changed manually.

i'll post with my finial verdict on how both work, behave etc when i'm done. i imagine the results will be pretty equal.

simon

[Anthony]

I am running f-prot now. I will DL the Linux version of Clam and test the two side by side for a month or so and let you know what I find.

After using it for five months, I haven't had any problems with ClamAV except for a scanning time which is longer than I'm comfortable with:

-- summary --
Known viruses: 21857
Scanned directories: 19518
Scanned files: 323767
Infected files: 2
Data scanned: 13921.50 MB
I/O buffer size: 131072 bytes
Time: 5364.687 sec (89 m 24 s)

Running on a dual Pentium 3, 1GHz system with 512MB of RAM, an hour and a half is longer than I would expect for that amount of data. Although several gigabytes of information is contained within compressed BZip2 archives, the software would be considerably more effective if it was modified to make proper use of a SMP environment.

One noteworthy feature which was quite helpful is the threaded clamd server, which allows for centralized scanning of a network. I haven't tested the actual bandwidth requirements of that system, however I would suspect that it would be substantial.