Slashdot Mirror

it was prolly a typo. what he means is ms bought this back in 2003. also covered here.

In 2003, they bought GeCAD , makers of RAV-AntiVirus . So is Microsoft going to release their own anti-virus too?

This is actually the second antivirus company Microsoft has bought. In 2003 they bought GeCAD, makers of RAV-AntiVirus. So it seems that Microsoft is indeed serious about getting into the anti-virus business.

<a href="http://www.ravantivirus.com">RAV Antivirus</a>

<URL:http://www.ravantivirus.com>

<a href="http://www.ravantivirus.com">RAV Antivirus</a>

<URL:http://www.ravantivirus.com>

In typical MS fashion they bought out this company a while back for this express purpose. The only thing that wasn't known is when and this article doesn't enlighten us any further. So like I said, this is old news.

Something tells me about 72% of GeCAD's former products are about the get axed, with the two remaining being Windows anti-virus and AV for MSN Messenger (which will likely be integrated into one product).

M$ bought GeCAD software (makers of RAV Anti-Virus) a year ago [press release]. What surprises me is that RAV is still available for Linux.

http://www.ravantivirus.com

I've experienced good results using ClamAV. My setup is as follows:

Sendmail 8.12 -> MS Exchange 2000 -> Outlook clients

My outfit was already married to Microsoft, and the Exchange server was buckling due to being inundatad with spam. I'm also running Symantec AVF on my Exchange server (Dell PE6650, Quad 1.4Ghz Xeon, 3Gb ram).

I originally installed Linux on a Dell Dimension desktop (450Mhz PIII, 768Mb ram) using Sendmail + Spamassassin + spamass-milter + RAV. Spamass-milter isn't very stable, and I had a request to append a legal disclaimer to all outbound email (I work at a law firm). I swapped spamass-milter in favor of MIMEDefang to interface Spamassassin with Sendmail while also appending those legal disclaimers. Microsoft had bought RAV by this point, so I dumped RAV for ClamAV. The Linux box has also moved to a retired Dell PE6450 (Dual 700Mhz Xeon, 3Gb ram).

So now MIMEDefang is performing several functions, plus I only have one milter running instead of three.

ClamAV catches 90% of my incoming viruses and Symantec AVF catches the rest.

I'd imagine they will go with Symantec, and integrate similar to the way the took on Diskeeper for defragmentation. Which is nice for Symantec and easy for Microsoft, but it *completely* shafts every other antivirus vendor.

MS doesn't even need to do that. It's been already mentioned once or twice in earlier posts: MS bought an East-European antivirus maker called RAV a few months back. IIRC, RAV was regarded as pretty good antivirus solution. MS bought them out, payed the owners, hired a handful of developers and discontinued the product after a few months of updates. I understand it was an especially bad blow for Linux users, because RAV was widely used and efficient on Linux servers as well as on Windows.

So if you ask me, this is the obvious and logical next step: putting the AV solution they bought where they usually put stuff like this, bundle it with Windows. And from what I gather from the way they went about it, they don't intend to to depend on Symantec or other AV vendor for this.

We used RAV Antivirus for our Qmail installation for about 3 ro 4 years. Smashing product, updated itself every hour over ftp, kept us free of iloveyou, anna kournikova, all the way up to mydoom, netsky and bagle et al, and most of all CHEAP. But, last september, they posted this message, announcing that they would be ceasing new sales and terminating subscriptions at their next renewal because they had just been bought by Microsoft. I Immediately thought Hmmm, how long before we get Microsoft Antivirus. Looks like I was right.

So, those of you who are worried out Microsoft's programming prowess, fear not. Your PCs will be protected by a romanian team with 10 years experience.

I've been using both the desktop version of RAV Anti-Virus as well as the sendmail version. Both were really great products for great prices. Needless to say, I was *extremely* disappointed when Micro$oft acquired RAV's intellectual property.

Worst part is they basically left their customers high and dry. Sure, they are honoring the remaining life of their update licenses, but now I'm forced to find a replacement. Kaspersky Labs, who then acquired the RAV coding team is offering a 50% discount to former RAV users, but their mail server anti-virus software doesn't work the same way RAV did. It works on a per seat basis (basically only licensed to specific names to the left of the '@') whereas RAV licensed on per-domain name basis.
Kaspersky does have an excellent track record for catching the latest virii before any of the other big commercial virus scanners though.

If anybody knows of a better replacement than Kaspersky, I'd like to hear about it.

PC World wrote an article in June 2003 outlining Microsoft's original acquisition of the AV software firm. According to the article the software was going to be sold separately and that the acquired firm, GeCAD, would continue to operate as a small consultancy, providing customers signature updates. GeCAD are the creators of RAV AntiVirus. Lastly, you can see the press release for the acquisition here.

PC World wrote an article in June 2003 outlining Microsoft's original acquisition of the AV software firm. According to the article the software was going to be sold separately and that the acquired firm, GeCAD, would continue to operate as a small consultancy, providing customers signature updates. GeCAD are the creators of RAV AntiVirus. Lastly, you can see the press release for the acquisition here.

I've been using the linux version of the software they bought-out, and it works great.

oh, there's a large enough user base alright. People use virus scanning modules for the major Linux MTAs ... scanning mail attachments for windows viruses on non-windows mailservers is cool (safe, too). Actually, GeCad was one of the more proeminent seller of such modules (for Linux, BSD, Solaris, OSX) before getting bought by Microsoft ... whaddya know, the webpage is still up for that (http://www.ravantivirus.com/pages/isp.php), makes one wonder if MS is still selling those ;-)

2. Offer different proxies with multiple levels of popup/junk filtering that your savvy customers can opt-into.

3. Send out a CD with free versions of Ad-Aware, Spybot S&D, and so on. Or point them to links like the online version of X-Cleaner or one of many online virus scans.

4. You could also be a real saint and figure out how to put most of the important Windows Updates on CD for your dial-up users and have it automatically do its thang. At a minimum, the Service Packs and Security Rollups will make you their hero.

5. ???
6. Profit!!!

We know there isn't a quick fix solution, but 1 and 2 are eminently doable. I personally use a proggie called AdMuncher(.com) and since Dec. 25th its blocked 13,100 ads/popups/etc and supposedly saved me around 102MB of bandwidth. It ain't free, but goddamn its good (and only 157K).

I wish rav antivrus had done the same.

Oh yes, and sadly, as a follow up,
ClarkConnect includes RAV antivirus. I just read that on the http://www.clarkconnect.org website.
RAV was recently purchased by M$. So much for security.
I won't use or recomend any products based on M$ and most certainly won't use and products produced or owned by M$..

Care to back that up with references?

It is possible to activate the virus by viewing an infected email message within the Microsoft Outlook Preview Pane.

We used to think that you had to open or, in some case, preview a message for it to infect your system with a virus. It's now been proven that malicious code can enter your system via an Outlook mail message from the Internet -- even if you do not open or preview it. The flaw is in an Internet Explorer component that Outlook shares with Outlook Express. See Microsoft Security Bulletin (MS00-043) for more details and remedies.

Microsoft has released a patch that eliminates a security vulnerability in Microsoft® Outlook® and Outlook Express. Under certain conditions, the vulnerability could allow a malicious user to cause code of his choice to execute on another user's computer.
The patch eliminates this vulnerability as well as those discussed in Microsoft Security Bulletins MS00-045 and MS00-046. Customers who already have taken the corrective action discussed in either of these bulletins do not need to take any additional action.

Affected Software:
# Microsoft Outlook Express 4.x
# Microsoft Outlook Express 5.x
# Microsoft Outlook 98
# Microsoft Outlook 2000

Win32/Bugbear.A@mm exploits a MIME vulnerability in Microsoft Outlook, Internet Explorer and Outlook Express, allowing an executable attachment to run automatically, even if you do not double-click on the attachment.

Give it a whirl.

We use Rav Antivirus to scan the email for about 6000 dialup customers. It's about $600 + 20%/year for maintaining updates but we chose it specifically because it wasn't free: a virus scanner is absolutely no good when the updates aren't maintained. Pricing is based on number of domains and they have distributors all over the world.

They have versions to run qmail, sendmail, postfix, exchange server, etc., etc. and also have some user programs as well if you want. We've been very happy with it so far.

But consider Qmail. Its more secure than sendmail. Much easier to configure. And does all the things you requested. Here is the link for the Anti-Virus support. Check out the RAV product as it is can scan both emails and your drives...aka samba shares. Although it is a product you have to pay for... I consider anti-viruse one of those things that is worth paying for to make sure you're up to date.

Just thought I would throw in my two cents. I manage the mail sever for a company that has 10,000 mailboxes and handles about 100,000 email messages a day (that's minus SPAM because our SPAM filter stops 20,000 email a day). Before I was able to convince TPTB that Linux is the best solution all around for a server, we were using NTMail. NTMail uses a format similar to mbox but also has an idx file that contains an index. NTMail finally got where it couldn't handle the load so I moved us up to SendMail on a RedHat system.
We were using EXT2 for the filesystem and IDE drives with a software RAID. Although we never had any corruption problem, some of the larger mailboxes did take a while to open (10 seconds max). The processor load average also went up and the whole machine slowed down (not too bad tho) when a large glob of emails came in at once.
We have finally upgraded to a Dell PowerEdge 1650 (with one processor) and hardware RAID SCSI drives. For the filesystem, I used XFS because it is a jounaling filesystem and has at least the performance of ReiserFS. We are also using the RAV antivirus milter (The Most Affordable Virus Scanner for Linux Mailservers for anyone not using a virus scanner on your mailserver). Our new server is very fast, even under high load. We have not had ANY corrupted mailboxes (except one who accessed it through IMAP and POP3 at the same time). I personally dont believe it is the format that needs changing, changing the hardware and software choices to scale to the growing about of email. The fact that email use is growing faster than any other internet service. Picking the right file hardware and filesystem are a must, as well as a properly configured mailserver. But just because you are having file corruption problems or the server is taking a long time to access your mailbox is no reason to go back and totally rewrite standard. Why are the mailboxes being corrupted? Why does it take to so long to open a mailbox? This is when you get to the root cause, not trying to go around it.

Of course, all of you can say that is NOT an infalible procedure... but what the hell, none is ! Having dozens of desktops with anti-virus is not infalible also. Sure there are some very fine packages but if you co-ordenate your traffic in a good combination of redirectors for SQUID, disabling file-tranfers through messengers and having your gateway pretty much tied up, I believe that you can have some relaxation time!

• STATS :
• 5Gb net traffic (mail+web) per day
• 3 virus caught in 27 days
• 0 infections

• Kaspersky
• Trend Micro
• RAV

and so on. Symantec/Norton also has a Linux/UNIX binary which is certainly bundled with the network-wide thing, I don't know if it's available separately. The trouble with all of these things is that although they are Linux applications, they detect Windows virii - they use the same signature files as the versions on other platforms do. This means they're very good for running on file/e-mail servers to protect the poor Windows machines behind them (which is what they're intended for) but they probably won't stop the subject of this post, for example. Basically, yes, they exist and work well but make sure you know what you're hoping for them to do...