Sybari's Antigen AV.

[micael]

I'm currently evaluating a AV product for Lotus Domino and Microsoft Exchange. I would like to hear everyones opinion on this product, its hard to say but it looks like a good product and it performs well in lab environment but without further testing in "live" environment is it almost impossible to tell the full potential of this product. I hope someone have had any kind of experience of Sybari's Antigen products.

Brief facts about Antigen for Lotus Domino:

Sybari's Antigen 6.0 for Lotus Domino

"Reliable, high-performance antivirus protection for Lotus Domino."

- Designed for 24x7 environments. Antigen is never off-line during product upgrades and virus signature updates.
- Provides e-mail worm detection and total message deletion.
- Multiple AV engine scanning of all messages and databases.
- Supports leading third-party scan engines: Norman Data Defense, McAfee, Sophos, CA.
- Provides Domino Net Store Protection.
- Supports scanning of Macintosh file formats.
- Supports scanning of digitally signed messages.
- Scans and cleans multi-level zipped attachments and other nested attachments.
- Content Management with customized message filters.
- iNotes Web Access Protection.

Source Antigen for Lotus Domino.

Brief facts about Antigen for Microsoft Exchange:

Sybari's Antigen for Microsoft Exchange

"Reliable, high-performance antivirus protection for Microsoft Exchange."

- Single Anti-virus and security solution for Exchange 2000, Exchange v5.5, and Exchange v5.0.
- Real-time protection of multiple storage groups and their databases.
- Full protection of the Exchange 2000 web storage system, including support for messages sent via Outlook Web Access.
- Multiple scan engine support for more comprehensive virus detection.
- Engine Manager and Bias settings achieve the desired balance between certainty and performance for multiple scanning of attachments.
- In-Memory Scanning of File Attachments and Multi-level .Zip files.
- 100% scanning of all messages/folders in both directions.
- Single instance scanning.
- Supports scanning of digitally signed messages.
- "Watchdog" processes that continuously monitor proper functioning of Antigen Realtime.
- Antigen Worm Purge.

Source Antigen for Microsoft Exchange.

• Quick links:
• Antigen for Lotus Domino.
• Antigen for Microsoft Exchange.
• Sybari Software.
• Norman AV.
• McAfee AV.
• Sophos AV.
• Computer Associates AV.

[KorpDeath]

Antigen works well. Their response to new viri is above average.
I like the performance of the engine. It also doesn't choke like some other scanners when you send a .zip file of 0 bytes through it (McA...,Tre..)or other odd things.

[micael]

I have only tested the Eval version and I dont think its a full time limited product.
I have discovered some sad things about the product, but it may work in the full product.

• I renamed 6 popular viruses to .txt .scr .com .exe and .ix, now I had 30 "different" viruses. I made a script "send a lots of mail". I did send 100 mails (3000 infections).
• Antigen found all viruses except those renamed to .txt and .ix .
• The scan was incredible fast though and my processor utilization was as top up to 66%.
  
• I repeated the test above but this time with all 30 different viruses in a nested virus.zip archive.
• Antigen found all viruses this time? What's the difference?
• Even this time was the scan incredible fast.
  
• I repeated the test above also this time with all 30 different viruses in a nested virus.zip archive.
• And then I renamed it to "virus.rar" and made a copy "virus.ace".
• Antigen found none of the viruses this time .
• Even this time was the scan incredible fast (extremly since it skipped the check).

Its still an interesting product since they have no competitors what I know about in speed, all tests was done with Antigen 6.0 all virus scanners activated + all other features. The test platform was Lotus Domino r5.x running on a win2000 with a p3 600 mhz processor and 256mb ram (minimum spec to get it to run).

[KorpDeath]

I did not notice that severe CPU utilization, but I used a version or so back from what you are testing.

Sounds like you're putting it through it's paces though, good luck.

There was a way to specify which extensions get scanned, but I'm not sure if that would slow the scan engine to a crawl if you added those.