These are various product both open source and closed source-commercial providing anti virus for Linux or Unix family. ClamAV may the most popular name on open source anti virus, and it has included on most of Linux distro. Beside ClamAV, BitDefender anti virus for Unices might be a good option, because it has a strong feature for virus and malware removal.

BitDefender is a commercial product with free license edition for personal use. Installing BitDefender on openSUSE require a simple step as below :

1. Get a free license from BitDefender website. BitDefender will send you a free license key and a link for downloading binary installer
2. Get BitDefender binary installer for Unices. Binary installer available on an executable file
3. Install the binary by running it on console. BitDefender provide a console task and a GUI menu for daily use and you would choose to install preferred features within installation process. Below is an installation example using version 7.6.4. Go to installation folder(in my case in /opt)

   cd /opt
   chmod +x BitDefender-Antivirus-Scanner-7.6-4.linux-gcc4x.i586.rpm.run
   ./BitDefender-Antivirus-Scanner-7.6-4.linux-gcc4x.i586.rpm.run
   

4. Launch it from start up menu (if only you choose to install the GUI option)
   `
   
5. Click on Set New Key menu and paste your free license key
6. Click on Update icon to updating BitDefender virus definition library
7. BitDefender ready to use. Click on Scanner menu to starting the virus & malware scanning.

Although SpamAssasin has smart enough to kill spam, Zimbra bundled it with a poor capability to prevent  a spam hit attack. We should improve it before launching the Zimbra mail server as fully production mail server.

We can improve the Zimbra anti spam by improving SpamAssasin capability, adding some plugins and change some configuration to meet with our requirement. Let’s improve Zimbra anti spam with the following task :

1. Edit the spam percentage threshold in Zimbra Admin | Global Setting | AS/AV. The standard percentage threshold (33% for tagging a spam message and 75% for killing spam message. The percentage using standard SpamAssasin score : 100% are equal with score 20, so the default score are 6.6 for tagging and 15 for killing) looks too permissive for fighting the spam.
   `
   The best way to  setting up the correct percentage threshold that meets with your criteria are investigating the message source of some spam message. Take a look on spam identification score on the header of message source and compare it with others message. In my case, the tagging percentage threshold looks pretty good to identified the spam but the killing percentage seems to be less-restrictive, so I setting up the lower percentage, 50% that equivalent with score 10. Please be-aware to set up the killing percent in a lower percentage step by step to prevent any message loss caused by too restrictive setting.
2. Installing SPF plugins. Mail::SPF is an object-oriented implementation of Sender Policy Framework (SPF). See http://www.openspf.org for more information about SPF. Install the plugins using the package built on openSUSE Build Service. Just typing SPF or Perl-Mail-SPF on the search text box. I found it from perl repository : http://download.opensuse.org/repositories/devel:/languages:/perl/.
3. Installing Pyzor Plugins. Pyzor is a collaborative, networked system to detect and block spam using identifying digests of messages. Install the Pyzor plugins from openSUSE Build Service and then run the following command to configuring Pyzor :
   `
   as root :

   mkdir /opt/zimbra/amavisd/.pyzor; chown zimbra:zimbra /opt/zimbra/amavisd/.pyzor
   

   then open your firewall ports for pyzor (UDP/24441 outgoing) and finally activating the Pyzor by running the following command using Zimbra user :

   su - zimbra
   pyzor --homedir /opt/zimbra/amavisd/.pyzor discover
   

4. Installing Razor Plugin.
   

   Vipul’s Razor is a distributed, collaborative, spam detection and filtering network. Razor establishes a distributed and constantly updating catalogue of spam in propagation. This catalogue is used by clients to filter out known spam. On receiving a spam, a Razor Reporting Agent (run by an end-user or a troll box) calculates and
   submits a 20-character unique identification of the spam (a SHA Digest) to its closest Razor Catalogue Server. The Catalogue Server echos this signature to other trusted servers after storing it in its database. Prior to manual processing or transport-level reception, Razor Filtering Agents (end-users and MTAs) check their incoming mail against a Catalogue Server and filter out or deny transport in case of a signature match. Catalogued spam, once identified and reported by a Reporting Agent, can be blocked out by the rest of the Filtering Agents on the network.

   Install Razor Agent and Perl-Razor-Agent from openSUSE Build Service and then configuring Razor with the following task :

   • Open your firewall ports for razor2 (TCP/2703 outgoing).
   • Run the following command as root :

     mkdir /opt/zimbra/amavisd/.razor; chown -Rf zimbra:zimbra /opt/zimbra/amavisd/.razor
     

     and then activating Razor by running the following command using Zimbra user :

     su - zimbra
     razor-admin -home=/opt/zimbra/amavisd/.razor -create
     razor-admin -home=/opt/zimbra/amavisd/.razor -discover
     razor-admin -home=/opt/zimbra/amavisd/.razor -register
     

   • Enable razor. Edit /opt/zimbra/conf/spamassassin/v310.pre and uncomment line
     loadplugin Mail::SpamAssassin::Plugin::Razor2
5. Install DCC plugins. he DCC or Distributed Checksum Clearinghouse is an anti-spam content filter that runs on a variety of operating systems. Install DCC from openSUSE Build Service and then edit /etc/dcc/dcc_conf, set DCCUID=zimbra  and DCCD_ENABLE=off and then edit /opt/zimbra/conf/spamassassin/v310.pre, enable DCC line :

   loadplugin Mail::SpamAssassin::Plugin::DCC
   

6. Enable SPF+Pyzor+Razor on the SpamAssasin configuration. Edit /opt/zimbra/conf/spamassassin/local.cf and add the following rules (modify it to meet your environment) at the end of configuration :

   ok_languages en es id
   ok_locales en es id
   trusted_networks 127. 192.168.
   use_bayes 1
   skip_rbl_checks 0
   use_razor2 1
   use_dcc 1
   use_pyzor 1
   dns_available yes
   
   ## Optional Score Increases
   ## Choose your preferred values...
   score DCC_CHECK 4.000
   score SPF_FAIL 10.000
   score SPF_HELO_FAIL 10.000
   score RAZOR2_CHECK 2.500
   score PYZOR_CHECK 2.500
   score BAYES_99 4.300
   score BAYES_90 3.500
   score BAYES_80 3.000
   bayes_ignore_header Received: from mail.vavai.net
   bayes_ignore_header Received: from localhost
   

7. Activating Domain, User and Content Whitelist & Blacklist. Please refer to Zimbra Wiki here and here to see a complete configuration.
8. Slow down the Simultaneous Connection Throttling to prevent spam attack.  I got this problem while setting up Zimbra in a government office in Jakarta. Spammer open up a large number of simultaneous connection and then send too many message. The message are fake and likely to be blocked by Zimbra but the message still hit the MTA and fill the queue. We could prevent this attack by setting a lower limit to simultaneous connection with the following command :

   su - zimbra
   postconf -e 'smtpd_hard_error_limit = 3'
   postconf -e 'smtpd_soft_error_limit = 2'
   exit
   cd /opt/zimbra/postfix/sbin
   ./postfix stop
   ./postfix start
   

   More info about Postfix Configuration Parameter regarding error limit, here.

9. Adding RBL list to block the blacklisted SMTP IP. I’m currently using b.barracudacentral.org, zen.spamhaus.org, dnsbl.njabl.org, dnsbl.ahbl.org, cbl.abuseat.org and bl.spamcop.net. Daftar tersebut dimasukkan melalui menu Zimbra Admin | Global Setting | MTA
   `
   

The above configuration should improve Zimbra anti spam capability to block all incoming spam. Below is a screenshot of anti spam image on my client after improving the spam capability.

Please remember that the well-restrictive spam would impact our Zimbra mail server performance. It’s a trade-off between Zimbra performance and the anti spam capability. Adding more anti spam plugins means an increasing number of task for Zimbra anti spam. You may need to increase your hardware specification or separate the anti spam on another machine.

Note : The above configuration has been tested on Zimbra 5.0.21 on openSUSE 11.1

PCMAV has officially launched their update for version 1.93. The third update added 12 new virus definition. To help anyone who need the anti virus (I’m using openSUSE and my system do not need anti virus, especially anti virus for Windows ), I’m placing direct link for download the anti virus. I decided to give a direct link download because I too tired to download from free public server who need so many click, weird ads and slow connection only for downloading the file

Below is a virus definition list added into  PCMAV 1.93 Update Build3 :
Ahole
Ahole.inf
Aurel
Aurel.vbs.B
Autoit.CL
Autoit.CM
Autorunme.D
Dungcoi.D
Gerubug
Hidea
LoveStory.B
Nabe.A
Nabe.B
Nabe.C
Nginul.B
PisangBakar
PisangBakar.B
PisangBakar.bat
PisangBakar.txt
Recycler.Q
Recycler.Q.inf
Recycler.R
Recycler.S
Vfp
Vfp.bat
Vfp.inf
Vires.H
Vires.I
Wordhb
Xlove
Yeanqin
Yuyun.vbs.C

Need PCMAV for Virus Removal ? Download Here

To obtain and use PCMAV update, simply download the .vdb file and replace the existing one on current PCMAV folder. Beside this method, PCMAV also has auto-online update feature and probably it was the easiest way to update your current virus databases if you have direct internet connection.

This update included Rieysha virus and it’s variants, known as Rieysha-Prisa. List of additional virus library included on PCMAV 1.8 Update Build 3 : Anjerit, Autoit.BR, Autoit.BS, Bungas.bat, Bungas.bgs.A, Bungas.bgs.B, Bungas.bgs.C, Bungas.inf, Bungas.vbs, Crashy, Crashy.inf, Dhetya, Ginga, Ginga.jpg, Hikhik, Joker, Joker.inf, Joker.txt, Keybd, Plolonk, Plolonk.inf, Plolonk.jpg, Rieysha-Local, Rieysha-Lokal.doc, Rieysha-lokal.htt, Rieysha-Lokal.ini, Rieysha-Prisa, Rieysha-Prisa.inf, Rieysha-Prisa.ini, Rieysha-Prisa.vbs.A, Rieysha-Prisa.vbs.B, Starkid, Starkid.exe, Starkid.inf, Starkid.txt

Download Link :

1. PCMAV 1.8 Virus Database Update Build 3
2. PCMAV 1.8 RTP & Cleaner Update 2 (Download the update build 3 to combine latest viruses database)

The easiest way to update the virus database is using online update. Disable PCMAV Real Time Protector for temporary used, launched the PCMAV Cleaner (PCMAV-CLN.exe) and then the Cleaner will automatically detected the update. Download the PCMAV.vdb file and replace the old vdb

If you have no direct internet connection, download the virus database from this link and then move to your PCMAV folder.

Indonesian computer magazine, PC Media has released their 11/2008 issue and attaching PCMAV 1.8 on the DVD beside Microsoft Visual Studio 2008 Express Edition SP1. PCMAV mostly becoming the leading and most popular virus removal in Indonesia because it was only a small size (approximately 2.4 MB), frequently updated and has great capabilities for searching and finding local virus.

The last update in November 2008 has added about 773 of viruses. Some virus with special removal process has also added with special cleaner engine to removing the virus and recover infected document. You can run PCMAV alone or expanding virus database by adding Clamav engine.

What’s New ?

• Added database with 73 viruses characteristics and cleaner, most of them are local viruses in Indonesia. Totally 2254 viruses and it’s variant could be detected
• Special cleaner engine for Tiara-Alimah and Virgear viruses
• Improve false alarm heuristic failure on some program
• Updating virus description

Download PCMAV 1.8, here. Use Cleaner for scanning viruses and the RTP version for Real Time Protection.