MailEnable Professional Guide
Configuring the antivirus filter
Message Filtering > Antivirus filtering > Configuring the antivirus filter

The administration of antivirus filters can be accessed via selecting the properties of the MailEnable Antivirus Filter within the MailEnable administration program. It is possible to select which antivirus applications are used to analyze messages as they pass through the Mail Transfer Agent.

Once the Antivirus agents have been configured to be used by the server, they can be used by specific filters.

The configurable properties for antivirus agents are outlined in the following table:

Setting

Description

Enable antivirus/filter support

Enables or disable all antivirus and other filters that may be installed for MailEnable.

Enable selected antivirus/filter

Indicates that the currently selected virus checker or filter will scan emails. It is possible to enable more than one antivirus/filter at once.

Options

Sets the advanced options for the currently selected antivirus application.

Test

Tests the currently selected antivirus program by writing out the test Eicar virus and determining whether the command line scanner can detect it. Be aware that this may not work with all command line scanners (Symantec’s Norton's Antivirus Corporate Edition is one of these). For scanners that do not work with the test button, check whether the antivirus program is functioning by running the MTA in debug mode.

Antivirus options

Setting

Description

Program Path

The path to the virus checker application. Only select the command line scanner for the antivirus application (the presets in MailEnable will point to the correct application).

Command line arguments

The command line arguments that are used to run the antivirus scanner. There should be no need to change these options unless adding your own antivirus scanner (i.e. not a preset).

Command line arguments will delete attachment

Selecting this will require that the command line scanner to delete any infected attachment. Some virus scanners cannot remove zip files that are infected with viruses using this option.

Return code will be checked against this list

This option will make MailEnable check the return code from a command line scanner. If the return code matches the return codes items in the list, then the attachment is detected as a virus. It is not possible to use any command line argument that deletes the attachment when this option is selected. Use the “any” keyword in order to check for any return code (i.e. other than 0)

Return code check

Choose to detect the attachment as a virus if the return code is a number other than those in the list.

It is not advisable to notify the sender that the have an infected email. When a virus is sent via email, it will usually use a different senders address that it randomly picks from the infected machine. So by sending notifications back to the sender address it is probably not being sent to someone who is infected.

Also consider that virus-scanning email adds more load on the server. This is because the antivirus filter must extract and test every attachment that goes through the server. It is advisable to adjust the MTA maximum transfer threads under the MTA properties to ensure that the number of concurrent instances of virus scan agents is appropriately configured. Consider that each transfer thread could potentially mean a different concurrent instance of the agent’s command line scanner.