SYMPTOMS

In the antivirus log file one of the following errors occur: 

Error scanning attachment - Command Line Scanner Process ([command line]) took too long and was terminated

Error scanning attachment - Command Line Scanner Proces ([command line]) took too long and needed to be terminated, but failed with error

This may also leave temporary files in the Scratch directory. These files may be left, as when the MTA service tries to terminate the process and continue, the temporary files may be locked, or the process is still active.

CAUSE

The anti-virus command line scanner is taking too long to check an email.

RESOLUTION

This error usually indicates that there are anti-virus command line processes timing out. By default plugins will time out after 20 seconds. To resolve the issue firstly try to reduce the number of threads that the MTA service uses. A large number may be causing delays plugins. Otherwise raise the timeout setting to accommodate how long the process should wait for the anti-virus command line scanner before timing out. The registry setting found in this Windows registry key location:

For 32bit servers:

HKEY_LOCAL_MACHINE\SOFTWARE\Mail Enable\Mail Enable\Agents\MTA\Filters

For 64bit servers:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mail Enable\Mail Enable\Agents\MTA\Filters

Select Filters, and in the right hand side pane, locate the value labelled "Process timeout". This setting is in milliseconds. Edit this and restart the MTA service.