This article explains how to setup and integrate McAfee VirusScan Enterprise 8.7i within MailEnable for virus scanning.

Step 1: Installing and Configuring McAfee VirusScan Enterprise 8.7i

• Download McAfee VirusScan Enterprise 8.7i from the McAfee website: http://www.mcafee.com
• Ensure that any resident or real-time protector capabilities of the antivirus application have been disabled (or all the MailEnable directories have been excluded from being protected by the software).

 As a general rule, consider the following:

• Exclude MailEnable "Queues" and the "Config" Directories from the resident/real-time monitoring.
• Disable the resident/real-time monitor if exclusion of MailEnable directories is not possible within the antivirus application.

Please download the respective registry import file for the McAfee VirusScan Enterprise 8.7i MailEnable Antivirus plug-in:

64 Bit versions of Windows: http://www.mailenable.com/utilities/addons/mcafee64.zip

32 Bit versions of Windows: http://www.mailenable.com/utilities/addons/mcafee.zip

• Double click the registry import file to add the updated McAfee plug-in settings to the MailEnable Antivirus plugin window.
• Open the MailEnable Administration program. Expand: Servers > Local host > Extensions branch, select the "MailEnable Message Filter" icon, then select the "MailEnable Antivirus Filter" item in the list which appears on the right side panel.
• Select "McAfee VirusScan" from the list of available antivirus applications.
• Make sure that the "Enable" (or "Enable selected antivirus") is selected. It is possible to enable more than one antivirus application on the server, but this will affect the number of messages that can be scanned over a period of time.
• Save changes within the McAfee Antivirus plugin window and restart the MTA agent.

Step 2: Creating an antivirus filter within the MailEnable administration console

In versions 3.x onwards MailEnable introduced a spam protection filter which is enabled by default when you install MailEnable. The spam protection script will score the message with a 100 positive weighting and mark the message as spam if an infection is found by the command line scanner. The infected attachment will automatically be removed by the command line scanner. More information in regards to the spam protection filter can be found within the MailEnable documentation or the following knowledgebase article: Article ME020391

However if you are configuring the McAfee VirusScan Enterprise 8.7i on a MailEnable version 1.x or 2.x (Pro or Ent) and require actions to be performed based on message infection then this will require the creation of a global filter in the MailEnable Administration program that detects when the message contains a virus and deletes the message or quarantines it, notifies sender, etc.

NOTE: A global filter can also be created in MailEnable versions 3.x and 4.x (Pro and Ent).

To create an antivirus filter:

• Open the MailEnable Administration Program.
• Right click on the Messaging Manager>Filters branch and create a new filter.
• Name the filter "Antivirus Filter" (without the quotes).
• Next double click the newly created filter in the right hand side pane window and check the criteria: "Where the message contains a virus".
• Create the actions that are undertaken when the virus is detected by clicking on the "Add Action" button (e.g.: Copy the message to the Quarantine directory or Delete Message).

Testing antivirus configuration

Test the configuration by emailing yourself the Eicar test virus from http://www.eicar.com. To perform more advanced testing and debugging, follow the details in this knowledge base article: Article ME020085

The MailEnable Antivirus log files are located under: Servers > Local host > Extensions > MailEnable Message Filter > logs > Antivirus

MailEnable antivirus overview: Article ME020389

Which antivirus solution to use with MailEnable: Article ME020144

Debugging the anti-virus support and the Mail Transfer Agent: Article ME020121

REFERENCES

McAfee Help and support: https://support.mcafee.com