Virus Quarantine

Whenever one of SmarterMail's antivirus engines — ClamAV, Microsoft Defender, Cyren Zero-Hour Antivirus, or a custom command-line antivirus integration — identifies a message as infected and its configured action is set to Quarantine, the message is pulled out of normal delivery and placed in the Virus Quarantine. This holding area is what separates a detected virus from an actual incident: instead of silently deleting a message (which could be a false positive) or delivering it (which could infect a mailbox), SmarterMail sets it aside so an administrator can inspect it, confirm the detection, and decide what to do next.

Messages are held in Virus Quarantine for 30 days before they are automatically and permanently deleted from the server. Unlike many other retention values in SmarterMail, this 30–day period is a fixed, hard-coded value in the product — it is not a setting that can be changed from the interface or an API call, regardless of what an older configuration screen or legacy web service parameter may suggest. If a message needs to be kept longer than 30 days, it must be moved out of quarantine (see Move Messages below) before that window expires.

Inbound and Outbound Coverage

A key distinction between Virus Quarantine and Spam Quarantine is directionality. Spam Quarantine only ever holds outbound messages — typically mail sent by a compromised or spam-sending account inside your server — because inbound spam is normally rejected or tagged at the gateway rather than quarantined. Virus Quarantine, on the other hand, is not restricted to a single direction: both inbound messages (arriving from the internet, destined for a local mailbox) and outbound messages (originating from a local user, destined for delivery elsewhere) can be quarantined here if they're flagged as infected.

For example, if an external sender emails one of your users a Word document containing a macro virus, ClamAV can catch it on the inbound side and quarantine it before it ever reaches the mailbox. Likewise, if a local user's account is compromised and starts sending infected attachments to outside recipients, that outbound traffic can also be caught and quarantined — protecting your server's sending reputation as well as the external recipients.

Note: Whether inbound, outbound, or both directions are actually scanned depends on the Antivirus configuration for each individual engine (Defender, ClamAV, Cyren, and command-line AV can each be enabled or disabled independently for scanning messages with attachments and messages without attachments). If an engine's action for a detected virus is set to Delete Message or No Action instead of Quarantine Message, infected messages caught by that engine will never appear here — they'll be deleted outright or passed through, respectively.

The Virus Quarantine tab displays messages that have been flagged and quarantined by SmarterMail's antivirus measures, including add-ons, if enabled. The following details can be seen for each entry:

File Name - The unique name of the EML file on the hard disk of the SmarterMail server.
Date - The date and time the message was flagged for quarantine.
Sender - The email address that initially sent the email.
Recipients - The number of delivered/total recipients.
Size - The total size of the message on the hard drive, in kilobytes.
Attempts - The number of delivery attempts that have been made.
Time in Spool - The amount of time the message has been quarantined.
Time of Removal - The date and time that a message will be automatically removed from quarantine and permanently deleted.

To view the contents of a message or its intended recipients, click on the entry's row. The email will load in a popup window.

Note: The message is displayed as "text only", and any formatting is removed in order to ensure nothing malicious runs once the message is opened. This protects the administrator reviewing the message: since the content may still contain an active exploit or malicious script, stripping HTML rendering, embedded images, and other active formatting prevents the preview itself from becoming an infection vector.

The following actions can be taken on selected entries using the Actions (⋮) button:

Resend - Moves the selected message(s) to the spool for delivery to its intended recipients.
Note: Resending a quarantined message releases it with an internal bypass flag that skips re-scanning by ClamAV, Cyren, and Microsoft Defender on its way back through the spool. In other words, resending does not re-check the message for viruses before delivering it — it assumes the administrator has already reviewed the message and confirmed it is safe (or accepts the risk) before choosing to resend. Only use Resend after you've verified the message and file attachments yourself; if you're unsure, consider using Move Messages or Download EML to inspect the message with a dedicated antivirus tool first.
Move Messages - Moves the location of the selected message(s) from the general email directory to a new path on the server. Use the default path provided or enter any folder path on the server. For example, it's possible to move messages to a "Moved Items" folder within the Spool folder using this path "C:\SmarterMail\Spool\MovedItems\". Moving the .eml files to their own folder on the server is useful because it allows an administrator to review the messages before taking actions against them. While it is possible to move quarantined messages to another user's folder (the folder path would look like "C:\SmarterMail\Domains\[Domain.com]\Users\[Username]\Mail\[Folder Name]\"), this isn't recommended as these messages have been flagged as possibly containing viruses; moving them to a user folder could "enable" any virus contained in a message if it's not handled properly.
Download EML - Allows you to download the raw EML file for the message.
Delete / Delete All - Remove the selected message(s), or all messages, from the quarantine list.

Important Notes:

Virus Quarantine settings are managed on the Antivirus page. For more information, refer to the Antivirus page.
Spam Quarantine and Virus Quarantine tabs will only load a maximum of 5,000 messages combined. (E.g., 2,000 Spam Quarantine items displayed and 3,000 Virus Quarantine items displayed - together they'll never show more than 5,000 messages). That means that if the two numbers add up to 5000, it's very likely there are MORE than the number of individual emails for each Quarantine type than can be displayed. If there are, they will need to be reviewed/handled from within the appropriate directory on the server.