Antivirus

SmarterMail supports multiple, layered methods of antivirus protection for securing your mail server. The default installation includes, at no additional cost, effective and self-updating antivirus protection with ClamAV, plus integration with Microsoft Defender. SmarterMail also supports Cyren Zero-Hour Outbreak Detection as a paid add-on and can integrate with third-party solutions through a command-line execution hook. In addition, each engine can be configured to quarantine messages that are suspected of containing a virus, and, using system events, SmarterMail can respond to senders that attempted to send an email containing a virus.

From an email processing standpoint, when all forms of antivirus are in use (or even if just one or two are used), the "order of operations" for antivirus is as follows:

Microsoft Defender Antivirus
ClamAV
Cyren Zero-Hour Outbreak Detection (if enabled)
Command-Line Antivirus

Also, in order to preserve resources, antivirus checks will stop as soon as a virus is detected by the FIRST antivirus solution. For example, if a third-party product detects a virus in the spool or in an uploaded file, any other antivirus programs will not process the same message.

When accessing Antivirus settings, the following options will be available.

Note: The virus Quarantine Directory — or Quarantine Path — is part of the General Settings. This is simply the folder on disk where quarantined .eml files are physically stored; it is not, by itself, a switch that turns quarantining on or off.

Where Virus Quarantine Is Actually Enabled

There is no single, global "Enable Virus Quarantine" checkbox on this page. Instead, whether an infected message is quarantined, deleted, or passed through untouched is decided independently for each scanning engine via that engine's When Virus is Found in Spool dropdown (documented under each engine below). Setting an engine's action to Quarantine Message is what actually enables quarantining for viruses that engine detects; setting it to Delete Message or No Action means messages caught by that engine will never reach the Virus Quarantine tab on the Spool page at all. Because each engine has its own dropdown, it's entirely possible to quarantine viruses caught by ClamAV while, say, deleting those caught by Cyren, if that better fits your risk tolerance.

Note: Regardless of which engine(s) quarantine a message, the retention period is a fixed 30 days. This value is hard-coded in the product and is not configurable from this page, the General Settings page, or any API — after 30 days in quarantine, the .eml file is automatically and permanently deleted unless an administrator has already moved or resent it. Older legacy web service definitions may reference a configurable quarantine length (for example, a 0/15/30-day option), but that value is not actually read or honored by the current product; 30 days is always used.

Note: If an engine's action is set to No Action, an infected message is not quarantined and not deleted — it continues through the spool and is delivered to its recipient(s) as if it were clean. The detection is still logged and reflected in antivirus reporting, but no protective action is taken on the message itself. Because of this, No Action should generally be reserved for testing or diagnostics rather than production use.

Microsoft Defender Antivirus

Microsoft Defender is part of the default installation for most Windows server operating systems and delivers the comprehensive, ongoing, and real-time protection you expect against software threats like viruses, malware, and spyware across email, apps, the cloud, and the web. SmarterMail ties into the antivirus portion of Defender to offer an added layer of protection system administrators can employ. (If Microsoft Defender is not supported, a note is displayed letting the system administrator know.)

Scan Uploaded Files - Enabling this will scan all files uploaded to File Storage, group chat, online meetings, and attachments to outgoing messages composed in webmail. Enabled by default.
Scan Messages With Attachments - Enabling this will only scan incoming or outgoing messages that are sent through the SmarterMail spool that have attachments. Attachments are scanned as well. Enabled by default.
Scan Messages Without Attachments - Enabling this will only scan incoming or outgoing messages that are sent through the SmarterMail spool that do NOT have any files attached. Enabled by default; Defender's real-time engine is fast enough that scanning attachment-free messages carries little overhead.
When Virus is Found in Spool - This dropdown allows you to select what you want done with a message if Microsoft Defender detects it contains a virus. Quarantine Message is the default action. These options include:
- No Action - Do nothing with the message.
- Delete Message - Delete the entire message.
- Quarantine Message - Move the message to the quarantine folder on the server. These messages can then be found on the Virus Quarantine tab on the Spool page. By default, messages remain in quarantine for 30 days, after which time the .eml is deleted, unless other action is taken to move the message out of quarantine.

ClamAV

ClamAV is a third-party open source antivirus toolkit that is included, at no additional cost, in the default installation of SmarterMail. Rather than requiring administrators to install and manage ClamAV separately, SmarterMail bundles the ClamAV engine (clamd) and runs it as a local scanning service, communicating with it over a TCP socket — which is why the IP address and port settings below default to localhost. For more information on ClamAV, visit: www.clamav.net

Note: ClamAV's virus definitions are kept current using ClamAV's own freshclam update utility, which SmarterMail runs automatically on a fixed 6-hour interval; the last updated date/time is displayed on the card. This 6-hour interval is not configurable. To manually force an update of the ClamAV definitions outside of that schedule, click on the Actions (⋮) button and select Update ClamAV Definitions.

Scan Uploaded Files - Enabling this will scan all files uploaded to File Storage, group chat, online meetings, and attachments to outgoing messages composed in webmail.
Scan Messages With Attachments - Enabling this will only scan incoming or outgoing messages that are sent through the SmarterMail spool that have attachments. Attachments are scanned as well. Enabled by default.
Scan Messages Without Attachments - Enabling this will only scan incoming or outgoing messages that are sent through the SmarterMail spool that do NOT have any files attached. Enabled by default.
When Virus is Found in Spool - This dropdown allows you to select what you want done with a message if ClamAV detects it contains a virus. Quarantine Message is the default action. These options include:
- No Action - Do nothing with the message.
- Delete Message - Delete the entire message.
- Quarantine Message - Move the message to the quarantine folder on the server. These messages can then be found on the Virus Quarantine tab on the Spool page. By default, messages remain in quarantine for 30 days, after which time the .eml is deleted, unless other action is taken to move the message out of quarantine.
ClamAV is on a remote server - Enable this setting if you are pointing SmarterMail at a ClamAV instance running on another machine, rather than using the local, bundled installation. This is common in larger or clustered environments where a dedicated scanning server handles antivirus duties for multiple mail servers.
IP Address - The IP address of the ClamAV server to use. When running ClamAV as part of the SmarterMail install, this will default to localhost. (127.0.0.1)
Port - The port that the ClamAV server is listening on. When running ClamAV as part of the SmarterMail install, this will default to port 3310.
Timeout (Seconds) - The maximum number of seconds SmarterMail should wait for ClamAV to respond before moving on to the next message. By default, the timeout is 10 seconds. If ClamAV consistently fails to respond within this window — for example, on an overloaded server with a large backlog of messages — raising this value can reduce false timeout failures, at the cost of holding messages in the scan queue slightly longer.
Failures Before Disable - The number of consecutive ClamAV scan failures (typically timeouts) that will cause SmarterMail to automatically restart the local ClamAV service in an attempt to recover it. By default, this is set to 5 consecutive failures. This setting only has an effect when using the local, bundled ClamAV installation; when ClamAV is on a remote server is enabled, SmarterMail has no local ClamAV process to restart.

Cyren Zero-Hour Outbreak Detection

Cyren Zero-Hour Outbreak Detection is a paid add-on, licensed separately from SmarterMail, that uses Recurrent Pattern Detection to identify "zero hour" — that is, recently released — viruses based on their unique distribution patterns, providing a complementary shield to the built-in antivirus technologies covered above. In addition, by offloading the intensive CPU cycles onto Cyren's servers, you're protected from outbreaks the moment they occur with zero impact on your own server's resources. Because it's cloud-based rather than a local scanning engine, Cyren is often able to flag brand-new outbreak patterns before local signature databases like ClamAV's have been updated to catch them.

Scan Messages With Attachments - Enabling this will only scan incoming or outgoing messages that are sent through the SmarterMail spool that have attachments. Attachments are scanned as well. This is enabled by default.
Scan Messages Without Attachments - Enabling this will only scan incoming or outgoing messages that are sent through the SmarterMail spool that do NOT have any files attached. This is disabled by default, since attachment-borne viruses are the far more common vector and scanning plain-text messages provides limited additional protection.
When Virus is Found in Spool - This dropdown allows you to select what you want done with a message if Cyren detects it contains a virus. Quarantine Message is the default action. These options include:
- No Action - Do nothing with the message.
- Delete Message - Delete the entire message.
- Quarantine Message - Move the message to the quarantine folder on the server. These messages can then be found on the Virus Quarantine tab on the Spool page. By default, messages remain in quarantine for 30 days, after which time the .eml is deleted, unless other action is taken to move the message out of quarantine.

Command-Line Antivirus

Administrators can integrate SmarterMail with third-party antivirus programs via a command-line execution. This can be an efficient solution for high-volume mail environments by reducing the burden on the mail server itself.

Once a message comes into the SmarterMail spool, it will then be scanned for viruses using the command-line antivirus and any built-in antivirus measures that have been enabled in SmarterMail. If the command-line scanner picks up a virus, it will be up to the command-line antivirus program to delete/quarantine the message according to the application's configuration.

Note: Unlike Microsoft Defender, ClamAV, and Cyren, there is no When Virus is Found in Spool dropdown for command-line antivirus. SmarterMail simply invokes the external program and relies on that program's own exit behavior and configuration to decide what happens to the scanned file; SmarterMail does not move messages caught by a command-line scanner into its own Virus Quarantine. If you need infected messages to land in SmarterMail's Virus Quarantine tab for administrator review, use Microsoft Defender, ClamAV, or Cyren with their action set to Quarantine Message instead.

Scan Uploaded Files - Enabling this will scan all files uploaded to File Storage, group chat, online meetings, and attachments to outgoing messages composed in webmail.
Scan Messages With Attachments - Enabling this will only scan incoming or outgoing messages that are sent through the SmarterMail spool that have attachments. Attachments are scanned as well.
Scan Messages Without Attachments - Enabling this will only scan incoming or outgoing messages that are sent through the SmarterMail spool that do NOT have any files attached.
Script File Name - Enter the name of the file that contains the script for the antivirus program. For example, if you'd like to integrate with ESET Endpoint Antivirus on Windows, you might create a script named "eset_endpoint.py" that references the following:
```
C:\Program Files\ESET\ESET Endpoint Antivirus\ecls.exe /base-dir="C:\Program Files\ESET\ESET Endpoint Antivirus" /aind /arch /sfx /adware /clean-mode=Delete %FILEPATH
```

Note:

%FILEPATH will be replaced with the path to the file to be scanned.
When using a Command-Line file, the file must be located in the Assets folder located within the SmarterMail Service folder. In Windows, the default location is "C:\Program Files (x86) \SmarterTools\SmarterMail\Service\Assets" and in Linux the default location is "/opt/smartermail/assets" .