Scan Incoming Messages for Computer Viruses
Regardless if you use our Anti-Virus-Scanner-Interface or
If you run a file-level anti-virus package on the machine where
Pytheas.Mailgate service is installed,
you should create a folder for temporary storage of incoming messages, then
make a reference to this folder on the
Service options / Incoming mail
tab in the Configuration Program (this is possible with v.2.30 and
later). Exclude this folder from the virus scan.
Il you have an anti-virus package able to use the virus-scanning-interface
of your mail server, you do not need the anti-virus interface built into
Il you have an anti-virus package able to scan at SMTP
level, we recommend using this feature, and insert the virus scanner between
PYTHEAS MailGate and your mail server: on the Your mail server
page in the PYTHEAS MailGate Configuration Program, configure
the IP address/port of the incoming SMTP interface of your virus scanner. Have the
virus-scanner forward the mail to your mail server.
If your anti-virus package does not have any of the features mentioned above, you
may be interested in the anti-virus interface built into PYTHEAS MailGate,
carry on reading.
What do you need?
- A real-time, server-based virus scanner which you hopefully already have
somewhere in your network, protecting one of your file servers. Your virus
scanner should be able to analyze MIME encoded messages in its real-time scan,
and preferably zip archives. If you are in doubt, go on reading - you will
find out later.
- PYTHEAS MailGate version 2.30, or later.
Configure virus scanning of incoming messages
Virus scanner and
Pytheas.Mailgate service (the Communication Task) on the
- Very important: define a folder for temporary storage of incoming messages on the
Service options / Incoming
tab. Exclude this folder from the virus scan.
- Create another folder where the virus scan should be performed, and select this
folder on the
Content checking / Virus check / Virus scanner
Virus scanner and
Pytheas.Mailgate service (the Communication Task) on
- Create a folder where the virus scan should happen, on the machine with the running virus scanner.
folder, give R/W permissions to user account which will be used to start the
Pytheas.Mailgate service (see below).
- On the Content checking / Virus check / Virus scanner
page, configure access to this shared
folder in UNC notation (
\\Server\Share\Folder); avoid using a drive letter.
Pytheas.Mailgate service accesses this shared folder through the network. To make this
possible, please configure the
Pytheas.Mailgate service to start
up with a "real" user account, which has R/W
permissions in the shared folder. By the way, this user account also needs R/W
permissions in the
Program files/PytheasMailgate folder and its subfolders
(and maybe the SpamAssassin subsystem, too).
Configure the virus-scanning software
Configure the way the real time scan (on-access-scan) is performed in the
- scan MIME encoded messages (this is mandatory),
- check inside archives (this is optional). Set it to 2 levels deep, as in some virus
scanning packages the MIME encoding counts for one level already. So zip
archives inside MIME encoded messages should be scanned for viruses.
Checking folder name (C:\Temp\VCheck)...
- Ok, folder found.
Checking C/R/W/D permissions in C:\Temp\VCheck...
- Permissions ok.
Make test message with attached EICAR virus (C:\Temp\PmgTmp\EICAR.tmp)...
Copy test message to folder watched by the virus scanner...
- Done. File name: C:\Temp\VCheck\pmg-vcheck-EICAR.msg
- Test message swallowed by the virus scanner.
- Ok, this is what should happen.
Go to the Try tab on the Virus check configuration page.
This will submit a
message "infected" by the harmless EICAR virus to your virus scanner.
If your real-time virus scanner and PYTHEAS MailGate work together as
expected, you should get a result similar to the text on the right.
In case something does not work as expected, it will try to give you some idea
what to check.