How does antivirus API work?

[Pavel Nagaev]

Dear newsreaders,

I have Front-end and Back-end configuration. Antivirus
software(doesn't matter which one) is installed on both of them. Lets assume
that it could check files and messages using antivirus API.

When message arrived on Front-end server it will be saved by SMTP server in
IIS directory QUEUE as file *.eml.

1. Will antivirus check this file in this moment? If yes, will it check only
as file?
2. Can antivirus check this file if it encoded with MIME?(I mean could it
recognize that it is a MIME format, decode it and scan for viruses)

Then message will be opened with SMTP IIS and will be sent to SMTP server to
Back-End server.
3. I think antivirus check this file *.eml only in this moment. Is it true?

Antivirus will not check message on Front-Server as message because
Front-End will not save it in message store.
4. Is that correct?

5. Antivirus will check the messages in real-time using antivirus API only
when they are stored in message store. Correct?

I want to find out if there is not mailboxes on front-end server it means
that you don't need to install antivirus on server or install it only for
system protection (not mail).

Best Regards

Pavel Nagaev

Mail server administrator, MCSA/MCSE
Caspian Pipeline Consortium
Novorossiysk, Russia

Mobile phone: (8617) 65 09 01
Office phone: (8617) 64 25 53 ext. 74046
Fax: (095) 7975990 ext. 5848

[brian.e...@hotmail.com]

I think you should check out http://www.opswat.com/ there are 2 or 3 products that may be a match, I think that OESIS Framework at http://www.opswat.com/products/oesis-framework provide a single interface to many antivirus packages, another option is I think Metascan at http://www.opswat.com/products/metascan which is more for ISV, I also found that many antivirus engines certified by OPSWAT at http://www.opswat.com/certified.

I hope this helps.

Regards,


B.E.