External Filters

The External Filters tab allows you to configure IceWarp Server to use any external Antivirus filter(s) that support command-line scanning.

Warning: This feature is provided for backwards compatibility and we strongly recommend that you use the built in antivirus engine provided with IceWarp Serverr. This section shows an example of using the AVGscan command line scanner. The information shown may be incorrect and we do not support these scanners directly. However, you may find information and help on our user-to-user forum at http://forum.icewarp.com/, where you can search for previous posts or interact with a group of very helpful IceWarp Server users.

IceWarp Antivirus allows two ways of external AntiVirus usage:

  • Executable applications
  • Libraries

Note: If you choose to use any external on-access AntiVirus scanner you should exclude the <InstallDirectory>\Temp folder from the scanning as this could cause severe server slowdown and problems with IceWarp Server itself.

Figure. External Filters section.

Field

Description

Add

Click the button to add a new external filter. The External Filter dialog opens.

Edit

Select an external filter and click the button to edit this filter. The External Filter dialog opens.

Delete

Select an external filter and click the button to remove this filter.

Arrows

Select an external filter and use the buttons to move this filter up or down within the list. You can change the order in what filters will be performed.

Figure. Definition in External Filter dialog.

Field

Description

Application

Specify the fully qualified path to the external filter.

Use the '...' button to open a standard file browser dialog.

Type

Select the type of module you are calling:

  • Executable: Choose this for a standard executable module.

  • StdCall Library, Cdecl Library: Choose this to call the filter from a library.

Parameters

Here specify parameters required by the external filter.

Refer to documentation of your filter for further information.

Use return value

Enter values that your external filter returns if a virus is found.

Refer to your filters documentation for this information.

Multiple values should be separated by commas.

Warning: For example, AVGscan issues the following codes:

  • 0 Everything is OK
  • 1 User cancelled/interrupted test
  • 2 Any error during the test – cannot open a file etc.
  • 3 Change identified
  • 4 Suspicion detected by heuristic analysis
  • 5 Virus found by heuristic analysis
  • 6 Specific virus detected
  • 7 Active virus in memory detected
  • 8 AVG corrupted
  • 9 Double extension
  • 10 Archive contains password protected files
  • Codes 4, 5, and 6 indicate a virus (7 is discounted as this virus would not be within a message!)
So we would enter 4,5,6 in this field.

Check for file deletion

Some filters do not return a value, but simply delete the file. If your filter behaves in this manner, select this option.

After the filter is run, IceWarp Server will check whether the file has been deleted and, if it has, will treat the message as it contains a virus.