Topic Last Modified: 2005-11-18
The Microsoft® Exchange Server Analyzer Tool queries the Win32_Service Microsoft Windows® Management Instrumentation (WMI) class to determine the value of the Started key for the ScanMail_RealTimeScan service. A value of True indicates the ScanMail_RealTimeScan service is started, and a value of False indicates the ScanMail_RealTimeScan service is not started. The ScanMail_RealTimeScan service is a component of the Trend Micro ScanMail for Microsoft Exchange application. Trend Micro ScanMail for Microsoft Exchange provides antivirus protection for Exchange.
In addition, the Exchange Server Analyzer reads the following registry entry to determine the setting for the Enabled value:
HKEY_LOCAL_MACHINE\Software\Microsoft\Exchange\TransportAVAPI
A value of 1 for Enabled indicates that transport-level antivirus scanning (sometimes referred to as Simple Mail Transfer Protocol (SMTP) scanning) is enabled, and a value of 0 indicates that SMTP scanning is not enabled.
If the Exchange Server Analyzer finds Enabled set to 1, and the value of the Started key for the ScanMail_RealTimeScan service set to True, a warning is displayed.
This warning indicates that messages flowing through this Exchange Server computer are being scanned twice by the same application and virus scanning engine. Scanning the same message twice as it moves through the transport and storage components of Exchange Server needlessly consumes resources and does not provide any extra protection or benefits. It is recommended that you keep Virus Scanning API (VSAPI) virus scanning enabled, and disable SMTP mail scanning using the ScanMail Management Console.
It is generally recommended that you deploy antivirus software designed for messaging systems at either the SMTP gateway or at the Exchange servers that host mailboxes. For the most protection, run antivirus software at the gateway that scans the inbound MIME messages and a scanner on the Exchange Server that uses VSAPI 2.5. In addition, you should be running client antivirus software on the user desktop. If you are running antivirus software designed for messaging systems (it can parse and scan MIME) at the gateway or on the Exchange server, running a file-level scanner at the desktop is sufficient.
To correct this
warning
-
Open the ScanMail Management Console and enter your logon credentials.
-
On the Virus Scan | Options page, ensure that the Enable VS API virus scanning check box is selected.
-
On this same page, clear the Enable SMTP mail scanning check box.
-
Click Apply to save your changes.
-
Close the ScanMail Management Console.
For more information about Trend Micro ScanMail for Microsoft Exchange, see the Trend Web site (http://kb.trendmicro.com/solutions/search).
 Note: |
|---|
| Web addresses can change, so you might be unable to connect to the Web site or sites mentioned here. |
For more information about using antivirus software with Exchange Server, see the following Microsoft Knowledge Base articles:
- 328841, "XADM: Exchange and Antivirus Software" (http://go.microsoft.com/fwlink/?LinkId=3052&kbid=328841)
- 823166, "Overview of Exchange Server 2003 and antivirus
software" (http://go.microsoft.com/fwlink/?LinkId=3052&kbid=823166)
- 306105, "XGEN: Microsoft's Position on Antivirus Solutions for
Exchange 2000" (http://go.microsoft.com/fwlink/?LinkId=3052&kbid=306105)
- 245822, "Recommendations for troubleshooting an Exchange
computer with antivirus software installed" (http://go.microsoft.com/fwlink/?LinkId=3052&kbid=245822)