Microsoft Exchange Antivirus

[Marshall]

Hi all,

Our Symantec Antivirus with Groupware protection has come to the end of it's subscription and is a three months over due so I cannot renew.
We want to get away from Symantec because of the cost.
The antivirus is for four PC's and a IBM server running Microsoft Exchange and small business server 2003.

I want to know do I have to buy antivirus for MS exchange, or can I just buy antivirus for a file server. Is there a way to scan emails on a mail server without purchasing antivirus for exchange.

Thanks
Marshall

 

[scotty]

Usually you need something exchange-specific if you want real time mail scanning. Regular anti-virus won't usually scan the mail engines.

That said, I usually just run regular AV in conjunction with MX Logic. They scan the email first, and then deliver it to your server. It's nice in that it's highest level service is about $2.75/user per month (so about $165/year for 5 users). It's a top notch spam and AV service, and doesn't bog your email systems down with local scanning tasks. Plus, if your mail server ever goes down, MXL holds/spools the mail until it's back up, so you get real-time server protection as an added bonus. Half the time, I buy it for the backup capabilities - the spam/AV filtering is the bonus.

That's just me, but I've had great success with it.

 

[YeOldeStonecat]

I want to know do I have to buy antivirus for MS exchange, or can I just buy antivirus for a file server. Is there a way to scan emails on a mail server without purchasing antivirus for exchange.

Thanks
Marshall

The traditional desktop/server antivirus you install for the OS, the real time protection is not designed for the Exchange infostore...you should have certain Exchange directories excluded from the real time file protection.

Antivirus "plug-ins" for Exchange scan the mail differently, they are specifically designed for Infostore scanning. Methods such as MAPI, VSAPI, and ESE based scanning of the infostore.

Without purchasing one, you can filter your e-mail via other methods...such as a UTM appliance like Untangle, or Symantec has some, or Sonicwall...most major brands. All SMTP traffic is scanned coming in and out of the internet. However, it cannot protect Exchange itself from a direct hit..say an end user somehow gets a worm on their workstation which spreads through MAPI via their Outlook to Exchange.

Or you can have your mail handled by an SMTP smart host..which washes the mail of spam and viruses before being delivered to your network. But...Exchange still remains a bit vulnerable with the same above situation.

You have Small Business Server. Most antivirus brands make a special bundle for Small Business Server...I know back when I resold Symantecs Corp Edition they had one. I work with Esets NOD32 and they also have a special SBS Bundle. The SBS bundles are usually a combo of the managed business edition of the product, as well as the Exchange plugin...all at a reduced "bundle" price.

For your reading, here's a list of antivirus exclusions for Small Business Server, which you should follow for optimal performance.
http://www.sbsfaq.com/Lists/FAQs/DispForm.aspx?ID=137

 

[Monkey]

I would agree with YeOldStoneCat, AV protection on both the server and Exchange would be the order of the day, as they both protect different services.

The recommendation of Untangle is also a good one, as you can have up to 3 AV engines scrubbing mail clear if you were to use ClamAV and the Kapersky (subscription required) offerings on Untangle along with your Exchange based protection.

With mail going through 2/3 AV programs, you *should* get a more consistent cover as they all have different detection rates and update cycles.