Summary
Sometimes, the Security Risk Scan Log of ScanMail for Exchange (SMEX) shows a gap between the Scan Time and Delivery Time.
Here is an example:
Click image to enlarge.
Details
The Delivery Time shows when the email arrives while the Scan Time shows when the malware is detected on the email. The gap between these two can be minimized if the malware is immediately detected by the Real-Time Scan. If you are using Scheduled Scan or Manual Scan, there can be a delay for several hours or days.
The following are the three (3) types of scanning in SMEX:
- Real-Time Scan
- Scheduled Scan
- Manual Scan
When an email arrives, it is scanned by the Real-Time Scan. However, a malicious email may passed through the Real-Time Scan if the detection is not yet in the pattern file. The malicious email will just stay in the Exchange unless it is deleted. When the detection for malicious email is added to the virus pattern, the Scheduled or Manual Scan can detect the malware.
Therefore, the time difference between the Delivery Time and Scan Time occurs because the malware is not detected by the Real-Time Scan due to the virus pattern which does not contain the malware signature. When the newly released pattern adds the malware signature, the Manual or Scheduled Scan will detect the malware.
