Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Timestamp modified by scheduled or manual scan in ScanMail for Exchange (SMEX)

    • Updated:
    • 25 Jun 2018
    • Product/Version:
    • ScanMail for Exchange 11.0
    • ScanMail for Exchange 12.0
    • ScanMail for Exchange 12.5
    • Platform:
    • Windows 2000 Advanced Server
    • Windows 2000 Server
    • Windows 2003 Enterprise
    • Windows 2003 Standard
    • Windows 2008 Enterprise
    • Windows 2008 Standard
    • Windows 2008 Standard 64-bit
    • Windows 2012 Server Essentials
    • Windows 2012 Standard
Summary

In SMEX, when a Scheduled or Manual Scan runs, the timestamp on the email is modified. Some email backup or archiving system may be affected.

Details
Public

When performing Manual or Scheduled Scan, SMEX adds timestamps for the scanned items. This timestamp is necessary to confirm whether a particular message is scanned or not. As an example, if you select the option "Scan messages that have not been scanned" on Manual Scan/Scheduled Scan, SMEX will check the timestamp to confirm whether the corresponding message has been scanned or not.

This behavior of adding a timestamp affects email backup and email archive. These features work based on the message's last changed time.

For Exchange 2013 or Exchange 2016:

  • "AV stamp" on Transport level and store level.
    • On transport level real-time scan, after smex scans a message, it will add AV stamp. The AV stamps used by the Exchange Transport are stored in spoofing protected X-headers "X-MS-Exchange-Organization-AVStamp-Mailbox".
    • On manual/schedule scan, after smex scans a message, SMEX will add MAPI property "SMEX virus stamp" as the AV stamp.
    • Both of them are used when checking whether a message is scanned by SMEX or not.
  • When manual/schedule scan is set to scan all messages, SMEX will add the "SMEX virus stamp" for all messages. So all message's last modified time will be changed.
    If manual scan is set to "only scan unscanned message", SMEX will only scan the messages that are not scanned by real-time scan or manual/schedule scan. And add the "SMEX virus stamp" for messages that doesn't have AV-stamp or "SMEX virus stamp". So the messages that have scanned before, the last modified time will not be changed.

For Exchange 2010:

  • On transport level real-time scan, after smex scans a message, it will add AV stamp as the X-header "X-MS-Exchange-Organization-AVStamp-Mailbox".
  • Exchange Store sets an AV stamp on a message or on a folder after manual/schedule scan.

According to the current situation, there is no workaround to avoid email time stamp changing by manual/scheduled scan. As a workaround, check if you can set to detect the receive time to archive the email.

Premium
Internal
Rating:
Category:
Troubleshoot; SPEC
Solution Id:
1114571
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.