GFI MailSecurity VS API Exchange 2000/2003 mode

If you have Microsoft Exchange 2000 or 2003, GFI MailSecurity can integrate with Exchange Server via the Microsoft Virus Scanning API (VS API).

What is and why use VS API (Virus Scanning API)?

Exchange 2000 & 2003 provides a new virus scan API that is implemented at very low-level in the Exchange store. This allows a virus scanning application to run with high performance and guarantees that the message will be scanned before any client can access a message or attachment. This low-level access facilitates the elimination of viruses such as the Melissa virus.

In addition, VS API reduces scalability issues that can arise when a particular server has a large number of users/mailboxes. VS-API's real-time scan allows messages and attachments to be scanned once before delivery, rather than multiple times determined by the number of mailboxes the message is delivered to. This single-instance scanning also helps prevent messages from being rescanned when a message is copied. GFI MailSecurity VS API has the following features:

Native MIME/MAPI content scanning
Proactive scanning
Priority-based queuing
Multithreaded queue processing
Per-Messaging Database configuration options
Enhanced background scanning
Event logging
Virus scanning API-specific Performance Monitor counters

Why choose a product based on the VSAPI?

Microsoft strongly encourages the development and adoption of Exchange VS API-based anti-virus solutions

VS API is secure and preserves the integrity of the Information Store and its databases
The Microsoft Exchange product group is committed to providing enhancements to this API, bug fixes, documentation, and technical assistance to ISVs using VS API (as appropriate)
Antivirus solutions using Extensible Storage Engine API or any other undocumented API may corrupt the Information Store and its databases
The Microsoft Exchange product group does not provide any code updates, documentation, or technical assistance to address issues related to the use of a non-VS API-based solution
For Exchange customers using a non-VS API-based solution, Microsoft Product Support Services may ask the customer to uninstall/disable the anti-virus solution to help identify issues, this may delay in final resolution
VS API enhances the current core feature set by providing abilities to optimize and configure the scanning process at multiple levels, as well as providing Exchange administrators with built-in functionality to monitor the performance of the new API

For more information about VS API

You can find more information about VS API on this link:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;q285667

Limitations of using the VS API Exchange 2000/2003 mode

Although VS API is a recommended way to do content checking and virus scanning on Exchange 2000, there are a number of limitations which you need to be aware of as a system administrator:

1. The Virus API only scans information stores. That means that if you have installed GFI MailSecurity for Exchange 2000 on for example a front-end server, no mail will be scanned, because mail is not being stored on the front-end server. In this case, you need to use GFI MailSecurity in SMTP gateway mode.

2. You need to be more careful with applying attachment rules. Some MAPI applications running on Exchange might be using vbs or exe files. You need to ensure that if this is the case, you don't apply rules to quarantine exe or vbs files to mailboxes used by those applications.

3. Outgoing mails that have been approved need to be resent by the user. For example, if an executable is quarantined and approved, the user will get a message saying that he has 24 hours to send that executable. The reason for this is because the recipient of the message is not always known with 100% certainty in VS API mode.