If a message cannot be cleaned, then it should not pass. The SMTP gateway should employ both a scanning engine to detect known viruses, and a heuristics engine. The heuristic engine applies rules to distinguish viruses from non-viruses and help identify virus variants. These toolkits allow for variants to be created and released much faster than antiviral software vendors, and system administrators, can update the anti-virus software. To overcome this problem it should be possible for the anti-virus scanning engine to use what it knows about defined viruses to detect undefined viruses.
Social engineering can pose a serious threat to the e-mail system.
Attackers can also trick unsuspecting users into revealing sensitive data by sending an e-mail posing as a system administrator requesting their user ID and password. Because of these threats, you may want to consider a SMTP gateway scanner that provides content filtering. By looking at the text in a message you can stop specific virus hoaxes. It also allows for the creation of rules that can catch many macro virus, and stop sensitive data from be revealed to unauthorized personnel. Many of the attachments sent via e-mail will be in compressed form.