# Virus scanning

> How EmailConnect scans attachments for malware before they reach your webhook, and what an infected file looks like in the payload

Source: https://emailconnect.eu/help/virus-scanning/

On **Business** and **Platform**, attachments can be scanned for malware before delivery. Scanning is off by default: turn on **Scan attachments for viruses** under **Settings → Storage**. An infected file is never delivered and never stored; your webhook sees only that it was there.

## Powered by ClamAV

EmailConnect uses [ClamAV](https://www.clamav.net/), the open-source antivirus engine maintained by Cisco's Talos Intelligence Group.

- **Open source** — fully auditable, no black-box scanning
- **Broad coverage** — detects viruses, trojans, ransomware, phishing payloads and other threats

## Virus definition updates

Virus definitions are updated automatically via ClamAV's built-in `freshclam` daemon. Definitions are stored persistently, so restarts don't trigger a full re-download.

Updates are applied in the background without service interruption. To keep memory usage predictable during updates, new definitions are loaded sequentially rather than in parallel with the old set.

## How scanning works

1. An email with attachments arrives at your alias
2. Each attachment is streamed to the ClamAV daemon for scanning. Images, audio, video and plain text are skipped
3. **Clean files** are delivered normally with scan metadata in the payload
4. **Infected files** are excluded: the entry stays in the payload, without content or download URL, and the file is not stored anywhere

Scanning happens inline before your webhook fires. There is no separate queue or delay beyond the scan itself.

## Clean file payload

Clean attachments include a `virusScan` object confirming the result:

```json
{
  "filename": "report.pdf",
  "contentType": "application/pdf",
  "size": 48210,
  "downloadUrl": "https://app.emailconnect.eu/attachments/.../download",
  "virusScan": {
    "status": "clean"
  }
}
```

## Infected file payload

An infected attachment stays in the payload as an excluded entry, so you know it was there. It has no content and no download URL, and the file is not stored anywhere: not in storage, not inline, not in our database.

```json
{
  "filename": "eicar_com.zip",
  "contentType": "application/x-zip-compressed",
  "size": 184,
  "excluded": true,
  "excludeReason": "virus-detected",
  "status": "rejected",
  "virusScan": {
    "status": "infected",
    "threat": "Eicar-Test-Signature"
  }
}
```

When scanning is on and the email has attachments, a top-level `security.virusScan` summary gives the scan statistics. If the scanner is unavailable, nothing is flagged: the email is delivered with `scanned: false` and `reason: "scanner-unavailable"`, so your handler should treat those attachments as unscanned. See the [webhook payload reference](https://emailconnect.eu/help/webhook-payload-reference/) for full field documentation.

## Testing virus scanning

Send an email with the [EICAR test file](https://www.eicar.org/download-anti-malware-testfile/) attached. This is a harmless industry-standard test string that every antivirus engine detects. Your webhook payload will show the attachment as rejected with threat `Eicar-Test-Signature`.

## Limits

Attachments up to **10 MB** are scanned. This matches the maximum email size accepted by EmailConnect.

## Availability

Virus scanning is available on **Business** and **Platform** plans. On lower plans, attachments are delivered without scanning.

## Related topics

- [Attachment processing](https://emailconnect.eu/help/attachment-processing/) — storage modes and attachment handling
- [Webhook payload reference](https://emailconnect.eu/help/webhook-payload-reference/) — full payload field documentation
- [Alias rules](https://emailconnect.eu/help/alias-rules/) — filter emails by attachment type