AntiVir MailGate acts as a store-and-forward agent whereby the work is shared by two programs:
The SMTP process receives the mails, filters them according to the IP address and places them in a specific directory (spool directory). This program can operate as an independent server occupying port 25 (SMTP) or being started by the internet super daemon 'inetd'.
The scan daemon reads the mails stored in the spool directory, decodes any attachments and then starts the scan.
Depending on the result, the mails are blocked or forwarded to the MTA. Besides blocking, deleting or forwarding the infected mail, it also issues status signals via 'syslog'. The 'postmaster' receives a mail with a detailed report, and the sender and receiver can also be notified of the infection in addition.