In years past I subscribed to the Commtouch AV add-in but then let it expire and have relied on the ClamAV scan. I, too, have realized that we get what we pay for in this regard. Just recently, I've tried to enable command line scanning with SEP (Symantec Endpoint) but I must have the syntax wrong. Guess I have to tinker with it a bit. I might just bite the bullet and renew the Commtouch/Cyren. I've noticed an uptick in virus attachments via email lately.