Since that

;Set this to 0 to prevent queued emails to be spooled to memory, and force spooling to disk. While less efficient, spooling to disk helps allow existing antivirus software to detect and block some infected email files
SpoolQueueFilesToMemory=1

after a year with Norman, I wanted to give a chance to another antivirus (even if with an external one SF cannot mark infected IP). So I set this option and AVG realtime protection started catching infected attachments dropped to temp bt SF; but unfortunately not all of them, maybe just because SF is too fast or what else.

Does anyone of you have a positive experience with any other antivirus product? Or anyway, what antivirus would you suggest to try?

Thanks in advance.

Ciao

MArco