After anti-virus definitions fail to update, the anti-virus modules fail and cause emails to be moved to the FailedMails folder.
You need to allow fallback to HTTP for the downloads, as described in the Setting MailEssentials to use HTTP to download updates article. Afterward, please make sure to exclude the GFI MailEssentials folder from any anti-virus or backup solution deployed to the server, as described in the Recommended Anti-virus and Backup Exclusions article.
Depending on the anti-virus engines you have licensed, please follow the procedure from the Manual Update Process for the Virus Scanning Engines article, to manually update the definitions.
Once the updates complete successfully, please reprocess the failed emails as described in the Reprocessing Emails Wrongly Moved to the FailedMails Folder article to ensure they reach their intended recipients.