F-SECURE ANTI-VIRUS - FOR MICROSOFT EXCHANGE Administrator's Manual

Other manuals for ANTI-VIRUS - FOR MICROSOFT EXCHANGE: Deployment Manual, Administrator's Manual

Summary of ANTI-VIRUS - FOR MICROSOFT EXCHANGE

  • Page 1

    F-secure anti-virus for microsoft exchange administrator’s guide.

  • Page 2

    "f-secure" and the triangle symbol are registered trademarks of f-secure corporation and f-secure product names and symbols/logos are either trademarks or registered trademarks of f-secure corporation. All product names referenced herein are trademarks or registered trademarks of their respective co...

  • Page 3

    3 contents about this guide 7 how this guide is organized .............................................................................................. 8 conventions used in f-secure guides ................................................................................ 9 symbols .....................

  • Page 4

    4 3.4 modifying settings and viewing statistics.................................................................. 33 3.5 manually processing mailboxes and public folders .................................................. 34 3.5.1 stand-alone mode ........................................................

  • Page 5

    5 5.4 query results page ................................................................................................. 167 5.5 viewing details of a quarantined message ............................................................. 169 5.6 reprocessing the quarantined content.........................

  • Page 6

    6 c.3 viewing the log file................................................................................................. 203 c.4 common problems and solutions............................................................................ 204 c.4.1 installing service packs...............................

  • Page 7

    7 a bout t his g uide how this guide is organized...................................................... 8 conventions used in f-secure guides ..................................... 13.

  • Page 8

    8 how this guide is organized f-secure anti-virus for microsoft exchange administrator's guide is divided into the following chapters: chapter 1. Introduction . General information about f-secure anti-virus for microsoft exchange and other f-secure anti-virus mail server and gateway products. Chapte...

  • Page 9

    9 conventions used in f-secure guides this section describes the symbols, fonts, and terminology used in this manual. Symbols ⇒ an arrow indicates a one-step procedure. Fonts arial bold (blue) is used to refer to menu names and commands, to buttons and other items in a dialog box. Arial italics (blu...

  • Page 10

    10 courier new bold is used for information that you must type. Small caps ( black ) is used for a key or key combination on your keyboard. Arial underlined (blue) is used for user interface links. Arial italics is used for window and dialog box names. Pdf document this manual is provided in pdf (po...

  • Page 11

    11 1 i ntroduction overview..................................................................................... 12 how f-secure anti-virus for microsoft exchange works ........... 13 key features .............................................................................. 15 f-secure anti-virus m...

  • Page 12

    12 1.1 overview malicious code, such as computer viruses, is one of the main threats for companies today. In the past, malicious code spread mainly via disks and the most common viruses were the ones that infected disk boot sectors. When users began to use office applications with macro capabilities...

  • Page 13

    Chapter 1 13 introduction 1.2 how f-secure anti-virus for microsoft exchange works f-secure anti-virus for microsoft exchange is designed to detect and disinfect viruses and other malicious code from e-mail transmissions through microsoft exchange 2000/2003 server. Scanning is done in real time as t...

  • Page 14

    14 alerting f-secure anti-virus for microsoft exchange has extensive alerting functions, which means that the system administrator can specify a recipient inside the company network to be notified about the infection found in the data content. Of course, the network administrator can be notified abo...

  • Page 15

    Chapter 1 15 introduction figure 1-1 (1) e-mail arrives from the internet to f-secure anti-virus for microsoft exchange, which (2) filters malicious content from mails and attachments, and (3) delivers cleaned files forward. 1.3 key features f-secure anti-virus for microsoft exchange provides the fo...

  • Page 16

    16 password protected archives can be treated as unsafe. Intelligent file type recognition. Message filtering based on keywords in message subjects and text. Utilizes the low-level anti-virus api (av api 2.0) for microsoft exchange 2000 server, and av ap 2.5 for microsoft exchange 2003 server. Virus...

  • Page 17

    Chapter 1 17 introduction protection against spam possible spam messages are transparently detected before they become widespread. Efficient spam detection based on different analyses on the e-mail content. Multiple filtering mechanisms guarantee the high accuracy of spam detection. Spam detection w...

  • Page 18

    18 simple integration to clearswift mailsweeper and websweeper, giving the corporation the powerful combination of complete content security. F-secure internet gatekeeper for linux™ provides a high-performance solution at the internet gateway level, stopping viruses and other malicious code before t...

  • Page 19

    19 2 r equirements which sql server to use for the quarantine database?.......... 20 network requirements............................................................... 21 web browser software requirements ....................................... 22 improving reliability and performance.................

  • Page 20

    20 2.1 which sql server to use for the quarantine database? As a minimum requirement, the quarantine database should have the capacity to store information about all inbound and outbound mail to and from your organization that would normally be sent during 2-3 days. Take into account the following s...

  • Page 21

    Chapter 2 21 requirements microsoft sql server 2000/2005 if your organization sends a large amount of e-mails, it is recommended to use microsoft sql server 2000/2005. It is recommended to use microsoft sql server 2000/2005 if you are planning to use centralized quarantine management with multiple f...

  • Page 22

    22 2.3 web browser software requirements in order to administer the product with f-secure anti-virus for microsoft exchange web console, one of the following web browsers is required: microsoft internet explorer 6.0 or later netscape communicator 8.1 or later mozilla firefox 1.5 or later opera 9.00 ...

  • Page 23

    Chapter 2 23 requirements 2.4 improving reliability and performance you can improve the system reliability and overall performance by upgrading the following components. Processor if the system load is high, a fast processor on the microsoft exchange server speeds up the e-mail message processing. A...

  • Page 24

    24 2.5 configuring the product after the installation after the installation, f-secure anti-virus for microsoft exchange is functional, but it is using mostly default values. It is highly recommended to go through all the settings of all installed components. You should also retrieve the latest viru...

  • Page 25

    25 3 u sing f-s ecure a nti -v irus for m icrosoft e xchange overview..................................................................................... 65 administering f-secure anti-virus for microsoft exchange........ 26 using the web console........................................................

  • Page 26

    26 3.1 administering f-secure anti-virus for microsoft exchange you can use the f-secure anti-virus for microsoft exchange web console to start and stop f-secure anti-virus for microsoft exchange, modify its settings, edit scheduled tasks and start manual processing. To open the f-secure anti-virus ...

  • Page 27

    Chapter 3 27 using f-secure anti-virus for microsoft exchange when you log in for the first time, your browser will display a security alert dialog window about the security certificate for f-secure anti-virus for microsoft exchange web console. You can create a security certificate for f-secure ant...

  • Page 28

    28 2. The security alert about the f-secure anti-virus for microsoft exchange web console certificate is displayed. If you install the certificate now, you will not see the security alert window again. Click view certificate to view the certificate information and to install the certificate. 3. The ...

  • Page 29

    Chapter 3 29 using f-secure anti-virus for microsoft exchange figure 3-2 f-secure anti-virus for microsoft exchange home page 3.2 checking the product status you can check the overall product status on the home page. The home page displays an overview of each component status and most important stat...

  • Page 30

    30 f-secure anti-virus for microsoft exchange the home page displays the status the f-secure anti-virus for microsoft exchange as well as a summary of the f-secure anti-virus for microsoft exchange statistics. Click configure to configure f-secure anti-virus for microsoft exchange. For more informat...

  • Page 31

    Chapter 3 31 using f-secure anti-virus for microsoft exchange click configure to configure f-secure content scanner server. For more information, see “ f-secure content scanner server settings ”, 129. F-secure automatic update agent click configure to configure f-secure automatic update agent. For m...

  • Page 32

    32 click configure to configure the f-secure management agent. For more information, see “ f-secure management agent settings ”, 157. Toolbar buttons click show f-secure log to view the f-secure log file (logfile.Log) in a new internet browser window. Click download to download and save the logfile....

  • Page 33

    Chapter 3 33 using f-secure anti-virus for microsoft exchange click show access log to view the f-secure anti-virus for microsoft exchange web console access log. Note that the web console access log differs from standard web server access logs, as it logs only the first request per session. To add ...

  • Page 34

    34 3.5 manually processing mailboxes and public folders you can scan mailboxes and public folders for viruses and strip attachments manually at any time. You can also create scheduled scan tasks to scan mailboxes and public folders periodically. 3.5.1 stand-alone mode specify the manual scanning set...

  • Page 35

    Chapter 3 35 using f-secure anti-virus for microsoft exchange step 1. Specify messages to process 1. Specify whether you want to process all messages or only those messages that have not been processed previously. 2. Specify how many concurrent transactions the scanner can have with f-secure content...

  • Page 36

    36 step 2. Select mailboxes to process 1. Choose mailboxes that should be processed during the manual scanning operation. Do not process mailboxes - do not process any mailboxes. Process all mailboxes - process all mailboxes. Process only these mailboxes - process all specified mailboxes. Process al...

  • Page 37

    Chapter 3 37 using f-secure anti-virus for microsoft exchange step 3. Specify virus scanning settings for mailboxes 1. Choose settings for virus scanning of mailboxes. Attachments to scan specify which message attachments are checked for viruses. Do not scan attachments for viruses - process message...

  • Page 38

    38 you can add new file types on the extensions lists by typing the file extensions in the file extensions text boxes. Separate the extensions by spaces. Scan mail message body specify whether the body of the e-mail message should be scanned for malicious code. By default, f-secure anti-virus for mi...

  • Page 39

    Chapter 3 39 using f-secure anti-virus for microsoft exchange 2. Click next to continue. Disinfect attachment - try to disinfect the infected attachment. If the disinfection succeeds, the recipient receives the disinfected file instead of the original one. If the disinfection fails, the infected att...

  • Page 40

    40 step 4. Specify attachment stripping settings for mailboxes 1. Choose settings for stripping attachments. Strip attachments specify which attachments should be stripped from messages and public folder notes. Do not strip - do not strip any attachments. Strip all attachments - strip all attachment...

  • Page 41

    Chapter 3 41 using f-secure anti-virus for microsoft exchange enable file type recognition trojans and other malicious code can disguise themselves with filename extensions which are usually considered safe to use. Intelligent file type recognition can recognize the real file type of the message att...

  • Page 42

    42 2. Click next to continue. Step 5. Select public folders to process notify administrator specify whether the administrator should be notified when f-secure anti-virus for microsoft exchange strips an attachment. Do not notify - do not send any notification to the administrator. Send informational...

  • Page 43

    Chapter 3 43 using f-secure anti-virus for microsoft exchange 1. Select public folders that should be processed. Do not process public folders - do not process any public folders. Process all public folders - process all notes posted to all public folders. Process only included public folders - proc...

  • Page 44

    44 step 6. Specify virus scanning settings for public folders 1. Choose settings for virus scanning of public folders. Attachments to scan specify which message attachments are checked for viruses. Do not scan attachments for viruses - do not scan any attachments. Scan all attachments - scan all mes...

  • Page 45

    Chapter 3 45 using f-secure anti-virus for microsoft exchange you can add new file types on the extensions lists by typing the file extensions in the file extensions text boxes. Separate the extensions by spaces. Scan mail message body specify whether the body of the e-mail message should be scanned...

  • Page 46

    46 2. Click next to continue. Disinfect attachment - try to disinfect the infected attachment. If the disinfection succeeds, the recipient receives the disinfected file instead of the original one. If the disinfection fails, the infected attachment is dropped, and it is not delivered to the recipien...

  • Page 47

    Chapter 3 47 using f-secure anti-virus for microsoft exchange step 7. Specify attachment stripping settings for public folders 1. Choose settings for stripping attachments. Strip attachments specify which attachments should be stripped from messages and public folder notes. Do not strip - do not str...

  • Page 48

    48 you can add new file types on the attachments lists by typing the file extensions in the allowed and disallowed attachments text boxes. Separate the extensions by spaces. Enable file type recognition trojans and other malicious code can disguise themselves with filename extensions which are usual...

  • Page 49

    Chapter 3 49 using f-secure anti-virus for microsoft exchange 2. Click next to continue. Notify administrator specify whether the administrator should be notified when f-secure anti-virus for microsoft exchange strips an attachment. Do not notify - do not send any notification to the administrator. ...

  • Page 50

    50 step 8. Finish the manual scanning wizard displays the summary of created operation. Click finish accept the new manual scanning operation and to exit the wizard. Creating scheduled operation start the scheduled operation wizard by clicking add task... In the scheduled processing window..

  • Page 51

    Chapter 3 51 using f-secure anti-virus for microsoft exchange step 1. Specify scanning task name and schedule 1. Enter the name for the new task and select how frequently you want the operation to be performed. Once - only once at the specified time daily - every day at the specified time, starting ...

  • Page 52

    52 step 2. Specify messages to process 1. Specify whether you want to process all messages or only those messages that have not been processed previously during the scheduled processing. 2. Specify how many concurrent transactions the scanner can have with f-secure content scanner server. 3. Click n...

  • Page 53

    Chapter 3 53 using f-secure anti-virus for microsoft exchange step 3. Select mailboxes to process 1. Choose mailboxes that should be processed during the scheduled operation. Do not process mailboxes - do not process any mailboxes. Process all mailboxes - process all mailboxes. Process only these ma...

  • Page 54

    54 step 4. Specify virus scanning settings for mailboxes 1. Choose settings for virus scanning of mailboxes during the scheduled operation. Attachments to scan specify which message attachments are checked for viruses. Do not scan attachments for viruses - process messages without scanning any attac...

  • Page 55

    Chapter 3 55 using f-secure anti-virus for microsoft exchange scan all attachments except with these extensions - scan all attachments except those with specified filename extensions. You can add new file types on the extensions lists by typing the file extensions in the file extensions text boxes. ...

  • Page 56

    56 2. Click next to continue. Action action on infected attachments specify whether infected attachments should be disinfected or dropped. Disinfect attachment - try to disinfect the infected attachment. If the disinfection succeeds, the recipient receives the disinfected file instead of the origina...

  • Page 57

    Chapter 3 57 using f-secure anti-virus for microsoft exchange step 5. Specify attachment stripping settings for mailboxes 1. Choose settings for stripping attachments during the scheduled operation. Strip attachments specify which attachments should be stripped from messages and public folder notes....

  • Page 58

    58 you can add new file types on the attachments lists by typing the file extensions in the allowed and disallowed attachments text boxes. Separate the extensions by spaces. Enable file type recognition trojans and other malicious code can disguise themselves with filename extensions which are usual...

  • Page 59

    Chapter 3 59 using f-secure anti-virus for microsoft exchange 2. Click next to continue. Step 6. Select public folders to process notify administrator specify whether the administrator should be notified when f-secure anti-virus for microsoft exchange strips an attachment. Do not notify - do not sen...

  • Page 60

    60 1. Select public folders that should be processed during the scheduled operation. Do not process public folders - do not process any public folders. Process all public folders - process all notes posted to all public folders. Process only included public folders - process all notes posted to the ...

  • Page 61

    Chapter 3 61 using f-secure anti-virus for microsoft exchange step 7. Specify virus scanning settings for public folders 1. Choose settings for virus scanning of public folders during the scheduled operation. Attachments to scan specify which message attachments are checked for viruses. Do not scan ...

  • Page 62

    62 you can add new file types on the extensions lists by typing the file extensions in the file extensions text boxes. Separate the extensions by spaces. Scan mail message body specify whether the body of the e-mail message should be scanned for malicious code. By default, f-secure anti-virus for mi...

  • Page 63

    Chapter 3 63 using f-secure anti-virus for microsoft exchange 2. Click next to continue. Disinfect attachment - try to disinfect the infected attachment. If the disinfection succeeds, the recipient receives the disinfected file instead of the original one. If the disinfection fails, the infected att...

  • Page 64

    64 step 8. Specify attachment stripping settings for public folders 1. Choose settings for stripping attachments during the scheduled operation. Strip attachments specify which attachments should be stripped from messages and public folder notes. Do not strip - do not strip any attachments. Strip al...

  • Page 65

    Chapter 3 65 using f-secure anti-virus for microsoft exchange you can add new file types on the attachments lists by typing the file extensions in the allowed and disallowed attachments text boxes. Separate the extensions by spaces. Enable file type recognition trojans and other malicious code can d...

  • Page 66

    66 2. Click next to continue. Notify administrator specify whether the administrator should be notified when f-secure anti-virus for microsoft exchange strips an attachment. Do not notify - do not send any notification to the administrator. Send informational alert - send an informational alert to t...

  • Page 67

    Chapter 3 67 using f-secure anti-virus for microsoft exchange step 9. Finish the scheduled operation wizard displays the summary of created operation. Click finish accept the new scheduled operation and to exit the wizard. 3.6 configuring alert forwarding alerts are sent if security has been comprom...

  • Page 68

    68 figure 3-3 f-secure management agent configuration > alert forwarding page you can specify where an alert is sent according to its severity level. You can send an alert to any of the following: windows event viewer e-mail snmp. To forward alerts to an e-mail, specify the e-mail address of the rec...

  • Page 69

    Chapter 3 69 using f-secure anti-virus for microsoft exchange 3.7 viewing alerts when f-secure anti-virus for microsoft exchange has encountered a problem, it sends an alert to the administrator. Alerts are also sent if security has been compromised or a program wants to notify about some specific e...

  • Page 70

    70 4 a dministration with w eb c onsole overview..................................................................................... 71 f-secure anti-virus for microsoft exchange settings ................ 71 f-secure content scanner server settings ............................. 129 f-secure automat...

  • Page 71

    Chapter 4 71 administration with web console 4.1 overview f-secure anti-virus for microsoft exchange can be administered with f-secure anti-virus for microsoft exchange web console. The web console is installed with f-secure anti-virus for microsoft exchange. To open the web console, double-click th...

  • Page 72

    72 4.2.1 summary the summary page displays the current status of the product and a summary of the most important product statistics. Figure 4-1 summary page.

  • Page 73

    Chapter 4 73 administration with web console click start to start the product and stop to stop it. Click reset statistics to reset the statistics displayed on this page. Status status the current status of f-secure anti-virus for microsoft exchange. F-secure anti-virus for microsoft exchange is star...

  • Page 74

    74 4.2.2 virus scanning virus scanning settings are used to specify how inbound and outbound messages and public folder notes that are sent to f-secure content scanner server are to be checked for malicious code. Figure 4-2 virus scanning / statistics page statistics infections found displays the to...

  • Page 75

    Chapter 4 75 administration with web console last infection found displays the name of the last infection that was found. Processed displays the number of processed message bodies and attachments. Infected displays the number of attachments that have been infected with malicious code. Suspicious dis...

  • Page 76

    76 common edit the virus scanning / common settings to specify which messages should be scanned for malicious code. Figure 4-3 virus scanning / common settings note that you may have to scroll the page to view all the settings..

  • Page 77

    Chapter 4 77 administration with web console scan mail and public folders for viruses scan mail and public folders for viruses specify which message attachments are checked for viruses. Do not scan - do not scan any attachments scan all - scan all message attachments scan all attachments with these ...

  • Page 78

    78 enable file type recognition trojans and other malicious code can disguise themselves with filename extensions which are usually considered safe to use. Intelligent file type recognition can recognize the real file type of the message attachment and use that while the attachment is processed. Spe...

  • Page 79

    Chapter 4 79 administration with web console drop attachment - do not disinfect or deliver infected attachments. All infected attachments are dropped. By default, f-secure anti-virus for microsoft exchange tries to disinfect infected attachments. Action on messages with exceeding nesting levels spec...

  • Page 80

    80 inbound mail edit virus scanning / inbound mail settings to define whether the whole message should be stopped if an infection is found and to specify the trusted mailboxes and the warning messages for infected, inbound mails. These settings are specific to the mails that are destined to the inte...

  • Page 81

    Chapter 4 81 administration with web console processing options stop the whole message if infection found specify whether f-secure anti-virus for microsoft exchange should stop inbound messages that contain malicious code. When this setting is enabled, inbound messages with infected attachment(s) wi...

  • Page 82

    82 editing trusted mailboxes list click specify to open a dialog box where you can add new trusted mailboxes, or remove trusted mailboxes from the list. To add new mailbox to the list, click add . Select mailboxes from the list and click ok . To delete a address from the list, click on column to sel...

  • Page 83

    Chapter 4 83 administration with web console click edit to edit the warning message that is sent to the sender of the mail message which had infected content. By default, f-secure anti-virus for microsoft exchange does not send the virus warning message to the sender. The virus warning message will ...

  • Page 84

    84 outbound mail edit virus scanning / outbound mail real-time processing settings to define what should be done to infected outbound messages and set warning messages to infected, outbound mails. Figure 4-5 virus scanning / outbound mail settings.

  • Page 85

    Chapter 4 85 administration with web console processing options stop the whole message if infection found specify whether all outgoing messages that have infected content should be stopped or not. Check the checkbox to stop all outbound messages with infected content completely. The original message...

  • Page 86

    86 public folders edit public folders real-time processing settings to define which public folders should be scanned for malicious code and to set warning messages to infected public folder notes. Figure 4-6 virus scanning / public folders settings add disclaimer to all outgoing messages specify whe...

  • Page 87

    Chapter 4 87 administration with web console editing public folders click specify to open a dialog box where you can add new public folders, or remove public folders from the list. To add new public folder to the list, click add . Select public folders from the list and click ok . To select all subf...

  • Page 88

    88 outbreak detection f-secure anti-virus for microsoft exchange can alert administrators when the number of infections detected within a specified time frame exceeds a specified value. Notifications send warning message to originator specify whether a virus warning message should be sent to the ori...

  • Page 89

    Chapter 4 89 administration with web console figure 4-7 virus scanning / outbreak detection settings condition notify when number of infections detected exceed specify the number of infected objects that should be found within a specified time period, for it to be considered as a virus outbreak. Use...

  • Page 90

    90 4.2.3 stripping attachments f-secure anti-virus for microsoft exchange can be configured to remove attachments in real-time from inbound and outbound messages by their file name or the file extension even without scanning them for malicious code. The statistics page displays the number of attachm...

  • Page 91

    Chapter 4 91 administration with web console figure 4-8 stripping attachments / statistics page on-access edit on-access stripping attachments settings to set which attachments should be stripped during the on-access scanning. Statistics attachments stripped displays the number of stripped attachmen...

  • Page 92

    92 figure 4-9 content blocking / on-access / stripping attachments settings strip attachments strip attachments specify which attachments should be stripped from messages and public folder notes. Do not strip - do not strip any attachments. Strip all attachments - strip all attachments from all mess...

  • Page 93

    Chapter 4 93 administration with web console you can add new file types on the attachments lists by typing the file extensions in the allowed and disallowed attachments text boxes. Separate the extensions by spaces. Enable file type recognition trojans and other malicious code can disguise themselve...

  • Page 94

    94 by default, f-secure anti-virus for microsoft exchange does not add the informational message. Send the informational message to sender specify whether an informational message should be sent to the sender of the mail message which had the stripped attachment. Click edit to edit the message that ...

  • Page 95

    Chapter 4 95 administration with web console inbound mail edit stripping attachments / inbound mail settings to specify which attachments should be stripped from the inbound mail. For settings descriptions, see below. Figure 4-10 stripping attachments / inbound mail settings note that you may have t...

  • Page 96

    96 strip attachments strip attachments specify which attachments should be stripped from messages and public folder notes. Do not strip - do not strip any attachments. Strip all attachments - strip all attachments from all messages and notes. Strip all attachments with these extensions - strip all e...

  • Page 97

    Chapter 4 97 administration with web console editing trusted mailboxes list click specify to open a dialog box where you can add new trusted mailboxes, or remove trusted mailboxes from the list. To add new mailbox to the list, click add . Select mailboxes from the list and click ok . To delete a add...

  • Page 98

    98 add informational message specify whether an informational message should be added to the mail message which originally had the stripped attachment. During on-access scanning, the informational message can be sent to the mailbox owner or to the originator of an infected message or an infected pub...

  • Page 99

    Chapter 4 99 administration with web console outbound mail edit stripping attachments / outbound mail attachment stripping settings to set which attachments should be stripped from the outbound mail. For settings descriptions, see “ inbound mail ”, 95. Send security alert - send a security alert to ...

  • Page 100

    100 figure 4-11 stripping attachments / outbound mail settings 4.2.4 content filtering the content filtering settings specify how content should be filtered based on keywords found in message subject and content. The spam control settings are also located under the content filtering branch, but they...

  • Page 101

    Chapter 4 101 administration with web console figure 4-12 content filtering / statistics page statistics spam messages displays the total number of spam messages that have been found. Size of spam messages displays the total size of spam messages that have been found. Filtered inbound messages displ...

  • Page 102

    102 spam control for information on f-secure spam control settings, see “ spam control settings in web console ”, 180. Inbound mail edit content filtering / inbound mail settings to define how content should be filtered in the inbound mail based on keywords in message subjects and text. For settings...

  • Page 103

    Chapter 4 103 administration with web console figure 4-13 content filtering / inbound mail settings processing options enable content filtering specify whether the content of inbound messages is filtered based on the subjects and texts of the messages as defined on this tab. List of disallowed keywo...

  • Page 104

    104 editing keyword lists click edit to open a dialog box where you can add new disallowed keywords, or remove keywords from the list. To add new keyword to the list, click add . To add multiple entries at once, click import . To delete a keyword from the list, click on column to select keywords tha...

  • Page 105

    Chapter 4 105 administration with web console editing trusted mailboxes list click specify to open a dialog box where you can add new trusted mailboxes, or remove trusted mailboxes from the list. To add new mailbox to the list, click add . Select mailboxes from the list and click ok . To delete a ad...

  • Page 106

    106 outbound mail edit outbound mail content blocking settings to set which attachments should be stripped from the outbound mail and how messages should be blocked based on keywords found in the message subjects and text. For settings descriptions, see “ inbound mail ”, 102. Do not notify - do not ...

  • Page 107

    Chapter 4 107 administration with web console figure 4-14 content filtering / outbound mail settings 4.2.5 manual scanning you can process mailboxes and public folders manually as needed..

  • Page 108

    108 figure 4-15 manual processing page.

  • Page 109

    Chapter 4 109 administration with web console processing mailboxes manually the status field displays the current status of the manual process. To start processing mailboxes manually, click start . Click stop to terminate the currently running manual scan click configure... To set up a new manual pr...

  • Page 110

    110 scheduled scan tasks figure 4-16 scheduled processing page editing scheduled tasks the scheduled tasks table displays all scheduled tasks and the date and time when the next scheduled task occurs for the next time..

  • Page 111

    Chapter 4 111 administration with web console clear the checkbox in front of the task to deactivate a scheduled. Check the checkbox to activate it again. When the scheduled scanning task is complete, column reports completed scheduled scanning tasks. You can view the report by clicking the report......

  • Page 112

    112 quarantine thresholds figure 4-17 quarantine thresholds settings.

  • Page 113

    Chapter 4 113 administration with web console quarantine thresholds quarantined items threshold specify the critical number of items in the quarantine storage. If the specified value is reached or exceeded, the product sends an alert. If zero (0) is specified, the number of items in the quarantine s...

  • Page 114

    114 quarantine reprocess, retention and cleanup when quarantined content is reprocessed, it is scanned again, and if it is found clean, it is sent to the intended recipients. For more information, see “ reprocessing the quarantined content ”, 171. Notify when quarantine threshold is reached specify ...

  • Page 115

    Chapter 4 115 administration with web console figure 4-18 quarantine cleanup settings reprocess unsafe messages automatically reprocess unsafe messages specify how often the product tries to reprocess unsafe messages that are retained in the quarantine. Set the value to disabled to keep all unsafe t...

  • Page 116

    116 final action on unsafe messages specify the action to unsafe messages after the maximum number of reprocesses have been attempted. Leave in quarantine - leave messages in the quarantine and process them manually. Release to intended recipients - release messages from the quarantine and send them...

  • Page 117

    Chapter 4 117 administration with web console infected disallowed suspicious spam scan failure unsafe retention period - specify an exception to the default retention period for the selected quarantine category. Cleanup interval - specify an exception to the default cleanup interval for the selected...

  • Page 118

    118 quarantine logging figure 4-19 quarantine logging settings logging quarantine log directory specify the path for quarantine log files. Rotate quarantine logs specify how often the product rotates quarantine log files. At the end of each rotation time a new log file is created. Keep rotated quara...

  • Page 119

    Chapter 4 119 administration with web console quarantine options quarantine options quarantine worms specify whether the product should quarantine files infected with mass worms or mail viruses such as sobig or bagle. Quarantine problematic messages specify if messages that contain malformed or brok...

  • Page 120

    120 quarantine database figure 4-20 quarantine database settings you can specify the database where information about quarantined e-mails is stored and from which it is retrieved. Quarantine database sql server name the name of the sql server where the database is located. Database name the name of ...

  • Page 121

    Chapter 4 121 administration with web console quarantine storage 4.2.7 advanced advanced settings control mail delivery and scanning timeout settings and polling intervals for new mailboxes and public folders. Quarantine storage specify the location of the quarantine storage where quarantined e-mail...

  • Page 122

    122 figure 4-21 advanced settings mail delivery settings mail opening timeout specify the number of seconds to try to open a message. Max mail sending retries specify the number of times to try to send a message if sending it fails. Mail sending timeout specify the number of seconds to wait to try s...

  • Page 123

    Chapter 4 123 administration with web console new mailbox polling interval specify how often f-secure anti-virus for microsoft exchange should check for newly established mailboxes. You can disable the new mailbox polling by using the value 0 (zero). By default, f-secure anti-virus for microsoft exc...

  • Page 124

    124 scanning servers edit the servers settings to configure the connection between f-secure anti-virus for microsoft exchange and f-secure content scanner server. Figure 4-22 advanced / scanning servers settings note that you may have to scroll the page to view all the settings..

  • Page 125

    Chapter 4 125 administration with web console editing f-secure content scanner server addresses to add new f-secure content scanner server ip addresses or host names to the list, click add . To delete a address from the list, click on column to select addresses that you want to delete. Click clear t...

  • Page 126

    126 use local interaction mode specify whether the product should interact with f-secure content scanner server in the local interaction mode. When f-secure anti-virus for microsoft exchange and f-secure content scanner server are installed on the same host and the local interaction mode is enabled,...

  • Page 127

    Chapter 4 127 administration with web console 4.2.8 internal domains specify the domains which should be considered to be internal domains. All messages which are going to internal domains are considered to be inbound messages. Separate each domain name with a space. You can use * wildcard, for exam...

  • Page 128

    128 figure 4-23 internal domains settings you can define how the mails destined for the internal domains are processed by configuring the virus scanning / inbound mail, stripping attachments / inbound mail and content filtering / inbound mail settings. Editing internal domain addresses to add a new ...

  • Page 129

    Chapter 4 129 administration with web console 4.3 f-secure content scanner server settings f-secure content scanner server can be administered with the f-secure anti-virus for microsoft exchange web console. You can check the system status, check statistics and modify the settings of f-secure conten...

  • Page 130

    130 figure 4-24 summary page status status displays whether f-secure content scanner server is currently running or not. Version displays the current version number and build of f-secure content scanner server. Start time displays the start date and time of f-secure content scanner server. Scanned f...

  • Page 131

    Chapter 4 131 administration with web console click start to start f-secure content scanner server and stop to stop f-secure content scanner server. Click reset statistics to reset the statistics in this window. Virus statistics you can see the list of most active viruses on the summary > virus stat...

  • Page 132

    132 figure 4-25 summary / virus statistics settings most active viruses most active viruses table this table displays a list of the 5, 10 or 30 most often found viruses during the specified time period. It also displays the number of times each virus has been found and the percentage that each virus...

  • Page 133

    Chapter 4 133 administration with web console spam scanner statistics on the spam control page you can see the status of f-secure spam control, spam definition databases and the spam scanning statistics. Viruses to show - specify the number of most active viruses to show in the virus statistics tabl...

  • Page 134

    134 figure 4-26 summary / spam scanner statistics page spam control statistics version shows the version and build number of the f-secure spam scanner. Status shows the status of the f-secure spam scanner. The possible statuses are: unknown or not installed - this status might be displayed right aft...

  • Page 135

    Chapter 4 135 administration with web console click reset statistics to reset the statistics in this window. Not loaded - this status is displayed when the f-secure content scanner server failed to load the scan engine for some reason. You should check the logfile.Log for the reason of the failure. ...

  • Page 136

    136 4.3.2 database updates f-secure content scanner server can notify the administrator if it detects that virus and/or spam definition databases are outdated. You can change the notification and other database updates settings on the updates page. For more information about virus definition databas...

  • Page 137

    Chapter 4 137 administration with web console figure 4-27 database updates settings ‘ database updates verify integrity of downloaded databases specify whether the product verifies that the downloaded virus definition databases are the original databases published by f-secure corporation and that th...

  • Page 138

    138 4.3.3 scan engines f-secure content scanner server uses multiple top quality scanning engines to ensure the highest possible detection rate and disinfection capability. You can view an overview of the engine statuses and updates on the scan engines page. Send warning alert - send a warning alert...

  • Page 139

    Chapter 4 139 administration with web console figure 4-28 virus scanning page scan engines scan engine displays the name of the scan engine. Version displays the version number of the scan engine. Database date displays the date of the currently used virus definition database. Last updated displays ...

  • Page 140

    140 properties you can view the detailed statistics and statuses of the scan engines on the scan engines > properties page. Figure 4-29 scan engines > properties page note that you have to scroll the page to view all the settings. Scan engine number of processed files displays the number of files th...

  • Page 141

    Chapter 4 141 administration with web console click reset statistics to reset the statistics for a scan engine. Select the scan engine and click enable to turn it on or disable to turn it off. Threat detection you can configure the virus outbreak and spam threat detection on the scan engines > threa...

  • Page 142

    142 figure 4-30 scan engines > threat detection page cache vod cache size specify the maximum number of patterns to cache for the virus outbreak detection service. By default, the cache size is 10000 cached patterns. Class cache size specify the maximum number of patterns to cache for spam detection...

  • Page 143

    Chapter 4 143 administration with web console 4.3.4 proxy configuration you can specify proxy server parameters that content scanner server uses when it connects to the threat detection center on the proxy configuration page. Action on connection failure specify the action for messages when the thre...

  • Page 144

    144 figure 4-31 proxy configuration page proxy configuration use proxy server specify whether f-secure content scanner server uses a proxy server when it connects to the threat detection center. Proxy server address specify the address of the proxy server. Proxy server port specify the port number o...

  • Page 145

    Chapter 4 145 administration with web console ntlm - the proxy uses ntlm authentication scheme. User name specify the user name for the proxy server authentication. Password specify the password for the proxy server authentication. Domain specify the domain name for the proxy server authentication..

  • Page 146

    146 4.3.5 archive scanning f-secure content scanner server can scan files inside archives. You can change the archive scanning and other advanced settings in the virus scanning / archive scanning page. Figure 4-32 archive scanning settings page.

  • Page 147

    Chapter 4 147 administration with web console virus scanning scan inside archives select whether f-secure content scanner server should scan files inside the archives for possible infections. Max levels in nested archives set the number of levels of archives inside archives that f-secure content sca...

  • Page 148

    148 acceptable unpacked size threshold specify the acceptable unpacked size (in kilobytes) for archive files. If the unpacked size of an archive file exceeds this threshold, the server will consider the archive suspicious and corresponding action will be taken. Scan these extensions in archive files...

  • Page 149

    Chapter 4 149 administration with web console 4.3.6 advanced you can change the working directory settings from the advanced page. The working directory specifies where temporary files are stored. Figure 4-33 advanced settings advanced working directory specify the working directory. Enter the compl...

  • Page 150

    150 free space threshold set the free space threshold of the working directory. F-secure content scanner server sends an alert to the administrator when the drive has less than the specified amount of space left. Max number of concurrent transactions specify how many files f-secure content scanner s...

  • Page 151

    Chapter 4 151 administration with web console 4.3.7 interface you can specify how f-secure content scanner server should interact with f-secure anti-virus agent for microsoft exchange. Figure 4-34 interface settings service connections ip address specify the ip address that f-secure content scanner ...

  • Page 152

    152 4.4 f-secure automatic update agent settings with f-secure automatic update agent, virus and spam definition database updates are retrieved automatically when they are published. When a new virus is found, f-secure provides a new virus definition database update. Accept connections specify the h...

  • Page 153

    Chapter 4 153 administration with web console 4.4.1 summary status displays the current status of f-secure automatic update agent. Version displays the version number of f-secure automatic update agent. Channel name displays the channel from where the updates are downloaded. Channel address displays...

  • Page 154

    154 downloads last check result displays the result of the last update check. Next check time displays the date and time for the next update check. Last successful check time displays the date and time when the last successful update check was done. Current http proxy displays the address of the htt...

  • Page 155

    Chapter 4 155 administration with web console available packages installed packages title displays the title of the downloaded package. Download time displays the download date and time. Size displays the size of the downloaded package. Title displays the title of the downloaded package. Installatio...

  • Page 156

    156 4.4.2 automatic updates you can configure the download options on the downloads page. Updates enable automatic updates select whether automatic updates are enabled or disabled..

  • Page 157

    Chapter 4 157 administration with web console http settings 4.5 f-secure management agent settings f-secure management agent enforces the security policies set by the administrator. It handles all management functions on the local workstations and provides a common interface for all f-secure applica...

  • Page 158

    158 you can access f-secure management agent settings from f-secure anti-virus for microsoft exchange web console home page by clicking the configure... Button in the f-secure management agent section. Note that you may have to scroll the page to view all the settings..

  • Page 159

    Chapter 4 159 administration with web console figure 4-35 f-secure management agent configuration page status the status section displays detailed information on the host, for example the dns and wins names and the ip address. In addition, it displays the date and time when the policy file that is c...

  • Page 160

    160 5 q uarantine m anagement introduction............................................................................... 161 configuring quarantine options............................................... 162 searching the quarantined content......................................... 163 query results...

  • Page 161

    Chapter 5 161 quarantine management 5.1 introduction you can manage and search quarantined mails with the f-secure anti-virus for microsoft exchange web console. You can search for quarantined content by using different search criteria, including the quarantine id, recipient and sender address, the ...

  • Page 162

    162 for more information on the sql servers recommended for different environments, see “ which sql server to use for the quarantine database? ”, 20. Quarantine storage the quarantine storage where the quarantined messages are stored is located on the server where f-secure anti-virus for microsoft e...

  • Page 163

    Chapter 5 163 quarantine management 5.3 searching the quarantined content you can search the quarantined content on the f-secure anti-virus for microsoft exchange > quarantine page in the web console. Figure 5-1 quarantine query options.

  • Page 164

    164 you can use the following search criteria: quarantine id enter the quarantine id of a quarantined message. The quarantine id is displayed in the notification sent to the user about the quarantined message. Object type select the type of the quarantined content. Attachment - search for quarantine...

  • Page 165

    Chapter 5 165 quarantine management recipients enter the e-mail recipient address. Subject enter the message subject to be used as search criteria. Show only you can use this option to view the current status of messages that you have set to be reprocessed, released or deleted. Because processing a ...

  • Page 166

    166 click query to start the search. The quarantine query results page is displayed once the query is completed. If you want to clear all the fields on the query page, click reset . Using wildcards you can use the following sql wildcards in the quarantine queries: search period select the time perio...

  • Page 167

    Chapter 5 167 quarantine management 5.4 query results page figure 5-2 quarantine query results page the quarantine query results page displays a list of mails and attachments that were found in the query. To view detailed information about a quarantined content, click the quarantine id (qid) number ...

  • Page 168

    168 quarantined mail operations you can select an operation to perform on the messages that were found in the query: click reprocess to scan the currently selected e-mail again, or click reprocess all to scan all e-mail messages that were found. For more information, see “ reprocessing the quarantin...

  • Page 169

    Chapter 5 169 quarantine management quarantined attachment operations you can select an operation to perform on the attachments that were found in the query: click send to deliver the currently selected attachment without further processing, or click send all to deliver all attachments that were fou...

  • Page 170

    170 figure 5-3 quarantined content details page the quarantined content details page displays the following information about the quarantined mails: qid - quarantine id. Submit date - the date and time when the item was placed in the quarantine. Processing server - the f-secure anti-virus for micros...

  • Page 171

    Chapter 5 171 quarantine management click download to download the quarantined message to your computer to check it. The quarantined content details page displays the following information about the quarantined attachments: qid - quarantine id. Submit date - the date and time when the item was place...

  • Page 172

    172 1. Select the f-secure anti-virus for microsoft exchange tab and the quarantine page. 2. Select the start and end dates and times of the quarantining period from the start time: and end time: drop-down menus. 3. If you want to specify how the search results are sorted, select the sorting criteri...

  • Page 173

    Chapter 5 173 quarantine management 1. Select the f-secure anti-virus for microsoft exchange tab and the quarantine page. 2. Enter the quarantine id of the message in the quarantine id field. 3. Click query . 4. When the query is finished, the query results page is displayed. Click the release butto...

  • Page 174

    174 5.8 removing the quarantined content quarantined messages are removed from the quarantine based on the currently configured quarantine retention and cleanup settings. For an example on how to configure those settings, see “ deleting old quarantined content automatically ”, 174. If you want to re...

  • Page 175

    Chapter 5 175 quarantine management 3. Select the category for which you want to specify the exception, for example infected, from the quarantine category drop-down menu. 4. Specify a retention period that is shorter than the default value, for example 1 day, in the retention period column. 5. Speci...

  • Page 176

    176 5.11 quarantine statistics the quarantine statistics page displays the number of quarantined items in each quarantine category, and the total size of the quarantine. Figure 5-4 quarantine > statistics page e-mail messages and infected, suspicious and disallowed attachments are stored and counted...

  • Page 177

    Chapter 5 177 quarantine management 5.12 moving the quarantine storage when you want to change the quarantine storage location, note that the product does not create the new directory automatically. Before you change the quarantine storage directory, make sure that the directory exists and it has pr...

  • Page 178

    178 to change the fsmseqs$ path, follow these steps: a. Open windows control panel > administrative tools > computer management. B. Open system tools > shared folders > shares. And find fsmseqs$ there. C. Right-click fsmseqs$ and select stop sharing. Confirm that you want to stop sharing fsmseqs$. D...

  • Page 179

    179 6 a dministering f-s ecure s pam c ontrol overview................................................................................... 180 spam control settings in centrally managed environments.... 236 spam control settings in web console ................................... 180 realtime blackhol...

  • Page 180

    180 6.1 overview when f-secure spam control is enabled, incoming messages that are considered spam are marked automatically by adding an x-header with the spam flag or predefined text in the message header. The end users can then create filtering rules that direct the messages marked with the spam f...

  • Page 181

    Chapter 6 181 administering f-secure spam control figure 6-1 spam control settings in a locally managed environment check messages for spam specify whether inbound mails should be scanned for spam. Realtime blackhole list (rbl) spam filtering is not enabled by default even if you enable spam filteri...

  • Page 182

    182 when the heuristic spam analysis is disabled, only the threat detection engine scans inbound mails for spam. Heuristic spam analysis slows down the performance but improves the spam detection rate. Spam filtering level specify the spam filtering level. Decreasing the level allows less spam to pa...

  • Page 183

    Chapter 6 183 administering f-secure spam control drop message - the message is deleted. Add x-header with spam flag specifies if the spam flag will be added to the mail as a x-spam-flag header in the following format: x-spam-flag: where is either "yes" or "no". Yes - the mail is considered spam. No...

  • Page 184

    184 example: x-spam-status: yes, hits=8 required=5 tests=date_in_future_03_06, date_spamware_y2k,forged_mua_thebat_boun, missing_mimeole,missing_outlook_name add this text to spam message subject specify the text that will be added in the beginning of the subject of an e-mail considered spam. Maximu...

  • Page 185

    Chapter 6 185 administering f-secure spam control 6.3 realtime blackhole list configuration this section describes how to enable and disable realtime blackhole lists, how to optimize f-secure spam control performance, and how to specify blocked and safe recipients and senders by using black- and whi...

  • Page 186

    186 5. Find the sample configuration file fssc_example.Cfg in f-secure spam control installation directory: \spam control\fssc_example.Cfg 6. Copy the file to the same directory with the name fssc.Cfg 7. Open fssc.Cfg in a text editor (like windows notepad). 8. The configuration file has instruction...

  • Page 187

    Chapter 6 187 administering f-secure spam control to force f-secure spam control to use a specific dns server, do the following: 1. Right-click the my computer icon and select properties. 2. Select advanced and click the environment variables.. Button. 3. In the system variables panel click new.. . ...

  • Page 188

    188 'spam-scanner-instances' (oid=1.3.6.1.4.1.2213.18.1.35.500) has been set to 5. To take the new setting into use, restart f-secure content scanner server. Important: each additional instance of the spam scanner takes approximately 25mb of memory (process fsavsd.Exe). Typically you should not need...

  • Page 189

    189 7 u pdating v irus and s pam d efinition d atabases overview................................................................................... 190 automatic updates with f-secure automatic update agent.... 190 configuring automatic updates................................................ 190 man...

  • Page 190

    190 7.1 overview it is of the utmost importance that virus definition databases are kept up-to-date. F-secure anti-virus for microsoft exchange takes care of this task automatically. This section describes how the automatic updates work, how you can configure them and how you can update the virus de...

  • Page 191

    Chapter 7 191 updating virus and spam definition databases 7.4 manual updates if you do not want to use f-secure automatic update agent to automatically update your virus definition database, you can do it manually with a program called fsupdate or by downloading the latest.Zip file. 7.4.1 using fsu...

  • Page 192

    192 a appendix: variables in warning messages list of variables ........................................................................ 193 outbreak management alert variables..................................... 195.

  • Page 193

    Appendix a 193 variables in warning messages list of variables the following table lists the variables that can be included in the warning and informational messages sent by the product if an infection is found or content is blocked. If both stripping and scanning are allowed and the agent found bot...

  • Page 194

    194 the following table lists variables that can be included in the scan report, in other words the variables that can be used in the warning message between $report-begin and $report-end. Variable description $affected-filenam e the name of the original file or attachment. $affected-filesize the si...

  • Page 195

    Appendix a 195 variables in warning messages outbreak management alert variables $interval-time detection interval in minutes. $interval-minutes outbreak limit of infections within detection interval. $infections-limit actual number of infections found within the detection interval. $infections-foun...

  • Page 196

    196 b appendix: services and processes f-secure anti-virus for microsoft exchange ............................ 197 f-secure content scanner server ........................................... 198 f-secure anti-virus for microsoft exchange web console...... 198 f-secure management agent (fsma)...........

  • Page 197

    Appendix b 197 services and processes the following tables list the services and processes that are running on the system after the installation. F-secure anti-virus for microsoft exchange service process description f-secure anti-virus for microsoft exchange fshkmngr.Exe the f-secure hook manager i...

  • Page 198

    198 f-secure content scanner server f-secure anti-virus for microsoft exchange web console service process description f-secure content scanner server daemon fsavsd.Exe the back-end component that provides anti-virus scanning and spam filtering services for simple content inspection protocol (scip) ...

  • Page 199

    Appendix b 199 services and processes f-secure management agent (fsma) service process description f-secure management agent fsma32.Exe f-secure management agent is an fsma service responsible for starting other services and monitoring them. Fsmb32.Exe f-secure message broker provides the inter-proc...

  • Page 200

    200 fameh32.Exe alert and management extensions handler is used to send alerts and reports to logfile.Log, windows event log and smtp server. Fih32.Exe f-secure installation handler enables the remote installation and updating of integrated f-secure products. Fsm32.Exe the f-secure settings and stat...

  • Page 201

    Appendix b 201 services and processes f-secure automatic updates agent service process description f-secure automatic updates agent servic~1.Exe the service starts and controls the f-secure automatic update agent client process. F-secu~1.Exe f-secure automatic update.Exe. This is the client process ...

  • Page 202

    202 c t roubleshooting overview................................................................................... 203 starting and stopping........................................................... 203 viewing the log file ................................................................. 203 commo...

  • Page 203

    Chapter c 203 troubleshooting c.1 overview if you have a problem that is not covered in here, see “ technical support ”, 218. C.2 starting and stopping if you ever need to start or stop f-secure anti-virus for microsoft exchange, you can do it in the following ways: open the services applet from the...

  • Page 204

    204 f-secure management agent uses logfile.Log (in f-secure / common directory) for logging of all the alerts on the host. Logfile.Log contains all the alerts generated by the host, regardless of the severity. Logfile.Log file size can be configured in f-secure management agent / settings / alerting...

  • Page 205

    Chapter c 205 troubleshooting if you get the cursor blinking in the upper left corner, it means that the connection has been established and f-secure content scanner server can accept incoming connections. If you get "connection to the host lost" or other error message or if the cursor does not go t...

  • Page 206

    206 scanner server. If you have entered a wrong keycode, the installation did not install all the components required for f-secure anti-virus for microsoft exchange. 2. A service or process may not be running on f-secure content scanner server. Make sure that all processes and services of f-secure c...

  • Page 207

    Chapter c 207 troubleshooting check the task manager. The following process should be running: fswebuid.Exe 2. If you try to connect to the f-secure anti-virus for microsoft exchange web console from a remote host, make sure that the connection is not blocked by a firewall or proxy server. C.4.1 ins...

  • Page 208

    208 c.5 frequently asked questions performance q. Why does the time to open a message in mailboxes and public folders increase after installation of f-secure anti-virus for microsoft exchange? A. F-secure anti-virus for microsoft exchange scans each message for viruses, hence the delay with opening ...

  • Page 209

    Chapter c 209 troubleshooting q. Every time when the server shuts down i get error reports that f-secure smtp and real-time scanners cannot connect to the server. What is the problem? A. When you shut down the computer with f-secure content scanner server and f-secure anti-virus for microsoft exchan...

  • Page 210

    210 q. I have a public folder that is excluded from the virus scan, but some messages are scanned and disinfected before they arrive to the excluded public folder. Why? A. If you send a message from a mapi client, the message goes to the outbox folder before it is sent to the public folder. The mess...

  • Page 211

    Chapter c 211 troubleshooting local protection with f-secure anti-virus for windows servers q. Can all files on a microsoft exchange computer be scanned for viruses, or are some files and folders excluded from scanning automatically? A. The working and quarantine directories of f-secure anti-virus f...

  • Page 212

    212 q. A message has an attachment_information.Txt file as an embedded ole object. What is this file and why do i get a warning message when i try to open the file? A. The original message had an infection which f-secure anti-virus for microsoft exchange removed and replaced with the attachment_info...

  • Page 213

    Chapter c 213 troubleshooting c.6 f-secure automatic update agent troubleshooting q. How can i verify that updating the virus and spam definition databases really works? A. First, open the f-secure automatic update agent window from f-secure settings and statistics and select the received packages t...

  • Page 214

    214 q. The received packages page states that a virus definition database update is “not installed”. What should i do? A. Click on the package title and then package properties to view the error message. Unable to locate anti-virus database update directory the directory does not exist, the communic...

  • Page 215

    Chapter c 215 troubleshooting q. The received packages page states that a virus definition database update is “installed”, but there are no new files in the anti-virus directory. Why? A. After downloading the update and placing it into a communication directory, f-secure content scanner server does ...

  • Page 216

    216 q. I installed the f-secure automatic update agent, but it has not downloaded any virus definition updates. What’s wrong? A. Select the received packages tab in the f-secure automatic update agent window and check that no virus definitions update packages are listed in there. Select the channel ...

  • Page 217

    Chapter c 217 troubleshooting you see a proxy server setting in the address section but it is grayed out, click advanced , remove the address and specify port 0. Mozilla firefox 1.0: under the tools menu, select options. Select the general category, and click connection settings... . If the manual p...

  • Page 218

    218 technical support f-secure online support resources........................................ 219 web club.................................................................................. 220 virus descriptions on the web ................................................. 221.

  • Page 219

    Technical support 219 f-secure online support resources f-secure technical support is available through f-secure support web pages, e-mail and by phone. Support requests can be submitted through a form on f-secure support web pages directly to f-secure support. F-secure support web pages for any f-s...

  • Page 220

    220 4. When the tool has finished collecting the data, click get report to download and save the collected data. You can also find and run the fsdiag.Exe utility under the f-secure\common folder, if you prefer not to do it through the f-secure anti-virus for microsoft exchange web console. The tool ...

  • Page 221

    Technical support 221 alternatively, right-click on the f-secure icon in the window taskbar, and choose the web club command. To connect to the web club directly from within your web browser, go to: http://www.F-secure.Com/anti-virus/webclub/corporate/ virus descriptions on the web f-secure corporat...

  • Page 222

    222.

  • Page 223

    About f-secure corporation f-secure corporation protects consumers and businesses against computer viruses and other threats from the internet and mobile networks. We want to be the most reliable provider of security services in the market. One way to demonstrate this is the speed of our response. A...

  • Page 224

    224.