Administrator's Guide - Kerio Software Archive

14.3 HTTP and FTP scanning
Use the If a virus is found... entry to specify actions to be taken whenever a virus is detected
in a transmitted file:
• Move the file to quarantine — the file will be saved in a special directory on the
Kerio Control host. Kerio Control administrators can later try to heal the file using
an antivirus program and if the file is recovered successfully, the administrator can
provide it to the user who attempted to download it.
The quarantine subdirectory under the Kerio Control directory is used for the
quarantine
(the typical path is C:\Program Files\Kerio\WinRoute Firewall\quarantine)
Infected files (files which are suspected of being infected) are saved into this directory
with names which are generated automatically. Name of each file includes information
about protocol, date, time and connection number used for the transmission.
Warning:
When handling files in the quarantine directory, please consider
carefully each action you take, otherwise a virus might be activated and
the Kerio Control host could be attacked by the virus!
• Alert the client — Kerio Control alerts the user who attempted to download the file by
an email message warning that a virus was detected and download was stopped for
security reasons.
Kerio Control sends alert messages under the following circumstances: The user
is authenticated and connected to the firewall, a valid email address is set in
a corresponding user account (see chapter 16.1) and the SMTP server used for mail
sending is configured correctly (refer to chapter 18.3).
Note: Regardless of the fact whether the Alert the client option is used, alerts can
be sent to specified addresses (e.g. addresses of network administrators) whenever
a virus is detected. For details, refer to chapter 19.4.
In the If the transferred file cannot be scanned section, actions to be taken when the antivirus
check cannot be applied to a file (e.g. the file is compressed and password-protected, damaged,
etc.):
• Deny transmission of the file — Kerio Control will consider these files as infected and
deny their transmission.
Hint:
It is recommended to combine this option with the Move the file to quarantine
function — the firewall administrator can extract the file and
perform manual antivirus check in response to user requests.
197