Administrator's Guide - Kerio Software Archive

Antivirus control
Warning:
1. Antivirus control within WinRoute can only detect and block infected attachments.
Attached files cannot be healed by this control!
2. Within antivirus scanning, it is possible to remove only infected attachments, entire
email messages cannot be dropped. This is caused by the fact that the firewall cannot
handle email messages like mailservers do. It only maintains network traffic coming
through. In most cases, removal of an entire message would lead to a failure in
communication with the server and the client might attempt to send/download the
message once again. Thus, one infected message might block sending/reception of any
other (legitimate) mail.
3. In case of SMTP protocol, only incoming traffic is checked (i.e. traffic from the Internet
to the local network — incoming email at the local SMTP server). Checks of outgoing
SMTP traffic (i.e. from the local network to the Internet) might cause problems with
temporarily undeliverable email (for example in cases where the destination SMTP
server uses so called greylisting).
To check also outgoing traffic (e.g. when local clients connect to an SMTP server without
the local network), define a corresponding traffic rule using the SMTP protocol inspector.
For details, see chapter 14.2.
Advanced parameters and actions that will be taken when a virus is detected can be set in the
Email scanning tab.
In the Specify an action which will be taken with attachments... section, the following actions
can be set for messages considered by the antivirus as infected:
• Move message to quarantine — untrustworthy messages will be moved to a special
directory on the Kerio Control host. The Kerio Control administrator can try to heal
infected files and later send them to their original addressees.
The quarantine subdirectory under the Kerio Control directory is used for the
quarantine
(the typical path is C:\Program Files\Kerio\WinRoute Firewall\quarantine)
Messages with untrustworthy attachments are saved to this directory under names
which are generated automatically by WinRoute. Each filename includes information
about protocol, date, time and the connection number used for transmission of the
message.
• Prepend subject message with text — use this option to specify a text to be attached
before the subject of each email message where at least one infected attachment is
found. This text informs the recipient of the message and it can be also used for
automatic message filtering.
200