Configuring Anti-Virus protection

Before configuring Anti-Virus protection in the message processing rule, make sure that the Anti-Virus module is enabled in general protection settings.

To configure Anti-Virus protection in the message processing rule:

In the application web interface window, select the Rules section.
In the rule table, select the rule for which you want to configure Anti-Virus protection.
This opens the View rule window.
Click Edit.
Rule settings become editable.
In the left pane, select the Anti-Virus section.
Use the toggle switch to the right of the section title to enable or disable Anti-Virus scanning of messages that match rule criteria.
Anti-Virus protection of messages is enabled by default.
If you have disabled Anti-Virus scanning, configure Anti-Virus module settings applied to the following objects based on the results of the scan:
- Infected and probably infected objects, as well as legitimate applications that can be exploited by hackers.
  1. On the Infected file tab, under Action, select the action that you want to apply to messages:
    - Skip.
      Deliver message to recipient
    - Disinfect.
      Disinfect infected files and deliver the message to recipient.
    - Delete attachment.
      Deliver message without attachment to recipient
    - Reject.
      Do not deliver message to recipient. Send SMTP session error code to the sender server if possible. If error code cannot be sent, send SMTP session success code to the sender server, and a non-delivery report might be sent to the sender of the original message
    - Delete message.
      Do not deliver message to recipient. Send SMTP session success code to the sender server. No non-delivery report is sent to the sender of the original message
    The Disinfect action is selected by default.
  2. If you selected the Disinfect action, under If disinfection fails, select one of the following actions to take on infected messages that cannot be disinfected:
    - Delete attachment.
    - Reject.
    - Delete message.
    The Delete attachment action is selected by default.
  3. If you want to automatically place in Backup messages with detected objects based on the results of the anti-virus scan, turn on the Place original message in Backup toggle switch.
    This toggle switch is on by default.
  4. If you want a tag to be added automatically to the beginning of the subject of infected messages, in the Text to add to subject of infected message field, enter the text of the tag.
    By default, the [Infected] tag is added.
  5. If you want tags to be added automatically to the beginning of the subject of infected and disinfected messages, in the Text to add to subject of disinfected message field, enter the text of the tags.
    By default, the [Cured] tag is added.
  6. If you want notifications to be sent based on the results of the scan, under Notifications, click Add and configure the following:
    1. In the Template drop-down list, select a notification template.
    2. Under Recipients, select check boxes next to the recipients of the notification. Recipients may be:
      Recipients from the general list.
      This option is available if the general list of recipients contains at least one email address.
      
      Message recipients.
      Message sender.
      Custom addresses.
    3. If you selected the Custom addresses option, in the Custom addresses field, specify other email addresses of notification recipients.
      Use a semicolon or a new line to separate email addresses.
    4. Under Notification contents, select one of the following values:
      Notification only.
      Notification with the original message attached.
    If necessary, repeat the steps to configure as many notifications as you need.
- Objects with errors encountered during scanning.
  1. On the Scan error tab, under Action, select an action to apply to messages that cause errors when scanned:
    The Skip action is selected by default.
  2. If you want to automatically place in Backup those messages that triggered errors when scanned, select the Place original message in Backup check box.
    This toggle switch is off by default.
  3. If you want tags to be added automatically to the beginning of the subject of messages that caused errors when scanned, in the Text to add to message subject field, enter the text of the tag.
  4. If you want notifications to be sent based on the results of the scan, under Notifications, click Add and configure the following:
    1. In the Template drop-down list, select a notification template.
    2. Under Recipients, select check boxes next to the recipients of the notification. Recipients may be:
      Recipients from the general list.
      This option is available if the general list of recipients contains at least one email address.
      
      Message recipients.
      Message sender.
      Custom addresses.
    3. If you selected the Custom addresses option, in the Custom addresses field, specify other email addresses of notification recipients.
      Use a semicolon or a new line to separate email addresses.
    4. Under Notification contents, select one of the following values:
      Notification only.
      Notification with the original message attached.
    If necessary, repeat the steps to configure as many notifications as you need.
- Encrypted objects.
  1. On the Encrypted object tab, under Action, select the action to apply to messages that contain encrypted objects:
    The Skip action is selected by default.
  2. If you want to automatically place in Backup the messages that contain encrypted objects, turn on the Place original message in Backup toggle switch.
    This toggle switch is off by default.
  3. If you want tags to be added automatically to the beginning of the subject of messages that contain encrypted objects, in the Text to add to message subject field, enter the text of the tag.
  4. If you want notifications to be sent based on the results of the scan, under Notifications, click Add and configure the following:
    1. In the Template drop-down list, select a notification template.
    2. Under Recipients, select check boxes next to the recipients of the notification. Recipients may be:
      Recipients from the general list.
      This option is available if the general list of recipients contains at least one email address.
      
      Message recipients.
      Message sender.
      Custom addresses.
    3. If you selected the Custom addresses option, in the Custom addresses field, specify other email addresses of notification recipients.
      Use a semicolon or a new line to separate email addresses.
    4. Under Notification contents, select one of the following values:
      Notification only.
      Notification with the original message attached.
    If necessary, repeat the steps to configure as many notifications as you need.
- Attachments with macros.
  1. If you want the application to process attachments with macros, on the Macro tab, enable the Process attachments with macros toggle switch.
  2. Under Action, select the action that you want to apply to messages:
    The Delete attachment action is selected by default.
  3. If you want to automatically place in Backup the messages that contain attachments with macros, turn on the Place original message in Backup toggle switch.
    This toggle switch is off by default.
  4. If you want tags to be added automatically to the beginning of the subject of messages that contain attachments with macros, in the Text to add to message subject field, enter the text of the tag.
    By default, the [Attachments with Macros] tag is added.
  5. If you want notifications to be sent based on the results of the scan, under Notifications, click Add and configure the following:
    1. In the Template drop-down list, select a notification template.
    2. Under Recipients, select check boxes next to the recipients of the notification. Recipients may be:
      Recipients from the general list.
      This option is available if the general list of recipients contains at least one email address.
      
      Message recipients.
      Message sender.
      Custom addresses.
    3. If you selected the Custom addresses option, in the Custom addresses field, specify other email addresses of notification recipients.
      Use a semicolon or a new line to separate email addresses.
    4. Under Notification contents, select one of the following values:
      Notification only.
      Notification with the original message attached.
    If necessary, repeat the steps to configure as many notifications as you need.
If necessary, configure the list of exclusions from scanning. To do so, on the Exclusions tab:
1. If you want to exclude archives from Anti-Virus scans, turn on the Do not scan archives toggle switch.
2. If you want to exclude attached objects with certain names from Anti-Virus scans, in the Do not scan attachments by name masks field, type a name mask and press Enter.
  Enter masks one by one. Repeat the steps for each mask you want to add.
  
  You can copy the added masks by clicking .
  
  Masks are case-insensitive and may contain any characters.
Click Save.

Anti-Virus protection is configured. The specified settings are applied to messages that match the rule criteria.

To ensure that the configured settings are applied by KSMG, make sure that Anti-Virus scanning is enabled for the rule and the configured rule is enabled.

Page top