Anti-Malware settings

Expand all | Collapse all

With the help of the Anti-Malware protection module, you can protect your company mailboxes against viruses, Trojans, worms, and other security threats that can be sent in email messages.

The Anti-Malware module scans messages by using the latest version of anti-virus databases, the heuristic analyzer, and the Kaspersky Security Network cloud services.

If the application detects any malicious content included directly in the message body, the message body is replaced by the following text: The message text has been deleted due to its malicious content that posed a risk of infection. You can contact the administrator for detailed information.

When creating a security policy, you can specify the Anti-Malware settings.

Actions to be taken by the application

In the Action area, specify what the application must do with messages in which it detects malware:

• Delete and quarantine message

  The whole message is deleted from the user mailbox and moved to Quarantine.

• Delete and quarantine infected attachment

  If the application detects a threat in the attached file, the application removes the infected file only. The rest of the message remains unchanged in the user mailbox. The original message is moved to Quarantine. In this case, the removed attachment is replaced with a text file that informs the user about the action taken by the application.

  The replacement file also contains the list of infected attachments and those deleted as a result of the Anti-Malware scan. If an infected file is detected inside of an archive, the application removes the whole archive.

• File replacement template

  You can customize the file replacement template:

  1. Click the Edit replacement file button.

     The Replacement file template window opens.

  2. Edit the template contents in the Message text field. For example, the text can include instructions or other information relevant to employees of your organization.
  3. If you want to restore the default template, click the Reset button.
  4. Click Save.

     In your custom template, you can keep using the variables included in the default template.

     • %DETECTED_FILES%. The list of infected files detected in the message attachment.
     • %REMOVED_ATTACHMENTS%. The list of files actually deleted by the Anti-Malware module as a result of a scan.

  This option is available for the Delete and quarantine infected attachment action only.

• Tag the subject

  You can add a custom tag to the subjects of affected messages. If necessary, change the tag in the entry field under the Tag the subject check box.

  This option is available for the Delete and quarantine infected attachment action only.

• Delete permanently: deleted messages cannot be recovered

  To view this option, you must open the Other options drop-down list. The whole message is deleted from the user mailbox beyond recovery.

Notifications

In the Notifications area, configure notifications that will be sent automatically:

• Notify administrators about detections

  This option allows you to enable and configure notifications about detected items. By default, notifications are disabled.

  To enable and configure notifications:

  1. Select the Notify administrators about detections check box.
  2. Click the Select button to add recipients.

     The Notification for administrators window appears.

  3. Enter the email addresses of the notification recipients.

     You can specify up to 25 email addresses.

  4. Click the Plus () button.

     The selected email addresses will be displayed under the Specify email address field.

  5. To delete an email address from the list, click the Delete () button in the row.
  6. Click Save.

     The list of addresses is saved. The notifications will be sent to the specified addresses.

• Notify mailbox owner about deleted messages

  This option allows you to notify the user from whose mailbox an entire message was deleted. By default, notifications are disabled.

  To enable and configure notifications:

  1. Select the Notify mailbox owner about deleted messages check box.
  2. If necessary, adapt the notification template to comply with the requirements of your corporate security policy:
     1. Click the Edit notification template button.

        The Notification template window opens.

     2. Edit the Subject and/or Body fields.
     3. If you want to restore the default template, click the Reset button.
     4. Click Save.

     In your custom template, you can keep using the variables included in the default template to provide the user with detailed information about the deleted message.

     Notifications to mailbox owners are sent on behalf of the Security Service, which will be indicated in the From field of the corresponding email message. You cannot send a reply to this sender.

     %FROM%. Message sender.

     %TO%. Message recipients, including carbon copy ones.

     %SUBJECT%. Message subject.

     %FOLDER%. Mailbox folder where the message was detected.

     %MSG_TIME%. The receipt date and time for incoming messages, the date and time when the message was sent for outgoing messages, and the draft creation date and time for drafts. The time zone specified in the application settings is applied.

     %DETECTED_FILES%. List of files detected in the message attachment.

  This option is available for the Delete and quarantine message and Delete permanently: deleted messages cannot be recovered actions only.