F-SECURE ANTI-VIRUS - FOR MICROSOFT EXCHANGE Administrator's Manual

F-Secure Anti-Virus for

Microsoft Exchange

Administrator’s Guide

"F-Secure" and the triangle symbol are registered trademarks of F-Secure Corporation and F-Secure

product names and symbols/logos are either trademarks or registered trademarks of F-Secure

Corporation. All product names referenced herein are trademarks or registered trademarks of their

respective companies. F-Secure Corporation disclaims proprietary interest in the marks and names of

others. Although F-Secure Corporation makes every effort to ensure that this information is accurate,

F-Secure Corporation will not be liable for any errors or omission of facts contained herein. F-Secure

Corporation reserves the right to modify specifications cited in this document without prior notice.

Companies, names and data used in examples herein are fictitious unless otherwise noted. No part of

this document may be reproduced or transmitted in any form or by any means, electronic or

mechanical, for any purpose, without the express written permission of F-Secure Corporation.

This product includes software developed by the Apache Software Foundation (http://

This product includes code from SpamAssassin. The code in the files of the SpamAssassin distribution

All files in the SpamAssassin distribution fall under the same terms as Perl itself, as described in the

“Artistic License”.

This product may be covered by one or more F-Secure patents, including the following:

GB2353372 GB2366691 GB2366692 GB2366693 GB2367933 GB2368233

GB2374260

3

Contents

About This Guide 7

How This Guide Is Organized .............................................................................................. 8

Conventions Used in F-Secure Guides.............................................................................. 10

Symbols .................................................................................................................... 10

Chapter 1 Using F-Secure Anti-Virus for Microsoft Exchange 12

1.1 Administering F-Secure Anti-Virus for Microsoft Exchange ....................................... 13

1.2 Using Web Console ...................................................................................................14

1.2.1 Logging in for the First Time...........................................................................14

1.2.2 Modifying Settings and Viewing Statistics with Web Console ........................16

1.2.3 Checking the Product Status .........................................................................17

1.3 Using F-Secure Policy Manager Console ..................................................................17

1.3.1 Modifying Settings and Viewing Statistics in Centrally Administered Mode ...17

Chapter 2 Centrally Managed Administration 20

2.1 Overview ....................................................................................................................21

2.2 F-Secure Anti-Virus for Microsoft Exchange Settings ................................................21

2.2.1 General Settings.............................................................................................21

2.2.2 Transport Protection .......................................................................................31

2.2.3 Storage Protection..........................................................................................50

2.3 F-Secure Anti-Virus for Microsoft Exchange Statistics............................................... 84

2.3.1 Common .........................................................................................................85

2.3.2 Transport Protection .......................................................................................86

2.3.3 Storage Protection..........................................................................................87

2.3.4 Quarantine......................................................................................................89

2.4 F-Secure Content Scanner Server Settings...............................................................90

2.4.1 Interface..........................................................................................................90

2.4.2 Virus Scanning ...............................................................................................91

2.4.3 Virus Statistics ................................................................................................94

2.4.4 Database Updates.......................................................................................... 95

2.4.5 Spam Filtering ................................................................................................ 96

2.4.6 Threat Detection Engine.................................................................................97

4

2.4.7 Proxy Configuration ........................................................................................98

2.4.8 Advanced........................................................................................................99

2.5 F-Secure Content Scanner Server Statistics ...........................................................100

2.5.1 Server ...........................................................................................................100

2.5.2 Scan Engines ...............................................................................................101

2.5.3 Common .......................................................................................................102

2.5.4 Spam Control................................................................................................102

2.5.5 Virus Statistics ..............................................................................................103

2.6 F-Secure Management Agent Settings ....................................................................103

2.7 F-Secure Automatic Update Agent Settings ............................................................105

Chapter 3 Administration with Web Console 107

3.1 Overview ..................................................................................................................108

3.2 Home........................................................................................................................109

3.3 Transport Protection.................................................................................................113

3.3.1 Attachment Filtering......................................................................................115

3.3.2 Virus Scanning .............................................................................................117

3.3.3 Grayware Scanning ......................................................................................121

3.3.4 Archive Processing.......................................................................................124

3.3.5 Content Filtering ..........................................................................................127

3.3.6 Other Options ...............................................................................................130

3.4 Spam Control ...........................................................................................................133

3.4.1 Status ...........................................................................................................134

3.4.2 Settings.........................................................................................................135

3.5 Storage Protection ...................................................................................................139

3.5.1 Real-Time Scanning .....................................................................................140

3.5.2 Manual Scanning .........................................................................................153

3.5.3 Scheduled Scanning ....................................................................................166

3.6 Quarantine ...............................................................................................................178

3.6.1 Query............................................................................................................180

3.6.2 Options .........................................................................................................180

3.7 Automatic Updates...................................................................................................188

3.7.1 Communications...........................................................................................190

3.8 General Server Properties .......................................................................................195

3.8.1 Administration...............................................................................................196

5

3.8.2 Network Configuration .................................................................................202

3.8.3 Notifications ..................................................................................................204

3.8.4 Sample Submission......................................................................................205

3.8.5 Engines.........................................................................................................207

3.8.6 Lists and Templates .....................................................................................216

Chapter 4 Quarantine Management 219

4.1 Introduction ..............................................................................................................220

4.1.1 Quarantine Reasons.....................................................................................221

4.2 Configuring Quarantine Options...............................................................................222

4.3 Quarantine Status ....................................................................................................222

4.3.1 Quarantine Logging ......................................................................................222

4.4 Searching the Quarantined Content.........................................................................222

4.5 Query Results Page .................................................................................................227

4.5.1 Viewing Details of the Quarantined Message ..............................................228

4.6 Quarantine Operations.............................................................................................229

4.6.1 Reprocessing the Quarantined Content .......................................................231

4.6.2 Releasing the Quarantined Content .............................................................232

4.6.3 Removing the Quarantined Content .............................................................233

4.6.4 Deleting Old Quarantined Content Automatically .........................................234

4.7 Moving the Quarantine Storage ...............................................................................235

Chapter 5 Updating Virus and Spam Definition Databases 237

Overview ..................................................................................................................238

Automatic Updates with F-Secure Automatic Update Agent....................................239

Configuring Automatic Updates ...............................................................................239

Appendix A Variables in Warning Messages 241

List of Variables................................................................................................................ 242

Appendix B Sending E-mail Alerts And Reports 244

B.1 Overview ................................................................................................................. 245

B.2 Solution ....................................................................................................................245

B.2.1 Creating a Scoped Receive Connector ........................................................246

6

B.2.2 Grant the Relay Permission on the New Scoped Connector........................247

B.2.3 Specify SMTP Server for Alerts and Reports ...............................................247

Appendix C Troubleshooting 248

C.1 Overview ..................................................................................................................249

C.2 Starting and Stopping...............................................................................................249

C.3 Viewing the Log File.................................................................................................250

Quarantine Logs...................................................................................................... 250

C.4 Common Problems and Solutions............................................................................250

Checking F-Secure Anti-Virus for Microsoft Exchange ........................................... 251

Checking F-Secure Content Scanner Server.......................................................... 252

Checking F-Secure Anti-Virus for Microsoft Exchange Web Console .................... 253

C.4.1 Installing Service Packs................................................................................253

C.4.2 Securing the Quarantine...............................................................................254

C.4.3 Administration Issues ...................................................................................254

C.5 Frequently Asked Questions ....................................................................................255

Technical Support 256

F-Secure Online Support Resources ............................................................................... 257

Web Club .........................................................................................................................259

Virus Descriptions on the Web .........................................................................................259

7

ABOUT THIS GUIDE

How This Guide Is Organized...................................................... 8

Conventions Used in F-Secure Guides ....................................... 6

8

How This Guide Is Organized

F-Secure Anti-Virus for Microsoft Exchange Administrator's Guide is

divided into the following chapters:

Chapter 1. Using F-Secure Anti-Virus for Microsoft Exchange.

Instructions how to use and administer F-Secure Anti-Virus for Microsoft

Exchange.

Chapter 2. Centrally Managed Administration. Instructions how to

remotely administer F-Secure Anti-Virus for Microsoft Exchange and

F-Secure Content Scanner Server when they have been installed in

centralized administration mode.

Chapter 3. Administration with Web Console. Instructions how to

administer F-Secure Anti-Virus for Microsoft Exchange with the Web

Console.

Chapter 4. Quarantine Management. Instructions how you can manage

and search quarantined mails with the F-Secure Anti-Virus for Microsoft

Exchange Web Console.

Chapter 5. Updating Virus and Spam Definition Databases. Instructions

how to update your virus definition database.

Appendix A. Variables in Warning Messages. Lists variables that can

be included in virus warning messages.

Appendix B. Sending E-mail Alerts And Reports. Instructions how to

configure the product to send alerts to the administrator by e-mail.

Appendix C. Troubleshooting. Solutions to some common problems.

Technical Support. Contains the contact information for assistance.

About F-Secure Corporation. Describes the company background and

products.

About This Guide 9

See the F-Secure Policy Manager Administrator's Guide for detailed

information about installing and using the F-Secure Policy Manager

components:

 F-Secure Policy Manager Console, the tool for remote

administration of F-Secure Anti-Virus for Microsoft Exchange.

 F-Secure Policy Manager Server, which enables communication

between F-Secure Policy Manager Console and the managed

systems.

6

Conventions Used in F-Secure Guides

This section describes the symbols, fonts, and terminology used in this

manual.

Symbols

 An arrow indicates a one-step procedure.

Fonts

Arial bold (blue) is used to refer to menu names and commands, to

buttons and other items in a dialog box.

Arial Italics (blue) is used to refer to other chapters in the manual, book

titles, and titles of other manuals.

Arial Italics (black) is used for file and folder names, for figure and table

captions, and for directory tree names.

Courier New is used for messages on your computer screen.

Courier New bold is used for information that you must type.

WARNING: The warning symbol indicates a situation with a

risk of irreversible destruction to data.

IMPORTANT: An exclamation mark provides important information

that you need to consider.

REFERENCE - A book refers you to related information on the

topic available in another document.

l

NOTE - A note provides additional information that you should

consider.

TIP - A tip provides information that can help you perform a task

more quickly or easily.

CHAPTER 2 7

SMALL CAPS (BLACK) is used for a key or key combination on your

keyboard.

Arial underlined (blue)

is used for user interface links.

Arial italics is used for window and dialog box names.

PDF Document

This manual is provided in PDF (Portable Document Format). The PDF

document can be used for online viewing and printing using Adobe®

Acrobat® Reader. When printing the manual, please print the entire

manual, including the copyright and disclaimer statements.

For More Information

Visit F-Secure at http://www.f-secure.com for documentation, training

courses, downloads, and service and support contacts.

In our constant attempts to improve our documentation, we would

welcome your feedback. If you have any questions, comments, or

suggestions about this or any other F-Secure document, please contact

us at documentation@f-secure.com

.

12

1

USING F-SECURE

A

NTI-VIRUS FOR

M

ICROSOFT EXCHANGE

Administering F-Secure Anti-Virus for Microsoft Exchange........ 13

Using Web Console.................................................................... 14

Using F-Secure Policy Manager Console................................... 17

CHAPTER 1 13

Using F-Secure Anti-Virus for Microsoft Exchange

1.1 Administering F-Secure Anti-Virus for Microsoft

Exchange

F-Secure Anti-Virus for Microsoft Exchange can be used either in the

stand-alone mode or in the centrally administered mode, based on your

selections during the installation and the initial setup.

Centralized

Administration

Mode

In the centralized administration mode, you can administer F-Secure

Anti-Virus for Microsoft Exchange with F-Secure Policy Manager.

You can use F-Secure Anti-Virus for Microsoft Exchange Web Console to

monitor the status, start and stop the product, manage the quarantined

content, and to configure settings that are not marked as Final in the

F-Secure Policy Manager Console (settings marked as Final are greyed

out in Web Console).

Stand-alone

Mode

You can use F-Secure Anti-Virus for Microsoft Exchange Web Console to

administer the product; monitor the status, modify settings, manage the

quarantine and to start and stop the product if necessary.

14

1.2 Using Web Console

You can open F-Secure Anti-Virus for Microsoft Exchange Web Console

in any of the following ways:

 Go to Windows Start menu > Programs > F-Secure Anti-Virus for

Microsoft Exchange > F-Secure Anti-Virus for Microsoft

Exchange Web Console

 Enter the address of F-Secure Anti-Virus for Microsoft Exchange

and the port number in your web browser. Note that the protocol

used is https. For example: 

https://127.0.0.1:25023

When the Web Console login page opens, enter your user name and the

password and click Log In. Note that you must have administrator rights

to the host where F-Secure Anti-Virus for Microsoft Exchange Web

Console is installed.

1.2.1 Logging in for the First Time

Before you log in the F-Secure Anti-Virus for Microsoft Exchange Web

Console for the first time, check that javascript and cookies are enabled in

the browser you use.

Microsoft Internet Explorer users:

The address of the F-Secure Anti-Virus for Microsoft Exchange

Web Console, https://127.0.0.1:25023/

, should be added to the

Trusted sites in Internet Explorer Security Options to ensure that

F-Secure Anti-Virus for Microsoft Exchange Web Console works

properly in all environments.

CHAPTER 1 15

Using F-Secure Anti-Virus for Microsoft Exchange

When you log in for the first time, your browser displays a Security Alert

dialog window about the security certificate for F-Secure Anti-Virus for

Microsoft Exchange Web Console. You can create a security certificate

for F-Secure Anti-Virus for Microsoft Exchange Web Console before

logging in, and then install the certificate during the login process.

Step 1. Create the security certificate

1. Browse to the F-Secure Anti-Virus for Microsoft Exchange Web

Console installation directory, for example:

C:\Program Files (x86)\F-Secure\Web User Interface\bin\

2. Locate the certificate creation utility, makecert.bat, and double click it

to run the utility.

3. The utility creates a certificate that will be issued to all local IP

addresses, and restarts the F-Secure Anti-Virus for Microsoft

Exchange Web Console service to take the certificate into use.

4. Wait until the utility completes, and the window closes. Now you can

proceed to logging in.

Step 2. Log in and install the security certificate

1. Open F-Secure Anti-Virus for Microsoft Exchange Web Console.

2. The Security Alert about the F-Secure Anti-Virus for Microsoft

Exchange Web Console certificate is displayed. If you install the

certificate now, you will not see the Security Alert window again.

If you are using Internet Explorer 7, click Continue and then

Certificate Error.

3. Click View Certificate to view the certificate information.

4. The Certificate window opens. Click Install Certificate to install the

certificate with the Certificate Import Wizard.

If your company has an established process for creating and

storing certificates, follow that process to create and store the

security certificate for F-Secure Anti-Virus for Microsoft Exchange

Web Console.

16

5. The Certificate window opens. Click Install Certificate to proceed to

the Certificate Import Wizard.

6. Follow the instructions in the Certificate Import Wizard.

If you are using Internet Explorer 7, in the Place all certificates in the

following store selection, select the Trusted Root Certification

Authorities store.

If you are using Internet Explorer 6, you are prompted to add the new

certificate in the Certificate Root Store when the wizard has

completed. Click Yes to do so.

7. If the Security Alert window is still displayed, click Yes to proceed or

log back in to the F-Secure Anti-Virus for Microsoft Exchange Web

Console.

8. When the login page opens, log in to Web Console with your user

name and the password.

9. The Web Console displays Getting Started page when you log in for

the first time. You can check and configure the following information in

the Getting Started page to complete the installation:

 Internal domains and senders

 E-mail alerts and reports

 Database updates

 Product updates

1.2.2 Modifying Settings and Viewing Statistics with Web

Console

To change F-Secure Anti-Virus for Microsoft Exchange settings in

stand-alone mode, open the F-Secure Anti-Virus for Microsoft Exchange

Web Console and select the variables you want to change from the left

pane. For detailed explanations of all variables, see “Administration with

Web Console”, 107.

CHAPTER 1 17

Using F-Secure Anti-Virus for Microsoft Exchange

1.2.3 Checking the Product Status

You can check the overall product status on the Home page of F-Secure

Anti-Virus for Microsoft Exchange Web Console. Summary and Services

tabs in the Home page displays an overview of each component status

and most important statistics of the installed F-Secure Anti-Virus for

Microsoft Exchange components. From the Home page you can also

open the product logs and proceed to configure the product components.

1.3 Using F-Secure Policy Manager Console

In the centralized administration mode, you can administer F-Secure

Anti-Virus for Microsoft Exchange with F-Secure Policy Manager. To open

F-Secure Policy Manager Console, select Windows Start menu >

Programs > F-Secure Policy Manager Console.

When the Policy Manager Console opens, go to the Advanced Mode user

interface by selecting View > Advanced Mode.

F-Secure Policy Manager Console is used to create policies for F-Secure

Anti-Virus for Microsoft Exchange installations that are running on

selected hosts or groups of hosts.

For detailed information on installing and using F-Secure Policy Manager

console, see the F-Secure Policy Manager Administrator’s Guide.

1.3.1 Modifying Settings and Viewing Statistics in Centrally

Administered Mode

To change F-Secure Anti-Virus for Microsoft Exchange settings in the

centrally administered mode, follow these instructions:

1. Select F-Secure Anti-Virus for Microsoft Exchange from the

Properties pane.

2. Make sure the Policy tab is selected and assign values to variables

under the Settings branch.

18

3. Modify settings by assigning new values to the basic leaf node

variables (marked by the leaf icons) shown in the Policy tab of the

Properties pane. For detailed explanations of all variables, see

“F-Secure Anti-Virus for Microsoft Exchange Settings”, 21

Initially, every variable has a default value, which is displayed in gray.

Select the variable from the Properties pane and enter the new value

in the Editor pane to change it. You can either type the new value or

select it from a list box.

Click Clear to revert to the default value or Undo to cancel the most

recent change that has not been distributed.

4. After you have modified settings and created a new policy, it must be

distributed to hosts. Choose Distribute from the File menu.

5. After distributing the policy, you have to wait for F-Secure Anti-Virus

for Microsoft Exchange to poll the new policy file. Alternatively, click

Poll the server now in the Server Properties page in F-Secure

Anti-Virus for Microsoft Exchange Web Console.

To view statistics, select the Status tab of the Properties pane. Statistics

are updated periodically and can be reset by choosing Reset Statistics on

the Policy tab of the Properties pane. For more information, see

“F-Secure Anti-Virus for Microsoft Exchange Statistics”, 84.

Settings that are configured during the installation and the

initial setup require that you select the Final check box from the

Product View pane. For more information, see “Changing

Settings That Have Been Modified During Installation or

Upgrade”, 19.

For testing purposes you may also want to change the polling

intervals. To do that, select the domain in F-Secure Policy

Manager console and set the Incoming Packages Polling

Interval and Outgoing Packages Update Interval variables to

30-45 seconds. The variables are located under each of the

two trees in the F-Secure Management Agent / Settings /

Communications branch. Note that since the default polling

interval is 10 minutes, it might take up to 10 minutes for the

new setting to take effect.

CHAPTER 1 19

Using F-Secure Anti-Virus for Microsoft Exchange

To manage the quarantined content, use F-Secure Anti-Virus for Microsoft

Exchange Web Console. For more information, see “Quarantine

Management”, 219.

Changing Settings That Have Been Modified During Installation

or Upgrade

If you want to change a setting that has been modified locally during

installation or upgrade, you need to mark the setting as Final in the

restriction editor. The settings descriptions in this manual indicate the

settings for which you need to use the Final restriction. You can also

check in F-Secure Policy Manager Console whether you need to use the

Final restriction for a setting. Do the following:

1. Select the Policy tab and then select the setting you want to check.

2. Select the Status tab to see if the setting has been modified locally.

 If the setting is shown in grayed font in the Status view, then the

product uses the setting from the base policy and therefore the

Final restriction is not needed.

 If the setting is shown in normal black font, then the setting has

been modified locally. You must mark the setting as Final when

you change it.

20

2

CENTRALLY MANAGED

A

DMINISTRATION

Overview..................................................................................... 21

F-Secure Anti-Virus for Microsoft Exchange Settings ................ 21

F-Secure Anti-Virus for Microsoft Exchange Statistics ............... 84

F-Secure Content Scanner Server Settings ............................... 90

F-Secure Content Scanner Server Statistics............................ 100

F-Secure Management Agent Settings .................................... 103

F-Secure Automatic Update Agent Settings............................. 105

Page is loading ...

F-SECURE ANTI-VIRUS - FOR MICROSOFT EXCHANGE Administrator's Manual

F-SECURE ANTI-VIRUS - FOR MICROSOFT EXCHANGE Administrator's Manual

Related papers

Other documents