GFI AVG Anti-Virus Updates for GFI MailSecurity, RNW, 50-99u, DEU User Manuals

Table of Contents

• 1 Introduction

  9
  • 1.1 Introduction to GFI MailSecurity

    9
  • 1.2 Using this manual

    9
    • 1.2.1 Manual structure

      9
    • 1.2.2 Terms and conventions used in this manual

      10
• 2 About GFI MailSecurity

  11
  • 2.1 GFI MailSecurity components

    11
    • GFI MailSecurity scan engine

      11
    • GFI MailSecurity web interface

      11
    • GFI MailSecurity Switchboard

      11
  • 2.2 How GFI MailSecurity works

    11
    • 2.2.1 Incoming email

      11
    • 2.2.2 Outgoing email

      12
    • 2.2.3 Other features

      13
  • 2.3 Licensing

    13
• 3 Monitoring the GFI MailSecurity status

  15
  • 3.1 Introduction

    15
  • 3.2 Status and statistical information

    16
    • Services

      17
    • Quarantine Statistics

      17
    • Email Statistics

      18
  • 3.3 Email processing logs

    19
    • Filtering the email processing logs

      20
  • 3.4 Virus scanning engine updates

    21
• 4 General settings

  23
  • 4.1 Introduction

    23
  • 4.2 Configuring the administrator’s email address

    23
  • 4.3 Configuring proxy server settings for automatic updates

    24
  • 4.4 Adding Local Domains

    25
  • 4.5 SMTP server bindings

    26
  • 4.6 Managing local users

    27
    • 4.6.1 GFI MailSecurity installed in Active Directory mode

      27
      • GFI MailSecurity installed on the Microsoft Exchange machine

        27
    • 4.6.2 GFI MailSecurity installed in SMTP mode

      27
      • To add a new local user:

        28
      • To remove a local user:

        28
• 5 Configuring Virus Scanning Engines

  29
  • 5.1 Introduction

    29
  • 5.2 AVG configuration

    30
    • AVG web site

      31
    • 5.2.1 AVG LinkScanner

      31
  • 5.3 Kaspersky configuration

    33
    • Kaspersky web site

      34
  • 5.4 BitDefender configuration

    35
    • BitDefender website

      36
  • 5.5 McAfee configuration

    37
    • McAfee website

      38
  • 5.6 Norman configuration

    39
    • Norman website

      40
  • 5.7 Virus scanner actions

    41
  • 5.8 Virus scanner updates

    43
    • Downloading anti-virus updates manually

      44
  • 5.9 Setting the Virus Scanning Engines scan sequence

    44
  • 5.10 Configuring Virus Scanning optimizations

    45
  • 5.11 Configuring Information Store Scanning

    45
    • 5.11.1 Information Store Scanning

      45
    • 5.11.2 VSAPI settings

      46
• 6 Configuring other mail filters

  49
  • 6.1 Content Filtering

    49
    • 6.1.1 Introduction

      49
    • 6.1.2 Creating a Content Filtering rule

      50
      • Step 1: Configuring basic rule settings

        50
      • Step 2: Configuring terms to block

        51
      • Step 3: Configuring the actions to take on detected emails

        53
      • Step 4: Specifying the users to apply this rule to

        54
    • 6.1.3 Enabling/disabling rules

      56
    • 6.1.4 Removing content filtering rules

      56
    • 6.1.5 Modifying an existing rule

      57
    • 6.1.6 Changing rule priority

      57
  • 6.2 Attachment Filtering

    57
    • 6.2.1 Introduction

      57
    • 6.2.2 Creating an Attachment Filtering rule

      59
    • 6.2.3 Enabling/disabling rules

      63
    • 6.2.4 Removing attachment rules

      64
    • 6.2.5 Modifying an existing rule

      64
    • 6.2.6 Changing the rule priority

      65
  • 6.3 Decompression engine

    65
    • 6.3.1 Introduction

      65
    • 6.3.2 Configuring the decompression engine filters

      66
      • Check password protected archives

        66
      • Check corrupted archives

        67
      • Check for recursive archives

        68
      • Check size of uncompressed files in archives

        69
      • Check for amount of files in archives

        70
      • Scan within archives (attachment checking)

        72
    • 6.3.3 Enable/disable decompression filters

      73
  • 6.4 The Trojan & Executable Scanner

    73
    • 6.4.1 Introduction

      73
      • What is a Trojan horse?

        73
      • How does the Trojan & Executable Scanner work?

        73
    • 6.4.2 Configuring the Trojan & Executable Scanner

      74
  • 6.5 The Email Exploit Engine

    77
    • 6.5.1 Introduction

      77
      • What is an exploit?

        77
      • What is an e-mail exploit?

        77
      • Difference between Anti-Virus software & Email Exploit Detection software

        77
    • 6.5.2 Configuring the Email Exploit Engine

      77
    • 6.5.3 Enabling/Disabling email exploits

      81
  • 6.6 The HTML Sanitizer

    82
    • 6.6.1 Introduction

      82
      • Why remove HTML scripts?

        83
    • 6.6.2 Configuring the HTML Sanitizer

      83
    • 6.6.3 HTML Sanitizer Whitelist

      83
      • Adding an HTML Sanitizer Whitelist entry

        84
      • Deleting an HTML Sanitizer Whitelist entry

        84
• 7 Quarantine

  85
  • 7.1 Introduction

    85
  • 7.2 The Quarantine Store

    85
    • 7.2.1 Searching for quarantined emails

      85
      • Content search

        86
      • Search by date

        87
    • 7.2.2 Search Folders

      87
      • Creating a new Search Folder

        87
      • Modifying a Search Folder

        90
      • Deleting Search Folders

        91
    • 7.2.3 Approving quarantined emails

      91
      • Sanitize and Approve

        92
    • 7.2.4 Permanently deleting quarantined emails

      92
      • Delete and Notify

        93
    • 7.2.5 Rescanning quarantined emails

      93
    • 7.2.6 Viewing the full security threat report of an email

      94
    • 7.2.7 Downloading quarantined email

      95
  • 7.3 Quarantine Action Forms

    95
    • 7.3.1 Enabling Quarantine Action Forms

      95
    • 7.3.2 Reviewing quarantined emails

      96
    • 7.3.3 Logging quarantine actions

      98
  • 7.4 Quarantine RSS feeds

    98
    • 7.4.1 Enabling Quarantine RSS Feeds

      99
    • 7.4.2 Subscribing to Quarantine RSS feeds

      100
      • Subscribing to all enabled Quarantine RSS feeds

        100
      • Subscribing to a search folder Quarantine RSS feed

        101
    • 7.4.3 Securing access to the GFI MailSecurity Quarantine RSS feeds

      101
  • 7.5 Directory Harvesting

    102
    • 7.5.1 Configuring Directory Harvesting

      102
• 8 Reporting

  105
  • 8.1 Introduction

    105
  • 8.2 Enabling reporting

    105
  • 8.3 Configuring the database

    105
    • Configuring a Microsoft Access database backend

      106
    • 8.3.1 Configuring a Microsoft SQL Server database backend

      106
• 9 Miscellaneous

  109
  • 9.1 Patch Checking

    109
  • 9.2 Version Information

    110
  • 9.3 Tracing

    110
  • 9.4 Failed emails

    111
    • 9.4.1 Reprocessing legitimate emails that fail

      112
      • GFI MailSecurity installed on Microsoft Exchange Server 2007/2010

        112
      • GFI MailSecurity installed on Microsoft Exchange Server 2003

        112
      • GFI MailSecurity installed on Gateway server

        112
    • 9.4.2 Failed emails notifications

      112
  • 9.5 Notification templates

    113
    • Notifications

      113
    • Templates

      114
    • 9.5.1 Customizing notification templates

      114
      • Variables used in XSL-based notification templates

        114
  • 9.6 Monitoring Virus Scanning API

    115
    • 9.6.1 Performance counter in Windows 2003 Server

      115
    • 9.6.2 Performance counter in Windows 2008 Server

      116
    • 9.6.3 Performance monitor counters

      118
• 10 Troubleshooting

  121
  • 10.1 Introduction

    121
  • 10.2 Knowledge Base

    121
  • 10.3 Web Forum

    121
  • 10.4 Common issues

    121
  • 10.5 Request technical support

    122
  • 10.6 Build notifications

    122
• 11 Glossary

  123