Anti-Virus protection

Kaspersky Secure Mail Gateway provides anti-virus protection of messages: It scans email messages for viruses and other threats and disinfects infected objects using the current (latest) version of Anti-Virus databases.

Messages are scanned for viruses and other threats by Anti-Virus engine. Anti-Virus engine scans the body of the message and all attached files in any format (attachments) using the Anti-Virus databases. The Anti-Virus engine detects and blocks email attachments that are intended for a limited number of recipients and are components of targeted attacks designed to exploit software vulnerabilities.

In addition to virus scanning of messages, you can enable detection of certain legitimate applications by the Anti-Virus component.

Based on the scan results, the Anti-Virus engine assigns the message one of the virus scan status labels and adds a tag with the status at the beginning of the message subject (Subject field).

Depending on the status assigned, the application performs actions in accordance with the message processing rule settings. You can select actions to be performed by the application on messages with a certain status and configure tags to be added to messages based on the Anti-Virus scanning result. Before processing a message, the application saves a copy of it in Backup.

You can specify the maximum size of attachments to be scanned and determine the objects to be skipped during Anti-Virus scanning. Attachments in certain formats and with certain names can be excluded from the scan.

The Anti-Virus engine is enabled by default. If required, you can disable Anti-Virus module or disable Anti-Virus scanning for any rule.

About virus scan status

Based on the results of scanning for viruses, the Anti-Virus engine assigns one of the following virus scan statuses to messages:

• Clean (Clean message)—Object is not infected.
• Infected (Infected message)—Object is infected; either it cannot be disinfected, or disinfection has not been attempted.
• Disinfected (Disinfected message)—Object is disinfected.
• Encrypted (Encrypted message)—Object cannot be scanned because it is encrypted.
• Corrupted (Corrupted message)—Object is corrupted or an error occurred during scanning.
• Attachments with macros—Message contains a macro in the attachment.

Enabling and disabling Anti-Virus protection of messages

To enable or disable Anti-Virus protection of messages:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Protection subsection.
2. In the Anti-Virus section, do one of the following:
   • Flip on the toggle switch next to the name of the Anti-Virus settings group to enable anti-virus protection of messages.
   • Flip off the toggle switch next to the name of the Anti-Virus settings group to disable anti-virus protection of messages.

Enabling and disabling Anti-Virus scanning for a rule

You can enable or disable virus scanning of messages for one or several rules. Anti-Virus scanning is enabled by default.

Before enabling or disabling Anti-Virus scanning of messages for a rule, make sure that Anti-Virus engine of Kaspersky Secure Mail Gateway is enabled.

To enable or disable virus scanning of messages for a rule:

1. In the main window of the application web interface, open the management console tree and select the Rules section.
2. In the list of rules, click the name of the rule to open the rule for which you want to enable or disable virus scanning of messages.
3. Select the Anti-Virus section.
4. Do one of the following:
   • Flip on the toggle switch next to the name of the Anti-Virus settings group to enable virus scanning of messages for a rule.
   • Flip off the toggle switch next to the name of the Anti-Virus settings group to disable virus scanning of messages for a rule.
5. Click the Apply button in the lower part of the workspace.

Configuring Anti-Virus engine settings

To configure Anti-Virus engine settings:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Protection subsection.
2. In the Anti-Virus section, click any link to open the Anti-Virus settings window.
3. In the Protection and heuristic analysis settings group, select one of the following options in the drop-down list Use KSN:
   • Yes, if you want to use KSN.
   • No, if you do not want to use KSN.
4. In the Protection and heuristic analysis settings group, select one of the following options in the drop-down list Use heuristic analysis:
   • Yes, if you want to use Heuristic Analysis.
   • No, if you do not want to use Heuristic Analysis.
5. If you have enabled Heuristic Analyzer, in the Protection and heuristic analysis settings group in the Heuristic analysis level list select the level of heuristic analysis.
6. In the Protection and heuristic analysis settings group, select one of the following options in the I consider some legitimate applications that can be exploited by hackers, to be dangerous for the corporate LAN drop-down list:
   • Yes, if you believe that such applications can be exploited by criminals to harm the computer network of your organization.
   • No, if you do not believe that such applications can be exploited by criminals to harm the computer network of your organization.

   Such legitimate applications include, for example, commercial remote administration utilities, IRC clients, dialers, file downloaders, computer system activity monitors, and password management utilities. Messages in which such applications are detected will be processed according to the rules for infected objects.

7. If, in the I consider some legitimate applications that can be exploited by hackers, to be dangerous for the corporate LAN list, you selected Yes, in the Protection and heuristic analysis settings group in the Enable detection of some legitimate applications drop-down list select one of the following options:
   • Yes, if you want to enable detection of such applications by Kaspersky Secure Mail Gateway.
   • No, if you want to disable detection of such applications by Kaspersky Secure Mail Gateway.
8. In the Performance settings group, in the Maximum scanning time field specify the maximum virus scan time in seconds.

   If the virus scan of a message does not finish within the time limit you specified, Kaspersky Secure Mail Gateway:

   • Stops scanning the message (Skip action).
   • Assigns Clean (Clean message) status to the message.
   • Adds the av-status="Clean"label to the message subject.
   • Delivers the message to the recipient.
   • Adds the following entry to the /var/log/maillog event log:

     <scan time and date> <Kaspersky Secure Mail Gateway hostname>: not clean: message-id=<message ID>: relay-ip=<IP address of the computer of the message recipient>: action="Skipped": rules=<rule ID>: size=<message size>: mail-from=<email address of the message sender>: rcpt-to=<email address of the message sender>: av-status="Clean", ap-status="Error", as-status="Error", ma-status="NotScanned, disabled by settings", cf-status="NotScanned, disabled by settings">

9. In the Performance settings group, in the Maximum scanning level field specify the maximum scanning level for messages scanned by the Anti-Virus engine.
10. Click the Apply button.

Setting default values for Anti-Virus engine settings

To set default values for Anti-Virus engine settings:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Protection subsection.
2. In the Anti-Virus section, click any link to open the Anti-Virus settings window.
3. In the lower part of the Anti-Virus settings window, click the Set default values link.
4. Click the Apply button.

Configuring actions on messages during Anti-Virus scanning

To configure the actions to be performed by Kaspersky Secure Mail Gateway on messages during virus scanning:

1. In the main window of the application web interface, open the management console tree and select the Rules section.
2. In the list of rules, click the link with the name of the rule to open the rule for which you want to configure actions on messages during virus scanning.
3. Select the Anti-Virus section.
4. Flip on the toggle switch next to the name of the Anti-Virus settings group if it is off.
5. In the If an infected file is detected drop-down list, select one of the following actions to perform on infected messages that pose a threat to the local area network of your organization:
   • Disinfect.
   • Delete attachment.
   • Delete message
   • Reject
   • Skip

   The Disinfect action is selected by default.

6. If the action of the If an infected file is detected setting is set to Disinfect, in the right part of the workspace in the If disinfection fails drop-down list select one of the following actions to take on infected messages that cannot be disinfected:
   • Delete attachment.
   • Delete message
   • Reject

   The Delete attachment action is selected by default.

7. If you selected one of the actions Disinfect, Delete attachment or Delete message, you can configure copies of messages to be automatically saved in Backup before those messages are processed. To do so, select the check box next to the Place copy in Backup setting name.

   By default, before performing the Disinfect, Delete attachment and Delete message actions, the application places a copy of messages in Backup.

8. In the If scan errors detected drop-down list, select one of the following actions to take on messages that returned errors during scanning:
   • Delete attachment.
   • Delete message
   • Reject
   • Skip

   The Skip action is selected by default.

9. If you selected one of the actions Delete attachment or Delete message] you can configure copies of messages to be automatically saved in Backup before those messages are processed. To do so, select the check box next to the Place copy in Backup setting name.

   By default, before performing the Delete attachment and Delete message the application places a copy of messages in Backup.

10. In the If encrypted object is detected drop-down list, select one of the following actions to take on messages containing encrypted objects:
    • Delete attachment.
    • Delete message
    • Reject
    • Skip

    The Skip action is selected by default.

11. If you selected one of the actions Delete attachment or Delete message] you can configure copies of messages to be automatically saved in Backup before those messages are processed. To do so, select the check box next to the Place copy in Backup setting name.

    By default, before performing the Delete attachment and Delete message the application places a copy of messages in Backup.

12. Select the Process attachments with macros check box if you want the application to process attachments with macros.
13. In the If a macro is detected drop-down list, select one of the following actions to take on messages containing macros in an attachment:
    • Delete attachment.
    • Delete message
    • Reject
    • Skip

    The Delete attachment action is selected by default.

14. If you selected one of the actions Delete attachment or Delete message] you can configure copies of messages to be automatically saved in Backup before those messages are processed. To do so, select the check box next to the Place copy in Backup setting name.

    By default, before performing the Delete attachment and Delete message actions, the application places a copy of messages in Backup.

15. Click the Apply button in the lower part of the workspace.

In order for the settings you have configured to be used during operation of Kaspersky Secure Mail Gateway, make sure that Anti-Virus scanning of messages is enabled for the rule and the rule for which you have configured settings is enabled.

Configuring tags added to message subjects after Anti-Virus scanning

To configure tags that Kaspersky Secure Mail Gateway adds to the message subject after virus scanning:

1. In the main window of the application web interface, open the management console tree and select the Rules section.
2. In the list of rules, click the name of the rule to open the rule for which you want to configure tags added to message subjects after virus scanning.
3. Select the Anti-Virus section.
4. Flip on the toggle switch next to the name of the Anti-Virus settings group if it is off.
5. Add a tag to the Subject field of infected messages. To do so, perform the following:
   1. In the If an infected file is detected settings group, click the link to the right of the Add the following text to the subject of an infected email message setting name to open the Tag for messages that contain malicious objects window.
   2. In the field under the name of the window, enter the text that you want to add at the beginning of the subject of infected messages. For example, you can add the Infected tag.
   3. Click the OK button.

      The Tag for messages that contain malicious objects window closes.

6. Add a tag to the Subject field of disinfected messages. To do so, perform the following:
   1. In the If an infected file is detected settings group, click the link to the right of the Add the following text to the subject of a disinfected email message setting name to open the Tag for messages that contain disinfected objects window.
   2. In the field under the name of the window, enter the text that you want to add at the beginning of the subject of disinfected messages. For example, you can add the Cured tag.
   3. Click the OK button.

      The Tag for messages that contain disinfected objects window closes.

7. Add a tag to the Subject field of messages with objects found to contain errors during scanning. To do so, perform the following:
   1. In the If scan errors detectedsettings group, click the link to the right of the Add the following text to subject of email message setting name to open the Tag for messages with objects that cause scan errors window.
   2. In the field under the name of the window, enter the text that you want to add at the beginning of the subject of messages that returned scan errors. For example, you can add the Corrupted tag.
   3. Click the OK button.

      The Tag for messages with objects that cause scan errors window closes.

8. Add a tag to the Subject field of messages that contain encrypted objects. To do so, perform the following:
   1. In the If encrypted object is detected settings group, click the link to the right of the Add the following text to subject of email message setting name to open the Tag for messages that contain encrypted objects window.
   2. In the field under the name of the window, enter the text that you want to add at the beginning of the subject of messages containing encrypted objects. For example, you can add the Encrypted tag.
   3. Click the OK button.

      The Tag for messages that contain encrypted objects window closes.

9. Add a label to the Subject field of messages that contain macros in an attachment. To do so, perform the following:
   1. In the If a macro is detected settings group, click the link to the right of the Add the following text to subject of email message setting name to open the Tag for messages with a macro in the attachment window.
   2. In the field under the name of the window, enter the text that you want to add at the beginning of the subject of messages containing macros in an attachment. For example, you can add the Attachments with Macros tag.
   3. Click the OK button.

      The Tag for messages with a macro in the attachment window closes.

10. Click the Apply button in the lower part of the workspace.

In order for the settings you have configured to be used during operation of Kaspersky Secure Mail Gateway, make sure that Anti-Virus scanning of messages is enabled for the rule and the rule for which you have configured settings is enabled.

Configuring Anti-Virus scan restrictions and exclusions

To configure restrictions and exclusions during virus scanning for a rule:

1. In the main window of the application web interface, open the management console tree and select the Rules section.
2. In the list of rules, click the link with the name of the rule to open the rule for which you want to configure restrictions and exclusions from virus scanning of messages.
3. Select the Anti-Virus section.
4. Flip on the toggle switch next to the name of the Anti-Virus settings group if it is off.
5. If you want to exclude archives from virus scanning, in the Exclusions from scanning settings group select the Do not scan archives check box.
6. To exclude message attachments of a certain size from virus scanning, do the following in the Exclusions from scanning settings group:
   1. Click the link to the right of the Do not scan objects larger than setting name to open the Attachment size scan limit window.
   2. In the field under the window name, enter the maximum size of objects to be scanned in the range from 0 KB to 1048576 KB (1 GB).

      If the value is set to 0 KB, no restrictions apply to the size of objects.

   3. Click the OK button.

      The Attachment size scan limit window closes.

7. To exclude message attachments with certain names from virus scanning, do the following in the Exclusions from scanning settings group:
   1. Click the link to the right of the Do not scan attachments by name masks setting name to open the Banned names window.
   2. In the field under the window name, enter the masks of names of attachments that you want to exclude from virus scanning.

      Masks can contain any symbols. Separate masks with the ";" symbol.

   3. Click the OK button.

      The Banned names window closes.

8. If you want to exclude message attachments of a certain format from virus scans, do the following in the Exclusions from scanning settings group:
   1. Click the link to the right of the Do not scan attachments by file types setting name to open the Banned attachment types window.
   2. Select check boxes next to the formats of attachments that you want to exclude from virus scanning.
   3. Click the Close button.

      The Banned attachment types window closes.

9. Click the Apply button in the lower part of the workspace.

In order for the settings you have configured to be used during operation of Kaspersky Secure Mail Gateway, make sure that Anti-Virus scanning of messages is enabled for the rule and the rule for which you have configured settings is enabled.