What s New in Trend ScanMail for Microsoft Exchange 2.5

Transcription

1 What s New in Trend ScanMail for Microsoft Exchange 2.5 This section covers what is new in ScanMail for Microsoft Exchange release 2.5. It applies to the Windows NT (both Intel and Alpha-processor based) versions of ScanMail. All users should refer to the Quick Start Guide for complete installation instructions. This document is organized into four sections: I. New features: New feature list and description of new features included in ScanMail for Microsoft Exchange version 2.5. II. Installing ScanMail for Microsoft Exchange: System requirements, installing a new version of ScanMail, upgrading from earlier Windows NT versions of ScanMail, creating a customized Windows NT account for remote installations, setting up Public Folder scanning, ScanMail installed files and registry key. III. New Log Files: Overview of the Open Mailbox Log and New Mailbox Log. IV. Running with Trend Virus Control System: Overview of Trend VCS and brief explanation of how it relates to ScanMail for Microsoft Exchange.

2 What s New in Trend ScanMail for Microsoft Exchange Section I. New Features Automatic detection of new mailboxes created ScanMail for Microsoft Exchange sends a message to users that their mailbox is protected when the mailbox is created Two new log files have been added to the Real-Time Scan Monitor in this release: Open Mailbox Log for reporting mailboxes that ScanMail can not access New Mailbox Log for reporting the newly created mailboxes that will now be protected by ScanMail New algorithm for improved Incremental Scanning Proxy Authentication for pattern downloads Remote installation, upgrade, and uninstall can now be performed from the x86 platform to the Alpha, and vice versa Simplified ScanMail for Microsoft Exchange console access Installation Improvements: Domain name now a selectable item on the installation list New editable text box for the server name on installation Remote server s disk space is now checked before deploying the installation agent to the shared directory Both the remote server and the local workstation are now cleaned completely when the administrator clicks the "Stop" button during installation Trend VCS Agent installation option as part of the ScanMail for Microsoft Exchange installation process

3 Automatic Detection of New Mailboxes ScanMail for Microsoft Exchange now automatically detects new mailboxes created. In earlier releases, the administrator had to Schedule Directory Exports in order to notify ScanMail when new mailboxes were created. Note: Directory Exports are no longer required, either during installation or as a maintenance procedure. In addition, ScanMail for Microsoft Exchange will now send a message to users when their mailboxes are created. The System Attendant will send a notification message from the real-time scan monitor to let the user know that their mailbox is now protected from virus threats. Automatic detection requires no additional configuration. Just allow one minute after the creation of a new user and the mailbox will automatically be detected by ScanMail. The user will then be notified that their mailbox is being protected. New Log Files Two new log files have been added to the Real-time Scan Monitor in the same location as the existing Public Folder log. The Public Folder is used to report the public folders that ScanMail can not access. The new log files are: Open Mailbox Log for reporting mailboxes that ScanMail can not access New Mailbox Log for reporting the newly created mailboxes that will now be protected by ScanMail

4 What s New in Trend ScanMail for Microsoft Exchange For a description of how to access the log files, see Section III. New Log Files. Alpha Platform is Now Supported ScanMail for Microsoft Exchange offered support only for the x86 platform in versions below With version 2.5, ScanMail brings the full feature set to the Alpha platform. In addition, installation from Alpha machines to x86 machines and vice versa is now fully supported. See Section II. Installation Improvements for more details. Proxy Authentication for Pattern Downloads Proxy authentication for pattern downloads has been added to this version. If the administrator enters the wrong account or password, ScanMail opens a dialog box to prompt for the Network Password again. This addition makes the pattern download process easier and more reliable. Improved Incremental Scanning A new algorithm is now used for improved Incremental Scanning. It is based on registry values rather than the Windows NT file attributes. Note: Incremental Scanning can greatly reduce the server load. When Incremental Scanning is first enabled, all exchange mailboxes and public folders are checked for viruses. After setting the scan status for each message, only changed messages will be scanned in future scheduled scans.

5 Simplified ScanMail Console Log On It is no longer necessary to enter the ScanMail profile name in order to access the ScanMail Console on the server. Just go to Start Programs ScanMail for Microsoft Exchange ScanMail for Microsoft Exchange and the ScanMail Console will be loaded. Installation Improvements Several installation improvements have been added to make the installation process more fully functioned and easy-to-use: New Installation Option Domain Name ScanMail for Microsoft Exchange can now be installed on all servers in a domain by simply selecting the domain name administers no longer have to select all servers individually. Selecting the domain name is easier than expanding the domain tree and then multiple-selecting all the server names in the domain. New Installation Option Editable Server Name The installation program now has an editable text box for the server name field. Previous versions allowed selection using the mouse only. The Select Target Servers screen contains this text box. Just enter the server name and click Add. Alpha Remote Installation Improvements Remote installation, upgrade, and uninstall can now be performed from the x86 platform to Alpha processor-based servers, and vice versa.

6 What s New in Trend ScanMail for Microsoft Exchange Check of Remote Server Disk Space During installation, the remote server s disk space is now checked before deploying the installation agent to the shared directory. If you are performing a local installation, local server disk space is also checked, as it was in previous version as well. "Stop" Installation Improvement The installation process has been improved for cases when the user decides to halt the installation process. The user merely clicks on the "Stop" button and the remote or local server are cleaned completely of all installation files. New Installation Option Trend VCS Agent Trend VCS Agent can now be installed during ScanMail for Microsoft Exchange setup. The administrator can optionally install the Trend VCS Agent immediately after finishing ScanMail installation. In addition, Trend VCS Agent can be uninstalled as part of the ScanMail for Microsoft Exchange uninstallation. Section II. Installing Trend ScanMail for Microsoft Exchange ScanMail for Exchange can be installed locally or remotely on Windows NT Server 4.0 (or 3.51) with Microsoft Exchange Server 4.0, 5.0 or 5.5. Remote installation supports installation to multiple servers, thus facilitating deployment of the software in the enterprise. You can perform remote installation from a Windows NT Workstation 4.0 (or 3.51) or from a Windows NT Server 4.0 (or 3.51). Installation, whether local or remote, requires that the target servers be logged in under an Exchange Service account.

7 Minimum System Requirements 166 MHz Intel Pentium (or Alpha 300) processor-based computer or higher 64 MB RAM 15 MB free disk space for the program files Microsoft Exchange Server (English) version 4.0, 5.0, or 5.5 Windows NT Server version 3.51 with Service Pack 5, or Windows NT Server version 4.0 (English) Local Installation The server must be logged in under an Exchange Service account Windows NT Server 3.51 or 4.0 Microsoft Exchange Server 4.0, 5.0, or 5.5 Remote Installation Target Servers: The target server must be logged in under an Exchange Service account Windows NT Server 3.51 or 4.0 Microsoft Exchange Server 4.0, 5.0 or 5.5 LAN connection Setup PC: Must use an account with Windows NT administrator privilege ("log on as a service") and Exchange "admin" privilege on organization, site, and configuration levels Windows NT Server 3.51 or 4.0/Windows NT Workstation 3.51 or 4.0 LAN connection

8 What s New in Trend ScanMail for Microsoft Exchange Installation Procedure You can install ScanMail either as an upgrade from a previous release or as a new version. The primary difference is whether to use or overwrite existing ScanMail configuration settings and log files. Installing a New Version of ScanMail If you have the Trend Enterprise Solution CD, invoke "GO.EXE" by inserting the CD into the CD-ROM drive or by running the program from the Windows Start menu. From the displayed screen, click "Install" in the left pane and then select "ScanMail for Exchange" from the product list box in the center. Select "English" and then click "Install". The Welcome screen appears. 1. Insert the ScanMail for Microsoft Exchange CD into the CD-ROM drive and run the Setup (SETUP.EXE) program from the Windows Start menu. -or- -or- If you downloaded ScanMail for Microsoft Exchange from our Web site, invoke the "SETUP.EXE" program to install ScanMail for Exchange. 2. First, start the installation process described in the previous "Installing ScanMail for Microsoft Exchange" section. Select Local or Remote Installation and then follow the installation prompts to complete installation. For more information on installation steps, please see the Quick Start Guide which is available in the Documentation section on the Trend website at: instguides.htm

9 Upgrading ScanMail If you have an older version of ScanMail on your system, you may need to uninstall it before upgrading. This depends on its version and the installation method you plan to use. Upgrading is a two-step process: 1. Uninstall your old version of ScanMail for Exchange. If you are planning to perform a local installation, you will need to uninstall any older version of ScanMail. If you are planning to perform a remote installation, you only need to uninstall if its version is below 1.5. For full versions 1.5 and above, Setup can perform the automatic upgrade. 2. Upgrade to the new version of ScanMail for Exchange. First, start the installation process described in the Quick Start guide. Select the "Remote Installation or Upgrade" option and then follow the installation prompts. Note: The upgrade must be done through the "Remote Installation or Upgrade" option, even if you are upgrading your local server. Just pick your local server name from the browse list. Creation of a Customized Windows NT Account for Remote Installations You do not have to create a customized Windows NT account for performing remote ScanMail installations, but you will probably find that it makes the installation process simpler. Follow these steps if you would like to create a customized Windows NT account: 1. Create a Windows NT account and make it a member of both the Administrators and the Domain Admins groups. (Go to

10 What s New in Trend ScanMail for Microsoft Exchange Start Programs Administrative Tools User Manager for Domains User New User). 2. If the target server is a BDC (backup domain controller), this account must be assigned the advanced right to "Log on as Service" on the PDC (primary domain controller). -or- If the target machine is a Stand Alone (Member) server: Log on to the Stand Alone server locally, add the Windows NT account you created on the PDC and assign the account "Log on as a Service" right. To assign this right in either case, go to Administrative Tools User Manager Policies User Rights check the check box "Show Advanced User Rights" click the drop-down arrow and scroll down to select Log on as a service Add... Show Users scroll down and click the user name Add OK OK.) 3. Start Microsoft Exchange Administrator on the target machine. In the Exchange server directory, assign this account minimum Admin. rights at the Organization level. (Click the Organization icon File Properties Permissions Add... scroll down and click the user name Add OK Admin. OK.) Repeat these steps to give the account minimum Admin. rights at the Site Name level and the Configuration Level (the Configuration icon located under the Site Name). 4. Do not install ScanMail right away because the directory will take a while to synchronize. If users need to install right away, please force an Exchange Directory Synchronization.

11 Setting up Public Folder Scanning For new installations, you need to manually enable the scanning of public folders on each ScanMail server. The system automatically enables this feature on subsequent operations. The Administrator s Guide and Quick Start Guide provide details about this process. Complete instructions for installing ScanMail for Exchange can be found in the Administrator s Guide. Once installed, both ScanMail s real-time scanning and monitoring services are automatically started. You will see the real-time monitor on the desktop. ScanMail for Microsoft Exchange Installed Files and Registry Key By default, ScanMail for Exchange installs the following executable programs to the C:\Program Files\SMailEx directory: driveup.exe instmon.exe InstRTS.exe pscaneng.exe pscanmon.exe realscan.exe rmonitor.exe smailex.exe smailup.exe Lpt$vpn the virus pattern extension may vary LOG folder VIRUS folder WEBPAGES

12 What s New in Trend ScanMail for Microsoft Exchange ScanMail also adds the following entry to your registry: HKEY_LOCALMACHINE\SOFTWARE\TREND\SCANMAIL EXCHANGE Section III: New Log Files Two new log files have been added to the Real-time Scan Monitor in the same location as the Public Folder Log: Open Mailbox Log for reporting mailboxes that ScanMail can not open. New Mailbox Log for reporting newly created mailboxes that will now be protected by ScanMail. To access the new Open Mailbox and New Mailbox Log Files: 1. Go to Programs ScanMail for Microsoft Exchange Real-time Scan Monitor. The Real-time Scan Monitor appears. 2. Towards the bottom of the screen, there is a new drop-down text box labeled: View Log. The Public Folder log (which is used to report public folders that ScanMail can not open) can still be found in this location, as it was in earlier versions. The two new real-time logs have been added here.the default item is Open Mailbox Log. Click the drop-down arrow to select this log, Public Folder Log, or New Mailbox Log. Note: You must click the drop-down arrow to view these logs.

13 The Messages Scanned group box below it is only used to display the results of the real-time and scheduled scan processes. 3. The log you select will appear as a text box. a. If you have not added any new mailboxes since you installed this release of ScanMail, the New Mailbox Log will not exist. If new mailboxes have been added, the New Mailbox Log will have the message that ScanMail has found the new mailboxes and protected them. In addition, when new mailboxes are found, the user will receive a message such as the following: Note: It takes about one minute for ScanMail to detect a new mailbox. The mailbox will be protected from viruses thereafter. b. The Open Mailbox log will display the message "Open mailbox done." if ScanMail is able to open all the

14 What s New in Trend ScanMail for Microsoft Exchange mailboxes. It will also display the date and time that the Real-time Scan Monitor started. If there are some mailboxes that ScanMail has not been able to open since the last time the Real-time Scan Monitor started, they will be displayed here. Section IV: Running with Trend VCS ScanMail for Microsoft Exchange versions 2.0 and above can be used with the Trend Virus Control System (Trend VCS). Trend VCS is a centralized management console for coordinating, tracking, and maintaining the variety of antivirus software products often found on enterprise networks regardless of platform or physical location. It can be used in conjunction with most Trend and non-trend antivirus products. Trend VCS Agent can now be installed as part of the ScanMail for Microsoft Exchange installation process. The administrator will be queried whether to install the Trend VCS Agent immediately after the ScanMail installation finishes. In addition, Trend VCS Agent can be uninstalled as part of the ScanMail for Microsoft Exchange uninstallation. Trend VCS is not required to run ScanMail for Microsoft Exchange. Use Trend VCS, for example, to coordinate and configure all antivirus programs (e.g., ScanMail for Microsoft Exchange, InterScan VirusWall, PC-cillin Corp., and non-trend products) on the network to enable real-time scanning options, schedule automatic scans, clean infected files, notify local administrators, etc. In addition, Trend VCS lets you view virus logs for virus events network wide, update the virus pattern files for all products, and perform other tasks. Because Trend VCS allows centralized control, administrative responsibility for ScanMail can be performed locally or from the

15 Trend VCS console. You may need to coordinate with the Trend VCS administrator to determine at which level (global or local) configurations, virus logging, virus pattern updates, etc. should occur. For additional information, please contact Trend at:

16 Trend ScanMail for Microsoft Exchange Administrator s Guide

17 Quick Start Guide

18 Trend ScanMail for Microsoft Exchange This Quick Start Guide provides a step-by-step guide to installing ScanMail for Microsoft Exchange, including the following sections: Installation Notes System Requirements Installing ScanMail and the Trend VCS Agent Creation of a Customized Windows NT Account for Remote Installations Setting up Public Folder Scanning Uninstalling ScanMail and the Trend VCS Agent Installation Notes ScanMail for Exchange can be installed locally or remotely on Windows NT Server 4.0 (or 3.51) with Microsoft Exchange Server 4.0, 5.0 or 5.5. Remote installation supports installation to multiple servers, thus facilitating deployment of the software in the enterprise. You can perform remote installation from a Windows NT Workstation 4.0 (or 3.51) from a Windows NT Server 4.0 (or 3.51). Installation, whether local or remote, requires that the target servers be logged on under an Exchange Service account. The following summarizes the logon and system requirements for both local and remote installation: 2

19 Quick Start Guide Installing ScanMail for Microsoft Exchange System Requirements 166 MHz Intel Pentium (or Alpha 300) or higher 64 MB RAM 15 MB free disk space for the program files Microsoft Exchange Server (English) version 4.0, 5.0, or 5.5 Windows NT Server version 3.51 with Service Pack 5, or Windows NT Server version 4.0 (English) A Java-enabled web browser that supports frames, such as Netscape Navigator 3.0 (or above) and Microsoft Internet Explorer 3.0 (or above) for web-based management. Note: The web-based administrative console is not available on the Alpha platform. If you would like to use web access for remote management, it is available in Trend VCS, Trend Micro s platformand product-independent Virus Control Center. 3

20 Trend ScanMail for Microsoft Exchange Local Installation Requirements The server must be logged on under an Exchange Service account Windows NT Server 3.51 or 4.0 Microsoft Exchange Server 4.0, 5.0, or 5.5 Remote Installation Requirements Target Servers The target server must be logged on under an Exchange Service account Windows NT Server 3.51 or 4.0 Microsoft Exchange Server 4.0, 5.0, or 5.5 LAN connection Setup PC Must use an account with Windows NT administrator privilege ("log on as a service") and Exchange "admin" privilege on organization, site, and configuration levels Windows NT Server 3.51 or 4.0/Windows NT Workstation 3.51 or 4.0 LAN connection Trial Version You can install the complete version of ScanMail by entering the product s serial number. The serial number can be found on the registration card or on the cover of the Administrator s Guide (or contact your Trend Micro sales representative for assistance). Alternatively, you can enter no serial number to install the 30-day free trial version. 4

21 Quick Start Guide Upgrades If you have an older version of ScanMail on your system, you may need to uninstall it before upgrading. This depends on its version and the installation method you plan to use. Please refer to the following: If you are performing a local installation, you will need to uninstall any older version of ScanMail. If you are performing a remote installation, you only need to uninstall ScanMail if its version is below 1.5. For full versions 1.5 and above, Setup can perform the automatic upgrade. Note: The upgrade must be done through the "Remote Installation or Upgrade" option, even if you are upgrading your local server. Just pick your local server name from the browse list. Should I Choose Local or Remote Installation? Local installation copies the program files to the hard disk of the server and should only be used to install ScanMail on one server at a time. You should currently be seated at the server for Local Installation. Remote Installation runs off the CD and can be used to install ScanMail on the local server or on remote servers. The remote servers must be part of your network and you must access to them with an account that has Windows NT administrator privilege ("log on as a service") and Exchange "admin" privilege on organization, site, and configuration levels. It is fine to use Remote Installation to install ScanMail for Microsoft Exchange on your local server. In fact, if you 5

22 Trend ScanMail for Microsoft Exchange would also like to install the Trend VCS Agent on your Local server, you should choose Remote Installation. Note: You must already have Trend VCS installed on a server on your network in order to install the Trend VCS Agent for ScanMail for Microsoft Exchange. Local Installation Make sure that you are logged on under a Windows NT account with "Service Account Admin" privileges. 1. Insert the ScanMail for Microsoft Exchange CD into the CD-ROM drive and run the Setup (SETUP.EXE) program from the Windows Start menu. -or- If you have the Trend Enterprise Solution CD, invoke GO.EXE by inserting the CD into the CD-ROM drive or by running the program from the Start menu. From the displayed screen, click Install and then select ScanMail for Exchange from the list at the right. Select English and then click Install. The Welcome screen appears. 2. Select Local Installation and then click Install. 3. Click Next on the next screen and Yes on the License Agreement screen to agree with the terms of the license. You must agree to the license conditions to proceed with Setup. 4. The ScanMail User Information and Registration screen appears. Enter your name, company and the product s serial number. The serial number can be found on 6

23 Quick Start Guide the front cover of this guide, and on the registration card included in the ScanMail package. Leaving the serial number line blank installs a 30-day trial version (trial versions are NOT able to update pattern files). Click Next to display a confirmation screen. Click Yes to continue or No to modify the displayed values. 5. The ScanMail Administrator Account and Profile screen appears. Accept or modify the displayed administrator account. This account will be used to install and start the ScanMail real-time services on the server. Specify a Windows NT account with Service Account Admin. privileges. Note: Take note of the account you specify on this screen. ScanMail prompts for this account when you access the server s Web-based administrator console. In the Enter Password text box, enter the corresponding password for the selected administrator account. Click Next to continue. Setup creates a profile called SMEX_<server_ name>_pf for use with ScanMail and a mailbox named SMEX_<server_name>_MB for receiving virus notification messages sent to you. The Status field displays the progress of this process. 6. The ScanMail Select Destination Directory screen appears. 7

24 Trend ScanMail for Microsoft Exchange From the Components group box, select the type(s) of administrator console you want to be available on the server. Select ScanMail program to install the Windows-based administrator console and/or Web configuration to install the Web-based administrator console. From the Destination Directory group box, select the directory you want to copy the ScanMail files to. To modify the displayed directory, click Browse and then select the directory you want. Note the amount of disk space available and the amount of disk space required for the ScanMail files. Click the Disk Space button if you would like to check whether one of the other drives has more available disk space. Click Next to display a confirmation screen. 7. Click Next to start copying the ScanMail files to the selected directory. After copying the files, Setup displays the ScanMail Select Groups screen. Accept the default program group, ScanMail for Exchange, specify a new one, or select one from the Existing Groups. Click Next to continue. 8. On the next screen, click OK. 9. The Online Registration screen appears. If you have an Internet connection and want to register ScanMail now, complete the form. If there is a proxy server between your network and the Internet, check the Enable proxy check box and then specify the Port number and Server IP address. Then click the Send button. If you choose not to register at this time, click Cancel. The Online Registration form can also be 8

25 Quick Start Guide accessed from the Update Pattern tab in the Windows-based administrator console. Alternatively, you can use the Registration Card that came with the ScanMail package to register by ordinary mail. 10. On the next screen, check or clear the I would like to view the README file check box and then click Finish. Click Exit to exit the ScanMail installation. The Setup program will not automatically install the Trend VCS Agent on the Local server. Click on TVCSAgentSetup.exe to start the Trend VCS Installation. Proceed to the Trend VCS Agent Installation section to see instructions on installing the Trend VCS Agent for ScanMail. Note: You must already have Trend VCS installed on a server on your network in order to install the Trend VCS Agent for ScanMail for Microsoft Exchange. Creation of a Customized Windows NT Account for Remote Installations You do not have to create a customized Windows NT account for performing remote ScanMail installations, but you will probably find that it makes the installation process simpler. Follow these steps if you would like to create a customized Windows NT account: 1. Create a Windows NT account and make it a member of both the Administrators and the Domain Admins groups. (Go to Start Programs Administrative Tools User Manager for Domains User New User). 9

26 Trend ScanMail for Microsoft Exchange 2. If the target server is a BDC (backup domain controller), this account must be assigned the advanced right to "Log on as Service" on the PDC (primary domain controller). -or- If the target machine is a Stand Alone (Member) server: Log on to the Stand Alone server locally, add the Windows NT account you created on the PDC and assign the account "Log on as a Service" right. To assign this right in either case, go to Administrative Tools User Manager Policies User Rights check the check box "Show Advanced User Rights" click the drop-down arrow and scroll down to select Log on as a service Add... Show Users scroll down and click the user name Add OK OK.) 3. Start Microsoft Exchange Administrator on the target machine. In the Exchange server directory, assign this account minimum Admin. rights at the Organization level. (Click the Organization icon File Properties Permissions Add... scroll down and click the user name Add OK Admin. OK.) Repeat these steps to give the account minimum Admin. rights at the Site Name level and the Configuration Level (the Configuration icon located under the Site Name). 4. Do not install ScanMail right away because the directory will take a while to synchronize. If users need to install right away, please force an Exchange Directory Synchronization. 10

27 Quick Start Guide Remote Installation 1. Have each target server log off and back on again using an account with Windows NT administrator privilege ("log on as a service") and Exchange "admin" privilege on organization, site, and configuration levels. 2. Insert the ScanMail for Microsoft Exchange CD into the CD-ROM drive and run the Setup (SETUP.EXE) program from the Windows Start menu. -or- If you have the Trend Enterprise Solution CD, invoke GO.EXE by inserting the CD into the CD-ROM drive or by running the program from the Start menu. From the displayed screen, click Install and then select ScanMail for Exchange from the list at the right. Select English and then click Install. The Welcome screen appears. 3. Select Remote Installation or Upgrade and then click Next. 4. Read the License Agreement screen and then click Yes to agree to the terms of the license. You must agree to the license conditions to proceed with Setup. 5. The Serial Number screen appears. Enter your name, company name, and the product s serial number. The serial number can be found on the front cover of this guide and on the registration card included in the ScanMail package. Leaving the serial number line blank installs a 30-day trial version (trial versions are NOT able to update pattern files). Click Next to display a confirmation screen. 11

28 Trend ScanMail for Microsoft Exchange 6. Click Next to continue or Back to modify the displayed values. 7. The Select Target Servers screen appears. From the list in the left pane, select the servers you want to install ScanMail on. You may either highlight the target server names individually or highlight the Domain name to install ScanMail on all servers in a Domain. Double-click a Domain name if you would like to view the servers within. Then click the Add> button. The selected server(s) appear in the Server Name list at the right. If you are installing ScanMail on selected servers within the Domain only, repeat this process until you have added all the servers you want. To remove server(s) from the Server Name list, select them and then click the <Remove or <Remove All button. Click Next to continue. 8. The Server Logon screen appears. In the User Name text box, enter the account the displayed server is currently logged on under. Note: Take note of the account you specify on this screen. ScanMail prompts for this account when you access the server s Web-based administrator console. In the Password text box, enter the password for the specified administrator account. Click Logon to log on to the servers with the same account. 12

29 Quick Start Guide Setup creates a profile called SMEX_<server_ name>_pf for use with ScanMail and a mailbox named SMEX_<server_name>_MB for receiving virus notification messages on each server. For servers that require a different logon credential, Setup displays the Server Logon screen again. 9. After the logon process, Setup displays the Analyze Selected Server(s) screen. Click Next and then Next again on the following screen. The Setup Information screen appears. Taking note that the settings you specify on this screen apply to all servers in the group, accept or modify the proposed destination directory and folder name. Click Install to start installing ScanMail to the selected servers. The system will display an error message for those servers using accounts with incorrect or insufficient rights (e.g., an account with Windows NT administrator privilege, but without Exchange privilege). From the displayed screen, enter an account with Windows NT administrator privilege ("log on as a service") and Exchange "admin" privilege on organization, site, and configuration levels. 10. The Installing Program screen appears and you can view the installation status. When the ScanMail installation program finishes for all selected server(s), click Next. You will then see the Installation Status screen that shows which of the ScanMail installations were successful, and which failed. Click Finish to complete the ScanMail Setup process. Then click 13

30 Trend ScanMail for Microsoft Exchange Exit to exit ScanMail installation or click Install Trend VCS Agent if you would like to use ScanMail with Trend VCS. See the next section, Trend VCS Agent Installation, for installation instructions. Note: You must already have Trend VCS installed on a server on your network in order to install the Trend VCS Agent for ScanMail for Microsoft Exchange. Trend VCS Agent Installation 1. You will see a progress bar while the Trend VCS Agent programs are unpacked. Then the Welcome Screen appears. Click Next to continue. (If you are not yet at the Welcome screen, click TVCSAgentSetup.exe and then click Next.) 2. Read the License Agreement screen and then click Yes to agree to the terms of the license. You must agree to the license conditions to proceed with Setup. 3. The Select Anti-virus Product screen appears. Select the first option Anti-virus products running on Windows NT to install the ScanMail for Microsoft Exchange Agent. Click Next to continue. 4. A list of Windows NT domains and workgroups appears. From the list in the left pane, select the servers you want to install the Trend VCS Agent on. You may either highlight the target server names individually or highlight the Domain name to install the Trend VCS Agent on all servers in a 14

31 Quick Start Guide Domain. Double-click a Domain name if you would like to view the servers within. Then click the Add> or Add All> button. The selected server(s) appear in the Server Name list at the right. If you are installing Trend VCS Agent on selected servers within the Domain only, repeat this process until you have added all the servers you want. To remove server(s) from the Server Name list, select them and then click the <Remove or <Remove All button. Click Next to continue. 5. The Server Logon screen appears. The Agent Installation program logs on to each server that was added to the server list in the previous screen. In the User Name text box, enter an account with administrator rights. In the Password text box, enter the password for the specified administrator account. By default, Agents are installed off the root-level share (c$). To specify another drive or subdirectory, click the ellipsis button (...). Take note of the directory you specify. Later on, you will be prompted to create a subdirectory off this share. Note: At least one drive or directory must be shared on the remote server to install an Agent there. Make sure you leave the Retain user name and password after logging on box checked to save 15

32 Trend ScanMail for Microsoft Exchange time if you are using the same account to log on to multiple servers. Click Log on to log on to the server(s). Click Stop to terminate any given logon and skip to the next server on the list. 6. After the logon process, Setup displays the Analyze Selected Server(s) screen. In the message box, "Finished Analyzing the Servers.", click OK. Click Next and then Next again on the following screen. The Setup Information screen appears. Taking note that the settings you specify on this screen apply to all servers in the group, accept or modify the proposed destination directory and folder name. 7. The Proxy Information screen appears. Click Yes, Connect through a proxy server if you use a proxy server. Then enter the Address and Port number of the proxy server. Just click Next if you do not use a proxy server. 8. The Trend VCS Server Information screen appears. Specify the IP address (name or number) of the server that you want to register the Agents with. Enter the TCP Port number of the WWW service for Microsoft IIS. Click Next to continue. 9. At the Agent Information screen, enter the Site name under which you want these Agents to appear in the server tree. Next, specify the Relative Destination Directory the subdirectory relative to the shared drive or directory that was identified earlier in the Log on to the server screen. For example, if the Shared drive selected is called antivirus and represents c:\admin\tools\antivirus, 16

33 Quick Start Guide the directory specified here for the installation of program files will be a subdirectory of c:\admin\tools\antivirus. 10. Click Install to copy the Agent files to the target machines. Click Yes to install more Agents, or No to quit the Agent installation program. Setting up Public Folder Scanning For new installations, you need to enable public folder scanning on a particular Microsoft Exchange server. You only need to do this once the system will automatically enable this feature on subsequent operations: 1. At the DOS prompt, type <server_dir>\bin\admin -raw where <server_dir> is the Microsoft Exchange server install directory. For example, c:\exchsrvr\bin\admin -raw 2. From the left pane of the Microsoft Exchange Administrator screen, select <domain>. Then in the right pane, select Configuration Servers <site> Private Information Store Mailbox Resources. Where <domain> is the server domain and <site> the server site. 3. Select System Attendant from the list in the right pane. Then from the File menu, select Raw Properties. 4. The System Attendant Properties screen appears. 17

34 Trend ScanMail for Microsoft Exchange Select All from the List attributes of type drop-down list box, and Display Name from the Object Attributes drop-down list box. In the Edit value text box, enter a name for the System Attendant mailbox. Then click Set. Select Hide from AB from the Object Attributes drop-down list box and then set its value to 0 in the Edit value text box. Then click Set. Click OK to save the changes. 5. From the left pane, select Folders Public Folders and then the public folder you want ScanMail to scan. 6. Select Properties from the File menu. 7. The Properties screen appears. Under the General tab, click Client Permissions and then Add. From the list on the left, select the name you specified in step 4 above and then click Add>. Click OK to create a new account. 8. From the Client Permissions screen, select the account you just created. In the Permissions section, assign the role of "Editor" to this account by selecting Editor from the Roles drop-down list box. Click OK and then OK again. 18

35 Quick Start Guide Uninstalling ScanMail Before removing ScanMail from a particular server, Close the server s Windows-based administrator console. You do not need to close the Web-based administrator console. For remotely-installed ScanMail servers, you have the option to locally or remotely remove the software. Remote Uninstallation allows you to remove ScanMail not only from a single server but from a group of servers as well. Note: The remote uninstall program only works on remotely-installed ScanMail servers. Local Uninstallation 1. Make sure that you are logged on under a Windows NT account with "Service Account Admin" privileges. 2. Click the Windows Start button. 3. Select Programs ScanMail for Microsoft Exchange Uninstall ScanMail. A confirmation screen appears. 4. Click Yes. Remote Uninstallation 1. Have each target server log off and back on again using an account with Windows NT administrator privilege ("log on as a service") and Exchange "admin" privilege on organization, site, and configuration levels. 19

36 Trend ScanMail for Microsoft Exchange 2. Insert the ScanMail for Microsoft Exchange CD into the CD-ROM drive and run the uninstall program (UNINSTALL.EXE) from the Windows Start menu. Or, if you have the Trend Enterprise Solution CD, run the uninstall program located in the \Programs\SMEX\English directory. 3. Click Next on the Welcome screen. 4. The Select Target Servers screen appears. From the list on the left side of the screen, select the server you want to remove ScanMail from by highlighting the target server and clicking the Add> button. The selected server appears in the Server Name list at the right. Repeat this process until you have added all the servers you want. To remove a server from the Server Name list, select it and then click the <Remove button. Click Next to continue. 5. The Server Logon screen appears. In the User Name text box, enter the account the displayed server is currently logged on under. In the Password text box, enter the password for the specified administrator account. Click Logon to log on to the servers with the same account. Setup checks whether or not ScanMail is installed on each server and then displays the results on the next screen. For those servers that require a different logon credential, Setup displays the Server Logon screen again. 20

37 Quick Start Guide 6. After the logon process, Setup displays the Analyze Selected Server(s) screen. Click Next and then Uninstall on the Uninstallation list screen to start removing the program from the selected servers. 7. On the next two screens, click Next and Finish to complete the uninstallation of ScanMail for Microsoft Exchange. 8. If you are using Trend VCS, then you should uninstall the Agent for ScanMail now. Click Uninstall Trend VCS Agent and proceed to the next section. If you are not using Trend VCS, click Exit. Trend VCS Agent Uninstallation 1. At the Welcome screen, click Next. (If you are not yet at the Welcome screen, double-click TvcsAgentUninstall.exe and click Next.) 2. A list of Windows NT domains and workgroups appears. From the list in the left pane, select the servers you want to uninstall the Trend VCS Agent from. You may either highlight the target server names individually or highlight the Domain name to uninstall the Trend VCS Agent from all servers in a Domain. Double-click a Domain name if you would like to view the servers within. Then click the Add> or Add All> button. The selected server(s) appear in the Server Name list at the right. If you are uninstalling the Trend VCS Agent from selected servers within the Domain only, repeat this process until you have added all the servers you want. 21

38 Trend ScanMail for Microsoft Exchange To remove server(s) from the Server Name list, select them and then click the <Remove or <Remove All button. Click Next to continue. 3. The Server Log on screen appears. The Agent Uninstallation program logs on to each server that was added to the server list in the previous screen. In the User Name text box, enter an account with administrator rights. In the Password text box, enter the password for the specified administrator account. Note: The drive or directory where the Trend VCS Agent was installed must be shared and you must log on using administrator-level credentials. Click the ellipsis button (...) to identify the Shared Drive. Make sure you leave the Retain user name and password after logging on box checked to save time if you are using the same account to log on to multiple servers. 4. Click Log on to log on to the server(s). Click Stop to terminate any given logon and skip to the next server on the list. 5. Click OK in the "Finished analyzing the servers" message box. 6. Click Next to remove the Agent(s) from the selected servers. 7. If the Agent still appears in the Trend VCS Server Tree after it has been uninstalled, highlight it and click Remove Agent to delete it from the tree. 22

39 Quick Start Guide Item Code: xxxx-xxxx 23

40 Trend ScanMail for Microsoft Exchange 24

41 Trend ScanMail for Microsoft Exchange Administrator s Guide Trend Micro Incorporated makes no representation or warranties with respect to the contents or use of this documentation or the product described herein and specifically disclaims any express or implied warranties as to the merchantability and fitness for any particular purpose. Furthermore, Trend Micro Incorporated reserves the right to make changes to this documentation and to the products described herein without any obligation to notify any person or entity of such changes. ScanMail, PC-cillin and InterScan VirusWall are registered trademarks of Trend Micro Incorporated. MacroTrap is a trademark of Trend Micro Incorporated. All other brand and product names are trademarks or registered trademarks of their respective companies or organizations. Copyright, Trend Micro Incorporated. No part of this publication may be reproduced, photocopied, stored in a retrieval system, or transmitted without the express prior written consent from Trend Micro Incorporated. Document Part No.: xx-xx-xx Release Date: August, 1998

42 Table of Contents Section I Getting Started Chapter 1 Chapter 2 Introducing ScanMail for Microsoft Exchange Chapter Overview Product Description ScanMail Benefits and Capabilities ScanMail A Dedicated Application for Microsoft Exchange Users How Microsoft Exchange Users Share Information. 1-4 How Viruses Spread in a Microsoft Exchange Environment How ScanMail Works Installing ScanMail Chapter Overview Installation Notes Local Installation Remote Installation Trial Version Upgrades Setting up Public Folder Scanning System Requirements Local Installation Remote Installation Setting up Public Folder Scanning Uninstalling ScanMail Local Uninstallation

43 Trend ScanMail for Microsoft Exchange Administrator s Guide Remote Uninstallation Chapter 3 Section II Management Options Chapter Overview Introduction Managing ScanMail using the Windows-based Administrator Console Accessing the Windows-based Administrator Console Managing ScanMail using the Web-based Administrator Console Accessing the Web-based Administrator Console Using the Web-based Server List Accessing the Web-based Server List Managing ScanMail from a Trend VCS Console Accessing the ScanMail Configuration Page Configuring ScanMail for Microsoft Exchange Chapter 4 Chapter 5 Performing Real-time Scans Chapter Overview Introduction Enabling/Disabling Real-time Scan Windows-based Web-based Configuring Real-time Scan Windows-based Web-based Monitoring Real-time Scans Performing Manual & Scheduled Scans Chapter Overview Introduction Manual Scan ii

44 Table of Contents Configuring Manual Scan Scheduling Mailbox and Public Folder List Refresh 5-9 Running a Scan Displaying Scan Results Scheduled Scan Enabling/Disabling Scheduled Scan Configuring Scheduled Scan Displaying Scan Results Chapter 6 Section III Configuring Notification Messages Chapter Overview Notification Messages Configuring Real-time Scan Notification Messages Windows-based Web-based Configuring Manual Scan Notification Messages Windows-based Web-based Configuring Scheduled Scan Notification Messages Windows-based Web-based Maintaining ScanMail for Microsoft Exchange Chapter 7 Viewing & Maintaining Log Files Chapter Overview ScanMail s Log Files Viewing Entries in the Log Files Windows-based Web-based Maintaining the Log Files iii

45 Trend ScanMail for Microsoft Exchange Administrator s Guide Chapter 8 Chapter 9 Section IV Updating the Virus Pattern File Chapter Overview Virus Pattern File Registering ScanMail Updating the Virus Pattern File Enabling/Disabling Scheduled Pattern Update Windows-based Web-based Scheduling Pattern Updates Windows-based Web-based Using the Virus Encyclopedia Chapter Overview Introduction Additional Information from the Web Sending Trend Your Viruses Accessing the Virus Encyclopedia Technical Support Issues Chapter 10 Chapter 11 Contacting Technical Support Bringing Up the Technical Support Screen Windows-based Web-based Frequently Asked Questions FAQs iv

46 Table of Contents Section V Appendix Appendix A Computer Viruses A-1 Appendix Overview... A-1 What is a Computer Virus?... A-1 Types of Viruses... A-2 Virus Writers... A-5 How Viruses Spread... A-5 Methods of Virus Detection... A-6 Pattern Recognition... A-6 Integrity Checking (or Checksumming)... A-6 Behavior Monitoring... A-7 Index v

47 Trend ScanMail for Microsoft Exchange Administrator s Guide vi

48 Section I Getting Started Section I Getting Started Chapter 1 Introducing ScanMail for Microsoft Exchange Chapter 2 Installing ScanMail Chapter 3 Management Options

49 I

50 1 Introducing ScanMail for Microsoft Exchange Chapter Overview In this chapter you will find: The product description ScanMail s benefits and capabilities How ScanMail cleans viruses and maintains a virus-free environment Product Description ScanMail for Microsoft Exchange is the latest in a long list of innovative computer anti-virus products developed by Trend Micro Incorporated for the enterprise. ScanMail stops the spread and acquisition of computer viruses both known and unknown. By combining our award winning, 32-bit multi-threading scan engine with the latest in macro virus detection, Trend Micro s MacroTrap, ScanMail s virus detection rate is unsurpassed in the anti-virus industry. 1-1

51 Trend ScanMail for Microsoft Exchange Administrator s Guide In a groupware environment, where shared information is used by hundreds of users and constantly replicated on other sites, and where sophisticated options allow virtually any file to be transported over the network, relying on the best scan engine is especially important. The ScanMail solution for a secure Microsoft Exchange environment is two-fold: First, with manual and scheduled scans, ScanMail roots out all existing viruses inside Microsoft Exchange s Information Store, where the system keeps the users mailboxes and public folders. Second, with real-time scan, ScanMail guards all possible virus entry points into the Microsoft Exchange system by: Checking the attachments of all incoming mails, Scanning files as they are posted on the public folders, and Checking files replicated from other Microsoft Exchange servers. ScanMail also supports automatic updates to the virus pattern file used for detecting and cleaning viruses to keep the system current with the latest viruses. ScanMail Benefits and Capabilities Provides both Web-based and Windows-based administrator consoles for management flexibility. Complies with Trend Virus Control System (Trend VCS), allows control of the software from a Trend VCS console. Uses pattern recognition and rule-based technologies to detect known and unknown viruses, including macro viruses. Supports remote installation for easy deployment. Also features remote uninstallation. 1-2

52 Introducing ScanMail for Microsoft Exchange Provides a Web-based Server List to facilitate management of multiple ScanMail servers on the network, from a single console. Provides a virtual Virus Hospital for sending infected files that require special treatment. Sends virus notification messages to designated people when viruses are detected. Features automatic virus pattern file updates via the World Wide Web. Uses Incremental Scans and SmartScan to expedite scanning and mail processing. Provides an activity log detailing system, virus and pattern update events. Is MAPI-compliant and multi-threaded for fast performance. Scans mailboxes migrated to Microsoft Exchange from Lotus cc:mail, Microsoft Mail and from Microsoft Exchange Server 4.0 to 5.0. Decodes UUENCODE and MIME attachments, and decompresses files compressed with PKZIP, LZEXE, ARJ, LZH, PKLITE and Microsoft Compress. ScanMail A Dedicated Application for Microsoft Exchange Users ScanMail is an anti-virus application specially designed to protect Microsoft Exchange users against computer viruses contained in files they receive as attachments, and documents they download from shared databases. To understand the ScanMail design and how it works, it is important to understand how Microsoft Exchange users share information. Accordingly, this section first discusses how Microsoft Exchange users share information and then describes how ScanMail works. 1-3

53 Trend ScanMail for Microsoft Exchange Administrator s Guide How Microsoft Exchange Users Share Information Microsoft Exchange allows users to share information with each other by sending the information as attachments and by posting the information on public folders for easy retrieval by other users. Another way information is shared in Microsoft Exchange is through server-to-server folder replication. This is one of the key strengths of Microsoft Exchange the ability to distribute and synchronize shared information. This ability is supported through the Microsoft Exchange Server replication system, which enables multiple synchronized copies of folders to exist in different locations regardless of whether the connection is over a LAN, WAN, X.400 or Internet backbone. How Viruses Spread in a Microsoft Exchange Environment Although Microsoft Exchange s architecture makes it possible to share the current information among users regardless of their physical location, it also contributes to an environment where viral infections can thrive and persist. Figure 1-1 shows how a single infected mail can spread in a Microsoft Exchange environment and beyond. 1-4

54 Introducing ScanMail for Microsoft Exchange Internet External Recipient User User Exchange Server 1 Exchange Server 2 User Figure 1-1. How one virus-infected file can quickly infect an organization and external users through information sharing 1. A Microsoft Exchange user inadvertently attaches an infected Word file and s it to ten local users. 2. Exchange Server 1 receives the and copies it to the mailboxes of the intended recipients. 3. One recipient posts the infected attachment to the public folder. Another forwards it to an external user through the Internet mail. 4. A routine replication of the public folders occurs. The infected document is now in Exchange Server Users in Exchange Server 2 download the infected document. Obviously, it is easy for a virus to spread throughout an unprotected enterprise. 1-5

55 Trend ScanMail for Microsoft Exchange Administrator s Guide How ScanMail Works ScanMail is a MAPI-compliant software that cleans existing viruses inside Microsoft Exchange s Information Store with manual and scheduled scanning, and guards all possible virus entry points with real-time scanning of all incoming mails, documents being posted on public folders and files replicated from other Microsoft Exchange servers. Note: The Information Store is where the system keeps the users mailboxes and public folders. Manual and Scheduled Scans: Establishing a Clean Microsoft Exchange Environment ScanMail for Microsoft Exchange scans and eliminates existing viruses inside the Information Store a key to eradicating old virus infections and minimizing the possibility of reinfection. ScanMail provides both manual and scheduled scan services, which recognize the Microsoft Exchange MAPI format and scan inside individual mailboxes and public folders. Figure 1-2 illustrates how manual and scheduled scans work. 1-6

56 Introducing ScanMail for Microsoft Exchange User1 A scheduled scan runs or the administrator executes a manual scan Exchange Server 1 User2 Information Store ScanMail Attachment(s) Mailboxes User3 Document(s) Public Folders ScanMail's action User-n Figure 1-2. How manual and scheduled scans work When you run a manual scan or when a scheduled scan executes, the following events take place: 1. ScanMail copies into a temporary directory the attachments of all messages in the users mailboxes, and posted documents on public folders. 2. From the temporary directory, ScanMail scans the attachments and documents for viruses. 3. When an infected file is detected, ScanMail takes one of the following actions: Auto-Clean. ScanMail cleans the virus from the file and then copies it back to the mailbox or public folder. If the virus is not cleanable, ScanMail can move, delete or ignore the file depending on your specification. 1-7

57 Trend ScanMail for Microsoft Exchange Administrator s Guide Move. ScanMail removes the infected file from the mailbox or public folder and then moves it to a preselected location, which can be a directory, to Trend s Virus Hospital or to you. Delete. ScanMail deletes the infected file from the mailbox or public folder. Pass. ScanMail ignores the infected file without cleaning and lets it stay in the mailbox or public folder. 4. After scanning all the files, ScanMail empties the temporary directory to prevent any infected files from spreading to the local system. Once the Information Store on the server has been scanned and cleaned (a process we recommend you undertake soon after installing ScanMail), the problem of recurring infections from archived and database documents is minimized. The next step, of course, must then be to guard against new viruses getting in the clean environment, which typically happens in three ways: 1. A user receives an message containing an infected attachment. 2. A user inadvertently posts an infected document on the public folder. 3. A second Microsoft Exchange server, with infected documents, replicates its public folders to other Microsoft Exchange servers. ScanMail for Microsoft Exchange guards these entry points with real-time scanning. 1-8

58 Introducing ScanMail for Microsoft Exchange Real-time Scans: Maintaining a Virus-Free Environment After existing viruses have been removed from the Information Store, the work of maintaining the integrity of the clean Microsoft Exchange environment remains. ScanMail actively monitors the three entry points mentioned above through which the Microsoft Exchange environment is vulnerable. Incoming Mail ScanMail performs a real-time scan on the attachments of all incoming mails to prevent viruses from entering the local mailing system. Figure 1-3 illustrates how ScanMail checks new messages. User1 Exchange Server 1 New mail User2 Information Store ScanMail Attachment(s) Mailboxes User3 Public Folders ScanMail action User-n Figure 1-3. How ScanMail checks new messages When a new message arrives at the mailbox of a user, ScanMail does the following: 1-9

59 Trend ScanMail for Microsoft Exchange Administrator s Guide 1. ScanMail copies the attachment(s) of the into a temporary directory. 2. From the temporary directory, ScanMail scans the attachment(s) for viruses. 3. When an infected file is detected, ScanMail takes one of the following actions: Auto-Clean. ScanMail cleans the virus from the file and then copies it back to the mailbox. If the virus is not cleanable, ScanMail can move, delete or ignore the file depending on your specification. Move. ScanMail removes the infected file from the mailbox and then moves it to a preselected location, which can be a directory, to Trend s Virus Hospital or to you. Delete. ScanMail deletes the infected file from the mailbox. Pass. ScanMail ignores the infected file and lets it stay in the mailbox. 4. After scanning the attachment(s), ScanMail empties the temporary directory to prevent any infected files from spreading to the local system. Public-folder Posting ScanMail actively monitors the public folders to prevent users from posting infected documents. Figure 1-4 illustrates how ScanMail checks newly-posted documents. 1-10

60 Introducing ScanMail for Microsoft Exchange Post document to public folder User1 Exchange Server 1 User2 Information Store ScanMail Document Mailboxes User3 Public Folders ScanMail's action User-n Figure 1-4. How ScanMail checks newly-posted documents When a user posts a document to the public folder, ScanMail does the following: 1. ScanMail copies the document into a temporary directory. 2. From the temporary directory, ScanMail scans the document for viruses. 3. If the document is infected with a virus, ScanMail takes one of the following actions: Auto-Clean. ScanMail cleans the virus from the file and then copies it back to the public folder. If the virus is not cleanable, ScanMail can move, delete or ignore the file. Move. ScanMail removes the infected file from the public folder and then moves it to a preselected location, which can be a directory, to Trend s Virus Hospital or to you. 1-11

61 Trend ScanMail for Microsoft Exchange Administrator s Guide Delete. ScanMail deletes the infected file from the public folder. Pass. ScanMail ignores the infected file and lets it stay in the public folder. 4. After scanning the file, ScanMail empties the temporary directory to prevent any infected files from spreading to the local system. Server-to-server Folder Replication ScanMail checks all replicated files to keep viruses from propagating to other Microsoft Exchange servers. Figure 1-5 illustrates how ScanMail monitors server-to-server folder replication. User1 Exchange Server 2 Replicate public folders Exchange Server 1 User2 Information Store ScanMail Document(s) Mailboxes User3 Public Folders ScanMail's action User-n Figure 1-5. How ScanMail monitors server-to-server folder replication During server-to-server folder replication, ScanMail does the following: 1-12

62 Introducing ScanMail for Microsoft Exchange 1. ScanMail copies the replicated files into a temporary directory. 2. From the temporary directory, ScanMail scans the files for viruses. 3. When an infected file is detected, ScanMail takes one of the following actions: Auto-Clean. ScanMail cleans the virus from the file and then copies it back to the public folder. If the virus is not cleanable, ScanMail can move, delete or ignore the file. Move. ScanMail removes the infected file from the public folder and then moves it to a preselected location, which can be a directory, to Trend s Virus Hospital or to you. Delete. ScanMail deletes the infected file from the public folder. Pass. ScanMail ignores the infected file and lets it stay in the public folder. 4. After scanning all the files, ScanMail empties the temporary directory to prevent any infected files from spreading to the local system. Note: For server-to-server replication scanning to occur, you need to give ScanMail "Editor" or greater role. For information on how to do this, please refer to the documentation that came with Microsoft Exchange. 1-13

63 Trend ScanMail for Microsoft Exchange Administrator s Guide 1-14

64 2 Installing ScanMail Chapter Overview In this chapter you will find: Installation notes The minimum hardware and software requirements Step-by-step installation and uninstallation instructions Installation Notes ScanMail for Exchange can be installed locally or remotely on Windows NT Server 3.51 (or 4.0) with Microsoft Exchange Server 4.0, 5.0 or 5.5. Remote installation supports installation to multiple servers, thus facilitating deployment of the software in the enterprise. You can perform remote installation from a Windows NT Workstation 3.51 (or 4.0) or from a Windows NT Server 3.51 (or 4.0). Installation, whether local or remote, requires that the target servers be logged under an Exchange Service account. The following summarizes the logon and system requirements for both local and remote installation: 2-1

65 Trend ScanMail for Microsoft Exchange Administrator s Guide Local Installation The server must be logged under an Exchange Service account Windows NT Server 3.51 or 4.0 Microsoft Exchange Server 4.0, 5.0 or 5.5 Remote Installation Target Servers The target server must be logged under an Exchange Service account Windows NT Server 3.51 or 4.0 Microsoft Exchange Server 4.0, 5.0 or 5.5 LAN connection Setup PC Must use an account with NT administrator privilege ("log on as a service") and Exchange admin privilege on organization, site, and configuration levels Windows NT Server 3.51 or 4.0/Windows NT Workstation 3.51 or 4.0 LAN connection Trial Version You can install the complete version of ScanMail for Microsoft Exchange by entering the product s serial number that came with the product (or contact your Trend Micro sales representative). Alternatively, you can enter no serial number to install the 30-day free trial version. 2-2

66 Installing ScanMail Upgrades If you have an older version of ScanMail in your system, you may need to uninstall first this software depending on its version and the installation method you plan to use. Please refer to the following: For local installation, you need to uninstall any older version of ScanMail. For remote installation, you only need to uninstall if its version is below 1.5. For full versions 1.5 and above, Setup can perform the automatic upgrade. Setting up Public Folder Scanning For new installations, you need to manually enable the scanning of public folders on each ScanMail server. You only need to do this once the system will automatically enable this feature on subsequent operations. The Setting up Public Folder Scanning section provides details about this procedure. System Requirements To use ScanMail for Microsoft Exchange, you need the following hardware and software: Intel Pentium 100 or higher 64 MB RAM 15 MB free disk space for the program files Microsoft Exchange Server (English) version 4.0, 5.0 or 5.5 Windows NT Server version 3.51 with Service Pack 5, or Windows NT Server version 4.0 (English) A Java-enabled web browser that supports frames like Netscape Navigator 3.0 (or above) and Microsoft Internet Explorer 3.0 (or above) for web-based management. 2-3

67 Trend ScanMail for Microsoft Exchange Administrator s Guide Local Installation 1. Insert the ScanMail for Microsoft Exchange CD into the CD-ROM drive and run the Setup (SESETUP.EXE) program from the Windows Start menu. -or- If you have the Trend Enterprise Solution CD, invoke GO.EXE by inserting the CD into the CD-ROM drive or by running the program from the Start menu. From the displayed screen, click Install and then select ScanMail for Exchange from the list at the right. Select English and then click Install. The Welcome screen appears: Figure 2-1. The Welcome screen 2. Select Local Installation and then click Install. 3. Click Next on the next screen and Yes on the License Agreement screen to agree with the terms of the license. You must agree to the license conditions to proceed with Setup. 2-4

68 Installing ScanMail The ScanMail User Information and Registration screen appears. 4. Enter your name, company and the product s serial number. The serial number can be found on the front cover of this guide, and the registration card included in the ScanMail package. Leaving the serial number line blank installs a 30-day trial version (trial versions are NOT able to update pattern files). Click Next to display a confirmation screen. 5. Click Yes to continue or No to modify the displayed values. The ScanMail Administrator Account and Profile screen appears: Figure 2-2. The Administrator Account and Profile screen 6. Accept or modify the displayed administrator account. This account will be used to install and start the ScanMail real-time services on the server. Specify an NT account with Service Account Admin privileges. 2-5

69 Trend ScanMail for Microsoft Exchange Administrator s Guide Note: Take note of the account you specify on this screen. ScanMail prompts for this account when you access the server s Web-based administrator console. 7. In the Enter Password text box, enter the corresponding password for the selected administrator account. 8. Click Next to continue. Setup creates a profile called SMEX_<server_name>_PF for use with ScanMail and a mailbox named SMEX_ <server_name>_mb for receiving virus notification messages sent to you. The Status field displays the progress of this process. The ScanMail Select Destination Directory screen appears: Figure 2-3. The Select Destination Directory screen 9. From the Components group box, select the type(s) of administrator console you want to be available on the server. Select ScanMail program to install the Windows-based administrator console and/or Web configuration to install the Web-based administrator console. 2-6

70 Installing ScanMail 10. From the Destination Directory group box, select the directory where you want to copy the ScanMail files. To modify the displayed directory, click Browse and then select the directory you want. 11. Click Next to continue. The ScanMail Schedule Directory Export screen appears: Figure 2-4. The Schedule Directory Export screen ScanMail can automatically refresh the Mailbox and Public Folder List on the Windows-based administrator console to display all existing mailboxes and public folders on the Microsoft Exchange server. 12. Specify the time when the first refresh should occur in the Start time text box. Click AM or PM appropriately. 13. From the Set the refresh frequency group box, specify how often you want refresh to occur per day. Select None to disable this feature. The Schedule list field displays the selected refresh schedule. 2-7

71 Trend ScanMail for Microsoft Exchange Administrator s Guide If you want to modify the refresh schedule, specify the new settings and then click the Update the Schedule List button. 14. Click Next to display a confirmation screen. 15. Click Next to start copying the ScanMail files to the selected directory. After copying the files, Setup displays the ScanMail Select Groups screen. 16. Accept the default program group, specify a new one or select one from the Existing Groups. Click Next to continue. 17. On the next screen, click OK. The Online Registration screen appears: Figure 2-5. The Registration screen 18. If you have an Internet connection and want to register ScanMail now, complete the above form. If there is a proxy server between your network and the Internet, check the 2-8

72 Installing ScanMail Enable proxy check box and then specify the Port number and Server IP address. Then click the Send button. If you choose not to register at this time, click Cancel. The Online Registration form can also be accessed from the Update Pattern tab on the Windows-based administrator console. Alternatively, you can use the Registration Card that came with the ScanMail package to register by ordinary mail. 19. On the next screen, check or clear the I would like to view the README file check box and then click Finish. The ScanMail for Microsoft Exchange setup is now complete. No configuration changes are required for ScanMail to run once it is installed, but many choices for user preference are available. For example, you can specify who is notified whenever a virus is found during a real-time scan: the administrator, the sender, and/or the intended recipient, and what the notification message says. For information on how to configure ScanMail, see Section II, Configuring ScanMail for Microsoft Exchange. Remote Installation 1. Have each target server log off and back on again using an account with NT administrator privilege ("log on as a service") and Exchange "admin" privilege on organization, site, and configuration levels. 2. Insert the ScanMail for Microsoft Exchange CD into the CD-ROM drive and run the Setup (SESETUP.EXE) program from the Windows Start menu. -or- If you have the Trend Enterprise Solution CD, invoke GO.EXE by inserting the CD into the CD-ROM drive or by running the program from the Start menu. From the displayed screen, click Install and then select ScanMail for 2-9

73 Trend ScanMail for Microsoft Exchange Administrator s Guide Exchange from the list at the right. Select English and then click Install. The Welcome screen appears: Figure 2-6. The Welcome screen 3. Select Remote Installation and then click Next. 4. Click Yes on the License Agreement screen to agree with the terms of the license. You must agree to the license conditions to proceed with Setup. The Serial Number screen appears. 5. Enter your name, company and the product s serial number. The serial number can be found on the front cover of this guide and the registration card included in the ScanMail package. Leaving the serial number line blank installs a 30-day trial version (trial versions are NOT able to update pattern files). Click Next to display a confirmation screen. 6. Click Next to continue or Back to modify the displayed values. The Select Target Servers screen appears: 2-10

74 Installing ScanMail Figure 2-7. The Select Target Servers screen 7. From the list at the left-hand side of the screen, select the servers where you want to install ScanMail by highlighting the target server and clicking the Add> button. The selected server appears in the Server Name list at the right. Repeat this process until you have added all the servers you want. To remove a server from the Server Name list, select it and then click the <Remove button. 8. Click Next to continue. The Server Logon screen appears: 2-11

75 Trend ScanMail for Microsoft Exchange Administrator s Guide Figure 2-8. The Server Logon screen 9. In the User Name text box, enter the account the displayed server is currently logged under. Note: Take note of the account you specify on this screen. ScanMail prompts for this account when you access the server s Web-based administrator console. 10. In the Password text box, enter the password for the specified administrator account. 11. Click Logon to log on to the servers with the same account. Setup creates a profile called SMEX_<server_name>_PF for use with ScanMail and a mailbox named SMEX_ <server_name>_mb for receiving virus notification messages on each server. For servers that require a different logon credential, Setup displays back the Server Logon screen. 2-12

76 Installing ScanMail 12. After the logon process, Setup displays the Analyze Selected Server(s) screen. Click Next and then Next again on the following screen. The Setup Information screen appears. 13. Taking note that the settings you specify on this screen apply to all servers in the group, accept or modify the proposed destination directory and folder name. 14. Click Install to start installing ScanMail to the selected servers. The system will display a screen similar to the following for those servers using accounts with incorrect or insufficient rights (e.g., an account with NT administrator privilege but without Exchange privilege). From the above screen, enter an account with NT administrator privilege ("log on as a service") and Exchange "admin" privilege on organization, site, and configuration levels. 15. Click Next and then Finish on the next two screens to complete the setup process. Setup creates a Web-based Server List on each of the installed servers, in addition to the Windows-based and Web-based administrator consoles, for use in group management. For more information about this list, please refer to Chapter 3, Management Options. To obtain updated virus pattern file from Trend, register ScanMail on each server. For online registration, use the Online Registration form 2-13

77 Trend ScanMail for Microsoft Exchange Administrator s Guide in the Update Pattern tab of the Windows-based administrator console; for registration by ordinary mail, use the Registration Card included in the ScanMail package. Setting up Public Folder Scanning For new installations, you need to perform the following to enable scanning of public folders on a particular Microsoft Exchange server: 1. At the DOS prompt, type <server_dir>\bin\admin -raw where <server_dir> is the Microsoft Exchange server install directory. 2. From the left pane of the Microsoft Exchange Administrator screen, select <domain> Configuration Servers <site> Private Information Store Mailbox Resources. Where <domain> is the server domain and <site> the server site. 3. Select System Attendant from the list on the right pane. Then from the File menu, select Raw Properties. The System Attendant Property screen appears. 4. Select All from the List attributes of type drop-down list box, and Display Name from the Object Attribute drop-down list box. 5. In the Edit value text box, enter a name for the System Attendant mailbox. Then click Set. 6. Select Hide from AB from the Object Attribute drop-down list box and then set its value to 0 in the Edit value text box. 7. Click OK to save the changes. 8. From the left pane, select Folders Public Folders and then the public folder you want ScanMail to scan. 9. Select Properties from the File menu. The Properties screen appears. 2-14

78 Installing ScanMail 10. Click Client Permissions and then Add. 11. From the list at the left of the screen, select the name you specified in step 5 above. Then click Add>. 12. Click OK to create a new account. 13. From the Client Permissions screen, select the account you have just created. 14. Assign a role of "Editor" to this account by selecting Editor from the Roles drop-down list box. 15. Click OK. Uninstalling ScanMail Before removing ScanMail from a particular server, Close the server s Windows-based administrator console. You do not need to close the Web-based administrator console. For remotely-installed ScanMail servers, you have the option to locally or remotely remove the software. Remote uninstallation allows you to remove ScanMail not only from a single server but to a group of servers as well. Note: The remote uninstall program only works on remotelyinstalled ScanMail servers. Local Uninstallation 1. Click the Windows Start button. 2. Select Programs ScanMail for Microsoft Exchange Uninstall ScanMail. A confirmation screen appears. 3. Click Yes. ScanMail s uninstall program removes all program files, as well as program folders, items, directories and entries made to the registry. If 2-15

79 Trend ScanMail for Microsoft Exchange Administrator s Guide ScanMail was remotely installed to this server, its entry in the Web-based Server List will also be removed. Remote Uninstallation 1. Have each target server log off and back on again using an account with NT administrator privilege ("log on as a service") and Exchange "admin" privilege on organization, site, and configuration levels. 2. Insert the ScanMail for Microsoft Exchange CD into the CD-ROM drive and run the uninstall program (SAUNINSTALL.EXE) from the Windows Start menu. Or, if you have the Trend Enterprise Solution CD, run the uninstall program located in the \Programs\SMEX\English directory. 3. Click Next on the Welcome screen. The Select Target Servers screen appears. 4. From the list at the left-hand side of the screen, select the servers where you want to remove ScanMail by highlighting the target server and clicking the Add> button. The selected server appears in the Server Name list at the right. Repeat this process until you have added all the servers you want. To remove a server from the Server Name list, select it and then click the <Remove button. 5. Click Next to continue. The Server Logon screen appears. 6. In the User Name text box, enter the account the displayed server is currently logged under. 7. In the Password text box, enter the password for the specified administrator account. 8. Click Logon to log on to the servers with the same account. Setup checks whether or not ScanMail is installed on each server and then displays the results on the next screen. For 2-16

80 Installing ScanMail those servers that require a different logon credential, Setup displays back the Server Logon screen. 9. After the logon process, Setup displays the Analyze Selected Server(s) screen. Click Next and then Uninstall on the next screen to start removing the program from the selected servers. 10. On the next two screens, click Next and Finish to complete the uninstallation process. ScanMail is now uninstalled from the selected servers. Uninstall has automatically updated the Web-based Server List to remove the corresponding entries for these servers. 2-17

81 Trend ScanMail for Microsoft Exchange Administrator s Guide 2-18

82 3 Management Options Chapter Overview Introduction This chapter contains information on: Managing ScanMail using the Windows-based and Web-based administrator consoles Group management using the Web-based Server List Managing ScanMail from a Trend VCS console There are several ways you could manage ScanMail: locally using the Windows-based administrator console and remotely using the Web-based administrator console. In addition to this, ScanMail complies with the Trend Virus Control System, making it also manageable from any Trend VCS console. Trend VCS is a Web-based management tool that allows administrators to configure, monitor and maintain most anti-virus software installed on the network from a single console regardless of location and platform. 3-1

83 Trend ScanMail for Microsoft Exchange Administrator s Guide The Trend VCS product is sold separately; however, information on how to manage ScanMail using this tool is provided in this manual. Managing ScanMail using the Windows-based Administrator Console You can either use the Windows-based or Web-based administrator console to monitor and set the configuration of ScanMail. All settings you specify will be saved in a common configuration file kept in the Microsoft Exchange server. The Windows-based administrator console gives full control of all ScanMail operations the Web-based administrator console only controls key ScanMail operations like configuring the real-time scanner and viewing entries in the log files. Accessing the Windows-based Administrator Console 1. Click the Windows Start button. 2. Select Programs ScanMail for Microsoft Exchange ScanMail for Microsoft Exchange. The Choose Profile screen appears. 3. Select the SMEX_<server_name>_PF profile or specify another with administrator privileges. 4. Click OK. The ScanMail for Microsoft Exchange main screen appears: 3-2

84 Management Options Figure 3-1. The ScanMail for Microsoft Exchange main screen Managing ScanMail using the Web-based Administrator Console Use the Web-based administrator console for remote management. Whereas the Windows-based administrator console gives you full control of all ScanMail operations, the Web-based administrator console only allows control to key ScanMail operations. Accessing the Web-based Administrator Console You can access the Web-based administrator console either from the ScanMail program folder or from a Web browser. ScanMail Program Folder 1. Click the Windows Start button. 3-3

85 Trend ScanMail for Microsoft Exchange Administrator s Guide 2. Select Programs ScanMail for Microsoft Exchange ScanMail Web Configuration. The Password screen appears. Web Browser 1. Open a Web browser. 2. In the Address text box, specify the URL address below. where <computer> is the name or IP address of the server. 3. Press Enter. The Password screen appears: Figure 3-2. The Password screen 4. Enter the logon credential used when ScanMail was installed to this server. Then click Login. The following screen appears: 3-4

86 Management Options Figure 3-3. The Web-based administrator console Using the Web-based Server List ScanMail provides a Web-based Server List to facilitate management of multiple ScanMail servers on the network. This list allows you to access the Web-based administrator consoles of selected servers, from a single station. The Web-based Server List is automatically created on each server included in a remote installation session. It varies from one server to another depending on the station where ScanMail was installed from servers with ScanMail installed from the same station come with the same list, while those installed from another station come with a different list. 3-5

87 Trend ScanMail for Microsoft Exchange Administrator s Guide Note: To have all servers in one Web-based Server List, always perform remote installation from the same machine. Accessing the Web-based Server List 1. Click the Windows Start button. 2. Select Programs ScanMail for Microsoft Exchange Exchange Servers Web Config. The Web-based Server List similar to the following appears: Figure 3-4. The Web-based Server List To access the Web-based administrator console of server Kelvin, for example, click Kelvin\Smex. 3-6

88 Management Options Managing ScanMail from a Trend VCS Console ScanMail for Microsoft Exchange v1.53 and later are Trend VCS-compliant products. As such, they can be included in the Trend Virus Control System (Trend VCS). Trend VCS is a centralized management console for coordinating, tracking and maintaining the variety of anti-virus software products often found on enterprise networks regardless of platform or physical location. For example, from the Trend VCS console, an administrator can configure all anti-virus programs (e.g., ScanMail for Microsoft Exchange, InterScan VirusWall and Non-Trend anti-virus products) on the network to perform according to the same standards. From the central console, it is also possible to view aggregate virus logs for virus events network-wide, update the virus pattern files for all products and perform other tasks. Trend VCS allows like products to be configured by group. For example, if there are 10 ScanMail servers running on the network, you can use the Trend VCS to make configuration changes to all 10 servers at the same time rather than having to bring up and configure each one individually. No special installation is required from the ScanMail side to make it work with Trend VCS. Instead, a special Trend VCS Agent is installed from the Trend VCS server to establish a link between the system and ScanMail. Additionally, there are several decisions to be made regarding virus pattern file updates and archived log files. Since it is possible to centralize the log files from all anti-virus products installed on the network and the distribution of new virus pattern files from Trend VCS, you may want to disable these functions at the local side to avoid duplications. 3-7

89 Trend ScanMail for Microsoft Exchange Administrator s Guide Accessing the ScanMail Configuration Page To access the Trend VCS console, you need the following: The IP address of the Trend VCS server. Two passwords: the Console and Site passwords. Get this information from the Trend VCS administrator. To access the Trend VCS console, 1. Open a Web browser. 2. In the Address text box, specify the URL address below. where <ipaddress> is the IP address of the Trend VCS server. Then press Enter. 3. When prompted for a password, enter the Console password. The Trend VCS console appears: Figure 3-5. The Trend VCS console 3-8

90 Management Options 4. From the Anti-virus Server Tree at the left of the screen, locate the server you want to manage. Expand the tree to display the existing Sites. 5. The system may prompt you for a password when opening a Site. When prompted, enter the Site password. 6. From the expanded Site, select ScanMail Exchange and then locate the target server. 7. Click Configuration. The ScanMail Configuration page appears on the display area at the right: Figure 3-6. The ScanMail Configuration page The ScanMail Configuration page contains four options, including Real-time Scan, Manual Scan and Scheduled Scan for configuring the real-time, manual and scheduled scanners, and Scheduled Pattern Update for scheduling virus pattern updates. The configuration you specify on this screen, as well as those set from the server s administrator consoles, will be saved in a common 3-9

91 Trend ScanMail for Microsoft Exchange Administrator s Guide configuration file kept on the local server. ScanMail always uses the last saved configuration. 3-10

92 Section II Configuring ScanMail for Microsoft Exchange Section II Configuring ScanMail for Microsoft Exchange Chapter 4: Performing Real-time Scans Chapter 5: Performing Manual & Scheduled Scans Chapter 6: Configuring Notification Messages

93 I

94 4 Performing Real-time Scans Chapter Overview Introduction This chapter contains information on: Enabling or disabling the real-time scan service Modifying the real-time scan configuration Displaying the real-time scan status For uniform protection, we recommend that you install one copy of ScanMail on each of your Microsoft Exchange servers. ScanMail s real-time scanning means all incoming messages and public-folder postings are scanned, and all server-to-server replications monitored. ScanMail decodes attachments encoded using MIME and UUENCODE formats, and detects viruses in files compressed with PKZIP, LZEXE, ARJ, LZH, PKLITE and Microsoft Compress. ScanMail recursively scans files containing multiple levels of compression; for example, a PKZIP file that also has been LZEXE and ARJ compressed. 4-1

95 Trend ScanMail for Microsoft Exchange Administrator s Guide Note: For server-to-server replication scanning to occur, you need to give ScanMail "Editor" or greater role. For information on how to do this, please refer to the documentation that came with Microsoft Exchange. Enabling/Disabling Real-time Scan Once ScanMail has been installed, no specific action is needed to enable the real-time scanning, as both the ScanMail s real-time scanner and SmartScan are automatically started when the Microsoft Exchange server is launched. ScanMail monitors all traffic passing to the Microsoft Exchange server, and saves time and resources by checking mails before they are delivered to the router. In this way, for example, an addressed to 12 users that contains an infected attachment is scanned and cleaned once, rather than 12 times as it arrives to each of the recipients. Windows-based 1. From the ScanMail for Microsoft Exchange main screen, click the Real-time Scan tab or select Real-time Scan Page from the File menu. 4-2

96 Performing Real-time Scans Figure 4-1. The Real-time Scan page 2. To enable the real-time scan service, check the Enable real-time scan check box. To disable, clear this check box. Implementation of the new status is immediate. Web-based Please refer to the appropriate section below for information on Web-based management from the Web-based administrator console and from a Trend VCS console. Web-based Administrator Console Select Configurations Real-time Scan to display the Real-time Scan Configuration page. 4-3

97 Trend ScanMail for Microsoft Exchange Administrator s Guide Figure 4-2. The Real-time Scan Configuration page Trend VCS 1. From the Anti-virus Server Tree at the left of the screen, locate the server you want to manage. 2. Click Configuration. The ScanMail Configuration page appears on the display area at the right. 3. Select Real-time Scan. 4-4

98 Performing Real-time Scans Figure 4-3. The Real-time Scan Configuration page To enable the server s real-time scanner, select On from the Enable real-time scan field at the right of the screen. To disable, select Off. Click Apply to send the new configuration to the server. Configuring Real-time Scan You can configure ScanMail to perform specific actions when it detects an infected file during a real-time scan. These actions include, Send virus notification messages to designated people, including the ScanMail administrator, the intended mail recipient(s) and/or the sender. Do one of the following: Remove the virus from the infected file, Delete the infected file, 4-5

99 Trend ScanMail for Microsoft Exchange Administrator s Guide Forward the infected file to Trend s Virus Hospital at virus_doctor@trendmicro.com, to the ScanMail administrator or to a quarantined directory on the server, or Leave the infected file alone. For information on how to configure notification messages, please refer to Chapter 6, Configuring Notification Messages. Windows-based 1. From the ScanMail for Microsoft Exchange main screen, click the Real-time Scan tab or select Real-time Scan Page from the File menu. The Real-time Scan page displays the current configuration of the real-time scanner. 2. Click Profile if you want to use another profile. Be sure to select an account with administrator privileges. 3. Click the Options button, or select Real-time Scan Options from the Options menu. The Real-time Scan Options screen appears: Figure 4-4. The Real-time Scan Options screen 4-6

100 Performing Real-time Scans 4. If you want ScanMail to automatically clean infected files, a. Select Auto Clean from the Action when virus found drop-down list box. b. From the If the virus is not cleanable group box, select the action to take in the event ScanMail cannot clean the infected files. Select Move the attachment to move the infected files to a location selected in the Move to group box; select Delete the attachment to delete the files; select Pass the attachment to leave the infected files alone (do nothing). c. If you choose Move the attachment, specify the location where to move the infected files in the Move to group box. Select Virus Hospital to forward the infected files to Trend Micro s Virus Hospital; select ScanMail Administrator to forward the infected files to you; select Directory to save the infected files to a selected directory. Note: Trend Micro s Virus Hospital will clean the infected files and send back (through ) the clean files to the intended recipient(s). Trend will notify the recipient(s) regardless of the outcome of the recovery process. d. If you choose Directory in the Move to group box, specify the directory where you want to save the infected files. 5. Select Delete from the Action when virus found drop-down list box to have ScanMail remove the files from the server. 6. To move the files to a specific location, a. Select Move from Action when virus found. b. From the Move to group box, select the location where to move the infected files. 4-7

101 Trend ScanMail for Microsoft Exchange Administrator s Guide c. If you choose Directory, specify the directory you want. 7. If you do not want ScanMail to take any action when it detects infected files, select Pass from Action when virus found. 8. Click OK to save the new real-time scan configuration. The Real-time Scan page displays the new real-time scan configuration. Web-based Please refer to the appropriate section below for information on Web-based management from the Web-based administrator console and from a Trend VCS console. Web-based Administrator Console Select Configurations Real-time Scan to display the Real-time Scan Configuration page. Trend VCS 1. From the Anti-virus Server Tree at the left of the screen, locate the server you want to manage. 2. Click Configuration. The ScanMail Configuration page appears on the display area at the right. 3. Select Real-time Scan. To configure the real-time scanner from the Web-based administrator console or the Trend VCS console, 1. From the Enable real-time scan field at the right of the screen, select Off to disable the real-time scan service. To enable, select On. 2. If you want ScanMail to automatically clean infected files, 4-8

102 Performing Real-time Scans a. Select Auto-Clean from the Clean when virus found field. b. From the Action on noncleanable virus field, select the action to take in the event ScanMail cannot clean the infected files. Select Move to move the infected files to a location selected in the Move to field; select Delete to delete the files; select Pass to leave the infected files alone (do nothing). c. If you choose Move, specify the location where to move the infected files in the Move to field. Select Virus Hospital to forward the infected files to Trend Micro s Virus Hospital; select Administrator to forward the infected files to you; select Directory to save the infected files to the \Virus directory on the ScanMail server. Note: Whereas Windows-based management allows you to select the directory where to move infected files, Web-based always selects the default directory (i.e., \Virus directory of ScanMail) for moving such files. 3. Select Delete from the Clean when virus found field to have ScanMail remove the files from the server. 4. To move the files to a specific location, a. Select Move from Clean when virus found. b. From the Move to field, select the location where to move the infected files. 5. If you do not want ScanMail to take any action when it detects infected files, select Pass from Clean when virus found. 6. Click the Apply button to send the new configuration to the server. A screen appears displaying the result of the configuration process. 4-9

103 Trend ScanMail for Microsoft Exchange Administrator s Guide Monitoring Real-time Scans The current status of the real-time scanner and the results of each scheduled scan process are available in the Real-time Scan Monitor screen. To display this screen, 1. Click the Windows Start button. 2. Select Programs ScanMail for Microsoft Exchange Real-time Scan Monitor. The Real-time Scan Monitor screen appears: Figure 4-5. The Real-time Scan Monitor screen The Real-time Scan Status group box displays the current configuration and status of the real-time scanner. When real-time scan is disabled, this box displays the message below. 4-10

104 Performing Real-time Scans Figure 4-6. What the Real-time Scan Status group box displays when real-time scanning is disabled When enabled, this group box displays the following fields: Real-time Scan started since displays the date when the real-time scan service was started. Default action taken when viruses found displays what action ScanMail takes upon detecting a virus during a real-time scan. Average processing rate for last 500 messages in Kbytes/sec displays how fast the real-time scanner processes 500 messages, in kilobytes per second. Number of messages scanned displays the number of messages that were scanned since starting the service. Number of messages infected displays the number of infected files that were detected since starting the service. Number of viruses found displays the number of viruses that were detected since starting the service. The Last Virus Found group box displays the virus last detected by the real-time scanner or by the scheduled scanner, including the name, action taken, date and time. The Messages Scanned group box displays the results of the real-time and scheduled scan processes. 3. To clear the messages displayed in the Messages Scanned group box, click Clear Messages. 4. To view logs about public folder scanning, click View Public Folders Log. 4-11

105 Trend ScanMail for Microsoft Exchange Administrator s Guide 4-12

106 5 Performing Manual & Scheduled Scans Chapter Overview Introduction This chapter contains information on: Configuring and running manual scans Scheduling the Mailbox and Public Folder List refresh Scheduling scans on selected mailboxes and public folders Scans of the mailboxes and public folders on the Microsoft Exchange server, whether prescheduled or manual, do not occur in real time. Rather, they are closer to the traditional methods of scanning for viruses that exist on the hard drive. Traditional anti-virus scanners, however, are not able to recognize the Microsoft Exchange database format, and thus are not able to scan files and documents inside the Microsoft Exchange environment. One of the first things you should do after installing ScanMail is to run a manual scan on all mailboxes and public folders to check for 5-1

107 Trend ScanMail for Microsoft Exchange Administrator s Guide 5-2 existing viruses. This is an important part of Trend s anti-virus solution. Otherwise, viruses may remain dormant, buried deep within the files and documents, able to spawn reinfections at any time. After performing an initial scan of all mailboxes and public folders, we recommend that you schedule ScanMail to automatically check these locations on a periodic basis. Manual Scan Manual scan checks for infected attachments in the mails stored in mailboxes and files posted on public folders. This scan goes inside individual mailboxes and public folders, checking for any existing viruses. When ScanMail detects a virus in an attachment, it acts only upon the infected file and leaves the message and any non-infected files that were also attached alone. As for the infected file, you can specify one of four actions for ScanMail to take: Clean the virus from the infected file. In some cases, due to damage to the infected file or the nature of the virus, ScanMail can identify the virus but is not able to clean it. When that happens, you can have ScanMail to delete the infected file, leave it alone (do nothing) or move it to a specific location. Delete the infected file. ScanMail removes the infected file from the mail, leaving only the message and the other noninfected files. Pass the infected file without cleaning. Move the infected file to a specific location. ScanMail strips off the infected file from the mail and sends it to the selected location. You can also configure ScanMail to automatically alert, via , the people you designate when a virus is discovered during a manual scan. For example, the ScanMail administrator or other individuals who need to know when infected files are found, like the sender and/or the intended recipient(s).

108 Performing Manual & Scheduled Scans For information on configuring notification messages, please refer to Chapter 6, Configuring Notification Messages. Configuring Manual Scan You can configure the manual scanner either from the Windows-based administrator console or from a Trend VCS console. Please refer to the appropriate section below. Windows-based 1. From the ScanMail for Microsoft Exchange main screen, click the Manual Scan tab or select Manual Scan Page from the File menu. Figure 5-1. The Manual Scan page The Manual Scan page displays the mailboxes and public folders that were detected on the Microsoft Exchange server during the last Mailbox and Public Folder List refresh. 5-3

109 Trend ScanMail for Microsoft Exchange Administrator s Guide 2. To ensure that all mailboxes on the server are included in the above list, click Refresh All. This list is not dynamically updated so be sure to refresh it every time you add or remove mailboxes. Note: ScanMail only scans those mailboxes that are included in the Mailbox and Public Folder List. If you frequently add or remove mailboxes, we recommend that you schedule this refresh to automatically occur at a regular basis. For information on how to do this, please see the Scheduling Mailbox and Public Folder List Refresh section in this chapter. 3. To use the Incremental Scan function, click Incremental Scan Setting. This function expedites the scan process by allowing ScanMail to only scan files that have been modified since the last manual or scheduled scan, or since a specified date. The Incremental Scan Setting screen appears: Figure 5-2. The Incremental Scan Setting screen To configure this function, follow these steps: a. Check the Enable incremental scan check box to enable this feature for this scan. To disable, clear this check box. b. From the Scan files updated since group box, select Last scan to only scan files that have been modified since the last manual or scheduled scan, or Date to only 5-4

110 Performing Manual & Scheduled Scans scan files that have been modified since the specified date. c. If you choose Date, specify the date you want in the provided text boxes. d. Click OK. 4. From the list, check the mailboxes and public folders you want to scan. 5. To scan the mailboxes Inbox, Outbox, Sent Items, Deleted Items and/or customized folders, check the Inbox, Outbox, Sent Items, Deleted Items and/or Others check boxes, respectively. 6. Click the Options button, or select Manual Scan Options from the Options menu. The Manual Scan Options screen appears: Figure 5-3. The Manual Scan Options screen 7. If you want ScanMail to automatically clean infected files, a. Select Auto Clean from the Action when virus found drop-down list box. 5-5

111 Trend ScanMail for Microsoft Exchange Administrator s Guide b. From the If the virus is not cleanable group box, select the action to take in the event ScanMail cannot clean the infected files. Select Move the attachment to move the infected files to a location selected in the Move to group box; select Delete the attachment to delete the files; select Pass the attachment to leave the infected files alone (do nothing). c. If you choose Move the attachment, specify the location to move the infected files in the Move to group box. Select Virus Hospital to forward the infected files to Trend Micro s Virus Hospital; select ScanMail Administrator to forward the infected files to you; select Directory to save the infected files to a selected directory. Note: Trend Micro s Virus Hospital will clean the infected files and send back (through ) the clean files to the intended recipient(s). Trend will notify the recipient(s) regardless of the outcome of the recovery process. d. If you choose Directory in the Move to group box, specify the directory where you want to save the infected files. 8. Select Delete from the Action when virus found drop-down list box to have ScanMail remove the files from the server. 9. To move the files to a specific location, a. Select Move from Action when virus found. b. From the Move to group box, select the location where to move the infected files c. If you choose Directory, specify the directory you want. 5-6

112 Performing Manual & Scheduled Scans 10. If you do not want ScanMail to take any action when it detects infected files, select Pass from Action when virus found. 11. Click OK to save the new manual scan configuration. Web-based Trend VCS 1. From the Anti-virus Server Tree at the left of the screen, locate the server you want to manage. 2. Click Configuration. The ScanMail Configuration page appears on the display area at the right. 3. Select Manual Scan. Figure 5-4. The Manual Scan Configuration page 5-7

113 Trend ScanMail for Microsoft Exchange Administrator s Guide 4. To specify which mailbox folders to scan, check Scan inbox, Scan outbox, Scan sent items, Scan deleted item and/or Scan others to scan the Inbox, Outbox, Sent Items, Deleted Items and/or customized folders. 5. If you want ScanMail to automatically clean infected files, a. Select Clean from the Virus found action field. b. From the Nonclean action field, select the action to take in the event ScanMail cannot clean the infected files. Select Move to move the infected files to a location selected in the Move to field; select Delete to delete the files; select Pass to leave the infected files alone (do nothing). c. If you choose Move, specify the location where to move the infected files in the Move to group box. Select Virus Hospital to forward the infected files to Trend Micro s Virus Hospital; select Administrator to forward the infected files to you; select Directory to save the infected files to the \Virus directory on the ScanMail server. 6. Select Delete from the Virus found action field to have ScanMail remove the files from the server. 7. To move the files to a specific location, a. Select Move from Virus found action. b. From the Move to field, select the location where to move the infected files. 8. If you do not want ScanMail to take any action when it detects infected files, select Pass from Virus found action. 9. If you want to use the Incremental Scan function, select On from the Incremental Scan field. This function expedites the scan process by allowing ScanMail to only scan files that have been modified since the last manual or scheduled scan, or since a specified date. This date, however, can only be set from the Windows-based administrator console. 5-8

114 Performing Manual & Scheduled Scans 10. Click Apply to send the new configuration to the server. A screen appears displaying the result of the configuration process. Scheduling Mailbox and Public Folder List Refresh ScanMail can automatically refresh the Mailbox and Public Folder List on the Windows-based administrator console at predetermined intervals. Refreshing this list is necessary to ensure that all existing mailboxes on the server are displayed on the screen. Note: ScanMail only scans those mailboxes that are included in the Mailbox and Public Folder List. If you frequently add or remove mailboxes on the server, we recommend that you schedule the refresh to automatically occur at a regular basis. To schedule automatic refresh, 1. From the ScanMail for Microsoft Exchange main screen, select Schedule Directory Export from the Help menu. The Schedule Directory Export screen appears: Figure 5-5. The Schedule Directory Export screen 2. Specify the time when the first refresh should occur in the Start time text box. Click AM or PM appropriately. 5-9

115 Trend ScanMail for Microsoft Exchange Administrator s Guide 3. From the frequency group box, specify how often you want refresh to occur per day. Since it can take some time to rebuild the list, we recommend that you do not schedule automatic refreshes any more often than is necessary. The refreshes take place at the hourly intervals (6, 8, 12, 24 or none) you specify, beginning at the designated hour. The Schedule list field displays the selected refresh schedule. 4. Click OK. Running a Scan ScanMail scans the selected mailboxes and public folders for viruses, employing both Trend Micro s MacroTrap and its multi-threading, 32-bit scan engine to detect macro, polymorphic, file, boot sector and other viruses. ScanMail decodes attachments encoded using MIME and UUENCODE formats, and detects viruses in files compressed with PKZIP, LZEXE, ARJ, LZH, PKLITE and Microsoft Compress. ScanMail recursively scans files containing multiple levels of compression; for example, a PKZIP file that has also been LZEXE and ARJ compressed. If Incremental Scan is enabled, only those files that have been modified since the last manual or scheduled scan, or since the specified date are scanned. To run a scan on the selected mailboxes and public folders, 1. From the ScanMail for Microsoft Exchange main screen, click the Manual Scan tab or select Manual Scan Page from the File menu. 5-10

116 Performing Manual & Scheduled Scans 2. Click Scan. The Scan Virus screen appears displaying the scan status: Figure 5-6. The Scan Virus screen 3. If you want to stop the scan, click Stop. The Results page appears following the scan. Displaying Scan Results ScanMail provides a Results page for displaying information about the viruses that were detected during the latest manual scan. This page appears after each scan process. To view the results of the latest manual scan, 1. Click the Results tab or select Results Page from the File menu. 5-11

117 Trend ScanMail for Microsoft Exchange Administrator s Guide Figure 5-7. The Results page 2. This information is held in a volatile cache. Click Print to create a hard copy before closing the screen or it is lost. 3. For details about the sender of an infected file, select an entry from the list and then click the Sender Info button. 4. For details about the detected virus, click Virus Info. The Virus Information screen appears: Figure 5-8. The Virus Information screen 5. Click Close. 5-12

118 Performing Manual & Scheduled Scans Scheduled Scan After cleaning all existing viruses in the Microsoft Exchange environment, we recommend that you schedule automatic scans to occur at a regular basis. This ensures a virus-free environment. Enabling/Disabling Scheduled Scan By default, scheduled scans are disabled. You need to enable this function to start periodic scanning of selected mailboxes and public folders on the server. Windows-based 1. From the ScanMail for Microsoft Exchange main screen, click the Schedule tab or select Schedule Page from the File menu. Figure 5-9. The Schedule page 5-13

119 Trend ScanMail for Microsoft Exchange Administrator s Guide 2. To enable scheduled scans, check the Enable schedule scan check box. To disable, clear this check box. Implementation of the new status is immediate. Web-based Please refer to the appropriate section below for information on Web-based management from the Web-based administrator console and from a Trend VCS console. Web-based Administrator Console Select Configurations Scheduled Scan to display the Scheduled Scan Configuration page. Figure The Scheduled Scan Configuration page 5-14

120 Performing Manual & Scheduled Scans Trend VCS 1. From the Anti-virus Server Tree at the left of the screen, locate the server you want to manage. 2. Click Configuration. The ScanMail Configuration page appears on the display area at the right. 3. Select Scheduled Scan. Figure The Scheduled Scan Configuration page To enable the server s scheduled scanner, select On from the Enable Scheduled Scan field at the right of the screen. To disable, select Off. Click Apply to send the new configuration to the server. Configuring Scheduled Scan When scheduling scans, you may want to take into consideration the workload on the server, which is typically heaviest during business 5-15

121 Trend ScanMail for Microsoft Exchange Administrator s Guide hours, and light during off hours. We recommend that you schedule the scan to occur early morning or during weekends. Windows-based 1. From the ScanMail for Microsoft Exchange main screen, click the Schedule tab or select Schedule Page from the File menu. The Schedule page displays the current status of the scheduled scanner, and the scheduled scans (if there is any). 2. To add a new entry to the list (i.e., to schedule a new scan), a. Click New. The Schedule Scan Setting screen appears: Figure The Schedule Scan Setting screen The list on this screen displays the mailboxes and public folders that were detected on the Microsoft Exchange server during the last Mailbox and Public Folder List refresh. If you always refresh this list every time you add or remove mailboxes, or if you have scheduled the refresh to occur at a regular basis, this list should contain all the existing mailboxes and public folders on the Microsoft Exchange server. 5-16

122 Performing Manual & Scheduled Scans For information on how to refresh the Mailbox and Public Folder List, see the Scheduling Mailbox and Public Folder List Refresh section for automatic refresh, or Configuring Manual Scan section for manual refresh. b. If you want to use the Incremental Scan function for this scan, click Incremental Scan Setting. This function expedites the scan process by allowing ScanMail to only scan files that have been modified since the last manual or scheduled scan, or since a specified date. The Incremental Scan Setting screen appears: Figure The Incremental Scan Setting screen To configure this function, i. Check the Enable incremental scan check box. ii. From the Scan files updated since group box, select Last scan to only scan files that have been modified since the last manual or scheduled scan, or Date to only scan files that have been modified since the specified date. iii. If you choose Date, specify the date you want in the provided text boxes. iv. Click OK. c. From the list, check the mailboxes and public folders you want to scan. 5-17

123 Trend ScanMail for Microsoft Exchange Administrator s Guide d. Specify when the scan should occur using the Frequency drop-down list box and the Time text boxes. Depending on the frequency you select, you may need to select the Day of Week or the Day of Month. Note: Scheduled scans always run on all mailbox folders, including the Inbox, Outbox, Sent Items, Deleted Items and customized folders. Contrast this with manual scan, which only checks the selected folders. e. Click the Options button. The Schedule Scan Options screen appears: Figure The Schedule Scan Options screen f. If you want ScanMail to automatically clean infected files, i. Select Auto Clean from the Action when virus found drop-down list box. ii. From the If the virus is not cleanable group box, select the action to take in the event ScanMail cannot clean the infected files. Select Move the attachment 5-18

124 Performing Manual & Scheduled Scans to move the infected files to a location selected in the Move to group box; select Delete the attachment to delete the files; select Pass the attachment to leave the infected files alone (do nothing). iii. If you choose Move the attachment, specify the location where to move the infected files in the Move to group box. Select Virus Hospital to forward the infected files to Trend Micro s Virus Hospital; select ScanMail Administrator to forward the infected files to you; select Directory to save the infected files to a selected directory. iv. If you choose Directory in the Move to group box, specify the directory where you want to save the infected files. g. Select Delete from the Action when virus found drop-down list box to have ScanMail remove the files from the server. h. To move the files to a specific location, i. Select Move from Action when virus found. ii. From the Move to group box, select the location where to move the infected files. iii. If you choose Directory, specify the directory you want. i. If you do not want ScanMail to take any action when it detects infected files, select Pass from Action when virus found. j. Click OK to close the Schedule Scan Options screen. k. Click OK. ScanMail adds an entry to the list for the scan you have just scheduled. 5-19

125 Trend ScanMail for Microsoft Exchange Administrator s Guide 3. If you want to modify the settings of a particular entry, select it and then click Modify. Follow the same procedure described above to specify a new configuration. 4. If you want to remove an entry from the list, select the entry and then click Delete. Web-based Unlike Windows-based management, which allows you to select the mailboxes and public folders to scan and the directory where to move infected files, Web-scheduled scans always use the default configuration; i.e., to run on all mailboxes and public folders included in the Mailbox and Public Folder List and, if you choose to move infected files to a directory, to move infected files to the \Virus directory on the ScanMail server. Please refer to the appropriate section below for information on Web-based management from the Web-based administrator console and from a Trend VCS console. Web-based Administrator Console Select Configurations Scheduled Scan to display the Scheduled Scan Configuration page. Trend VCS 1. From the Anti-virus Server Tree at the left of the screen, locate the server you want to manage. 2. Click Configuration. The ScanMail Configuration page appears on the display area at the right. 3. Select Scheduled Scan. To configure the scheduled scanner from the Web-based administrator console or the Trend VCS console, 5-20

126 Performing Manual & Scheduled Scans 1. To enable scheduled scans, select On from the Enable Scheduled Scan field at the right of the screen. To disable, select Off. 2. To add a new entry to the list (i.e., to schedule a new scan), a. Click the New button. The configuration parameters appear on the screen. b. Specify when the scan should occur using the Frequency drop-down list box and the Starting Time text boxes. Depending on the frequency you select, you may need to specify the Day of Week or the Day of Month. c. If you want ScanMail to automatically clean infected files, i. Select Auto-Clean from the Action when virus found field. ii. From the Action on noncleanable virus field, select the action to take in the event ScanMail cannot clean the infected files. Select Move to move the infected files to a location selected in the Move to field; select Delete to delete the files; select Pass to leave the infected files alone (do nothing). iii. If you choose Move, specify the location where to move the infected files in the Move to group box. Select Virus Hospital to forward the infected files to Trend Micro s Virus Hospital; select Administrator to forward the infected files to you; select Directory to save the infected files to the \Virus directory of ScanMail. d. Select Delete from Action when virus found to have ScanMail remove the files from the server. e. To move the files to a specific location, i. Select Move from Action when virus found. 5-21

127 Trend ScanMail for Microsoft Exchange Administrator s Guide ii. From the Move to field, select the location where to move the infected files. f. If you do not want ScanMail to take any action when it detects infected files, select Pass from Action when virus found. g. If you want to use the Incremental Scan function for this scan, select On from the Incremental Scan field. This function expedites the scan process by allowing ScanMail to only scan files that have been modified since the last manual or scheduled scan, or since a specified date. This date, however, can only be set from the Windows-based administrator console. h. Click OK. ScanMail adds an entry to the list for the scan you have just scheduled. 3. If you want to modify the settings of a particular entry, select it and then click Modify Schedule. Follow the same procedure described above to specify a new configuration. 4. If you want to remove an entry from the list, select the entry and then click Delete Schedule. 5. Click Apply to send the new configuration to the server. A screen appears displaying the result of the configuration process. Displaying Scan Results You can view the results of each scheduled scan process by accessing the event log file. ScanMail logs all events into this log file, including events related to the real-time scan, scheduled scan and manual scan. In addition to the event log file, you can also use the Real-time Scan Monitor screen to display the results of each scheduled scan process. 5-22

128 Performing Manual & Scheduled Scans For more information about the event log file, please see Chapter 7, Viewing & Maintaining Log Files. For information about the Real-time Scan Monitor screen, please refer to Chapter 4, Performing Real-time Scans. 5-23

129 Trend ScanMail for Microsoft Exchange Administrator s Guide 5-24

130 6 Configuring Notification Messages Chapter Overview In this chapter you will learn how to configure notification messages for each of the system scanners, including the real-time, manual and scheduled scanners. Notification Messages When a virus is detected during a scan, ScanMail can automatically alert, via , the people you designate. For example, the ScanMail administrator or other individuals who need to know when infected files are found, like the sender and/or the intended recipient(s). The notification messages contain details about the virus, including the place where the virus was found (i.e., mailbox or public folder), the sender s name, the subject line, delivery or posting time, name of the virus and the action taken. The following displays what the default notification message contains: 6-1

131 Trend ScanMail for Microsoft Exchange Administrator s Guide 6-2 ScanMail for Microsoft Exchange has detected virus-infected files! Place = <mailbox or public folder name> Sender = <sender name> Subject = <subject of mail> Delivery Time = <delivery or posting time> Action on the virus found: MSWORD_CONCEPT virus was found in the attachment MANUAL1.DOC. ScanMail has cleaned this virus. The attachment can now be safely used. ScanMail gives you the option to append additional information to the above default message, including The website address of Trend Micro, where users can get the latest information about viruses and other related facts, and/or A customized message. For example, if you choose to add the website address and the following message to the notification message that will be sent to the sender of an infected mail, Warning! ScanMail has detected a virus in one of the attachments you sent. the sender will receive a notification message that looks like: ScanMail for Microsoft Exchange has detected virus-infected attachments. Place = Tanny Sender = David Subject = Files you ve requested. Delivery Time = February 15, :25:24 Action on the virus found: MSWORD_CONCEPT virus was found in the attachment MANUAL1.DOC. ScanMail has cleaned this virus. The attachment can now be safely used.

132 Configuring Notification Messages For more information about viruses, please visit Trend Micro s web site at: Message from recipient s administrator: Warning! ScanMail has detected a virus in one of the attachments you sent. The last two paragraphs display the additional information. Note: For the intended recipient of an infected mail, the notification message is sent as a separate . Configuring Real-time Scan Notification Messages You can configure ScanMail to send notification messages to selected people when a real-time scan detects a virus. Windows-based 1. From the ScanMail for Microsoft Exchange main screen, click the Real-time Scan tab or select Real-time Scan Page from the File menu. 6-3

133 Trend ScanMail for Microsoft Exchange Administrator s Guide Figure 6-1. The Real-time Scan page 2. If you want to change to a different profile, click Profile. Be sure to choose an account with administrator privileges. 3. Click the Options button or select Real-time Scan Options from the Options menu. The Real-time Scan Options screen appears: 6-4

134 Configuring Notification Messages Figure 6-2. The Real-time Scan Options screen 4. From the On finding a virus, send notification to group box, specify who will receive a virus notification message whenever the real-time scan detects a virus. You have the option to send this notification to the Recipient, Sender and/or the ScanMail Administrator. If you want to append a message to the default notification, enter the information in the provided text box. a. Check the Recipient check box to notify the intended recipient of the infected mail. b. Check the Sender check box to notify the sender of the infected mail or infected file. c. Check the ScanMail Administrator check box to send a notification message to yourself. d. To include Trend Micro s website address in the notification messages, check the Add com URL to notification check box. 5. Click OK to save the changes. 6-5

135 Trend ScanMail for Microsoft Exchange Administrator s Guide Web-based Please refer to the appropriate section below for information on Web-based management from the Web-based administrator console and from a Trend VCS console. Web-based Administrator Console Select Configurations Real-time Scan to display the Real-time Scan Configuration page. Figure 6-3. The Real-time Scan Configuration page Trend VCS 1. From the Anti-virus Server Tree at the left of the screen, locate the server you want to manage. 2. Click Configuration. The ScanMail Configuration page appears on the display area at the right. 6-6

136 Configuring Notification Messages 3. Select Real-time Scan. Figure 6-4. The Real-time Scan Configuration page To configure notification messages for the real-time scanner from the Web-based administrator console or the Trend VCS console, 1. Select the virus notification message recipients and specify the message you want to append to the default notification in the provided text box, a. To notify the sender of the infected mail or infected file, select Yes from the Notify Sender field. b. To notify the intended recipient of the infected mail, select Yes from the Notify Recipient field. c. To send a notification message to yourself, select Yes from the Notify Administrator field. 2. To include Trend Micro s website address in the notification messages, select Yes from the Add Trend s URL field. 6-7

137 Trend ScanMail for Microsoft Exchange Administrator s Guide 3. Click Apply to send the new configuration to the server. A screen appears displaying the result of the configuration process. Configuring Manual Scan Notification Messages You can configure ScanMail to send notification messages to selected people when a manual scan detects a virus. Windows-based 1. From the ScanMail for Microsoft Exchange main screen, click the Manual Scan tab or select Manual Scan Page from the File menu. Figure 6-5. The Manual Scan page 2. Click on the Options button or select Manual Scan Options from the Options menu. The Manual Scan Options screen 6-8

138 Configuring Notification Messages appears: Figure 6-6. The Manual Scan Options screen 3. From the On finding a virus, send notification to group box, specify who will receive a virus notification message whenever the manual scan detects a virus. You have the option to send this notification to the Recipient, Sender and/or the ScanMail Administrator. If you want to append a message to the default notification, enter the information in the provided text box. a. Check the Recipient check box to notify the intended recipient of the infected mail. b. Check the Sender check box to notify the sender of the infected mail or infected file. c. Check the ScanMail Administrator check box to send a notification message to yourself. d. If you want to include Trend Micro s website address in the notification messages, check the Add www. antivirus.com URL to notification check box. 4. Click OK to save the changes. 6-9

139 Trend ScanMail for Microsoft Exchange Administrator s Guide Web-based Trend VCS 1. From the Anti-virus Server Tree at the left of the screen, locate the server you want to manage. 2. Click Configuration. The ScanMail Configuration page appears on the display area at the right. 3. Select Manual Scan. Figure 6-7. The Manual Scan Configuration page 4. Select the virus notification message recipients and specify the message you want to append to the default notification in the provided text box, a. To notify the sender of the infected mail or infected file, select Yes from the Notify Sender field. 6-10

140 Configuring Notification Messages b. To notify the intended recipient of the infected mail, select Yes from the Notify Recipient field. c. To send a notification message to yourself, select Yes from the Notify Administrator field. 5. To include Trend Micro s website address in the notification messages, select Yes from the Add Trend s URL field. 6. Click Apply to send the new configuration to the server. A screen appears displaying the result of the configuration process. Configuring Scheduled Scan Notification Messages You can configure ScanMail to send notification messages to selected people when a scheduled scan detects a virus. Windows-based 1. From the ScanMail for Microsoft Exchange main screen, click the Schedule tab or select Schedule Page from the File menu. 6-11

141 Trend ScanMail for Microsoft Exchange Administrator s Guide Figure 6-8. The Schedule page 2. From the list, select the entry you want to work on and then click Modify. The Schedule Scan Setting screen appears: Figure 6-9. The Schedule Scan Setting screen 6-12

142 Configuring Notification Messages 3. Click Options. The Schedule Scan Options screen appears: Figure The Schedule Scan Options screen 4. From the On finding a virus, send notification to group box, specify who will receive a virus notification message whenever this scan detects a virus. You have the option to send this notification to the Recipient, Sender and/or the ScanMail Administrator. If you want to append a message to the default notification, enter the information in the provided text box. a. Check the Recipient check box to notify the intended recipient of the infected mail. b. Check the Sender check box to notify the sender of the infected mail or infected file. c. Check the ScanMail Administrator check box to send a notification message to yourself. d. If you want to include Trend Micro s website address in the notification messages, check the Add www. antivirus.com URL to notification check box. 5. Click OK to close the Schedule Scan Options screen. 6-13

143 Trend ScanMail for Microsoft Exchange Administrator s Guide 6. Click OK again to save the changes. Web-based Please refer to the appropriate section below for information on Web-based management from the Web-based administrator console and from a Trend VCS console. Web-based Administrator Console Select Configurations Scheduled Scan to display the Scheduled Scan Configuration page. Figure The Scheduled Scan Configuration page 6-14

144 Configuring Notification Messages Trend VCS 1. From the Anti-virus Server Tree at the left of the screen, locate the server you want to manage. 2. Click Configuration. The ScanMail Configuration page appears on the display area at the right. 3. Select Scheduled Scan. Figure The Scheduled Scan Configuration page To configure notification messages for a particular scan from the Web-based administrator console or the Trend VCS console, 1. Select the entry you want to work on from the list and then click the Modify Schedule button. The configuration parameters appear on the screen displaying the current settings of the selected entry. 6-15

145 Trend ScanMail for Microsoft Exchange Administrator s Guide 2. Select the virus notification message recipients and specify the message you want to append to the default notification in the provided text box, a. To notify the sender of the infected mail or infected file, select Yes from the Notify Sender field. b. To notify the intended recipient of the infected mail, select Yes from the Notify Recipient field. c. To send a notification message to yourself, select Yes from the Notify Administrator field. 3. If you want to include Trend Micro s website address in the notification messages, select Yes from the Add Trend s URL field. 4. Click OK. ScanMail updates the entry according to the changes you have just specified. 5. Click Apply to send the new configuration to the server. A screen appears displaying the result of the configuration process. 6-16

146 Section III Maintaining ScanMail for Microsoft Exchange Section III Maintaining ScanMail for Microsoft Exchange Chapter 7: Viewing & Maintaining Log Files Chapter 8: Updating the Virus Pattern File Chapter 9: Using the Virus Encyclopedia

147 I

148 7 Viewing & Maintaining Log Files Chapter Overview This chapter contains information on: ScanMail s log files Viewing entries in the log files Using the aging function to control the sizes of the log files ScanMail s Log Files ScanMail keeps three log files to document various events: The event log file records events related to the ScanMail services, including the real-time scan, manual scan and scheduled scan. The virus log file records virus events, including details such as the date and time the virus was detected, the sender of the infected file, where the virus was detected (mailbox or public folder), the virus name and the action that was taken. 7-1

149 Trend ScanMail for Microsoft Exchange Administrator s Guide The pattern update log file records events related to virus pattern updates. ScanMail keeps the log files in the \Log directory of ScanMail using the filenames, SCANSUM.LOG for the event log file, MANUAL. LOG for the virus log file and UPDATPTN.LOG for the pattern update log file. Since system and virus events occur more frequently than pattern updates, ScanMail implements an aging function on the event and virus log files to control their sizes. This function automatically deletes entries in these log files that are older than the configured aging time. Viewing Entries in the Log Files Entries in the event log and the virus log files can be viewed according to the following priorities: Grouped by date Grouped by service; i.e., real-time scan, manual scan or scheduled scan These priorities do not apply to the pattern update log file for the following two reasons: (1) the pattern update process is totally independent of the scan type, and (2) pattern update events occur less often. Windows-based 1. From the ScanMail for Microsoft Exchange main screen, click the View Log tab or select View Log Page from the File menu. 7-2

150 Viewing & Maintaining Log Files Figure 7-1. The View Log page 2. If you want to view specific entries in the event or virus log file, a. In the From: and To: text boxes, specify the time period you want. b. To view entries specific to the scheduled scan process, manual scan process and/or real-time scan process, check the Scheduled scan, Manual scan and/or Real-time scan check box(es), respectively. c. To retrieve the selected entries from the event log file, click Event Log. The Event Log screen appears: 7-3

151 Trend ScanMail for Microsoft Exchange Administrator s Guide Figure 7-2. The Event Log screen For details about a particular scan, select an entry from the list and then click View Scan Details. Or, doubleclick the target entry. To get a summary of all the entries included in the list, click Summary. If you want to print the list, click Print. Click Close to close this screen. d. To retrieve the selected entries from the virus log file, click Virus Log. The Virus Log screen appears: 7-4

152 Viewing & Maintaining Log Files Figure 7-3. The Virus Log screen For details about the sender of an infected file, select the corresponding entry and then click Sender Info. Or, double-click the target entry. For details about the virus that was detected in a particular file, click Virus Info. To print the entries displayed on this screen, click Print. To close, click Close. 3. To display the pattern update history of the system, perform these steps: a. Click the Update Log button. The Pattern Update Log View screen appears: 7-5

153 Trend ScanMail for Microsoft Exchange Administrator s Guide Figure 7-4. The Pattern Update Log View screen The Updated result field displays the result of the last pattern update process. b. Click Print to print the entries displayed on this screen. c. To close the screen, click Close. Web-based Web-based Administrator Console To view entries in the event log file or virus log file, 1. Select View Log Files Scan Log. 7-6

154 Viewing & Maintaining Log Files Figure 7-5. The Scan Log page 2. In the From: and To: text boxes at the right of the screen, specify the time period you want. 3. To view entries specific to the scheduled scan process, manual scan process and/or real-time scan process, check the Scheduled Scan, Manual Scan and/or Real-time Scan check box(es), respectively. 4. From the Select log type field, select which log file you want to access. Select Event Log to access the event log file; select Virus Log to access the virus log file. 5. Click View to display the selected entries. To view the pattern update history of the system, select View Log Files Pattern Update Log. 7-7

155 Trend ScanMail for Microsoft Exchange Administrator s Guide Maintaining the Log Files ScanMail implements an aging function on the event and virus log files to control their sizes. This function automatically deletes entries in these files that are older than the configured aging time. Note: If you have ScanMail included in Trend VCS, you may no longer need the log files kept on the Microsoft Exchange server. As such, set their aging time to the minimum; i.e., 1 day. To set the aging time, 1. From the ScanMail for Microsoft Exchange main screen, click the View Log tab or select File View Log Page. 2. Click Options. The View Log Options screen appears: Figure 7-6. The View Log Options screen 3. In the Delete records older than text box, specify the aging time you want. Maximum aging time is 90 days. 4. Click OK to save the new value. 7-8

156 Viewing & Maintaining Log Files 7-9

157 Trend ScanMail for Microsoft Exchange Administrator s Guide 7-10

158 8 Updating the Virus Pattern File Chapter Overview This chapter contains information on: The system virus pattern file Online registration Updating the pattern file from a floppy, UNC path, mapped drive, local drive or from Trend s web site Scheduling pattern updates Virus Pattern File ScanMail for Microsoft Exchange draws upon an extensive database of virus "signatures," commonly called the virus pattern file. It is this file that ScanMail uses to detect viruses in traffics, folder replications and archived documents. As new viruses are written, released to the public and discovered, Trend collects their tell-tale signatures and incorporates the information into the virus pattern file. New virus pattern files are available every two weeks or so, and you should not wait much longer than a month before updating your existing pattern file. 8-1

159 Trend ScanMail for Microsoft Exchange Administrator s Guide To obtain updated virus pattern file, you must register ScanMail with Trend Micro. Note: If you have ScanMail included in Trend VCS, you may want to disable the pattern update function on the Microsoft Exchange server to avoid duplications. Registering ScanMail There are two ways to register ScanMail: (1) by filling out and mailing the Registration Card included in the ScanMail package, or (2) by completing the Registration Form in the Update Pattern tab and sending it over the Internet. This section describes the latter method. 1. From the ScanMail for Microsoft Exchange main screen, click the Update Pattern tab or select Update Pattern Page from the File menu. Figure 8-1. The Update Pattern page 8-2

160 Updating the Virus Pattern File 2. Click the Register button. The Online Registration screen appears: Figure 8-2. The Registration screen 3. Complete the form and then click the Send button. 4. Click OK on the next screen. You can now download new virus pattern files from Trend Micro s web site. 8-3

161 Trend ScanMail for Microsoft Exchange Administrator s Guide Updating the Virus Pattern File 8-4 We recommend that you update your virus pattern file every two weeks to keep up with the latest viruses. Hundreds, and by some estimates, thousands, of new viruses are written and released each year, so you should not allow the pattern file to fall months out of date. To update the virus pattern file of the system, perform these steps: 1. From the ScanMail for Microsoft Exchange main screen, click the Update Pattern tab or select Update Pattern Page from the File menu. 2. To update the pattern file from a floppy, UNC path, mapped drive or local drive, a. Insert the pattern file floppy into the disk drive. If you do not have this diskette, go directly to step c. b. From the Select a drive to copy new pattern from drop-down list box select the drive where you have inserted the floppy. c. If you have the pattern file saved in a local drive, UNC path or mapped drive, select Others from the Select a drive to copy new pattern from drop-down list box and then specify the complete path in the Type in the drive path text box. d. Click Drives to start the pattern update process. 3. To download the pattern file from Trend Micro s web site, a. If there is a proxy server between your network and the Internet, check the Enable proxy check box and then specify the Port number and Server IP address. b. Click the Internet button. The The last update result group box displays the progress of the update process. After updating the system s pattern file, the Your

162 Updating the Virus Pattern File current pattern file version is field displays the new pattern file number. ScanMail logs this event into the pattern update log file. Enabling/Disabling Scheduled Pattern Update By default, the scheduled pattern update function of ScanMail is disabled. You can, however, enable this function to have your copy of the virus pattern file automatically updated at a regular basis. Windows-based 1. From the ScanMail for Microsoft Exchange main screen, click the Update Pattern tab or select Update Pattern Page from the File menu. 2. Check the Enable schedule pattern update check box. Implementation of the new status is immediate. Web-based Please refer to the appropriate section below for information on Web-based management from the Web-based administrator console and from a Trend VCS console. Web-based Administrator Console Select Configurations Scheduled Pattern Update to display the Scheduled Pattern Update Configuration page. 8-5

163 Trend ScanMail for Microsoft Exchange Administrator s Guide Figure 8-3. The Scheduled Pattern Update Configuration page Trend VCS 1. From the Anti-virus Server Tree at the left of the screen, locate the server you want to manage. 2. Click Configuration. The ScanMail Configuration page appears on the display area at the right. 3. Select Scheduled Pattern Update. 8-6

164 Updating the Virus Pattern File Figure 8-4. The Scheduled Pattern Update Configuration page To enable the server s scheduled pattern update function, select On from the Enable Scheduled Pattern Update field at the right of the screen. To disable, select Off. Click Apply to send the new configuration to the server. Scheduling Pattern Updates You can schedule ScanMail to automatically download the latest pattern file updates from Trend or from a specific directory. Windows-based 1. From the ScanMail for Microsoft Exchange main screen, click the Update Pattern tab or select Update Pattern Page from the File menu. 8-7

165 Trend ScanMail for Microsoft Exchange Administrator s Guide 2. To enable the scheduled pattern update function, check the Enable schedule pattern update check box. To disable, clear this check box. 3. Click Options. The Schedule Pattern Update screen appears: Figure 8-5. The Schedule Pattern Update screen 4. From the Time setting group box, select the update Frequency and Time. Depending on the frequency you select, you may need to select the Day of Week or Day of Month. 5. From the Update pattern from group box, select the location where you want to download the new pattern file from. Select Internet to download from Trend s web site; select Drive to download from a local directory, UNC path, mapped drive or floppy. If you choose Drive, type in the complete path to the pattern file in the provided text box. 6. Click OK to save the new configuration. ScanMail displays the new pattern update schedule on the Update Pattern page. 8-8

166 Updating the Virus Pattern File Web-based Whereas Windows-based management allows you to select the location where to download pattern files from, Web-scheduled updates always download from Trend s web site. Please refer to the appropriate section below for information on Web-based management from the Web-based administrator console and from a Trend VCS console. Web-based Administrator Console Select Configurations Scheduled Pattern Update to display the Scheduled Pattern Update Configuration page. Trend VCS 1. From the Anti-virus Server Tree at the left of the screen, locate the server you want to manage. 2. Click Configuration. The ScanMail Configuration page appears on the display area at the right. 3. Select Scheduled Pattern Update. To configure pattern updates from the Web-based administrator console or the Trend VCS console, 1. To enable the scheduled pattern update function, select On from the Enable Scheduled Pattern Update field at the right of the screen. To disable, select Off. 2. Specify when the pattern update should occur using the Frequency drop-down list box and the Starting Time text boxes. Depending on the frequency you select, you may need to select the Day of Week or the Day of Month. 3. Click Apply to send the new configuration to the server. A screen appears displaying the result of the configuration process. 8-9

167 Trend ScanMail for Microsoft Exchange Administrator s Guide 8-10

168 9 Using the Virus Encyclopedia Chapter Overview Introduction This chapter contains information on: The system virus encyclopedia Places you can get information about viruses Sending viruses to Trend Micro for special treatment Getting information about a virus Your copy of the ScanMail program includes a desktop version of our virus encyclopedia, organized by name and virus type. Use it to find out about the typical symptoms of a given virus, its infection procedure and the damage routine. Of course ScanMail, which uses Trend Micro s award-winning scan engine, is capable of detecting thousands of viruses, not just those included in the online encyclopedia. 9-1

169 Trend ScanMail for Microsoft Exchange Administrator s Guide Additional Information from the Web More comprehensive anti-virus information is available over the Internet at our anti-virus center From there, you can find: Virus classifications Anti-virus methods Detailed information about the viruses listed in the encyclopedia Trend Micro s products White papers We also provide a virus calendar with the dates that known logic bombs viruses are set to go off, and a list of viruses that are currently in the wild, or actively circulating. Advice on what to do if you think you have a virus is also provided, and you will find our Virus Emergency Room (ER), where you can send files infected with especially pernicious viruses for special treatment. Sending Trend Your Viruses You can also us viruses. More specifically, if you have a file you suspect is infected with a virus but the scan engine does not detect it or can not clean it, we encourage you to send the suspected file to Trend s Virus Hospital at: virus_doctor@trendmicro.com Please include in the message text a brief description of the symptoms you are experiencing. Our team of virus engineers will dissect the file and remove any virus(es) it may contain. We will then return the cleaned file to you. 9-2

170 Using the Virus Encyclopedia ScanMail can automatically send infected files to Trend Micro s Virus Hospital. For information about this feature, please see Section II, Configuring ScanMail for Microsoft Exchange. Accessing the Virus Encyclopedia To access the virus encyclopedia, 1. From the ScanMail for Microsoft Exchange main screen, click the Virus Information tab or select Virus Information Page from the File menu. Figure 9-1. The Virus Information page 2. From the Virus Type drop-down list box, select the virus group you are interested in. 3. Choose the name of the virus from the Virus Name List. Information about the selected virus appears in the Description field. The Type of File Virus and Memory 9-3

171 Trend ScanMail for Microsoft Exchange Administrator s Guide Resident fields display the virus type, and whether or not it stays resident in the memory (TSR). 4. Click Print to make a hard copy of the displayed virus description. 9-4

172 Section IV Technical Support Issues Chapter 10: Contacting Technical Support Section IV Tech. Support Issues Chapter 11: Frequently Asked Questions

173 I

174 10 Contacting Technical Support Trend Micro provides a full year of free technical support for ScanMail customers worldwide. If you need help, or just have a question, please feel free to contact us. Trend Micro can be reached via telephone, fax, BBS, , regular mail or through our web site at We also welcome your comments. Bringing Up the Technical Support Screen ScanMail provides a database containing the contact information of all Trend Micro offices worldwide. If you are experiencing problems and need to contact a technical support engineer closest to your site, please access this database. Windows-based 1. From the ScanMail for Microsoft Exchange main screen, select Help Technical Support. The Technical Support Information screen appears: 10-1

175 Trend ScanMail for Microsoft Exchange Administrator s Guide Figure The Technical Support Information screen 2. From the Office drop-down list box, select the office you need. Trend Micro s offices include the following: Trend Micro, Inc. (USA) Trend Micro Latin America, Inc. (Mexico) Trend Micro do Brazil, Ltda. Trend Micro Europe S.r.1. Trend Micro Deutschland GmbH Trend Micro, Inc. (Taiwan) Trend Micro, Inc. (Japan) Trend Micro, Inc. (Korea) Trend Micro, Inc. (Malaysia) The Contact Information field displays the information for the selected office. 3. Click Close to close the screen. 10-2

176 Contacting Technical Support Web-based Web-based Administrator Console 1. Select Technical Support. 2. From the displayed list, click on the country you need. Figure The Technical Support page 10-3

177 Trend ScanMail for Microsoft Exchange Administrator s Guide 10-4

178 11 Frequently Asked Questions FAQs If you encounter problems while using the product, please check for the solution in this chapter before calling for help. If this does not fix your problem, please get in touch with any of Trend s technical support people. See Chapter 10, Contacting Technical Support, for information. I received a logon failure message while performing remote installation. Please make sure that the account you specify during installation is the same account the target server is currently logged under. If you do not want to do this, have the target server log off before installation. This allows you to specify any account you want. Be reminded though that you still need to specify an account with Service Account Admin privileges. The Web-based Server List does not include all the ScanMail servers. The Web-based Server List varies from one server to another depending on the station where ScanMail was installed from servers with ScanMail installed from the same station come with the 11-1

179 Trend ScanMail for Microsoft Exchange Administrator s Guide same list, while those installed from another station come with a different list. If you want to have all these servers in one list, always perform remote installation from the same machine. A message that reads "Removing temp files" appears on the screen for a long time. During remote installation, the system usually takes about five minutes to remove the temporary files. The Web-based administrator console does not display the new settings I have just set. The Web-based administrator console does not automatically refresh after each configuration. You need to manually refresh this console to display the new settings. To do this, just click on any option at the right of the screen and then go back to the page you are currently working on. The new settings should now appear. 11-2

180 Section V Appendix Appendix A: Computer Viruses Section V Appendix