Antigen for Microsoft SMTP Quick Start Guide. Published: March 2005

Transcription

1 Antigen for Microsoft SMTP Quick Start Guide Published: March 2005

2 Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the example companies, organizations, products, domain names, addresses, logos, people, places, and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, address, logo, person, place, or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. Microsoft Corporation may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft Corporation, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property Microsoft Corporation. All rights reserved. Microsoft, Active Directory, Outlook, Windows, Windows NT, and Windows Server are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. All other trademarks are property of their respective owners.

3 Table of Contents Introduction... 1 Introducing Microsoft Antigen for Microsoft SMTP...1 Installation... 2 System Requirements...2 Minimum Server Requirements... 2 Minimum Workstation Requirements... 2 Installing on a Local Server...3 Installing on a Remote Server...4 Administrator-Only Installation...4 Upgrading...5 Uninstalling...5 Configuring Antigen... 6 Securing the Antigen Service...6 The Antigen Administrator...6 Connecting to a Local Server...6 Antigen Administrator Overview...7 General Options...8 Configuring File Scanner Updating...9 Scanner Update Settings...9 Scheduling an Update...10 Primary Update Path Secondary Update Path Date Time Frequency Repeat Enabling Updates for an Engine Scheduling Updates on Multiple Servers Updating Through a Proxy...12 Configuring the SMTP Scan Job...12 Configuring the AV Scanners and Job Action...14 Running the SMTP Scan Job...15 Configuring File Filtering...15 Available File Filtering Actions Configuring Notifications...17 To Configure and Enable Notifications The Incident Log...19 The Quarantine Database...21 Additional Settings and Options The Anti-Spam Job...23 Using Identify: Tag Message...23 SpamCure Engine Updates...24 Mailhost Filtering...24 Sender-Domains Filtering...25 Subject Line Filtering...25 Keyword Filtering...26 Allowed Sender Lists...26 Getting Help... 28

4 Introduction Introducing Microsoft Antigen for Microsoft SMTP Antigen helps protect Microsoft Simple Mail Transfer Protocol (SMTP) services running on Microsoft Windows Server 2003 and Microsoft Windows 2000 Server. It is designed to help eliminate the infiltration of viruses into your environment as well as provide file and content filtering to control unwanted message traffic and proactively block viruses before they have been identified by virus labs. In addition to antivirus protection, Antigen provides powerful content filtering features that include: o o o Keyword message body filtering. Mailhost filtering with real-time blackhole list (RBL) integration. File and content filtering that includes filter lists to help administrators manage large groups of filters. Antigen also includes support for the optional Antigen Spam Manager. This add-on module helps administrators minimize the number of spam messages that enter their messaging environments. The Antigen Spam Manager enhances Antigen s content filtering by providing: o o Support for the mail filter s SpamCure anti-spam engine. Identify: Tag Message options for suspected spam message tracking and identification. Antigen helps protect your messaging servers and is the antivirus solution for Microsoft Exchange 2000 Server and Microsoft Exchange Server 2003 environments. This Quick Start Guide will help you install and start using Microsoft Antigen for Microsoft SMTP. For more detailed information on the included topics and for additional topics not covered in this guide, see the Microsoft Antigen for Microsoft SMTP User Guide. 1

5 Installation This release of Antigen for Microsoft SMTP supports local and remote installations on servers running Microsoft Windows Server 2003 and Windows 2000 Server. Antigen s setup wizards can be used to install the product to a local SMTP server, to a remote SMTP server, or as an administrator-only installation to a local workstation. The following information should be gathered prior to installation: The server name of the computer running the SMTP service (remote installation) Microsoft Internet Information Services (IIS) 5.0 SMTP service must be installed for Antigen s SMTP scanning to function. Windows Messenger must also be installed on the server to provide the Messaging Application Programming Interface (MAPI) to ensure the proper parsing of message bodies in.msg files and Transport Neutral Encapsulation Format (TNEF)-encoded messages. (You can install Microsoft Office Outlook on the server to provide the required functionality.) System Requirements These are the minimum requirements necessary to install Antigen for Microsoft SMTP on a server and a workstation. Administrators must have domain rights and local administrator rights to install Antigen for Microsoft SMTP on servers. Minimum Server Requirements Windows 2000 Server, Professional Server, or Advanced Server SP4 Update Rollup 1 or Windows Server 2003 (all versions) 64 megabytes (MB) of available memory (512 MB recommended). (Note: Each additional licensed scan engine will require more memory per Antigen scanning process.); 100 MB of available disk space Intel processor IIS 5.0 or later with SMTP service installed. Minimum Workstation Requirements Windows 2000 Professional 6 MB of available memory 10 MB of available disk space Intel processor 2

6 Installing on a Local Server To install Antigen for Microsoft SMTP on a local server, log on the local computer using an account that has administrator rights. To begin the installation procedure, run setup.exe from the directory containing the Antigen installation files. Follow the initial setup panels until you are prompted by the Installation Location panel. To install on a local server, choose Local Installation. Follow these installation steps: 1. Read and accept the Antigen license. 2. Enter your name and company name. 3. Choose Local or Remote Installation. 4. If you choose Remote Installation, you will be prompted to enter the server name and share directory of the remote server. 5. Choose Server or Administrator Install. 6. Set the Quarantine Security Settings. You can choose Secure Mode or Compatibility Mode. o o Secure Mode is the default, and when the value is set to this mode, all messages and attachments delivered from Quarantine will be re-scanned for viruses and filter matches. Compatibility Mode allows messages and attachments to be delivered from Quarantine without being scanned for filter matches. (Messages and attachments are always scanned for viruses.) Antigen identifies these messages by placing special Tag text in the subject line of all messages that are delivered from Quarantine. For more information about this setting, see the chapter Reporting and Statistics in the Microsoft Antigen for Microsoft SMTP User Guide. 7. Enter the path to the installation folder or use the default (c:\program Files\Microsoft Antigen for SMTP). 8. Enter the program folder name or use the default (Antigen for SMTP). 9. Review the Install Settings and accept or correct as needed. 10. All the installation files will now be installed. 11. View the ReadMe. 12. Click OK to let Antigen restart your server to properly engage the Antigen SMTP event sink or restart your server at a later time. The Antigen Administrator installed with SMTP scanning for Windows Server 2003 or Windows 2000 Server may also be used to connect to Antigen for Exchange or Antigen for SharePoint servers. The registry for the Antigen service remains: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft Software\Antigen for SMTP 3

7 Installing on a Remote Server Antigen can be installed remotely within the same domain using the installation wizard. To remotely install Antigen on an SMTP server using the installation wizard, you will need to log on your local computer using an account that has administrator rights to the remote computer. This is necessary for setup to be able to perform Windows 2000 Server service registration. Antigen can also be installed remotely using the Microsoft Antigen Enterprise Manager (AEM). The AEM installation process is described later in this guide. 1. Follow the initial setup panels until you are prompted by the Installation Location panel. Choose Remote Installation / Uninstallation. If Antigen is already installed on the remote Exchange Server, this process can automatically stop the SMTP services, uninstall Antigen, and restart the SMTP services prior to beginning the new installation. 2. Enter the following information: a. Server Name: The name of the computer to which you are installing Antigen. b. Share Directory: The temporary location that the remote installation will use while setting up Antigen. Default: C$. 3. If Microsoft Data Access Components (MDAC) or Microsoft Jet is not installed (Windows 2000 Server only), Antigen will ask if you would like the component installed on the remote server. Once initiated, the install of MDAC or Jet will proceed in silent mode. Note: If restarting the computer is required after MDAC or Jet is installed, Antigen will restart the server automatically. Once the installation is complete, Antigen will continue installing Antigen on the remote server. 4. At this point, installation will determine if the SMTP service is installed and/or running on the remote computer. If the SMTP service is not running, the installation will give you the option of starting the SMTP services. The SMTP services must be running for installation to continue. 5. Choose the Destination Directory and Start Menu Program Folder name. Click Next. 6. After installation is complete, setup can stop and restart the SMTP services automatically. This needs to be done in order for Antigen to become active. Click Next to have setup perform this step, or click Skip to manually perform this step at a later time. 7. Like most installations, setup updates shared Microsoft files on your computer. If during installation you are instructed to restart your computer, you do not have to do that immediately, but it may be necessary for certain Antigen features to work correctly. Note: Upon installation, Antigen is configured to allow everyone access to the Antigen service. To change the security settings to restrict access to the Antigen service, you will need to use DCOMCNFG to modify the security settings. For more information about securing access to the Antigen service, see the Antigen Services chapter in the Microsoft Antigen for Microsoft SMTP User Guide. Administrator-Only Installation Performing an administrator-only installation will install the Antigen Administrator onto any Windows workstation or server, which can then be used to centrally manage the Antigen service 4

8 running on remote SMTP servers. Administrator-only installation requires approximately 2.5 MB of disk space. To perform an administrator-only installation 1. Follow the initial setup panels until you are prompted by the Installation Location panel. Choose Local Installation, and then click Next. 2. Choose Administrator - Admin Console Only, and then click Next. 3. Choose the installation directory, and then click Next. Default: Program Files\Microsoft Antigen for SMTP 4. Choose Start Menu Program Folder, and click Next. Default: Antigen for SMTP Upgrading Antigen detects previous installations and provides the option of upgrading the service. Upgrading an installation requires only that you provide the password for the user account that the Antigen service runs under. (Antigen does not store this for security reasons.) Antigen retains all of your previous settings. When upgrading, additional features may be added based on your environment. When upgrading Antigen, all scan jobs will have their template settings configured to none in order to prevent users from inadvertently overwriting existing settings. To deploy templates, you will need to change this setting on each server to default or a named template. For more information on configuring scan job template settings, see the Templates chapter in the Microsoft Antigen for Microsoft SMTP User Guide.. Note: 1. After an upgrade to Antigen 9.0, the Microsoft antivirus (AV) engine will not scheduled for updates. You must manually set the update schedule for the Microsoft engine after the upgrade is complete. 2. When upgrading Antigen on a server where NetIQ AppManager is installed, you will first need to disable and shut down NetIQ prior to the upgrade of Antigen. This is required because the Antigen performance.dll is registered so that Perfmon monitors it. NetIQ attaches itself to this.dll and will not release it even if the programs that use it are shut down. If this.dll is not released, it will not be properly upgraded during the install. Uninstalling Local Servers To uninstall Antigen from a local computer, stop the SMTP services and use the Add/Remove Programs utility in the Windows Control Panel to remove Antigen. Note: If Advanced Spam Manager (ASM) junk mail folders have been enabled, Antigen will disable the folders during the uninstall. There is, however, no automated way of deleting the junk mail folders; the user or administrator will have to delete them manually to remove them. 5

9 Configuring Antigen Before you use Antigen for Microsoft SMTP for the first time, there are some steps you should perform. For more detailed information on these procedures, see the Antigen for Microsoft SMTP User Guide. Securing the Antigen Service The Antigen service uses Distributed COM (DCOM) to launch and authenticate administrator connections. You can build an access list of authorized Microsoft Windows NT users who can connect to the Antigen service using the Antigen Administrator. To edit the default settings for the Antigen service: 1. Open a Windows NT command window, type DCOMCNFG and press ENTER. The Distributed COM Configuration Properties dialog box will appear. 2. Choose AntigenService from the Applications list, and click Properties. Once the identity of a user account has been configured, you can use the Access Lists on the Security tab to control who has rights to access the Antigen service, launch the Antigen service, or change the DCOM configuration. For more information about the Antigen service, see the Antigen Services chapter of the Antigen for Microsoft SMTP User Guide. The Antigen Administrator The Antigen Administrator is used to configure and run Antigen for Microsoft SMTP locally or remotely. For the Antigen Administrator to launch successfully, the Antigen service and the Microsoft SMTP server must be running on the computer to which the Antigen Administrator is connecting. Since the Antigen Administrator is the front end of the Antigen for Microsoft SMTP software, it can be launched and closed without affecting the back-end processes that are being performed by the Antigen service. The Antigen Administrator may also be run in a read-only mode to provide access to users who do not have permission to change settings or run jobs, but who may need to view information provided through the user interface (UI). To run the Antigen Administrator, from the Start menu, click Programs, and click Microsoft Antigen for SMTP. Connecting to a Local Server The first time the Antigen Administrator is launched, it will prompt you to connect to the SMTP server running on the local computer. You can use the server name or local alias to connect to the local SMTP server. 6

10 Antigen Administrator Overview The Antigen Administrator dialog box contains the Shuttle Navigator on the left and the work panels on the right, as shown in the following illustration. The Shuttle Navigator is divided into several areas: Settings The SETTINGS area includes icons for accessing the work panels to configure: Scan Job, Anti-Virus, Scanner Updates, Templates, General Options, and the Anti-Spam job when the Antigen Spam Manager is enabled. Filtering The FILTERING area includes icons for accessing the work panels to configure: Content Filtering, File Filtering, Mailhost Filtering, Keyword Filtering, Allowed Senders, and Filter Lists. Operate The OPERATE area includes icons for accessing the work panels to: Run Antivirus and Anti-spam jobs, Schedule Jobs, and perform Quick Scans. Report The REPORT area includes icons for accessing the work panels for: Notification Configuration, the Incidents View, and the Quarantine area. The areas of the Shuttle Navigator are discussed in the Antigen for Microsoft SMTP User Guide. 7

11 General Options General Options, accessed from the SETTINGS shuttle of the Antigen Administrator dialog box, provides access to a variety of system-level settings for Antigen for Microsoft SMTP, eliminating the need to directly access the registry in order to change them. While there are many options that can be controlled through General Options, each of them has a default (enabled/disabled or a value), which can be used as is for most situations. There are, however, several that you may want to modify while configuring Antigen for the first time. These options are: Critical Notification List: Enter the addresses of administrators and others who should be notified in the event that the SMTP service starts and Antigen is not hooked in or if the Antigen Store shuts down abnormally. Multiple addresses should be separated by semicolons. For example: admin@northwindtraders.com;admin2@northwindtraders.com. Internal Address: For the purpose of identifying Internal Addresses, administrators will need to enter the domain names that should be sent internal notifications in the field provided. Domains should be entered as a semicolon delimited list. For example: northwindtraders.com;northwindtraders.net 8

12 When entering a domain name, please be aware that subdomains are covered by the entry. For example: domain.com will include subdomain.domain.com, subdomain2.domain.com, and so forth Alternate domains such as domain.net or domain.org must be entered individually. Do not use any spaces in the list. You might also be asked to modify some settings as you work through this Quick Start guide. You can find a complete list of the General Options and their definitions in the Antigen Administrator chapter of the Antigen for Microsoft SMTP User Guide. Configuring File Scanner Updating The standard Antigen license includes five antivirus engines (called the Box Set): two from Computer Associates (InoculateIT and Vet), and one each from Microsoft, Norman, and Sophos. The Box Set engines begin scanning your system as soon as the Antigen service starts. Your license may also allow you to select additional engines during the installation process. Once Antigen is installed, updates automatically take place. Scanner Update Settings To set the schedule times for updating the scanning engine, select Scanner Updates from the SETTINGS shuttle, and then choose Scanner Updates. The Scanner Update Settings dialog box appears, as shown in the following illustration. 9

13 The top pane shows a list of supported file scanners and the Worm List. The bottom pane contains the updating schedule for the selected scanner, along with information on that scanner. Scheduling an Update To schedule an update for a particular engine, select it in the top pane. In the bottom pane, set the primary and secondary update paths (if necessary), as well as the date, time, and frequency for the update. Finally, make sure that updating is enabled for that engine. All of these are explained in the following sections. Primary Update Path Set the primary update path by clicking Primary in the bottom pane and entering a value into the Network Update Path field. By default, Antigen uses the primary update path to download updates. If the primary path fails for any reason, Antigen uses the secondary update path, if any (which is explained in the following section). The primary update path is set to by default. You may change it to point to another HTTP update site or, if you would prefer to use Universal Naming convention (UNC) updating as the primary update path, enter the UNC path to another server. For more information about UNC updating, see Distributing Updates, later in this guide. To restore the default server path, right-click in the Network Update Path field and select Default HTTP Path. 10

14 Secondary Update Path Set the secondary update path by clicking Secondary in the bottom pane and entering a value into the Network Update Path field. If the primary path fails for any reason, Antigen will use the secondary update path. It is left blank by default. The secondary path may be set to use HTTP or UNC updating. Enter either a URL or a UNC path to another SMTP server. For more information about UNC updating, see Distributing Updates, later in this guide. Date Use the calendar to specify when to check for updates. If you choose a Frequency of Once, this date is the only time update checking will take place; if you specify anything other than Once, this date represents the first time update checking will take place. Click the left and right arrows to change the month. Click a particular day to select it (it will turn blue). Time Set a time for the update to take place. Each of the three subfields (hour, minute, and AM/PM) can be selected and set separately. You can enter a time or use the up/down controls to change the current value of each subfield. Frequency Specify how often the update will occur. You can choose Once (update only once, on the given date and time), Daily (update every day, at the same time), Weekly (update each week, on the same day and time), or Monthly (update each month, on the same date and time). We recommend that you select Daily, and then set a Repeat interval to update the engine at multiple times during the day. Repeat The Repeat setting indicates a repeat interval. Enable it by selecting it and choosing a time interval (the minimum time is 15 minutes). We recommend that you check for updates at least every two hours. If a new update is not available at the scheduled time, the engine is not taken offline and no updating is done. Enabling Updates for an Engine Use the Enable and Disable buttons to control whether the update check will be performed for a selected engine. All engine updates are enabled by default. Note: This controls updating only, not the use of the engine. To disable an engine, clear its check box on the Anti-Virus Settings dialog box. Scheduling Updates on Multiple Servers When scheduling engine updates on multiple servers in your organization, we recommend staggering the updates by at least five minutes, in order to prevent servers from timing out during 11

15 the update process. When scheduling updates for multiple engines, it is also helpful to stagger the updates in five-minute intervals. Note: If you are using the optional Microsoft Antigen Enterprise Manager (AEM) to update the scan engines, you should disable scheduled updates in Antigen. Updating Through a Proxy In environments where the servers must access the Internet through a proxy server, Antigen can be configured to retrieve engine updates through that proxy. To configure Antigen for proxy server updating, follow these steps: 1. Select General Options from the SETTINGS shuttle. 2. In the Scanner Updates section of General Options, select Use Proxy Settings. 3. Enter the following information: Proxy Server Name/IP Address The IP address of the proxy server Proxy Port The number of the port Antigen should use Proxy Username The name of a user with access rights to the proxy server (if necessary) Proxy Password The appropriate password for the proxy user name (if necessary) UNC Username The name of a user with access rights to the UNC path (if necessary) UNC Password The appropriate password for the UNC user name (if necessary) 4. Save your changes. Once the Proxy Server settings have been entered and saved, they can be deployed to other servers by replicating the General Options settings using the Microsoft Antigen Enterprise Manager (AEM). Configuring the SMTP Scan Job The SMTP Scan Job scans in real-time all Multipurpose Internet Mail Extensions (MIME) and Uuencode based and related attachments that are inbound or outbound through the SMTP stack. The SMTP Scan Job is your first line of defense against unwanted and malicious messages and attachments, so it should be configured and operating as soon as possible. To configure the SMTP Scan Job, select Scan Job from the SETTINGS shuttle on the Antigen Administrator. The SCAN JOB SETTINGS dialog box appears, as shown in the following illustration. 12

16 Follow these steps to configure the SMTP Scan Job: 1. Click SMTP Scan Job in the top portion of the SCAN JOB SETTINGS work panel that contains the list of configurable Scan Jobs. 2. Select if you want to scan Inbound, Outbound, and/or Internal messages. Inbound messages are messages that originated from or were relayed through an external server. Outbound messages include all outgoing that leaves your site or organization through the SMTP stack. Messages are designated as Outbound if at least one recipient has an external address. Internal messages are messages that originate from inside your domain and all the recipients are located inside your domain. 3. Configure the Deletion Text. When Antigen deletes an infected attachment, it replaces it with the deletion text so that the recipient will know that a virus was deleted. The default deletion text is: Antigen for Microsoft SMTP removed %file% since it was found to be infected with %virus% virus. Where %file% is the name of the file that was removed and %virus% is the name of the virus that infected the file. The deletion text can be changed to include additional information you may want to provide to your users. Additional dynamic keywords can be added to the message, such as the name of the sender or recipient. To insert a dynamic keyword, right-click in the Deletion Text window and choose Paste Keyword. 4. If the Advanced Spam Manager is installed, a button labeled Tag Text is displayed. When you click the Tag Text, a text field is presented. This text is used by Antigen to tag the subject line or MIME header of a message when the Action for a filter is set to Identify: Tag Message. (For more information about this action, see the Antigen Spam Manager chapter of the Antigen for Microsoft SMTP User Guide.) A custom message 13

17 can be used by modifying this text field. 5. If you want to append a disclaimer to all outbound messages, check the Outbound Disclaimer box. The disclaimer feature of Antigen for Microsoft SMTP allows administrators to append a disclaimer to outbound messages flowing through the SMTP stack. When the Add Outbound Disclaimer option is selected, the Disclaimer Text button will be enabled. If you click the Disclaimer Text button, a text input dialog box displays the default disclaimer text. You may customize the disclaimer text by entering the message you want include in all outgoing messages. Once enabled, the disclaimer text will be appended to the message body of all outbound messages. 6. To save your configuration settings, click Save. Configuring the AV Scanners and Job Action The next step is to configure the AV engines, the Bias setting for the engines, and the job Action, and to enable the Send Notifications and Quarantine Files options. To configure these settings, click the Anti-Virus icon in the shuttle navigator. The Anti-Virus Settings work panel will open. The settings are displayed in the bottom half of the work panel as shown in the following image. Follow these steps to configure the settings: 1. Select SMTP Scan Job in the top portion of the work panel. This will ensure that your settings will be applied to the proper Scan Job. 2. Select the scan engines that the SMTP Scan Job should use. It is a good idea to enable multiple engines for the SMTP Scan Job because it is your first line of defense. Select or clear the check box next to each engine. 3. Set the engine Bias. Since the SMTP Scan Job is your first line of defense, you should consider setting the bias to Max Certainty or Favor Certainty. For more information about bias settings, please refer to the Multiple Scan Engines and Bias Modes chapter of the Antigen for Microsoft SMTP User Guide. 4. Set the Action that you want Antigen to perform when a virus is detected. The options include: Skip Clean Make no attempt to clean or delete. Viruses will be reported, but the files will remain infected. Attempt to clean the virus. If successful, the infected attachment will be replaced with the clean version. If cleaning is not possible, the attachment will be deleted but the body of the message will remain. 14

18 Delete Delete the attachment without attempting to clean. The infected file will be removed from the attachment and a text file containing the deletion text will be inserted in its place. 5. Enable Send Notifications for the SMTP Scan Job if you want Antigen to send notifications when a virus is detected. 6. Enable Quarantine Files if you want Antigen to save messages and attachments detected by the file scanning engine. By default, Quarantine Files is enabled. 7. Save your changes. Running the SMTP Scan Job Now that the SMTP Scan Job is properly configured, follow these steps to run the job: 1. Click OPERATE in the left navigation shuttle, and then click the Run Job icon. The Run Job work panel will appear to the right. 2. Select the SMTP Scan Job. 3. If the State for the Scan Job is not set to Enabled, click the Enable button. This will enable the Scan Job. 4. Select or clear the following options: Virus Scanning, File Filtering, Content Filtering, Keyword Filtering, and/or Mailhost Filtering. In most cases, all options should be selected. 5. If the ASM is installed, you may also select the following option: Spam Scanning. For additional information about these options, see the Antigen for Microsoft SMTP User Guide. The SMTP Scan Job is now configured and running. Incidents are displayed in the lower half of the Run Job work panel whenever the Administrator is opened. Configuring File Filtering File filtering provides an additional layer of defense against malicious or infected files. It is considered a security best practice to block certain file types that are considered potentially dangerous. File attachments can be detected by their name, type, size, or any combination of the three. To configure some basic file filters, follow these steps: 1. Open the Antigen Administrator and click File Filtering in the FITLTERING area of the Navigation Shuttle. The File Filtering work panel will be displayed. 2. Select the Scan Job for which you want to configure File Filtering. Once it has been selected, the changes that are made to the lower portion of the File Filtering panel will apply to the selected Scan Job. 3. Create the file filter by clicking the Add button and entering the proper syntax. There are a number of ways you can enter a file filter. The filters work by a combination of name and file type. You must select both elements to complete the filter. For example, if you want to filter executable files (.exe), you can create a filter like this: 15

19 *.exe* and then set the File Types selection list to EXEFILE. Setting the File Types selection to only match actual.exe files will help reduce false positives. Note: The second asterisk (*) in the filter will prevent files with extra characters appended after the file extension from bypassing the filter. 4. Next, set the Action that Antigen should take when a file filter is matched. The options are described in the following table in the Available File Filtering Actions section. 5. Use the drop down list to set the filter to Enabled. 6. Select if you want detected files to be quarantined. 7. Select if you want Antigen to send notifications when a file is detected. 8. If you want, you can modify the Deletion Text that will be used when a file is deleted. The default text is: Microsoft Antigen for Microsoft SMTP removed %File% since it was found to match the %Filter% file filter. 9. Click Save to save the new file filter. Available File Filtering Actions There are four actions available when a file is detected, as described in the following table. Action Skip: Detect only Delete: Remove contents Purge: Eliminate message Identify: Tag message Description This setting will record the number of messages that meet the filter criteria, but will allow messages to route normally. This setting does not provide any protection. However, you may want to use this setting to log instances of specific file types being sent or received without taking action on them. Delete the file attachment. The detected file attachment will be removed from the message and a text file will be inserted in its place. The text file will contain the string that was configured using the Deletion Text button. This setting will delete the message from your mail system. If you want to keep a copy of the , make sure you choose the Quarantine Files option. File Filtering option offers the same tagging options as the Anti-Spam Scan Job. However, most of these actions would only be used in limited scenarios for File Filtering. For descriptions of the tagging options, see the Using Identify: Tag Message section later in this guide. For more information about setting file filters, including creating file size filters, using wild cards, and creating filters for only inbound or outbound messages, see the Antigen for Microsoft SMTP User Guide. 16

20 Configuring Notifications There are many notifications that can be used to notify administrators, senders (both internal and external), and recipients (both internal and external) of virus and filter incidents. Each of these can be edited and customized by selecting Notification from the Report area of the shuttle navigator. The NOTIFICATION SETUP dialog box appears, as shown in the following illustration. The available notifications include: Virus Administrators: This notification is used to alert administrators of all viruses being detected on the server that is being protected by Antigen. Typically, the notification is used for reporting the who, what, where, and when details of the infection, including the disposition of the virus. Virus Sender (internal): Use this notification to alert the sender of the infection if the sender is in your organization. The typical message would include help in determining the extent of infection on the user s own computer, whom to call, and how to proceed. Virus Sender (external): Use this notification to alert the sender of the infection if the sender is not a user in your organization. Virus Recipients (internal): Use this notification to alert the recipient of the infection if the recipient is in your organization. The typical message would include help in determining the extent of infection on the user s own computer, whom to call, and how to proceed. 17

21 Virus Recipients (external): Use this notification to alert the recipient of the infection if the recipient is not a user in your organization. File Administrators: This notification is used to alert administrators of all files that satisfy the filtering criteria on the server that is being protected by Antigen. Typically, the notification is used for reporting the who, what, where, and when details of the filtering performed, including the disposition of the attachment. This notification is also used for messages that are purged by File Filtering. File Sender (internal): Use this notification to alert the sender of the filtered attachment if the sender is in your organization. This notification is also used for messages that are purged by File Filtering. File Sender (external): Use this notification to alert the sender of the filtered attachment if the sender is not a user in your organization. This notification is also used for messages that are purged by File Filtering. File Recipients (internal): Use this notification to alert the recipient of the filtered attachment if the recipient is in your organization. This notification is also used for messages that are purged by File Filtering. File Recipients (external): Use this notification to alert the recipient of the filtered attachment if the recipient is not a user in your organization. This notification is also used for messages that are purged by File Filtering. Worm Administrators: This notification is used to alert administrators of all worm messages that are detected or purged by Antigen. Content Administrators: This notification is used to alert administrators of all messages that are filtered by Sender and Subject Line Filtering. Content Sender (internal): Use this notification to alert the sender that a message was filtered by Sender or Subject Line Filtering if the sender is in your organization. Content Sender (external): Use this notification to alert the sender that a message was filtered by Sender or Subject Line Filtering if the sender is not a user in your organization. Content Recipients (internal): Use this notification to alert the recipient that a message was filtered by Sender or Subject Line Filtering if the recipient is in your organization. Content Recipients (external): Use this notification to alert the recipient that a message was filtered by Sender or Subject Line Filtering if the recipient is not a user in your organization. Keyword Administrator: This notification is used to alert administrators of all messages that are filtered by Keyword Filtering. Keyword Sender (internal): Use this notification to alert the sender that a message was filtered by Keyword Filtering if the sender is in your organization. Keyword Sender (external): Use this notification to alert the sender that a message was filtered by Keyword Filtering if the sender is not a user in your organization. 18

22 Keyword Recipients (internal): Use this notification to alert the recipient that a message was filtered by Keyword Filtering if the recipient is in your organization. Keyword Recipients (external): Use this notification to alert the recipient that a message was filtered by Keyword Filtering if the recipient is not a user in your organization. Spam/RBL Administrator: This notification is used to alert administrators of all messages that are filtered by a spam engine or RBL filters. To Configure and Enable Notifications To configure notifications, follow these steps: 1. Enable the notifications you want to use. Check that the notifications you want to use are enabled and those you don t want to use are disabled. To change a setting, select the Notification and click the appropriate Enable or Disable button. 2. Enter administrator addresses. All Administrator notifications must have recipient addresses defined for them. Enter one or more addresses in the To:, cc: or bcc: address lines. You may enter multiple addresses by using a semicolon-separated list of people or groups who should receive the notification. The list may include addresses, aliases, and groups. 3. Customize the subject line and body text if necessary. Default notification text is provided, but you may customize each message. Edit the text in the appropriate areas to customize the text. You can enter additional automatic keyword fields by right-clicking and choosing Paste Keyword. 4. Click Save to save your changes. Note: The Scan Job configuration controls the sending of any enabled notifications. The Incident Log The Incident database (Incidents.mdb) stores all virus detections or filter operations for an SMTP server, regardless of the Scan Job that caught the infection or performed the filtering. Antigen collects statistics on a per Storage Group basis for the Manual and Realtime Scan Jobs. To view this log, click REPORT in the left navigation shuttle and then click the Incidents icon. The Incidents work panel will open as shown in the following illustration. 19

23 Incidents will be displayed on the screen. By clicking the columns, you can sort data based on that column heading. You can also clear the log, export data, set a purge time for the database, and filter the contents of the database. Purging the Database The Incident Log can grow very large. When this happens, performance can be affected. To keep the log from growing too large, you can set a purge time. Simply select the Purge check box and choose how many days of Incident Log data you wish to maintain. Filtering the Data When searching for a specific incident, the Filtering field can be very helpful. Select a column category, and then enter specific filter text. Wildcards are available for the Filtering field. Consult the Antigen for Microsoft SMTP User Guide for details. You must click the Save button for your filter settings to take effect. Clearing the Log Clearing the Virus Incidents database is a two-step process. 1. On the Incidents dialog box, click Clear Log. This clears all the items from the Incidents display. 20

24 2. In the OPERATE shuttle, click Run Job. Select a Scan Job, and then click Clear Log. This clears the items from the job s Incidents display. You must clear both the Real-Time and the Manual jobs to have all items flagged for deletion from the database. After you have cleared the entries in both work panels, they are flagged for deletion from the Incidents database and no longer show on the dialogs. Antigen automatically compacts the database every day at 2:00 A.M. (until that time, the items still exist). Exporting Data Use the Export button to save the Virus Incident results. Clicking the button displays a standard Windows save dialog, in which you select a location for the Incidents.txt or Quarantine.txt file and choose a format of Formatted Text or Delimited Text. Entries in the Delimited Text format are separated by a vertical bar ( ). The Quarantine Database Antigen will, by default, create a copy of every detected file before a clean, delete, or skip action occurs. These files are stored in an encoded format in the Quarantine folder under the Antigen installation folder. An administrator can access the QUARANTINE panel to delete or extract stored detected file attachments. To view the Quarantine log, click REPORT in the left navigation shuttle, and then click the Quarantine icon. You will see the QUARANTINE panel appear to the right, as shown in the following illustration. 21

25 Quarantined items will be displayed on the screen. By clicking the columns, you can sort data based on that column heading. The Quarantine screen enables you to check for items, search among them, deliver them, export them for viewing, and set purge times. Deliver an Item If a particular message or attachment needs to be delivered, select the item and click the Deliver button. A pop-up window will allow you to deliver the item to the original recipient(s) or redirect it elsewhere. All items released from Quarantine will be rescanned for viruses, to prevent release of a known virus. If you release a virus, it will once again return to the Quarantine. Purging the Database The Incident Log can grow very large. When this happens, performance can be affected. To keep the log from growing too large, you can set a purge time. Simply select the Purge check box and choose how many days of Incident Log data you want to maintain. Filtering the Data When searching for a specific incident, the Filtering field can be very helpful. Select a column category, and then enter specific filter text. Wildcards are available for the Filtering field. Consult the Antigen for Microsoft SMTP User Guide for details. You must click the Save button for your filter settings to take effect. Clearing the Quarantine Database To clear the Quarantine database, in the QUARANTINE dialog box, click Clear Log. After you have cleared the entries, they are flagged for deletion from the Quarantine database. Antigen automatically compacts the database every day at 2:00 A.M. (until that time, the items still exist). You can also delete a subset of the results by selecting one or more entries (use the SHIFT and CTRL keys to select multiple entries), and then using the DELETE key to remove them from the Quarantine listing. Note: If a large number of entries is selected, the deletion process can take a long time. In this case, a message box appears to ask you to confirm the deletion. Exporting Data Use the Export button to save the Virus Incident results. Clicking the button displays a standard Windows save dialog, in which you select a location for the Incidents.txt or Quarantine.txt file and choose a format of Formatted Text or Delimited Text. Entries in the Delimited Text format are separated by a vertical bar ( ). 22

26 Additional Settings and Options Antigen for Microsoft SMTP and the Antigen Spam Manager (ASM) provide many additional features that can add to your level of protection and provide tools to fight unwanted spam . These features include: The Anti-Spam Job (ASM Only) Mailhost filtering Sender-Domains Filtering Subject Line Filtering Message Body Keyword Filtering Each of these features will be described below. For a full discussion of using each of these features, see to the Antigen for Microsoft SMTP User Guide. The Anti-Spam Job Spam can make up 60 percent or more of inbound , causing network congestion, clogged mail stores, and upset and distracted end users. An effective blocking mechanism is critical. The Anti-Spam Job is available when the optional Antigen Spam Manager is installed with Antigen. The Anti-Spam Scan Job uses the SpamCure engine from Mail-Filters to detect spam with no administrative effort required. SpamCure uses an effective and accurate signature-based spam detection technology to catch unwanted s. All users of Advanced Spam Manager should configure this Scan Job. To configure the Anti-Spam Job, you will need to enable the engine and set the action that Antigen should take upon detection of a suspected spam . Follow these steps to configure and enable the Anti-Spam Job: 1. In the SETTINGS area of the Shuttle Navigator, click Anti-Spam. The Anti-Spam Settings work panel will be displayed. 2. To enable the SpamCure engine for an SMTP Scan Job, select the SpamCure check box. 3. Set the Action that Antigen should take upon detection of a spam message. The options include: Skip: Detect only Purge: Eliminate message Identify: Tag message (If you select Identify: Tag Message make sure to click the Identify tab and set the identification specifics. For additional information, see the following Using Identify: Tag Message section. 4. Click Save to save your changes. Using Identify: Tag Message 23

27 When the Antigen Spam Manager is enabled, the action Identify: Tag Message is available for all filtering and anti-spam functions. This action allows administrators to select how they want a suspect message to be tagged for later identification. You may choose from the following options: Tag subject line Message Header Set SCL property Move to ASM Junk Mail The text specified in the Tag Text dialog box will be added to the subject line of the message. The Tag Text dialog box can be accessed by clicking the Tag Text button on the SMTP Scan Job Settings work panel. This setting can be used to enable Microsoft Office Outlook users to route suspected spam to a junk mail folder by setting client side rules in their Outlook clients. The text specified in the Tag Text dialog box will be added to the MIME header. This setting can be used to enable Outlook users to route suspected spam to a junk mail folder by setting client side rules in their Outlook clients. This option will set the spam confidence level (SCL) rating on the message indicating whether or not Antigen determined the message to be spam. The Enable SCL Rating option must be selected in the General Options work panel to use this action. Antigen will always set the SCL Rating to level 9. The Store Action Threshold option in the SMTP scan job SETTINGS work panel must also be set to 8 or lower. Using this setting will allow Outlook to route suspected spam to the Outlook Junk Mail folder. This option will route all messages that match a content filter or are identified as spam to the ASM Junk Mail folder in the user s Outlook desktop. Note: When using this option, you must also check the Enable Junk Mail Folders option in the General Options work panel. (Exchange Server 2000 only.) Note: Multiple options may be checked for each filter. SpamCure Engine Updates The SpamCure engine must be set to automatically update. The update should be configured for once per half-hour or less. Click Scanner Updates to configure this engine in the same way as you configured the anti-virus engines. Mailhost Filtering Mailhost Filtering is designed to prevent mail from specific IP addresses from entering your messaging environment. There are three components of Mailhost Filtering: Allowed Mailhosts, Rejected Mailhosts, and RBL Servers. All three are configured by clicking Mailhost Filtering in the Filtering menu of the Shuttle Navigator. For details on using these features, please refer to the Antigen for Microsoft SMTP User Guide. 24