F-Secure Anti-Virus for Microsoft Exchange

Administrator’s Guide "F-Secure" and the triangle symbol are registered trademarks of F-Secure Corporation and F-Secure product names and symbols/logos are either trademarks or registered trademarks of F-Secure Corporation. All product names referenced herein are trademarks or registered trademarks of their respective companies. F-Secure Corporation disclaims proprietary interest in the marks and names of others. Although F-Secure Corporation makes every effort to ensure that this information is accurate, F-Secure Corporation will not be liable for any errors or omission of facts contained herein. F-Secure Corporation reserves the right to modify specifications cited in this document without prior notice.

Companies, names and data used in examples herein are fictitious unless otherwise noted. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of F-Secure Corporation.

This product includes code from SpamAssassin. The code in the files of the SpamAssassin distribution are Copyright © 2000-2002 Justin Mason and others, unless specified otherwise in that particular file. All files in the SpamAssassin distribution fall under the same terms as Perl itself, as described in the “Artistic License”.

This product may be covered by one or more F-Secure patents, including the following:

GB2353372 GB2366691 GB2366692 GB2366693 GB2367933 GB2368233 GB2374260

12000040-7B15 Contents

About This Guide 7 How This Guide Is Organized ...... 8 Conventions Used in F-Secure Guides...... 9 Symbols ...... 9 Chapter 1 Introduction 11 1.1 Overview ...... 12 1.2 How F-Secure Anti-Virus for Microsoft Exchange Works...... 13 1.3 Key Features...... 15 1.4 F-Secure Anti-Virus Mail Server and Gateway Products ...... 17 Chapter 2 Requirements 19 2.1 Which SQL Server to Use for the Quarantine Database?...... 20 2.2 Network Requirements...... 21 2.3 Web Browser Software Requirements ...... 22 2.4 Improving Reliability and Performance ...... 23 2.5 Configuring the Product After the Installation...... 24 Chapter 3 Using F-Secure Anti-Virus for Microsoft Exchange 25 3.1 Administering F-Secure Anti-Virus for Microsoft Exchange ...... 26 3.1.1 Logging in for the First Time...... 26 3.2 Checking the Product Status...... 29 3.3 Configuring the Web Console ...... 32

3 3.4 Modifying Settings and Viewing Statistics...... 33 3.5 Manually Processing Mailboxes and Public Folders ...... 34 3.5.1 Stand-alone Mode ...... 34 3.5.2 Creating Scanning Operations ...... 34 3.6 Configuring Alert Forwarding ...... 67 3.7 Viewing Alerts ...... 69 Chapter 4 Administration with Web Console 70 4.1 Overview ...... 71 4.2 F-Secure Anti-Virus for Microsoft Exchange Settings ...... 71 4.2.1 Summary ...... 72 4.2.2 Virus Scanning ...... 74 4.2.3 Stripping Attachments ...... 90 4.2.4 Content Filtering ...... 100 4.2.5 Manual Scanning...... 107 4.2.6 Quarantine...... 111 4.2.7 Advanced...... 121 4.2.8 Internal Domains ...... 127 4.3 F-Secure Content Scanner Server Settings...... 129 4.3.1 Summary ...... 129 4.3.2 Database Updates...... 136 4.3.3 Scan Engines ...... 138 4.3.4 Proxy Configuration...... 143 4.3.5 Archive Scanning...... 146 4.3.6 Advanced...... 149 4.3.7 Interface...... 151 4.4 F-Secure Automatic Update Agent Settings ...... 152 4.4.1 Summary ...... 153 4.4.2 Automatic Updates ...... 156 4.5 F-Secure Management Agent Settings ...... 157 Chapter 5 Quarantine Management 160 5.1 Introduction ...... 161 5.2 Configuring Quarantine Options...... 162 5.3 Searching the Quarantined Content...... 163

4 5.4 Query Results Page ...... 167 5.5 Viewing Details of a Quarantined Message ...... 169 5.6 Reprocessing the Quarantined Content...... 171 5.7 Releasing the Quarantined Content...... 172 5.8 Removing the Quarantined Content...... 174 5.9 Deleting Old Quarantined Content Automatically...... 174 5.10 Quarantine Logging...... 175 5.11 Quarantine Statistics ...... 176 5.12 Moving the Quarantine Storage ...... 177 Chapter 6 Administering F-Secure Spam Control 179 6.1 Overview ...... 180 6.2 Spam Control Settings in Web Console...... 180 6.3 Realtime Blackhole List Configuration ...... 185 6.3.1 Enabling Realtime Blackhole Lists ...... 185 6.3.2 Optimizing F-Secure Spam Control Performance ...... 187 Chapter 7 Updating Virus and Spam Definition Databases 189 7.1 Overview ...... 190 7.2 Automatic Updates with F-Secure Automatic Update Agent...... 190 7.3 Configuring Automatic Updates ...... 190 7.4 Manual Updates ...... 191 7.4.1 Using FSUPDATE ...... 191 Appendix A Variables in Warning Messages 192 List of Variables...... 193 Outbreak Management Alert Variables ...... 195 Appendix B Services and Processes 196 Chapter C Troubleshooting 202 C.1 Overview ...... 203 C.2 Starting and Stopping...... 203

5 C.3 Viewing the Log File...... 203 C.4 Common Problems and Solutions...... 204 C.4.1 Installing Service Packs...... 207 C.4.2 Securing the Quarantine...... 207 C.5 Frequently Asked Questions ...... 208 C.6 F-Secure Automatic Update Agent Troubleshooting...... 213 Technical Support 218 F-Secure Online Support Resources ...... 219 Web Club ...... 220 Virus Descriptions on the Web ...... 221

6 ABOUT THIS GUIDE

How This Guide Is Organized...... 8 Conventions Used in F-Secure Guides ...... 13

7 8

How This Guide Is Organized

F-Secure Anti-Virus for Microsoft Exchange Administrator's Guide is divided into the following chapters: Chapter 1. Introduction. General information about F-Secure Anti-Virus for Microsoft Exchange and other F-Secure Anti-Virus Mail Server and Gateway products. Chapter 2. Requirements. System requirements and instructions how to set up F-Secure Anti-Virus for Microsoft Exchange. Chapter 3. Using F-Secure Anti-Virus for Microsoft Exchange. Instructions how to use and administer F-Secure Anti-Virus for Microsoft Exchange. Chapter 4. Administration with Web Console. Instructions how to administer F-Secure Anti-Virus for Microsoft Exchange with the Web Console. Chapter 6. Administering F-Secure Spam Control. General information about and instructions on how to configure F-Secure Spam Control. Chapter 7. Updating Virus and Spam Definition Databases. Instructions how to update your virus definition database. Appendix A. Variables in Warning Messages. Lists variables that can be included in virus warning messages. Appendix B. Services and Processes. Describes services, devices and processes of F-Secure Anti-Virus for Microsoft Exchange. Chapter C. Troubleshooting. Solutions to some common problems. Technical Support. Contains the contact information for assistance. About F-Secure Corporation. Describes the company background and products. 9

Conventions Used in F-Secure Guides

This section describes the symbols, fonts, and terminology used in this manual. Symbols

WARNING: The warning symbol indicates a situation with a risk of irreversible destruction to data.

IMPORTANT: An exclamation mark provides important information that you need to consider.

REFERENCE - A book refers you to related information on the topic available in another document.

NOTE - A note provides additional information that you should consider.

TIP - A tip provides information that can help you perform a task more quickly or easily.

⇒ An arrow indicates a one-step procedure.

Fonts Arial bold (blue) is used to refer to menu names and commands, to buttons and other items in a dialog box. Arial Italics (blue) is used to refer to other chapters in the manual, book titles, and titles of other manuals. Arial Italics (black) is used for file and folder names, for figure and table captions, and for directory tree names. Courier New is used for messages on your computer screen. 10

Courier New bold is used for information that you must type.

SMALL CAPS (BLACK) is used for a key or key combination on your keyboard. Arial underlined (blue) is used for user interface links. Arial italics is used for window and dialog box names.

PDF Document This manual is provided in PDF (Portable Document Format). The PDF document can be used for online viewing and printing using Adobe® Acrobat® Reader. When printing the manual, please print the entire manual, including the copyright and disclaimer statements.

For More Information Visit F-Secure at http://www.f-secure.com for documentation, training courses, downloads, and service and support contacts. In our constant attempts to improve our documentation, we would welcome your feedback. If you have any questions, comments, or suggestions about this or any other F-Secure document, please contact us at [email protected]. 1 INTRODUCTION

Overview...... 12 How F-Secure Anti-Virus for Microsoft Exchange Works ...... 13 Key Features ...... 15 F-Secure Anti-Virus Mail Server and Gateway Products...... 17

11 12

1.1 Overview

Malicious code, such as computer viruses, is one of the main threats for companies today. In the past, malicious code spread mainly via disks and the most common viruses were the ones that infected disk boot sectors. When users began to use office applications with macro capabilities - such as Microsoft Office - to write documents and distribute them via mail and groupware servers, macro viruses started spreading rapidly. After the millennium, the most common spreading mechanism has been the e-mail. Today about 90% of viruses arrive via e-mail. E-mails provide a very fast and efficient way for viruses to spread themselves without any user intervention and that is why e-mail worm outbreaks, like Sober, Netsky and Bagle, have caused a lot of damage around the world. F-Secure Anti-Virus Mail Server and Gateway products are designed to protect your company's mail and groupware servers and to shield the company network from any malicious code that travels in HTTP or SMTP traffic. In addition, they protect your company network against spam. The protection can be implemented on the gateway level to screen all incoming and outgoing e-mail (SMTP), web surfing (HTTP and FTP-over-HTTP) and file transfer (FTP) traffic. Furthermore, it can be implemented on the mail server level so that it does not only protect inbound and outbound traffic but also internal mail traffic and public sources, such as Public Folders on Microsoft Exchange servers. Providing the protection already on the gateway level has plenty of advantages. The protection is easy and fast to set up and install, compared to rolling out antivirus protection on hundreds or thousands of workstations. The protection is also invisible to the end users which ensures that the system cannot be by-passed and makes it easy to maintain. Of course, protecting the gateway level alone is not enough to provide a complete antivirus solution; file server and workstation level protection is needed, also. Why clean 1000 workstations when you can clean one attachment at the gateway level? CHAPTER 1 13 Introduction

1.2 How F-Secure Anti-Virus for Microsoft Exchange Works

F-Secure Anti-Virus for Microsoft Exchange is designed to detect and disinfect viruses and other malicious code from e-mail transmissions through Microsoft Exchange 2000/2003 Server. Scanning is done in real time as the mail passes through Microsoft Exchange Server. On-demand scanning of user mailboxes and Public Folders is also available.

Scanning F-Secure Anti-Virus for Microsoft Exchange scans attachments and Attachments and message bodies for malicious code. It can also be instructed to remove Message Bodies particular attachments according to the file name or the file extension. In addition, it can filter out messages containing keywords that have been defined as disallowed. If the intercepted mail contains malicious code, F-Secure Anti-Virus for Microsoft Exchange can be configured to disinfect or drop the content. Any malicious code found during the scan process can be placed in the Quarantine, where it can be further examined. Stripped attachments can also be placed in the Quarantine for further examination.

Flexible and Scalable F-Secure Anti-Virus for Microsoft Exchange is installed on Microsoft Anti-Virus Protection Exchange 2000/2003 Server and it intercepts mail traveling through mailboxes and Public folders. Intercepted attachments and documents are sent to F-Secure Content Scanner Server, which returns disinfected files back to F-Secure Anti-Virus for Microsoft Exchange. The two-component product architecture ensures that the anti-virus protection does not increase the load on the protected system and that the infected data is never stored on the production network. It also enables you to implement a server pool, so you can share the traffic load between multiple F-Secure Content Scanner Servers and have backup servers if the traffic to primary servers stops for some reason. 14

Alerting F-Secure Anti-Virus for Microsoft Exchange has extensive alerting functions, which means that the system administrator can specify a recipient inside the company network to be notified about the infection found in the data content. Of course, the network administrator can be notified about the infection also.

Powerful and Always F-Secure Anti-Virus for Microsoft Exchange uses the award-winning Up-to-date F-Secure Anti-Virus scanner to ensure the highest possible detection rate and disinfection capability. The daily F-Secure Anti-Virus signature database updates provide F-Secure Anti-Virus for Microsoft Exchange an always up-to-date protection capability. F-Secure Anti-Virus scanner consistently ranks at the top when compared to competing products. Our team of dedicated virus researchers is on call 24-hours a day responding to new and emerging threats. In fact, F-Secure is one of the only companies to release tested virus definition updates on a daily basis, to make sure our customers are receiving the highest quality service and protection.

Virus and Spam Massive spam and virus outbreaks consist of millions of messages which Outbreak Detection share at least one identifiable pattern that can be used to distinguish the outbreak. Any message that contains one or more of these patterns can be assumed to be a part of the same spam or virus outbreak. F-Secure Anti-Virus for Microsoft Exchange can identify these patterns from the message envelope, headers and body, in any language, message format and encoding type. It can detect spam messages and new viruses during the first minutes of the outbreak.

Easy to Administer F-Secure Anti-Virus for Microsoft Exchange can be managed with the web-based user interface. With Web Console, you can configure F-Secure Anti-Virus for Microsoft Exchange settings, set up scheduled scans or run manual processes any time you want. CHAPTER 1 15 Introduction

Figure 1-1 (1) E-mail arrives from the Internet to F-Secure Anti-Virus for Microsoft Exchange, which (2) filters malicious content from mails and attachments, and (3) delivers cleaned files forward.

1.3 Key Features

F-Secure Anti-Virus for Microsoft Exchange provides the following features and capabilities.

Superior Protection Superior detection rate with multiple scanning engines. Automatic malicious code detection and disinfection. Heuristic scanning detects also unknown Windows and macro viruses. Recursive scanning of ARJ, BZ2, CAB, GZ, JAR, LZH, MSI, RAR, TAR, TGZ, Z and ZIP archive files. Automatic daily virus definition database updates. Suspicious and unsafe attachments can be stripped away from e-mails. 16

Password protected archives can be treated as unsafe. Intelligent file type recognition. Message filtering based on keywords in message subjects and text. Utilizes the low-level Anti-Virus API (AV API 2.0) for Microsoft Exchange 2000 Server, and AV AP 2.5 for Microsoft Exchange 2003 Server.

Virus Outbreak The virus outbreak detection is an additional active layer of Detection protection that automatically detects virus outbreaks and quarantines suspicious messages. Virus outbreaks are transparently detected and infected messages are quarantined before the outbreak becomes widespread. The product can notify the administrator about virus outbreaks. Quarantined unsafe messages can be reprocessed automatically.

Transparency and Viruses are intercepted before they can enter the network and Scalability spread out on workstations and servers. Real-time scanning of internal, inbound and outbound mail messages and Public Folder notes. Automatic protection of new mailboxes and Public Folders. Total transparency to end-users. Users cannot bypass the system, which means that messages and documents cannot be exchanged without scanning.

Management Controlling and monitoring the behavior of the products remotely. Starting predefined operations remotely. Monitoring statistics provided by the products remotely with F-Secure Anti-Virus for Microsoft Exchange Web Console. You can manage and search quarantined content with the F-Secure Anti-Virus for Microsoft Exchange Web Console. CHAPTER 1 17 Introduction

Protection against Possible spam messages are transparently detected before they Spam become widespread. Efficient spam detection based on different analyses on the e-mail content. Multiple filtering mechanisms guarantee the high accuracy of spam detection. Spam detection works in every language and message format.

1.4 F-Secure Anti-Virus Mail Server and Gateway Products

The F-Secure Anti-Virus product line consists of workstation, file server, mail server, gateway and mobile products.

F-Secure Internet Gatekeeper is a high performance, totally automated web (HTTP and FTP-over-HTTP) and e-mail (SMTP) virus scanning solution for the gateway level. F-Secure Internet Gatekeeper works independently of firewall and e-mail server solutions, and does not affect their performance. F-Secure Anti-Virus for Microsoft Exchange™ protects your Microsoft Exchange users from malicious code contained within files they receive in mail messages and documents they open from shared databases. Malicious code is also stopped in outbound messages and in notes being posted on Public Folders. The product operates transparently and scans files in the Exchange Server Information Store in real-time. Manual and scheduled scanning of user mailboxes and Public Folders is also supported. F-Secure Anti-Virus for MIMEsweeper™ provides a powerful anti-virus scanning solution that tightly integrates with Clearswift MIMEsweeper for SMTP and MIMEsweeper for Web products. F-Secure provides top-class anti-virus software with fast and 18

simple integration to Clearswift MAILsweeper and WEBsweeper, giving the corporation the powerful combination of complete content security. F-Secure Internet Gatekeeper for Linux™ provides a high-performance solution at the Internet gateway level, stopping viruses and other malicious code before the spread to end users desktops or corporate servers. The product scans SMTP, HTTP, FTP and POP3 traffic for viruses, worms and trojans, and blocks and filters out specified file types. ActiveX and Java code can also be scanned or blocked. The product receives updates automatically from F-Secure, keeping the virus protection always up to date. A powerful and easy-to-use management console simplifies the installation and configuration of the product. F-Secure Messaging Security Gateway™ delivers the industry’s most complete and effective security for e-mail. It combines a robust enterprise-class messaging platform with perimeter security, antispam, antivirus, secure messaging and outbound content security capabilities in an easy-to-deploy, hardened appliance. 2 REQUIREMENTS Which SQL Server to Use for the Quarantine Database?...... 20 Network Requirements...... 21 Web Browser Software Requirements ...... 22 Improving Reliability and Performance...... 23 Configuring the Product After the Installation...... 24

19 20

2.1 Which SQL Server to Use for the Quarantine Database?

As a minimum requirement, the Quarantine database should have the capacity to store information about all inbound and outbound mail to and from your organization that would normally be sent during 2-3 days. Take into account the following SQL server specific considerations when deciding which SQL server to use:

Microsoft SQL Server When using Microsoft SQL Server Desktop Engine (MSDE), the Desktop Engine and Quarantine database size is limited to 2 GB. SQL Server 2005 MSDE includes a concurrent workload governor that limits the Express Edition scalability of MSDE. For more information, see http://msdn.microsoft.com/library/?url=/library/en-us/architec/ 8_ar_sa2_0ciq.asp?frame=true. It is not recommended to use MSDE or SQL Server 2005 Express Edition if you are planning to use centralized quarantine management with multiple F-Secure Anti-Virus for Microsoft Exchange installations.

MSDE is delivered together with F-Secure Anti-Virus for Microsoft Exchange, and you can install it during the F-Secure Internet Anti-Virus for Microsoft Exchange Setup. For more information, see “Installation Overview”, 28. CHAPTER 2 21 Requirements

Microsoft SQL If your organization sends a large amount of e-mails, it is Server 2000/2005 recommended to use Microsoft SQL Server 2000/2005. It is recommended to use Microsoft SQL Server 2000/2005 if you are planning to use centralized quarantine management with multiple F-Secure Anti-Virus for Microsoft Exchange installations. For more information, see “Performance-Critical Installation”, 24. Note that the product does not support Windows Authentication when connecting to Microsoft SQL Server 2000/2005. The Microsoft SQL Server 2000/2005 that the product will use for the Quarantine database should be configured to use Mixed Mode authentication.

If you plan to use Microsoft SQL Server 2005, you must purchase it and obtain your own license before you start to deploy F-Secure Anti-Virus for Microsoft Exchange. To purchase Microsoft SQL Server 2005, contact your Microsoft reseller.

2.2 Network Requirements

This network configuration is valid for all scenarios described in this chapter. Make sure that the following network traffic can travel:

Service Process Inbound ports Outbound ports

F-Secure Content Scanner %ProgramFiles%\F-Secure\ 18971 (TCP) + DNS (53, UDP/TCP), Server Content Scanner Server\ 1024-65536 (TCP), only HTTP (80) or other known fsavsd.exe with F-Secure Anti-Virus port used for HTTP proxy for Internet Mail on a separate host

F-Secure Anti-Virus for %ProgramFiles%\F-Secure\ 25023 DNS (53, UDP and TCP), Microsoft Exchange Web Web User Interface\ 1433 (TCP), only with the Console bin\fswebuid.exe dedicated SQL server

F-Secure Automatic F-Secure Automatic Update.exe 371 (UDP), only if DNS (53, UDP and TCP), Update Agent BackWeb Polite Protocol HTTP (80) is used 22

Service Process Inbound ports Outbound ports

FSNRB %ProgramFiles%\F-Secure\ - DNS (53, UDP/TCP), Common\fnrb32.exe HTTP (80)

FSMA (AMEH) %ProgramFiles%\F-Secure\ - DNS (53, UDP/TCP), Common\fameh32.exe SMTP (25)

F-Secure Quarantine %ProgramFiles%\F-Secure\ - DNS (53, UDP/TCP), Manager Quarantine Manager\fqm.exe 1433 (TCP), only with the dedicated SQL server

2.3 Web Browser Software Requirements

In order to administer the product with F-Secure Anti-Virus for Microsoft Exchange Web Console, one of the following web browsers is required:

Microsoft Internet Explorer 6.0 or later Netscape Communicator 8.1 or later Mozilla Firefox 1.5 or later Opera 9.00 or later Konqueror 3.5 or later Any other web browser supporting HTTP 1.0, SSL, Java scripts and cookies may be used as well. Microsoft Internet Explorer 5.5 or earlier cannot be used to administer the product. CHAPTER 2 23 Requirements

2.4 Improving Reliability and Performance

You can improve the system reliability and overall performance by upgrading the following components.

Processor If the system load is high, a fast processor on the Microsoft Exchange Server speeds up the e-mail message processing. As Microsoft Exchange Server handles a large amount of data, a fast processor alone is not enough to guarantee a fast operation of F-Secure Anti-Virus for Microsoft Exchange.

Memory Memory consumption is directly proportional to the size of processed mails - scanning a single mail may use memory in amounts up to three times the size of the mail concerned. If the average size of mail messages is big, or Microsoft Exchange Server has to process large messages regularly, increasing the amount of physical memory increases the overall performance. If large messages are processed only now and then, it might be enough to increase the size of the virtual memory. In this case, large messages will slow the system down.

Hard Drive Hard drive size is an important reliability factor. Hard drive performance is crucial for Microsoft Exchange Server to perform well. For best performance, a RAID system is recommended; for servers with only moderate load, SCSI hard disks are adequate. If your server has an IDE hard disk, DMA access support is recommended.

Operating System It is highly recommended to have the latest service packs for the operating system being used. These fixes make the platform more stable and thus increase the reliability of the system. 24

2.5 Configuring the Product After the Installation

After the installation, F-Secure Anti-Virus for Microsoft Exchange is functional, but it is using mostly default values. It is highly recommended to go through all the settings of all installed components. You should also retrieve the latest virus definition database updates.

Configure F-Secure Anti-Virus for Microsoft Exchange. Use the F-Secure Anti-Virus for Microsoft Exchange Web Console to configure the settings of F-Secure Anti-Virus for Microsoft Exchange. For more information, see “Administration with Web Console”, 70.

Specify the domains which should be considered to be internal domains. For more information, see “Internal Domains”, 159. Retrieve virus definition database updates. For more information, see “Updating Virus and Spam Definition Databases”, 189. USING F-SECURE 3 ANTI-VIRUS FOR MICROSOFT EXCHANGE

Overview...... 65 Administering F-Secure Anti-Virus for Microsoft Exchange...... 26 Using the Web Console...... 66 Checking the Product Status...... 29 Configuring the Web Console...... 32 Using F-Secure Policy Manager Console...... 73 Modifying Settings and Viewing Statistics ...... 33 Manually Processing Mailboxes and Public Folders ...... 34 Configuring Alert Forwarding...... 67 Viewing Alerts...... 69

25 26

3.1 Administering F-Secure Anti-Virus for Microsoft Exchange

You can use the F-Secure Anti-Virus for Microsoft Exchange Web Console to start and stop F-Secure Anti-Virus for Microsoft Exchange, modify its settings, edit scheduled tasks and start manual processing. To open the F-Secure Anti-Virus for Microsoft Exchange Web Console, start it from F-Secure Settings and Statistics or select F-Secure Anti-Virus for Microsoft Exchange from the Windows Start menu > Programs > F-Secure Anti-Virus for Microsoft Exchange > F-Secure Anti-Virus for Microsoft Exchange Web Console. You can open F-Secure Settings and Statistics by double-clicking the F-Secure icon in the Windows system tray.

3.1.1 Logging in for the First Time

F-Secure Anti-Virus for Microsoft Exchange Web Console does not support Microsoft Internet Explorer 5.5 or older.

Microsoft Internet Explorer 6.0 users: The address of the F-Secure Anti-Virus for Microsoft Exchange Web Console, https://127.0.0.1:25023/, should be added to the Trusted sites in Internet Explorer 6.0 Security Options. This ensures that the F-Secure Anti-Virus for Microsoft Exchange Web Console works properly in all environments. Before you log in the F-Secure Anti-Virus for Microsoft Exchange Web Console for the first time, check that Java script and cookies are enabled in the browser you use. CHAPTER 3 27 Using F-Secure Anti-Virus for Microsoft Exchange

When you log in for the first time, your browser will display a Security Alert dialog window about the security certificate for F-Secure Anti-Virus for Microsoft Exchange Web Console. You can create a security certificate for F-Secure Anti-Virus for Microsoft Exchange Web Console before logging in, and then install the certificate during the login process.

If your company has an established process for creating and storing certificates, you can follow that process to create and store the security certificate for F-Secure Anti-Virus for Microsoft Exchange Web Console.

Step 1. Create the security certificate 1. Browse to the F-Secure Anti-Virus for Microsoft Exchange Web Console installation directory, for example: C:\Program Files\F-Secure\Web User Interface\bin\ 2. Locate the certificate creation utility, makecert.bat, and double click it to run the utility. 3. The utility creates a certificate that will be issued to all local IP addresses, and restarts the F-Secure Anti-Virus for Microsoft Exchange Web Console service to take the certificate into use. Wait until the utility completes, and the window closes. Now you can proceed to logging in. Step 2. Log in and install the security certificate 1. Select Programs>F-Secure Anti-Virus for Microsoft Exchange>F-Secure Anti-Virus for Microsoft Exchange Web Console, or enter the address of the F-Secure Anti-Virus for Microsoft Exchange and the port number in your web browser. Note, that the protocol used is https. For example: https://127.0.0.1:25023 28

2. The Security Alert about the F-Secure Anti-Virus for Microsoft Exchange Web Console certificate is displayed. If you install the certificate now, you will not see the Security Alert window again. Click View Certificate to view the certificate information and to install the certificate. 3. The Certificate window opens. Click Install Certificate to proceed to the Certificate Import Wizard. 4. Follow the instructions in the Certificate Import Wizard. When the wizard has completed, you are prompted to add the new certificate in the Certificate Root Store. Click Yes. 5. If the Security Alert window is still displayed, click Yes to proceed. 6. When the login page opens, enter the user name and the password. Note, that you must have administrator rights to the host. Then click Log In.

Figure 3-1 F-Secure Anti-Virus for Microsoft Exchange Web Console Login page 7. You will be forwarded to the home page, which displays a summary of the system status. CHAPTER 3 29 Using F-Secure Anti-Virus for Microsoft Exchange

Figure 3-2 F-Secure Anti-Virus for Microsoft Exchange Home page

3.2 Checking the Product Status

You can check the overall product status on the Home page. The Home page displays an overview of each component status and most important statistics of the installed F-Secure Anti-Virus for Microsoft Exchange components. From the Home page you can also open the product logs and proceed to configure the product components. This section describes the statistics and operations available on the Home page. 30

F-Secure Anti-Virus for Microsoft Exchange The Home page displays the status the F-Secure Anti-Virus for Microsoft Exchange as well as a summary of the F-Secure Anti-Virus for Microsoft Exchange statistics.

Status indicator Displays the status of F-Secure Anti-Virus for Microsoft Exchange.

Processed messages Displays the total number of messages that have been processed.

Infected messages Displays the number of infected messages found since the last reset of statistics.

Stripped attachments Displays the number of attachments that have been stripped.

Click Configure to configure F-Secure Anti-Virus for Microsoft Exchange. For more information, see “Overview”, 71. F-Secure Content Scanner Server The Home page displays the status the F-Secure Content Scanner Server as well as a summary of the F-Secure Content Scanner Server statistics.

Status indicator Displays the status of F-Secure Content Scanner Server.

Last time virus definition Displays the last date and time when the databases updated virus definition databases were updated.

Database update version Displays the version of the virus definition database update. CHAPTER 3 31 Using F-Secure Anti-Virus for Microsoft Exchange

The version is shown in YYYY-MM-DD_NN format, where YYYY-MM-DD is the release date of the update and NN is the number of the update for that day.

Scanned files Displays the number of files the server has scanned for viruses.

Last time infection found Displays the last infection detected by the server.

Click Configure to configure F-Secure Content Scanner Server. For more information, see “F-Secure Content Scanner Server Settings”, 129. F-Secure Automatic Update Agent

Status indicator Displays the status of F-Secure Automatic Update Agent.

Communication method Displays the currently used client protocol.

Last connection to the Displays the last date and time when server F-Secure Automatic Update Agent polled the F-Secure Automatic Update Server for new updates.

Click Configure to configure F-Secure Automatic Update Agent. For more information, see “Updating Virus and Spam Definition Databases”, 189. F-Secure Management Agent

Status indicator Displays the status of F-Secure Management Agent.

Management method Displays if the host is standalone (configured locally) or networked (at least sometimes connected through a network or a temporary link). 32

Click Configure to configure the F-Secure Management Agent. For more information, see “F-Secure Management Agent Settings”, 157. Toolbar Buttons Click Show F-Secure Log to view the F-Secure log file (LogFile.log) in a new Internet browser window. Click Download to download and save the LogFile.log for later use. Click Export Settings to open a list of all F-Secure Anti-Virus for Microsoft Exchange settings in a new Internet browser window. Select File > Save As... to save the file for later use. Click Export Statistics to open a list of all F-Secure Anti-Virus for Microsoft Exchange statistics in a new Internet browser window. Select File > Save As... to save or print the file for later use. Click Configure Console to configure the F-Secure Anti-Virus for Microsoft Exchange Web Console. For instructions, see “Configuring the Web Console”, 32. Click Help to open the online help.

3.3 Configuring the Web Console

On the F-Secure Anti-Virus for Microsoft Exchange Web Console Configuration page you can specify settings for connections to the server. You can also open the F-Secure Anti-Virus for Microsoft Exchange Web Console access log from this page.

Limit session timeout Specify the length of time a client can be connected to the server. When the session expires, the F-Secure Anti-Virus for Microsoft Exchange Web Console displays a warning. The default value is 60 minutes. CHAPTER 3 33 Using F-Secure Anti-Virus for Microsoft Exchange

Click Show Access Log to view the F-Secure Anti-Virus for Microsoft Exchange Web Console access log. Note that the Web Console access log differs from standard web server access logs, as it logs only the first request per session.

Listen on address Specify the IP address of the F-Secure Anti-Virus for Microsoft Exchange Web Console Server.

Port Specify the port where the server listens for connections. The default port is 25023.

Accept connections from Specify a list of hosts which are allowed to the following hosts connect to F-Secure Anti-Virus for Microsoft Exchange Web Console.

To add a new host in the list, click Add to add new a new line in the table and then enter the IP address of the host.

3.4 Modifying Settings and Viewing Statistics

To change F-Secure Anti-Virus for Microsoft Exchange settings in stand-alone mode, open the F-Secure Anti-Virus for Microsoft Exchange Web Console and select the variables you want to change from the options tree. For detailed explanations of all variables, see “Administration with Web Console”, 70. To view statistics for real-time scanning, select Summary on the options tree. To reset all counters to zero, click Reset Statistics. To view statistics for the latest manual scan, select Manual Scanning on the options tree. The Manual Scanning property page displays the following statistics: the number of processed mailboxes, the number of processed Public Folders, the numbers of processed, infected, and suspicious messages in mailboxes and in the Public Folders. Manual scanning statistics are reset every time a new manual scan is performed. 34

3.5 Manually Processing Mailboxes and Public Folders

You can scan mailboxes and Public Folders for viruses and strip attachments manually at any time. You can also create scheduled scan tasks to scan mailboxes and Public Folders periodically.

3.5.1 Stand-alone Mode Specify the manual scanning settings on the Manual Scanning property pages. After you have specified the manual scanning settings, select the Manual Processing and click Start. Under Progress, you can view the progress of the manual scan - the total numbers of mailboxes and Public Folders, and the numbers of processed mailboxes and Public Folders. In the bottom of the property page, the results of the previous manual scan are shown - the numbers of processed, infected and suspicious messages in the mailboxes and in the Public Folders.

3.5.2 Creating Scanning Operations To process mailboxes manually, you need to set up a manual processing task. For more information, see “Creating Manual Scanning Operation”, 34. If you want to run scanning tasks frequently, you can set up scheduled operations. For more information, see “Creating Scheduled Operation”, 50.

Creating Manual Scanning Operation Start the Manual Scanning Wizard by clicking the Configure... button on the Manual Scanning page. CHAPTER 3 35 Using F-Secure Anti-Virus for Microsoft Exchange

Step 1. Specify Messages to Process

1. Specify whether you want to process all messages or only those messages that have not been processed previously. 2. Specify how many concurrent transactions the scanner can have with F-Secure Content Scanner Server. 3. Click Next to continue.

If F-Secure Anti-Virus for Microsoft Exchange is operating on a system that has multiple processors or you are using a high-performance computer, you can increase performance by increasing the number of concurrent transactions.

If you want to use the default settings for most of the scanning settings, click Last to proceed to the last page of the Manual Scanning wizard where you can see a summary of the scanning task settings. 36

Step 2. Select Mailboxes to Process

1. Choose mailboxes that should be processed during the manual scanning operation. Do not process mailboxes - Do not process any mailboxes. Process all mailboxes - Process all mailboxes. Process only these mailboxes - Process all specified mailboxes. Process all except these mailboxes - Process all except specified mailboxes. Click Add... to add a new mailbox to the list. Click the checkbox in the column to mark a mailbox to be removed. Click Clear to remove all currently marked entries from the list. By default, F-Secure Anti-Virus for Microsoft Exchange examines all mailboxes. 2. Click Next to continue. CHAPTER 3 37 Using F-Secure Anti-Virus for Microsoft Exchange

Step 3. Specify Virus Scanning Settings for Mailboxes

1. Choose settings for virus scanning of mailboxes.

Attachments to scan Specify which message attachments are checked for viruses.

Do not scan attachments for viruses - Process messages without scanning any attachments for viruses.

Scan all attachments - Scan all message attachments regardless of filename extension.

Scan all attachments with these extensions - Scan all attachments with specified filename extensions.

Scan all attachments except with these extensions - Scan all attachments except those with specified filename extensions. 38

You can add new file types on the extensions lists by typing the file extensions in the file extensions text boxes. Separate the extensions by spaces.

Scan mail message Specify whether the body of the e-mail message body should be scanned for malicious code.

By default, F-Secure Anti-Virus for Microsoft Exchange scans message bodies.

Although scanning message bodies can slow down the performance, it is recommended as a virus can be carried inside a message body. Enable File Type Trojans and other malicious code can disguise Recognition themselves with filename extensions which are usually considered safe to use. Intelligent File Type Recognition can recognize the real file type of the message attachment and use that while the attachment is processed. Specify whether you want to use Intelligent File Type Recognition or not.

By default, Intelligent File Type Recognition is disabled during the real-time processing.

Disinfect attachment - Try to disinfect the infected attachment. If the disinfection succeeds, the recipient receives the disinfected file instead of the original one. If the disinfection fails, the infected attachment is dropped, and it is not delivered to the recipient.

Drop attachment - Do not disinfect or deliver infected attachments. All infected attachments are dropped.

By default, F-Secure Anti-Virus for Microsoft Exchange tries to disinfect infected attachments.

Quarantine infected Specify whether infected attachments should be attachments placed in the Quarantine or not. For more information, see “Quarantine Management”, 160.

Send warning Specify whether to send a message to the message to mailbox mailbox owner when an infected attachment is owner found. Click Edit... to edit the informational text file that replaces the infected attachment if it is dropped.

2. Click Next to continue. 40

Step 4. Specify Attachment Stripping Settings for Mailboxes

1. Choose settings for stripping attachments.

Strip attachments Specify which attachments should be stripped from messages and public folder notes.

Do not strip - Do not strip any attachments.

Strip all attachments - Strip all attachments from all messages and notes.

Strip all attachments except these allowed - Strip all except specified attachments.

Strip only these disallowed attachments - Strip only specified attachments.

You can add new file types on the attachments lists by typing the file extensions in the allowed and disallowed attachments text boxes. Separate the extensions by spaces. CHAPTER 3 41 Using F-Secure Anti-Virus for Microsoft Exchange

Enable File Type Trojans and other malicious code can disguise Recognition themselves with filename extensions which are usually considered safe to use. Intelligent File Type Recognition can recognize the real file type of the message attachment and use that while the attachment is processed. Specify whether you want to use Intelligent File Type Recognition or not. Action Action on stripped Specify whether stripped attachments should be attachment quarantined or dropped.

Quarantine attachment - All stripped attachments are placed in the Quarantine. For more information, see “Quarantine Management”, 160.

Drop attachment - All stripped attachments are deleted automatically.

By default, F-Secure Anti-Virus for Microsoft Exchange quarantines stripped attachments.

Send informational Specify whether an informational message message to the should be sent to the owner of the mailbox when mailbox owner an attachment is stripped. Click Edit to edit the message. 42

Notify administrator Specify whether the administrator should be notified when F-Secure Anti-Virus for Microsoft Exchange strips an attachment.

Do not notify - Do not send any notification to the administrator.

Send informational alert - Send an informational alert to the administrator.

Send warning alert - Send a warning alert to the administrator.

Send security alert - Send a security alert to the administrator.

2. Click Next to continue. Step 5. Select Public Folders to Process CHAPTER 3 43 Using F-Secure Anti-Virus for Microsoft Exchange

1. Select Public Folders that should be processed. Do not process public folders - Do not process any Public Folders. Process all public folders - Process all notes posted to all Public Folders. Process only included public folders - Process all notes posted to the listed Public Folders. Process all except excluded public folders - Process all notes posted to all Public Folders, except the listed ones.

The notes and attachments to be processed in the selected folders are defined with the Attachments to Scan and Scan Mail Message Body settings. Click Add to add a new Public Folder to the list. Click Clear to remove the selected folder or Clear All to remove all entries from the list. By default, F-Secure Anti-Virus for Microsoft Exchange processes all Public Folders. 2. Click Next to continue. 44

Step 6. Specify Virus Scanning Settings for Public Folders

1. Choose settings for virus scanning of Public Folders.

Attachments to scan Specify which message attachments are checked for viruses.

Do not scan attachments for viruses - Do not scan any attachments.

Scan all attachments - Scan all message attachments.

Scan all attachments with these extensions - Scan all attachments with specified filename extensions.

Scan all attachments except with these extensions - Scan all attachments except those with specified filename extensions. CHAPTER 3 45 Using F-Secure Anti-Virus for Microsoft Exchange

You can add new file types on the extensions lists by typing the file extensions in the file extensions text boxes. Separate the extensions by spaces.

Scan mail message Specify whether the body of the e-mail message body should be scanned for malicious code.

By default, F-Secure Anti-Virus for Microsoft Exchange scans message bodies.

By default, Intelligent File Type Recognition is disabled during the real-time processing.

Drop attachment - Do not disinfect or deliver infected attachments. All infected attachments are dropped.

By default, F-Secure Anti-Virus for Microsoft Exchange tries to disinfect infected attachments.

Quarantine infected Specify whether infected attachments should be attachments placed in the Quarantine or not. For more information, see “Quarantine Management”, 160.

Send warning Specify whether to send a warning message to message to the the originator of the public folder message, originator which contained an infected attachment. Click Edit to edit the message.

2. Click Next to continue. CHAPTER 3 47 Using F-Secure Anti-Virus for Microsoft Exchange

Step 7. Specify Attachment Stripping Settings for Public Folders

1. Choose settings for stripping attachments.

Strip attachments Specify which attachments should be stripped from messages and public folder notes.

Do not strip - Do not strip any attachments.

Strip all attachments - Strip all attachments from all messages and notes.

Strip all attachments except these allowed - Strip all except specified attachments.

Strip only these disallowed attachments - Strip only specified attachments. 48

You can add new file types on the attachments lists by typing the file extensions in the allowed and disallowed attachments text boxes. Separate the extensions by spaces.

Quarantine attachment - All stripped attachments are placed in the Quarantine. For more information, see “Quarantine Management”, 160.

Drop attachment - All stripped attachments are deleted automatically.

By default, F-Secure Anti-Virus for Microsoft Exchange quarantines stripped attachments.

Send the Specify whether an informational message informational should be sent to the originator of the message message to the when an attachment is stripped. Click Edit to originator edit the message. CHAPTER 3 49 Using F-Secure Anti-Virus for Microsoft Exchange

Notify administrator Specify whether the administrator should be notified when F-Secure Anti-Virus for Microsoft Exchange strips an attachment.

Do not notify - Do not send any notification to the administrator.

Send informational alert - Send an informational alert to the administrator.

Send warning alert - Send a warning alert to the administrator.

Send security alert - Send a security alert to the administrator.

2. Click Next to continue. 50

Step 8. Finish

The Manual Scanning Wizard displays the summary of created operation. Click Finish accept the new manual scanning operation and to exit the wizard.

Creating Scheduled Operation Start the Scheduled Operation Wizard by clicking Add Task...in the Scheduled Processing window. CHAPTER 3 51 Using F-Secure Anti-Virus for Microsoft Exchange

Step 1. Specify Scanning Task Name and Schedule

1. Enter the name for the new task and select how frequently you want the operation to be performed. Once - Only once at the specified time Daily - Every day at the specified time, starting from the specified date Weekly - Every week at the specified time on the same day when the first operation is scheduled to start. Monthly - Every month at the specified time on the same date when the first operation is scheduled to start. 2. Enter the start time of the task in hh:mm format. 3. Enter the start date of the task in mm/dd/yyyy format.

Do not use any special characters in the task name.

4. Click Next to continue. 52

Step 2. Specify Messages to Process

1. Specify whether you want to process all messages or only those messages that have not been processed previously during the scheduled processing. 2. Specify how many concurrent transactions the scanner can have with F-Secure Content Scanner Server. 3. Click Next to continue. CHAPTER 3 53 Using F-Secure Anti-Virus for Microsoft Exchange

Step 3. Select Mailboxes to Process

1. Choose mailboxes that should be processed during the scheduled operation. Do not process mailboxes - Do not process any mailboxes. Process all mailboxes - Process all mailboxes. Process only these mailboxes - Process all specified mailboxes. Process all except these mailboxes - Process all except specified mailboxes. Click Add... to add a new mailbox to the list. Click the checkbox in the column to mark a mailbox to be removed. Click Clear to remove all currently marked entries from the list. By default, F-Secure Anti-Virus for Microsoft Exchange examines all mailboxes. 2. Click Next to continue. 54

Step 4. Specify Virus Scanning Settings for Mailboxes

1. Choose settings for virus scanning of mailboxes during the scheduled operation.

Attachments to scan Specify which message attachments are checked for viruses.

Do not scan attachments for viruses - Process messages without scanning any attachments for viruses.

Scan all attachments - Scan all message attachments regardless of filename extension.

Scan all attachments with these extensions - Scan all attachments with specified filename extensions. CHAPTER 3 55 Using F-Secure Anti-Virus for Microsoft Exchange

Scan all attachments except with these extensions - Scan all attachments except those with specified filename extensions.

You can add new file types on the extensions lists by typing the file extensions in the file extensions text boxes. Separate the extensions by spaces.

Scan mail message Specify whether the body of the e-mail message body should be scanned for malicious code.

By default, F-Secure Anti-Virus for Microsoft Exchange scans message bodies.

By default, Intelligent File Type Recognition is disabled during the real-time processing.

Action Action on infected Specify whether infected attachments should be attachments disinfected or dropped.

Drop attachment - Do not disinfect or deliver infected attachments. All infected attachments are dropped.

By default, F-Secure Anti-Virus for Microsoft Exchange tries to disinfect infected attachments.

Quarantine infected Specify whether infected attachments should be attachments placed in the Quarantine or not. For more information, see “Quarantine Management”, 160.

2. Click Next to continue. CHAPTER 3 57 Using F-Secure Anti-Virus for Microsoft Exchange

Step 5. Specify Attachment Stripping Settings for Mailboxes

1. Choose settings for stripping attachments during the scheduled operation.

Strip attachments Specify which attachments should be stripped from messages and public folder notes.

Do not strip - Do not strip any attachments.

Strip all attachments - Strip all attachments from all messages and notes.

Strip all attachments except these allowed - Strip all except specified attachments.

Strip only these disallowed attachments - Strip only specified attachments. 58

You can add new file types on the attachments lists by typing the file extensions in the allowed and disallowed attachments text boxes. Separate the extensions by spaces.

Quarantine attachment - All stripped attachments are placed in the Quarantine. For more information, see “Quarantine Management”, 160.

Drop attachment - All stripped attachments are deleted automatically.

By default, F-Secure Anti-Virus for Microsoft Exchange quarantines stripped attachments.

Send the Specify whether an informational message informational should be sent to the owner of the mailbox when message to the an attachment is stripped. Click Edit to edit the mailbox owner message. CHAPTER 3 59 Using F-Secure Anti-Virus for Microsoft Exchange

Notify administrator Specify whether the administrator should be notified when F-Secure Anti-Virus for Microsoft Exchange strips an attachment.

Do not notify - Do not send any notification to the administrator.

Send informational alert - Send an informational alert to the administrator.

Send warning alert - Send a warning alert to the administrator.

Send security alert - Send a security alert to the administrator.

2. Click Next to continue. Step 6. Select Public Folders to Process 60

1. Select Public Folders that should be processed during the scheduled operation. Do not process public folders - Do not process any Public Folders. Process all public folders - Process all notes posted to all Public Folders. Process only included public folders - Process all notes posted to the listed Public Folders. Process all except excluded public folders - Process all notes posted to all Public Folders, except the listed ones.

Step 7. Specify Virus Scanning Settings for Public Folders

1. Choose settings for virus scanning of Public Folders during the scheduled operation.

Attachments to scan Specify which message attachments are checked for viruses.

Do not scan attachments for viruses - Do not scan any attachments.

Scan all attachments - Scan all message attachments.

Scan all attachments with these extensions - Scan all attachments with specified filename extensions.

Scan all attachments except with these extensions - Scan all attachments except those with specified filename extensions. 62

You can add new file types on the extensions lists by typing the file extensions in the file extensions text boxes. Separate the extensions by spaces.

Scan mail message Specify whether the body of the e-mail message body should be scanned for malicious code.

By default, F-Secure Anti-Virus for Microsoft Exchange scans message bodies.

By default, Intelligent File Type Recognition is disabled during the real-time processing.

Drop attachment - Do not disinfect or deliver infected attachments. All infected attachments are dropped.

By default, F-Secure Anti-Virus for Microsoft Exchange tries to disinfect infected attachments.

Quarantine infected Specify whether infected attachments should be attachments placed in the Quarantine or not. For more information, see “Quarantine Management”, 160.

2. Click Next to continue. 64

Step 8. Specify Attachment Stripping Settings for Public Folders

1. Choose settings for stripping attachments during the scheduled operation.

Strip attachments Specify which attachments should be stripped from messages and public folder notes.

Do not strip - Do not strip any attachments.

Strip all attachments - Strip all attachments from all messages and notes.

Strip all attachments except these allowed - Strip all except specified attachments.

Strip only these disallowed attachments - Strip only specified attachments. CHAPTER 3 65 Using F-Secure Anti-Virus for Microsoft Exchange