AVG 9.0 EMAIL SERVER EDITION - REVISED 10-2009, 9.0 EMAIL SERVER User Manual

Page 1

Document rev ision 90.1 (9. 10. 2009)

This product uses RSA Data Security, Inc. MD5 Message-Digest Algorithm, Copyright (C) 1991-2, RSA Data Security, Inc. C reated 1991. This product uses code from C -SaC zech library, C opyright (c) 1996-2001 Jaromir Dolecek (dolecek@ics.muni.cz). This product uses compression library zlib, Copyright (c) 1995-2002 Jean-loup Gailly and Mark Adler.

AVG 9.0 Email Server Edition

User Manual

Page 2

Contents

........................................................................................................................ 4

1. Introduction

........................................................................................................................ 5

2. AVG Installation Requirements

.......................................................................................................... 5

2.1 Operation Systems Supported

.......................................................................................................... 5

2.2 Email Servers Supported

.......................................................................................................... 5

2.3 Hardware Requirements

.......................................................................................................... 6

2.4 Uninstall Previous Versions

.......................................................................................................... 6

2.5 MS Exchange Service Packs

........................................................................................................................ 8

3. AVG Installation Process

.......................................................................................................... 8

3.1 Installation Launch

.......................................................................................................... 9

3.2 License Agreement

.......................................................................................................... 9

3.3 Checking System Status

.......................................................................................................... 10

3.4 Select Installation Type

.......................................................................................................... 10

3.5 Activate AVG

.......................................................................................................... 11

3.6 Custom Installation - Destination Folder

.......................................................................................................... 12

3.7 Custom Installation - Component Selection

.......................................................................................................... 13

3.8 Custom Installation - DataCenter

.......................................................................................................... 14

3.9 Setup Summary

.......................................................................................................... 14

3.10 Installing

.......................................................................................................... 14

3.11 Installation Complete

........................................................................................................................ 16

4. E-mail Scanner for MS Exchange Server 2007

.......................................................................................................... 16

4.1 Overview

.......................................................................................................... 19

4.2 E-mail Scanner for MS Exchange (routing TA)

.......................................................................................................... 21

4.3 E-mail Scanner for MS Exchange (SMTP TA)

.......................................................................................................... 21

4.4 E-mail Scanner for MS Exchange (VSAPI)

.......................................................................................................... 24

4.5 Detection_Actions

.......................................................................................................... 26

4.6 Mail Filtering

........................................................................................................................ 27

5. E-mail Scanner for MS Exchange Server 2000/2003

.......................................................................................................... 27

5.1 Overview

.......................................................................................................... 29

5.2 VSAPI 2.0

.......................................................................................................... 30

5.3 E-mail Scanner for MS Exchange (VSAPI)

.......................................................................................................... 33

5.4 Detection_Actions

.......................................................................................................... 34

5.5 Mail Filtering

Page 3

........................................................................................................................ 36

6. AVG for Kerio MailServer

.......................................................................................................... 36

6.1 Configuration

.......................................................................................................... 36

6.1.1 Antivirus

.......................................................................................................... 36

6.1.2 Attachment Filter

........................................................................................................................ 42

7. Anti-Spam Configuration

.......................................................................................................... 42

7.1 Anti-Spam Interface

.......................................................................................................... 44

7.2 Anti-Spam Principles

.......................................................................................................... 44

7.3 Anti-Spam Settings

.......................................................................................................... 44

7.3.1 Anti-Spam Training Wizard

.......................................................................................................... 44

7.3.2 Select Folder with Messages

.......................................................................................................... 44

7.3.3 Message filtering options

.......................................................................................................... 50

7.4 Performance

.......................................................................................................... 51

7.5 RBL

.......................................................................................................... 52

7.6 Whitelist

.......................................................................................................... 53

7.7 Blacklist

.......................................................................................................... 54

7.8 Advanced Settings

........................................................................................................................ 55

8. AVG Settings Manager

........................................................................................................................ 58

9. FAQ and Technical Support

Page 4

1. Introduction

This user manual provides comprehensive documentation for AVG 9.0 Email Server Edition.

Congratulations on your purchase of AVG 9.0 Email Server Edition!

AVG 9.0 Email Server Edition is one of a range of award winning AVG products

designed to provide you with peace of mind and total sec urity for your PC. As with all AVG products AVG 9.0 Email Server Edition has been c ompletely re-designed, from the ground up, to deliver AVG’s renowned and accredited security protection in a new, more user friendly and efficient way.

AVG has been designed and developed to protect your computing and networking activity. Enjoy the experience of full protection from AVG.

Note: This documentation contains description of specific E-mail Server Edition features. Should you require information about other AVG features, please c onsult the user guide to Internet Security edition, which contains all the necessary details. You can download the guide from the http://www.avg.com.

Page 5

2. AVG Installation Requirements

2.1. Operation Systems Supported

AVG 9.0 Email Server Edition is intended to protec t e-mail servers running under the following operating systems:

· Windows 2008 Server Edition (x86 and x64)

· Windows 2003 Server (x86, x64 and Itanium) SP1

· Windows 2000 Server SP4 + Update Rollup 1

2.2. Email Servers Supported

The following e-mail servers are supported:

· MS Exchange 2000 Server (with Service Pack 1 or higher) version

Note: for Exchange 2000 Server - Service Pac k 1 (or higher) needs to be applied

before you can use the AVG engine; AVG for MS Exchange 2000/2003 Server uses the VSAPI 2.0 (or 2.5 with Exchange 2003 Server) application interfac e which is covered in this Service Pack.

· MS Exchange 2003 Server version

· MS Exchange 2007 Server version

· AVG for Kerio MailServer – version 5.x/6.x and higher

2.3. Hardware Requirements

Minimum hardware requirements for AVG 9.0 Email Server Edition are:

· Intel Pentium CPU 1.5 GHz

· 500 MB of free hard drive space (for installation purposes)

· 512 MB of RAM memory

Recommended hardware requirements for AVG 9.0 Email Server Edition are:

Page 6

· Intel Pentium CPU 1.8 GHz

· 600 MB of free hard drive space (for installation purposes)

· 512 MB of RAM memory

2.4. Uninstall Previous Versions

If you have an older version of AVG Email Server installed, you will need to uninstall it manually before installing AVG 9.0 Email Server Edition. You must manually perform the uninstallation of the previous version, using the standard windows functionality.

· From the start menu Start/Settings/Control Panel/Add or Remove

Programs select the correct program from the list of installed software. Be

careful to select the c orrect AVG program for uninstallation. You need to uninstall the Email Server Edition before uninstalling the AVG File Server Edition.

· Once you have uninstalled the Email Server Edition, you can proceed to uninstall

your previous version of AVG File Server Edition. This c an be done easily from the start menu Start/All Programs/AVG/Uninstall AVG

· If you have previously used the AVG 8.x or older version, do not forget to

uninstall also individual server plug-ins.

2.5. MS Exchange Service Packs

Since AVG for MS Exchange 2000/2003 Server uses the VSAPI 2.0/2.5 virus scanning interface, you must have the Service Pack 1 (or higher) for MS Exchange 2000 Server applied on your system. Follow the link below to get the latest Service Pack for MS Exchange 2000 Server:

Service Pack for MS Exchange 2000 Server:

http://www.microsoft.c om/technet/prodtechnol/exchange/downloads/2000/sp3/ default.mspx

For MS Exchange 2003 Server no additional service pack is needed; however, it is recommended to keep your system as up to date with the latest service packs and hotfixes as possible in order to obtain maximal available security.

Service Pack for MS Exchange 2003 Server (optional):

http://www.microsoft.c om/exchange/evaluation/sp2/overview.mspx

Page 7

At the beginning of the setup, all system libraries versions will be examined. If it is necessary to install newer libraries, the installer will rename the old ones with a .delete extension. They will be deleted after the system restart.

Service Pack for MS Exchange 2007 Server (optional):

http://www.microsoft.c om/downloads/details.aspx?FamilyID=44c66ad6-f185-4a1da9ab-473c1188954c&displaylang=en

Page 8

3. AVG Installation Process

To install AVG on your computer, you need to get the latest installation file. You can use the installation file from the CD that is a part of your box edition but this file might be out-of-date. Therefore we recommended getting the latest installation file online. You can download the file from the AVG website (at http://www.avg.c om/download?

prd=msw).

During the installation process you will be asked for your license number. Please make sure you have it available before starting the installation. The sales number can be found on the CD packaging. If you purchased your copy of AVG on-line, your license number will have been delivered to you via e-mail.

Once you have downloaded and saved the installation file on your hard drive, you can launch the installation process. The installation is a sequence of dialog windows with a brief description of what do at each step. In the following, we offer an explanation for each dialog window:

3.1. Installation Launch

The installation process starts with the Welcome window. In here you select the language used for the installation process. In the lower part of the dialog window find the Choose your setup language item, and select the desired language from the drop down menu. Then press the Next button to confirm and continue to the next dialog.

Page 9

Attention: Here you are choosing the language for the installation process only. You are not selecting the language for the AVG application - this can be specified later on during the installation process!

3.2. License Agreement

The License Agreement dialog provides the full wording of the AVG license agreement. Please read it carefully and confirm that you have read, understood and accept the agreement by checking the I have read license agreement c heckbox and pressing the Accept button. If you do not agree with the license agreement press the Don't accept button, and the installation process will be terminated immediately.

Use the Printable version button to open the license agreement in a new window suitable for printing.

3.3. Checking System Status

Having confirmed the license agreement you will be redirected to the Checking System Status dialog. This dialog does not require any intervention; your system is

being chec ked before the AVG installation can start. Please wait until the process has finished, then continue automatically to the following dialog.

Page 10

3.4. Select Installation Type

The Select Installation Type dialog offers the choice of two installation options: Standard Installation and Custom Installation.

For most users, it is highly recommended to keep to the Standard Installation that installs AVG in fully automatic mode with settings predefined by the program vendor. This configuration provides maximum sec urity combined with the optimal use of resources. In the future, if the need arises to change the configuration, you will always have the possibility to do so directly in the AVG application.

Custom installation should only be used by experienced users who have a valid reason to install AVG with non-standard settings. E.g. to fit specific system requirements.

3.5. Activate AVG

In the Activate your AVG License dialog you have to fill in your registration data. Type in your name (User Name field) and the name of your organization (Company Name field).

Then enter your license number into the License Number text field. The license number will be in the c onfirmation e-mail that you received after purchasing your AVG on-line. You must type in the number exactly as shown. If the digital form of the lic ense number is available (in the email), it is recommended to use the copy and paste method to insert it.

Page 11

Press the Next button to continue the installation process.

If in the previous step you have selected the standard installation, you will be redirected directly to the Setup Summary dialog. If custom installation was selected you will continue with the Destination Folder dialog.

3.6. Custom Installation - Destination Folder

Page 12

The Destination folder dialog allows you to spec ify the location where AVG should be installed. By default, AVG will be installed to the program files folder located on drive C:. If you want to c hange this location, use the Browse button to display the drive structure, and select the respective folder. Press the Next button to c onfirm.

3.7. Custom Installation - Component Selection

The Component Selection dialog displays an overview of all AVG components that can be installed. If the default settings do not suit you, you c an remove/add spec ific components.

However, you can only select from components that are included in your purchased AVG edition. Only those components will be offered to be installed within the Component Selection dialog!

· Remote Administration component - if you intend to connect AVG to an AVG

DataCenter (AVG Network Editions), then you need to select this option.

Note: Only e-mail server components available in the list can be managed remotely!

· AVG Settings Manager - a tool suitable mainly for network administrators that

allows you to copy, edit and distribute AVG configuration. The c onfiguration can be saved to a portable device (USB flash drive etc.) and then applied manually or any other way to chosen stations.

Page 13

· Additional Installed Languages - you can define which language(s) AVG

should be installed in. Check the Additional installed languages item and then select the desired languages from the respective menu.

Basic overview of the individual server components:

· Anti-Spam Server for MS Exchange

Checks all inc oming e-mail messages and marks unwanted e-mails as SPAM. It uses several analyzing methods to process each e-mail message, offering maximum possible protec tion against unwanted e-mail messages.

· E-mail Scanner for MS Exchange (routing Transport Agent)

Checks all inc oming, outgoing and internal e-mail messages going through the MS Exchange HUB role.

Available for MS Exchange 2007 and can be installed for HUB role only.

· E-mail Scanner for MS Exchange (SMTP Transport Agent)

Checks all e-mail messages coming through the MS Exchange SMTP interface.

Available for MS Exchange 2007 only and can be installed for both EDGE and HUB roles.

· E-mail Scanner for MS Exchange (VSAPI)

Checks all e-mail messages stored in user mailboxes. If any viruses are detected, they are moved to the Virus Vault, or completely removed.

Note: There are different options available for MS Exchange 2007 and MS Exchange

2003.

Continue by pressing the Next button.

3.8. Custom Installation - DataCenter

If you selected the Remote Administration Component module during module selection, then in this screen you can define the c onnection string for connecting to your AVG DataCenter.

Page 14

3.9. Setup Summary

The Setup Summary dialog provides an overview of all parameters of the installation process. Please make sure all the information is correct. If so, press the Finish button to continue. Otherwise, you can use the Back button to return to the respec tive dialog and correct the information.

3.10. Installing

The Installing dialog shows the progress of the installation process, and does not require any intervention. Please wait until the installation is complete, then you will be redirected to the Installation Complete dialog.

3.11. Installation Complete

The Installation Complete dialog is the last step of the AVG installation process. AVG is now installed on your computer and fully functional. The program is running in the background in fully automatic mode.

To individually setup protection for your e-mail server, follow the appropriate c hapter:

· E-mail Scanner for MS Exchange Server 2007

· E-mail Scanner for MS Exchange Server 2000/2003

Page 15

· AVG for Kerio MailServer

Page 16

4. E-mail Scanner for MS Exchange Server 2007

4.1. Overview

The AVG for MS Exchange Server 2007 configuration options are fully integrated within the AVG 9.0 Email Server Edition as server components.

Basic overview of the individual server components:

· Anti-Spam - Anti-Spam Server for MS Exchange

Page 17

· EMS (routing) - E-mail Scanner for MS Exchange (routing Transport Agent)

Checks all inc oming, outgoing and internal e-mail messages going through the MS Exchange HUB role.

Available for MS Exchange 2007 and can be installed for HUB role only.

· EMS (SMTP) - E-mail Scanner for MS Exchange (SMTP Transport Agent)

Checks all e-mail messages coming through the MS Exchange SMTP interface.

Available for MS Exchange 2007 only and can be installed for both EDGE and HUB roles.

· EMS (VSAPI) - E-mail Scanner for MS Exchange (VSAPI)

Checks all e-mail messages stored in user mailboxes. If any viruses are detected, they are moved to the Virus Vault, or completely removed.

Double-click a required component to open its interface. With the exception of AntiSpam, all the components share the following common control buttons and links:

Available links:

· Scan Results

Opens a new dialog where you can review sc an results:

Page 18

Here you can check messages divided into several tabs according to their severity. See configuration of individual components for amending the severity and reporting.

By default there are displayed only results for the last two days. You c an change the displayed period by amending the following options:

Show last - insert preferred days and hours.

Show selection - c hoose a custom time and date interval.

Show all - Displays results for the whole time period.

Use Refresh button to reload the results.

· Refresh statistical values - updates stats displayed above.

· Reset statistical values - resets all the stats to zero.

Page 19

The working buttons are as follows:

· Settings - use this button to open settings of the component.

· Back - press this button to return to the Server c omponents overview.

You will find more information on individual settings of all components in the chapters

below.

4.2. E-mail Scanner for MS Exchange (routing TA)

To open the settings of E-mail Scanner for MS Exchange (routing transport agent) , select the Settings button from the interfac e of the c omponent.

From the Server components list select the E-mail Scanner for MS Exchange (routing TA) item:

The Basic Settings section contains the following options:

Page 20

· Enable component - uncheck to disable the whole component.

· Language - select preferred component language.

· Certify messages - check this if you wish to add a c ertification note to all

scanned messages. You can customize the message in the next field.

The Logging settings section:

· Log file size - choose a preferred size of the log file. Default value: 100 MB.

The Scanning properties sec tion:

· Use Heuristics - chec k this box to enable heuristic analysis method during

scanning.

· Report Potentially Unwanted Programs and Spyware threats - chec k this

option to report the presence of potentially unwanted programs and spyware.

· Scan inside archives - chec k this option to let the scanner look also inside

archived files (zip, rar, etc.)

The E-mail attachments reporting section allows you to c hoose which items should be reported during scanning. If checked, each e-mail with such an item will contain [INFORMATION] tag in the message subject. This is the default configuration which can be easily amended in the Detection actions section, part Information (see below).

The following options are available:

· Report password protected archives

· Report password protected documents

· Report files containing macro

· Report hidden extensions

There are also these sub-items available in the following tree structure:

· Detection actions

· Mail filtering

Page 21

4.3. E-mail Scanner for MS Exchange (SMTP TA)

The configuration for the E-mail Scanner for MS Exchange (SMTP Transport Agent) is exactly the same as in the case of routing transport agent. For more information please see the E-mail Scanner for MS Exchange (routing TA) chapter above.

There are also these sub-items available in the following tree structure:

· Detection actions

· Mail filtering

4.4. E-mail Scanner for MS Exchange (VSAPI)

This item contains settings of the E-mail Scanner for MS Exchange (VSAPI).

Page 22

The Basic Settings section contains the following options:

· Enable component - uncheck to disable the whole component.

· Language - select preferred component language.

The Logging settings section:

· Log file size - choose a preferred size of the log file. Default value: 100 MB.

The Scan settings section:

· Background Scan – you can enable or disable the background scanning process

here. Background scanning is one of the features of the VSAPI 2.0/2.5 applic ation interface. It provides threaded scanning of the Exchange Messaging Databases. Whenever an item that has not been scanned with the latest AVG virus base update is encountered in the users’ mailbox folders, it is submitted to AVG for Exchange 2007 Server to be scanned. Scanning and searching for the not examined objects runs in parallel.

A spec ific low priority thread is used for each database, which guarantees other tasks (e.g. e-mail messages storage in the Microsoft Exchange database) are always carried out preferentially.

· Proactive Scan (incoming messages)

You can enable or disable the proactive sc anning function of VSAPI 2.0/2.5 here. This scanning occurs when an item is delivered to a folder, but a request has not been made by a client.

As soon as messages are submitted to the Exchange store, they enter the global scanning queue as low priority (maximum of 30 items). They are scanned on the first in, first out (FIFO) basis. If an item is accessed while still in the queue, it is changed to high priority.

Note: Overflow messages will continue to the store unscanned.

Note: Even if you disable both Background Scan and Proactive Scan options, the on

access scanner will be still active when an user will try to download a message with the MS Outlook client.

· Scan RTF - you can specify here, whether the RTF file type should be scanned

or not.

· Number of Scanning Threads - the scanning process is threaded by default to

increase the overall scanning performance by a certain level of parallelism. You

Page 23

can change the threads c ount here. The default number of threads is computed as 2 times the

‘number_of_processors’ + 1.

The minimum number of threads is c omputed as ('number of processors'+1) divided by 2.

The maximum number of threads is computed as 'Number of Processors' multiplied by 5 + 1.

If the value is the minimum or lesser value or the maximum or greater, the default value is used.

· Scan Timeout - the maximum c ontinuous interval (in seconds) for one thread to

access the message that is being scanned (the default value is 180 seconds).

The Scanning properties section:

· Use Heuristics - chec k this box to enable heuristic analysis method during

scanning.

· Report Potentially Unwanted Programs and Spyware threats - chec k this

option to report the presence of potentially unwanted programs and spyware.

· Scan inside archives - chec k this option to let the scanner look also inside

archived files (zip, rar, etc.)

The E-mail attachments reporting section allows you to c hoose which items should be reported during scanning. The default c onfiguration can be easily amended in the Detection actions section, part Information (see below).

The following options are available:

· Report password protected archives

· Report password protected documents

· Report files containing macro

· Report hidden extensions

Generally, some of these features are user extensions of the Microsoft VSAPI 2.0/2.5 applic ation interface services. For the detailed information on the VSAPI 2.0/2.5 please refer to the following links (and also the links accessible from the referenced ones):

Page 24

· http://support.microsoft.com/default.aspx?scid=kb;en-

us;328841&Product=exch2k - for information on Exchange and antivirus

software interaction

· http://support.microsoft.com/default.aspx?scid=kb;en-us;823166 for

information on additional VSAPI 2.5 features in Exc hange 2003 Server applic ation.

There are also these sub-items available in the following tree structure:

· Detection actions

· Mail filtering

4.5. Detection_Actions

In the Detection actions sub-item you can choose automatic actions that should take place during the sc anning process.

Page 25

The actions are available for the following items:

· Infections

· PUP (Potentially Unwanted Programs)

· Warnings

· Information

Use the roll-down menu to c hoose an action for each item:

· None - no ac tion will be taken.

· Move to Vault - the given threat will be moved to Virus Vault.

· Remove - the given threat will be removed.

To select a custom subject text for messages that contain the given item/threat, check the Mark subject with... box and fill-in a preferred value.

Note: The last mentioned feature is not available for E-mail Scanner for MS Exchange VSAPI.

Page 26

4.6. Mail Filtering

In the Mail Filtering sub-item you can c hoose which attac hments should be automatically removed, if any. The following options are available:

· Remove attachments - check this box to enable the feature.

· Remove all executable files - removes all executables.

· Remove all documents - removes all document files.

· Remove files with these comma separated extensions - fill the box with file

extensions you wish to automatically remove. Separate the extensions with comma.

Page 27

5. E-mail Scanner for MS Exchange Server 2000/2003

5.1. Overview

The E-mail Scanner for MS Exchange Server 2000/2003 configuration options are fully integrated within the AVG 9.0 Email Server Edition as a server component.

The server components include the following:

Basic overview of the individual server components:

· Anti-Spam - Anti-Spam Server for MS Exchange

Checks all inc oming e-mail messages and marks unwanted e-mails as SPAM. It uses several analyzing methods to process each e-mail message, offering

Page 28

maximum possible protec tion against unwanted e-mail messages.

· EMS (VSAPI) - E-mail Scanner for MS Exchange (VSAPI)

Checks all e-mail messages stored in user mailboxes. If any viruses are detected, they are moved to the Virus Vault, or completely removed.

Double-click a required component to open its interface. With the exception of AntiSpam, all the components share the following common control buttons and links:

Available links:

· Scan Results

Opens a new dialog where you can review sc an results:

Here you can check messages divided into several tabs according to their severity. See configuration of individual components for amending the severity

Page 29

and reporting.

By default there are displayed only results for the last two days. You c an change the displayed period by amending the following options:

Show last - insert preferred days and hours.

Show selection - c hoose a custom time and date interval.

Show all - Displays results for the whole time period.

Use Refresh button to reload the results.

· Refresh statistical values - updates stats displayed above.

· Reset statistical values - resets all the stats to zero.

The working buttons are as follows:

· Settings - use this button to open settings of the component.

· Back - press this button to return to the Server c omponents overview.

You will find more information on individual settings of all components in the chapters

below.

5.2. VSAPI 2.0

Virus Scanning API 2.0 (VSAPI 2.0 as provided in MS Exchange 2000 Server) does not allow the deletion of infected e-mail files. Since the virus infected e-mail message attachment cannot be deleted, its filename is changed: AVG for Exchange 2000/2003 Server appends the .virusinfo.txt extension to the original filename. The file content is overwritten with a message about the known virus. If a virus is found directly in the message, the whole body of the message is overwritten with a note saying a virus was found inside this message.

Virus Scanning API 2.5 (VSAPI 2.5 as provided in MS Exchange 2003 Server) also allows deletion of infected messages. This feature can be set up in AVG for MS Exchange 2000/2003 Server configuration dialog.

Page 30

5.3. E-mail Scanner for MS Exchange (VSAPI)

This item contains settings of the E-mail Scanner for MS Exchange (VSAPI).

The Basic Settings section contains the following options:

· Enable component - uncheck to disable the whole component.

· Language - select preferred component language.

The Logging settings section:

· Log file size - choose a preferred size of the log file. Default value: 100 MB.

The Scan settings section:

· Background Scan – you can enable or disable the background scanning process

here. Background scanning is one of the features of the VSAPI 2.0/2.5

Page 31

applic ation interface. It provides threaded scanning of the Exchange Messaging Databases. Whenever an item that has not been scanned with the latest AVG virus base update is encountered in the users’ mailbox folders, it is submitted to AVG for Exchange 2007 Server to be scanned. Scanning and searching for the not examined objects runs in parallel.

A spec ific low priority thread is used for each database, which guarantees other tasks (e.g. e-mail messages storage in the Microsoft Exchange database) are always carried out preferentially.

· Proactive Scan (incoming messages)

You can enable or disable the proactive sc anning function of VSAPI 2.0/2.5 here. This scanning occurs when an item is delivered to a folder, but a request has not been made by a client.

Note: Overflow messages will continue to the store unscanned.

Note: Even if you disable both Background Scan and Proactive Scan options, the on

access scanner will be still active when an user will try to download a message with the MS Outlook client.

· Scan RTF - you can specify here, whether the RTF file type should be scanned

or not.

· Number of Scanning Threads - the scanning process is threaded by default to

increase the overall scanning performance by a certain level of parallelism. You can change the threads c ount here.

The default number of threads is computed as 2 times the ‘number_of_processors’ + 1.

The minimum number of threads is c omputed as ('number of processors'+1) divided by 2.

The maximum number of threads is computed as 'Number of Processors' multiplied by 5 + 1.

If the value is the minimum or lesser value or the maximum or greater, the default value is used.

· Scan Timeout - the maximum c ontinuous interval (in seconds) for one thread to

Page 32

access the message that is being scanned (the default value is 180 seconds).

The Scanning properties section:

· Use Heuristics - chec k this box to enable heuristic analysis method during

scanning.

· Report Potentially Unwanted Programs and Spyware threats - chec k this

option to report the presence of potentially unwanted programs and spyware.

· Scan inside archives - chec k this option to let the scanner look also inside

archived files (zip, rar, etc.)

The following options are available:

· Report password protected archives

· Report password protected documents

· Report files containing macro

· Report hidden extensions

Generally, all these features are user extensions of the Microsoft VSAPI 2.0/2.5 applic ation interface services. For the detailed information on the VSAPI 2.0/2.5 please refer to the following links (and also the links accessible from the referenced ones):

· http://support.microsoft.com:80/support/kb/articles/Q285/6/67.ASP for general

info on the VSAPI 2.0 in Exchange 2000 Server Service Pack 1

· http://support.microsoft.com/default.aspx?scid=kb;en-

us;328841&Product=exch2k - for information on Exchange and antivirus software

interaction

· http://support.microsoft.com/default.aspx?scid=kb;en-us;823166 for information

on additional VSAPI 2.5 features in Exchange 2003 Server application.

There are also these sub-items available in the following tree structure:

· Detection actions

· Mail filtering

Page 33

5.4. Detection_Actions

In the Detection actions sub-item you can choose automatic actions that should take place during the sc anning process.

The actions are available for the following items:

· Infections

· PUP (Potentially Unwanted Programs)

· Warnings

· Information

Use the roll-down menu to c hoose an action for each item:

· None - no ac tion will be taken.

Page 34

· Move to Vault - the given threat will be moved to Virus Vault.

· Remove - the given threat will be removed.

5.5. Mail Filtering

In the Mail Filtering sub-item you can c hoose which attac hments should be automatically removed, if any. The following options are available:

· Remove attachments - check this box to enable the feature.

· Remove all executable files - removes all executables.

· Remove all documents - removes all document files.

· Remove files with these comma separated extensions - fill the box with file

extensions you wish to automatically remove. Separate the extensions with

Page 35

comma.

Page 36

6. AVG for Kerio MailServer

6.1. Configuration

The anti-virus protection mec hanism is integrated directly into the Kerio MailServer applic ation. In order to activate e-mail protec tion of Kerio MailServer by the AVG scanning engine, launch the Kerio Administration Console application. In the control tree on the left side of the application window choose the Content Filter sub-branch in the Configuration branch:

Clic king the Content Filter item will display a dialog with three items:

· Spam Filter

· Antivirus (see section Antivirus)

· Attachment Filter (see section Attachment Filter)

Page 37

6.1.1. Antivirus

To ac tivate AVG for Kerio MailServer, select the Use external antivirus checkbox and choose the AVG Email Server Edition item from the external software menu in the Antivirus usage frame of the configuration window:

In the following section you can specify what to do with an infected or filtered message:

· If a virus is found in a message

This frame specifies the action to be carried out when a virus is detected in a message, or when a message is filtered by an attachment filter:

Discard the message – when selected, the infected or filtered message will be deleted.

Deliver the message with the malicious code removed – when selected, the message will be delivered to the recipient, but without the possibly harmful attachment.

Forward the original message to administrator address – when selected, the virus infected message is forwarded to the address specified in the address text field

Forward the filtered message to administrator address - when selected, the filtered message is forwarded to the address specified in the address text field

Page 38

· If a part of message cannot be scanned (e.g. encrypted or corrupted file)

This frame specifies the action to be taken when part of the message or attachment cannot be scanned:

Deliver the original message with a prepared warning — the message (or attachment) will be delivered unchecked. The user will be warned that the message may still contain viruses.

Reject the message as if it was virus — the system will react the same way as when a virus was detected (i.e. the message will be delivered without any attachment or rejected). This option is safe, but sending password protected archives will be virtually impossible.

Page 39

6.1.2. Attachment Filter

In the Attachment Filter menu there is a list of various attac hment definitions:

You can enable/disable filtering of mail attachments by selecting the Enable attachment filter checkbox. Optionally you can change the following settings:

· Send a warning to sender that the attachment was not delivered

The sender will receive a warning from Kerio MailServer, that he/she has sent a message with a virus or blocked attac hment.

· Forward the original message to administrator address

The message will be forwarded (as it is — with the infected or forbidden attachment) to a defined email address, regardless of whether it is a local or an external address.

· Forward the filtered message to administrator address

Page 40

The message without its infected or prohibited attachment will be (apart from the actions selected below) forwarded to the specified e-mail address. This can be used to verify the correct functioning of the antivirus and/or attachment filter.

In the list of extensions, each item has four fields:

· Type – spec ification of the kind of attachment determined by the extension

given in the Content field. Possible types are File name or MIME type. You can select the respective box in this field to include/exclude the item from attachment filtering.

· Content – an extension to be filtered can be specified here. You can use

operation system wildcards here (for example the string ‘*.doc .*’ stands for any file with the .doc extension, and any other extension following).

· Action – define action to be performed with the particular attachment. Possible

actions are Ac cept (ac cept the attachment), and Block (block the attachment as defined in the Action tab dialog).

· Description – desc ription of the attac hment is defined in this field.

An item is removed from the list by pressing the Remove button. You can add another item to the list by pressing the Add… button. Or, you can edit an existing record by pressing the Edit… button. The following window then appears:

· In the Description field you can write a short desc ription of the attac hment to be

Page 41

filtered.

· In the If a mail message c ontains an attachment where field you can select the

type of attachment (File name or MIME type). You can also choose a particular extension from the offered extensions list, or you can type the extension wildcard directly.

In the Then field you c an decide whether to block the defined attac hment or accept it.

Page 42

7. Anti-Spam Configuration

7.1. Anti-Spam Interface

You will find the Anti-Spam server component's dialog in the Server Components section (left menu). It c ontains a brief information about the functionality of the server component, information on its current status (Anti-Spam Server for MS Exchange component is ac tive.), and some statistics.

Available links:

· Scan Results

Opens a new dialog where you can review anti-spam scan results:

Page 43

Here you can check messages detec ted either as a SPAM (unwanted messages) or a Phishing attempt (an effort to steal your personal data, banking details, identity etc.). By default there are displayed only results for the last two days. You can change the displayed period by amending the following options:

Show last - insert preferred days and hours.

Show selection - c hoose a custom time and date interval.

Show all - Displays results for the whole time period.

Use Refresh button to reload the results.

· Refresh statistical values - updates stats displayed above.

· Reset statistical values - resets all the stats to zero.

The working buttons are as follows:

Page 44

· Settings - use this button to open Anti-Spam settings.

· Back - press this button to return to the Server c omponents overview.

7.2. Anti-Spam Principles

Spam refers to unsolic ited e-mail, mostly advertising a product or service that is mass mailed to a huge number of e-mail addresses at a time, filling recipients’ mail boxes. Spam does not refer to legitimate commercial e-mail for which consumers have given their consent. Spam is not only annoying, but also can often be a source of sc ams, viruses or offensive c ontent.

Anti-Spam checks all incoming e-mail messages and marks unwanted e-mails as SPAM. It uses several analyzing methods to process each e- mail message, offering maximum possible protec tion against unwanted e-mail messages.

7.3. Anti-Spam Settings

In the Anti-Spam basic settings dialog you can check the Turn on Anti-Spam protection checkbox to allow/forbid the anti-spam scanning of e-mail communication.

Page 45

In this dialog you can also select more or less aggressive scoring measures. The AntiSpam filter assigns each message a score (i.e. how similar the message content is to SPAM) based on several dynamic sc anning techniques. You can adjust the Mark message as spam if the score is greater or equal to setting by either typing the

value (0 to 100) or by moving the slider left or right (using the slider, the range of values is limited to 50-90).

Generally we recommended setting the threshold between 50-90, or if you are really unsure, to 90. Here is a general review of the sc oring threshold:

· Value 90-99 - Most incoming e- mail messages will be delivered normally (without

being marked as spam). The most easily identified spam will be filtered out, but a significant amount of spam may still be allowed through.

· Value 80-89 - E-mail messages likely to be spam will be filtered out. Some non-

spam messages may be incorrectly filtered as well.

· Value 60-79 - Considered as a quite aggressive c onfiguration. E-mail messages

that are possibly spam will be filtered out. Non-spam messages are likely to be caught as well.

· Value 1-59 - Very aggressive c onfiguration. Non-spam e-mail messages are as

likely to be caught as real spam messages. This threshold range is not recommended for normal use.

· Value 0 - In this mode, you will only receive e-mail messages from senders in

your Whitelist. Any other e-mail messages will be considered as spam. This

threshold range is not recommended for normal use.

You can further define how the detected spam e-mail messages should be treated:

· Modify subject for messages marked as spam - tick this check box if you

would like all messages detected as spam to be marked with a spec ific word or character in the e-mail subject field; the desired text c an be typed in the activated text field.

Train Anti-Spam button opens the Anti-Spam training wizard described in details in the next chapter.

7.3.1. Anti-Spam Training Wizard

The first dialog of the Anti-Spam Training Wizard asks you to select the source of e-mail messages you want to use for training. Usually, you will want to use either emails that have been incorrectly marked as SPAM, or spam messages that have not been recognized.

Page 46

There are the following options to choose from:

· A specific e-mail client - if you use one of the listed e-mail clients (MS Outlook,

Outlook Express, The Bat!, Mozilla Thunderbird), simply select the respective

option

· Folder with EML files - if you use any other e-mail program, you should first

save the messages to a specific folder (in .eml format), or make sure that you know the location of your e-mail client message folders. Then select Folder with EML files, which will enable you to locate the desired folder in the next step

For faster and easier training process, it is a good idea to sort the e- mails in the folders beforehand, so that the folder you will use for training c ontains only the training messages (either wanted, or unwanted). However, it is not nec essary, as you will be able to filter the e-mails later on.

Select the appropriate option and click Next to continue the wizard.

7.3.2. Select Folder with Messages

Dialog displayed in this step depends on your previous selection.

Folders with EML files

Page 47

In this dialog, please select the folder with the messages you want to use for training. Press the Add folder button to locate the folder with the .eml files (saved e-mail messages). The selected folder will then be displayed in the dialog.

In the Folders contain drop-down menu, set one of the two options - whether the selected folder contains wanted (HAM), or unsolicited (SPAM) messages. Please note that you will be able to filter the messages in the next step, so the folder does not have to contain only training e-mails. You c an also remove unwanted selected folders from the list by clicking the Remove folder button.

When done, click Next and proceed to Message filtering options.

Specific e-mail client

Once you confirm one of the options, new dialog will appear.

Page 48

Note: In case of Microsoft Office Outlook, you will be prompted to select the MS Office Outlook profile first.

In the Folders contain drop-down menu, set one of the two options - whether the selected folder contains wanted (HAM), or unsolicited (SPAM) messages. Please note that you will be able to filter the messages in the next step, so the folder does not have to contain only training e-mails. A navigation tree of the selected e-mail client is already displayed in the main sec tion of the dialog. Please locate the desired folder in the tree and highlight it with your mouse.

When done, click Next and proceed to Message filtering options.

Page 49

7.3.3. Message filtering options

In this dialog, you can set filtering of the e-mail messages.

If you are sure that the selected folder contains only messages you want to use for training, select the All messages (no filtering) option.

If you are unsure about the messages c ontained in the folder, and you want the wizard to ask you about every single message (so that you can determine whether to use it for training or not), select the Ask for each message option.

For more advanced filtering, select the Use filter option. You can fill in a word (name ), part of a word, or phrase to be searched for in the e-mail subject and/or the sender's field. All messages matching exactly the entered criteria will be used for the training, without further prompting.

Attention!: When you fill in both text fields, addresses that matc h just one of the two conditions will be used, too!

When the appropriate option has been selected, click Next. The following dialog will be informative only, telling you that the wizard is ready to process the messages. To start training, c lick the Next button again. Training will then start acc ording to previously selected conditions.

Page 50

7.4. Performance

The Engine performance settings dialog (linked to via the Performance item of the left navigation) offers the Anti-Spam component performance settings. Move the

slider left or right to c hange the level of sc anning performance ranging between Low memory / High performance modes.

· Low memory - during the scanning process to identify spam, no rules will be

used. Only training data will be used for identification. This mode is not recommended for common use, unless the c omputer hardware is really poor.

· High performance - this mode will consume large amount of memory. During the

scanning process to identify spam, the following features will be used: rules and

spam database cac he, basic and advanced rules, spammer IP addresses and

spammer databases.

The Enable on-line checking item is on by default. It results in more precise spam detection via communication with the Mailshell servers, i.e. the scanned data will be compared with Mailshell databases online.

Generally it is recommended to keep the default settings and only change them

Page 51

if you have a valid reason to do so. Any changes to this configuration should only be done by expert users!

7.5. RBL

The RBL item open an editing dialog called Realtime Blackhole Lists:

In this dialog you can switch on/off the Query RBL servers function.

The RBL (Realtime Blac khole List) server is a DNS server with an extensive database of known spam senders. When this feature is switched on, all e-mail messages will be verified against the RBL server database and marked as spam if identical to any of the database entries.

The RBL servers databases c ontain the latest up-to-the-minute spam fingerprints, to provide the very best and most accurate spam detection. This feature is espec ially useful for users who receive large amounts of spam that is not being normally detected by the Anti-Spam engine.

The RBL servers list allows you to define specific RBL server locations. By default, two RBL server addresses are specified. We recommend to keep the default settings

Page 52

unless you are an experienced user and really need to change these settings!

Note: Enabling this feature may, on some systems and configurations, slow down the e-mail rec eiving proc ess, as every single message must be verified against the RBL server database.

No personal data is sent to the server!

7.6. Whitelist

The Whitelist item opens a dialog with a global list of approved sender e-mail addresses and domain names whose messages will never be marked as spam.

In the editing interface you can c ompile a list of senders that you are sure will never send you unwanted messages (spam). You c an also compile a list of full domain names (e.g. avg.c om), that you know do not generate spam messages.

Once you have such a list of senders and/or domain names prepared, you can enter them by either of the following methods: by direct entry of each e-mail address or by importing the whole list of addresses at once. The following control buttons are available:

Page 53

· Edit - press this button to open a dialog, where you can manually enter a list of

addresses (you c an also use copy and paste). Insert one item (sender, domain name) per line.

· Import - if you already have a text file of email addresses/domain names

prepared, you can simply import it by selecting this button. The input file must be in plain text format, and the content must contain only one item (address, domain name) per line.

· Export - if you decide to export the records for some purpose, you can do so by

pressing this button. All records will be saved to a plain text file.

7.7. Blacklist

The Blacklist item opens a dialog with a global list of blocked sender e-mail addresses and domain names whose messages will always be marked as spam.

In the editing interface you can c ompile a list of senders that you expect to send you unwanted messages (spam). You can also compile a list of full domain names (e.g. spammingcompany.com), that you expect or receive spam messages from. All e-mail from the listed addresses/domains will be identified as spam.

Page 54

· Edit - press this button to open a dialog, where you can manually enter a list of

addresses (you c an also use copy and paste). Insert one item (sender, domain name) per line.

· Import - if you already have a text file of email addresses/domain names

prepared, you can simply import it by selecting this button. The input file must be in plain text format, and the content must contain only one item (address, domain name) per line.

· Export - if you decide to export the records for some purpose, you can do so by

pressing this button. All records will be saved to a plain text file.

7.8. Advanced Settings

Typically it is recommended to keep the default settings and only change them if you have a valid reason to do so. Any changes to configuration should only be done by expert users!

If you still believe you need to change the Anti-Spam configuration at the very advanced level, please follow the instructions provided directly in the user interface. Generally, in eac h dialog you will find one single spec ific feature and you can edit it its description is always included in the dialog itself:

· Cache - fingerprint, domain reputation, LegitRepute

· Training - word training, sc ore history, score offset, maximum word entries, auto

training threshold, weight, write buffer

· Filtering - language list, c ountry list, approved IPs, blocked IPs, blocked

countries, blocked charsets, spoofed senders

· RBL - RBL servers, multihit, threshold, timeout, maximum IPs

· Internet connection - timeout, proxy server, proxy server authentication

Page 55

8. AVG Settings Manager

The AVG Settings Manager is a tool suitable mainly for smaller networks that allows you to copy, edit and distribute AVG configuration. The configuration can be saved to a portable device (USB flash drive etc .) and then applied manually to chosen stations.

The tool is included in the installation of AVG and available via Windows Start menu:

All Programs/AVG <%VER%>/AVG Settings Manager

· Edit AVG configuration of this computer

Use this button to open dialog with advanced settings of your local AVG. All changes made here will be reflected also to the local AVG installation.

· Load and edit AVG configuration file

If you already have an AVG configuration file (.pck), use this button to open it for editing. Once you c onfirm your changes by the OK or Apply button, the file will be replaced with the new settings!

· Apply configuration from file to AVG on this computer

Use this button to open an AVG configuration file (.pck) and apply it to the local

Page 56

installation of AVG.

· Store local AVG configuration to a file

Use this button to save the AVG configuration file (.pck) of the local AVG installation. If you did not set a password for the Allowed ac tions, you may experience the following dialog:

Answer Yes if you wish to set the password for acc ess to Allowed items now and then fill-in the required information and c onfirm your choice. Answer No to skip the password creation and continue to save the local AVG configuration to a file.

· Clone AVG installation

This option allows you to make an exact copy of the local AVG installation by creating an installation package with custom options. To proceed first select folder where the installation script will be saved.

Then from the drop-down menu select one of the following:

Hidden installation - no information will be displayed during the setup process.

Show installation progress only - the installation will not require any

Page 57

user attention, but the progress will be fully visible.

Show installation wizard - the installation will be visible and user will need to manually confirm all steps.

Use either the Download button to download the latest available AVG installation package directly from the AVG website to the selected folder or manually put the AVG installation package into that folder.

You can use the Proxy button to define a proxy server settings if your network requires this for a successful connection.

By clicking OK the c loning process begins and should shortly finish. You may also experience a dialog asking about setting password to Allowed items (see above). Once finished, there should be AvgSetup.bat available in the c hosen folder along with other files. If you run the AvgSetup.bat file, it will install AVG according to the parameters chosen above.

Page 58

9. FAQ and Technical Support

Should you have any problems with your AVG, either business or technical, please refer to the FAQ section of the AVG website at http://www.avg.c om.

If you do not succeed in finding help this way, contac t the tec hnic al support department by email. Please use the contac t form accessible from the system menu via Help / Get help online.