Avira ANTIVIR EXCHANGE User Manual
Avira AntiVir Exchange
User Manual
Contents
...................................................................................... 5
..................................................................................... 8
.................................................................... 14
......... 19
1 Quickstart
1.1 Installation on an Exchange server ........................................................................ 5
1.2 Starting the AntiVir Exchange Management Console ............................................. 5
1.3 Configuration in the AntiVir Exchange Management Console ................................ 6
1.3.1 Necessary steps in the basic configuration ................................................................. 6
1.3.2 Necessary steps in the policy configuration ................................................................ 6
1.3.3 Recommended steps in the basic configuration .......................................................... 7
1.3.4 Virus scan of the Exchange databases ........................................................................ 7
1.4 Observing data in AntiVir Monitor ........................................................................ 7
2 Installation
2.1 System requirements ............................................................................................ 8
2.2 Installation of Avira AntiVir Exchange on an Exchange server ................................ 8
2.3 Uninstalling Avira AntiVir Exchange ................................................................... 13
3 Technical description
3.1 The Avira AntiVir Exchange Server ...................................................................... 14
3.1.1 The transport agent ................................................................................................. 15
3.1.2 The Avira AntiVir Exchange Service = Enterprise Message Handler (EMH) ............... 15
3.1.3 The Avira AntiVir Exchange quarantine ................................................................... 15
3.1.4 The Active Directory/LDIF ....................................................................................... 16
3.1.5 Compressed files/archives: The Avira AntiVir Exchange unpacker ............................ 17
3.2 The Avira AntiVir Exchange configuration ........................................................... 17
4 Details on the Avira AntiVir Exchange Management Console
4.1 The toolbar ......................................................................................................... 19
4.2 Meaning of icons ................................................................................................ 20
4.3 Basic configuration ............................................................................................. 22
4.3.1 Overview with configuration reports ....................................................................... 22
4.3.2 Importing a configuration ....................................................................................... 23
4.3.3 AntiVir Server settings ............................................................................................ 23
4.3.4 Settings for an individual AntiVir Server .................................................................. 27
4.3.5 Address lists ............................................................................................................ 32
4.3.6 Report templates ..................................................................................................... 38
4.3.7 Creating a database connection to an SQL server ..................................................... 44
4.3.8 Folder settings ........................................................................................................ 49
4.3.9 Utility settings ........................................................................................................ 57
4.4 Policy configuration ............................................................................................ 58
4.4.1 Example of a company policy ................................................................................... 58
2
4.4.2 Conditions .............................................................................................................. 58
....................................................................... 70
................................................................................ 105
4.4.3 Job types ................................................................................................................. 59
4.4.4 Actions .................................................................................................................... 60
4.4.5 Processing sequence of jobs ..................................................................................... 61
4.5 AntiVir Monitor ................................................................................................. 61
4.5.1 Quarantines ............................................................................................................ 61
4.5.2 Avira AntiVir Exchange reports ............................................................................... 69
5 AntiVir scan engine
5.1 Overview ............................................................................................................ 70
5.1.1 Job types ................................................................................................................. 70
5.2 AntiVir Scan ....................................................................................................... 70
5.3 Information store scan........................................................................................ 71
5.3.1 Status of the information store ................................................................................ 72
5.3.2 Virus scan in the information store - sample job ...................................................... 75
5.4 Configuring and enabling the AntiVir Scan Engine ............................................... 80
5.5 Activating virus scanning - sample job ................................................................. 83
5.5.1 General settings ...................................................................................................... 83
5.5.2 Job is mission critical .............................................................................................. 84
5.5.3 Setting address conditions ....................................................................................... 85
5.5.4 Setting content conditions ...................................................................................... 85
5.5.5 Defining actions ...................................................................................................... 85
5.5.6 Selecting servers ...................................................................................................... 89
5.5.7 Entering details for the job ...................................................................................... 89
5.5.8 Saving the configuration .......................................................................................... 89
5.6 Virus scan of password-protected archives ........................................................... 90
5.6.1 Sample job ............................................................................................................... 90
5.7 File restrictions for the attachment ..................................................................... 91
5.7.1 By type .................................................................................................................... 91
5.7.2 By email size ............................................................................................................ 92
5.7.3 By attachment type and/or size ............................................................................... 92
5.7.4 Configuring fingerprints .......................................................................................... 93
5.7.5 Blocking file attachments by type - Sample job ......................................................... 93
5.7.6 Restricting email size - sample job ........................................................................... 97
5.7.7 Blocking attachments types and sizes - sample job ................................................. 100
6 AntiVir Wall
6.1 Job types .......................................................................................................... 105
6.2 Address check ................................................................................................... 105
6.2.1 Blocking senders or recipients - sample job ............................................................ 106
6.3 Content check with dictionaries ........................................................................ 109
6.3.1 Setting up dictionaries ........................................................................................... 109
6.3.2 Checking and blocking text content - sample job .................................................... 112
3
Avira AntiVir Exchange 9
................................................................................... 119
6.4 Limiting the number of recipients ..................................................................... 116
6.4.1 Restricting the number of recipients - sample job ................................................... 116
7 Anti-spam
7.1 Avira AntiSpam Engine ..................................................................................... 119
7.1.1 Configuring AntiSpam Engine ............................................................................... 119
7.2 Wall spam filtering jobs .................................................................................... 122
7.2.1 AntiSpam with Wall Spam Filtering jobs ................................................................ 122
7.2.2 Definite no-spam criteria ....................................................................................... 124
7.2.3 Definite spam criteria ............................................................................................ 125
7.2.4 Practical tips.......................................................................................................... 126
7.3 Anti-spam for experts ....................................................................................... 126
7.3.1 Combined criteria - example .................................................................................. 127
7.3.2 Combining the information on spam probability .................................................... 128
7.3.3 AntiSpam scanning - Sample job ............................................................................ 130
7.3.4 Configuring advanced spam filtering jobs .............................................................. 140
7.3.5 Manual AntiSpam configuration ............................................................................ 141
4
Quickstart
1 Quickstart
The quick guide to Avira AntiVir Exchange:
• Installation on an Exchange server
• Starting the AntiVir Exchange Management Console
• Configuration in the AntiVir Exchange Management Console
• Observing data in AntiVir Monitor
1.1 Installation on an Exchange server
1. To install Avira AntiVir Exchange, double-click the installation file:
• For Microsoft Exchange 2003: avira_antivir_exchange_2k_32bit.exe
• For Microsoft Exchange 2007/2010 (64-bit):
avira_antivir_exchange_2k7_64bit.exe
2. Follow the rest of the instructions in the setup until the installation is completed.
If you do not specify another installation directory, Avira AntiVir Exchange is installed
in the following default directory:
C:\Programme\Avira\AntiVir Exchange\ (German)
C:\Program Files\Avira\AntiVir Exchange\ (English)
or
C:\Programme(x86)\Avira\AntiVir Exchange\ (German)
C:\Program Files(x86)\Avira\AntiVir Exchange\ (English)
for 64-bit versions
Warning: You must disable any real-time or on-access scan functions of the virus scanners used
for the directory ...\Avira\AntiVir Exchange\AntiVirData\
1.2 Starting the AntiVir Exchange Management Console
Avira AntiVir Exchange is a server product that is configured using the AntiVir Exchange
Management Console. For Avira AntiVir Exchange to work, the AntiVir for Exchange service
must be started. See also The Avira AntiVir Exchange Service = Enterprise Message Handler (EMH)
You start the console via Start - Programs - Avira - AntiVir Exchange - AntiVir Exchange
Management Console.
When you close the AntiVir Exchange Management Console, you will be asked if you want to
save changes.
Note: Open changes are indicated by (*) at the uppermost node. If you want to save your
changes to the configuration, click the Save button. The configuration is saved in the
ConfigData.xml file, which is stored in the Avira\AntiVir Exchange\Config\ directory.
5
Avira AntiVir Exchange 9
1.3 Configuration in the AntiVir Exchange Management
Console
After the installation, make the settings described below in the AntiVir Exchange Management
Console.
1.3.1 Necessary steps in the basic configuration
In the Basic Configuration, you define the valid servers, email addresses, common templates
and utility settings.
Select Basic Configuration - General Settings - AntiVir Server settings on the Email
addresses tab to check the entries for the Administrators and the Internal domains. See
Server settings.
AntiVir
1.3.2 Necessary steps in the policy configuration
In the Policy Configuration, you define and enable the required jobs in accordance with your
company's policies. In other words, jobs are no more than rule-based measures or actions that
are applied to the mail traffic.
Carry out the following steps to create a new job:
1. Find the required template in Job templates.
2. Select the template and drag it into the Mail Transport Jobs folder. Configure the
name and the properties of this job and enable the job under Properties. (Active: Yes)
6
Quickstart
3. Note the sequence in which the jobs are processed (see Processing sequence of jobs
4. Save your changes. See also Starting the AntiVir Exchange Management Console.
It is important to distinguish between two categories of jobs.
Jobs for the AntiVir Scan Engine that scan for viruses, malware or malicious scripts or that filter
emails according to size and/or type of file attachment and jobs for the AntiVir Wall that can be
used to filter emails according to a number of criteria (e.g. addresses, words, images).
).
1.3.3 Recommended steps in the basic configuration
It is recommended that you make individual settings for address lists, templates, etc. in the
basic configuration. These settings are, however, not mandatory for a test operation.
1. Configure the Address lists (for the selection in the job rules) under General
Settings.
2. If required, change the standard templates under General Settings.
3. In Utility Settings, configure the required accessories such as word lists, fingerprints
and virus scanners.
1.3.4 Virus scan of the Exchange databases
In Policy Configuration - Information Store Jobs, you can make the corresponding settings
for each AntiVir server individually.
You cannot create information store jobs yourself. When you add a new server, a corresponding
information store job is automatically available.
When you remove the server again, the information store job is also deleted.
For further information on information store jobs, see Information store scan
.
1.4 Observing data in AntiVir Monitor
After saving your settings, you can observe ongoing operations in Avira AntiVir Exchange with
AntiVir Monitor.
AntiVir Monitor allows you to observe the latest "live data" and manage the quarantines of
the configured servers, for example.
More information is available under AntiVir Monitor
7
2 Installation
Overview:
• System requirements
• Installation of Avira AntiVir Exchange on an Exchange server
• Uninstalling Avira AntiVir Exchange
2.1 System requirements
The following are the system requirements for installing Avira AntiVir Exchange:
• CD-ROM drive or network access
• RAM: Exchange recommended + additional 64 MB
• Hard drive: At least 400 MB for the installation
• Microsoft .NET Framework 2.x
• Operating systems (both 32-bit and 64-bit):
• Windows Server 2003
• Windows Server 2008
• Exchange server:
• MS Exchange Server 2003
• MS Exchange Server 2007 SP1 Update Rollup 4
The following roles are supported:
- Hub Transport Server
- Mailbox Server
• MS Exchange Server 2010
Note: Please contact the support for information about the installation of clusters.
Warning: You must disable any real-time or on-access scan functions of the virus scanners used
for the directory ...\Avira\AntiVir Exchange\AntiVirData\
2.2 Installation of Avira AntiVir Exchange on an Exchange
server
1. To install Avira AntiVir Exchange, double-click the installation file, for example:
avira_antivir_exchange_2k_32bit.exe
8
Installation
2. First select the setup language. Then select the platform and the language for the
product.
The selected product language applies for the product interface and for the user
notifications that are sent from Avira AntiVir Exchange to the users.
3. In the next dialog box, accept the license agreement to be able to continue and then click
Next.
9
Avira AntiVir Exchange 9
4. In the next dialog box, select the features that you want to install. When you make this
selection, all server components and the AntiVir Exchange Management Console are
installed.
If another active information store scan application apart from Avira AntiVir Exchange
is located on the server, the information store scan function is disabled. If you want to
use the information store scan, you first need to uninstall the other application.
5. Click Next.
10
Installation
6. In the next dialog box, you are asked for the storage location of the configuration file.
If you are not operating Avira AntiVir Exchange on multiple servers and you want to
administer centrally with one configuration, confirm the default setting and click Next.
7. In the next dialog box, define the email address of the administrator.
8. If you are using a proxy server for the AntiVir update, check the box and enter the proxy
settings for IP address, port, user and password. The password is stored in plain text.
11
Avira AntiVir Exchange 9
9. In the next dialog box, you are asked for the license file.
12
Enable the Use license file option and use Browse to select the path for the license
file.
Installation
10. You then receive a summary of your settings.
11. Now disable the on-access scanner for the directory ...\AntiVirData if you have not
already done so.
12. Check your configuration settings.
These settings are accepted as the default settings in the configuration of the Avira
AntiVir Exchange Server. For more information, see AntiVir Exchange Server Settings
13. Follow the rest of the instructions and click Install.
Avira AntiVir Exchange is then installed in the following directory:
<Drive>:\<Default program directory>\Avira\AntiVir Exchange\
14. When you click Finish in the last dialog box, Avira AntiVir Exchange is successfully
installed.
The AntiVir virus scanner is completely configured and can be used straightaway. For this
purpose, we provide a job for the virus scan with AntiVir, which you can simply enable.
See also Configuring and enabling the AntiVir Scan Engine
Warning: You must disable any real-time or on-access scan functions of the virus scanners used
for the directory ...\Avira\AntiVir Exchange\AntiVirData\
.
.
2.3 Uninstalling Avira AntiVir Exchange
1. Click Start - Control Panel - Programs and Features
2. Select Avira AntiVir Exchange
3. Click Next. The setup will be launched and will uninstall Avira AntiVir Exchange.
13
3 Technical description
Avira AntiVir Exchange is divided into three main components:
• The Avira AntiVir Exchange Console
• The Avira AntiVir Exchange Server
• The Avira AntiVir Exchange Configuration
The Avira AntiVir Exchange Console is the user interface for configuring and administering
Avira AntiVir Exchange. This is a so-called "snap-in" for the MMC.
The Avira AntiVir Exchange Console can be used to administer individual Exchange servers with
Avira AntiVir Exchange installed or entire "Avira AntiVir Exchange server farms". This makes
daily administration much easier, particularly in a multi-server environment.
The Avira AntiVir Exchange Console gives the administrator access to all the necessary
configuration information and to the AntiVir Monitor (which includes an overview of
quarantines) of the Avira AntiVir Exchange Servers. Two different access methods are used for
configuration purposes and to access the quarantines.
1. Standard Windows file access
Windows data access is required in order access the Avira AntiVir Exchange
configuration, for example to administer security settings. The Avira AntiVir Exchange
configuration may be available locally.
2. SOAP and SSL
The AntiVir Monitor
used for communication purposes.
is accessed via SOAP and SSL. A defined communication port is
The Avira AntiVir Exchange Console supports two modes:
1. Local administration
Here the Avira AntiVir Exchange Console is run directly on the Exchange server on
which all the Avira AntiVir Exchange components have been installed. This mode is
suitable for smaller environments and administration takes place on the local server.
2. Remote administration
In this case the Avira AntiVir Exchange Console is not run on the Exchange server, but
is installed on a client instead.
The Avira AntiVir Exchange Console runs on the following operating systems:
• Windows 2003
• Windows XP Professional
• Windows 2008
• Windows Vista
• Windows 7
The remote administration option is suitable for central administration in multi-server
environments. The Avira AntiVir Exchange Console uses one or more Exchange servers to
configure and administer Avira AntiVir Exchange.
3.1 The Avira AntiVir Exchange Server
Avira AntiVir Exchange Server is the term used to refer to the Avira AntiVir Exchange functions
and processes that run solely on the Exchange server.
14
Technical description
The Avira AntiVir Exchange Server can be installed both in simple environments and in frontend/back-end environments.
The Avira AntiVir Exchange Server is in turn divided into a number of different areas.
3.1.1 The transport agent
The transport agent is a process that ensures that all emails, schedule queries, etc. sent, received
or routed by the Exchange server are "intercepted" (or grabbed).
The SMTP transport protocol is used for all transport involving emails, schedule requests, etc.
The "MS SMTP Transport Stack" is part of the SMTP transport protocol. This transport stack is
used to route all email traffic. It doesn’t matter whether these are emails that are sent between
mailboxes on the same mailbox or incoming and outgoing emails.
In every case, email must pass through the transport stack. The transport agent is "linked" to
this transport stack. As a registered event sink, the transport agent monitors the email traffic
and routes all relevant information to the Avira AntiVir Exchange Service – the second
component of the Avira AntiVir Exchange Server. The email remains active until all processing
by the Avira AntiVir Exchange Server is successfully completed.
Note: Exchange-internal information, such as replication messages, are recognized as such by
the transport agent and are left unchanged in the Exchange system.
3.1.2 The Avira AntiVir Exchange Service = Enterprise Message
Handler (EMH)
The Avira AntiVir Exchange Service is always started as a Windows service and accepts all
information from the transport agent. All further processing by Avira AntiVir Exchange will be
monitored and controlled by the Avira AntiVir Exchange Service from this point forward. If the
Avira AntiVir Exchange Service is stopped, the security functions of Avira AntiVir Exchange are
disabled.
The Avira AntiVir Exchange Service can access all the necessary information:
• The configured Avira AntiVir Exchange jobs
• The installed Avira AntiVir Exchange license
• The Active Directory
• The Avira AntiVir Exchange quarantine
All of this information is now used for many purposes, for example to check the emails for
viruses, identify spam emails and to place them in quarantine.
After processing, the Avira AntiVir Exchange Service returns the emails to the SMTP server.
3.1.3 The Avira AntiVir Exchange quarantine
One possible option is to stop infected emails or other undesirable emails on the server. This
prevents these emails from reaching the relevant recipients. These emails are placed in the Avira
AntiVir Exchange quarantine instead. A number of quarantines are available on each Avira
AntiVir Exchange Server after installation. Additional quarantines can be created by the
administrator.
An Avira AntiVir Exchange quarantine comprises
• A quarantine directory on the Exchange server
(...\AntiVirData\Quarantine\Default Quarantine)
• The emails copied to quarantine.
15
Avira AntiVir Exchange 9
• A quarantine database (LocIdxDB.mdb).
Avira AntiVir Exchange automatically generates an entry in the quarantine database for every
email placed in quarantine. This database is a Microsoft Access file.
The following information is stored in this database:
• Email subject
• Date/Time
• Sender’s email
• Recipient’s email
• Sender’s email (SMTP)
• Recipient’s e-mail (SMTP)
• Short description of the restriction detected
• Email size
• Name of the Avira AntiVir Exchange job that placed this email in quarantine
• Name of the Exchange server
• Name of the email file
• Processing history
When an Avira AntiVir Exchange quarantine is displayed with the Avira AntiVir Exchange
Console, the information from the quarantine database is displayed first.
When a quarantine entry is opened, more information is loaded from the email file.
Communication with the Avira AntiVir Exchange quarantine uses SOAP (Simple Object Access
Protocol) + SSL (Secure Socket Layer). This applies both to direct "local" access to the server and
to access from a remote Windows workstation. Port 8008 is the default communication port.
This port can be changed in the Avira AntiVir Exchange Console (AntiVir Server node). If this
port is changed for the server, this change must also be adapted to all accessing Avira AntiVir
Exchange Consoles. All computers must use the same port. SSL is used to encrypt the SOAP
communication channel. All the necessary components are provided during installation.
3.1.4 The Active Directory/LDIF
Avira AntiVir Exchange does not make any changes or additions to the Active Directory (AD).
However, information from the Active Directory is read out at various points by Avira AntiVir
Exchange.
When starting, the Avira AntiVir Exchange Service determines which Global Catalog server is
available. This is used when determining addresses from distribution lists during email
processing, for example.
The Avira AntiVir Exchange Console uses the Active Directory when selecting sender/ recipient
conditions.
16
If there is no Active Directory available because, for example, the relevant ports are not open,
then it is possible to work with an LDIF file. This can be generated by means of an LDAP export
from an Active Directory, Exchange user directory or Notes Name and Addressbook (NAB).
Technical description
3.1.5 Compressed files/archives: The Avira AntiVir Exchange
unpacker
Files are often compressed when sent by email. To ensure that the virus scan and all checks also
work for archives, Avira AntiVir Exchange uses an unpacker to be able to check files within the
archive. Avira AntiVir Exchange includes an unpacker which is automatically available after
installation.
The unpacker supports the following archive formats:
• ACE
• CAB
• ZIP
• Selfextracting ZIP
• ARJ
• Selfextracting ARJ
• TAR
• GZIP
• TGZ (Tape archive)
• UUE (Executable compressed ASCII archive)
• LZH (LH ARC)
• RAR
• Selfextracting RAR
• Java Archive (.jar)
• BZIP2
• 7-ZIP
Note: It is possible for an archive itself to contain archives. These archives (recursively packed
files) are unpacked to a depth of 5 as standard. All archives that exceed this limit are transferred
to the Bad Mail area.
The default upper limit for an email including unpacked files is 300 MB. A limit like this is
particularly important in so-called "ZIP of Death" attacks.
The unpacking depth and the size limit can be changed in the console under Basic
Configuration - AntiVir Server - Properties - General.
3.2 The Avira AntiVir Exchange configuration
All the information required to run Avira AntiVir Exchange is stored in the Avira AntiVir
Exchange configuration. The Avira AntiVir Exchange configuration is available in the form of an
XML file (ConfigData.xml).
The ConfigData.xml file is similar in structure to a database. There are different entries for each
configuration area. Because the configuration involves a single file, it is very easy to distribute
and back up the configuration. When help is required with configuration problems, the
ConfigData.xml can be sent to the Avira Support Team for analysis.
17
Avira AntiVir Exchange 9
The configuration information required both by the Avira AntiVir Exchange Server and the
Avira AntiVir Exchange Console. Among other things, the Avira AntiVir Exchange Server derives
the data for the Avira AntiVir Exchange job to be run from this information. To be able to make
changes to the configuration with the Avira AntiVir Exchange Console, access is also required to
the ConfigData.xml file. The Avira AntiVir Exchange configuration information can be stored
both in a local directory and on a network share. An entry in the registry defined which Avira
AntiVir Exchange configuration is used by the Avira AntiVir Exchange Console or the Avira
AntiVir Exchange Server. The path to the Avira AntiVir Exchange configuration can be specified
in C:\..... format or as UNC path \\Servername\Share\ConfigData.xml. If the specified Avira
AntiVir Exchange configuration is unavailable, Avira AntiVir Exchange uses the so-called "LastKnown-Good" configuration. This is logged in the Windows event list.
The "Last-Known-Good" configuration is stored locally for each server and is always updated
when changes have been made to the Avira AntiVir Exchange configuration and it is possible to
access the "Last-Known-Good" configuration from the Avira AntiVir Exchange configuration.
Note: A parameter is available to allow a non-standard configuration to be opened with the
console. For example, you could start the Avira.msc file with parameter config and the required
configuration file as follows:
"C:\Programs\Avira\AntiVir Exchange\Avira.msc" config
"C:\OtherFolder\Directory\ConfigData.xml"
You can also specify a UNC path here.
18
4 Details on the Avira AntiVir Exchange
Management Console
1. Open the AntiVir Exchange Management Console
2. In the left hand column select the Basic Configuration, Policy Configuration or
AntiVir Monitor.
The corresponding subfolders can be seen in the right hand window.
3. To launch Online Help click on
in the toolbar or on Show Help File in the menu.
4.1 The toolbar
Back
Forwards
Up one level
Properties of the selected object
Refresh
19
Avira AntiVir Exchange 9
Export list
Help
Save
Increase position/order by one
Decrease position/order by one
Enable job
Disable job
New object
Set filter in quarantine / bad mail
4.2 Meaning of icons
Avira AntiVir Exchange Console start and logo
Basic Configuration for the general settings of all modules.
Node for General Settings
The folder for the address lists
A single Avira AntiVir Exchange address list (red collar), supplied with Avira
AntiVir Exchange and cannot be changed.
A single user-defined address list (yellow collar), can be created by the user and
configured under Properties
The folder for Sample notifications, containing the various samples for every
job type and recipient.
A single sample notifications, configurable under Properties
The folder for the individual database connections.
The icon for a single database connection, configurable under Properties.
A list of all Avira AntiVir Exchange servers. Servers can be added, removed and
configured. The shared properties for all servers are configured under General
Settings - AntiVir Server Settings, or, alternatively, by right-clicking on
AntiVir Server - Properties. These include the standard email addresses and
internal domain(s)
20
General AntiVir Server Settings under the General Settings node in the righthand window.
A single server, configurable under Properties.
Details on the Avira AntiVir Exchange Management Console
Folder Settings and Utility Settings. The quarantines are found under Folder
Settings and all additional items to be configured, such as virus scanner,
fingerprints and dictionaries, are found under Utility Settings.
The quarantine folder structure. This contains all quarantine folders.
A single quarantine folder, configurable under Properties.
The folder for fingerprint groups.
A logically related fingerprint group.
A single fingerprint, configurable under Properties.
The folder for the word lists used to filter content.
A single dictionary, configurable under Properties.
The AntiVir virus scanner, configurable under Properties.
Policy configuration for configuring individual jobs based on your company's
policies.
Folder for sample jobs, containing the jobs for individual job types.
An AntiVir job or AntiVir Wall job, which can have various job types, configurable
under Properties.
An active job, configurable under Properties.
An inactive job, configurable under Properties.
The AntiVir Monitor for viewing all quarantine folders on each available server.
The quarantine folders contain the copies of the original emails, including the
attachments.
The quarantine folders with original mails for inspection. Detailed information
can be retrieved for every email.
A single quarantine item
Invalid quarantine item
Resent quarantine item
Information store for quarantine item.
Time and day of quarantine update
Folder for different AntiVir reports delivered with Avira AntiVir Exchange.
Individual AntiVir report.
21
Avira AntiVir Exchange 9
The view of the Avira AntiVir Exchange Console comprises three areas:
• Basic configuration
• Policy configuration
• AntiVir Exchange Monitor
4.3 Basic configuration
The basic configuration is where general settings and the most important basic settings are
made for the modules.
The basic configuration is used to manage:
• General settings, such as:
• All folders (e.g. quarantine folders)
• and the utilities:
• Proxy server
• Address lists
• Notification templates (templates)
• Database connections
• AntiVir servers
• Word lists for the content check
• Fingerprints for blocking attachments
• AntiVir engine
• AntiSpam engine
4.3.1 Overview with configuration reports
A configuration report provides an overview of the current configuration:
1. Right-click on Basic Configuration and select All Tasks - Show Configuration Reports.
22
Details on the Avira AntiVir Exchange Management Console
2. Click the required report.
3. Click Show report.
The report is then opened as a HTML file in the browser.
4. Click Report preview
5. Click Save report
to display a print preview.
to save the selected report as a HTML file.
4.3.2 Importing a configuration
Warning: Before changing an object in the basic configuration, it is recommended that you create a copy
of the old object of the same name and rename it. The new version replaces the old one, which means that
your own changes to the object are then lost.
If a modified version is available:
1. Select Basic Configuration - All Tasks - Import Configuration to reinstall all
elements/objects such as word lists or fingerprints.
2. For this, select the corresponding XML file provided by Avira.
Warning: This function does not import the full configuration (ConfigData.xml) including the jobs, but
instead imports only individual basis objects.
4.3.3 AntiVir Server settings
Under AntiVir Server Settings you can configure the default settings for all Avira AntiVir
Exchange servers. Each server can also be configured on an individual basis. For more details see
Settings for an individual AntiVir server
1. Select Basic Configuration - General Settings
2. Open Properties:
• In the right-hand window click on AntiVir Server Settings and right-click to select
Properties.
.
23
Avira AntiVir Exchange 9
Packed files and AntiVir Monitor
The settings on the General tab define the maximum permissible size for unpacked files on the
hard disk and the maximum permissible unpacking depth for archives. Emails that exceed these
values are transferred to the Bad Mail area.
Warning: Make sure that your communication port is set correctly for the AntiVir Monitor.
Otherwise it will not be possible to communicate with the servers.
Port 8008 is used as the default during installation. The values entered here apply to all servers.
• Properties can also be opened by double-clicking on AntiVir Server Settings.
• Alternatively, you can access the properties in the left-hand window under Basic
Configuration by right-clicking AntiVir Server.
24
In this context you should also read the description of how to assign rights and make security
settings under AntiVir Monitor
.
Unscannable elements
Unscannable elements, for example emails including encrypted attachments, can be subject to
cross-server actions which are automatically performed when the program identifies an element
as unscannable.
You can choose between two options from the drop-down. Either the fact that the email is
unscannable can be ignored and the email is processed or the email is automatically moved to
the bad mail directory.
Details on the Avira AntiVir Exchange Management Console
Combined notification
Each job can generally be configured so that, when a particular event occurs, the recipients,
senders and/or administrators are notified of this event (Actions tab in Job Properties).
If several of these events occur for a processed email, then the default setting for Avira AntiVir
Exchange emails is that they do not send a separate notification for every event, but rather that
all notifications are sent as a collective notification. This means that the recipients of this
collective notification only receive one email that lists all incoming events.
The recipients of this Collective Notification only receive one email that lists all incoming events.
Collective Notifications is used as the template in this case. You can modify this template or
create new templates (with Basic Configuration - General Settings - Templates -
Collective Notifications).
Note: If you suppress the sending of collective notifications and instead wish to send a separate
email notification for every event that occurs, you should disable the Create collective
notifications field under General Settings - AntiVir Server Settings - General Tab.
Central whitelist
In multi-email environments every participating server creates its own user whitelists. Without
email synchronization, each user therefore receives a separate whitelist for each server and each
whitelist has to be managed separately. To be able to manage these whitelists centrally, thus
simplifying administration, instead of the regular local database based on Microsoft Jet-Engine,
you can also set up a Microsoft SQL server to save the data for all participating Avira AntiVir
Exchange servers in a central SQL database.
To create central user whitelists, you must first configure a database connection between the
SQL server and the Avira AntiVir Exchange server (Basic Configuration - Database Connections).
As soon as this connection is in place, select the relevant configuration in the Database
Connection for Whitelist Entries field.
25
Avira AntiVir Exchange 9
Defining email addresses and internal domains
Avira AntiVir Exchange requires a number of basic settings for the mail domain of the emails to
be processed. During installation, the email address of the specified Avira AntiVir Exchange
administrator is used to enter the following basic settings for Avira AntiVir Exchange:
• Administrator(s): The Avira AntiVir Exchange administrator addresses entered here
receive important status notifications from the Avira AntiVir Exchange installation and
the configured administrator notifications. The installation enters the queried
administrator address as the default.
• Notification sender: The sender displayed in Avira AntiVir Exchange notifications. The
installation enters Avira AntiVir Exchange with the mail domain of the queried
administrator address as the default.
• Reply address: The recipient of replies to these notifications in Avira AntiVir Exchange
notifications. The installation enters the queried administrator address as the default.
• Internal domains: The mail domains specified here are seen as internal mail domains,
while all others are considered external mail domains. This setting is used to
differentiate between incoming and outgoing emails in the Avira AntiVir Exchange rules
on the basis of the sender and recipient addresses of an email. For example, a spam
filter job will only deal with incoming emails, while AntiVir should not be applied to
outgoing emails.
Multiple domains are separated with Return. Subdomains are automatically included if
the main domain is preceded by the prefix "*."as a wildcard, e.g. *.domain.com. The
installation enters the mail domain of the queried administrator address as the default.
26
Details on the Avira AntiVir Exchange Management Console
These entries apply to all Avira AntiVir Exchange servers. The settings can be changed here at
any time.
4.3.4 Settings for an individual AntiVir Server
Select Basic Configuration, click AntiVir Server in the left-hand window and select the
required server in the right-hand window with a double-click. To create a new server, right-click
on AntiVir Server - New - AntiVir Server. Right-click on Properties and configure the
settings for the new server.
General server settings
1. Enter the name of the Exchange server.
The current Exchange server name is automatically entered during installation.
2. Define the maximum number of simultaneously processed emails in the Number of
Threads field.
The number of emails that can be reasonably processed by AntiVir depends on the
configuration and performance of your server.
3. Select the log level for the event log which can be viewed with the event viewer
(Windows Event Log).
Levels range from None to Maximum.
4. Decide on the number of days for which the emails are to remain in Bad Mail
quarantine.
The emails are automatically deleted after this number of days elapses.
27
Avira AntiVir Exchange 9
5. Define the number of days after which a job processing log is to be deleted in the Log
Note: To be able to access a newly created server immediately in the AntiVir Monitor, update
the view in the monitor (right-click on AntiVir Monitor - Update, or use the icon in the
toolbar).
Individual email addresses for an AntiVir Server
The settings for each server are taken from the properties of all AntiVir Servers that are set
automatically during installation or that have been entered individually by you. These settings
are regarded as AntiVir Server default settings.
If you need individual settings for a server, enable the option Customize address settings and
enter the addresses in the relevant fields.
folder.
28
Using proxy servers
If a proxy server is required in your network environment for Internet connections, you can
select the appropriate proxy server for every AntiVir Server. For example for downloading
updates from the Internet.
Details on the Avira AntiVir Exchange Management Console
Click the Proxy servers tab.
Proxy server settings
If you wish to connect your AntiVir Server to a proxy server, select your user-defined
appropriate proxy server from the list.
If you have already specified the connection data for the proxy server while installing Avira
AntiVir Exchange, you will see these proxy server settings under Basic Configuration -
General Settings - Proxy Servers.
Otherwise, you should enter the proxy server settings there:
• Name/IP Address: The full name or IP address of the proxy server.
Example 1: proxy.mydomain.de
Example 2: 127.0.0.1
• Port: Port number of the proxy server. The specified port is used to communicate with
the proxy server.
Example: 8000
• User and password (optional): Authentication data under which the update service
logs onto the proxy server.
Example: proxy_user
A proxy server is deleted by right-clicking and selecting Delete . Please note that you cannot
delete a proxy server that is already in use by an object.
29
Avira AntiVir Exchange 9
If the actions of the virus scanner and AntiSpam engine are to be executed by means of a proxy
server, make the appropriate settings in the proxy server tab.
User-specific access to quarantine
Avira AntiVir Exchange allows users to access their own quarantine emails.
Which emails are available and which users have access can be configured individually for each
quarantine. This function is particularly interesting in relation to spam filtering, i.e. for spam
quarantines. In addition, the administrator has less work to do because users can deliver the
individual quarantine emails themselves.
They can define whether users are permitted to access their quarantine emails and which type
of emails they can access for each individual server. The user receives a quarantine summary
report containing information on quarantined emails and, by clicking on the appropriate action
for the relevant email, thereby creating a request.
Individually configured for each quarantine, these actions are Request (deliver to recipients of
the summary report), Approve (delivery to all recipients) and/or Remove (flag email for
deletion in the quarantine). User access is by means of an email request or a HTTP request.
Click the Quarantine Access tab:.
30
Allow users to request quarantined items by email: The quarantine request is initiated by
means of an email request. If the user clicks on the action link for the required email in his
quarantine summary report, the email request is automatically generated and sent to the email
address you define in the Mailbox field on this tab.
This requires that the email address specified here should exist and that the email is sent via the
server on which Avira AntiVir Exchange, and the corresponding quarantines, are installed.
Loading...