GFI AVGREN1000-2999 Datenblatt

GFI MailSecurity 2011 for Exchange/SMTP Administration & Configuration Manual

2  GFI MailSecurity 2011 Introduction Chapter 8 Reporting Describes how to configure the reporting database to generate reports using the GFI MailS

92  GFI MailSecurity 2011 Quarantine Screenshot 71 - Quarantine folder RSS feed 4. Select Enable Quarantine RSS feeds on this folder checkbox. 5.

Quarantine GFI MailSecurity 2011  93 Subscribing to a search folder Quarantine RSS feed To subscribe to an RSS feed of a default or custom search f

94  GFI MailSecurity 2011 Quarantine Screenshot 73 - Quarantine RSS feeds Access Control Lists 3. In the IIS mode access control list dialog box y

Quarantine GFI MailSecurity 2011  95 Screenshot 74 - Directory Harvesting filter 3. Select Enable directory harvesting protection checkbox. 4. Sel

96  GFI MailSecurity 2011 Quarantine NOTE 2: When GFI MailSecurity is behind a firewall, the Directory Harvesting feature might not be able to conn

Reporting GFI MailSecurity 2011  97 8 Reporting 8.1 Introduction Use the GFI MailSecurity Reporting option to configure logging of statistical da

98  GFI MailSecurity 2011 Reporting Configuring a Microsoft Access database backend Screenshot 76 - Configuring a Microsoft Access database backen

Reporting GFI MailSecurity 2011  99 NOTE 2: For information how to create a new database in Microsoft SQL Server refer to http://kbase.gfi.com/show

Miscellaneous GFI MailSecurity 2011  101 9 Miscellaneous 9.1 Patch Checking The Patch Checking feature verifies if there are any software patches

About GFI MailSecurity GFI MailSecurity 2011  3 2 About GFI MailSecurity 2.1 GFI MailSecurity components GFI MailSecurity scan engine The GFI Mai

102  GFI MailSecurity 2011 Miscellaneous 9.2 Version Information Screenshot 79 - Version Information page To view the GFI MailSecurity version in

Miscellaneous GFI MailSecurity 2011  103 Screenshot 80 - Tracing settings 2. Select Enabled next to the feature to enable logging for, or Disable

104  GFI MailSecurity 2011 Miscellaneous 9.4.1 Reprocessing legitimate emails that fail If a large number of legitimate emails are being moved to

Miscellaneous GFI MailSecurity 2011  105 Screenshot 81 - Failed emails notification 2. Select Other tab. 3. Select Send Notifications on Failed Ma

106  GFI MailSecurity 2011 Miscellaneous when an email gets quarantined or modified. Templates There are two types of templates: Tag-based template

Miscellaneous GFI MailSecurity 2011  107 VARIABLE DESCRIPTION “itemsenderemailaddress” The sender‟s email address. “itemsubject” The quarantined em

108  GFI MailSecurity 2011 Miscellaneous Screenshot 82 - Adding VSAPI performance monitor counters 5. From the Performance object dropdown list, s

Miscellaneous GFI MailSecurity 2011  109 Screenshot 83 - Adding VSAPI performance monitor counters in Windows 2008 Server 4. From the Select count

110  GFI MailSecurity 2011 Miscellaneous The counters of added processes are now displayed in the Performance Monitor. Screenshot 84 - Monitoring

Miscellaneous GFI MailSecurity 2011  111 Virus Scan Files Scanned The total number of separate files that are processed by the virus scanner. Viru

4  GFI MailSecurity 2011 About GFI MailSecurity Incoming email is relayed to the GFI MailSecurity machine. Email is scanned by GFI MailSecurity u

Troubleshooting GFI MailSecurity 2011  113 10 Troubleshooting 10.1 Introduction The troubleshooting chapter explains how you should go about reso

114  GFI MailSecurity 2011 Troubleshooting an attachment in category <filetype 1>. The file was detected to belong to the category <filety

Glossary GFI MailSecurity 2011  115 11 Glossary Active Directory A technology that provides a variety of network services, including LDAP director

116  GFI MailSecurity 2011 Glossary Mail Exchange The DNS record used to identify the IP addresses of the domain‟s mail servers. Malware All malici

Index A Active Directory, 115 anti-virus, 69, 105 AVG, 22, 23 B BitDefender, 27, 28, 30, 32 D Database, 19, 66, 97, 98, 99 Decompression engine, 57

T Trojan, 16, 65, 66, 68, 69, 73 X XSL, 106, 107

About GFI MailSecurity GFI MailSecurity 2011  5 Virus Scanning Engines Scan emails for viruses and malicious code. Some engines also include other

Monitoring the GFI MailSecurity status GFI MailSecurity 2011  7 3 Monitoring the GFI MailSecurity status 3.1 Introduction The GFI MailSecurity Da

8  GFI MailSecurity 2011 Monitoring the GFI MailSecurity status 3.2 Status and statistical information Screenshot 3 - The GFI MailSecurity Dashbo

Monitoring the GFI MailSecurity status GFI MailSecurity 2011  9 Services Screenshot 4 - The GFI MailSecurity Services The Services area displays t

10  GFI MailSecurity 2011 Monitoring the GFI MailSecurity status Email Statistics Screenshot 6 - The GFI MailSecurity Charts The Charts area displ

Monitoring the GFI MailSecurity status GFI MailSecurity 2011  11 Unprocessed emails in this period 3.3 Email processing logs Screenshot 7 - Email

12  GFI MailSecurity 2011 Monitoring the GFI MailSecurity status NOTE: The email cannot be previewed in quarantine if it was manually deleted or it

Monitoring the GFI MailSecurity status GFI MailSecurity 2011  13 3.4 Virus scanning engine updates Screenshot 9 - Virus scanning engines updates

General settings GFI MailSecurity 2011  15 4 General settings 4.1 Introduction The Settings node enables you to configure a number of options. 

16  GFI MailSecurity 2011 General settings 4.3 Configuring proxy server settings for automatic updates GFI MailSecurity automatically searches for

General settings GFI MailSecurity 2011  17 6. Click Apply. 4.4 Adding Local Domains Screenshot 12 - Local Domains list GFI MailSecurity requires

18  GFI MailSecurity 2011 General settings 4.5 SMTP server bindings NOTE: The SMTP Server bindings tab is not available when GFI MailSecurity is i

General settings GFI MailSecurity 2011  19 4.6 Managing local users GFI MailSecurity uses 3 ways to retrieve users depending on the installation e

20  GFI MailSecurity 2011 General settings NOTE: GFI MailSecurity automatically populates the list of local users using the sender‟s email address

Configuring Virus Scanning Engines GFI MailSecurity 2011  21 5 Configuring Virus Scanning Engines 5.1 Introduction GFI MailSecurity uses multiple

http://www.gfi.com [email protected] The information and content in this document is provided for informational purposes only and is prov

22  GFI MailSecurity 2011 Configuring Virus Scanning Engines 5.2 AVG configuration Screenshot 15 - Anti-virus Scanning Engines: AVG configuration

Configuring Virus Scanning Engines GFI MailSecurity 2011  23 4. If you installed GFI MailSecurity on the Microsoft Exchange machine, you will also

24  GFI MailSecurity 2011 Configuring Virus Scanning Engines Screenshot 16 - AVG LinkScanner options 1. Navigate to GFI MailSecurity ► Virus Scann

Configuring Virus Scanning Engines GFI MailSecurity 2011  25 5.3 Kaspersky configuration Screenshot 17 - Anti-virus Scanning Engines: Kaspersky c

26  GFI MailSecurity 2011 Configuring Virus Scanning Engines NOTE: To be able to use the Information Store Virus Scanning feature, you must enable

Configuring Virus Scanning Engines GFI MailSecurity 2011  27 5.4 BitDefender configuration Screenshot 18 - Virus Scanning Engines: BitDefender co

28  GFI MailSecurity 2011 Configuring Virus Scanning Engines Scan outbound SMTP email Select this option to scan outgoing emails 4. If you installe

Configuring Virus Scanning Engines GFI MailSecurity 2011  29 5.5 McAfee configuration Screenshot 19 - Virus Scanning Engines: McAfee configuratio

30  GFI MailSecurity 2011 Configuring Virus Scanning Engines 4. If you installed GFI MailSecurity on the Microsoft Exchange machine, you will also

Configuring Virus Scanning Engines GFI MailSecurity 2011  31 5.6 Norman configuration Screenshot 20 - Virus Scanning Engines: Norman configuratio

32  GFI MailSecurity 2011 Configuring Virus Scanning Engines Scan inbound SMTP email Select this option to scan incoming emails Scan outbound SMTP

Configuring Virus Scanning Engines GFI MailSecurity 2011  33 5.7 Virus scanner actions Screenshot 21 - Virus Scanning Engine: Configuration page

34  GFI MailSecurity 2011 Configuring Virus Scanning Engines NOTE: This feature is not applicable to emails scanned using the Information Store Vir

Configuring Virus Scanning Engines GFI MailSecurity 2011  35 5.8 Virus scanner updates Screenshot 22 - Virus Scanning Engines: Configuration page

36  GFI MailSecurity 2011 Configuring Virus Scanning Engines Check for updates and download Select this option if you want GFI MailSecurity to chec

Configuring Virus Scanning Engines GFI MailSecurity 2011  37 5.10 Configuring Virus Scanning optimizations From the GFI MailSecurity ► Virus Scann

38  GFI MailSecurity 2011 Configuring Virus Scanning Engines Screenshot 25 - Information Store Protection node 2. In the Information Store Virus S

Configuring Virus Scanning Engines GFI MailSecurity 2011  39 Screenshot 26 - VSAPI scan settings 2. Select the VSAPI Settings tab. 3. (Optional) S

40  GFI MailSecurity 2011 Configuring Virus Scanning Engines This is the default and recommended mode of operation, since in general the delay asso

Configuring other mail filters GFI MailSecurity 2011  41 6 Configuring other mail filters Apart from virus scanning engines, GFI MailSecurity also

Contents 1 Introduction ... 1 1.1 Intro

42  GFI MailSecurity 2011 Configuring other mail filters 6.1.2 Creating a Content Filtering rule Step 1: Configuring basic rule settings 1. Naviga

Configuring other mail filters GFI MailSecurity 2011  43 4. To block emails encrypted using PGP technology, select Block PGP encrypted emails. NOTE

44  GFI MailSecurity 2011 Configuring other mail filters Screenshot 30 - Content Filtering: Body Tab- configuring other options 5. From the Option

Configuring other mail filters GFI MailSecurity 2011  45 Screenshot 31 - Content Filtering: Subject Tab 7. Select Enable subject content filtering

46  GFI MailSecurity 2011 Configuring other mail filters Quarantine email Stores emails containing the keyword(s) in the Quarantine Store. You can

Configuring other mail filters GFI MailSecurity 2011  47 Screenshot 32 - Content Filtering: Users/Folders Tab 2. Specify the users to apply this r

48  GFI MailSecurity 2011 Configuring other mail filters NOTE: You do not need to input the full name of the users, groups or public folder. It is

Configuring other mail filters GFI MailSecurity 2011  49 Deleted rules are not recoverable. 1. Navigate to the GFI MailSecurity ► Scanning & F

50  GFI MailSecurity 2011 Configuring other mail filters Screenshot 35 - Attachment Filtering page To configure attachment rules, navigate to GFI

Configuring other mail filters GFI MailSecurity 2011  51 6.2.2 Creating an Attachment Filtering rule 1. Navigate to GFI MailSecurity ► Scanning &a

5.4 BitDefender configuration ... 27 5.5 McAfee configuration ...

52  GFI MailSecurity 2011 Configuring other mail filters 4. Select whether to scan inbound and/or outbound emails. Check inbound emails Select this

Configuring other mail filters GFI MailSecurity 2011  53 Screenshot 37 - Attachment Filtering: Actions Tab 7. Click the Actions tab to configure w

54  GFI MailSecurity 2011 Configuring other mail filters NOTE: When GFI MailSecurity is installed on same machine as Microsoft Exchange 2003, GFI M

Configuring other mail filters GFI MailSecurity 2011  55 14. To add email users, user groups and/or public folders to the list, click Add. Screens

56  GFI MailSecurity 2011 Configuring other mail filters 6.2.4 Removing attachment rules Screenshot 40 - Selecting an attachment Filtering rule f

Configuring other mail filters GFI MailSecurity 2011  57 6.2.6 Changing the rule priority Attachment Filtering rules are applied in the same order

58  GFI MailSecurity 2011 Configuring other mail filters 6.3.2 Configuring the decompression engine filters To configure any decompression engine

Configuring other mail filters GFI MailSecurity 2011  59 Notify administrator Notify the administrator whenever this engine blocks an email. To con

60  GFI MailSecurity 2011 Configuring other mail filters  The file name only (including .txt extension). The log file will be stored in the follo

Configuring other mail filters GFI MailSecurity 2011  61 NOTE: When GFI MailSecurity is installed on same machine as Microsoft Exchange 2003, GFI M

7 Quarantine ... 77 7.1 Introduction ..

62  GFI MailSecurity 2011 Configuring other mail filters This filter allows you to block or delete emails with archives that exceed the specified p

Configuring other mail filters GFI MailSecurity 2011  63 Screenshot 45 - Configuring the amount of files in archive check This filter allows you t

64  GFI MailSecurity 2011 Configuring other mail filters address. Notify local user Notify the email local recipients about the blocked email. 9. T

Configuring other mail filters GFI MailSecurity 2011  65 6.3.3 Enable/disable decompression filters Screenshot 46 -Disabling Decompression tool f

66  GFI MailSecurity 2011 Configuring other mail filters of the executable to a database of malicious actions and rates the risk level of the file.

Configuring other mail filters GFI MailSecurity 2011  67 Check outbound emails scan outgoing emails for Trojans and malicious executable files. 4.

68  GFI MailSecurity 2011 Configuring other mail filters  Path and file name (including .txt extension) to a custom location on disk where to sto

Configuring other mail filters GFI MailSecurity 2011  69 11. In Download/check after the specified number of hours text box, specify how often you

70  GFI MailSecurity 2011 Configuring other mail filters Screenshot 50 - Email Exploit Engine: General Tab 3. From the General tab, select whether

Configuring other mail filters GFI MailSecurity 2011  71 Screenshot 51 - Email Exploit Engine: Actions Tab 4. In the Actions area select one of th

10 Troubleshooting ... 113 10.1 Introduction ...

72  GFI MailSecurity 2011 Configuring other mail filters 7. You can configure GFI MailSecurity to download Email Exploit Engine updates automatical

Configuring other mail filters GFI MailSecurity 2011  73 10. In Download/check after the specified number of hours text box, specify how often you

74  GFI MailSecurity 2011 Configuring other mail filters Screenshot 53 - Email Exploit list 2. Select the check box of the exploit(s) that you wan

Configuring other mail filters GFI MailSecurity 2011  75 Why remove HTML scripts? The introduction of HTML email has allowed senders to include scr

76  GFI MailSecurity 2011 Configuring other mail filters Screenshot 55 - HTML Sanitizer Whitelist page The list of whitelisted senders is displaye

Quarantine GFI MailSecurity 2011  77 7 Quarantine 7.1 Introduction The GFI MailSecurity Quarantine is a central repository where all emails that

78  GFI MailSecurity 2011 Quarantine Screenshot 56 - Quarantine Store status page Content search From the Quick Search area of the Quarantine page

Quarantine GFI MailSecurity 2011  79 text in the subject. Search in quarantine reason Specify a keyword or phrase to find quarantined emails that c

80  GFI MailSecurity 2011 Quarantine Screenshot 58 - New Search Folder - selecting the source 4. If GFI MailSecurity is installed on the Microsoft

Quarantine GFI MailSecurity 2011  81 Screenshot 60 - New Search Folder - searching by keywords 6. In the Keywords search area specify the search c

Introduction GFI MailSecurity 2011  1 1 Introduction 1.1 Introduction to GFI MailSecurity Email is frequently used as a means for distributing ha

82  GFI MailSecurity 2011 Quarantine Screenshot 62 - New Search Folder - filtering by date 8. A search folder can also filter emails by date. From

Quarantine GFI MailSecurity 2011  83 2. Click Edit search folder and make the required changes to the search folder properties. 3. Click Save folde

84  GFI MailSecurity 2011 Quarantine Screenshot 64 - List of Quarantined Emails in Search Folder 2. Select the checkbox next to the quarantined em

Quarantine GFI MailSecurity 2011  85 Screenshot 65 - List of Quarantined Emails in selected Search Folder 2. Select the checkbox next to the quara

86  GFI MailSecurity 2011 Quarantine 7.2.6 Viewing the full security threat report of an email To view the full security threat report of a quaran

Quarantine GFI MailSecurity 2011  87 7.2.7 Downloading quarantined email Emails in Quarantine Store may contain malicious content. Use this featu

88  GFI MailSecurity 2011 Quarantine Screenshot 67 - Quarantine Options configuration page 2. In the Quarantine mode page, select Send quarantine

Quarantine GFI MailSecurity 2011  89 Screenshot 68 - The Quarantine Action Form When a Quarantine Action Form is received, review it and select on

90  GFI MailSecurity 2011 Quarantine 7.3.3 Logging quarantine actions GFI MailSecurity provides the option to store a log of actions taken on quar

Quarantine GFI MailSecurity 2011  91 7.4.1 Enabling Quarantine RSS Feeds 1. Navigate to GFI MailSecurity ► Quarantine ► Quarantine RSS Feeds. Scr