Kerio Connect Administration

Antivirus

For more information about using an antivirus with Kerio Connect, refer to the manual.

Antispam filters can be set and managed under Configuration → Content Filtering → Antivirus:

Use integrated McAfee antivirus module

Kerio Technologies offers Kerio Connect with or without the integrated McAfee antivirus. To make the McAfee Anti-Virus available, to appropriate license is required.

The external McAfee Anti-Virus is not supported by Kerio Connect.

Use an external antivirus

External antiviruses can be used either separately or in combination with the integrated McAfee antivirus.

This option opens a menu with antivirus programs. The antivirus software must be installed on the Kerio Connect host prior to making a selection (we recommend stopping the Kerio Connect Engine before the antivirus installation).

The installed antivirus may not be run automatically. In such case, use the Options button to specify advanced settings of the external antivirus program.

Warning

If the external Symantec Scan Engine is selected, it is necessary to define the IP address and port of the computer used by the antivirus in the Options dialog box.

Check for update every [hours]

(This option can be check only if your Kerio Connect includes integrated McAfeeantivirus engine.) Interval for automatic update of the antivirus database and of the antivirus itself (in hours). Information about updates can be found in the security log (see chapter Logs).

To enable automatic updates well-working connection to the Internet must be provided. Automated dialing is not supported. In case of dial-ups we recommend you to perform updates by hand (see below).

Virus definition updates are downloaded via HTTP. If the Kerio Connect is behind a firewall or proxy server, you must allow for outbound communication over an appropriate TCP port (from the computer with Kerio Connect installed).

Click Update now to start the update of the virus database and antivirus software manually. When this button is pressed, the update progress window is displayed.

Current virus database was updated before

The time that has elapsed since the last successful update of the virus database (with an accuracy of minutes).

Last update check performed ... ago

The time elapsed from the last successful update attempt. The fact whether a new version has been available on the server is irrelevant.

Warning

If the time is significantly (several times) greater than the interval set for automatic update, then the automatic updates are not working correctly. In this case we recommend updating the database manually and to inspect the error and security logs for a failure explanation.

The following parameters define what will happen to email where a virus or a damaged attachment is found.

Discard the message

The message will be removed.

Deliver the message with the attachment removed

The message will be delivered to the recipient without the blocked attachment. Instead, a server message will be attached saying that the attachment has been removed.

Forward the original message to administrator address

The message will be forwarded (intact — with possibly infected or forbidden attachment) to the email address specified. It is not important whether the address is local or remote.

Forward the filtered message to administrator address

The message without an infected or prohibited attachment will be (apart from the actions selected below) forwarded to the specified email address as well. This can be used for verification of proper functionality of the antivirus and/or attachment filter.

This section defines actions to be taken if one or multiple files attached to a message cannot be scanned for any reason (e.g. password-protected archives). The following actions can be taken:

Deliver the original message with a prepended warning

The message (actually, the attachment in question) will be delivered without having been ckecked. The user will be warned that the message may still contain viruses.

Reject the message as if it was a—virus

The system will react the same way as when a virus was detected (i.e. the message will be delivered without any attachment or rejected). This option is safe, but sending password-protected archives is virtually impossible.