ESET NOD32 ANTIVIRUS POUR MS EXCHANGE User manual

ESET NOD32 Antivirus

for MS Exchange Server

Installation

w e p r o t e c t d i g i t a l w o r l d s

No part of this document may be reproduced or transmitted

in any form or by any means electronic or mechanical, for

any purpose without the express written permission of

ESET, spol. s r. o. Information in this document is subject to

change without prior notice.

Certain names of program products and company names

used in this

document might be registered trademarks or trademarks

owned by other entities.

ESET, NOD32 and AMON are trademarks of ESET, spol. s r. o.

Microsoft and Windows are registered trademarks of

Microsoft Corporation.

ESET, spol. s r. o.

Svoradova 1, 811 03 Bratislava, Slovak Republic

http://www.eset.sk/en

Technical Support Worldwide:

http://www.eset.com/support

Technical Support for Europe:

http://www.eset.eu/support

REV.20071114-002

ESET NOD32 Antivirus for MS Exchange Server

1. Introduction

ESET NOD32 Antivirus for MS Exchange Server is ESET

NOD32 Antivirus version designed for scanning e-mail

trac routed by the MS Exchange Servers.

The major dierences between the ESET NOD32 Anti-

virus 2.7 and the ESET NOD32 Antivirus for MS Exchange

Server include a module XMON and the absence of IMON

and EMON modules.

This document describes the XMON module. Before

reading this document, please read the ESET NOD32 Anti-

virus 2.7 user guide rst.

As of version 2.71, the XMON module provides antivi-

rus protection for MS Exchange Server in two avors – a

32-bit for MS Exchange Server 5.5 SP3 and higher, 2000

SP 1 and higher and 2003 (xmon.dll), and a 64-bit for MS

Exchange Server 2007 (xmon64.dll).

The XMON module checks the MS Exchange Server e-

mail communication via its antivirus interface VSAPI or

external Control Center scanning core.

2. Installation

If you are running any previous version of the ESET

NOD32 Antivirus for Exchange Server, the new one can be

installed over (if it is version 2.0 or higher).

The installation wizard will help you to install the

NOD32 for MS Exchange Server. It displays the following

dialog:

If you want to install XMON, check the Activate an-

tivirus protection for MS Exchange Server (XMON) chec-

kbox. To activate the XMON service, you need the license

le provided by the provider or distributor upon purchase

of the program.

The license le is entered in the next step. If your Li-

cense le is valid, click Add and list the license le.

This screen is present in all installation scenarios.

Additional Activation of XMON:

If you have not activated the antivirus protection for

MS Exchange server, you can do it additionally by adding

the license le in the License manager. For License mana-

ger click on ESET NOD32 Antivirus system tools in the ESET

NOD32 Antivirus Control Center and choose ESET NOD32

Antivirus system setup/ setup. After adding the license

le, XMON will be activated.

ESET NOD32 Antivirus for MS Exchange Server

3. XMON

The Main Window

To open the XMON main window, click on the XMON

icon in the Control Center window. If the XMON is displa-

yed in grey color, the MS Exchange Server is not present

on the local computer or the MS Exchange server version

is not supported by XMON. XMON is displayed in grey co-

lor also if the XMON module is not activated (it is not set,

or the license le has expired). In these cases XMON can-

not scan e-mails. If the XMON is displayed in red color; the

XMON module is not active. To activate the XMON, check

the Activate Control checkbox in the main window.

The main XMON window shows the number of scan-

ned, infected and cleaned les (a le is each e-mail mess-

age and its attachments).The main window also displays

MS Exchange version running on the local server and the

virus signature database version (with the date of the last

update in the parentheses).

• Active control – check box for XMON activation.

To activate the XMON, mark the check box. To disable it,

uncheck it. Before XMON deactivation you will be reques-

ted to conrm its shutdown.

• Settings – enables you to alter the default XMON

settings

• Run NOD32 – activates the NOD32 on−demand

scanner

Before XMON deactivation you will be requested to

conrm its shutdown. If you really want to turn o XMON,

press Yes.

Note: MS Exchange Server communicates with the antivirus scan

using the system database registry which is being checked

in approximately one minute intervals Turning XMON on and

o as well as any change in the settings will take about a

minute to take eect

SETTINGS

The left part of the XMON Settings window shows

eight possible setting areas of XMON. The setting para-

meters in each setting area are shown in the right part

of the window.

The MS Exchange server checks the settings of the

XMON module each minute, so the new XMON settings

come into eect after a few seconds.

Scanner

The Scanner page shows the following properties:

• Background scanning – if checked, all the mess-

ages are scanned in the background. XMON keeps track of

what messages it scanned and the version of virus data-

base it used. If you are opening a message not scanned

by the most current virus database, XMON scans it before

opening it in your e-mail client. The background testing

means that XMON keeps scanning all the messages from

ESET NOD32 Antivirus for MS Exchange Server

the Exchange server, so when you are about to open the

message, it has already been scanned. Background scan-

ning can inuence system load (scanning is done by each

virus signature database update).When scanning the sto-

re database in the day mode, the system might be slowed

down. In this case we recommend using scheduled scan-

ning outside working hours. By scheduled scanning, the

option has to be disabled.

• Proactive scanning – new inbound messages are

scanned in the order they are received. If this checkbox is

marked and a user opens a message that has not been

scanned yet, this message is scanned before the other

messages waiting in the scanning queue.

• Scan plain text message bodies – enables scan-

ning plain text messages

• Scan RTF message bodies – enables scanning

RTF message bodies. The RTF message bodies may con-

tain macroviruses

• Scan transported messages – When checked,

XMON scans also messages that are not stored on the lo-

cal MS Exchange server and are delivered to other e-mail

servers through the local Exchange server. The MS Ex-

change Server can be set as a gateway and used just to

deliver messages to the other e-mail servers. If Scan of

the transported messages is turned on, XMON scans also

these messages.

• Repeat scanning button – By clicking the Repeat

scanning button all the messages stored on the local MS

Exchange server are scanned again. Upon each virus data-

base update the XMON scans all the messages stored on

the Exchange server again as well. It is useful for example

after changing the rules.

• Default button – By clicking the Default button,

all the properties on Scanner page are set to default (fac-

tory settings).

When clicking the Default button, a conrmation

window will allow you to conrm or reject your selection.

By clickingYes, you will activate the default settings.

Detection

The Detection page contains the settings of detecti-

on methods.

The ThreatSense Scanning Engine options section al-

lows you to set the methods for detection of inltrations

used in XMON module. For highest security level check all

of them.

• Signatures – when checked, XMON uses the sig-

nature based inltration detection

• Heuristics – when checked, XMON uses heuristic

method based inltration detection (analysis of le con-

tent)

• Advanced Heuristics – when checked, XMON

uses Advanced Heuristics based inltration detection.

Advanced Heuristics is a new unique set of ESET NOD32

Antivirus system, among others capable of eective dete-

cting internet worms.

• Adware/Spyware/Riskware – when checked,

XMON detects also this kind of bothering malware

• Potentially unsafe applications - this classica-

tion is used for commercial legitimate software. It inclu-

des programs such as remote access tools, password-crac-

king applications, and keyloggers (programs recording all

keystrokes).

• Potentially unwanted applications - Potenti-

ally unwanted applications are not necessarily intended

ESET NOD32 Antivirus for MS Exchange Server

to be malicious, but they may aect the performance of

your computer. Such applications usually require consent

for installation. If they are present on your computer, your

system behaves dierently (when compared to the state

before their installation).

In the Target section check the types of attachments

to be scanned (Archives, Self-extracting archives, Run-

time archives). When scanning archives the scanning

procedure is more time consuming, because the archive

must be opened for scanning.

Extensions

The Extensions page enables you to set which le typ-

es should be included in virus scanning.

• Scan all les – marking this check box, XMON will

scan all les types found in message attachments.The le

types list will show le types excluded from scanning in-

stead of les included in scanning.

• Add – enables you to add a new le extension to

the le extension list. It displays Add new extension win-

dow. To add a new extension use alphanumerical charac-

ters and wildcards such as“?”(represents random charac-

ter) and“*”(represents random order of characters).

• Remove – removes the selected le extension

from the list

• Default – restores the default extension list set-

ting

• Scan extension−less les - adds scanning les

without extensions

Add a new extension (you can also use wildcards “?”

and“*”) and click OK.

Actions

The Actions page lets you select what actions should

be taken upon virus detection. When scan archives option

in Detection in the Targets section is activated, this pane

contains separate settings for archives and les. The type

can be chosen in the pull-down menu.

The When virus is found settings let you select what

action should be taken upon virus detection.

• Clean – XMON attempts to clean the virus from

the infected le.When the attempt fails, the action selec-

ted in theWhen virus cannot be cleaned settings is execu-

ted.

• No action, mark as infected – when selected

the Exchange server is notied about the infection and

the user cannot open the infected message attachment.

• Rename attachment/ delete message –

XMON changes the attachment extension, so that it can-

not be opened or run. If the message body contains a vi-

rus, the message will be deleted.

• Delete – XMON deletes the infected message or

the attachment if only the attachment is infected. The

ESET NOD32 Antivirus for MS Exchange Server

deletion process can be adjusted in the Deleting setting

page.

• Quarantine – when checked, the infected mess-

ages will be stored in Quarantine, where it is harmless.

Messages stored in Quarantine can be analyzed and cle-

aned later using a newer virus signature database.

When virus cannot be cleaned setting is executed, if

Clean option in previous menu is set. Some of the infe-

ctions cannot be cleaned, because the XMON does not

have a cleaning procedure for them, or because they do

not contain any useful content except virus (currently the

most common case). The When virus cannot be cleaned

settings lets you select what action should be taken when

attempt to clean an infected message fails. (No action,

Mark as infected, Rename attachment/ Delete messa-

ge, Delete, Quarantine)

Rules

The Rules settings let you select detailed rules for

handling le types. If there is more than one rule for a sin-

gle le type, the rst rule in the list is applied.

Rules are prior to extensions set in Extensions set-

tings, meaning that the each le is at rst compared to

existing rules. It will be scanned only if no rule is applied

(or if the respective rule says that it has to be scanned).

The number of rules applied is displayed in the Number

column.

• Add– enables you to add a new rule

• Modify– modies the selected rule

• Remove– removes the selected rule

• Move up – moves up the selected rule and incre-

ases its priority

• Move down – moves down the selected rule and

decreases its priority

Adding a new rule will open a wizard, which guides

you through the process.

• Mailbox – the rule applies to the name of a mail-

box

• Sender of message – the rule applies to a mess-

age sent by the selected sender.

• Subject of message – the rule applies to a mess-

age with the selected subject line

• File name mask – File name mask enables you to

select a certain le selection

• File size – File size enables you to select les from

certain size

In the strings in the Sender of message and Subject

of message it is enough to ll in only a part of a text (if

the Match whole words only option is not checked); capi-

tal letters are not dierentiated (if the option Dierenti-

ate capital letters is not checked). When using other than

alphanumerical characters, use parentheses and quotes.

You can also create conditions using logical operators

AND, OR, NOT.

ESET NOD32 Antivirus for MS Exchange Server

File name mask enables you to select a certain le se-

lection using a mask created from alphanumerical chara-

cters and wildcards“?”and“*”, e.g.“*.VBS”.The rule is ap-

plied to les matching this mask. To use more than one

mask, separate them by a semicolon.

File size limit enables you to select certain size of at-

tachments. The rule will be applied to all attachments

with the size exceeding the dened value.

Rule applies to a name of a mailbox and all other pro-

cedures connected with its usage are the same as with the

other rules.

The Action section lets you select what actions should

be taken with les matching the above mentioned search

criteria.

• Scan for viruses as – XMON will scan for viruses

in selected le

• No action – XMON declares the message to be cle-

• Rename attachment/ delete message –

XMON alters the le extension so that it cannot be ope-

ned or run

• Delete – XMON deletes the selected message

• Mark as infected – XMON marks the selected

message as infected

• Quarantine –The selected message will be stored

in Quarantine

Finally, add the rule name and description to be saved

in the Exchange server log when the rule is applied.

Deleting

The Deleting page lets you select what action should

be made when a message or attached le is selected for

deletion.

ESET NOD32 Antivirus for MS Exchange Server

When deleting message settings lets you select what

actions should be taken when the whole message is mar-

ked for deletion.

• Delete message body – XMON deletes the body

of the infected message. The recipient will receive the

empty message and also non−infected attachments

• Overwrite message body with virus protocol

– XMON overwrites the message body with a virus proto-

col or a rule description.

• Delete whole message – XMON deletes the

whole message including all attachments

When deleting attachments settings lets you select

what action should be taken when a message is marked

for deletion.

• Truncate le to zero size – XMON truncates the

attachment to zero size and lets the recipient see the at-

tachment le name and type.

• Replace le with virus protocol – XMON repla-

ces the infected le with a virus protocol or rule descripti-

• Delete whole message – XMON deletes the

whole message along with all its attachments

Note: If you can not open the Deleting selection it is displayed in

grey it is not supported by your MS Exchange Server version

Performance

The Performance page lets you select performance

parameters for XMON.

• Use NOD32 Control Center scanner - Unlike

all the previous versions that would explicitly use the in-

ternal scanning core for antivirus scanning, version 2.71

brings an option to utilize external Control Center scan-

ning core as well. With 32-bit versions of MS Exchange

Server this feature is optional and it is possible to select

it in the Performance section of the XMON setup.With the

64-bit version of MS Exchange Server it is only possible to

utilize the external Control Center scanning core. Therefo-

re this option is automatically selected and grayed out.

• Number of threads – this parameter lets you

select how many threads should be used for virus scan-

ning. More threads on multiprocessor machines can in-

crease the scanning rate. MS Exchange server provider re-

commends using the following formula to determine the

number of threads used: Number of physical processors

times 2 plus 1 = number of threads used.

• Time limit (for Exchange 5.5) – sets the time in-

terval for running the virus scanner

• Time limit (for Exchange 2000 and higher) – a

time limit for scanning an individual le

• Folder to store temporary les - For the best

performance, we recommend that you congure XMON

to store temporary les on a physical drive other than

the one with the Exchange store. If no folder is specied,

XMON will create temporary les in the system tempora-

ry folder.

Background scan scope option

MS Exchange Server 2007 provides a way to actively

aect antivirus scanning in the background.Therefore the

64-bit XMON module version oers an option to congu-

re the progress and scope of background scanning. Howe-

ver, this option is not available in 32-bit versions of MS

Exchange Server and the XMON module; therefore the ap-

propriate controls are inactive and grayed out

Selecting Scan only messages with attachment will

limit the background scanning scope only to messages

with an attachment. This will also decrease the overall

server load while scanning in the background.

Please note that not all infected messages necessari-

ly come with an attachment. However, this will, not de-

crease protection of the messages in the MS Exchange

ESET NOD32 Antivirus for MS Exchange Server

Server store, as messages are also checked when acces-

sed by the user.

Another way to reduce the overall system load is pro-

vided by the Scan level option. When enabled, only mess-

ages from the specied time interval determined by the

date of message receipt will be scanned on the backg-

round. It is possible to choose between scanning of all

messages regardless the date of receipt, messages rece-

ived within the last year, 6 months, 3 months, one month

or week. Choosing the appropriate background scan level

will enable administrators of MS Exchange Server 2007 to

tune up the system performance to their needs. Also in

this case messages not falling into the specied time in-

terval are not left without antivirus protection, yet they

are checked when accessed by the user.

Given the high detection eciency provided by the

ESET NOD32 Antivirus for MS Exchange Server scanning

core, we recommend the following: After the initial instal-

lation of ESET NOD32 Antivirus for MS Exchange Server, let

the scanning run in the background with no restrictions.

After certain time (1 - 2 days) tune up background scan-

ning according to the estimated frequency of users acces-

sing older messages and the volume of messages received

within the specied time interval.

Protocol

The Protocol settings page lets you select how the vi-

rus scanning protocol/log should be assembled. More de-

tailed protocol can contains more information, but it can

slow down the server.

• Log all les – when checked, all scanned les are

listed in the scanning log, including non−infected les

• Synchronous logging – when checked, all the

log entries are immediately written into the log le wi-

thout storing them in the log cache

• Scope – This setting lets you select what the sco-

pe of logging activities. The more detailed the scope, the

more activities are written into the log le

• Log server version – when checked, XMON wri-

tes the server version into the log le

•Log license – when checked, XMON writes the

XMON license into the log le

• Log rules – when checked, XMON writes the list of

currently enabled rules into the log le (only in detailed

one)

4.Recommended settings:

• Excluding Exchange les from resident

protection scanning

XMON scans e-mail messages stored in the MS Ex-

change Server storage. This storage is saved on the ser-

ver le system as a single le and using non-standard set-

tings in AMON (on-access scanner) while running on the

same server, might lead to a collision between XMON and

AMON. To avoid the collision make sure that the AMON

module is not set to scan .EDB, .TMP and .EML le typ-

es. By default, the mentioned extensions are excluded

from scanning. It is also recommended to exclude from

scanning directories containing following les and di-

rectories:

%ProgramFiles%\Exchsrvr\MDBData\

%ProgramFiles%\Exchsrvr\Mtadata\

%ProgramFiles%\Exchsrvr\Server_Name.log

%ProgramFiles%\Exchsrvr\Mailroot

%ProgramFiles%\Exchsrvr\Srsdata

%SystemRoot%\System32\Inetsrv

%ProgramFiles%\Exchsrvr\IMCData

ESET NOD32 Antivirus for MS Exchange Server

This manual suits for next models

Table of contents

Other ESET Software manuals

ESET

ESET NOD32 ANTIVIRUS 4 - FOR MICROSOFT WINDOWS... User manual

ESET

ESET NOD32 ANTIVIRUS - FOR KERIO User manual

ESET

ESET NOD32 ANTIVIRUS - FOR KERIO User manual

ESET

ESET SMART SECURITY 4 User manual

ESET

ESET GATEWAY SECURITY - FOR LINUX BSD AND SOLARIS User manual

ESET

ESET CYBERSECURITY - ANNEXE 794 User manual

ESET

ESET SMART SECURITY 4 - V4.2 Quick start guide

ESET

ESET FILE SECURITY - ANNEXE 22 User manual

ESET

ESET NOD32 ANTIVIRUS - FOR KERIO User manual

ESET

ESET NOD32 ANTIVIRUS - FOR KERIO User manual

ESET

ESET NOD32 ANTIVIRUS - FOR LINUX-BSD FILE SERVER User manual

ESET

ESET MOBILE ANTIVIRUS - ANNEXE 480 User manual

ESET

ESET MOBILE SECURITY - ANNEXE 706 SYMBIAN User manual

ESET

ESET NOD32 ANTIVIRUS - FOR KERIO User manual

ESET

ESET REMOTE ADMINISTRATOR 4 User manual

ESET

ESET NOD32 ANTIVIRUS - FOR KERIO User manual

ESET

ESET NOD32 ANTIVIRUS - FOR KERIO User manual

ESET

ESET GATEWAY SECURITY User manual

ESET

ESET NOD32 ANTIVIRUS 4 - FOR MICROSOFT WINDOWS... User manual

ESET

ESET REMOTE ADMINISTRATOR V2 User manual

ESET

ESET MOBILE ANTIVIRUS - FOR WINDOWS MOBILE User manual

ESET

ESET NOD32 ANTIVIRUS - FOR KERIO User manual

ESET

ESET NOD32 ANTIVIRUS - FOR MICROSOFT WINDOWS... User manual

ESET

ESET MOBILE SECURITY - FOR SYMBIAN User manual

Popular Software manuals by other brands

COMPRO

COMPRO COMPROFM manual

Muratec

Muratec OFFICEBRIDGE ONLINE user guide

Oracle

Oracle Contact Center Anywhere 8.1 installation guide

Adobe

Adobe 65007312 - Photoshop Lightroom Programmer's guide

Avaya

Avaya NULL One-X for RIM Blackberry user guide

HP ProLiant BL420c user guide

PS Audio

PS Audio PowerPlay Programming manual

Brady

Brady LOCKOUT PRO 3.0 Administrator's guide

Avaya

Avaya Interaction Center user guide

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Guide book

Novell

Novell GROUPWISE 8 - INTERNET AGENT manual

Oracle

Oracle Application 9i Configuration guide

Acer

Acer RDM user guide

Canon

Canon Vixia HF21 instruction manual

Canon

Canon ZR950 instruction manual

Samsung

Samsung Auto Backup user manual

Polycom

Polycom Vortex EF2201 Application note

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c user manual