Administrator's Guide - Kerio Software Archive

Chapter 17 Antivirus Control of Email And Attachment FilteringThe installed antivirus may not be run automatically. In such case, use the Options button tospecify advanced settings of the external antivirus program.Warning: If the external Symantec Antivirus Scan Engine is selected, it is necessary to definethe IP address and port of the computer used by the antivirus in the Options dialog box.The following conditions must be met so that the antivirus is properly run:• The antivirus must be installed on the same computer where Kerio MailServer is running.• The antivirus license must meet the conditions of the producer (usually the same or highernumber of users of the licensed version of Kerio MailServer or a special server license).The interface between Kerio MailServer and an antivirus program consists of special modules(one for each antivirus). The mailserver administrator must select the appropriate modulefor the antivirus to be used. If a module is selected and the corresponding antivirus is notinstalled of does not work properly, Kerio MailServer does not allow saving these settings.The message stating that the antivirus control is not functional appears in the Error log.Note: There are two exceptions to this behavior: incorrectly transferred configuration of KerioMailServer (for more information, see chapter 28.2), or less licenses of antivirus than thelicenses of Kerio MailServer. In such cases, Kerio MailServer will work normally, but it willnot be able to send messages. This is because Kerio MailServer wants to perform an antiviruscheck after receipt, but the antivirus does not work. The message stating that the antiviruscontrol is not functional appears in the Error log.In order for Kerio MailServer and antivirus program to cooperate properly, specify an exceptionfor the store directory (or also for the *.eml files in case of older versions of someantiviruses), so that the messages are not checked by the antivirus engine.If the resident shield was set incorrectly, a dialog box is opened. The resident shield alsodetects the eicar.com file (a testing antivirus generated by Kerio MailServer to check forproper settings of an exception in the resident shield).17.3 Examples of configuration of external antivirus modulesKerio MailServer supports several external antivirus programs for Windows, Mac OS X andLinux operating systems from different vendors (e.g. NOD32, Grisoft, Sophos Antivirus, etc.).For the most current list of supported antivirus vendors refer to the Kerio Technologies websiteat http://www.kerio.com/.Here, you can find notes on peculiarities and possible configurations of external antivirusapplications:Symantec Scan EngineOne of the supported antivirus applications is Symantec Scan Engine by Symantec. SinceKerio MailServer 6.1.2, the traffic protocol for communication between Kerio MailServer andSymantec Scan Engine versions 4 and 5 has been changed. The applications now use ICAP198