Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 345 / 861

344 Preventing attacks
Protecting your network resources from virus infections
Responding to virus detections
You can specify how you want the security gateway to respond to virus detections for the SMTP, POP3,
HTTP, and FTP protocols. Depending on the protocol and the response option that you choose, you can
also notify the user when a virus has been detected and what action the security gateway has taken
with the infected file. All virus detections and their responses are logged.
The response options are as follows:
■
Insert x-virus header
Adds an x-virus header to an email message and forwards the email and any attachments to the
recipient.
The Insert x-virus header option does not repair or delete virus-infected email.
This option is available only for SMTP and POP3 protocols. This option is rarely used, but available
for geographical regions or locations that do not allow modifying the contents of an email
message.
■
Delete
Deletes the infected file without attempting to repair it. If the virus-infected file is in a container
(such as a zip file), the security gateway removes the infection and rebuilds the container.
You can replace the deleted, infected file with a text file that notifies the recipient that an infected
file was deleted. You can customize the text file message. This provides extra security by removing
the infected file even if the file could be repaired.
■
Repair or delete
Attempts to repair the infected file. If the file cannot be repaired, the security gateway deletes the
infected file.
You can configure the email message to notify the user that an infected file was repaired. You can
customize the message. This is the most frequently used option.
For more information about response options, see the following:
■
“Monitoring log files” on page 470
■
“Inserting an x-virus header into an email message” on page 344
■
“Automatically deleting infected files” on page 345
■
“Repairing or deleting infected files” on page 346
Inserting an x-virus header into an email message
If your organization is a member of the European Union (EU) or wants to address privacy concerns
about modifying, repairing, or deleting emails, you can configure the security gateway to only add an x-
virus header to infected emails. This option is only available for the SMTP and POP3 protocols.
Warning: The Insert x-virus header option does not repair or delete virus-infected email.
The security gateway only adds the virus found header if it detects a MIME message. If it detects a
malformed MIME message, it does not add the header and informs the proxy that a malformed MIME
message exists.
A partial example of an x-virus header that displays at the top of an email is as follows (see Table 9-2
for a description of the x-virus header definitions):
Subject: <Your email subject>
Importance: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MSMail-Priority: Normal
X-Priority: 3 (Normal)