Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 346 / 861

345 Preventing attacks
Protecting your network resources from virus infections
X-Virus:1
Message-ID: <34222396612167.52632qmailV06.58@<ISP address>
MIME-Version: 1.0
Content-Type: multipart/mixed;
Prerequisites
None.
To insert an x-virus header into an email message
1 In the SGMI, in the left pane, under Policy, click Antivirus .
2 In the right pane, on the Response tab, do one or more of the following:
■
In the SMTP drop-down list, click Insert x-virus header .
■
In the POP3 drop-down list, click Insert x-virus header .
3 Optionally, do one of the following:
■
To save your configuration now and activate later, on the toolbar, click Save .
■
To activate your configuration now, on the toolbar, click Activate .
When prompted to save your changes, click Yes .
4 To apply these settings, create a rule and enable the appropriate actions on the Antivirus tab.
Related information
For further information related to this topic, see the following:
■
“Antivirus—Response tab” on page 635
■
“Adding antivirus protection to a rule” on page 347
Automatically deleting infected files
You can configure the security gateway to automatically delete infected files without attempting to
repair the infection. You can also include a message in the body of the email to notify the user that an
infected file was deleted.
The SMTP and POP3 protocols replace the deleted, infected file with a text message file. The text file
that is inserted is called deleted%.txt, where % is a sequence number. For example, if two attachments
are deleted, the replacement files are called deleted1.txt and deleted2.txt. The security gateway lets
you customize the message.
The FTP and HTTP protocols display a message when an infected file is deleted, which you can
customize. However, this message only displays when the deleted file was within a container file. This
is because there must be a remaining file on which to append the message. For example, if the virus is
in a container file (such as a .zip file), when the scanner removes the infected file, it rebuilds the
container. The replacement message text is appended to the container file. But if the virus is not in a
container, when the scanner deletes the infected file, there is no file remaining on which to append the
text message. In this instance, the security gateway sends the users a standardized response, which
cannot be customized.
Table 9-2 x-virus header definitions
x-virus header value Definition
-1 Content cannot be scanned (for example, due to a container violation).
0 No viruses were detected in the email.
1 A virus was detected in the email.