Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 348 / 861

347 Preventing attacks
Protecting your network resources from virus infections
To repair or delete infected files
1 In the SGMI, in the left pane, under Policy, click Antivirus .
2 In the right pane, on the Response tab, in the drop-down list for the protocol that you want to
configure, select
Repair or delete .
3 In the Message contained in the file that replaces a deleted file text box, type your customized
message.
You can use non-English characters in the message.
To revert to the original message, click
Restore Default .
4 In the Summary message appended to emails when files are repaired text box, type your
customized message.
To revert to the original message, click
Restore Default .
5 Optionally, do one of the following:
■
To save your configuration now and activate later, on the toolbar, click Save .
■
To activate your configuration now, on the toolbar, click Activate .
When prompted to save your changes, click Yes .
6 To apply these settings, create a rule and enable the appropriate actions on the Antivirus tab.
Related information
For further information related to this topic, see the following:
■
“Adding antivirus protection to a rule” on page 347
Adding antivirus protection to a rule
Antivirus scanning is enabled on a rule-by-rule basis through the protocol-specific settings. To enable
the antivirus functionality, you must create a rule and select the antivirus processes that you want to
use. You can specify separate options for each protocol.
The more antivirus scanning and filtering processes that you use, the greater the antivirus protection.
However, when you use multiple antivirus processes, you may see an impact on performance due to an
increased demand on system resources.
Email that arrives at the security gateway by way of the SMTP protocol is scanned before it is
delivered; therefore, blocking a message is possible. Email that uses the POP3 protocol can only be
scanned after it has been delivered to a mailbox, but before it is read by a user. You cannot block POP3
email, because there is no way to remove the infected mail from the mailbox.
The following table shows some sample rule settings:
■
When users receive mail using inbound SMTP, your rule should apply antivirus and antispam
scanning, with messages that notify the user that a virus has been deleted or repaired.
■
When users send mail using outbound-SMTP, your rule should suppress messages that indicate
that a virus that was inside your company has been repaired.
■
When users read mail on an outside server using POP3, your rule should apply both antivirus
scanning and antispam heuristics.
Table 9-3 Common rule settings for email
Rule type Antivirus scanning Antispam settings Antivirus response
Inbound-SMTP Yes All Yes messages
Outbound-SMTP No No No messages
Inbound-POP3 Yes Heuristics Yes messages