Anti-virus protection
59
Kaspersky Anti-Virus allows the user to configure notifications about the results
of the anti-virus scan of objects (see Chapter 12 on page 110).
When scanning e-mail messages transferred via SMTP protocol the program
scans the body of the message and all attached files of any format.
It is to be noted that Kaspersky Anti-Virus distinguishes between simple objects
(the message body, simple attachment, for example an executable file) and
containers (consisting of several objects, for example an archive, a message with
another message attached to it or an MS Word file that contains macros). In
order to decrease the load on the server, containers with the nesting level above
a specified value can be excluded from the anti-virus scan.
An additional list of objects to be excluded from the anti-virus scan can be
created for data transferred via HTTP and FTP protocols. Such list can include
archives, packed executable files and some other types of files.
When scanning multi-volume archives downloaded from the source in parts,
Kaspersky Anti-Virus will treat and process each volume and each part as an
individual object. In this case, the application can detect malicious code only if
such code if fully located in one of the volumes. Malicious objects split into parts
can not be detected. In this situation, the malicious code may propagate after the
object is restored as one entity.
For HTTP protocol Kaspersky Anti-Virus provides an option of blocking access to
objects that are transferred in parts (see section 7.4, page 65). This option is not
provided for FTP protocol and in order to minimize the possibility of infection
using the method described above, we recommend disabling the ability to
download information by parts in the settings of Check Point
TM
Firewall-1
®
.
For data requested via HTTP protocol, Kaspersky Anti-Virus blocks access to
objects that do not satisfy the requirements of this protocol (for example, no
headings). Such objects will not be sent for anti-virus processing nor will they be
delivered to the user. However, if required, there is a provision for a transfer of
data that does not include service information to the user. In this case the object
will be sent for anti-virus processing, processed and delivered to the user
according to the anti-virus scan settings selected for HTTP traffic.
Anti-virus scan increases the time required to deliver the information to the user.
Therefore, there is a provision for transferring unscanned data that still can rule
out the possibility of the delivery of infected objects when processing objects
transferred via HPPT and FTP protocols (see section 7.4, page 65), This method
involves transferring of unscanned data in parts at maximum allowed intervals
that make it possible to hold parts of downloaded information before the object
has been scanned. If, as the result of the anti-virus scan, it appears that the
Multi-volume archives and objects downloaded in parts can be
scanned after they are saved to the hard drive using, for example,
Kaspersky Anti-Virus for Windows Workstations.