KAPERSKY ANTI-VIRUS 5.5 - FOR MICROSOFT EXCHANGE SERVER 2000-2003, Руководство администратора, Страница: 51 / 143

Anti-virus protection
51
5.4. Actions to be performed on
infected objects
As a result of an anti-virus scan each object can be assigned a status as listed
below:
•
Not infected – object does not contain viruses.
•
Infected – object contains at least one of the known viruses.
•
Suspicious – object's code is similar to the code of a known or unknown
virus.
•
Protected – object is password-protected.
•
Corrupted – object is corrupted.
Which actions will be applied to an object depend on the object's status.
The most important major function of the application is the disinfection of
infected objects. Disinfection is performed based on the information contained in
the anti-virus database. According to the results of the attempted disinfection, an
object can be assigned a status as listed below:
•
Disinfected – object successfully disinfected.
•
Non-disinfectable – object disinfection failed.
A special processing procedure can be used for non-disinfectable objects.
Infected objects found in the message body are processed using the
action that is assigned to objects that could not be disinfected.
The following actions can be applied to objects with one of the following statuses:
infected, non-disinfectable, suspicious, protected and corrupted .
•
Pass – pass the object to the recipient with no changes.
•
Replace message body with text and rename attached objects – change
the infected message body with text created using the corresponding re-
placement template and change name and the extension of the infected
attached objects. Such renamed objects will have .
txt extension.
Names of the attached objects only will be changed, no
changes will be made in the body of the message if the virus
is detected.
•
Replace infected objects with text – delete the detected object and replace
it with text (message body) or a txt file (attachments) created based on the
replacement template.