Kerio Tech KERIO WINROUTE FIREWALL 6, Руководство администратора

Страница: 174 / 368

Chapter 13 Antivirus control
174
Warning
When handling files in the
quarantine
directory, please consider carefully each action
you take, otherwise a virus might be activated and the WinRoute host could be attacked
by the virus!
• Alert the client — WinRoute alerts the user who attempted to download the file by
an email message warning that a virus was detected and download was stopped for
security reasons.
WinRoute sends alert messages under the following circumstances: The user is authen-
ticated and connected to the firewall, a valid email address is set in a corresponding
user account (see chapter 15.1 ) and the SMTP server used for mail sending is config-
ured correctly (refer to chapter 18.3 ).
Note: Regardless of the fact whether the Alert the client option is used, alerts can
be sent to specified addresses (e.g. addresses of network administrators) whenever
a virus is detected. For details, refer to chapter 19.4 .
In the If the transferred file cannot be scanned section, actions to be taken when the antivirus
check cannot be applied to a file (e.g. the file is compressed and password-protected, damaged,
etc.):
• Deny transmission of the file — WinRoute will consider these files as infected and deny
their transmission.
Hint
It is recommended to combine this option with the Move the file to quarantine function
— the WinRoute administrator can extract the file and perform manual antivirus check
in response to user requests.
• Allow the file to be transferred — WinRoute will treat compressed password-protected
files and damaged files as trustful (not infected).
Generally, use of this option is not secure. However, it can be helpful for example
when users attempt to transmit big volume of compressed password-protected files
and the antivirus is installed on the workstations.
HTTP and FTP scanning rules
These rules specify when antivirus check will be applied. By default (if no rule is defined), all
objects transmitted by HTTP and FTP are scanned.
WinRoute contains a set of predefined rules for HTTP and FTP scanning. By default, all exe-
cutable files as well as all Microsoft Office files are scanned. The WinRoute administrator can
change the default configuration.
Scanning rules are ordered in a list and processed from the top. Arrow buttons on the right can
be used to change the order. When a rule which matches the object is found, the appropriate
action is taken and rule processing is stopped.
New rules can be created in the dialog box which is opened after clicking the Add button.