Copyright: Copyright © 2001 Kaspersky Lab


KAV Office MailChecker Technical Support: Updating Antivirus Databases

To keep your antivirus protection system efficient we strongly recommend you to update antivirus databases on a regular basis. Kaspersky Lab may provide updates on diskettes or you may update your antivirus databases via the Internet. KAV Updater that is included in the package is designed to enable you easily to update antivirus databases via the Internet.


KAV Office MailChecker: Protecting Mailbox

The E-Mail Infection Threat

How to Protect Your Mailbox from Viruses

Antivirus Protection Settings List

Updating KAV Office MailChecker


Antivirus Protection Settings List

After installed KAV Office MailChecker onto the computer you should configure your antivirus protection system. You may enable/disable your Office MailChecker to:

Notifications on infected messages:

·	notify a user if any infected message is detected in the mailbox;

·	notify the sender of infected message if detected;

·	notify a user predefined address on the infected message if detected;

Disinfecting infected messages:

·	try to disinfect the infected message text if infected;

·	try to disinfect the infected attachments if infected and to delete them if failed to disinfect;

Rerouting infected messages:

·	process infected messages one of the following ways: to pass them to the recipient, or to readdress them to the administrator, or to pass them to the recipient and send copies to the administrator, or to delete them;

Appending text to messages:

·	append a user-predefined text to infected messages;

·	append a user-predefined text to virus-free and disinfected messages.


Appending a User Predefined Text to Infected/Virus-Free Messages

You may set the program to append some certain text to infected and not disinfected messages.

To do it follow the steps:

1.	Switch to the KAV MailChecker tab sheet within the Options dialog window;

2.	Click the Advanced Options button to display the KAV Actions dialog window;

3.	Check the Text to add to infected message check box.

4.	Enter the desired text in the corresponding text field.

You may set the program to append some certain text to disinfected and virus-free messages.

To do it follow the steps:

1. Check the Text to add to non infected message check box on the KAV Actions dialog window.

2. Enter the desired text in the corresponding text field.


Checking for Viruses

Incoming Messages

Outgoing Messages

Messages That Were in Your Mailbox before You Installed KAV Office MailChecker


Contents

Main Functions and Features

KAV Office MailChecker: Protecting Mailbox

Customizing KAV MailChecker

Checking for Viruses

Rerouting the Traffic with KAV Office MailChecker

KAV Office MailChecker Technical Support: Updating Antivirus Databases


Customizing KAV MailChecker

Enabling/Disabling Antivirus Protection

Enabling/Disabling Notification Options

Disinfecting Infected Messages

Rerouting Infected Messages

Appending a User Predefined Text to Infected/Virus-Free Messages


Deleting Infected Messages

If you enabled the delete-infected-message options (See "Rerouting Infected Messages") KAV Office MailChecker deletes all infected messages from your mailbox.

In this case to define weather any infected messages were forwarded to you check your mailbox for the You were sent an infected message! subject messages. The program deletes infected messages and places these notifications in your mailbox. The date and time of such notification will be similar to those of the infected message.

To be assured that your program will not delete outgoing messages if they are infected, we recommend you to enable the display-warning option. Then if you try to send an infected message the program will ask you to confirm its deletion.


Disinfecting Infected Messages

To enable/disable KAV Office MailChecker disinfecting options follow the steps:

1.	Switch to the KAV MailChecker tab sheet within the Options dialog window

2.	Click the Advanced Options button to display the KAV Actions dialog window

3.	If you want the program to try to disinfect the infected message text if infected check the Try to cure message text check box.

4.	If you want the program to try to disinfect the infected attachments if infected check the Try to cure message attachments check box,

KAV Office MailChecker is enabled to detect the virus in attached to message archives but cannot disinfect these attachments. To disinfect archived files you should extract them from archive first and then start the antivirus.

5.	If you want the program to delete the attachments it failed to disinfect check the Delete non curable attachments check box.

If the Popup Alert Message box upon detection check box is checked before deleting not disinfected attachments the program displays the corresponding warning.

If the program deletes an attachment it failed to disinfect the following text is appended to the message: This message contained infected attachment(s). The attachment(s) were successfully deleted.

If KAV Office MailChecker successfully disinfected the message (i.e. removed the virus or deleted infected attachments) it is forwarded to the recipient without any extra notification (See "Passing Virus-Free and Disinfected Messages to Their Recipients").

On default the Try to cure message text and attachments check boxes are checked and the Delete non curable attachments check box is unchecked.

If you want to enable the highest level of antivirus protection we recommend you to check all the three check boxes and the program will remove all known viruses from you mailbox. However in this case you may lose some important data that might be stored in infected archives and otherwise could be recovered by some other antivirus.


Enabling/Disabling Antivirus Protection

To enable/disable your mailbox antivirus protection you should use the KAV MailChecker tab in the Options dialog window. This dialog may be called from within your mail-processing program.

To call the Options dialog window, for example, with the Microsoft Outlook program follow the steps:

1.	Start Microsoft Outlook.

2.	Select the ToolsOptions command from the program menu.

After this the Options dialog window with options of your mailbox will appear on your screen.

To enable your mailbox antivirus protection,

1.	Switch to the KAV MailChecker tab.

Antivirus protection settings

2.	Check the Enable protection check box.

On this tab sheet you may also find the program notification options (For details see "Enabling/Disabling Notification Options").

To change other settings click the Advanced Options button (for details see "Disinfecting Infected Messages", "Rerouting Infected Messages", "Appending a User Predefined Text to Infected/Virus-Free Messages").

The KAV Actions dialog window


Enabling/Disabling Notification Options

To enable/disable KAV Office MailChecker notification options follow the steps:

1.	Switch to the KAV MailChecker tab sheet within the Options dialog window

2.	If you want to set your KAV Office MailChecker to display the warning each time an infected message in your mailbox is detected check the Popup Alert Message box upon detection check box.

3.	If you want to set the program to notify the sender of incoming infected message if detected on the virus within his (her) message check the Send report to sender of message check box.

This option is not valid for outgoing messages.

4.	If you want to set the program to notify some certain e-mail address on the infected message if detected (e.g. the e-mail address of your system administrator) check the Send report to address check box and enter the address in the corresponding text field.


How to Protect Your Mailbox from Viruses

To protect messages from viruses we recommend you to install KAV Office MailChecker onto the computer and configure your antivirus protection system.

After installed and configured KAV Office MailChecker will check for viruses all incoming and outgoing messages (See "Checking for Viruses") redirecting and changing the traffic according to the predefined settings of antivirus protection (See "Rerouting the Traffic with KAV Office MailChecker").


Incoming Messages

Incoming messages are checked automatically on arrival to your mailbox. Infected messages are processed in accordance with the algorithm described in chapter "Scheme" and predefined antivirus protection settings (See "Customizing KAV MailChecker"). The program will try first to disinfect the message (if disinfecting options are enabled - See "Disinfecting Infected Messages"). Then, if failed to disinfect, it will display the warning (if the display-warning option is enabled), forward the notification to your mailbox, to the message sender and to the predefined address (if the corresponding options are enabled). After this the program depending on the rerouting settings, or passes the infected message to its recipient, or reroutes it to the predefined address, or passes to the recipient and forwards the copy to the predefined address, or deletes this infected message.

If you set the program to pass infected messages to their recipients your mailbox may contain infected messages. To disinfect them we recommend you to use KAV Scanner. To identify the infected message in your mailbox without opening it you may use one of the following tips:

·	Set the program to display a warning on infected message in your mailbox if detected. In this case each time an infected message in your mailbox will be detected KAV Office MailChecker will display the corresponding warning.

The infected message is detected in your mailbox

·	Check your mailbox for messages with the following subject: You were sent an infected message! Each time an incoming infected message is detected the program places this warning in your mailbox. The date and time of such warning will be similar to those of the infected message.

If you set the program to try to disinfect infected and to delete incurable attachments your mailbox may contain disinfected messages with deleted attachments. These messages will contain the following text: This message contained infected attachment(s). The attachment(s) were successfully deleted.


Main Functions and Features

The Kaspersky Mail Checker for Microsoft Exchange Client Compatibles (KAV Office MailChecker) is designed to provide with antivirus protection a user employing the software that is compatible with Microsoft Exchange Client for message-passing communication. If installed KAV Office MailChecker onto the computer a user can be assured that all the incoming and outgoing messages will be checked for viruses.

KAV Office MailChecker performs the following functions:

·	Checks for viruses all incoming and outgoing messages. The program viruschecks messages and their attachments of any format while they are sent or received. Furthermore KAV Office MailChecker is enabled to detect viruses in archives, packed executable files, plain mail format files and mail databases.

·	Checks for viruses messages that were in your mailbox before you installed KAV Office MailChecker. These messages being viruschecked while you open them.

·	Forms notifications on the infected messages. If some incoming message is infected the program places the corresponding notification in your mailbox and if preset (See "Enabling/Disabling Notification Options") notifies the administrator and/or the message sender. Besides the program may be set to inform the administrator e-mail address on the infected outgoing message.

·	Passes, redirects or deletes infected messages. The program may be set to pass infected messages to recipients, to redirect these messages to the administrator address, to pass these messages to recipients and send their copies to the administrator address or to delete infected messages (See "Rerouting Infected Messages").

·	If preset (See "Disinfecting Infected Messages") attempts to disinfect incoming messages and their attachments. The program may be set to delete incurable attachments. Successfully disinfected messages are forwarded to the recipient without any notification.

Your antivirus protection settings may be changed from within the mail-processing program.

KAV Office MailChecker is enabled to detect all currently known viruses in all infected messages but to disinfect these messages we recommend you to use KAV Scanner. For example, KAV Office MailChecker is enabled to detect viruses in attached to message archives but cannot disinfect them. To disinfect archived files you should extract them first and then start the antivirus.


Messages That Were in Your Mailbox before You In-stalled KAV Office MailChecker
Messages That Were in Your Mailbox before You Installed KAV Office MailChecker

You may check for viruses any message that were in your mailbox before you installed KAV Office MailChecker.

To viruscheck the message in your mailbox highlight and open it (e.g. you may double-click it).

After this the program will process this message according to settings predefined for infected incoming messages.


Notifying on Infected Messages Detected

Notifying the Recipient

Notifying the User Predefined Address

Notifying the Sender


Notifying the Recipient

Each time an incoming infected message is detected the program places the following notification in your mailbox: You were sent an infected message! The date and time of such notification will be similar to those of the infected message. If a user employs Microsoft Outlook this notification will look similar to the following:

Notifying on the infected incoming message detected

where John Buttler is a user protecting his mailbox with KAV Office MailChecker from viruses and the recipient of this message
and Nick Anderson is a sender of the infected message.


Notifying the Sender

If you enabled the notify-sender option KAV Office MailChecker notifies the sender of the infected incoming message detected on that his (her) message is infected. If a user employs Microsoft Outlook this notification will look similar to the following:

Notifying the infected message sender

where John Buttler is a user protecting his mailbox with KAV Office MailChecker from viruses and the recipient of the infected message who set the program to notify senders of infected incoming messages
and Nick Anderson is a sender of the infected message that was received by John Buttler.

KAV Office MailChecker forwards a similar notification from your mai lbox and specifies the following subject: You sent an infected message. . The notification format is similar to that of the predefined-address notification (See "Notifying the User Predefined Address").


Notifying the User Predefined Address

If you enabled the notify-predefined-address option KAV Office MailChecker will send notifications on all infected incoming and outgoing messages to the address specified within the Send report to address text field. If a user employs Microsoft Outlook this notification will look similar to the following:

Notifying the user predefined address

where John Buttler is a user protecting his mailbox with KAV Office MailChecker from viruses and the recipient of the infected message who set the program to notify Whitney McCansey (for example, his system administrator) on infected messages within his mailbox if detected
and Nick Anderson is a sender of the infected message that was received by John Buttler
and Whitney McCansey is a recipient of this notification.

KAV Office MailChecker forwards a similar notification from your mailbox and specifies the following subject: Report message from KAV MailChecker. The notification format is similar to the following:

KAV found, that the message

FROM: <ADDRESS_FROM>

TO: <ADDRESS_TO>

CC: <ADDRESS_CC>

BCC: <ADDRESS_BCC>

DATE: <DATE>

TIME: <TIME>

SUBJECT: <SUBJECT>

contains viruses.

Please check it using KAV Scaner.

<TEXT_OK>

where <ADDRESS_FROM> is an address of the infected message sender;
<ADDRESS_TO> is an address of the infected message recipient;
<ADDRESS_CC> is an address of the infected message copy recipient;
<ADDRESS_BCC> – is an address of the infected message second-copy recipient;
<DATE> is a date the infected message was sent;
<TIME> is time the infected message was sent;
<SUBJECT> is a subject of the infected message;
<TEXT_OK> is a text string specified within the infected message recipient Text to add to non infected message text field and therefore appended to this notification.  This text string confirms that this notification message is virus-free.


Outgoing Messages

KAV Office MailChecker checks outgoing messages for viruses while they are sent.

If an outgoing message is infected the program will try to disinfect it (if disinfecting options are enabled). If the program is set to delete incurable attachments and such attachments are detected in an outgoing message the confirm-deletion dialog box will appear on your screen.

The confirm-deletion dialog box

This dialog box will appear on your screen only if the Popup Alert Message box upon detection check box is checked.

Click Yes to delete the attachments. After this the message with attachments replaced with the following text will be forwarded to its recipient: This message contained infected attachment(s). The attachment(s) were successfully deleted.

Click No to cancel the attachment deletion. After this the confirm-send dialog box will appear on your screen.

The confirm-send dialog box appears on your screen each time you try to send some infected message (if the display-warning option is enabled).

The confirm-send dialog box

Click Yes to forward this infected message to its recipient

In this case the program will forward this infected outgoing message to its recipient without any changes

Click No to cancel this outgoing message

If you cancelled some outgoing infected message it is placed in the folder for outgoing messages (the Outbox folder if you are using Microsoft Outlook).

The cancelled outgoing message has no recipient and the following text is appended to it:

<TEXT_INFECTED>

Original TO: <ADRESS_TO>

where <TEXT_INFECTED> is a user predefined text that should be appended to infected messages
and <ADRESS_TO> is an address of the user this message was addressed to.

Now you may disinfect this message and forward to the recipient it was intended for.

If the display-warning option is disabled any infected outgoing message will be processed according to the antivirus protection settings predefined within the KAV Actions dialog window. If you enabled the corresponding option the program will forward notification on the infected outgoing message to the predefined address. After this depending on the rerouting settings the program will pass this infected message to its recipient, or reroute it to the predefined address, or pass it to the recipient and forward a copy to the predefined address, or delete this infected message.


Passing Infected Messages

If you set the program to pass infected messages to their recipients, KAV Office MailChecker appends to them the text specified with the Text to add to infected message text field and passes them to their recipients. The outgoing messages will be passed to the recipients you specified for them and the incoming messages will be passed to your mailbox. If a user employs Microsoft Outlook for incoming messages this message will look similar to the following:

Passing infected messages

where John Buttler is a user protecting his mailbox with KAV Office MailChecker from viruses and the recipient of the infected message who set the program to pass infected messages to their recipients
and Nick Anderson is a sender of this infected message.

In this case the infected message format is similar to the following:

<MESSAGE>

<TEXT_INFECTED>

Original TO: <ADRESS_TO>

where <MESSAGE> is an infected message (including its text and attachments)
<TEXT_INFECTED> is a text string specified within the recipient Text to add to infected message text field and therefore appended to this message
<ADRESS_TO> is an address of the infected message recipient.

If you set the program to pass infected messages to their recipients your mailbox may contain infected messages. To disinfect them we recommend you to use KAV Scanner.


Passing Virus-Free and Disinfected Messages to Their Recipients

KAV Office MailChecker appends the text specified within the Text to add to non infected message text field to virus-free and disinfected messages and then passes them to their recipients.

If you enabled the disinfecting-infected-attachments and delete-incurable-attachments options your mailbox may contain messages which attachments were deleted. These messages will contain the following text: This message contained infected attachment(s). The attachment(s) were successfully deleted.

The message which attachments were deleted


Popup help topics

To Enable Protection

To Reroute/Send Copy of Infected Message

To Delete Infected Mail from Mailbox

To Delete Non Curable Attachments

To Try Curing Infected Message Attachments

To Append to Virus-Free Message

To Append to Infected Message

To Try Curing the Text

The Advanced Options Button

To Notify Address on Infected Message Detected

To Notify Sender on Infected Message Detected

To Display Warning on Infected Message Detected


Rerouting Infected Messages

To set the program to reroute infected messages follow the steps:

1.	Switch to the KAV MailChecker tab sheet within the Options dialog window;

2.	Click the Advanced Options button to display the KAV Actions dialog window

3.	If you want the program to delete infected messages from your mailbox check the Delete the infected mail from mailbox check box;

If the Popup Alert Message box upon detection check box is checked before deleting an infected message the program displays the corresponding warning.

4.	If you want the program to reroute infected messages to some other e-mail address (e.g. the e-mail address of your system administrator) check the Reroute/send a copy of message to check box and enter this address in the corresponding text field.

If the Delete the infected mail from mailbox check box is unchecked the program passes infected messages to their recipients (to you if we are talking about incoming messages).

If the Delete the infected mail from mailbox check box is unchecked and the Reroute/send a copy of message to check box is checked the program passes infected messages to their recipients and forwards their copies to the predefined e-mail address.

On default the Delete the infected mail from mailbox and Reroute/send a copy of message to check boxes are unchecked.

If you check the Reroute/send a copy of message to check box and enter your own address in the corresponding text field while rerouting a message the program will be set to repeatedly forward it to your address until your computer will run out of its free memory space.


Rerouting Infected Messages

If you enabled the reroute/send-a-copy option KAV Office MailChecker appends to infected messages the text string specified within the Text to add to infected message text field and reroutes them to the address specified in the Reroute/send a copy of message to text field (See "Rerouting Infected Messages").

Rerouting infected messages

where John Buttler is a user protecting his mailbox with KAV Office MailChecker from viruses and the recipient of the infected message who set the program to reroute infected messages to Whitney McCansey (for example, his system administrator)
and Nick Anderson is an original sender of this infected message
and Whitney McCansey is a recipient of the rerouted infected message.

While rerouting an infected message KAV Office MailChecker keeps its original sender name. The rerouted message has the following format:

<MESSAGE>

<TEXT_INFECTED>

Original TO: <ADRESS_TO>

where <MESSAGE> is an infected message (including its text and attachments)
<TEXT_INFECTED> is a text string specified within the original recipient Text to add to infected message text field and therefore appended to this message
<ADRESS_TO> is an original recipient of this message.


Rerouting the Traffic with KAV Office MailChecker

Scheme

Passing Virus-Free and Disinfected Messages to Their Recipients

Notifying on Infected Messages Detected

Passing Infected Messages

Rerouting Infected Messages

Deleting Infected Messages


Scheme

KAV Office MailChecker changes the message traffic. This chapter illustrates the algorithm of changes that occur when KAV Office MailChecker detects some infected message.

The way KAV Office MailChecker reroutes the traffic if any infected message is detected


Customizing advanced options of antivirus protection.


The E-Mail Infection Threat

A computer may be infected with viruses through the e-message (e.g. Microsoft Office 6.0, 95, 97 and 2000 messages) if this message or its attachments are infected. While attempting to open this kind of message a user starts the corresponding Microsoft Office application and infects the computer. If it is an HTML message it can also contain viruses. If some infected file attached to the message the computer will be infected immediately after a user clicked the attachment icon.


The mode appending some user predefined text to infected messages.


The mode appending some user predefined text to virus-free messages.


The mode deleting infected messages from your mailbox.


The mode deleting attachments the antivirus failed to disinfect.


The mode displaying warning on infected message detected in your mailbox.


The mailbox antivirus protection mode.


The mode notifying some certain address on infected message detected.


The mode notifying the sender on infected incoming message detected.


The mode rerouting/sending a copy of the infected message to some certain predefined address.


The mode trying to disinfect attachments of infected messages.


The mode trying to disinfect the text of infected messages.


Updating KAV Office MailChecker

After the antivirus protection is configured we recommend you to regularly update your antivirus databases.