NOD32 for MS Exchange Server 2.0

E-mail has become the main infection vector of the computer worms today. E-mail servers are flooded daily by an enormous number of infected messages targeting the end-user computers. For a large or even a small organization, the use of antivirus software running on e-mail server is a very important line of defense.

Eset's NOD32 for MS Exchange Server 2.0 (aka XMON) is based on its award winning scanning engine that has not missed any In the Wild virus in the test of Virus Bulletin (www.virusbulletin.com) for more than 5 years.

Key product features

• easy installation
• easy-to-use graphical user interface
• unprecedented scanning rate
• small footprint and low impact on system resources
• runs on MS Exchange Server 5.5 SP3, 2000 SP2, 2003
• advanced Heuristics detecting new unknown viruses without any need to update virus signature database
• scanning inside the archives, self-extracting files and run-time compressed files
• multithreaded scanning on background for higher performance
• proactive virus scanning
• scanning the message body
• scanning of all routed messages when MS Exchange Server is used as an e-mail gateway
• rule based virus scanning
• built-in standard on-demand scanner
• resident antivirus monitor - AMON
• quarantine for safe keeping of infected files and messages
• automatic virus signature database update over the internet
• incremental virus signature database update
• NOD32 mirror for updating multiple NOD32 antivirus scanners from within your network
• automatic logging and log management
• virus detection warning using LAN messages or e-mail messages
• manageable by Remote Administrator console
• password protected settings

FAQs

Does XMON check the message attachment or message body?

Depending on the version of MS Exchange, NOD32 scans either both message attachment and body (MS Exchange 2000 SP2 or higher). In the rest of the cases it only scans the message attachments.

Why are there some of the XMON features disabled?

XMON is a universal module working with multiple MS Exchange servers (5.5 SP3, 2000 SP2, 2003). All the disabled XMON features are disabled because the MS Exchange server version you are running does not support disabled features.

Why does XMON scan messages on the MS Exchange server after it has been disabled?

The asynchronous communication between the XMON and the MS Exchange server does not allow immediate reflection of XMON settings changes on the MS Exchange server. Please, allow a one minute delay between the changing of the XMON settings and their effect on the MS Exchange server.

Is XMON able to delete the whole message upon detection of infected attachment?

Yes, XMON is able to delete the whole message containing an infected attachment. To enable this option, go to XMON setting and in the Deleting preferences select delete the whole message. This option is available for MS Exchange 2003 only. Older MS Exchange servers do not support this feature. 

Does XMON check outgoing messages as well? 

Yes, XMON checks the outgoing messages. Make sure that your outgoing SMTP server is the MS Exchange server with running XMON. This feature is enabled for MS Exchange 2000 SP3 and higher.

How can I change XMON settings so that it would append a stamp on each checked message, that is has been checked?

It is not possible to add "checked by NOD32" stamps into messages checked by XMON, because the MS Exchange server does not allow this feature to be implemented.

Why can I not open some messages checked by XMON in my Outlook?

Most probably you have set the XMON settings to be No action, mark as infected in the Actions settings. Or the message has been marked as a virus by one of the rules created in the Rules XMON settings. In both cases the message is marked as a virus and the MS Exchange servers denies access to this message. 

Is the reboot necessary after the XMON installation? Why can't I simply start the NOD32 Kernel Service?

Yes, it is possible to manually start the NOD32 Kernel Service upon the first XMON installation. Upon XMON reinstallation or XMON un-installation the reboot is mandatory.

What exactly does the Time limit option in the Performance settings mean?

On the MS Exchange server 2000 SP2 and higher this settings means the maximum time allowed to finish checking of a single message in one thread. If the time limit has been reached and the scanner has not finished scanning the access to this message will be denied. The scanning of the particular message is not halted, however, the access to this message will be granted for the recipient only after the checking is finished. On the MS Exchange server 5.5 SP3 and SP4 the time limit settings is a number of milliseconds between two following attempts to access the message that has been checked.

What is the maximum count of file extensions in a single rule?

The extension list may not exceed 255 characters.

When activated the option Background scanning all the messages had been rechecked upon virus database update, but after the recent update none of the messages on the server have been rechecked. Is this a bug?

No, this is not a problem. MS Exchange Server may either scan the messages upon the update of the virus signature database or, else, after the end-user's attempt to access the message.

Why does XMON verify file sizes of the attached files?

For the purposes of virus scanning the virus scanner needs to work with the exact file size of the currently checked file. MS Exchange identifies an approximate file size of attached files, but some of the attached files are encoded and thus change their size. When enabled, XMON determined the exact file size of all attached files. This option improves virus detection and decreases the scanning rate.

When selected Rename attachment option in the Actions settings, will be the renamed attachment rechecked upon the following virus check?

There are several possibilities: If the Scan all files option is enabled the file will be rechecked again. If the file contains a header such as EXE, DLL, DOC etc. the file will be rechecked, because XMON recognizes its file type. If the file does not contain a header such as COM, BAT, JS, VBS etc. the file will not be rechecked after renaming. It is advisable to use the Rename option with an appropriate rule so that the file will not be rechecked in the future.