Scanning
Norman SandBox
Scanning of archive files
Messaging
Automatic updates

Scanning
Back to top

Norman Virus Control for MS Exchange 5.5 offers two types of scanning:
On-access
On-demand

and it is necessary to distinguish between them.

On-access scanning involves constant monitoring of the email activity on an Exchange 5.5 server. The on-access scanner checks the incoming mail.

On-demand scanning - is based on active involvement by the administrator where he identifies one or more specific mailbox for scanning. All Exchange mailboxes can be scanned on-demand.

Norman Virus Control for MS Exchange can be used to scan old message attachments in mailboxes to root out any old infections. Thereafter, all incoming email is scanned in real-time at the router, so mails with multiple recipients need to be scanned only once.

During on-access or on-demand scanning, all mail bodies and attachments in an email are scanned. A mail or a note can have file attachments like documents or program files. When we refer to attachments, we are referring to any file attached to an email. Attached files are possible virus carriers and consequently subject to virus checking. Archive files are also scanned. If a virus in an archive file cannot be repaired, the entire archive file will be removed from the email.

Norman SandBox
Back to top

Norman’s SandBox technology detects new and unknown computer viruses, including trojans and worms. Today, an email worm can infect tens of thousands of workstations in a matter of seconds. The antivirus vendors are expected to find the cure, update the virus definition files, and distribute these to its customers immediately. The need for speed is paramount. Norman’s SandBox is a virtual world where everything is simulated. An emulator provides an environment where possible virus infected executables “run" just as they would do on a real system. When execution stops, the SandBox is analyzed for changes. The SandBox is particularly tuned to find new email-, network- and peer-to-peer worms.

Scanning of archive files
Back to top

NVC for MS Exchange 5.5 uses our previous version of the decompression module to scan files that have been compressed with different archive programs. With this module NVC can scan approximately 25 archive types and variants like ZIP, TAR, RAR, ARJ, UUENCODE, ARC etc. Files that contain other files of different archive formats will also be scanned to further increase security. In addition, if malware is found within an archived file, NVC will - if possible - clean the infection and repack the file (only valid for some formats).
 

Messaging
Back to top

NVC for MS Exchange 5.5 does not use NVC’s own messaging system. Instead messages are logged to the event log. It is also possible to send messages to the sender, recipient and administrator.
 

Automatic updates
Back to top

Norman Internet Update (NIU) is an integrated part of NVC and can be configured to regularly check for new and updated files on Norman’s product servers. NIU provides complete updating and upgrading of the application software and virus definition files to ensure that the latest version of the software is always installed.

NIU employs incremental updates of virus definition files to keep the size of the updates as small as possible, thereby reducing download time.