User Guide

30 Kaspersky Anti-Virus® for Sendmail with Milter API
2. If the message addresses are not found in any group created by the
administrator, the message will be processed according to the rules
of the Default group, contained in the default.conf file.
4.3. Message status
Following an anti-virus scan a status is assigned to the message which may
have one of the following values:
• clean – no malicious code was found in the message (or part of it).
• error – the message (or part of it) is corrupted and an error occurred
while scanning it.
• protected – the message (or part of it) is protected with a password or
other means of protection. Therefore, it was skipped during anti-virus
scanning.
• infected – the message (or part of it) contains malicious code (code
sample is available in the anti-virus database or it was detected by the
heuristic code analyzer).
• suspicious – the message (or part of it) contains suspicious code (it can
be a new unknown virus or a modification of a known one).
If disinfection of an infected object has failed, the object is assigned the
CureFailed status. If disinfection is successful the object is assigned the CURED
status.
The message status determines the action to be applied to the message. The
possible actions to be applied to messages are defined by the parameters
DefaultAction, SuspiciousAction, ProtectedAction, and ErrorAction which
are located in the [group.actions] section of the group configuration file.
Possible actions are described in the next section.
4.4. Assigning actions for mail
messages
The range of possible actions to be applied to messages / objects is as follows:
• warn – replace the infected message with a warning about a detection of
an object containing a virus;
• cure – disinfect the infected object in the message. If disinfection fails,
delete the object and add the corresponding notification to the message;