User Guide

Using the application 35
3. Using a built-in MIME format identifier (RFC822, MIME, UUE), the
application divides the message into its components, such as message
body, attachments, etc.
4. If the application is configured to filter objects by name and/or attachment
type, it applies the specified filtering rules for this message. If an object
meets the filter conditions, the object will be assigned the Filtered status
and will not be subjected to further anti-virus scanning.
5. Then each of the received objects will be sent to the AV module that
analyzes the received object and returns the status assigned to it.
An object may be assigned one of the following statuses in the process of
checking:
• Clean – object is clean.
• Infected – object is infected and cannot be disinfected or its
disinfection has not been attempted.
• Disinfected – infected object has been successfully
disinfected.
• Suspicious – object is suspected of being infected with an
unknown virus or with a new modification of a known virus.
• Protected – scanning failed because the object is password-
protected (e.g., it is an archive).
• Error – object is corrupted or an error occurred during the scan.
6. Depending on the status assigned to each object, the application
performs actions as specified in the settings for the respective group.
7. After the anti-virus scan of all message components and execution of
basic actions on those components, an additional action can be
performed on the message as a whole.
The tasks that can be performed with objects are of the following two types:
• Basic actions:
• Deliver messages without changes (see section 4.2.3.1 on
page 36).
• Deliver only clean or disinfected messages (see section 4.2.3.2
on page 37).
• Delete infected attachments (see section 4.2.3.3 on page 38).
• Replace infected attachments with messages created using
templates (see section 4.2.3.4 on page 39).