User Guide

16 Kaspersky Security 5.5 for Microsoft Exchange Server 2003
The application sends notifications about events occurred to the administrator,
the recipient and the sender of the infected message and also places a record
about this event into the Kaspersky Security application log file and into the
Microsoft Windows event log.
If the virus outbreaks detection facility is enabled, the application will register the
virus activity level and will send a notification about the virus outbreak threat or
place a corresponding record into the Microsoft Windows event log and into the
Kaspersky Security application log file.
2.1. Security Server architecture
The server component of the application, Security Server, consists of the
following subsystems:
• E-mail VSAPI Interceptor intercepts objects arriving to Microsoft
Exchange Server and forwards them to the anti-virus scan subsystem. It is
integrated into the Microsoft Exchange Server processes using VSAPI 2.5
technology.
• SMTP E-mail Interceptor intercepts objects arriving to Microsoft
Exchange Server via SMTP protocol and forwards them to the anti-spam
scan subsystem.
• Anti-spam Scan Subsystem scans e-mail messages for spam. This
feature is implemented as a Microsoft Windows service, which starts
automatically when a message that must be scanned arrives.
• Anti-virus Scan Subsystem performs anti-virus scan of objects. This
component includes several processes with one anti-virus kernel per
process. The anti-virus scan subsystem also includes storage of
temporary objects for scanning objects in RAM. The storage is located in
working folder Store that is created in the installation folder and must be
excluded from the scan scope of any anti-virus applications installed in the
corporate network.
• The Internal Application Management and Integrity Control Module is
launched in a separate process and is a Microsoft Windows service. This
service is launched automatically and does not depend on the state of
Microsoft Exchange Server (started, stopped) which allows configuring the
application even if Microsoft Exchange Server is stopped. For the correct
operation of the application, the Internal Application Management
Module must always be running; stopping this service manually is not
recommended.