This article applies to:

• WebMarshal 2.X
• WebMarshal 3.X
• WebMarshal 6.X
• WebMarshal 7.X

Question:

• What Virus Scanners are supported by WebMarshal?
• How do I use Anti-Virus scanners with WebMarshal?
• How do I install and set up my anti-virus scanner supported by WebMarshal?

Information:

WebMarshal can virus scan file downloads and uploads. If a virus is found, the download or upload can be blocked and a warning page displayed, indicating that a virus was found.

Note: Upload scanning is not supported when WebMarshal is run as a Web filter plug-in to ISA Server. This includes virus scanning uploads.

WebMarshal only supports virus scanners that have a special WebMarshal DLL interface. 

Available scanners:

• Bitdefender for Marshal (WebMarshal 6.12 and above)
  Included in the WebMarshal download on the trial or upgrade download pages of this site.
• McAfee for Marshal
• Available on the trial or upgrade download pages of this site.
• Sophos for Marshal
  Available on the trial or upgrade download pages of this site.
• Sophos Anti Virus (SAV Interface)
  http://www.sophos.com/
  (Not available with WebMarshal 7.X - 64 bit integration is not provided)
  
  • For customers upgrading to WebMarshal 7 who are currently licensed for Sophos (SAVI), Trustwave has agreed with Sophos to provide Sophos for Marshal, at no cost, for the remaining life of the customer's existing SAVI license.
  • At the next renewal, to continue using Sophos for Marshal, customers must purchase Sophos for Marshal licensing from Trustwave on normal terms.
  • To take advantage of this offer, customers (or partners) should contact their Trustwave account manager. Proof of the SAVI license is required, such as the original order confirmation.
• Symantec Anti-Virus Scan Engine 
  (Not available with WebMarshal 7.X - 64 bit integration is not provided)
  http://www.symantec.com/

Note that Norman products are no longer supported. The products are discontinued by the developer.

Installing and Setting up the Anti-Virus Scanner

The virus scanner should be installed on each WebMarshal processing server according to the manufacturer's instructions.

WebMarshal uses a temporary folder during virus scanning and this folder must be excluded from any resident virus scanning. See documentation for your version of WebMarshal

The way you exclude folders from resident scanning is specific to each scanner.  

• Bitdefender for Marshal, McAfee for Marshal and Sophos for Marshal
  • These scanners are specifically designed to work with WebMarshal and do not require exclusion setup.
• Sophos Anti Virus
  1. From the Options menu, select Exclusion List.
  2. The Sophos on access scanner (InterCheck) will exclude any files on this list, by default. You can check this in the InterCheck settings, under the Exclusion tab.  

Setting up the Virus Scanner in WebMarshal

Once the virus scanner has been installed and set up on the WebMarshal server, it needs to be installed in WebMarshal.  

1. In the WebMarshal Console, select Rule Elements (or Policy Elements) and right click Virus Scanners.
2. Select New Scanner, and from the list provided, select the required virus scanner.
3. If necessary, create a content rule to run the virus scanner. WebMarsahl default rules include virus scanning rules. Your rule should look similar to this:

   When a web request is received
   For any User
   And where addressed to any URL
   Except where the URL is a member of Sites Excluded From Virus Scanning
   Where the result of the virus scan is Contains Virus; Unexpected Error
   Block Access and display FileBlockedVirus page
   Or Abort Download of this file and display FileAbortedVirus page
   Send a notification e-mail to the administrator
   And do not process any further rules

For more information about setting up virus scanning rules, refer to the chapter, Virus Scanners, in the WebMarshal manual or contact Technical Support at https://support.trustwave.com/.

Notes:

For performance reasons, by default WebMarshal does not virus scan HTML and text files. You can enable scanning of these files. See the WebMarshal Console, Download Options tab of WebMarshal Server Properties.

This article was previously published as:

NETIQKB29171

Marshal KB226