Applies to: Forefront Online Protection for Exchange
Topic Last Modified: 2012-04-23
This topic answers frequently asked questions about the Forefront Online Protection for Exchange (FOPE) virus filtering service.
A. There are two possible reasons why you received a virus.
First, the virus you received may be a new variant and the FOPE anti-virus partners may not have released a pattern file for the service to deploy. The time it takes for an update to be released to FOPE is dependent on the anti-virus partners. The FOPE servers check for new virus definitions every 15 minutes.
The second, and most likely, possibility is that the attachment you received does not contain any active malicious code. In these situations, some antivirus engines that run on desktops may be more aggressive and stop messages with truncated payloads.
If you have received a virus which made it past the filters, please save a copy of the email message with its attached virus, contact Microsoft technical support and submit a support request. Add the infected message to the support request as a password protected .zip file. We’ll investigate and ensure that corrective action is taken to prevent the virus from going undetected.
A. FOPE checks for new virus definitions from our anti-virus partners every 15 minutes. When a new definition file is received it can take approximately 30 minutes to fully propagate the new definitions to all servers worldwide.
A. Yes, it could be a virus. We strongly advise against opening any attachments that you do not recognize.
If you would like us to investigate the attachment, contact technical support and submit a support request. Add the infected message to the support request as a password protected .zip file. We’ll investigate and ensure that corrective action is taken to prevent the virus from going undetected.
A. Unfortunately, messages blocked by the virus filter contain active malicious code and we do not allow access to these messages. They are simply deleted.
A. FOPE utilizes a layered approach to anti-virus filtering for both inbound and outbound e-mail and has partnerships with numerous best-of-breed providers of anti-virus technologies.
A. All of our customers are automatically protected by at least three of our virus partners at all times. However, there is no way to choose one anti-virus engine over another.
A. No. Policy Allow rules cannot bypass the virus filter. However, you can send your attachment within a password-protected .zip file if you would like to bypass the virus filter.