Dr.Web HTTP Web Filter

The anti-virus check starts when the server sends the data back to the client or obtains the requested data from the cache of Microsoft ISA Server or Microsoft Forefront TMG.

As the object to check is a web resource specified in the client's request, Dr.Web HTTP Web Filter analyzes the packets of the protocol, compiling a temporary file (if the resource size is too large) for further anti-virus scanning.

If an URL is not blocked by Office Control, one of the following four states (two of them are known, and two – unknown) may be assigned to it:

•Unverified

•Unknown

•Infected

•Clean (contains no threats)

The state is stored for 30 minutes from the end of scanning. After that the resource is considered unverified. Once 60 verification attempts are finished, information about the resource will be deleted from the system.