Modifying the heuristic level

Products

• Messaging Gateway

Issue/Introduction

The heuristic level determines the way in which the system uses heuristics to detect viruses. Symantec Messaging Gateway uses Symantec Bloodhound heuristics technology to scan for threats for which no known definitions exist. Bloodhound heuristics technology scans for unusual behaviors (such as self-replication) to target potentially infected message bodies and attachments. Bloodhound technology can detect up to 80 percent of new and unknown executable file threats. Bloodhound-Macro technology detects and repairs over 90 percent of new and unknown macro viruses.

Bloodhound requires minimal overhead because it examines only message bodies and the attachments that meet stringent prerequisites. In most cases, Bloodhound determines in microseconds whether a message or attachment is likely to be infected. If it determines that a file is not likely to be infected, it moves to the next file.

Bloodhound heuristics involve a trade-off between higher virus-detection rates and the speed with which Symantec Messaging Gateway processes mail. Lower heuristic levels may miss more viruses but require less processing power. Higher heuristic levels may catch more viruses but consume more processing power.

Resolution

To modify the heuristic level

1. Click Malware > Settings > Scan Settings.

2. Click the General tab.

3. Under Bloodhound Level, click the level that you want.

   The default setting is Medium.

4. Click Save.

See About detecting viruses, malware, and malicious attacks.

See Detecting viruses, malware, and malicious threats.

See Product technologies that detect viruses and malicious attacks.