Escan/english/mailantivirus

From eScan Wiki

(Difference between revisions)

Revision as of 10:36, 30 August 2008

Mail Anti-Virus (eMail Scanning) - Shows the current status of the eMail Scanning Protection level. The green color right tick mark denotes that the module is “Active” while the red color cross mark displays that the module is “InActive”.

On the Mail Anti-Virus (eMail Scanning) option page in the “Configuration” section, when clicked on the “Settings” option, one can change the Mail Anti-Virus (eMail Scanning) Protection level, whereas clicking on the “Start” and /or “Stop” option (next to Settings) makes the module “Active” and /or “InActive”.

Configuration section

When clicked on “Settings” the below options are available, through which the eScan software’s real-time eMail Scanning protection can be customized -

a. Scan Options:-

i) Block Attachment types -

This option holds a list of different file types, for example - *.exe, *.pif,* .scr, etc... which when encountered during an email download (pop) would be deleted by default (automatically). This option is set to ensure that emails having these types of known attachments (used by worms, spywares, spammers, etc...to propage themselves) would not be downloaded (as they cannot be disinfected /cleaned) but deleted at MWL (MicroWorld Winsock Layer – Gateway Level).

This option can be customized based on requirements, for example - if you wish to receive the file type (*.pif), there are two options available within to set it. Firstly, delete it from the list and Secondly you can add the file type to the Exclude Attachments list (Whitelist), point no.8 explained below.

The other available options are:-

1. Delete all attachments in email if disinfection is not possible - this option is enabled by default. It would delete all attachments listed in the Block Attachments types section as they are the files that cannot be disinfected/ cleaned.

2. Delete entire email if disinfection is not possible - this option is also enabled by default. It would delete the entire email if the files within the email cannot be disinfected/cleaned.

3. Delete entire email if any virus is found - this option when enabled would delete the entire email if any virus is found in it.

4. Quarantine blocked sttachments - this option when enabled would quarant the attachments blocked.

5. Delete entire email if any blocked attachment is found - this option when enabled would delete the entire email if any blocked attachment is found in it.

6. Quarantine email if attachments are not scanned - this option when enabled would quarant emails if the attachments within are not scanned.

7. Quarantine attachments if they are not scanned - this option when enabled would quarant attachments when not scanned.

8. Exclude attachments (White list) - this option is useful in case a file type listed in the block attachment types section needs to be delivered into the user's mailbox/ inbox and should not be deleted. This option holds precedence over the Block Attachment types.

ii) Action –

This option is set on the right hand side of the Block Attachments types, this section is useful in setting up the action to be taken when an infection is found, the default value set is to "Disinfect" while the other is "Delete".

The options that can be set up here are of quaranting infected files and emails. If eScan is installed in the below path by default then the path would be C:\PROGRA~1\eScan\INFECTED for infected files and C:\PROGRA~1\eScan\Quarant for emails and can be easily changed as per requirements.

iii) Mail Server settings –

This option is useful for setting up an outbreak alert /notification /warning messages that are sent by eScan when it detects any violation or breach of security.

There are two sections to this port configuration settings -

1. SMTP Mail Server settings -

The mail server ip address and port details needs to be defined along with credentials of a valid username and password (though optional) in case the mail server requires Authentication, using which eScan automatically sends the notification alerts.

2. Port settings for eMail/Web Scan –

The ports that are used for sending (smtp,25) and receiving (pop3,110) emails are defined along with options of, if outgoing or incoming emails need to be scanned or not. The same can be customized as per requirements.

b. Compression / Decompression options:-

This option helps in Internet Bandwidth Management.

There are two options available within:-

1. Compress outbound attachments –

This option when enabled will decrease the size of all attachments that are sent in emails.

2. Create self extracing zip files –

This option when enabled overrides the above point no.1 and creates a self extractable zip file which when clicked on automatically uncompresses itself thereby eliminating the need at the receiver's end from using any unzipping tool.

3. Uncompress inbound attachments –

This option when enabled will automatically open/unpack the compressed file and be scanned.

4. Uncompress inbound attachments (Local Domain) –

This option when enabled will automatically open/unpack the compressed file and be scanned when sent within the local domain.

5. Do not compress files with extensions (Exclude following attachments) –

This option is helpful in excluding the file types {attachments} that need not be compressed when being sent out.

6. Compression options - a) Compress only if compression % greater than –The default value set is 25, this option will compress all attachments in emails to 25 % or more.

b) Compress if attachment size is above (KB) –The default value set is 50, this option will compress all attachments that are and above 50 KB in size and not below.

c) Select the compression ratio – The default value set is to “Max. Speed”, this option will utilize the system resources to the best and compress the attachments in emails and send it out too much quicker.

c. IE – Vulnerabilities I –

Internet Explorer (IE) has vulnerabilities and using them as the base, malwares easily transmit themselves on to systems and email clients like Outlook and Outlook Express thus making it easier for malware authors to get their malicious code propagating.

To overcome them, MicroWorld with it's proactive security range of solutions is committed to securing your data and system from such vulnerabilities.

i) Delete attachments with CLSID extensions - this option is enabled by default. It deletes Class ID file extensions [CLSID - files that are hidden and do not show the actual file extension] to prevent dangerous files from exploiting the vulnerabilities of IE.

ii) Delete HTML attachments with Scripts - this option is not enabled by default. In general, eMails are sent and received in different formats and one of them being HTML, this HTML can have Scripts {similar to a batch file - .bat) with Tags to perform a particular or a set of task/s (embedded), such emails when encountered are deleted to prevent exploiting the vulnerabilities.

iii) Script & Content check disabled for mails From - this option is useful when you know and want to add a user who is genuine and sends legitimate html email with scripts. Once added, (for example - abc@xyz.net or *@xyz.net) all emails coming from this user or domain would automatically be delivered to the receiver's inbox/mailbox.

iv) Script & Content check disabled for mails To - this option is useful when you know and want to add a user who is genuine and sends legitimate html email with scripts. Once added, (for example - suzanne@xyz.net or *@xyz.net) all emails being sent from this user or domain would automatically be delivered to the receiver's inbox/mailbox.

d. IE – Vulnerabilities II –

i) Select action on mails with Multiple Extension Attachment - the default option set is to "No Action", the other is "Delete mail", this option is very useful to prevent malware like worms from propagating itself using multiple (double or triple) extensions via email attachments, for example -nimda, sircam, etc...

ii) Allow Multiple Extension attachment for ZIP file - the default option set is to "Yes" or "Allowed", this option is very useful and helps in transmitting multiple extensions attachments in email, for example - compressed files like .zip, .pdf that have multiple extensions can be allowed.

e. Archival –

i) Archive emails - this option is not enabled by default. This option is useful to archive or backup all emails that are sent and received via eScan. The folder or the path to this destination is customizable as per one's requirements.

ii) Archive attachments - this option is not enabled by default. This option is useful to archive or backup all email attachments that are sent and received via eScan. The folder or the path to this destination is customizable as per one's requirements. iii) Do not archive attachments of type - With this option certain file types can be excluded from being archived, for example - *.vcf, *.htm, *.html, etc...

At the bottom end of this Mail Anti-Virus (eMail Scanning) option page in the “Reports” section, there are different options available like “View eMail Log” and “View Archived Mails”.

2. Reports section -

The below options are available within -

a. View eMail log -

This displays the email scan activity done on the system in details like the infection found name of the infection, status of the action taken, etc..

b. View Archived Mails –

This displays the emails that are archived, using the “Archival” option explained above (point no. e).

Along with the above statistical reports, it also displays the total mails scanned and total infected objects.

Retrieved from "https://wiki.escanav.com/wiki/index.php/Escan/english/mailantivirus"

Welcome to eScan Wikipedia

From eScan Wiki

Revision as of 10:36, 30 August 2008

Main Page

Latest Developments

Product Information

Knowledge Base

For Windows Downloads

For Linux Downloads

For MAC Downloads

General

Support

Views

 . Delete entire email if any virus is found - this option when enabled would delete the entire email if any virus is found in it.
-. Quarantine blocked sttachmetns - this option when enabled would quarant the attachments blocked.
+. Quarantine blocked sttachments - this option when enabled would quarant the attachments blocked.
 . Delete entire email if any blocked attachment is found - this option when enabled would delete the entire email if any blocked attachment is found in it.
 . Exclude attachments (White list) - this option is useful in case a file type listed in the block attachment types section needs to be delivered into the user's mailbox/ inbox and should not be deleted. This option holds precedence over the Block Attachment types.
 ii) Action –
 The options that can be set up here are of quaranting infected files and emails. If eScan is installed in the below path by default then the path would be C:\PROGRA~1\eScan\INFECTED for infected files and C:\PROGRA~1\eScan\Quarant for emails and can be easily changed as per requirements.
 iii) Mail Server settings –
 iv) Script & Content check disabled for mails To - this option is useful when you know and want to add a user who is genuine and sends legitimate html email with scripts. Once added, (for example - suzanne@xyz.net or *@xyz.net) all emails being sent from this user or domain would automatically be delivered to the receiver's inbox/mailbox.
 '''d. IE – Vulnerabilities II –'''