eScan Blog
eScan Website
eScan Forum
eScan Feeds From eScan Wiki
Mail Anti-Virus (Scansione eMail)
Questa sezione fornisce la descrizione delle funzioni e delle impostazioni del modulo Mail Anti-Virus per scansionare le email.
Contents |
Descrizione
Il modulo Mail Anti-Virus scansiona tutti i messaggi di posta ellettronica in entrata / in uscita contro i virus, spyware, adware e altri oggetti maligni. Come predefinito, al momento dell'avvio del modulo Mail Anti-virus verrano scansionate solo le email in entrata.
Lo Stato nella Finestra
The green colored Tick (√) mark indicates the Mail Anti-Virus is active and running.
The red colored Cross (X) mark indicates the Mail Anti-Virus is inactive and stopped.
Configuration section
- Status
- Mail Anti-Virus Status – This will display the status of the Mail Anti-virus in Disabled or Running mode.
- Action – This will display the action to be taken on infected emails in Delete or Disinfect mode.
- Stop / Start buttons – Clicking stop / start button will disable or enable the Mail Anti-Virus.
- Settings button – To configure the Mail Anti-Virus for incoming / outgoing email scanning click on the Settings button.
I. Scan Options:-
- a) Block Attachment types -
- This setting contains a list of file extensions, which will be blocked / deleted at the MicroWorld Winsock layer (MWL - gateway level), if found in any email attachment (pop3 account) during scanning by Mail Anti-Virus. MicroWorld has a predefined list of known file extensions mostly propagated by Viruses.
- Additional file extensions to be blocked can be added in this section as per the user’s requirement
- Note: We do not recommend deleting the file extensions predefined by MicroWorld.
- More options / Advanced (- - -)
- i) Delete all attachments in email if disinfection is not possible (default) - It would delete those infected attachments in an email, only when the attachment is non-disinfectable.
- More options / Advanced (- - -)
- ii) Delete entire email if disinfection is not possible (default) – It would delete the entire email if the attachments in it are non-disinfectable.
- iii) Delete entire email if any virus is found – It would delete any email infected with virus.
- iv) Quarantine blocked attachments – It would quarantine the attachments that are listed in the Block Attachment types.
- v) Delete entire email if any blocked attachment is found (default) – It would delete the email which has an attachment listed in the Block Attachment types.
- vi) Quarantine email if attachments are not scanned – It would quarantine the email in case if the attachment(s) in it is not scanned.
- vii) Quarantine attachments if they are not scanned - It would quarantine the attachment in case if it is not scanned.
- viii) Exclude attachments (White list) – Here the users can add the filename or the extensions of those files that should not be blocked and should be delivered to the user’s inbox. For e.g. If *.pif is listed in Block Attachments types and a file by the name e.g. abcd.pif is required to be allowed, then add abcd.pif can be added in the Exclude Attachments (White list) section. Adding *.pif files in this section will allow all *.pif to be delivered. We recommend adding the entire file name like abcd.pif.
- Note: The Exclude attachment list (White List) holds precedence over the Block Attachments types.
- b) Action –
- Here the action can be configured to be taken on an infected email.
- Disinfect – The infected email will be disinfected.
- Delete – The infected email will be deleted.
- Quarantine Infected Files - The infected email will be quarantined and the quarantined folder path can be set. The default path is C:\PROGRA~1\eScan\Quarant and this can be set to a different folder as per users requirement by clicking on the select path button (---).
- Here the action can be configured to be taken on an infected email.
- c) Mail Server settings –
- This setting is required to be configured for eScan to send an email notification to the user informing about the action taken on an email. This is useful for setting up an outbreak alert /notification /warning messages to the recipient, that are sent by eScan when it detects any violation or breach of security.
- SMTP Mail Server settings – Enter the SMTP IP address of the mailserver of your company or you ISP.
- SMTP Port – Enter the SMTP Port of the mailserver of your company or your ISP. By default port is 25. (You can confirm the same with your mailserver administrator or ISP).
- User Authentication (optional) – Enter the user name if your mailserver requires Authentication for sending email.
- Authentication Password (optional) - Enter the password if your mailserver requires Authentication for sending email.
- d) Port settings for eMail/Web Scan –
- Here the ports used for incoming and outgoing of email are defined, in-order for the Mail Anti-Virus to scan the emails received / sent on the respective ports.
- Outgoing Mail (SMTP) – By default the SMTP port is 25 (check with your mailserver administrator or your ISP).
- Incoming Mail (POP3) – By default the POP3 port is 110 (check with your mailserver administrator or your ISP).
- Scan Outgoing Mails – When this option is selected, Mail Anti-Virus will also scan outgoing emails.
- Here the ports used for incoming and outgoing of email are defined, in-order for the Mail Anti-Virus to scan the emails received / sent on the respective ports.
II. Compression / Decompression options:-
- Options in this section help in Internet Bandwidth Management:
- Compress outbound attachments – This option when enabled will reduce the size of all outgoing attachments in an email by compressing them in zipped/compressed format. To enable this option, ensure that the Scan Outgoing Mails in the Port Settings for email/Web Scan of the Scan options is checked.
- Create self extracing zip files – This option when enabled creates a self extractable zip file of the attachment, which when clicked on automatically uncompresses itself thereby eliminating the need at the receiver’s end from using any unzipping tool. This option needs incase the receiving user does not have any tool to uncompress/unzip the attachment.
- Uncompress inbound attachments – This option when enabled will automatically open/unpack the compressed file and be scanned and delivered to the user.
- Uncompress inbound attachments (Local Domain) – This option when enabled will automatically open/unpack the compressed file and be scanned when sent within the local domain.
- Do not compress files with extensions (Exclude following attachments) – This option is helpful in excluding the file types {attachments} that need not be compressed when being sent out.
- Compression options –
- Compress only if compression % greater than –The default value set is 25%. This will compress all attachments in emails to 25 % or more.
- Compress if attachment size is above (KB) –The default value set is 50. This will compress all attachments that are and above 50 KB in size and not below.
- Select the compression ratio – The default value set is to "Max. Speed". This option will utilize the system resources to the best and compress the attachments in emails and send it at much quicker rate. "Max. Compression" mode will try to compress the attachments to the maximum.
III. Vulnerabilities I –
- Internet Explorer (IE) has vulnerabilities and using them as the base, malwares easily transmit themselves on to systems and email clients like Outlook and Outlook Express thus making it easier for malware authors to get their malicious code propagating.
- To overcome this, MicroWorld with it’s proactive security range of solutions is committed to securing your data and system from such vulnerabilities.
- Delete attachments with CLSID extensions - this option is enabled by default. It deletes Class ID file extensions [CLSID - files that are hidden and do not show the actual file extension] to prevent dangerous files from exploiting the vulnerabilities of IE.
- Delete HTML attachments with Scripts - In general, eMails are sent and received in different formats and one of them being HTML, this HTML can have Scripts (similar to a batch file - .bat) with Tags to perform a particular or a set of task/s (embedded). Such emails when encountered are deleted to prevent exploiting the vulnerabilities.
- Script and Content check disabled for mails From - this option is useful when you know and want to add a user who is genuine and sends legitimate html email with scripts. Once added, (for example - abc@xyz.net or *@xyz.net) all emails coming from this user or domain would automatically be delivered to the receiver’s inbox/mailbox.
- Script and Content check disabled for mails To - this option is useful when you know and want to add a user who is genuine and sends legitimate html email with scripts. Once added, (for example - suzanne@xyz.net or *@xyz.net) all emails being sent from this user or domain would automatically be delivered to the receiver’s inbox/mailbox.
IV. Vulnerabilities II –
- 1. Select action on mails with Multiple Extension Attachment – Action on attachments with multiple actions will be taken as below:
- No Action
- Delete Mail
- Forward to Admin
- 2. Allow Multiple Extension attachment for ZIP file – Compressed files / attachmend for eg.Zipped files with multiple files in it will be allowed to be delivered.
- 3. Allow Multiple Extension Attachment for file types- In this section,file extensions can be added for allowing such attachments to be delivered to the users inbox.
- 1. Select action on mails with Multiple Extension Attachment – Action on attachments with multiple actions will be taken as below:
V. Archiving –
- Archive emails - This option is useful to archive or backup all emails that are sent and received via eScan. The folder or the path to this destination is customizable as per one’s requirements.The default path for mail archiving is %UserProfile%\Application Data\MicroWorld\eScan\Archive
- Archive attachments - This option is useful to archive or backup all email attachments that are sent and received via eScan. The folder or the path to this destination is customizable as per one’s requirements. The default path for the attachments archiving is %UserProfile%\Application Data\MicroWorld\eScan\Archive\Attachments
- Do not archive attachments of type - With this option certain file types can be excluded from being archived, for example - *.vcf, *.htm, *.html, etc...
Reports section
- Statistics
- Total Mails Scanned – This will display the total mails scanned by Mail Anti-Virus on real time basis.
- Total Infected Objects – This will display the total virus / malwares detected by Mail Anti-Virus on real time basis.
- a. View Archived Mails – Clicking on View Archived Mails, will display the backed up / archived emails.
- b. View Report – Clicking on View Report, will display a summary report of all the infected emails and action taken on the email.
