eScan Blog
eScan Website
eScan Forum
eScan Feeds From eScan Wiki
eMail Attachment Control
eMail Attachment Control
The latest version of eScan that has this feature is 9.x and is available in these editions - Virus Control(VC), Professional(PRO), Internet Security Suite(ISS), Corporate and Enterprise. It is compatible with Microsoft Windows operating systems like W'95,98,ME,NT 4(srv & wks),2000,2003,XP,Vista (32 & 64 bit)
This is the first option page available in the eScan Content Administrator. It can be accessed after installing eScan, by right clicking on the green 'e icon added to the systray.
It has different options like "Block Attachment types", "Port Configuration", "Compression and Decompression of Attachments" and "Advanced".
A) Block Attachment types:
This option holds a list of different file types, for example - *.exe, *.pif,* .scr, etc... which when encountered during an email download would be deleted by default (automatically). This option is set to ensure that emails having these types of known attachments (used by worms, trojans, spyware, etc...) would not be downloaded as they cannot be disinfected/ cleaned but deleted at the MWL (MicroWorld Winsock Layer).
This option can be customized based on requirements, for example - if you wish to receive the file type (*.pif), there are two options available within to set it. Firstly, delete it from the list that holds this file type or secondly you can add the file type to the Exclude Attachments (Whitelist), point no.8 explained below.
The other available options are:-
1. Delete all attachments in email if disinfection is not possible - this option is enabled by default. It would delete all attachments listed in the Block Attachments types section as they are the files that cannot be disinfected/ cleaned.
2. Delete entire email if disinfection is not possible - this option is also enabled by default. It would delete the entire email if the files within the email cannot be disinfected/cleaned.
3. Delete entire email if any virus is found - this option when enabled would delete the entire email if any virus is found in it.
4. Quarantine blocked sttachmetns - this option when enabled would quarant the attachments blocked.
5. Delete entire email if any blocked attachment is found - this option when enabled would delete the entire email if any blocked attachment is found in it.
6. Quarantine email if attachments are not scanned - this option when enabled would quarant emails if the attachments within are not scanned.
7. Quarantine attachments if they are not scanned - this option when enabled would quarant attachments when not scanned.
8. Exclude attachments (White list) - this option is useful in case a file type listed in the block attachment types section needs to be delivered into the user's mailbox/ inbox and should not be deleted. This option holds precedence over the Block Attachment types.
The other section is called "Action", which is set on the right hand side of the Block Attachments types and just below the Port Configuration option, this section is useful in setting up the action to be taken when an infection is found, the default value set is to "Disinfect" while the other is "Delete".
The options that can be set up here are of quaranting infected files and emails, if eScan is installed in the said path - by default then the path would be C:\PROGRA~1\eScan\INFECTED for infected files and C:\PROGRA~1\eScan\Quarant for emails and can be easily changed as per requirements.
B) Port Configuration:
This option is useful for setting up an outbreak alert or notification or warning messages that are sent by eScan when it detects any violation or breach of security.
There are two sections to this port configuration -
1. Mail Server settings - the mail server ip address and port details needs to be defined along with credentials like valid username and password (though optional) in case the mail server requires it, so that eScan can automatically use these details and send the notification alerts.
2. Port settings for eMail/Web Scan - the ports that are used for sending (smtp,25 )and receiving (pop3 ,110) emails are defined and if these emails need to be scanned or not.
C) Compression and Decompression of Attachments:
this option helps in Internet Bandwidth Management.
There are two options available within:-
1. Compress outbound attachments - this option when enabled will decrease the size of all attachments that are sent in emails.
2. Create self extracing zip files - this option when enabled overrides the above point no.1 and creates a self extractable .zip file which when clicked on automatically uncompresses itself thereby eliminating the need at the receiver's end from using any unzipping tool.
3. Do not compress files with extensions (Exclude following attachments) - this option is helpful in excluding the file types {attachments} that need not be compressed when being sent out.
4. a)Uncompress inbound attachments - this option when enabled will automatically open/unpack the compressed file and be scanned. b)Uncompress inbound attachments (Local Domain) - this option when enabled will automatically open/unpack the compressed file and be scanned when sent within the local domain.
5. Compression options
a) Compress only if compression % greater than - the default value set is 25, this option will compress all attachments in emails to 25 % or more.
b) Compress if attachment size is above (KB) - the default value set is 50, this option will compress all attachments that are and above 50 KB in size and not below.
c) Select the compression ratio - the default value set is of Max. Speed, this option will utilize the system resources to the best and compress the attachments in emails quicker and send it out too.
D) Advanced:
Internet Explorer (IE) has vulnerabilities and using them as the base, malwares easily transmit themselves onto the system and email clients like Outlook and Outlook Express thus making it easier for malware authors to get their malicious code propagating.
To overcome them, MicroWorld with it's security range of solutions is committed to securing your data and system from such vulnerabilities.
1. IE Vulnerabilities 1
a) Delete attachments with CLSID extensions - this option is enabled by default. It deletes Class ID file extensions [CLSID - files that are hidden and do not show the actual file extension] to prevent dangerous files from exploiting the vulnerabilities of IE.
b) Delete HTML attachments with Scripts - this option is not enabled by default. In general, eMails are sent and received in different formats and one of them being HTML, this HTML can have Scripts {similar to a batch file - .bat) with Tags to perform a particular or a set of task/s (embedded), such emails when encountered are deleted to prevent exploiting the vulnerabilities.
c) Script & Content check disabled for mails From - this option is useful when you know and want to add a user who is genuine and sends legitimate html email with scripts. Once added, (for example - abc@xyz.net or *@xyz.net) all emails coming from this user or domain would automatically be delivered to the receiver's inbox/mailbox.
d) Script & Content check disabled for mails To - this option is useful when you know and want to add a user who is genuine and sends legitimate html email with scripts. Once added, (for example - suzanne@xyz.net or *@xyz.net) all emails being sent from this user or domain would automatically be delivered to the receiver's inbox/mailbox.
2. IE Vulnerabilities 2
a) Select action on mails with Multiple Extension Attachment - the default option set is to "No Action", the other is "Delete mail", this option is very useful to prevent malware like worms from propagating itself using multiple (double or triple) extensions via email attachments, for example -nimda, sircam, etc...
b) Allow Multiple Extension attachment for ZIP file - the default option set is to "Yes" or "Allowed", this option is very useful and helps in transmitting multiple extensions attachments in email, for example - compressed files like .zip, .pdf that have multiple extensions can be allowed.
3. Archival
a) Archive emails - this option is not enabled by default. This option is useful to archive or backup all emails that are sent and received via eScan. The folder or the path to this destination is customizable as per one's requirements.
b) Archive attachments - this option is not enabled by default. This option is useful to archive or backup all email attachments that are sent and received via eScan. The folder or the path to this destination is customizable as per one's requirements.
c) Do not archive attachments of type - With this option certain file types can be excluded from being archived, for example - *.vcf, *.htm, *.html, etc...
Other options -
Save - this option enables the user to Save the settings done.
Refresh - this option refreshes itself and displays the latest status.
