Kaspersky PURE 2.0. Mail Anti-Virus: security levels

Transcription

1 Mail Anti-Virus: security levels

2 Content Mail Anti-Virus. Security levels... 2 Operation algorithm of Mail Anti-Virus... 2 Security levels of Mail Anti-Virus... 2 Customizing security level... 4 Creating protection scope... 4 Heuristic analysis... 5 Scan of compound files... 6 Filtering attachments... 7 Configuring embedded plug-ins for Microsoft Office Outlook and The Bat!... 8 Installing Mail Anti-Virus plug-in in Microsoft Office Outlook 2003/ Installing Mail Anti-Virus plug-in in Microsoft Office Outlook Installing Mail Anti-Virus plug-in in The Bat! Disabling embedding of the Mail Anti-Virus plug-in in the mail clients Microsoft Outlook or The Bat! Scan of SMTP, POP3, NNTP, IMAP mail traffic Working features with Microsoft Outlook and Mozilla Thunderbird version 1.5 and above

3 Mail Anti-Virus. Security levels Operation algorithm of Mail Anti-Virus By default the mail protection functions according to the following algorithm: 1. Mail Anti-Virus intercepts each message the user sends or receives. 2. A mail message is parsed into basic components: message header (part of an message which contains technical information and shows its route since its sending to the receiving by the recipient s server), body (the text of the message itself), attachments (files attached to the message). 3. Message body and attachments (including attached OLE objects 1 are scanned for the presence of threats. Recognition of the malicious objects is performed based on the application databases 2, and the heuristic analysis 3. The databases include the description of all known malicious programs and the disinfection methods. Heuristic analysis allows to detect new viruses whose description is not added to the virus database yet. 4. If a threat is detected, Kaspersky PURE assigns one of the following statuses to the found object: malicious program (such as a virus or Trojan); potentially infected (suspicious) status if the scan cannot determine whether the object is infected or not. The file may contain a sequence of code appropriate for viruses, or modified code from a known virus. The application blocks a message, displays a notification about the detected threat and performs the assigned action. Security levels of Mail Anti-Virus Different sets of the protection parameters (security levels) suit different working conditions. A user can manually change these settings. Kaspersky Lab specialists distinguish three security levels. When set at the high security level Mail Anti-Virus maximally scans messages. If you work in a non-secure environment, the maximum security level will suit you the best. An example of such environment is a connection to a free service, from a network that is not guarded by centralized protection. 1 In this case OLE-objects are understood as graphic information implemented into the body of a message. For example, images, Excel tables and graphs in the text (not in the mail attachment). 2 Databases are anti-virus databases which contain records about threats and network attacks, as well methods to fight them. Protection components use these records when searching for dangerous objects on the computer and disinfecting them. 3 Heuristic analysis is the analysis of the objects activity in the system. If such activity is typical for malicious objects in this case an object under analysis will be recognized as suspicious or malicious. Analysis of the object activity allows to detect a virus even if it has not been defined by virus analysts. 2 18

4 Recommended. This level provides an optimum balance between the efficiency and security and is suitable for most cases. This is also the default setting. Low. If you work in a well secured environment, low security level can be used. An example of such an environment might be a corporate network with centralized security. To change the security level, perform the following actions: 1. In the left part of the Settings window select the Mail Anti-Virus component. 2. Make sure, in the right part of the Settings window the Enable Mail Anti-Virus box is checked. 3. In the Security level section configure the necessary security level. 4. In the Settings window click the Apply button. If you are not satisfied with any preset security levels you can independently configure Mail Anti-Virus settings. In this case when the settings are modified in the Settings window in the Mail Anti-Virus section the security level changes to Custom. You can roll back to the recommended security level at any moment, set by default, by clicking the Default level button. 3 18

5 Customizing security level By default, Mail Anti-Virus works with the settings recommended by Kaspersky Lab experts for the optimal protection of your mail. However, you can customize the security level of Mail Anti-Virus the following way: 1. In the Settings window select the Mail Anti-Virus component. 2. Make sure that Mail Anti-Virus is enabled (the Enable Mail Anti-Virus box is checked). 3. In the right part of the Settings window in the Security level section click the Settings button. The Mail Anti-Virus window will open. Creating protection scope By default, Kaspersky PURE scans both incoming and outgoing mails. If you are sure that outgoing mails are not infected, in this case you can configure scan of incoming messages only. Before you disable scan of outgoing mails you are advised to scan your computer for viruses, because it is likely that there are mail worms on your computer which will propagate themselves via

6 To disable scan of outgoing s, please do the following: 1. In the Mail Anti-Virus window on the General tab in the Protection scope section check the Incoming only box. 2. In the bottom right corner of the window click the OK button. 3. In the Settings window click the Apply button. Heuristic analysis During Mail Anti-Virus operation, signature analysis is always used: Kaspersky PURE compares the object found with the database records. Additionally to the analysis based on the refilled anti-virus databases, heuristic analysis is added to Mail Anti-Virus. Essentially, the heuristic method analyzes the object's activities in the system. If those actions are typical of malicious objects, the object is likely to be classed as malicious or suspicious. This allows new threats to be detected before they have been analyzed by virus analysts. You can select one of the three scanning levels of the heuristic analysis: light scan, medium scan and deep scan. If you select deep scan mode the probability of threat detection is higher but scanning takes longer. With the light scan enabled scanning is faster but the probability of threat detection in that mode is somewhat lower. Only the medium scan mode provides optimal combination of the detail level and scanning time. By default, heuristic analysis is enabled. To enable or disable heuristic analysis in Mail Anti- Virus, please do the following: 5 18

7 1. In the Mail Anti-Virus window on the General tab, in the Scan methods section make sure the Heuristic Analysis box is checked. If you do not want to use this technology, uncheck the box correspondingly. 2. Move the slider bar to select the scan method: light, medium, deep. 3. In the Mail Anti-Virus window click the OK button. 4. In the Settings window click the Apply button. Scan of compound files Compound files are a set of files and folders placed into one file (archive). By default Kaspersky PURE scans all compound files. However you should remember, that the selection of compound files scan mode affects the performance of the computer. You can enable or disable the scan of attached archives and limit the maximum size of archives to be scanned in Mail Anti-Virus. To configure Mail Anti-Virus scan settings, perform the following actions: 1. In the Mail Anti-Virus window on the General tab In the Scan of compound files section check/uncheck the following boxes: Skip attached archives; Do not process archives larger than (limit the maximum size). 6 18

8 2. In the Mail Anti-Virus window click the OK button. 3. In the Settings window click the Apply button. Filtering attachments Malware is most often distributed in mail as objects attached to messages. Files of various formats can be attached to a message. To protect your computer, for example, from automatic launch of attached files, you can enable filtering of attachments, which can automatically rename or delete files of specified types. Thus you can configure filtering of objects attached to an message using Mai Anti-Virus and to prevent penetration of malicious software onto your computer. If you access the Internet directly without a proxy server or a firewall, you are advised not to disable scanning of attached archives. To configure filtering of attached objects in Mail Anti-Virus, please do the following: 1. In the Mail Anti-Virus window go to the Attachment filter tab. 2. Select the filtering mode for attachments: Disable filtering Rename selected attachment types Delete selected attachment types When you select the modes Rename or Delete attachments, select the necessary file types (extensions) in the list or add a mask to select a new type. To add a new type of mask, click the Add link. In the Input file name mask window enter the mask and click the OK button. 7 18

9 3. In the Mail Anti-Virus window click the OK button. 4. In the Settings window click the Apply button. Configuring embedded plug-ins for Microsoft Office Outlook and The Bat! Integration of Mail Anti-Virus into the system allows the application plug-ins to embed into the mail clients Microsoft Office Outlook and The Bat!. Installing Mail Anti-Virus plug-in in Microsoft Office Outlook 2003/2007 When installing Kaspersky PURE, a special plug-in is installed in Microsoft Office Outlook. It allows you to configure Mail Anti-Virus settings quickly, and determine when messages will be scanned for dangerous objects. The plug-in comes in the form of protection tab. To go to the tab in the mail client, do the following: 1. Open the main window of Microsoft Office Outlook. 2. In the main application menu select Tools -> Options. 8 18

10 3. In the Options window go to the protection tab and specify the necessary scan mode. Scan upon receiving; Scan when read; Scan upon sending; 4. Click the OK button to save the made changes. 9 18

11 Installing Mail Anti-Virus plug-in in Microsoft Office Outlook 2010 To go to the Mail Anti-Virus tab from Microsoft Office Outlook 2010, perform the following actions: 1. Open the main window of Microsoft Office Outlook. 2. Go to the File menu. 3. In the File menu select the Options item. 4. In the Outlook Options window go to the Add-ins section. 5. In the right part of the Outlook Options window in the Add-in Options section click the Add-in Options button

12 6. In the Add-in Options window on the protection tab specify the necessary scan mode: Scan upon receiving; Scan when read; Scan upon sending; 7. Save the made the changes by clicking the OK button. Installing Mail Anti-Virus plug-in in The Bat! If The Bat! Is installed as a mail client on the computer, then actions on infected objects in The Bat! are defined using the application's own tools. Mail Anti-Virus settings extend to the scanning of attached archives only. Note that incoming messages are first scanned by Mail Anti-Virus and only after that by the plug-in of The Bat!. If you select the Disinfect (Delete) action upon detection of a malicious object, actions aimed at eliminating the threat will be performed by Mail Anti-Virus. If you select the Ignore option, the object will be disinfected by the plug-in of The Bat! When sending messages, they are first scanned by The Bat plug-in and then - by Mail Anti-Virus. To set up protection rules in The Bat!, do the following: 1. Open the main The Bat! Window. 2. In the Options menu select Preferences

13 3. In the settings tree select Anti-Virus. In the right part of the window specify the necessary settings of mail scan. Disabling embedding of the Mail Anti-Virus plug-in in the mail clients Microsoft Outlook or The Bat! To disable embedding of the Mail Anti-Virus plug-in in the mail clients Microsoft Office Outlook or The Bat!, do the following: 1. Open the main window of Kaspersky PURE. 2. In the top right corner of the window click the Settings button. 3. In the left part of the Settings window on the Protection tab select the Mail Anti-Virus component. 4. In the right part of the window in the Security level section click the Settings button

14 5. In the Mail Anti-Virus window go to the Additional tab. 6. Clear the box: Microsoft Office Outlook plug-in, if you are using Microsoft Office Outlook. The Bat! Plug-in, if you are using The Bat!

15 7. In the Mail Anti-Virus window click the OK button. 8. In the Settings window click the Apply button. Scan of SMTP, POP3, NNTP, IMAP mail traffic By default, Mail Anti-Virus in Kaspersky PURE scans a stream of mail messages using protocols SMTP, POP3, NNTP, IMAP in the real-time mode, i.e. while receiving them. If you disable protocol scan, mail will only be scanned after it is received (after it is loaded from the server onto your computer)

16 To disable traffic scan of these protocols by Mail Anti-Virus in the real-time mode, perform the following actions: 1. In the right part of the Settings window in the Security level section of the Mail Anti- Virus component click the Settings button. 2. In the Mail Anti-Virus window go to the Additional tab. 3. On the Additional tab uncheck the box POP3/SMTP/NNTP/IMAP traffic

17 4. In the bottom right corner of the window click the OK button. 5. In the Settings window click the Apply button. Working features with Microsoft Outlook and Mozilla Thunderbird version 1.5 and above Microsoft Office Outlook IMAP4 is a standard protocol to access your . With IMAP4 is stored on the IMAP mail server and can be accessed from any client on the network. The mail client gets access to the user s on the server and works with this mail as if it were stored on the user s computer. messages can be managed from the user s computer and files with the full content of the message are not constantly sent to server and back. In Kaspersky CRYSTAL when the mail is scanned by the protocol IMAP4 in Microsoft Office Outlook by default before scan all messages are downloaded on the computer locally as a result the Internet traffic may increase. In order Mail Anti-Virus would not scan these messages on delivery but would scan them only on read, do the following: 1. Open the mail client Outlook MS Office. 2. In the upper menu select Tools -> Options. 3. In the Options window go to the protection tab. 4. Uncheck the Scan upon receiving box. 5. Check the Scan when read box

18 6. Click the OK button. Mozilla Thunderbird version 1.5 and above If a mail client Mozilla Thunderbird version 1.5 or above is installed, then a default filter is embedded into the mail which allows to receive messages by IMAP protocol by chunks. For the mail to be scanned correctly by Mail Anti-Virus from Kaspersky PURE a message should be received as a whole. For the mail to be received as a whole it is recommended to specify the following parameters in Mozilla Thunderbird version 1.5 or above, perform the following actions: 1. Open Mozilla Thunderbird. 2. In the upper menu Tools -> Options. 3. In the Options window click the Advanced button. 4. On the General tab click the Config Editor button. 5. In the about:config window click the I ll be careful, I promise! button. 6. In the Filter field enter CHUNK. 7. Right-click the filter mail.server.default.fetch_by_chunks. 8. In the context menu select Toggle. 9. Make sure the Value field has changed from True to False. 10. Right-click the filter mail.imap.chunk_add

19 11. In the context menu select Change. 12. Change the value to "0". 13. Click the OK button. 14. Click OK to close the Options window. Note that when working with Mozilla Thunderbird mail client, messages transferred via IMAP will not be scanned for viruses if any filters moving messages from the Inbox folder are used