Small Office Security 2. Mail Anti-Virus

Transcription

1 Small Office Security 2 Mail Anti-Virus

2 Table of content Table of content... 1 Mail Anti-Virus... 2 What is Mail Anti-Virus... 2 Enabling/Disabling Mail Anti-Virus... 2 Operation algorithm of Mail Anti-Virus... 3 Security levels of Mail Anti-Virus... 4 Changing Mail Anti-Virus actions to be performed on detected threats... 5 Default actions... 5 Actions that user can set... 5 Actions for each object... 6 How to specify an action on detected threats... 7 Configuring settings of the user security level... 8 Creating a protection scope... 8 Heuristic analysis Scan of compound files Filtering attachments Installing Mail Anti-Virus plug-in in Microsoft Office Outlook Installing Mail Anti-Virus plug-in in The Bat! Disabling embedding of the Mail Anti-Virus plug-in in the mail clients Microsoft Outlook and The Bat! Scan of SMTP, POP3, NNTP, IMAP traffic Working features with Microsoft Outlook and Mozilla Thunderbird version 1.5 and above

3 Mail Anti-Virus What is Mail Anti-Virus Mail Anti-Virus from Protection Center of Kaspersky Small Office Security 2 scans incoming and outgoing messages for the presence of malicious objects. The component scans all sent or received on the POP3, SMTP, IMAP, MAPI and NNTP protocols, as well as on secure connections (SSL) for POP3 and IMAP. 1 Enabling/Disabling Mail Anti-Virus By default the Mail Anti-Virus component is enabled. You can disable Mail Anti-Virus, if necessary. To enable or disable Mail Anti-Virus, do the following: 1. Open the main application window. 2. In the left side of the window choose the tab Protection Center. 3. In the top part of the window, click the Settings link. 4. In the left part of the Settings window select the Mail Anti-Virus component: Clear the Enable Mail Anti-Virus box, to disable the component. Check the Enable Mail Anti-Virus box, to enable the component. 5. In the Settings window click the Apply button. 1 POP3, SMTP, IMAP, MAPI and NNTP are protocols intended for creation, receiving and transfer of . SSL protocol provides secure transfer (encryption) of data by other protocols (example, POP3 and IMAP). 2 20

4 Operation algorithm of Mail Anti-Virus By default the mail protection functions according to the following algorithm: 1. Mail Anti-Virus intercepts each message the user sends or receives. 2. A mail message is parsed into basic components: message header (part of an message which contains technical information and shows its route since its sending to the receiving by the recipient s server), body (the text of the message itself), attachments (files attached to the message). 3. Message body and attachments (including attached OLE objects 2 are scanned for the presence of threats. Recognition of the malicious objects is performed based on the application databases 3, and the heuristic analysis 4. The databases include the description of all known malicious programs and the disinfection methods. Heuristic analysis allows to detect new viruses whose description is not added to the virus database yet. 4. If a threat is detected, KSOS 2 assigns one of the following statuses to the found object: malicious program (such as a virus or Trojan); potentially infected (suspicious) status if the scan cannot determine whether the object is infected or not. The file may contain a sequence of code appropriate for viruses, or modified code from a known virus. 2 In this case OLE-objects are understood as graphic information implemented into the body of a message. For example, images, Excel tables and graphs in the text (not in the mail attachment). 3 Databases are anti-virus databases which contain records about threats and network attacks, as well methods to fight them. Protection components use these records when searching for dangerous objects on the computer and disinfecting them. 4 Heuristic analysis is the analysis of the objects activity in the system. If such activity is typical for malicious objects in this case an object under analysis will be recognized as suspicious or malicious. Analysis of the object activity allows to detect a virus even if it has not been defined by virus analysts. 3 20

5 The application blocks a message, displays a notification about the detected threat and performs the assigned action. By default Mail Anti-Virus works with the set of settings configured by Kaspersky Lab experts for the optimal protection of your mail. Security levels of Mail Anti-Virus Different sets of the protection parameters (security levels) suit different working conditions. A user can manually change these settings. Kaspersky Lab specialists distinguish three security levels. When set at the high security level Mail Anti-Virus maximally scans messages. If you work in a non-secure environment, the maximum security level will suit you the best. An example of such environment is a connection to a free service, from a network that is not guarded by centralized protection. Recommended. This level provides an optimum balance between the efficiency and security and is suitable for most cases. This is also the default setting. Low. If you work in a well secured environment, low security level can be used. An example of such an environment might be a corporate network with centralized security. In order to change the security level, please do the following: 1. In the left part of the Settings window select Mail Anti-Virus. 2. Make sure the Enable Mail Anti-Virus box is checked in the right part of the window. 3. In the Security level section set the necessary security level. 4. Click the Apply button in the bottom right corner of the window. If you are not satisfied with any preset security levels you can independently configure Mail Anti- Virus settings. In this case when the settings are modified in the Settings window in the Mail Anti-Virus section the security level changes to Custom. You can roll back to the recommended security level at any moment, set by default, by clicking the Default level button. 4 20

6 Changing Mail Anti-Virus actions to be performed on detected threats Default actions By default the program itself defines an action to be performed over an infected object. If as a result of scan the program failed to define whether the object is infected or not, the object is quarantined. If as a result of a scan KSOS 2 assigns the status of a malicious program to the object, Mail Anti- Virus will try to disinfect an infected object. If disinfection is impossible, the object is deleted. Before attempting to disinfect or delete an infected object, KSOS 2 creates a backup copy of it to allow later restoration or disinfection. Actions that user can set You can also define an action to be performed for detected threats. In this case the following actions upon threat detection can be defined for Mail Anti-Virus: Disinfect Delete Delete, if disinfection fails (this option appears if you checked the Disinfect box). 5 20

7 If the Disinfect variant is selected, the program functions the following way: If the object can be disinfected, it will be disinfected and will return to the user. If as a result of scan the program failed to define whether the object is infected or not, the object is quarantined. If the option to scan quarantined files after each database update is enabled, then when a new disinfection signature is received the quarantined object can be disinfected and returned to the user. If the status of a virus is assigned to the object and its disinfection is impossible, the object is blocked and is added to the report about detected threats. You can select only the Delete variant, but in this case all objects will be deleted, even if they could be available for the user after disinfection. Kaspersky Lab specialists recommend to select the following actions for the detected threats: Disinfect; Delete if disinfection fails. In this case the program will perform the following actions over an object: Disinfect, if disinfection is possible. After disinfection you can continue your work with the object. Quarantine, if the program failed to define if the object is infected or not. If the option to scan quarantined files after each database update is enabled, then when a new disinfection signature is received the quarantined object can be disinfected and returned to the user. Delete, if the virus status is assigned to the object and its disinfection is impossible. Actions for each object You can also specify Mail Anti-Virus actions for every detected object individually. For this enable KSOS 2 interactive mode: 1. In the Settings window select General Settings. 2. In the left part of the window in the Interactive protection section clear the Select action automatically box. 3. Click the Apply button. 6 20

8 Interactive mode can only be enabled for the whole program. When the mode is enabled you will have to select an action for every object detected by any KSOS 2 component. How to specify an action on detected threats To specify an action over detected threats, please do the following: 1. In the left part of the Settings window select Mail Anti-Virus. 2. Make sure that the Enable Mail Anti-Virus box is checked in the right part of the window 3. In the Action section select an action over detected threats: Select action automatically Select action: o Disinfect o Delete (Delete if disinfection fails) 4. In the window Settings click the Apply button. 7 20

9 If the Select action option is enabled but no action is chosen, Mail Anti-Virus will block dangerous objects and quarantine them notifying the user about the quarantined objects. The Delete, if disinfection fails options appears only if the Disinfect box is checked. Configuring settings of the user security level Creating a protection scope By default, KSOS 2 scans both incoming and outgoing mails. If you are sure that outgoing mails are not infected, in this case you can configure scan of incoming messages only. Before you disable scan of outgoing mails you are advised to scan your computer for viruses, because it is likely that there are mail worms on your computer which will propagate themselves via . To disable scans of outgoing s, please do the following: 1. In the left part of the Settings window select Mail Anti-Virus. 2. Make sure Mail Anti-Virus is enabled (the Enable Mail Anti-Virus box is checked). 3. In the Security level section click the Settings button. 8 20

10 4. On the General tab in the Protection scope section check the Incoming messages only box. 5. In the window Mail Anti-Virus click the OK button. 6. In the Settings window click the OK button. 9 20

11 Heuristic analysis During Mail Anti-Virus operation, signature analysis is always used: KSOS 2 compares the object found with the database records. Additionally to the analysis based on the refilled anti-virus databases, heuristic analysis is added to Mail Anti-Virus. Essentially, the heuristic method analyzes the object's activities in the system. If those actions are typical of malicious objects, the object is likely to be classed as malicious or suspicious. This allows new threats to be detected before they have been analyzed by virus analysts. You can select one of the three scanning levels of the heuristic analysis: light scan, medium scan and deep scan. If you select deep scan mode the probability of threat detection is higher but scanning takes longer. With the light scan enabled scanning is faster but the probability of threat detection in that mode is somewhat lower. Only the medium scan mode provides optimal combination of the detail level and scanning time. By default, heuristic analysis is enabled. To enable or disable heuristic analysis in Mail Anti-Virus, please do the following: 1. In the Security level section of the Settings window click the Settings button. 2. On the General tab in the Scan methods section make sure the Heuristic Analysis box is checked; clear the box if you do not want to use this scan method. 3. Move the slider bar to select the scan method: light, medium, deep. 4. In the bottom corner of the window click the OK button

12 5. In the Settings window click the OK button. Scan of compound files Compound files are a set of files and folders placed into one file (archive). By default KSOS 2 scans all compound files. However you should remember, that the selection of compound files scan mode affects the performance of the computer. You can enable or disable the scan of attached archives and limit the maximum size of archives to be scanned in Mail Anti-Virus. To configure Mail Anti-Virus scan settings, please do the following: 1. In the Security level section click the Settings button

13 2. On the General tab in the Scan of compound files section check/ clear the boxes: Skip attached archives Do not process archives larger than 3. Limit the maximum size. 4. In the bottom corner of the window click the OK button. 5. In the Settings window click the Apply button

14 Filtering attachments Malware is most often distributed in mail as objects attached to messages. Files of various formats can be attached to a message. To protect your computer, for example, from automatic launch of attached files, you can enable filtering of attachments, which can automatically rename or delete files of specified types. Thus you can configure filtering of objects attached to an message using Mai Anti-Virus and to prevent penetration of malicious software onto your computer. If you access the Internet directly without a proxy server or a firewall, you are advised not to disable scanning of attached archives. To configure filtering of attached objects in Mail Anti-Virus, please do the following: 1. In the Security level section click the Settings button. 2. In the Mail Anti-Virus window go to the Attachment filter tab. 3. Select the filtering mode for attachments: Disable filtering Rename selected attachment types Delete selected attachment types When you select the modes Rename or Delete attachments, select the necessary file types (extensions) in the list or add a mask to select a new type. To add a new type of mask, click the Add link. In the Input file name mask window enter the mask and click the OK button. 4. On the Attachment filter tab click the OK button

15 5. In the Settings window click the Apply button. Installing Mail Anti-Virus plug-in in Microsoft Office Outlook When installing KSOS 2, a special plug-in is installed in Microsoft Office Outlook. It allows you to configure Mail Anti-Virus settings quickly, and determine when messages will be scanned for dangerous objects. The plug-in comes in the form of protection tab. To go to the tab in the mail client, do the following: Open the main window of Microsoft Office Outlook. 1. In the main application menu select Tools > Options. 2. In the Options window go to the protection tab and specify the necessary scan mode

16 Installing Mail Anti-Virus plug-in in The Bat! If The Bat! Is installed as a mail client on the computer, then actions on infected objects in The Bat! are defined using the application's own tools. Mail Anti-Virus settings extend to the scanning of attached archives only. Note that incoming messages are first scanned by Mail Anti-Virus and only after that by the plug-in of The Bat!. If you select the Disinfect (Delete) action upon detection of a malicious object, actions aimed at eliminating the threat will be performed by Mail Anti-Virus. If you select the Ignore option, the object will be disinfected by the plug-in of The Bat! When sending messages, they are first scanned by The Bat plug-in and then - by Mail Anti- Virus. To set up protection rules in The Bat!, do the following: 1. Open the main The Bat! Window. 2. In the Options menu select Preferences. 3. In the settings tree select Anti-Virus

17 Disabling embedding of the Mail Anti-Virus plug-in in the mail clients Microsoft Outlook and The Bat! To disable embedding of the Mail Anti-Virus plug-in in the mail clients Microsoft Office Outlook or The Bat!, do the following: 1. In the Security level section of the Mail Anti-Virus component click the Settings button. 2. Go to the Additional tab. 3. Clear the box Additional: Microsoft Office Outlook plug-in, if you are using Microsoft Office Outlook. 4. Clear the box Additional: The Bat! Plug-in, if you are using The Bat!. 5. In the bottom right corner of the window click the OK button

18 6. In the Settings window click the Apply button. Scan of SMTP, POP3, NNTP, IMAP traffic By default, Mail Anti-Virus in KSOS 2 scans a stream of mail messages using protocols SMTP, POP3, NNTP, IMAP in the real-time mode, i.e. while receiving them. If you disable protocol scan, mail will only be scanned after it is received (after it is loaded from the server onto your computer). To disable traffic scan of these protocols by Mail Anti-Virus in the real-time mode, do the following: 1. In the Security level section of the Mail Anti-Virus component click the Settings button

19 2. In the Mail Anti-Virus window go to the Additional tab. 3. Clear the box POP3/SMTP/NNTP/IMAP traffic. 4. In the bottom right corner of the window click the OK button. 5. In the Settings window click the OK button

20 Working features with Microsoft Outlook and Mozilla Thunderbird version 1.5 and above Microsoft Office Outlook IMAP4 is a standard protocol to access your . With IMAP4 is stored on the IMAP mail server and can be accessed from any client on the network. The mail client gets access to the user s on the server and works with this mail as if it were stored on the user s computer. messages can be managed from the user s computer and files with the full content of the message are not constantly sent to server and back. In KSOS 2 when the mail is scanned by the protocol IMAP4 in Microsoft Office Outlook by default before scan all messages are downloaded on the computer locally as a result the Internet traffic may increase. In order Mail Anti-Virus would not scan these messages on delivery but would scan them only on read, do the following: 1. Open the mail client Outlook MS Office. 2. In the upper menu select Tools > Options. 3. In the Options window go to the protection tab. 4. Clear the Scan upon receiving box. 5. Check the Scan when read box. 6. Click the OK button. Mozilla Thunderbird version 1.5 and above If a mail client Mozilla Thunderbird version 1.5 or above is installed, then a default filter is embedded into the mail which allows to receive messages by IMAP protocol by chunks. For the mail to be scanned correctly by Mail Anti-Virus from KSOS 2 a message should be received as a whole. For the mail to be received as a whole it is recommended to specify the following parameters in Mozilla Thunderbird version 1.5 or above: 1. Open Mozilla Thunderbird. 2. In the upper menu Tools > Options. 3. In the Options window click the Advanced button. 4. On the General tab click the Config Editor button. 5. In the about:config window click the I ll be careful, I promise! button. 6. In the Filter field enter CHUNK. 7. Right-click the filter mail.server.default.fetch_by_chunks. 8. In the context menu select Toggle. 9. Make sure the Value field has changed from True to False. 10. Right-click the filter mail.imap.chunk_add

21 11. In the context menu select Change. 12. change the value to "0". 13. Click the OK button. 14. Click OK to close the Options window. Note that when working with Mozilla Thunderbird mail client, messages transferred via IMAP will not be scanned for viruses if any filters moving messages from the Inbox folder are used