Product Guide Revision A. McAfee Customer Submission Tool 2.4.0

Transcription

1 Product Guide Revision A McAfee Customer Submission Tool 2.4.0

2 COPYRIGHT Copyright 2016 McAfee, Inc., 2821 Mission College Boulevard, Santa Clara, CA 95054, , TRADEMARK ATTRIBUTIONS Intel and the Intel logo are registered trademarks of the Intel Corporation in the US and/or other countries. McAfee and the McAfee logo, McAfee Active Protection, McAfee DeepSAFE, epolicy Orchestrator, McAfee epo, McAfee EMM, McAfee Evader, Foundscore, Foundstone, Global Threat Intelligence, McAfee LiveSafe, Policy Lab, McAfee QuickClean, Safe Eyes, McAfee SECURE, McAfee Shredder, SiteAdvisor, McAfee Stinger, McAfee TechMaster, McAfee Total Protection, TrustedSource, VirusScan are registered trademarks or trademarks of McAfee, Inc. or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Customer Submission Tool Product Guide

3 Contents Preface 5 About this guide Audience Conventions Find product documentation Introduction 7 How it works Identifying spam Avoiding spam How spam scores work Identifying phish Avoiding phish Installation 11 Requirements Installation checklist Download the product files Install the product files manually Install the tool using a script Examples Announce the tool to users Change the configuration Using the tool 17 Finding the tool on the Outlook interface Submit samples Submit wrongly categorized samples Add your Microsoft Outlook contacts to the whitelist Configure Customer Submission Tool Index 21 McAfee Customer Submission Tool Product Guide 3

4 Contents 4 McAfee Customer Submission Tool Product Guide

5 Preface This guide provides the information you need to work with your McAfee product. Contents About this guide Find product documentation About this guide This information describes the guide's target audience, the typographical conventions and icons used in this guide, and how the guide is organized. Audience McAfee documentation is carefully researched and written for the target audience. The information in this guide is intended primarily for: Administrators People who implement and enforce the company's security program. Users People who use the computer where the software is running and can access some or all of its features. Conventions This guide uses these typographical conventions and icons. Book title, term, emphasis Bold User input, code, message Interface text Hypertext blue Title of a book, chapter, or topic; a new term; emphasis. Text that is strongly emphasized. Commands and other text that the user types; a code sample; a displayed message. Words from the product interface like options, menus, buttons, and dialog boxes. A link to a topic or to an external website. Note: Additional information, like an alternate method of accessing an option. Tip: Suggestions and recommendations. Important/Caution: Valuable advice to protect your computer system, software installation, network, business, or data. Warning: Critical advice to prevent bodily harm when using a hardware product. McAfee Customer Submission Tool Product Guide 5

6 Preface Find product documentation Find product documentation On the ServicePortal, you can find information about a released product, including product documentation, technical articles, and more. Task 1 Go to the ServicePortal at and click the Knowledge Center tab. 2 In the Knowledge Base pane under Content Source, click Product Documentation. 3 Select a product and version, then click Search to display a list of documents. 6 McAfee Customer Submission Tool Product Guide

7 1 Introduction 1 McAfee Customer Submission Tool helps you to reduce the amount of unwanted or spam that you receive. The software works with your Microsoft Office Outlook software to forward messages to McAfee Labs and McAfee Quarantine Manager (MQM). McAfee Labs and MQM analyze the message sample and use it to reduce further spam. Contents How it works Identifying spam Identifying phish How it works Anti-spam products provide protection against spam. Spam is sometimes hard to detect; spammers develop new techniques, and anti-spam products are unable to detect new spam. In addition, some false detections can occur an anti-spam product can wrongly categorize some genuine messages as spam. By analyzing new spam, phish, and wrongly categorized , McAfee can continuously improve its anti-spam products. Customer Submission Tool forwards messages to McAfee Labs or MQM for analysis. Sending to McAfee Labs McAfee Labs examines messages that are incorrectly categorized by our software or other vendor products, and learn why, which improves our anti-spam products. We treat all submitted samples as confidential material and do not forward or use them for any purpose other than research. To analyze the sample properly, we look at the message headers, including sender and subject, and body contents, including text and attachments. A full privacy statement is available at the time you install the tool. Sending to MQM If your network includes MQM, you can submit samples to MQM. See also Using the tool on page 3 Identifying spam Any unsolicited and unwelcome messages are considered spam. Spam, also known as unsolicited bulk (UBE), includes: McAfee Customer Submission Tool Product Guide 7

8 1 Introduction Identifying spam Commercial messages, which are the electronic equivalent of junk mail Unwanted non-commercial messages, such as virus hoaxes, jokes, and chain letters People who create spam, known as spammers, forge the headers of the messages to hide their true identity, often deflecting retaliation toward innocent parties. What is not spam? Some is called spam, but it is not. For example, if you completed any of the following scenarios, your address is probably still on a distribution list: Subscribed to a newsletter or online forum Requested information about some products Recently left a workgroup To reduce this type of unwanted , remove your address from any out-of-date distribution lists. Avoiding spam Every time you use an address to respond to and send messages, post to an Internet chat room, or advertise an address, you expose that account to spammers. Spammers compile lists of addresses. Over time, the address is added to more lists within spammer networks, greatly increasing the amount of spam that you receive. To help reduce the number of spam messages that you receive, follow any guidelines about usage that your organization recommends. For example: Beware of purchasing products advertised within spam messages. This alerts the spammer that the address is active so the address and other personal information can then be sold to other spammers. Do not post a personal address online. Instead, use a disposable address when you participate in newsgroups, join contests, or when a third party requests your address. If the address receives an excessive amount of spam, you can stop using that address and obtain a new one. Do not reply to spam messages, even if they offer to remove you from the distribution list. Your reply confirms to the spammer that the address is active, and the address can then be sold to other spammers. How spam scores work Our anti-spam products match an extensive set of rules against every message. Each rule is associated with a score positive or negative. Rules that match spam-like characteristics give a positive score. Rules that match attributes of legitimate messages give a negative score. When added, the scores give each message an overall spam score. Some rules are simple, and match only on phrases. Other rules are more complex and match on the header information and structure of messages. A false negative is an message that has not been categorized, but contains content that is generally considered to be spam or phish. A false positive is an message that has been categorized as spam or phish, but the recipient does not consider to be spam or phish. 8 McAfee Customer Submission Tool Product Guide

9 Introduction Identifying phish 1 Anti-spam products can specify a level at which a message is considered as spam. Typically, a score of 5 indicates that a message is spam. Your anti-spam product can highlight messages by adding some text, such as **SPAM** to the subject line of the message. You can then easily identify a spam message and decide how to handle the message. You must correctly configure your anti-spam product to categorize spam when the spam score exceeds a certain level. If the level is too high (a spam score of 10 or more), the anti-spam product does not categorize some spam messages. If the level is too low, some genuine messages are wrongly categorized as spam. Identifying phish Some spammers specialize in spoofing messages to trick unsuspecting users into disclosing information about their identity and financial accounts. Spoofing examples include forging the origin of an message to conceal the identity of the sender, and creating a website that looks authentic. This specialized form of spam is known as phish. Typically, you receive an that appears to come from a respected organization such as a bank. The message normally directs you to a spoofed website where you are asked for personal and financial details such as: Account number Password Credit card details Social security numbers Criminals use the stolen identity to fraudulently obtain goods and services (such as personal loans), to: Steal directly from your account Open bank accounts Launder money Avoiding phish Follow any guidelines about usage that your organization recommends for promoting good messaging practices. For example: Beware of any that asks for passwords and other sensitive information. Banks do not ask for such information directly and normally verify information using the mail. Organizations are unlikely to lose your account information. The typical procedure is to issue new details to you by mail, rather than ask you to provide the details yourself through or via a website. Beware of links to websites. When you are asked to provide sensitive information, you might be directed via a spoofed link. For example, a link in an looks like your bank s website ( and connects you to a site that appears authentic, but the address in the browser shows a different name (such as or an IP address (such as ) instead. Beware of websites that are not secure. Legitimate organizations operate secure websites that encrypt your personal information before you send it. Their websites have addresses such as rather than In other words, they use a secure Internet protocol known as HTTPS rather than HTTP. McAfee Customer Submission Tool Product Guide 9

10 1 Introduction Identifying phish 10 McAfee Customer Submission Tool Product Guide

11 2 Installation Prepare your installation environment and install the Customer Submission Tool software. You can install the software manually, but if you intend to provide the tool to many users, we recommend that you use a script. Contents Requirements Installation checklist Download the product files Install the product files manually Install the tool using a script Requirements To ensure your installation is successful, your environment must meet the minimum requirements. Component Microsoft Office Outlook Requirement You can download 32-bit and 64-bit Customer Submission Tool installers. Each installer supports different versions of Microsoft Outlook. If you download Customer Submission Tool using the 32-bit installer, verify that you use one of these Microsoft Outlook versions: If you download Customer Submission Tool using the 64-bit installer, verify that you use one of these Microsoft Outlook versions: Messaging server Customer Submission Tool supports these versions of Microsoft Exchange Server: McAfee Customer Submission Tool Product Guide 11

12 2 Installation Installation checklist Installation checklist To make sure that your system is configured correctly to run the installation program, review the installation checklist. Determine... If your computer has a Microsoft Windows XP or later operating system If you have installed the latest service packs for Windows operating systems and Windows updates If your computer has a Microsoft Outlook 2002 or later client. The Customer Submission Tool is unable to work with Microsoft Outlook Express or other clients If you have the administrator rights and permissions for installing the Customer Submission Tool software Verified Download the product files Download the Customer Submission Tool product files from the McAfee website. Task 1 Create a temporary folder on your hard drive. 2 Go to the McAfee Free Tools page. 3 Locate the Spam Submission section, then click Customer Submission Tool. 4 Click the installation link appropriate for your computer, then click Download Now on the McAfee Software royalty-free License page. 5 Extract the archived product installation folder to the temporary folder. You can obtain the necessary utilities to extract.zip archives from most electronic services. Install the product files manually Install the Customer Submission Tool product files on your computer. For Outlook 2007 or earlier versions, after the first installation, you cannot change the installation location during reinstallation. To install Customer Submission Tool on several computers, we recommend that you use a script. Task 1 Close all running applications. 2 In the temporary folder where you downloaded the tool, double-click the McAfee Customer Submission Tool folder. 3 To open the installation wizard, locate and run the MCSTx86.EXE file for Office 32-bit, or MCSTx64.EXE for Office 64-bit. If the installer has not automatically selected the appropriate language, a dialog box opens to enable you to select a language. 4 On the McAfee Customer Submission Tool Setup window, click Next to open the Destination Folder page. 5 Keep the default destination folder or click Browse to select a different folder, then click Next. 12 McAfee Customer Submission Tool Product Guide

13 Installation Install the tool using a script 2 6 On the Ready to Install the Application page, click Next to open the Updating System page. The page displays progress messages and a progress bar. The files are copied and the software is installed, which can take a few minutes. When the installation is complete, the McAfee Customer Submission Tool has been successfully installed page appears. 7 To close the wizard, click Finish. 8 Open Microsoft Outlook. Extra buttons are available on the Microsoft Outlook user interface. Install the tool using a script Use a script to install Customer Submission Tool on several computers. For Outlook 2007 or earlier versions, after the first installation, you cannot change the installation location during reinstallation. The install command has the following general form: msiexec /qn /I mcstx86.msi parameter1 parameter2 parameter3 msiexec /qn /I mcstx64.msi parameter1 parameter2 parameter3 For more information about the Windows Installer, visit the Microsoft website. All features that can be set when configuring the tool manually (as on Configuring the tool) can be specified as parameters in the command. The following tables describe the parameters. Table 2-1 General parameters Parameter and default value CONFIGENABLED 1 (Yes) DELETESPAMONSUBMIT 0 (No) Description Allows the user to configure the tool by making the Configure MCST button visible. 0 = No 1 = Yes Any other value is treated as 1. Deletes any spam or phish after submission. 0 = No 1 = Yes Any other value is treated as 0. DONTSHOWSPAMSUBMIT 0 (No) When the user clicks the button to submit spam or phish, hides the submission dialog. 0 = No 1 = Yes Any other value is treated as 0. McAfee Customer Submission Tool Product Guide 13

14 2 Installation Install the tool using a script Table 2-1 General parameters (continued) Parameter and default value DONTSHOWHAMSUBMIT 0 (No) INSTALLDIR1 (See text) MAXSUBMISSIONCOUNT 100 REBOOT (None) Description When the user clicks the button to submit an incorrectly categorized message, hides the submission dialog box. 0 = No 1 = Yes Any other value is treated as 0. Installs the tool at the specified location. By default, the tool is installed at: C:\Program Files\McAfee\Submission Tool Allows the user to submit up to 100 messages at one time. Reboots the operating system when the installation finishes. Possible settings are: F = Forced S = Suppress R = Really Suppress We recommend that you use S or R. Table 2-2 Parameters for submissions to McAfee Labs Parameter and default value ASEENABLED 1 (Yes) ASERESPONSEFREQ 0 (Immediately) ASERESPONSETYPE 0 (Brief) Description Enables the submission of samples to McAfee Labs. How often McAfee Labs responds to the submissions. Possible settings are: 0 = Immediate 1 = Daily 2 = Weekly 3 = Never Any other value is treated as 0. Type of acknowledgment that McAfee Labs sends. Possible settings are: 0 = Brief 1 = Normal 2 = Detailed Any other value is treated as 0. Table 2-3 Parameters for submissions to MQM Parameter and default value MQMENABLED 0 (No) MQMPATH Description Enables the submission of samples to MQM. 0 = No 1 = Yes Any other value is treated as 0. URL for the user folder on MQM. For example, 14 McAfee Customer Submission Tool Product Guide

15 Installation Install the tool using a script 2 Table 2-3 Parameters for submissions to MQM (continued) Parameter and default value WHITELISTHAMONSUBMIT 0 (No) Description When the submitted is not spam or phish, automatically adds the sender address to a whitelist. 0 = No 1 = Yes Any other value is treated as 0. BLACKLISTSPAMONSUBMIT 0 (No) When the submitted is spam or phish, automatically adds the sender address to a blacklist. 0 = No 1 = Yes Any other value is treated as 0. Examples Enclose character strings in double quotes. For example: INSTALLDIR1= C:\FOLDER A\FOLDER 1. The following command: Silently installs Customer Submission Tool using the default values Allows the user to see the Submit Spam and Submit Non-spam buttons on the Microsoft Outlook toolbar Allows the user to submit samples to McAfee Labs Prevents the user from reconfiguring Customer Submission Tool When the installation finishes, no reboot occurs. msiexec /qn /i mcstx86.msi CONFIGENABLED=0 INSTALLDIR1= C:\FOLDER A\FOLDER 1 REBOOT=R msiexec /qn /i mcstx64.msi CONFIGENABLED=0 INSTALLDIR1= C:\FOLDER A\FOLDER 1 REBOOT=R The following command: Silently installs the Customer Submission Tool Enables the user to submit samples to MQM Allows the user to reconfigure Customer Submission Tool msiexec /qn /I mcstx86.msi MQMENABLED=1 MQMPATH= REBOOT=R msiexec /qn /I mcstx64.msi MQMENABLED=1 MQMPATH= REBOOT=R Announce the tool to users You can issue an announcement to the users when Customer Submission Tool is installed on their Microsoft Outlook clients. Example Today, we are deploying the McAfee spam submission tool. The tool helps us all to reduce the amount of SPAM that our organization receives. Two extra buttons appears on the Microsoft Outlook user interface. If you cannot see the icons, restart Microsoft Outlook. McAfee Customer Submission Tool Product Guide 15

16 2 Installation Install the tool using a script To submit samples of spam that were not detected as spam, click. To submit samples of messages that were wrongly categorized as spam, click. Change the configuration To change the configuration without reinstalling the tool, you can change registry settings at the key HKEY_CURRENT_USER\Software\McAfee\Submission Tool. Table 2-4 Settings Name AseEnabled AseResponseFreq AseResponseType BlacklistSpamOnSubmit ConfigEnabled DeleteSpamOnSubmit DontShowHamSubmit DontShowSpamSubmit MaxSubmissionCount MqmEnabled WhitelistHamOnSubmit Default value (in hexadecimal) The names in the registry are identical to the parameters you use to install Customer Submission Tool using a script. To enforce the changed registry settings, restart Microsoft Outlook. If you enter any incorrect values, Customer Submission Tool replaces them with the default values. 16 McAfee Customer Submission Tool Product Guide

17 3 Using 3 the tool On the Microsoft Outlook interface, you can submit samples, add contacts to the whitelist, and configure Customer Submission Tool. Contents Finding the tool on the Outlook interface Submit samples Submit wrongly categorized samples Add your Microsoft Outlook contacts to the whitelist Configure Customer Submission Tool Finding the tool on the Outlook interface Customer Submission Tool adds toolbar buttons and menu entries to the Microsoft Outlook 2007 or earlier versions. In Outlook 2010 and 2013, icons are added to the home tab of the ribbon user interface. Outlook 2007 In Outlook 2007 or earlier supported versions, the following toolbar buttons appear with the elaborated tooltip text as: Submit spam or phish sample Submit non-spam sample Configure submissions settings You can also use the options from the Actions menu. Outlook 2010 and 2013 In Outlook 2010 and 2013, the following icons appear on the home tab of the ribbon user interface: Submit Spam Submit Non-spam Configure MCST These options enable you to: Submit messages that are categorized as spam or phish. Submit messages that are wrongly categorized as spam or phish. McAfee Customer Submission Tool Product Guide 17

18 3 Using the tool Submit samples Add all your Microsoft Outlook contacts to a whitelist if your organization uses MQM. Configure some of the tool settings. Submit samples Submit spam and phish samples using your Microsoft Outlook client. Task 1 In Microsoft Outlook, view the message or select the subject line of the message. 2 On the toolbar, click Submit Spam. You can also use the Action menu. 3 In the Submit Spam or Phish dialog box, select one of the following options, then click OK. Blacklist sender on submission Adds the sender of the spam to a blacklist. Any future s from the sender are blocked. The Blacklist sender on submission checkbox is only available if your organization uses MQM. Delete messages on submission Deletes the selected spam or phish samples. Do not show this dialog again Prevents the dialog box from appearing again. To show this dialog box again, press Shift, then click Submit Spam. Customer Submission Tool submits the sample. 4 If you submit the sample to MQM, you are prompted for your logon name and password. 5 On the message window that states that the sample was submitted successfully, click OK. The tool does not submit samples that are over 1 MB. We recommend that you delete files that are over 1 MB. Submit wrongly categorized samples Submit wrongly categorized samples using your Microsoft Outlook client. Task 1 In Microsoft Outlook, view the message or select the subject line of the message. 2 On the toolbar, click Submit Non-spam. You can also use the Action menu. 3 In the Submit Non-Spam dialog box, select one of the following options, then click OK. Whitelist sender on submission When selected, any future s from the sender are not categorized as spam. The Whitelist sender on submission checkbox is only available if your organization uses MQM. Do not show this dialog again Prevents the dialog box from appearing again. To show this dialog box again, press Shift, then click Submit Spam. Customer Submission Tool submits the sample. 18 McAfee Customer Submission Tool Product Guide

19 Using the tool Add your Microsoft Outlook contacts to the whitelist 3 4 If you submit the sample to MQM, you are prompted for your logon name and password. 5 On the message window that states that the sample was submitted successfully, click OK. The tool does not submit samples that are over 1 MB. We recommend that you delete files that are over 1 MB. Add your Microsoft Outlook contacts to the whitelist To prevent categorizing from any of your Microsoft Outlook contacts as spam or phish, you can add your contact addresses to your whitelist. Before you begin This feature is only available when: Your organization uses MQM. Customer Submission Tool is configured to display the Configure MCST button on the Microsoft Outlook toolbar. Task 1 In Microsoft Outlook, click Configure MCST on the toolbar. 2 In the McAfee Customer Submission Tool dialog box, click Add contact addresses to safe sender list, then click OK. All future messages that you receive from addresses in your whitelist are scanned for viruses, but not for spam or phish. Configure Customer Submission Tool If the Configure MCST button is available on the toolbar, you can configure the features. The button is only available when you view subject lines, and is unavailable if the tool was installed via a script that did not enable it. Task 1 On the Microsoft Outlook toolbar, click Configure MCST. 2 In the McAfee Customer Submission Tool dialog box, click the General tab, then select the following options. Delete on submission Deletes each spam or phish after it is successfully submitted. Do not show submission dialog Prevents a dialog box from appearing when any spam, phish, or wrongly categorized is submitted. 3 If you want to submit samples to McAfee Labs for analysis, click the McAfee Labs tab, select Enable, then configure the following options. Frequency of response Specifies how often McAfee Labs sends an automatic to acknowledge your submissions. When you select Immediately, then send many samples at the same time, you receive several replies within the following few minutes. Type of response Specifies the detail in each automatic . For example, Brief provides an acknowledgment only. When you first use the tool, we recommend that you select Immediately and Brief. McAfee Customer Submission Tool Product Guide 19

20 3 Using the tool Configure Customer Submission Tool 4 if you want to submit samples to MQM for analysis, click the MQM tab, select Enable, then configure the following options. URL Specifies the MQM server address. For example: User name Specifies the user name that is used when communicating with MQM. For example, user@example.com. Password Specifies the password associated with the user name. Block future messages from this sender (Blacklist the sender) Blocks any future received from the sender. Allow future messages from this sender (Whitelist the sender) Prevents Customer Submission Tool from scanning any from this sender for spam or phish. is always scanned for viruses. 20 McAfee Customer Submission Tool Product Guide

21 Index A about this guide 5 add Outlook contacts to whitelist 19 announce tool to users 15 avoid phish 9 avoid spam 7, 8 C change configuration 16 configure tool 19 conventions and icons used in this guide 5 D documentation audience for this guide 5 product-specific, finding 6 typographical conventions and icons 5 download product files 12 F false negative 8 false positive 8 I install checklist 12 install tool manually 12 using script 13 M McAfee Customer Submission Tool 7 McAfee ServicePortal, accessing 6 R requirements, installation 11 S send to McAfee Labs 7 to McAfee Quarantine Manager 7 ServicePortal, finding product documentation 6 spam 7 spam scores 8 spammer 9 spoofing 9 submit first spam or phish sample 18 first wrongly categorized sample 18 T technical support, finding product information 6 tool configure 19 use 17 U use tool 17 use McAfee Customer Submission Tool 17 W what is phish 9 what is spam 7 P phish 9 McAfee Customer Submission Tool Product Guide 21

22 0A00