InterScan E-Mail VirusWall

Sanitize your email attachments

Show of hands--how many of you send atleast one email message per day? For many Windows NT professionals, email is thefabled killer app that developers want to tap into. Indeed, for collaborationand communication, nothing beats the ease and convenience of email.Unfortunately, email can also be a vehicle for virus attacks: Most email clientssupport file attachments, but the clients don't check file integrity. Because alarge percentage of email messages include attached files, systems connected toa network or the Internet probably will catch a virus.

Fortunately, there's help. Trend Micro's InterScan E-Mail VirusWall 1.72 isa service that acts as a gateway between your computer and a Simple MailTransport Protocol (SMTP) mail server. The program sits between the server andclients to detect and clean files before the server delivers the files to theirdestination. In short, E-Mail VirusWall cleans the places the other leadingvirus scanners, mail gateways, and firewalls can't reach.

The product ships on three floppy disks and includes a fourth disk thatcontains the freeware EMWAC Web server (you can also use a third-party Webserver as the host). The product includes a Web server for administrators whowant to configure and update E-Mail VirusWall across an intranet, as they doInternet Information Server (IIS). Installation is simple enough--just run Setupfrom the floppies and select a directory for the program. The setup program willcopy the files and start the service automatically. After the installation, youcan log on to the program. Because the default username and password areidentical, change the password as soon as possible.

You can configure E-Mail VirusWall's options with its applet or by using aWeb browser; the latter method is ideal for administrators who work from remotemachines. Both methods provide a rich set of configuration options: You cancustomize logging functions, cleaning options, and notification messages, asshown in Screen 1. To save time, you can set the scanner to allow certain files,such as DLL files, to pass through automatically.

When a file arrives via email, the program performs like a conventionalvirus scanner. It creates a duplicate of the file and scans it. If the file isclean, the program passes the file through the gateway and the mail serverdelivers it. If the file is infected, however, E-Mail VirusWall moves the fileto a temporary directory, cleans the file automatically and passes it through tothe server, deletes the file, or sends it anyway, depending on yourinstructions. The program also sends warning messages to the sender, therecipient, and the administrator. You can change these messages in theconfiguration program as needed. E-Mail VirusWall supports UUencoded files,MIME, and most popular compression formats, including ARJ and ZIP.

As a reviewer, I hate to admit that I've noticed no significant snags inthe program. To test it, I set up an Exchange Server acting as an SMTP mailserver. I attached an executable file infected with the Jerusalem virus and sentit to another email address on the server. When the file arrived on the server,E-Mail VirusWall scanned the file, cleaned it, delivered it, and sent out threenotification messages.

If you send files via email on your network, or if you have a mail serveron the Internet, look into E-Mail VirusWall. It works so well and is sounobtrusive that you won't know it's there. Even though E-Mail VirusWall detectsthe same viruses that conventional virus scanners trap (e.g., boot sectorviruses and document macro viruses), E-Mail VirusWall complements your existingvirus scanner because the two scanners look at different files. Following thetrend set by McAfee and Symantec in their virus scanners, E-Mail VirusWall letsyou retrieve virus definition updates electronically so the program will scanfor new viruses. On unattended servers, I recommend turning on automaticupdating and setting it to poll Trend Micro's server weekly for updateddefinitions. A 30-day trial version of E-Mail VirusWall is available fromhttp://www.trendmicro.com/emvwnt-dl.html.