Outlook IMAP protection?

[mh0001]

Hi,

I read in system requirements to VirusScan Plus 2009 that VirusScan supports IMAP in Outlook.
Now I have tested this by sending me some mails with the eicar test file as attachement.

While getting my mails by pop3, VirusScan put the attachement to quarantine. But when I use IMAP, it does nothing and let me access the attachement. It just alerts when I try to save it to the hdd or try to run it.

As I understood, there should be a real IMAP-Plugin that behaves the same way for IMAP-accounts like pop3.

Any suggestions?

[matrixluke]

Do you mean that every attachment that you recieve through POP3 is quarantined?

To your attention, there is alot difference in between the working of POP3 and IMAP, I specify this point because E-mails are scanned while the e-mails are downloaded from the Server. There is alot difference in the way the mails being downloaded.

Find more on this link.

http://www.ietf.org/proceedings/94jul/charters/imap-charter.html

[exbrit]

I think you are confusing MAPI with IMAP.

From the System Requirements page:

Supported Email Programs

• 
  
• POP3 – Outlook Express, Outlook, Eudora, Netscape, IncrediMail and Thunderbird; Japanese only: Shuriken, Becky and PostPet
  
• MAPI – Outlook
  
• Web – MSN/Hotmail, or email account with POP3 access

This is particularly important when using Anti-Spam (formerly Spamkiller): http://service.mcafee.com/FAQDocument.aspx?id=100929&lc=1033&partner=McAfee&type=TS&ia=1

There's an interesting line in that FAQ:

Please note that many IMAP servers also have the ability to support a POP3 connection as well. You should consult with your IMAP server administrator to see about the POP3 server addresses and login information and then set up that type of account in SpamKiller instead of the IMAP account.

The same could apply to any other type of scanning such as VirusScan.

[mh0001]

No!
I send eicar.com as attachment! The problem is, that if I receive this email using IMAP, VirusScan doesn't scan the mail and doesn't recognize the virus test file.
If I receive it using POP3, VirusScan DOES scan the mail and detect it as a virus (as it should be).

But I want VirusScan to scan the mails I receive using IMAP, too!

[mh0001]

The mail server I use does support both POP3 and IMAP. But I WANT to use IMAP because of it's features.
I don't have the Anti-SPAM installed anyway.
I just have VirusScan and SecurityCenter.

My provider has a virus protection for incoming mails that scans the mails before they arrive me. The problem is, that I can't use this feature any longer without having to pay for it.
So I thought, that VirusScan should be able to do the same thing for me, scanning incoming mails.
So I looked at the McAfee site and saw that it supports MAPI for scanning mails.

I thought MAPI=IMAP ?

[exbrit]

No it isn't the same. I don't use either personally relying instead on Windows Mail, so I had to Google it.

This site gives a good description of the difference and MAPI appears to be the best out of the three, MAPI, IMAP and POP, and of course it is supported.

http://www.intermedia.net/support/kb/default.asp?id=997

[mh0001]

So IMAP isn't supported by VirusScan?

Hmmm....
Has it any advantages to scan the E-Mails before opening them?

Outlook blocks all kind of dangerous file-extensions by default and don't run activex or other scripts.

And if the mail include a script or malware-attachment that is included in the VirusScan-DAT, then it should be blocked when I try to execute it anyway, right?

When you open an attachment in Outlook, it temporarly stores it in the "Temporary Internet Files"-folder and then asks you if you want to open it.
So VirusScan file protection deletes it and outlook just say "File not found".

[exbrit]

If anything that is detectable tries to install itself on your hard drive then VirusScan will block it, no matter which source it's from.

[DaGopha]

Not to flog a dead horse, but this is really interesting.

I'm moving across to IMAP with either Outlook or Thunderbird shortly - but from what I gather here, McAfee doesn't scan IMAP mail in the same way that it does POP3? Of course, IMAP is different in that the mail is on the server, and POP3 is being downloaded to the PC.

But offline-IMAP, such that the mail is present locally and on the server, and is sychronised in real time, should surely be covered by McAfee, since the mail is effectively being stored locally as well?

But from what I gather from this thread - this isn't the case?

This could be a real killer - cos' if McAfee can't handle IMAP scanning like it would POP3, then it's next to useless, because - correct me if I'm wrong - it's potentially like downloading nasties to your machine and then waiting for them to execute before McAfee does anything about them...?

Cripes!

Cheers,
Goph.

[exbrit]

I have no idea as I have never used Outlook and this thread is long since dead.