Monday, February 18, 2008

McAfee Anti-Spam

McAfee Anti-Spam

Anti-Spam (formerly called SpamKiller) stops unsolicited e-mail from entering your Inbox by examining your incoming e-mail, and then marking it as spam (e-mail soliciting you to purchase something) or phishing (e-mail soliciting you to provide personal information to a potentially fraudulent Web site). Anti-Spam then filters the spam e-mail and moves it to the McAfee Anti-Spam folder.

If your friends sometimes send you legitimate e-mail that may appear as spam, you can ensure that it is not filtered by adding their e-mail addresses to Anti-Spam's friends list. You can also customize how spam is detected. For example, you can filter messages more aggressively, specify what to look for in a message, and create your own filters.

Anti-Spam also protects you if you try to access a potentially fraudulent Web site through a link in an e-mail message. When you click a link to a potentially fraudulent Web site, you are redirected to the Phishing filter safe page. If there are Web sites that you do not want filtered, you can add them to the whitelist (Web sites in this list are not filtered).

Anti-Spam works with various e-mail programs, such as POP3, POP3 Webmail, Yahoo®, MSN®/Hotmail®, Windows® Live™ Mail, and MAPI (Microsoft Exchange Server) accounts. If you use a browser to read your e-mail, you must add your Webmail account to Anti-Spam. All other accounts are configured automatically and you do not have to add them to Anti-Spam.

Note: SecurityCenter reports critical and non-critical protection problems as soon as it detects them. If you need help diagnosing your protection problems, you can run McAfee Virtual Technician.

In this chapter

Anti-Spam features

Anti-Spam provides the following features.

Spam filtering

Anti-Spam's advanced filters prevent unsolicited e-mail from entering your Inbox, and are updated automatically for all your e-mail accounts. You can also create custom filters to ensure that all spam is filtered, and report spam to McAfee for analysis.

Phishing filtering

The Phishing filter identifies potential phishing (fraudulent) Web sites that solicit personal information.

Customized spam processing

Mark unsolicited e-mail as spam and move it to your McAfee Anti-Spam folder, or mark legitimate e-mail as not spam and move it to your Inbox.

Friends

Import your friends' e-mail addresses to the friends list so that their e-mail messages are not filtered.

Sort list items by relevance

You can sort your personal filters, friends, address books, and Webmail accounts by relevance (simply click the appropriate column name).

Additional support

Anti-Spam supports Mozilla® Thunderbird™ 1.5 and 2.0, and provides Windows Vista™ 64-bit support for Windows Mail. In addition, the new gaming mode feature stops Anti-Spam background processes so that your computer does not slow down while you play video games or watch DVDs. Anti-Spam also filters Microsoft® Outlook®, Outlook Express, or Windows Mail accounts on any port, including SSL (Secure Socket Layer) ports.

Setting up Webmail accounts

If you use a browser to read your e-mail messages, you must configure Anti-Spam to connect to your account and filter your messages. To add your Webmail account to Anti-Spam, simply add the account information provided by your e-mail provider.

After you add a Webmail account, you can edit your account information, and obtain more information about filtered Webmail. If you are not using a Webmail account any more, or you do not want it filtered, you can remove it.

Anti-Spam works with various e-mail programs, such as POP3, POP3 Webmail, Yahoo®, MSN/Hotmail, Windows Live Mail, and MAPI accounts. POP3 is the most common account type, and is the standard for Internet e-mail. When you have a POP3 account, Anti-Spam connects directly to the e-mail server and filters messages before they are retrieved by your e-mail program. POP3 Webmail, Yahoo, MSN/Hotmail, and Windows Mail accounts are Web-based. Filtering POP3 Webmail accounts is similar to filtering POP3 accounts. MAPI is a system designed by Microsoft that supports many types of messaging, including Internet e-mail, fax, and Exchange Server messaging. Currently, only Microsoft Outlook can work directly with MAPI accounts.

Note: Although Anti-Spam can access MAPI accounts, it does not filter your e-mail until you have retrieved your messages with Microsoft Outlook.

In this chapter

Add a Webmail account

Add a POP3 (for example, Yahoo), MSN/Hotmail, or Windows Mail (only paid versions are fully supported) Webmail account if you want to filter the messages in that account for spam.

  1. Open the Spam Protection pane.

    How?

  2. On the Spam Protection pane, click Webmail Accounts.
  3. On the Webmail Accounts pane, click Add.
  4. Specify the account information, and then click Next.
  5. Under Checking Options, specify when Anti-Spam checks your account for spam.
  6. If you are using a dial-up connection, specify how Anti-Spam connects to the Internet.
  7. Click Finish.

Edit a Webmail account

You must edit your Webmail account information when changes to your account occur. For example, edit your Webmail account if you change your password, or if you want Anti-Spam to check for spam more frequently.

  1. Open the Spam Protection pane.

    How?

  2. On the Spam Protection pane, click Webmail Accounts.
  3. Select the account you want to modify, and then click Edit.
  4. Specify the account information, and then click Next.
  5. Under Checking Options, specify when Anti-Spam checks your account for spam.
  6. If you are using a dial-up connection, specify how Anti-Spam connects to the Internet.
  7. Click Finish.

Remove a Webmail account

Remove a Webmail account if you no longer want to filter its e-mail for spam. For example, if your account is not active any more or you are experiencing problems, you can remove the account while you troubleshoot the issue.

  1. Open the Spam Protection pane.

    How?

  2. On the Spam Protection pane, click Webmail Accounts.
  3. Select the account you want to remove, and then click Remove.

Understanding Webmail account information

The following tables describe the information you must specify when adding or editing Webmail accounts.

Account information

Information

Description

Description

Describe the account for your own reference. You can type any information in this box.

E-mail Address

Specify the e-mail address associated with this e-mail account.

Account Type

Specify the type of e-mail account you are adding. (for example, POP3 Webmail or MSN/Hotmail).

Server

Specify the name of the mail server that hosts this account. If you do not know your server name, refer to the information provided by your Internet Service Provider (ISP).

User Name

Specify the user name for this e-mail account. For example, if your e-mail address is username@hotmail.com, the user name is likely username.

Password

Specify the password for this e-mail account.

Confirm Password

Verify the password for this e-mail account.

Checking options

Option

Description

Check every

Anti-Spam checks this account for spam at the interval (number of minutes) you specify. The interval must be between 5 and 3600 minutes.

Check on startup

Anti-Spam checks this account every time you restart the computer.

Connection options

Option

Description

Never dial a connection

Anti-Spam does not automatically dial a connection for you. You must manually start your dial-up connection.

Dial when no connection is available

When an Internet connection is not available, Anti-Spam attempts to connect using the dial-up connection you specify.

Always dial the specified connection

Anti-Spam attempts to connect using the dial-up connection you specify. If you are currently connected through a different dial-up connection than the one you specify, you will be disconnected.

Dial this connection

Specify the dial-up connection Anti-Spam uses to connect to the Internet.

Stay connected after filtering has completed

Your computer stays connected to the Internet after filtering is complete.

Setting up friends

To ensure that Anti-Spam does not filter legitimate e-mail messages from your friends, you can add their addresses to Anti-Spam's list of friends.

The simplest way to update your friends list is to add your address books to Anti-Spam so that all your friends' e-mail addresses are imported. After you add an address book, its contents are imported automatically at scheduled intervals (daily, weekly, or monthly) to prevent your friends list from becoming out-of-date.

You can also update your Anti-Spam friends list manually, or add an entire domain if you want each user on the domain to be added to your friends list. For example, if you add the company.com domain, none of the e-mail from that organization is filtered.

In this chapter

Setting up friends automatically

You automatically update your list of friends by adding your address books to Anti-Spam. Adding an address book allows Anti-Spam to import the corresponding e-mail addresses and populate the friends list with them.

After you add an address book, you can change how often its contents are imported to your friends list. You can also remove an address book if you no longer want to import its contents.

In this section

Add an address book

Add your address books so that Anti-Spam can automatically import all your e-mail addresses and update your friends list. This ensures that your friends list is always up-to-date.

  1. Open the Spam Protection pane.

    How?

  2. On the Spam Protection pane, click Address Books.
  3. On the Address Books pane, click Add.
  4. Click the type of address book you want to import in the Type list.
  5. If the Source list is populated, select the address book source. For example, if you have Outlook address books, you must select Outlook from this list.
  6. Click Daily, Weekly, or Monthly in the Schedule list to determine when Anti-Spam checks your address book for new addresses.
  7. Click OK.

Edit an address book

After you add address books, you can change their import information and schedule. For example, edit your address books if you want Anti-Spam to check for new addresses more frequently.

  1. Open the Spam Protection pane.

    How?

  2. On the Spam Protection pane, click Address Books.
  3. Select the address book you want to edit, and then click Edit.
  4. Click the type of address book you want to import in the Type list.
  5. If the Source list is populated, select the address book source. For example, if you have Outlook address books, you must select Outlook from this list.
  6. Click Daily, Weekly, or Monthly in the Schedule list to determine when Anti-Spam checks your address book for new addresses.
  7. Click OK.

Remove an address book

Remove an address book when you no longer want Anti-Spam to automatically import addresses from it (for example, if an address book is outdated and you do not want to use it any more).

  1. Open the Spam Protection pane.

    How?

  2. On the Spam Protection pane, click Address Books.
  3. Select the address book you want to remove, and then click Remove.

Setting up friends manually

You manually update your list of friends by editing the entries one-by-one. For example, if you receive an e-mail from a friend whose address is not in your address book, you can manually add their e-mail address right away. The easiest way to do this is to use the Anti-Spam toolbar. If you do not use the Anti-Spam toolbar, you must specify your friend's information.

In this section

Add a friend from the Anti-Spam toolbar

If you are using Outlook, Outlook Express, Windows Mail, Eudora™, or Thunderbird e-mail programs, you can add friends directly from the Anti-Spam toolbar.

To add a friend in...

Select a message, and then...

Outlook, Outlook Express, Windows Mail

Click Add Friend.

Eudora, Thunderbird

On the Anti-Spam menu, click Add Friend.

Add a friend manually

If you do not want to add a friend directly from the toolbar, or you forgot to do so when you received the e-mail message, you can still add a friend to your friends list without having to wait for Anti-Spam to automatically import your address book.

  1. Open the Spam Protection pane.

    How?

  2. On the Spam Protection pane, click Friends.
  3. On the Friends pane, click Add.
  4. Type the name of your friend in the Name box.
  5. Select Single e-mail address in the Type list.
  6. Type the e-mail address of your friend in the E-Mail Address box.
  7. Click OK.

Add a domain

Add an entire domain if you want to add every user on that domain to your friends list. For example, if you add the company.com domain, none of the e-mail from that organization is filtered.

  1. Open the Spam Protection pane.

    How?

  2. On the Spam Protection pane, click Friends.
  3. On the Friends pane, click Add.
  4. Type the name of the organization or group, in the Name box.
  5. Select Entire domain in the Type list.
  6. Type the domain name in the E-mail Address box.
  7. Click OK.

Edit a friend

If the information for a friend changes, you can update your friends list to ensure that Anti-Spam does not mark their messages as spam.

  1. Open the Spam Protection pane.

    How?

  2. On the Spam Protection pane, click Friends.
  3. Select the friend you want to edit, and then click Edit.
  4. Change the name of your friend in the Name box.
  5. Change the e-mail address of your friend in the E-mail Address box.
  6. Click OK.

Edit a domain

If the information for a domain changes, you can update your friends list to ensure that Anti-Spam does not mark the messages from that domain as spam.

  1. Open the Spam Protection pane.

    How?

  2. On the Spam Protection pane, click Friends.
  3. On the Friends pane, click Add.
  4. Change the name of the organization or group in the Name box.
  5. Select Entire domain in the Type list.
  6. Change the domain name in the E-mail Address box.
  7. Click OK.

Remove a friend

If a person or a domain in your friends list sends you spam, remove them from the Anti-Spam friends list so that their e-mail messages are filtered again.

  1. Open the Spam Protection pane.

    How?

  2. On the Spam Protection pane, click Friends.
  3. Select the friend you want to remove, and then click Remove.

Configuring spam detection

Anti-Spam allows you to customize how spam is detected. You can filter messages more aggressively, specify what to look for in a message, and look for specific character sets when analyzing spam. You can also create personal filters to fine-tune which messages Anti-Spam identifies as spam. For example, if unsolicited e-mail that contains the word mortgage is not filtered, you can add a filter that contains the word mortgage.

If you are having issues with your e-mail, you can disable spam protection as part of your troubleshooting strategy.

In this chapter

Disable spam protection

You can disable spam protection to prevent Anti-Spam from filtering e-mail.

  1. On the Advanced Menu, click Configure.
  2. On the Configure pane, click E-mail & IM.
  3. Under Spam protection, click Off.

Tip: Remember to click On under Spam protection so that you are protected against spam.

Setting filtering options

Adjust Anti-Spam's filtering options if you want to filter messages more aggressively, specify what to look for in a message, and look for specific character sets when analyzing spam.

Filtering level

The filtering level dictates how aggressively your e-mail is filtered. For example, if spam is not filtered and your filtering level is set to Medium, you can change it to High. However, if the filtering level is set to High, only e-mail messages from senders in your friends list are accepted: all others are filtered.

Special filters

A filter specifies what Anti-Spam looks for in an e-mail message. Special filters detect e-mail messages that contain hidden text, embedded images, intentional HTML formatting errors, and other techniques commonly used by spammers. Since e-mail messages that have these attributes are usually spam, the special filters are enabled by default. For example, if you want to receive e-mail messages that contain embedded images, you may need to disable the special image filter.

Character Sets

Anti-Spam can look for specific character sets when analyzing spam. Character sets are used to represent a language, including the language's alphabet, numeric digits, and other symbols. If you are receiving spam in Greek, you can filter all messages that contain the Greek character set.

Be careful not to filter character sets for languages in which you receive legitimate e-mail. For example, if you only want to filter messages in Italian, you might select Western European because Italy is in Western Europe. However, if you receive legitimate e-mail in English, selecting Western European will also filter messages in English and any other languages in the Western European character set. In this case, you cannot filter messages in Italian only.

Note: Filtering messages that contain characters from a specific character set is for advanced users.

In this section

Change the filtering level

You can change how aggressively you want to filter your e-mail. For example, if legitimate messages are filtered, you can lower the filtering level.

  1. Open the Spam Protection pane.

    How?

  2. On the Spam Protection pane, click Filtering Options.
  3. Under Filtering Options, move the slider to the appropriate level and then click OK.

Level

Description

Low

Most e-mail is accepted.

Medium-Low

Only obvious spam messages are filtered.

Medium

E-mail is filtered at the recommended level.

Medium-High

Any e-mail that resembles spam is filtered.

High

Only messages from senders in your friends list are accepted.

Disable a special filter

Special filters are enabled by default because they filter messages that spammers typically send. For example, e-mail messages that contain embedded images are usually spam; however, if you often receive legitimate e-mail with embedded images, disable the special image filter.

  1. Open the Spam Protection pane.

    How?

  2. On the Spam Protection pane, click Filtering Options.
  3. Under Special Filters, select or clear the appropriate check boxes and then click OK.

Filter

Description

Filter messages that contain hidden text

Looks for hidden text because messages with hidden text are often used by spammers to avoid detection.

Filter messages that contain certain ratios of images versus text

Looks for embedded images because messages with embedded images are usually spam.

Filter messages that contain intentional HTML formatting errors

Looks for messages that contain invalid formatting because invalid formatting is used to prevent filters from filtering spam.

Do not filter messages larger than

Does not look for messages larger than the specified size because large messages may not be spam. You can increase or decrease the message size (valid range is 0-250 KB).

Apply character set filters

Note: Filtering messages that contain characters from a specific character set is for advanced users.

You can filter specific language character sets; however, do not filter character sets for languages in which you receive legitimate e-mail.

  1. Open the Spam Protection pane.

    How?

  2. On the Spam Protection pane, click Character Sets.
  3. Select the check boxes beside the character sets you want to filter.
  4. Click OK.

Using personal filters

A filter specifies what Anti-Spam looks for in an e-mail message. When spam is found, the message is marked as spam and left in your Inbox or moved to the McAfee Anti-Spam folder. For more information about how spam is handled, see Modify how a message is processed and marked.

By default, Anti-Spam uses many filters; however, you can create new filters or edit existing ones to fine-tune which messages Anti-Spam identifies as spam. For example, if you add a filter that contains the word mortgage, Anti-Spam filters messages with the word mortgage. Do not create filters for common words that appear in legitimate e-mail messages, because then even non-spam e-mail will be filtered. After you create a filter, you can edit it if you find that the filter is still not detecting some spam. For example, if you created a filter to look for the word viagra in the subject of the message, but you are still receiving messages that contain the word viagra because it's appearing in the body of the message, change the filter to look for viagra in the message body instead of the message subject.

Regular expressions (RegEx) are special characters and sequences that can also be used in personal filters; however, McAfee only recommends using regular expressions if you are an advanced user. If you are not familiar with regular expressions, or you want more information about how to use them, you can research regular expressions on the Web (for example, go to http://en.wikipedia.org/wiki/Regular_expression).

In this section

Add a personal filter

You can add filters to fine-tune which messages Anti-Spam identifies as spam.

  1. Open the Spam Protection pane.

    How?

  2. On the Spam Protection pane, click Personal Filters.
  3. Click Add.
  4. Specify what the personal filter looks for in an e-mail message.
  5. Click OK.

Edit a personal filter

Edit existing filters to fine-tune which messages are identified as spam.

  1. Open the Spam Protection pane.

    How?

  2. On the Spam Protection pane, click Personal Filters.
  3. Select the filter you want to edit, and then click Edit.
  4. Specify what the personal filter looks for in an e-mail message.
  5. Click OK.

Remove a personal filter

You can permanently remove filters that you no longer want to use.

  1. Open the Spam Protection pane.

    How?

  2. On the Spam Protection pane, click Personal Filters.
  3. Select the filter you want to remove, and then click Remove.
  4. Click OK.

Specifying a personal filter

The following table describes what a personal filter looks for in an e-mail message.

Information

Description

Item

Click an entry to determine whether the filter looks for the words or phrases in the message subject, body, headers, or the message sender.

Condition

Click an entry to determine whether the filter looks for a message that contains, or does not contain, the words or phrases you specify.

Words or phrases

Type what to look for in a message. For example, if you specify mortgage, all messages that contain this word are filtered.

This filter uses regular expressions (RegEx)

Specify character patterns used in filter conditions. To test a character pattern, click Test.

Filtering e-mail

Anti-Spam examines your incoming e-mail, and categorizes it as spam (e-mail soliciting you to purchase something) or phishing (e-mail soliciting you to provide personal information to a potentially fraudulent Web site). By default, Anti-Spam then marks each unsolicited e-mail message as spam or phishing (the tag [SPAM] or [PHISH] appears in the subject line of the message), and moves the message to the McAfee Anti-Spam folder.

To customize the way Anti-Spam filters your e-mail messages, you can mark e-mail as spam or not spam from the Anti-Spam toolbar, change the location where spam messages are moved, or change the tag that appears in the subject line.

To change how spam is processed and marked, you can customize the location where spam and phishing e-mail messages are moved, and customize the name of the tag that appears in the subject line.

You can also disable Anti-Spam toolbars as part of your troubleshooting strategy when you are experiencing issues with your e-mail program.

In this chapter

Mark a message from the Anti-Spam toolbar

When you mark a message as spam, the subject of the message is tagged with [SPAM] or a tag of your choice and left in your Inbox, your McAfee Anti-Spam folder (Outlook, Outlook Express, Windows Mail, Thunderbird), or your Junk folder (Eudora®). When you mark a message as not spam, the message tag is removed and the message is moved to your Inbox.

To mark a message in...

Select a message, and then...

Outlook, Outlook Express, Windows Mail

Click Mark as Spam or Mark as Not Spam.

Eudora, Thunderbird

On the Anti-Spam menu, click Mark as Spam or Mark as Not Spam.

Modify how a message is processed and marked

You can change how spam is processed and marked. For example, you can decide whether the e-mail message is left in your Inbox or McAfee Anti-Spam folder, and change the [SPAM] or [PHISH] tag that appears in the message subject line.

  1. Open the Spam Protection pane.

    How?

  2. On the Spam Protection pane, click Processing.
  3. Select or clear the appropriate check boxes, and then click OK.

Option

Description

Mark as spam and move to the McAfee Anti-Spam folder

This is the default setting. Spam messages are moved to your McAfee Anti-Spam folder.

Mark as spam and leave in the Inbox

Spam messages remain in your Inbox.

Add this customizable tag to the subject of spam messages

The tag you specify is added to the e-mail subject line of spam messages.

Add this customizable tag to the subject of phishing messages

The tag you specify is added to the e-mail subject line of phishing messages.

Disable the Anti-Spam toolbar

If you are using Outlook, Outlook Express, Windows Mail, Eudora, or Thunderbird, you can disable the Anti-Spam toolbar.

  1. Open the Spam Protection pane.

    How?

  2. On the Spam Protection pane, click E-mail Toolbars.
  3. Clear the check box beside the toolbar you want to disable.
  4. Click OK.

Tip: You can re-enable your Anti-Spam toolbars at any time by selecting their check boxes.

Working with filtered e-mail

At times, some spam may not be detected. When this happens, you can report spam to McAfee, where it is analyzed to create filter updates.

If you are using a Webmail account, you can copy, delete, and obtain more information about your filtered e-mail messages. This is useful when you are not sure whether a legitimate message was filtered, or if you want to know when the message was filtered.

In this chapter

Report spam to McAfee

sYou can report spam to McAfee, where it is analyzed to create filter updates.

  1. Open the Spam Protection pane.

    How?

  2. On the Spam Protection pane, click Reporting to McAfee.
  3. Select the appropriate check boxes, and then click OK.

Option

Description

Enable reporting when you click Mark as Spam

Reports a message to McAfee every time you mark it as spam.

Enable reporting when you click Mark as not Spam

Reports a message to McAfee every time you mark it as not spam.

Send entire message (not just headers)

Sends the entire message, not just the headers, when you report a message to McAfee.

Copy or delete a filtered Webmail message

You can copy or delete messages that have been filtered in your Webmail account.

  1. Under Common Tasks, click View Recent Events.
  2. On the Recent Events pane, click View Log.
  3. On the left pane, expand the E-mail & IM list, and then click Webmail Filtering Events.
  4. Select a message.
  5. Under I want to, do one of the following:
    • Click Copy to copy the message to the Clipboard.
    • Click Delete to delete the message.

View an event for filtered Webmail

You can view the date and time when e-mail messages were filtered and the account that received them.

  1. Under Common Tasks, click View Recent Events.
  2. On the Recent Events pane, click View Log.
  3. On the left pane, expand the E-mail & IM list, and then click Webmail Filtering Events.
  4. Select the log you want to view.

Configuring phishing protection

Anti-Spam categorizes unsolicited e-mail as spam (e-mail soliciting you to purchase), or phishing (e-mail soliciting you to provide personal information to a known or potentially fraudulent Web site). Phishing protection protects you from accessing Web sites that are fraudulent. If you click a link in an e-mail message to a known or potentially fraudulent Web site, Anti-Spam redirects you to the Phishing filter safe page.

If there are Web sites that you do not want to filter, add them to the Phishing whitelist. You can also edit or remove Web sites from the whitelist. You do not need to add sites such as Google®, Yahoo, or McAfee, because these Web sites are not considered fraudulent.

Note: If you have SiteAdvisor installed, you do not receive Anti-Spam phishing protection because SiteAdvisor already has phishing protection similar to Anti-Spam's.

In this chapter

Add a Web site to the whitelist

If there are Web sites that you do not want to filter, add them to the whitelist.

  1. Open the Phishing Protection pane.

    How?

  2. On the Phishing Protection pane, click Advanced.
  3. Under Whitelist, click Add.
  4. Type the Web site address, and then click OK.

Edit sites in your whitelist

If you added a Web site to the whitelist and the Web site address changes, you can always update it.

  1. Open the Phishing Protection pane.

    How?

  2. On the Phishing Protection pane, click Advanced.
  3. Under Whitelist, select the Web site you want to update, and then click Edit.
  4. Edit the Web site address, and then click OK.

Remove a Web site from the whitelist

If you added a Web site to the whitelist because you wanted to access it, but now you want to filter it, remove it from the whitelist.

  1. Open the Phishing Protection pane.

    How?

  2. On the Phishing Protection pane, click Advanced.
  3. Under Whitelist, select the Web site you want to remove, and then click Remove.

Disable phishing protection

If you already have phishing software that is not from McAfee and there is a conflict, you can disable Anti-Spam phishing protection.

  1. On the SecurityCenter Home pane, click Internet & Network.
  2. In the Internet & Network information area, click Configure.
  3. Under Phishing protection, click Off.

Tip: When you are done, remember to click On under Phishing protection so that you are protected against fraudulent Web sites.

No comments: