Threat reduction by filetype

PureMessage for Windows/Exchange can block selected attachments by filetype, name and multiple extensions.

The main filetypes are

• archives (including tar, Zip and RAR,)
• self-extracting archives
• common virus carriers
• graphics (including GIF, JPG, TIF, BMP)
• others (including PDF, HTML, Macintosh files, MIME, RTF).

For archives, self-extracting archives and graphics, you can exclude types of files individually.

You can also block the attachment types most likely to contain a virus:

• Windows/DOS program files
• UNIX or Linux program files
• Microsoft Office documents that include macros.

Blocking by attachment name enables you to block individual files and types of files.

An alert can be sent to the administrator to inform them of the blocked attachments.

What to do

You can block email attachments by filetype in the mail scanning page:

1. To open the PureMessage console, double-click the PureMessage icon on your desktop.
2. In the PureMessage console tree, click 'Jobs' and then 'Mail (SMTP)'.
3. In the details pane, click the 'Content' tab.
4. In the 'Content' tabbed page, click 'Block selected attachments'.
5. Select 'By filetype'.
6. Select 'All files' or individual filetypes.
7. Click 'Apply'.

Common Virus Carriers

Within 'Common Virus Carriers' you can select whether to block

• Windows/DOS executables
• UNIX/Linux executables
• Microsoft Office documents that include macros.

These are the attachment types most likely to contain a virus

Excluding individual filetypes and files

For archives, self-extracting archives and graphics, you can select the types of files to exclude individually. Click the name of the filetype for a list.

To block a file with a particular name, select 'Block by attachment name' and give the names of any files you want to block.

To block additional filetypes, use wildcards to block by attachment name. For example, to block all ASC files add '*.ASC' to the list.

Multiple extensions

To block files with multiple extensions (virus writers use double extensions to hide a virus), select 'Block all multiple extensions except'. Then give the names of any multiple extensions you want to allow (for example tar.gz archives).

See the PureMessage for Windows/Exchange user manual for more information.