Can I 'force' nod to check outgoing email?

Discussion in 'NOD32 version 2 Forum' started by tobamore, Aug 30, 2004.

Thread Status:
Not open for further replies.
  1. tobamore

    tobamore Registered Member

    Joined:
    Jun 21, 2004
    Posts:
    128
    I appreciate that this question was probably asked a long time ago, however I can find no reference, but is there a way of forcing nod to scan my outgoing email? I like the way that it scans incoming and adds a text tag notifying me of this, but would like the peace of mind an outgoing scan can give.
     
  2. Pete_x

    Pete_x Guest

    why dont you ask them to add this feature in the next build

    but then if you computer isnt infected then how would a vrius get attached to your outgoing email
     
  3. tobamore

    tobamore Registered Member

    Joined:
    Jun 21, 2004
    Posts:
    128
    Your question is a fair one, but it is still possible that a virus is missed on pc. For example I perform full system scans every 2-4 weeks, but I would hope that within that time my sig files had been updated and so could prevent me sending on a virus without my knowledge. Also, just because nod is apparently a very good AV solution, doesn't mean we can afford to be arrogant on the matter does it? :)

    PS How do I request feature implementation?
     
  4. Devinco

    Devinco Registered Member

    Joined:
    Jul 2, 2004
    Posts:
    2,524
    You can add the tag to the end of outgoing messages.
    I think the setting is in IMON setup.
    There is a check box to append the scanned by NOD32 tag to incoming and one for outgoing.
     
  5. Pete_x

    Pete_x Guest

    Devinco he didnt ask about the tag

    Anyway the options are:

    no notification

    infected email only

    all email

    there is no option to scan smtp outgoing mail could, try adding port 25 but i'm thinking imon will ignore it as its going out
     
  6. leehigdon3

    leehigdon3 Registered Member

    Joined:
    Jun 26, 2004
    Posts:
    132
    Location:
    Plano, TX USA
    Just for reference, TrendMicro scans both incoming and outgoing mail. Now NOD may not look at Trend as much of a competitor, but they are. And the features in their products are generally very well liked by their customers. The feature we are talking about wouldn't add any significant overhead to the product and would be an extra layer of protection for those who believe they need it. Unless of course NOD has a convincing argument why that would really be a stupid feature to add. After all, they did add POP3 and IMAP scanning.
     
  7. fredra

    fredra Registered Member

    Joined:
    Jul 25, 2004
    Posts:
    366
  8. rdsu

    rdsu Registered Member

    Joined:
    Jun 28, 2003
    Posts:
    4,456
    If the NOD32 will add this feature, I will disable it, because I don't see any reason to have it enable, and the AV scan all the files that running...

    Did you tried to send an email with a virus to see if the NOD32 will block it?
     
  9. fredra

    fredra Registered Member

    Joined:
    Jul 25, 2004
    Posts:
    366
    Here are the instructions (taken from ESET's FAQ)
    How do I know my POP3 filter works?
    Checking the functionality of e-mail AV scanner can be performed using a test file: eicar.com. This file IS NOT a virus. It is often used to test the functionality of an antivirus system.

    If NOD32 system is properly installed on your computer, you should see a icon on the lower taskbar. This icon indicates, that your computer is protected by the memory resident (constantly running) NOD32 module, named AMON. You need to temporarily quit AMON, otherwise, AMON would detect the incoming test file and would prevent further steps of the testing procedure. Before quitting AMON, quit all currently running applications.

    To quit AMON: click on the icon, double-click on the moving NOD logo - after that click the logo should not move anymore and Amon will be disabled.

    The test of the scanner consists of the following steps:

    Download the eicar.com file: log on to Internet, and click at the following link: eicar.com. Make sure you remember where the location of the downloaded file is, since, in the second step of the testing procedure, you need to send this file to yourself.
    To send the eicar.com file to yourself: open your e-mail program and, in the TO: field, enter your own e-mail address. In the attachment of this e-mail you need to include the file (eicar.com) you have just downloaded. Send the message and wait until it is delivered to your computer.
    If, upon receipt of the e-mail with eicar.com file attached, your e-mail scanner detects the file and triggers the warning window, the configuration of the scanner is correct, otherwise, it needs to be configured again. If the problems persist, contact our support at support@nod32.com.
    To enable AMON again: click on the icon, double-click on the NOD logo - after that click it should move again and Amon will be enabled.

    Cheers :)
     
  10. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    57,770
    Location:
    Texas
  11. flyrfan111

    flyrfan111 Registered Member

    Joined:
    Jun 1, 2004
    Posts:
    1,224
    Even adding port 25 to IMON wouldn't accomplish anything. Mail traffic is POP or SMTP not HTTP traffic. And as you said it is outgoing.
     
  12. rdsu

    rdsu Registered Member

    Joined:
    Jun 28, 2003
    Posts:
    4,456
    I know that fedra... ;)

    I only ask to the others to see if they know...
     
  13. fredra

    fredra Registered Member

    Joined:
    Jul 25, 2004
    Posts:
    366
    Sorry...I misunderstood.
    No offense intended.
    Cheers :)
     
  14. rdsu

    rdsu Registered Member

    Joined:
    Jun 28, 2003
    Posts:
    4,456
    No problem, we only try to help... :D
     
  15. Devinco

    Devinco Registered Member

    Joined:
    Jul 2, 2004
    Posts:
    2,524
    Thank you for pointing that out.
    I thought all current AV scanners scan outgoing email as well.
    Even NAV scans outgoing email.

    I do see the logic in not needing an outgoing scanner though. If the incoming POP scanner (IMON) or the resident scanner (AMON) doesn't catch the virus, then neither would an outgoing SMTP scanner.
    While probably not essential, it still makes a less informed customer feel a little more secure. I am a relative NOD32 noob, and I assumed it was scanning outgoing. I felt a little disappointed when I realized it didn't scan outgoing.

    Are there any situations where an outgoing NOD32 scanner could detect something that would get by AMON or IMON?

    They could add a behavior based scanner similar to ZoneAlarm Pro's outbound email scanner. It detects if a certain number of emails are sent out all at once and alerts you. I think NOD32 should at least have something like that.
     
  16. leehigdon3

    leehigdon3 Registered Member

    Joined:
    Jun 26, 2004
    Posts:
    132
    Location:
    Plano, TX USA
    Not necessarily true about not needing SMTP scanning because IMON should catch malware coming in. Not all malware finds it's way to your computer via port 110. IRC channels/instant messaging programs provide good vectors. Infected media is another. I fully agree that AMON *should* catch anything running resident. The issue though is really what will the majority of Eset's customers will want. I personally don't rely on any resident scanning, but I'm only one $ 39.00 annual subscription.
     
  17. Devinco

    Devinco Registered Member

    Joined:
    Jul 2, 2004
    Posts:
    2,524
    I for one even knowing that it may not be absolutely essential, still want outgoing SMTP scanning of some kind.
    If you paid for it, why not use it? I would activate everything (AMON,IMON,DMON with MS office) unless there was some compatibility issue that couldn't be worked around.
     
  18. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Checking outgoing email will be supported in the next version of EMON (beta will be available soon).
     
  19. Devinco

    Devinco Registered Member

    Joined:
    Jul 2, 2004
    Posts:
    2,524
    Thanks Marcos!

    Sorry for going slightly off topic. AFAIK, EMON can only be used with Outlook2003 when it is used in corporate mode. Does anybody know if in corporate mode, Outlook2003 can be used for regular POP3 and SMTP use?
     
Thread Status:
Not open for further replies.