Hows does NOD32 treat email attachments?

How does NOD32 treat attachments in emails? Are the attachments not scanned until they are opened or are the attachments automatically scanned when the mail is downloaded?

 

If you receive email through POP3, IMON will check all emails (if you do not use the default port 110, you'll need to specify it in the IMON setup).

However, if you use MS Outlook, it will first download email and then pass it to EMON via MAPI for checking. So EMON will check any email regardless of the protocol used.

 

Hmm. I had a friend submit two suspicious files that NOD32 said the archived was damaged to Virustotal and 5 or 6 of the scanners indicated a variant of MyTob in the files. They were contained in an email that tried to get the receiver to open the attachment saying that the mail was undeliverable when the user never even sent the "original" to begin with.

 

NOD32 has detected all Mytob variants heuristically without needing to update so I really doubt NOD32 wouldn't catch this one if it was actually functional.

 

Well there is no way my friend will chance opening the attachment. Guess there is no point in sending these files into NOD since they are supposedly inert and NOD never fixed a false positive with another file which he sent into NOD at least 2 months ago.

 

Where did you actually send the file to? Because I'm not aware that we've received a false positive that is yet to be fixed. Please submit that file to samples@eset.com

 

Sorry it only seems like 2 months ago when in fact it was in Sept. Here is the original thread with all the details https://www.wilderssecurity.com/showthread.php?t=98384