You might be wondering why an email was blocked by our MailScanner filters even though it came from a trusted and reliable source. Simple, many of the viruses that our computer gets came from opening an attachment from someone we know and trust. PCSecurityNews.com reported that 8 out of 10 PC's are infected with some sort of Spyware, with an average of 24.4 spies per PC scanned, Microsoft estimates that 50% of all PC crashes are due to spyware, Dell reports that 20% of all technical support calls involve spyware.

Our email system is equipped with a scanner program known as MailScanner. It’s an open source email security system that helps protect against viruses and spam. Currently, the MailScanner takes a “better safe than sorry” approach in blocking email attachments.

Here are reasons an email was blocked by MailScanner.

1. Very long filename – having a long filename is a good sign of attack against Microsoft email packages. So let your sender know to keep their filename as short as possible.
2. Specific file types have been known to contain viruses. Here is a list of file extensions and what each can cause.

File Extension	Can cause/will attack
.wmf, .bmp, .ico, .ani, .hlp, .cur	Buffer overflows in Window
.cab	Can contain malicious Microsoft cabinet file.
.reg and .chm	Windows registry files
.hta	Microsoft HTML archive
.lnk	Eudora security hole
.pif	MS-Dos program


Microsoft has also listed some attachments that are very dangerous. These attachments include:

md .prf .pst

.tmp .ws .com

.its .mau .exe

.vsmacros .vs .scr

.bat .cmd .cpl

 

3. URLs or Web addresses can be used for phishing. Phishing emails are sent to user to acquire sensitive information by acting as a legitimate and trustworthy entity. You have probably gotten a couple of email of this kind that use eBay, PayPal or a bank as a front. To make sure the message came from a legitimate company, place your cursor on the link and look at your Status bar at the bottom of the window. If the address on the status bar is different from the one on the email, then it’s probably a scam. If you don’t want to take any chances, call the company that send you the message and see if it’s a legitimate email or not.
4. Filenames ending with CLSIDs. CLSIDs are unique identifiers that are used to identify special Windows controls. Filenames ending with CLSIDs could be a front for a file that contains a virus.
5. Filenames have a lot of contiguous white spaces in them. A long gap in a filename is often used to hide parts of it.
6. Filename with double file extensions. These can be used to hide real filename extension.
7. Encrypted Zips are compressed by WinZip, EnZip or other Zip utility that uses a password to encrypt the file. This type of files can be used by viruses to disguise and therefore evade anti-virus programs.
8. Mailbox Quota: Your mailbox has a 100MB disk space for storing your email contents on the RCC email server. If you have reached your quota limit, you will no longer receive incoming email messages until you clean up your mailbox and your disk quota is within the limit again. Remember, deleting an email from your Inbox doesn't delete that email on the email server, you have to always remember to clean up your Trash folder as well as your Sent folder.

Just remember, nothing is perfect. Even though an email is deemed safe, it could still be carrying a virus so always be careful in opening attachments sent to you.