Mail Threat Protection

This check box enables or disables Mail Threat Protection.

This component is enabled by default.

Configure (Protection settings)

Clicking this button opens the Mail Threat Protection settings window, in which you can configure the Mail Threat Protection scope and the scan settings for compound files.

Configure (Attachment filter)

Clicking this button opens the Attachment filter window, in which you can configure the filtering of email attachments.

Use the heuristic analyzer

Heuristic analysis level

This check box enables or disables the use of the heuristic analyzer.

When scanning files for malicious code, the heuristic analyzer executes instructions in executable files. How many instructions the heuristic analyzer executes depends on the specified heuristic analysis level. The heuristic analysis level sets the balance between the thoroughness of searches for novel threats, the load on the operating system's resources, and the duration of heuristic analysis.

By default, the heuristic analyzer is enabled and the medium heuristic analysis level is selected.

Actions on threat detection

The action that Mail Threat Protection performs when a threat is detected in email messages:

• Disinfect; delete if disinfection is not possible. When an infected object is detected in an incoming message, the application attempts to disinfect the detected object. The message with the safe attachment is then made available to the user. If disinfection fails, the application deletes the infected object. The application adds information about the performed action to the message subject, for example, [The message has been processed] <message subject>. This action is selected by default.
• Disinfect; block if disinfection fails. When an infected object is detected in an incoming message, the application attempts to disinfect the detected object. The message with the safe attachment is then made available to the user. If disinfection fails, the application adds a warning to the subject of the message. The message with the original attachment is then made available to the user.
• Block. If an infected object is detected in an incoming message, the application adds a warning to the message subject. The message with the original attachment is then made available to the user.