Mail Anti-Virus settings

Security level

Kaspersky Total Security uses various sets of settings to run Mail Anti-Virus. The sets of settings that are stored in the application are called security levels:

• High. When this mail security level is selected, Mail Anti-Virus applies maximum scrutiny to messages. Mail Anti-Virus scans incoming and outgoing mail messages, and it also performs a deep heuristic analysis. We recommend that you use the High mail security level in a dangerous environment. An example of such an environment is a connection to a free email service from a home network that is not guarded by centralized email protection.
• Recommended. The mail security level that strikes the optimal balance between Kaspersky Total Security performance and mail security. Mail Anti-Virus scans incoming and outgoing mail messages, and it also performs a medium-level heuristic analysis. This mail security level is recommended by Kaspersky specialists.
• Low. This is the mail security level that Mail Anti-Virus uses only to scan incoming mail messages as well as to perform a surface heuristic analysis. It does not use this level to scan archives that are attached to messages. When this mail security level is selected, the Mail Anti-Virus component scans email messages as fast as possible and consumes the least amount of operating system resources. The Low mail security level is recommended to be used when working in a reliably protected environment. An example of such an environment might be a local network with centralized email security.

Action on threat detection

• Ask user. Mail Anti-Virus informs you of detection of an infected or probably infected object, prompting you for further actions to take on this object.

  This option is available if the Perform recommended actions automatically check box is cleared under Settings → General.

• Select action automatically When infected or probably infected objects are detected, Mail Anti-Virus automatically performs the action that is recommended by Kaspersky specialists. For infected objects, this action is Disinfect. This value is selected by default.

  Before attempting to disinfect or delete an infected object, Mail Anti-Virus creates a backup copy in case there is a later need to restore the object or possibility of disinfecting it.

  This option is available if the Perform recommended actions automatically check box is selected under Settings → General.

• Disinfect; delete if disinfection fails. If an infected object is detected in an incoming or outgoing message, Kaspersky Total Security tries to disinfect the discovered object. The user will be able to access the message with a secure attachment. However, if Kaspersky Total Security is unable to disinfect the object, then it will delete it. Kaspersky Total Security adds information about the performed action in the message subject: [Infected object deleted] <message subject>.
• Disinfect; block if disinfection fails. If an infected object is detected in an incoming message, Kaspersky Total Security tries to disinfect the discovered object. The user will be able to access the message with a secure attachment. If the object cannot be disinfected, Kaspersky Total Security adds a warning to the message subject: [Message infected] <message subject>. The user will be able to access the message with the original attachment. If an infected object is detected in an outgoing message, Kaspersky Total Security will try to disinfect the discovered object. If Kaspersky Total Security is not able to disinfect the object, it will block the message from being sent, and the mail client will display an error message.
• Block. If an infected object is detected in an incoming message, Kaspersky Total Security will add a warning to the message subject: [Message infected] <message subject>. The user will be able to access the message with the original attachment. If an infected object is detected in an outgoing message, Kaspersky Total Security will block the message from being sent, and the mail client will display an error.

Protection scope

The Protection scope includes objects that the component checks when it is run: Incoming and outgoing messages or Incoming messages only.

In order to protect your computers, you need only scan incoming messages. You can turn on scanning for outgoing messages to prevent infected files from being sent in archives. You can also turn on the scanning of outgoing messages if you want to prevent files in particular formats from being sent, such as audio and video files, for example.

Scan POP3 / SMTP / NNTP / IMAP traffic

This check box enables/disables the scanning by Mail Anti-Virus of mail traffic that is sent over the POP3, SMTP, NNTP and IMAP protocols.

Connect Microsoft Outlook extension

If the check box is selected, email messages transmitted via the POP3, SMTP, NNTP, and IMAP protocols will be scanned using the extension that is integrated into Microsoft Outlook.

If email is scanned using the extension for Microsoft Outlook, it is recommended to use Cached Exchange Mode. You can find more details about the Cached Exchange Mode and recommendations for how to use it in the Microsoft Knowledge Base.

Heuristic analysis

A technique for detecting threats that cannot be identified using the current version of the Kaspersky application databases. It allows you to find files that may contain unknown malware or a new modification of a known malware program.

When scanning files for malicious code, the heuristic analyzer executes instructions in the executable files. The number of instructions that are executed by the heuristic analyzer depends on the level that is specified for the heuristic analyzer. The heuristic analysis level sets the balance between the thoroughness of searches for new threats, the load on the operating system resources, and the time required for heuristic analysis.

Scan attached files of Microsoft Office formats

Scans Microsoft Office files (DOC, DOCX, XLS, PPT and other Microsoft extensions). Microsoft Office files also include OLE objects.

Scan attached archives

Scans archives in the following formats: RAR, ARJ, ZIP, CAB, LHA, JAR, and ICE.

Do not scan archives larger than

If this check box is ticked, Mail Anti-Virus excludes archives that are attached to mail messages from scanning if their size exceeds the value that you have specified. If the check box is unticked, Mail Anti-Virus scans archives of any size that are attached to mail messages.

Limit archive scan time to

If the check box is ticked, then the amount of time that is needed to scan archives that are attached to mail messages will be limited to the specified period.