PureMessage Spam Virus Settings - How To

On 1st May 2005 West
Australian Networks decided to discontinue the free virus and spam filtering
service it has provided to clients over the last eight or so years. This decision
was not taken lightly.

Virus, Spam and Mail
abuse detection and filtering has become a huge task both in administration
and fielding clients' queries when mail is blocked. Therefore West Australian
Networks has decided to deploy a new solution that will put the power to filter
back into the hands of our clients, where we feel it really belongs.

The product chosen
to do the job is Sophos PureMessage, it was switched on Wednesday May 9,2005.

Subscribed clients
are able to access the online web interface for your mailbox/es by clicking
here http://mail.westnet.net.au:28080/ and entering your username (without
the @westnet.net.au on it) and your password. A description of what options
are available from the interface, how these options work and some Frequently
Asked Questions (FAQ's) is included below.

The service will continue
to block all spam, offensive content and virus infected messages, but, rather
than simply delete them as the practice has been, it will now quarantine them
for you.

You will be sent a
message periodically from the PureMessage Admin with the subject line "Quarantined
spam messages since...". This e-mail will detail all the messages being
held in quarantine for you along with the ID, Time, probability of the message
being SPAM, the sender of the message and the subject. This function can be
turned on and off from the web interface as desired.

To request that a
message be automatically released from the quarantine and delivered to you,
click on the messages' ID (this will automatically create a new e-mail message
with all the required information filled in for you), all you need to do is
send the request. To release all messages in the list, you can simply reply
to this message (note this will have all messages listed delivered to you).

Blocked messages held
in quarantine will be automatically deleted after 7 days (unless you request
otherwise from the web interface).

The use of this new
system will mean messages are never again deleted without your knowledge.

The system will also
allow for offensive content to be blocked before reaching your or your children's
mailboxes. This will be a great relief for many clients and parents as well
as the schools using our mail network.

The cost for this
new service has been subsidised by WA Networks and is available at two rates:

Essential Filtering $49.95 per annum per email box or

Premium Filtering $99 per annum per email box.

Premium filtering
updates more frequently and has auto learning capabilities enabling this service
to block a higher percentage of offending emails.

All clients who wish
to subscribe should notify the PureMessage
Admin via e-mail at puremessage@westnet.net.au
if they wish to subscribe to the filtering service. We strongly advise you
do this as early as possible to avoid receiving any un-filtered mail (SPAM
and Viruses etc). You can subscribe or un-subscribe from the service at any
time. Please list the mailboxes you wish to have protected on the e-mail.
The fee will be added to your normal Internet access account.

Only clients
who have subscribed to the service will have the protection of filtering.
Clients who do not subscribe will be able to continue utilising our services
as normal but will not have any filtering on their mail service at all. This
will allow all the spam and virus mail sent to them through to their mailbox
and on into their PC/s. We obviously strongly advise all clients subscribe
to this service. As an indicator of the levels you can expect if you do not
opt for this service, we have at midday today blocked 90 SPAM messages destined
for just one individual client.

Facts on PureMessage

Industry-leading
spam protection

PureMessage safely identifies up to 98% of spam and protects against email
scams, including phishing attacks.

Powerful anti-virus
protection

Award-winning technology detects, disinfects or quarantines viruses,
Trojans, worms and malicious spyware in incoming and outgoing email.

Offensive
content

Powerful content scanning controls protect against messages being
sent or received with offensive content in them. No more worrying about the
language contained in e-mail sent or received by your children.

Content security

Powerful content scanning controls protect against confidential information
leakage and tailor filtering to meet your organisation's specific email policies.

Automatic
updates

The latest software, virus detection files and new spam rules are
downloaded automatically.

Easy configuration
and management

A web-based interface
allows the straightforward configuration and management of PureMessage to
suit all individual requirements.

Whitelist/blacklist
capabilities

Enterprise and end-user
preferences are established through global and end-user whitelists and blacklists.

End-user quarantine

End-user interfaces
provide customisable quarantine features for the quick retrieval of legitimate
messages.



Multi-language filtering

Global organisation's are protected from viruses and spam in multiple
language message streams.

Sophos PureMessage
provides a secure solution at the email gateway, uniquely integrating anti-virus,
anti-spam and policy enforcement capabilities. Based on a scalable architecture,
PureMessage includes innovative detection techniques that deliver proactive,
sustained protection.

Sophos PureMessage
provides integrated gateway and messaging protection from spam and viruses.
It scans all internal, inbound and outbound email messages, and includes threat
reduction technology to protect against new or unknown email-borne threats.

PureMessage features * Spam, scam and phishing detection and quarantining * Virus, Trojan, worm and malicious spyware detection and disinfection * Genotype virus and spam family detection * Virus updates and spam rules are automatically updated

 

FAQ and User
Guide

* What
Is PureMessage?

* How Does PureMessage Identify
Spam?

* PureMessage End User Web Interface

* Quarantine Digests

* Mail Client Filters

 

What Is PureMessage?

PureMessage is a mail-filtering
program that runs on the West Australian Networks email servers. All ingoing
and outgoing email messages pass through PureMessage. The PureMessage filter
looks for certain message characteristics and performs actions on the message
when these characteristics are found.

This document describes
PureMessage from the perspective of a user whose email is filtered by PureMessage.
Except for the description of quarantine digests (which are not enabled by
default), it describes the default PureMessage configuration.



How Does PureMessage Identify Spam?

PureMessage contains
several hundred spam tests that analyze individual characteristics of each
message. Each of these tests has a numerical weight. When a message is analyzed
by PureMessage, the weights from all the spam tests that matched the message
are added up and converted to a spam score that expresses the message's "spam
probability".

By default, PureMessage
only checks for spam in messages that originate from outside the network,
not in messages that originate within the local domain. If a message is found
to have a spam probability of 20% or more, it is copied to the PureMessage
Quarantine.

PureMessage
End User Web Interface

The End User Web Interface
(EUWI) gives PureMessage users access to email-filtering features. Users can
view and manage messages that are quarantined (blocked) by PureMessage, manage
user-specific sender lists, and configure various email-filtering options.

The EUWI is comprised
of the following components:

* Navigation Menu:
The menu located on the left side of the page.

* Main Page: The current page accessed through the navigation menu. Links
to additional pages include: Blocked Messages, Deleted Messages, Approved
Senders, Blocked Senders, and Options.

* Email Message Viewer: A viewer that opens when a message's "Subject"
link is clicked.

Accessing
the End User Web Interface

Access the End User
Web Interface (EUWI) via the web link sent by your system administrator. A
PureMessage administrator can give you access to the EUWI by either emailing
you the access information or having you request a password through the EUWI.
Alternatively, the administrator may add a link in quarantine digests to the
EUWI.

Notification from
the Administrator

Usually, the PureMessage
Administrator sends you an email message containing your EUWI login and password.
This message also contains a web link to the EUWI (http://mail.westnet.net.au:28080/).
To access the EUWI:

1. Click the web
link in the email message. The EUWI login page is displayed.

2. Enter the login and password provided in the email message.

3. Click Login. You are logged in to the EUWI and the Blocked Messages page
is displayed.

Requesting a Password

Before you request
a password, the PureMessage administrator must send you an email message containing
the web link to the EUWI (for example, http://mail.westnet.net.au:28080).
After obtaining this link, proceed as follows:

1. Enter the link
in a web browser (or click the link if it is in an email message). The EUWI
login page is displayed.

2. Click "here". If you do not have a password, please go here.
The Send Authorization page is displayed.

3. Enter your company email address.

4. Click Send Authorization. Your EUWI password is sent to the email address
entered.

If you send multiple
authorization requests, only the latest request grants you access to the EUWI.

When you receive an
email message from the PureMessage administrator:

1. Open the email
message.

2. Click the web link in the email message. The EUWI login page is displayed.

3. Enter the login and password provided in the email message.

4. Click Login. You are logged in to the EUWI and the Blocked Messages page
is displayed.

Blocked Messages

The Blocked Messages
page displays all email messages that are quarantined by PureMessage due to
spam content. Using the Blocked Messages page, you can:

* view blocked messages

* release misclassified legitimate messages from the PureMessage Quarantine
and deliver them to your mailbox

* delete and send messages to the Deleted Messages page

* deliver and approve a sender

* delete all messages in the list

You can sort quarantined
messages based on the spam Score, the email address listed in the From header,
the message's Subject, or the Date the message was delivered. Note that the
date column displays the time in hours and minutes for messages blocked in
the last 24 hours. Both the time and date are shown for messages blocked more
than 24 hours ago.

View a Blocked
Message

To view a blocked
message:

1. On the left navigation
menu, click Blocked Messages. The Blocked Messages page is displayed.

2. On the Blocked Messages page, click the subject of the message you want
to view. The message opens in another browser window.

3. To close the message, click the "X" in the upper-right corner
of the window.

Deliver Message

Use the Deliver Message
feature to release legitimate messages from the PureMessage Quarantine and
deliver them to your mailbox.

1. On the left navigation
menu, click Blocked Messages. The Blocked Messages page is displayed.

2. On the Blocked Messages page, under the Score column, select the check
box(es) beside the message(s) that you want delivered to your mailbox.

3. Click Deliver Message. The selected messages are released from the Quarantine
and delivered to your mailbox.

Delete Message

Use the Delete Message
feature to remove messages from the Blocked Messages page and send them to
the Deleted Messages page.

1. On the left navigation
menu, click Blocked Messages. The Blocked Messages page is displayed.

2. On the Blocked Messages page, under the Score column, select the check
box(es) beside the message(s) you want to remove.

3. Click Delete Message. The selected messages are removed from the Blocked
Messages page and sent to the Deleted Messages page.

Deliver and
Approve Sender

Use the Deliver and
Approve Sender feature to send the selected message(s) to your mailbox and
add the sender(s) of those messages to your Approved Senders list.

1. On the left navigation
menu, click Blocked Messages. The Blocked Messages page is displayed.

2. On the Blocked Messages page, under the Score column, select the check
box(es) beside the message(s) that you want delivered to your inbox and whose
senders you want added to your Approved Senders list.

3. Click the Deliver and Approve Sender button. The Approved Senders page
is displayed.

4. On the Approved Senders page, select if you want to Approve just the sender
or Approve all email from the sender's domain.

5. Click Approve. The selected messages are released and sent to your inbox.
The selected sender(s) are added to your Approved Senders list.

Delete All

Use the Delete All
feature to remove all messages from the Blocked Messages page and send them
to the Deleted Messages page.

1. On the left navigation
menu, click Blocked Messages. The Blocked Messages page is displayed.

2. On the Blocked Messages page, click Delete Message. All messages are removed
from the Blocked Messages page and sent to the Deleted Messages page.

Deleted Messages

Displays messages
deleted from the Blocked Messages page. Sort deleted messages based on spam
Score, the email address listed in the From header, the message's Subject,
or the Date the message was blocked. Note that the date column displays the
time in hours and minutes for messages blocked in the last 24 hours. Both
the time and date are shown for messages blocked more than 24 hours ago.

Use the Delete Messages
feature to view and undelete messages. Undeleted messages are sent back to
the Blocked Messages page.

Undelete Message

To undelete a message:

1. On the left navigation
menu, click Deleted Messages. The Deleted Messages page is displayed.

2. On the Deleted Messages page, under the Score column, select the check
box(es) beside the message(s) you want to undelete.

3. Click Undelete Message. The selected message(s) are sent to the Blocked
Messages page.

Approved Senders

The Approved Senders
page lists email addresses that are known to be legitimate sources of email.
By default, PureMessage delivers email from approved senders and hosts without
scanning it for spam. Use the Approved Senders feature to add or delete senders
from the Approved Senders list.

Add an Approved Sender

1. On the left navigation
menu, click Approved Senders. The Approved Senders page is displayed.

2. On the Approved Senders page, in the Add address text box, enter the valid
email address of the sender you wish to approve.

Note: Valid email addresses are of the form user@host.domain (for example,
fooey@spammer.com).

3. Click Add Sender. The Approved Senders List page is displayed with the
approved sender added.

Delete an
Approved Sender

1. On the left navigation
menu, click Approved Senders. The Approved Senders page is displayed.

2. On the list of Approved Senders, under the Sender column, select the check
box(es) beside the sender(s) you want to remove.

3. Click Delete Sender. The Approved Senders page is displayed with the sender(s)
removed from the list.

Blocked Senders

The Blocked Senders
page lists email addresses that are known to distribute spam or viruses. The
End User Web Interface can be configured to block messages originating from
addresses in this list. Use the Blocked Senders feature to add or delete senders
from the Blocked Senders list.

Add a Blocked Sender

1. On the left navigation
menu, click Blocked Senders. The Blocked Senders page is displayed.

2. On the Block Senders page, in the Add address text box, enter the valid
email address of the sender you wish to block.

Note: Valid email addresses are of the form user@host.domain (for example,
fooey@spammer.com).

3. Click Add Sender. The Blocked Senders List page is displayed with the blocked
sender(s) added.

Delete a Blocked
Sender

1. On the left navigation
menu, click Blocked Senders. The Blocked Senders page is displayed.

2. In the list of Blocked Senders, under the Sender column, select the check
box(es) beside the sender you want to remove from the list.

3. Click Delete Sender. The Blocked Senders page is displayed with the sender
removed from the list.

Options

Use the Options page
to set or modify individual PureMessage email-filtering preferences.

Disable all spam and offensive content blocking for my messages

1. On the left navigation
menu, click Options. The Options page is displayed.

2. On the Options page, under Mail-Filtering Preferences, select the Disable
all spam and offensive content blocking for my messages check box.

3. Click Save.

Notify me
periodically of messages that have been blocked

1. On the left navigation
menu, click Options. The Options page is displayed.

2. On the Options page, under Mail Filtering Preferences, select the Notify
me periodically of messages that have been blocked check box.

3. Click Save.

Hold Messages

Use the Hold Messages
option to keep messages for longer than the set number of days (for example,
during a vacation). With the Hold Messages option you specify a hold date
using the day, month, and year drop-down lists.

1. On the left navigation
menu, click Options. The Options page is displayed.

2. Under Hold Messages, use the drop-down lists to select the date after which
the messages will be held for 99 days.

3. Click Save. The option is saved.

Language Preference

Note: This feature
is only available if the system administrator has enabled it. If the administrator
disables this setting, the Language Preference portion of the Options page
is not displayed.

Use the Language Preference
option to change the language in which the End User Web Interface (and this
documentation) is displayed.

1. Under Language
Preference, select a language from the drop-down list.

2. Click Save. The End User Web Interface and the accompanying documentation
are displayed in the specified language.

Quarantine
Digests

When the PureMessage
filter detects that a message has a 50% or greater likelihood of containing
spam, the message is stored in the PureMessage Quarantine instead of being
delivered. Quarantine digests are email messages generated by PureMessage
that list each user's quarantined messages.

Quarantine digests
display the quarantine message ID number, the spam probability percentage,
the message's "From" address, and the message's "Subject".
To release a single message from the Quarantine, click on the ID number. This
generates an email to PureMessage; the message is automatically released.
To release all listed messages from the Quarantine, reply to the message.

Exempting
Digests from Local Filters

Some email clients
(such as Microsoft Outlook) have built-in message filtering that can be enabled
by the end user. These filters can result in quarantine digests being filtered
by the end user's email client. In most cases, you can configure a list for
built-in message filtering.

For example, when
you enable the "Junk E-Mail" filter or "Adult Content"
filter in Microsoft Outlook, a list rule is automatically created that exempts
specific addresses from these filters. To edit the list, select Tools|Rules
Wizard, and add the "From" address in your quarantine digest to
the list.

Mail Client
Filters

In the default policy
configuration, PureMessage delivers all mail regardless of the spam probability.
However, it modifies the subject line of messages that have a spam probability
of 50% or more. Email clients can be configured to filter messages based on
this message characteristic.

In the following example,
the email client filter automatically moves messages containing "PMX:"
in the subject line to the "Filtered Spam" mailbox. By using a separate
mailbox, users have the option of scanning messages containing spam before
deleting them.



Configuring Filters ("Rules") in Microsoft Outlook 2000

1. To create a new
folder, right-click in Outlook's Folder List pane, select New Folder, and
specify the folder name ("Filtered Spam") and location.

2. Microsoft Outlook uses the term "Rules" to denote filters. To
configure rules, select Tools|Rules Wizard, and click New.

3. From the "rule type" list box at the top of the dialog box, select
Check messages when they arrive. Click Next.

4. In the "conditions" list box at the top of the dialog box, select
with specific words in the subject. In the "rule description" field,
click specific words. Enter PMX: in the Search Text dialog box. Click Next.

5. Select move it to the specified folder when prompted for the action. Click
the word "specified" in the selected option, and select Filtered
Spam as the destination folder. (If necessary, click New to create a new folder.)
Click Next.

6. Click Next to bypass the exceptions dialog.

7. Provide a name for the new rule and check Turn on this rule. Click Finish.

8. If more than one rule is configured for the email client, ensure that the
PureMessage anti-spam rule is applied first. Click Run Now to apply the new
rule to messages in the Inbox.

If you would like
any further information on PureMessage or help in setting it up please do
not hesitate to contact us by either of the following methods: