Endpoint Protection

Hi all,

I have a user that send many times a day, the same attachment to different mail address.

It is possible that SEP blocks the attachment and send the email without it? (without any warning in console?!?)

SEP cannot do that, Symantec mail security for exchange can do that.

Nope SEP cannot do that, you can tweat Symantec DLP to do this.

In SMSMSE (v 7.5) there's nothing in quarantine neither in log...

Hi David ITA,

Is this user doing this mailing on purpose, or is this unusual/unexpected behavior on that computer?  If it is unexpected then the computer is likely infected and part of a spambot.  Locate and remove the malware responsible!

Using Today's SymHelp to Combat Today's Threats
https://www-secure.symantec.com/connect/articles/using-todays-symhelp-combat-todays-threats

Please do update this thread with more details!

With thanks and best regards,

Mick

SMSMSE is the product to handle scanning email. I suggest you pose this question in that forum.

Mik, this user send this mail on purpose, the pc it's not infected.

I opened this thread here because smsmse doesn't show any warning, so I was thinking that the problem is SEP.

It sounds like the PC is infected with a spambot.

SEP may not be catching it because it does not have a signature for it. Possible that it is a new variant.

My suggestion would be to create a firewall to block port 25. This would stop the spambot (until you can remove from the network and clean) but still allow Outlook to function properly.

No Brian, The pc is not infected, the user send the mail on purpose.

Is just the attachments that sometimes disappear... I think it's not smsmse because nothing is showed in logs...

Do you have the SEP Outlook Auto-Protect scanning component enabled?

If so, I suppose it may be possible. SEP Outlook AP could still allow the email through while stripping the attachment if it deems it malicious. You could check the Risk or Security log for any alerts.

yes I have it, but nothing appear in risk or security log.

To rule it in or out, temporarily disable and see if that attachment goes through.