anti-spam - kaspersky lab | antivirus protection | internet security

Small Office Security 2

Anti-Spam

1 | 2 5

Kaspersky Small Office Security 2

Table of content Table of content ............................................................................................................................... 1

Anti-Spam ..................................................................................................................................... 2

What is Anti-Spam ..................................................................................................................... 2

Enabling/Disabling Anti-Spam ................................................................................................... 2

Security levels of Anti-Spam ...................................................................................................... 3

Changing security level of Anti-Spam ........................................................................................ 4

Additional settings of Anti-Spam ................................................................................................ 5

Exact methods ....................................................................................................................... 5

Expert methods .................................................................................................................... 12

Additional tab ....................................................................................................................... 14

Rollback to Anti-Spam default settings .................................................................................... 14

Training Anti-Spam .................................................................................................................. 15

Anti-Spam training wizard (for Microsoft Outlook and Microsoft Outlook Express) .............. 15

Training using the Junk and NOT Junk buttons (for Mozilla Thunderbird and The Bat!) ...... 18

Training using outgoing messages ....................................................................................... 18

Training using report window ............................................................................................... 18

Registering Anti-Spam plug-in in different mail clients ............................................................ 20

Registering Anti-Spam plug-in in Microsoft Outlook Express ............................................... 20

Registering Anti-Spam plug-in in Microsoft Outlook as part of Microsoft Office ................... 21

Registering Anti-Spam component in Mozilla Thunderbird .................................................. 23

Relocating Anti-Spam database from one computer to another .............................................. 24

2 | 2 5


Anti-Spam What is Anti-Spam The Anti-Spam component filters all incoming mail for unwanted mail (spam) and sorts it according to the settings configured by the user. Enabling/Disabling Anti-Spam In order to enable or disable Anti-Spam, perform the following actions:

1. Open the main application window. 2. Choose the Protection Center tab. 3. In the right upper corner click the Settings link.

4. In the Settings window on the Protection tab select the Anti-Spam item.

3 | 2 5


5. In the Anti-Spam, Setting section:

• Uncheck the Enable Anti-Spam box, to disable the component • Check the Enable Anti-Spam box, to enable the component

6. In the Settings window click the Apply button. Security levels of Anti-Spam Anti-Spam can add appropriate labels to the message recognized after analysis as spam or potential spam. This value is called a spam factor. Having processed a message, Anti-Spam assigns one of the following statuses to it:

► Spam ► Probable spam ► Useful email

You can specify threshold values of the spam rate by changing the Anti-Spam security level. When the threshold is exceeded the message would get one of the statuses Spam/ Probable Spam. A security level is a set of predefined Anti-Spam settings which provide a scan level of incoming and outgoing messages. Kaspersky Lab specialists distinguish three security levels:

• High. This security level should be used if you receive spam frequently; for example, while using free mail services. When you select this level, the frequency of false positives rises: that is, useful mail is more often recognized as spam. When analyzing a message for spam the Anti-Spam component calculates the potential rating: if the rating exceeds 50 but does not reach 80, the message is considered to be potential spam. If the rating exceeds 80, then such message is labeled as spam. On this security level attachments in .rtf format are also analyzed, i.e. Anti-Spam additionally analyzes files attached to the messages for the spam presence.

• Recommended. This security level should be used in most cases. When analyzing a message for spam the Anti-Spam component calculates the potential rating: if the rating exceeds 60 but does not reach 90, the message is considered to be potential spam. If the rating exceeds 90, then such message is labeled as spam.

4 | 2 5


• Low. This security level should be used if you rarely receive spam, for example, if you are working in a protected corporate email environment. When this level is selected, spam and potential spam messages are less frequently recognized. When analyzing a message for spam the Anti-Spam component calculates the potential rating: if the rating exceeds 80 but does not reach 90, the message is considered to be potential spam. If the rating exceeds 99 out of 100, then such message is labeled as spam.

Changing security level of Anti-Spam In order to change an Anti-Spam security level, perform the following actions:

1. In the Settings window on the Protection tab select the Anti-Spam component. 2. In the Security level section move the vertical slider to the required position. 3. In the Settings window click the OK button.

5 | 2 5


Additional settings of Anti-Spam To fine-tune Anti-Spam, click the Settings button.

The Anti-Spam window contains three tabs which allow to configure various Anti-Spam settings:

► Exact methods ► Expert methods ► Additional

Exact methods On the Exact methods tab you can enable/disable filters which Anti-Spam will use to scan a message. You can specify the range within which Anti-Spam will recognize messages as spam

• With phishing elements • With URLs from the base of suspicious addresses • Addressed not to you

In order to create a list of your addresses, on the Exact methods tab perform the following actions:

1. In the Anti-Spam window on the Exact methods tab check If it is not addressed to me 2. Click the My addresses button.

6 | 2 5


3. In the My Email Addresses window click the Add link. 4. In the Email address mask window enter an email address (for

example, [email protected]) and click OK.

5. In order to quickly configure Anti-Spam on another computer, save the list of your email

addresses to a file by clicking the Export button and saving the file to a specified location. At the next stage copy the file on any computer with KSOS 2 installed, open the My Email addresses window, click the Import link and specify the path to the address file.

mailto:[email protected]�

7 | 2 5


6. To edit/delete a record, highlight the record and click Edit/Delete.

7. When the list is created, in the My Email Addresses window click the OK button.

• From blocked senders In order to create a list from blocked senders, check the corresponding option and:

1. In the Anti-Spam window on the Exact methods tab check If it is from a blocked sender сlick the Select button.

8 | 2 5


2. In the Blocked senders window click the Add link. 3. In the Email address mask window enter an email address (for

example, [email protected]) иand click OK.

• With blocked phrases

In order to create a list of blocked phrases, perform the following actions: 1. In the Anti-Spam window on the Exact methods tab check If it contains blocked

phrases 2. Click the Select button.


9 | 2 5


3. In the List of blocked phrases check the boxes next to the listed phrases. 4. To add a new phrase, click the Add link 5. In the Blocked phrase window enter a phrase (for example, quick money) and click

OK. 6. When the list is created, click the OK button in the Blocked phrase window

10 | 2 5


You can also configure to give the useful status to an email (which does not refer to the Spam and Probable Spam categories). • From allowed senders

In order to create a list of allowed senders, 1. In the Anti-Spam window on the Exact methods tab check If it is from an allowed

sender and click the Select button

2. In the List of allowed senders check the boxes next to the required senders. 3. To add a new sender:

Click the Add link. In the Email address mask window enter an email address (for

example, [email protected]) and click OK. 4. When the list is created, click the OK button in the Allowed senders window.


11 | 2 5


• With allowed phrases

In order to create a list of allowed phrases, perform the following actions: 1. In the Anti-Spam window on the Exact methods tab check If it contains allowed

phrases 2. Click the Select button.

3. In the Allowed phrases check the boxes next to the listed phrases.

12 | 2 5


4. To add a new phrase: • Click the Add link • In the Allowed phrase window enter a phrase (for example, kaspersky.com) and click

OK. 5. When the list is created, click the OK button in the Allowed phrases window.

Expert methods On the Expert methods tab you can specify the maximum and the minimum values for the Spam and Probable spam rate, as well as enable/disable work of some spam recognition algorithms. In order to change the values of the spam rate, upon whose exceeding a status Spam/Probable Spam will be assigned to the message, move the corresponding horizontal sliders or specify a value using the arrow-buttons. In the Recognition algorithms section check/uncheck the boxes:

► Image recognition (GSG Technology) ► Analysis of attachments in RTF format ► Self-training text recognition algorithm (iBayes 1

In order to configure additional settings, perform the following actions. ).

1. Click the Additional button:

1 The iBayes algorithm decides which status should be assigned to a message based on the phrases it contains. Prior to work beginning, sample strings of useful and spam mail should be submitted to the iBayes algorithm, i.e. it should be trained. Detailed instruction how to train the algorithm can be found in the Anti-Spam training chapter.

13 | 2 5


2. In the Additional window enable/disable the settings which influence the Spam rate by

checking/unchecking the boxes next to them.

3. Click OK.

14 | 2 5


Additional tab On the Additional tab you can:

• Change the component actions performed on messages recognized as spam/probable spam.

• Configure display of the component plug-in in different mail clients (Microsoft Office Outlook, Microsoft Outlook Express, Thunderbird, The Bat!).

• Configure actions of the Mail dispatcher upon mail receipt via POP3 protocol. • Enable/disable training on outgoing messages. • Enable/disable scan of Microsoft Exchange Server messages.

To enable/disable additional settings, check/uncheck boxes next to the corresponding options and in the Anti-Spam window click OK

Rollback to Anti-Spam default settings You can roll back to the default settings at any moment, after you have changed the Anti-Spam parameters. For this, perform the following steps:

1. Close the Anti-Spam window and in the Settings window 2. In the Security level section click the Default level button. 3. In the Settings windows click the Apply button.

15 | 2 5


Training Anti-Spam One of the most powerful spam detection tools is the self-training iBayes algorithm. The application uses the algorithm to decide, which status should be assigned to a message (Spam, Probable Spam, Not Spam) based on the phrases it contains. The algorithm is initially trained in Kaspersky Lab. Prior to work beginning, sample strings of useful and spam mail should be submitted to the iBayes algorithm, i.e. it should be trained. There are several approaches to training Anti-Spam:

► By using the Training Wizard (only on mail clients Microsoft Outlook 2003, 2007, 2010 (all 32-bit) and Microsoft Outlook Express (32-bit).

► By using the 'Junk' and 'Not Junk' buttons in the tool bar in Microsoft Outlook 2003, 2007, 2010 (all 32-bit), Microsoft Outlook Express (32-bit), Mozilla Thunderbird, The Bat!.

► With the "Train using outgoing mail" setting enabled, Anti-Spam is automatically trained on all outgoing messages, regardless of the mail client.

► In the statistics window of the Anti-Spam component (additional Anti-Spam training). Anti-Spam training wizard (for Microsoft Outlook and Microsoft Outlook Express) Training Wizard allows Anti-Spam training in batch mode, i.e. on entire mail folders, not on separate mails. Training wizard allows to train Anti-Spam on mail clients Microsoft Outlook 2003, 2007, 2010 (all 32-bit) and Microsoft Outlook Express (32-bit). Correct spam recognition requires training using at least 50 useful messages and 50 samples of unwanted mail. To train Anti-Spam with the help of the Training wizard, perform the following actions:

1. In the Anti-Spam training section click the Train button.

16 | 2 5


2. In the Training Wizard: Anti-Spam click Next.

3. Specify folders with useful main and click Next.

17 | 2 5


4. Specify folders which contain spam (if you do not have such folders, skip this step) and

click Next. Anti-Spam will perform the training.

5. In the Wizard completion window make sure that in the Action section the Add results to an existing Anti-Spam database variant is selected and click the Finish button.

18 | 2 5


Training using the Junk and NOT Junk buttons (for Mozilla Thunderbird and The Bat!) If a mail client Mozilla Thunderbird and or The Bat is installed, you can manually train the Anti-Spam component using the Junk and NOT Junk buttons. For this, perform the following actions:

1. Start the mail client. 2. Select a message using which you wish to train Anti-Spam. 3. In the mail client The Bat! use the special Mark as Junk and Mark as NOT Junk items in

the Specials menu.

4. In the mail client Mozilla Thunderbird, use the Junk/NOT Junk button in the toolbar:

After selection of an option from the list above Anti-Spam performs training using the selected message. If you select several messages, they will all be used for training. If a message is marked as useful mail, the address of its sender will be added to the list of allowed senders. Training using outgoing messages You can also train the Ant-Spam component using 50 outgoing messages. For this, on the Additional tab in the Outgoing messages section check the Train using outgoing email messages box. The application also adds to that list of allowed senders the addresses of outgoing mail recipients. Training using report window There is an opportunity to train Anti-Spam using its reports. To assign the Spam or Not Spam labels to messages, perform the following actions:

1. Open the main KSOS 2 window. 2. In the top right part of the window click the Report link.

19 | 2 5


3. Click the Detailed report button.

4. In the top left drop-down list select Anti-Spam. 5. In the left part of the window expand the list by clicking the "+" button. 6. Select the required message. 7. Right-click the string with the information about the message.

20 | 2 5


8. In the context menu select one of the following items:

► Mark as Spam ► Mark as NOT Spam ► Add to the list of allowed senders ► Add to the list of blocked senders

Depending on your decision about the message status, Anti-Spam will correct the operation scheme of the iBayes algorithm and will further place similar messages to the selected category. Registering Anti-Spam plug-in in different mail clients Registering Anti-Spam plug-in in Microsoft Outlook Express Sometimes with KSOS 2 installed and started, incoming messages may be scanned for viruses and filtered for spam, but the management plug-in for the Anti-Spam component is missing from the mail client Microsoft Outlook. It means that Anti-Spam is started and functions in the normal mode, but somehow the management plug-in is not displayed in the mail client. To resolve this problem Kaspersky Lab experts recommend first manually unregister and then register the plug-in libraries in the operating system. For this perform the following steps: Step 1. Unregister the plug-in:

1. Close the mail client. 2. In the bottom left corner of the screen click the Start button All programs

Accessories Command prompt. 3. Copy and paste the following command in the command prompt regsvr32 -u "C:\Program

Files\Kaspersky Lab\Kaspersky Small Office Security 2\kloehk.dll". 4. Press Enter on your keyboard. 5. Make sure the library has been successfully unregistered and click OK.

21 | 2 5


6. In the bottom left corner of the screen click the Start button All programs


Files\Kaspersky Lab\Kaspersky Small Office Security 2\oeas.dll". 8. Press Enter on your keyboard. 9. Make sure the library has been successfully unregistered and click OK.

Step 2. Re-register the plug-in:

1. In the bottom left corner of the screen click the Start button All programs Accessories Command prompt.

2. Copy and paste the following command in the command prompt regsvr32 "C:\Program Files\Kaspersky Lab\Kaspersky Small Office Security 2\kloehk.dll".

3. Press Enter on your keyboard. 4. Make sure the library has been successfully registered and click OK.


Accessories Command prompt. 6. Copy and paste the following command in the command prompt regsvr32 "C:\Program

Files\Kaspersky Lab\Kaspersky Small Office Security 2\oeas.dll". 7. Press Enter on your keyboard. 8. Make sure the library has been successfully registered and click OK.

Registering Anti-Spam plug-in in Microsoft Outlook as part of Microsoft Office To manually register the Anti-Spam plug-in in Microsoft Outlook from MS Office, perform the following steps: Step 1. Unregister the plug-in:

22 | 2 5




Files\Kaspersky Lab\Kaspersky Small Office Security 2\mcou.dll". 4. Press Enter on your keyboard. 5. Make sure the library has been successfully unregistered and click OK.



Files\Kaspersky Lab\Kaspersky Small Office Security 2\mcouas.dll". 9. Press Enter on your keyboard. 10. Make sure the library has been successfully unregistered and click OK.

Step 2. Re-register the plug-in:


2. Copy and paste the following command in the command prompt regsvr32 "C:\Program Files\Kaspersky Lab\Kaspersky Small Office Security 2\mcou.dll".

3. Press Enter on your keyboard. 4. Make sure the library has been successfully registered and click OK.


Accessories Command prompt. 6. Copy and paste the following command in the command prompt regsvr32 "C:\Program

Files\Kaspersky Lab\Kaspersky Small Office Security 2\mcouas.dll". 7. Press Enter on your keyboard. 8. Make sure the library has been successfully registered and click OK.

23 | 2 5


9. Start the mail client.

Registering Anti-Spam component in Mozilla Thunderbird If somehow the plug-in for the mail client Mozilla Thunderbird is not displayed in the program interface and/or malfunctions, in this case Kaspersky Lab experts recommend to manually register the plug-in in the operating system. For this, perform the following steps:

1. Disable KSOS 2 self-defense. For this: • Open the main application window. • In the top right corner of the main window click the Settings link.

• In the top part of the Settings window select the General section and then select

Self-Defense.

24 | 2 5


• In the right part of the window uncheck the Enable Self-Defense box. • In the Settings window click the OK button.


3. Copy and paste the following command in the command prompt regsvr32 "C:\Program Files\Kaspersky Lab\Kaspersky Small Office Security 2\asppp.dll".

4. Click the OK button. 5. Make sure the asppp.dll library has been successfully unregistered. 6. Enable KSOS 2 self-defense. 7. Restart the mail client Mozilla Thunderbird.

If you do not want to use embedded Anti-Spam in the mail client Mozilla Thunderbird, unregister the plug-in in the operating system. For this perform the following steps:

1. Disable KSOS 2 self-defense. 2. In the bottom left corner of the screen click the Start button All programs

Accessories Command pro. 3. Copy and paste the following command in the command prompt regsvr32 /u "C:\Program

Files\Kaspersky Lab\Kaspersky Small Office Security 2\asppp.dll" 4. Click the OK button. 5. Make sure the asppp.dll library has been successfully unregistered. 6. Enable KSOS 2 self-defense. 7. Restart the mail client Mozilla Thunderbird.

Relocating Anti-Spam database from one computer to another You can always relocate Anti-Spam settings from one computer to another without additional Anti-Spam training. In order to relocate Anti-Spam databases from one computer to another, perform the following actions:

1. On your computer copy the file antispam.sfdb from the folder: o in Windows XP the folder C:\Documents and Settings\All Users\Application

Data\Kaspersky Lab\AVP9\Data

25 | 2 5


o in Windows Vista/7 the folder C:\ProgramData\Kaspersky Lab\AVP9\Data 2. On the computer on which you want to relocate the Anti-Spam database:

o Disable KSOS 2 self-defense. o Close the main KSOS 2 window. o In the toolbar right-click the KSOS 2 icon and in the context menu select Exit.

o Save the file antispam.sfdb into similar folder. o Start KSOS 2. o Enable KSOS 2 self-defense.

The Anti-Spam databases are relocated on the second computer.