This article applies to:

• Trustwave MailMarshal (SEG)
  • Note changes in behavior for Office 2007 documents at version 6.4 and version 7.1
• Trustwave ECM/MailMarshal Exchange 7.X

Question:

• What file types do TextCensor scripts scan by default?
• How can I apply TextCensor scripts to non-standard files?
• How do I make TextCensor scripts scan the entire e-mail and not just the decoded body?
• How do I allow a TextCensor script to scan MIME tags?
• How do I use TextCensor scripts to perform steganography on the encoded contents of an image file?

Information:

By default, MailMarshal applies TextCensor to files that are plain text. MailMarshal will not apply TextCensor scripts to certain types of files.

The default file types that TextCensor scripts will not scan are:  

• mail (The raw mail file including MIME boundaries, MIME tags, etc.)
• archives  
• images
• video
• sound

In addition, SEG/MailMarshal SMTP and ECM/MailMarshal Exchange 7.X, applies TextCensor only to the extracted text in the following file types:

• DOC (Microsoft Word)
• MSG (Email message)
• PDF (Adobe PDF)
• PPT (Powerpoint Presentation)
• PPS (Powerpoint Show)
• XLS (Microsoft Excel workbook)
• Office 2007 documents (DOCX, PPTX, PPSX, XLSX, XLSB) - in SEG 6.4 and above only
• CHM files - text, html, css and js files are scanned - in SEG with Unpacker 2.3.5 and above

These settings are designed to avoid the following issues:

• Performance issues associated with scanning potentially large amounts of binary data
• False positive issues due to scanning of binary data or utility text

Advanced Settings

For advanced users who have a need to change these settings, registry/Advanced Settings entries are available.

The method differs depending on the MailMarshal version.

Caution: The registry keys REPLACE the default lists. If you want to add an item to the default list you must include the entire default list as well as the new item.

MailMarshal SEG 6.X and above 

• The default list of file types NOT scanned by TextCensor is:
  • archive;image;video;sound
• You can override this list by adding a Registry key/Advanced Setting TextCensorFileTypes with different values.
• The default list of file types PARTIALLY scanned by TextCensor is:
  • mail,mhdr,mbody,rtfbody;
  • pdf,text;
  • doc,text;
  • ppt,text;
  • pps,text;
  • msg,text;
  • xls,text;
  • xlsx,text;
  • docx,text;
  • xlsb,text;
  • pptx,text;
  • ppsx,text;
  • chm,text,html,css,js (Unpacker 2.3.5 and above)
• Each item shows the parent type and a list of child types that are scanned.
• You can override this list by adding a Registry key TextCensorSubTypes that includes a list of parent and child types.

Examples:

• To apply TextCensor to raw mail files, including the MIME tags, the value of the registry key would be (all on one line):
  • pdf,text;doc,text;ppt,text;pps,text;msg,text;xls,text;xlsx,text;docx,text;xlsb,text;
    pptx,text;ppsx,text;chm,text,html,css,js
• To apply TextCensor to raw PDF files, the value of the registry key would be (all on one line):
  • mail,mhdr,mbody,rtfbody;doc,text;ppt,text;pps,text;msg,text;xls,text;xlsx,text;docx,text;xlsb,text;
    pptx,text;ppsx,text;chm,text,html,css,js

To apply TextCensor to additional file types:

• Caution: The registry keys or advanced setting entries REPLACE the default lists. If you want to add an item to the default list you must include the entire default list as well as the new item.

1. On the Array Manager, edit the Registry (MailMarshal (SEG) 10.X: use Advanced Settings in the Management Console)
2. Navigate to the SEG Engine key:
   • In version 8.X: HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\Default\Engine
   • MailMarshal (SEG) 10.X: value names have the prefix Engine. (Engine dot).
   • For full details of the location for each product version, see article Q10832.
3. Add one or more of the following string values:
   • TextCensorFileTypes     REG_SZ    
     • Use this key to specify the COMPLETE list of file types that will not be scanned.
   • TextCensorSubTypes    REG_SZ    
     • Use this key to specify the COMPLETE list of subtypes (child types) that will not be scanned.
4. Enter the required values (see examples above)
5. Reload (Commit) the configuration
6. On each email processing server, restart the MailMarshal Engine service

MailMarshal ECM 7.X

• The default list of file types NOT scanned by TextCensor is:
  • archive;image;video;sound
• You can override this list by adding a Registry key TextCensorFileTypes with different values.
• The default list of file types PARTIALLY scanned by TextCensor is:
  • mail,mhdr,mbody,rtfbody;
  • pdf,text;
  • doc,text;
  • ppt,text;
  • pps,text;
  • msg,text;
  • xls,text; 
• Each item shows the parent type and a list of child types that are scanned.
• You can override this list by adding a Registry key TextCensorSubTypes that includes a list of parent and child types.

Office 2007 example:

• To avoid applying TextCensor to the top level of Office 2007 files, the value of the registry key would be (all on one line): 
  • mail,mhdr,mbody,rtfbody;pdf,text;doc,text;ppt,text;pps,text;
    msg,text;xls,text;docx,text;pptx,text;ppsx,text;xlsx,text;xlsb,text;chm,text,html,css,js
    

Notes:

• Warning: Due to the possibility of adverse effects caused by deploying these changes, they should only be attempted by advanced users who understand both the positive and negative ramifications of scanning non-standard file types. If you have any question, contact Trustwave Technical Support before making these changes.

Office 2007 (and above) documents

Text from Office 2007 and above documents is scanned in SEG/MailMarshal 6.4 and above (DOCX, PPTX, PPSX, XLSX, XLSB).

If you find that TextCensor is false triggering on the top level data of these documents, take one of the following actions:

• Upgrade to the current version of SEG. The issue that caused false triggering is corrected in SEG 7.1 and above.
• For MailMarshal Exchange/ECM 7.X, see the advanced setting example above for Office 2007.

Warning: Using the Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Trustwave cannot guarantee that problems resulting from the incorrect use of the Registry Editor can be resolved. Make sure that you backup your registry prior to making any changes.

This article was previously published as:

NETIQKB46628