This article applies to:
- Trustwave SEG 8.2 and above
- Virus scanners with "cleaning" options
Question:
- Why has "virus cleaning" been removed in new releases of Trustwave SEG?
Information
Background
In the early 2000s, SEG introduced the ability to interact with specific virus scanners' "cleaning" function. The cleaning function was typically used to remove malicious macros from real documents, or to remove malware that had been attached unbeknownst to the original sender.
A customer using SEG could "disinfect" these messages, allowing the safe content to reach the original recipients with malicious content removed.
The present
Malware techniques have evolved, and different methods of infecting recipients are employed. Viruses are rarely embedded directly in messages due to the proliferation of mail security gateways.
The Anti-Virus industry stance is that any message that contains malware should not be trusted. Even if the removal of part of the email succeeds, it is highly probable that other parts of the mail message could still be infected. The expert opinion of virus analysts is that during the last several years, attempting to disinfect malicious email is pointless in close to 100% of the cases.
Based on millions of analyzed messages, the industry leading Trustwave SpiderLabs team have found little evidence to suggest that cleaning messages is of any benefit to the end recipient.
AV vendors are slowing removing the cleaning function from their new releases, and Trustwave is pre-empting this move by removing this functionality from SEG. This action aligns Anti-Virus security settings for SEG with industry best practice.
Other benefits
The removal of the cleaning function interaction with the Anti-Virus engine reduces SEG engine load time significantly.
Recommended action:
- Trustwave recommends that customers remove any scanning rules that allow "cleaned" messages to be delivered.
- When making this change customers should be sure that a rule to quarantine the messages is still present.
Upgrade path:
- Upgrade to SEG 8.2 or above will check for rules that use the cleaning option.
- Upgrade will be blocked until these rules have been removed.