As spam gets ever more sophisticated, pure automation fails to prevent it. Vircom's ModusMail 2.0 combines automated in-depth mail analysis with constantly updated scripts to produce a package that adapts to fight new attacks.

by Alex Goldman ISP-Planet Associate Editor [January 17, 2003]

Vircom, developer of the ModusMail anti-spam and anti-virus product, has released ModusMail 2.0. The updated product is more customizable, making it easier to serve customers with different needs or requirements.

The basic product includes an updated anti-spam engine utilizing the Sieve mail filtering language [.txt] as developed by the Internet Engineering Task Force (IETF). Sieve enables Vircom and its ISP clients to write simple scripts that will help the software identify specific problem spams using only part of the spam message. For example, an ISP could ban all messages containing a specific 800 number.

Vircom has included a stand-alone Sieve editor and command-line syntax checker to make it easier for ISPs to write their own scripts. Vircom continues to maintain its customer network, the Vircom Anti-Spam Coalition (VASC), which encourages users to submit scripts to Vircom so that they can be checked and then shared with other Vircom customers.

The ModusMail scanning engine uses several other strategies besides Sieve to fight spam—for example a technique Vircom calls "Body Purification" which strips out the HTML and allows the Sieve engine to focus on the text that the end-user would see. Daniel Roy, Vircom product manager, said that some spammers hide their messages from scanning engines by breaking up key words with code that fools some anti-spam engines, so the spam is still delivered to the end-user. The engine also uses a Perl-like regular expression (Regex) engine for more powerful anti-spam search techniques.

The new engine is also more secure, fortified against specific types of mail server attacks such as Malformed MIME Attacks (MMAs) which are used to infect mail servers with viruses. The Vircom team has achieved added efficiencies, making the new scanning engine faster and more efficient.

Further enhancing security for ModusMail 2.0 is the option of using McAfee's anti-virus product (for an additional fee) or Norman's anti-virus product (which comes with ModusMail 2.0). Norman is more popular in Europe than in North America.

Being there
To better understand what it's like to run ModusMail 2.0, we received Vircom's marketing demonstration, which involves a walkthrough of ModusMail 2.0's most important new feature, web-based administration. Vircom has built two consoles based on Microsoft Active Server Pages (ASP) technology, one for administrators called ModusWebAdmin, and one for end-users called ModusWebMail.

The ModusWebAdmin console is intuitive and easy to use. Features can be turned on or off with simple checkboxes or drop-down menus. Vircom includes RBL support. Roy said the company does not recommend the use of blacklists, but feels that its product should support them if customers want to use them. The console also allows administrators to select individual servers, identified by IP address, to be allowed to send mail to the scanning engine. It can even allow servers to pass traffic through ModusMail without any action at all. Numerous other features are available at a click of the mouse. Anyone interested in the product should contact Vircom and take the tour.

ModusWebMail provides an equally intuitive interface for end-users. It allows subscribers to choose from three or more security levels for each category of spam (Adult, Money, Hoax, Patterns, Health, and Goods), and even to disable filtering of a particular category if they wish (although the administrator can override this). Subscribers can also use the console to set up vacation autoresponders, and choose whether to delete viruses and spam or place them in a quarantine mailbox.

Go to page 2: Spam gatecrashes the party >