ReadMe for

MAILsweeper for SMTP 4.3.15

(including Technology Update Version 1.4_15

and Anti-spam Filter Update Version 1.6.2)

This ReadMe describes the problems resolved by this patch for MAILsweeper for SMTP, lists the prerequisites for and contents of the patch, and explains how to install and remove the patch. This MAILsweeper for SMTP 4.3.15 patch also includes the fixes in all previous 4.3.x patches released since MAILsweeper for SMTP 4.3 Service Pack 2 (SP2), which are listed under Problems fixed in previous patches .

This patch also includes solutions to Anti-spam Filter Version 1.6.

You need only apply this Version 4.3.15 patch to update an installation of MAILsweeper for SMTP 4.3 SP2 or later, or Anti-spam Filter 1.6.

Contents

This document contains the following topics:

• Patch description
• Prerequisites
• Installing the patch
• Removing the patch
• Files included in this patch
• Problems fixed in previous patches

Patch description

The MAILsweeper for SMTP Version 4.3.15 patch provides a solution to the following problems:

• In certain circumstances, if the results from textual analysis were included in the Inform notification message, messages were placed in the Recovery folder.

  Textual analysis functionality has been improved to stop this from happening.

• Some TAR, GZIP files were incorrectly classified as Undetermined.

  TAR and GZIP data types are now detected and decoded correctly.

• Certain messages containing LHA attachments were incorrectly classified as Undetermined.

  LHA data type is now detected and decoded correctly.

• Corrupt Microsoft PowerPoint files could cause the Security service to process indefinitely, using 100% of the available CPU resource.

  Such files are now processed correctly as Undetermined so that they no longer use large amounts of system resource.

• In certain circumstances, BinHex encoded files in the body of the message were not decoded correctly.

  Inline BinHex attachments are now detected and decoded correctly.

• In certain circumstances, JPEG image files embedded within a Word document were not extracted correctly. This caused IMAGEmanager to classify them as Undetermined.

  JPEG file extraction has been improved.

• In certain circumstances, MAILsweeper for SMTP was not cleaning up orphaned files left in the Holding folder after delivery.

  The file handling code has been improved for checking and deleting orphaned files.

• Disclaimers were not added to HTML emails when using Outlook 2003 with Exchange 2003 SP1.

  Disclaimers are now added correctly to HTML emails.

Anti-spam Filter

The following list of Anti-spam Filter solutions will only be installed on your machine if the installer detects that Anti-spam Filter Version 1.6 is already installed. If version 1.5 is detected, no files will be updated.

• The version of the GETASF.BAT file for the Anti-spam Filter was incorrect.

  The correct version of the GETASF.BAT file is now included.

• The Anti-spam Filter Content Manager did not perform cleaning.

  The Content Manager now checks the asfwhite15.ini file and removes entries from the spam tree.

• A problem in the Anti-spam Filter Content Manager caused a memory leak.

  This problem has been fixed.

• The scheduled spamActive tasks generated by the ASF Scheduler were not running, and the error "Could not start" was logged in the Status column for each spamActive task listed.

  Each task was expecting a password to be entered before running. The ASF Scheduler now uses the Local system account to run the spamActive tasks. Once you have installed this patch, re-run the ASF Scheduler and the tasks will start running normally.

Back to Contents

Prerequisites

Install this patch on the following versions of MAILsweeper for SMTP only:

• MAILsweeper for SMTP 4.3 Service Pack 2 or later

You must log on with the Administrator account that originally installed MAILsweeper for SMTP.

The Anti-spam Filter solutions will only be installed on a machine that has Anti-spam Filter Version 1.6 already installed.

Back to Contents

Installing the patch

Before installing this MAILsweeper for SMTP Version 4.3.15 patch, ensure you have read the Prerequisites section.

Note:	If you are running a distributed deployment of MAILsweeper for SMTP, you must install the patch on each machine in the cluster.
	No messages can be processed during the patch installation.

To install the patch:

1. Stop the MAILsweeper for SMTP services.
2. Close the MAILsweeper for SMTP Console .
3. Run msw4315.exe from your installation media.
4. Open the MAILsweeper for SMTP Console and restart the MAILsweeper for SMTP services.
5. If using the Anti-spam Filter, you must now run the ASF Scheduler to download the latest datafiles from the Clearswift website.

If the installer experiences problems, it will rollback to the version that was installed on your machine before you installed this patch. If you experience any other problems, please contact your normal support provider.

In certain circumstances, to complete the upgrade the patch installer will cause the machine to reboot.

In cBack to Contents

Removing the patch

If you experience problems after installing MAILsweeper for SMTP Version 4.3.15, you can remove the patch. No messages can be processed during the removal of the patch.

Note:

If you are running a distributed deployment of MAILsweeper for SMTP, you must remove the patch from each machine in the cluster.

To remove the patch:

1. Stop the MAILsweeper for SMTP services.
2. Close the MAILsweeper for SMTP Console .
3. Navigate to the MAILsweeper for SMTP program folder (by default, C:\Program Files\MAILsweeper for SMTP\Program).
4. Select the MAILsweeper for SMTP 4.3.15 folder, and then run rollback.exe.
5. Open the MAILsweeper for SMTP Console and restart the services.

Back to Contents

Files included in this patch

The table below shows the updated MAILsweeper for SMTP 4.3 program files contained in this patch, listing their new version number for this patch. All other files included in this patch have not been changed.

MAILsweeper for SMTP program file	New version
FML14.DLL	1.4.15
MOF14.DLL	1.4.15
MIMETNEF14.DLL	1.4.15
MAILUTIL.DLL	4.3.15
SMTPDS.EXE	4.3.15
INFORM.XSL	-
GETASF.BAT	- *
ASFPLAT43.DLL	1.6.2 *
ASFCM43.DLL	1.6.2 *
ASFSCHEDULERCOM.DLL	1.6.2 *

* These files will only be installed on a machine that has Anti-spam Filter 1.6 already installed.

Back to Contents

---

Problems fixed in previous patches

MAILsweeper for SMTP Version 4.3.15 patch also includes the solutions provided in all patches released since MAILsweeper for SMTP 4.3 Service Pack 2. These solutions are:

• MAILsweeper for SMTP 4.3.14 patch summary
  • An LHA buffer overflow UNIX exploit which caused MAILsweeper for SMTP to fail has now been fixed.
  • The solution for the Password-protected Adobe PDF files problem that was fixed in the 4.3.13 (Technology update 1.4.13) patch has been removed from this patch release as it was producing too many false positives. A new solution is targeted to be addressed in a later release. For more information on the previous solution, see MAILsweeper for SMTP 4.3.13 (Technology update 1.4.13) patch summary.
  • Large temporary JET database files were causing problems with message processing.

    This patch release has improved efficiency in message area handling.

  • Mail with long domain names can cause the Delivery Service to stop processing messages.

    The Receiver Service now imposes a size limit on domain names in the MAIL FROM: and RCPT TO: addresses to ensure that the length of the spool directory path does not exceed the maximum limit.

  • Encrypted ARJ files passed through MAILsweeper for SMTP as clean files.

    Encrypted ARJ files are now recognised as encrypted.

  • Microsoft PowerPoint files that are corrupt caused the Security Service to process indefinitely, using large amounts of system resource.

    This patch release has improved support in handling such files so that they no longer use large amounts of system resource.

  • Certain Word documents were incorrectly classified as Undetermined.

    These Word documents are now processed without error.

  • If the SMTP Mail Server port setting within the SMTP Alerter was changed in the MAILsweeper for SMTP Console, it reverted back to default 25.

    The MAILsweeper for SMTP Console has been fixed so that the Server port setting within SMTP Alerter no longer reverts back to 25 if the setting is changed.

• MAILsweeper for SMTP 4.3.13 (Technology update 1.4.13) patch summary
  • Some Password-protected Adobe PDF files were not recognised as being encrypted.

    Adobe Acrobat allows the password protection of Portable Document Files (PDF). Prior to the development of this patch, MAILsweeper for SMTP 4.3 did not recognise that some of these files were encrypted.

    This Technology Update corrects this issue, and marks password-protected PDF files appropriately.

    Note: this has been regressed in Version 4.3.14.

  • Some Windows Meta Files (WMF) were not being extracted from MS PowerPoint presentations.

    Some WMF image files were not being extracted by MAILsweeper for SMTP 4.3. This Technology Update corrects this issue, improving the extraction of WMF files from PowerPoint presentations.

• MAILsweeper for SMTP 4.3_13 (Technology update 1.4_12) patch summary
  • Certain email messages that contained RAR attachments caused the Security Service to process indefinitely, using large amounts of system resources. Such files are now processed correctly.
• MAILsweeper for SMTP 4.3_13 (Technology update 1.4_11) patch summary
  • An issue has been identified with the authentication process between the MAILsweeper Security Service and the Microsoft Management Console. In some exceptional circumstances, the MAILsweeper Security Service would stop processing messages, especially around midnight, and mail would queue in the "Unchecked messages" folder, even though the Security Service was still running. This has now been fixed.

Back to Contents

Revision 1.0 July 2004
Published by Clearswift Limited 28-July-04
© 2004 Clearswift Ltd
All rights reserved

The materials contained herein are the sole property of Clearswift Ltd. No part of this publication may be reproduced or disseminated or transmitted in any form or by any means electronic, mechanical, photocopying, recording, or otherwise stored in any retrievable system or otherwise used in any manner whatsoever without the express permission of Clearswift Ltd.

Information in this document contains references to fictional persons, companies, products and events for illustrative purposes. Any similarities to real persons, companies, products and events is coincidental and Clearswift shall not be liable for any loss suffered as a result of such similarity.

The Clearswift Logo and Clearswift product names including MIMEsweeper™, MAILsweeper™, e-Sweeper™, IMAGEmanager™, REMOTEmanager™, SECRETsweeper™, ENTERPRISEsuite™,ClearPoint™, ClearSecure™, ClearEdge™, ClearBase™, ClearSurf™, DeepSecure™, Bastion™ II, X.400 Filter™, FlashPoint™, ClearDetect™, ClearSupport™, ClearLearning™ are trademarks of Clearswift Ltd.

All other trademarks are the property of their respective owners.

Clearswift Ltd. (registered number 3367495) is registered in Britain with registered offices at 1310 Waterside, Arlington Business Park, Theale, Reading, Berkshire RG7 4SA, England. Users should ensure that they comply with all national legislation regarding the export, import, and use of cryptography.