Trend Micro keeping a sharp eye on message content

CUPERTINO, CALIF. - Trend Micro is beginning to look at the content of e-mail, not just viruses, as it seeks to boost the capabilities of its ScanMail products.

The company in two weeks plans to ship Version 3.0 of ScanMail for Exchange, which includes content filtering technology and failover support for Microsoft Exchange servers linked in a cluster. Trend in-tends to make the features available for all its messaging server-based ScanMail products, including those for Lotus Notes and cc:Mail, Microsoft Outlook and Hewlett-Packard OpenMail.

Trend has borrowed technology from its InterScan VirusWall product to create a plug-in for ScanMail called eManager. The product allows e-mail to be filtered based on the content of a message and whether or not it is considered spam. The content filter can look for offensive or inappropriate language or certain code words or names that should not be passed in e-mail. The spam filter is linked to a database of known spam addresses and Web sites that Trend maintains, which can be downloaded onto Exchange servers.

Both eManager filters block e-mail before it has a chance to clog servers or pass inappropriate content, Trend officials say.

The company also has taken advantage of the Microsoft Cluster Service API in order to support clusters of Exchange servers. Deploying Exchange servers in clusters has become popular to ensure scalability and reliability. ScanMail monitors each server in the cluster to ensure all mail is checked for viruses and content.

ScanMail for Exchange 3.0 also addresses macro viruses and message-attached executables with a new Emergency File Blocking service. Administrators can use the service to block all attachments or specifically filter such content as .exe attachments or .doc attachments that include macros.

"As content viruses become more common, we'll see all the vendors going to content filtering," says Kurt Schlegel, an analyst with Meta Group. "The next big focus will be speed - how quickly the vendors can get the fix out to combat fast spreading viruses or worms."

The speed at which a virus can spread was recently highlighted by the Melissa and Worm viruses that rocked corporate e-mail systems.

Trend is addressing the issue with ActiveUpdate, which allows remote and local servers to be updated automatically with the latest virus information on set schedules. Trend also has added a ScanMail Server Status feature that reports the health of ScanMail and the version of the virus database running on each server.

"The problem is content, not just viruses," says Dan Schrader, vice president of new technology for Trend. "The goal is to protect all the content threats."

ScanMail for Exchange 3.0 is priced at $5,000 without the eManager plug-in and $6,250 with the addition. Both prices are for 250 users.

Separately, Network Associates last week unveiled another virus detection program for Exchange.

GroupShield for Exchange Version 4.0.3 features ViruLogic, which detects false positive results when scanning for viruses. This increases the accuracy of virus detection. The software also has a "virus lock" to prevent reinfection from viruses lying dormant in private folders.

The Network Associates product is priced at $19 per seat, per year for 5,000 nodes or more.

Trend: www.antivirus.com; Network Associates: www.nai. com