Submitting Spam Examples

In order to improve our anti-spam detection capabilities, we collect samples of spam that were not identified by our system. Simply forwarding messages directly to us will not accurately capture the true format of the original message, including email headers vital to properly analyzing the content. Therefore we need all submissions be forwarded using the SpamSource Toolbar to ensure each email arrives in the correct format.  The instructions below will help you properly install and configure the SpamSource Toolbar.

Download plugin for your email client version

SpamSource configuration

1. Shutdown Outlook.
2. Select all defaults during the installation process.
   
   
   
   
3. Finish the installation.
   
   
   
   
4. Launch Outlook
   
   
5. Select Tools > Options and open the SpamSource tab.
   
   
   
   
6. Select the General button and choose 'Display button for individual email messages'.
   
   
   
   

7. Add our spam reporting email addresses by selecting the Email Options button.
   
   
   
   Select the Add button, click the Spam radio button and enter the Email Address below:

8. Select OK
   
   
9. Highlight a spam message and select the "Report Spam" button in the toolbar.
   
   

SpamGrabber configuration

1. Download the correct installer package and extract the two files to a folder on your computer. Make sure Outlook is not running and execute the "setup.exe" file. The installer will first ensure you have all required prerequisites installed (such as the .NET Framework and the runtime libraries for Visual Studio Tools for Office). If your system does not already have these files installed, you will be prompted to download and install them automatically.

2. Once the installer has finished running you can start Outlook and configure the app.

3. Once installed, you should see a new tab in the Outlook main screen (Outlook 2010) or a new set of buttons on the toolbar (Outlook 2007):

   

4. The buttons displayed on the menu can be configured in the settings, and you may not see all of them by default.
   The first thing you will want to do is to set up a default reporting profile. 
   Click the settings button to view the settings dialog. Click on "Reporting Profiles" in the left pane, which will list all the reporting profiles you have configured (this will be blank when you first install the app).

   Click the "Add" button. This will prompt you to enter a friendly name for the profile (such as "SpamReport"), and the default email address to report to:

   Click Add, and you will be taken to the advanced settings for your profile.
   
   
   

5. Select profile "SpamReport" and click "Spam Default button"

6. Advanced settings:
   Report Text:

   • Report subject: Please change the subject of the generated report email by changing the text in this box to "SpamGrabberReport"
   • End report text: leave default text
   • Message body: leave default text

   Report Options:

   • Ask for verification:
   • Keep a copy:
   • Send multiple: must be unchecked
   • Use RFC822: must be unchecked
   • Clean headers: must be unchecked
     

Submitting Virus Examples Files suspected to contain malicious payload or have wrongly been identified as a virus can be submitted to us for analysis.

1. All virus submissions must be compressed (or zipped) into an archive file and password protected.
2. Our team will conduct analysis on submitted examples in a sandbox environment to determine whether any malicious payload is present.

Filtering Process  

1. On a daily basis, messages that are clearly not malware are filtered out of the mailbox - this includes emails such as newsletters, and other email that has been subscribed to. 
2. The next step is to filter through the examples to detect global trends across all customers. From experience, Our analysts are easily able to identify the types of spam or viruses, and whether these are company specific or related to a global issue. 
3. Regular reports are also run to monitor the number of examples submitted to the mailbox; and the customer accounts they are coming from. If higher volumes are coming from a particular customer, a security review will be conducted on the customer's account. If necessary, the Security Services Team will contact the Administrator, to discuss certain recommendations which will help to reduce malware.
4. We will not respond to each example that has been submitted, and does not provide customers with reports on their malware activity. This is because many examples submitted are not actually malware, or the same example may be submitted several times by different users, which would distort the results of a report based on the number of submissions.