Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Header length allows POP3 emails to bypass scans in OfficeScan (OSCE)

    • Updated:
    • 27 Mar 2017
    • Product/Version:
    • OfficeScan 10.6
    • OfficeScan 11.0
    • OfficeScan XG.All
    • Platform:
    • N/A N/A
Summary

OSCE scans POP3 emails and detects malicious content. In rare cases, POP3 emails bypass scans because of their header length.

Details
Public

Due to email structure complexity, the POP3 email header length is set to 64 bytes by default in OSCE. If the header length exceeds 64 bytes, the email bypasses the scan.

Trend Micro highly recommends using an email security product (e.g. Deep Discovery Email Inspector) to protect all email channels.

To adjust and set the header length limit for POP3 email messages:

  1. Upgrade to at least OfficeScan 11.0 Service Pack 1 4150 and contact Trend Micro Technical Support for Hot Fix Build 4253. If you have OfficeScan 11.0 Service Pack 1 Patch 1 or XG, proceed to next step.
  2. Open the Ofcscan.ini file in the \PCCSRV\ folder under the OfficeScan server installation directory.
  3. Under the [Global Setting] section, manually add the HdrPerEnt key and set an appropriate value for the header fields. For example, to set the limit to 100 fields:

    [Global Setting]
    HdrPerEnt=100

     
    The default value for this key is 64 and can take any value. However, Trend Micro recommends limiting the value to 1024 fields.
  4. Save the changes and close the file.
  5. Open the OSCE web console and go to the Agents > Global Agent Settings screen.
  6. Click Save to deploy the setting to agents.

    The OSCE server deploys the command to OSCE agents and adds the following registry entry in all OSCE agent computers:

    [HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\Osprey\Scan\Common\MailManager\config]
    Key: HdrPerEntType: dwordValue: 100 (Decimal)

  7. Restart the OSCE agents.
Premium
Internal
Rating:
Category:
Troubleshoot; Remove a Malware / Virus
Solution Id:
1116997
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.