GUMail: Automatic Attachment Filtering

What is attachment filtering? What is the rationale for attachment filtering? Can I still send or receive a compressed or executable attachment? How do I send an e-mail attachment with one of the file names listed below? Which filename extensions are filtered by GUMail? Why were these file types selected as potentially dangerous? Why do I receive so many e-mail messages with a notice saying that an attachment has been removed? My file attachment was removed from an e-mail message. Does the attachment have a virus?

What is attachment filtering? GUMail is configured to automatically remove potentially dangerous executable or compressed file attachments from incoming e-mail messages. The system determines whether to remove the attachment by examining the filename and associated filename extension (the last 3 characters after the 'dot' in the filename).  When the system deletes an attachment from an e-mail message, it still delivers the original message to the intended recipient(s), along with a notice that the accompanying attachment was removed. The list of filename extensions that the system automatically removes from e-mail messages is shown below. What is the rationale for attachment filtering? The number of incoming virus-infected messages reaching the Georgetown e-mail system has recently skyrocketed. This dramatic increase clogs the mail system, fills mailboxes with large attachments, and creates a greater risk of virus infection. In addition to the increase in quantity, viruses are also becoming much more sophisticated. More people are being fooled by the deceptive text of viruses disguised as official e-mail. A large percentage of these worms spread via e-mail attachments. Fortunately, the worms have distinctive filename extensions. GUMail is configured to remove these dangerous attachments automatically. However, attachment filtering does not affect the transfer of data files such as text files (.TXT), word processing documents (.DOC and .WPD), spreadsheet files (.XLS), Adobe files (.PDF), or image files. Georgetown University has implemented this service feature to promote the integrity of our computer network and to safeguard your computer.  The procedure is completely automated; no one ever views or opens your e-mail messages. If you believe an attachment has been removed from your e-mail by mistake, please contact the UIS Help Desk.

Can I still send or receive an executable or compressed attachment even though it is being filtered?  Yes! If you want to send or receive an executable attachment, you should simply change the filename extension. If you do not change the filename extension, the attachment will not accompany the original message if sent using GUMail.

Which filename extensions are filtered by GUMail?  The file extensions and associated file types that are filtered are listed here:

Why were these file types selected as potentially dangerous?

All the file types on the list represent files that can be used to exploit a security vulnerability. This includes many file types are not traditionally executable. UIS follows the recommendations provided by Microsoft and other leading institutions of higher education like Indiana University and Florida State University to determine which files pose a security threat.

---

Why do I receive so many e-mail messages with a notice saying that an attachment has been removed?

This indicates that someone that you know has a computer that is infected with a worm. The worm is sending e-mail messages with malicious attachments, and pretending to be you. GUMail servers can identify this behavior, and diffuse it by stripping the malicious attachments. As a normal function of e-mail system, we must always notify you when a message has been altered enroute to delivery.

Typically this type of virus cracks open a PC's address book and then sends e-mail messages with harmful attachments to other people in that it found in the address book. 

For example, suppose hacked@georgetown.edu's computer has been compromised by a worm. The worm finds two email addresses on the computer, bystander@georgetown.edu and yourNetID@georgetown.edu. The worm will try to send an email to bystander@georgetown.edu with a dangerous attachment. To fool bystander into thinking this is a legitimate message, the email appears to come from yourNetID@georgetown.edu.

Our filtering system can recognize and delete the dangerous attachment, then automatically send a notice to yourNetID@georgetown.edu with a messge that the file attachment was removed.  

---

My file attachment was removed from an e-mail message. Does the attachment have a virus?

Possibly, but we do not check for the presence of a virus. Our system automatically removes all attachment files with the filenames listed above. Because the attachment is removed, we do not check it for the presence of a virus. Scanning for the presence of a virus would take a longer time and delay our e-mail messaging service. We cannot confirm whether your attachment has a virus. You can determine this by using your computer's anti-virus software.