McAfee VirusScan 9 has a feature called \'WormStopper\'. McAfee recommend that this option is enabled, and it may be enabled by default.

In normal operation this feature is a good idea as it checks outgoing emails for suspicious behaviour, such as more than 5 messages being sent within 30 seconds. On a normal user\'s PC this should rarely, if ever, happen.

However, if McAfee VirusScan 9 is installed on a computer containing a mail server program such as VPOP3, it is entirely feasible that VPOP3 might send many more than 5 legitimate emails out within 30 seconds. Also, WormStopper can check for messages being sent to a large number of recipients at once - this might be triggered by features such as VPOP3\'s distribution/mailing list server.

To access the WormStopper settings:

• right-click the McAfee \'shield\' icon in the task tray, point to VirusScan then Options.
• Click Advanced, then click the WormStopper tab.

To prevent any problems when using McAfee VirusScan 9 on a computer with VPOP3 we recommend one or more of the following actions:

• Disable the WormStopper feature on the VPOP3 computer (we do not recommend that it is disabled on other computers which McAfee VirusScan 9 may be installed on, as it is, in general, a good idea)
• Disable the Alert me when X e-mails are sent within Y seconds option as that is the option most likely to be triggered inadvertently by VPOP3. Alternatively, modify the \'X\' setting upwards based on your expectations. For instance set it to check for 20 emails being sent if you would usually only have 10 or so messages in the VPOP3 Out Queue at once.
• Disable the Alert me when an e-mail is sent to Z or more recipients option, if you use distribution or mailing lists within VPOP3. Again, as an alternative, you may want to leave it enabled, but adjust the \'Z\' setting appropriately.

It is unclear what the Enable Pattern Matching option in WormStopper does, so it may be possible to leave that option enabled.

If you decide to leave any of the WormStopper options enabled, note that when WormStopper does detect suspicious activity it will alert you (via the display on the VPOP3 computer). So, you should periodically check the display there because if an alert is displayed it may prevent VPOP3 from sending any outgoing email.

Keywords: McAfee VirusScan WormStopper Outgoing Email