Attachment Sandboxing uses advanced sandbox technology to quarantine harmful email attachments that can evade other antivirus or anti-spam software. It can even identify brand-new malware and viruses. And Attachment Sandboxing does all this before the email even reaches your inbox.

How does Sandboxing affect me?

Attachment Sandboxing, like other VIPRE Email Security software, acts in the background to protect you. In a perfect world, no one would ever try to send you a harmful file. However, we know better. Harmful files are transferred as attachments through email all the time, including viruses, Trojans, adware, and other forms of malware. Some of these are caught by signature-based checks, particularly if they are files that have been seen before by other people. Sandboxing scans new, unknown email attachments, flags newly identified harmful items and delivers this information in your Email Security Quarantine Report.

What happens to my emails when Sandboxing checks them?

If an email does not contain any attachments or only non-supported attachments, it is delivered to you immediately (after all the standard Email Security checks, such as anti-spam).

If an email message contains supported attachment types, each attachment is extracted from the email and "detonated" (i.e., executed) within an isolated sandbox virtual machine. Advanced AI technology analyzes the attachment's behavior. This process does take some time, and processing time may depend on how many of your peers have also recently received emails with attachments.

If the attachments are clean, you’ll receive your original email with the attachments, as usual.

If an email message contains attachments that are identified as potential malware by Sandboxing, those items are sent to quarantine just like other undesired content. You'll find these items on your Quarantine Report, which shows all suspect emails and potentially malicious file attachments. If you do not receive a Quarantine Report, check with your administrator.

In the special case where an email with attachments takes a very long time to process, you may receive a "pre-notification" email that consists of the original email with attachments stripped off of it. This notification is intended to alert you to a pending message from the sender that is "in queue". You may be able to respond based solely on the email content without the attachments, or you can wait for the final result of the Attachment Sandboxing scan. If the attachments are clean, Attachment Sandboxing re-delivers the original email with all attachments intact.

As part of this process, you may see that your email has:

• A subject beginning with [SANDBOX]
• Its original attachments removed, with a text list of attachment filenames instead
• A warning at the bottom

What's the difference between a suspect and a malicious attachment?

Attachment Sandboxing uses advanced sandbox technology to test files within a virtual environment and see if they attempt to perform harmful activities or otherwise act suspiciously. The behavior of the attachment under test is compared to the past observed behavior of millions of known malware samples and known benign samples. This comparison is a statistical analysis that necessarily involves a similarity rating within a range.

• A suspect attachment is one that has exhibited odd (but not immediately harmful) behavior. It may have attempted to take action without permission, like open a web page or launch other programs, or it may have performed other suspicious activities that have similarly been observed in other malware. Not all suspect files are bad, but they have performed actions that are typically unexpected in well-behaving software.
• A malicious attachment is one that either contains other known malware or attempts to perform malware-like actions. It clearly attempted to infect or damage a user's PC to some degree during testing or clearly exhibits behavior very similar to other malware.

Malicious attachments are quarantined and cannot be released due to the risk they pose; suspect attachments are also quarantined but may be released on your personal recognizance (if your admin has granted permission). We do NOT recommend releasing suspect attachments unless you know and trust the sender or have proper protections in place for the testing of the attachment.

Warnings generated by Attachment Sandboxing

If a delay is detected while Attachment Sandboxing is processing one of your emails, you may receive a notification message consisting of the content of the original email with attachments removed.

These warnings are described below for your reference.

• Attachments have been temporarily removed
• Multiple attachments that could not be checked

"This email contains one or more attachments that have been temporarily removed while we check them for malicious code."

The full text of the message is

This email contains one or more attachments that have been temporarily removed while we check them for malicious code. We will redeliver the email with any original attachments once processing is complete.

Please exercise caution if you choose to release this email before it is checked.

What does this mean?

Attachment Sandboxing is currently analyzing files that were sent to you. Your email message is intact, but Attachment  Sandboxing has pulled out the attachments to test them. There could be a delay while these files are tested.

Email release link and portal

If your administrator has enabled it, you will also have a link at the bottom of your email to release the original message and attachments and receive them immediately.

Clicking the link takes you to the Email Security portal, where you have a few options. See the table below.

"This email contains multiple attachments which could not be checked for malicious code."

The full text of the message is

This email contains multiple attachments which could not be checked for malicious code. Please exercise caution when opening any attachments to this message.

What does this mean?

For some reason, Attachment Sandboxing was unable to fully analyze the files attached to your email. The attachments have, therefore, not been checked by Attachment Sandboxing, and (like any unchecked attachment) could be malicious — exercise caution when opening them.

VIPRE Email Security Encryption enables administrators to automatically encrypt emails.

You can locate VIPRE Email Security Encryption on the left-side menu under Service Settings > Encryption.

This screen includes four pre-existing policies that have been created to enable users to quickly start using the service. These policies are disabled by default. 

When enabled, the four predefined policies will trigger encryption when:

• An email body contains any of the following information which the user can choose from the checkboxes:
  • Credit Card Number
  • Social Security Number - US
  • Social Insurance Number - Canada
  • Danish Personal Number
  • Swedish Personal Number
  • Norwegian Personal Number
• The sensitivity of a Microsoft Outlook email is set to confidential
• The email sender pre-pends an email's subject line with the word “[Encrypt]” (not case-sensitive)
  • This enables the end user to selectively encrypt an email that contains sensitive information but is not covered by any of the policies
• An email sent by an end-user contains at least one domain or address listed in the text box
  • You can add specific domains or addresses for your organization in the text box below the policy in the web console

The recipient will receive a notification email with a link to read and respond to the encrypted email through a secure portal. First-time recipients will have to set up an account by inputting their email address and a password of their choice. They will receive an email to confirm their email address, after which they can start using the secure portal to read and respond to the encrypted email securely.

You can also brand these encrypted emails with your organization's logo.