Mail filter for Microsoft Exchange

I don't understand why people still open unknown attachments but apparently they do since the viruses with attachements with extension of .exe, .scr, .pif etc still flourish. A number of years ago and in the aftermath of such an virus attack I wrote this mail filter, implemented as an SMTP event sink for Microsoft Exchange Server 2003. I recently added support for recoding WAV file attachments to WMA based on my implementation of a WAV to WMA console utility.

Being able to transcode WAV files is particularily handy when used with a system that sends voice recordings in a poorly compressed format. An example of such an application is Avaya's voice mail server solution. A 45 second sound clip can thus be taken down from 750kB to 30kB which means that they can then easily and cost effectively be downloaded directly to smartphones capable of playing WMA files.

Installation

There is no installer included so you will have to do the installation manually. First you need to download and install the Microsoft Platform SDK. The only reason you need the Platform SDK is that you need the script SmtpReg.vbs from the include directory. Once you have the script you should copy it to some directory which is in your path. After that, do the following:

• Copy the filter DLL to a suitable location on your Exchange server. It does not have to be in the same folder as Exchange itself.
• Register the filter DLL by typing 'regsvr32 MailFilter.dll' from within the same folder.
• Type 'smtpreg.vbs /add 1 OnArrival FilterSink MailFilter.Sink “rcpt to=*”'

The filter will be triggered by the first incoming email and write default settings to the registry (HKLM\Software\Bergek\MailFilter). Run the registry editor (regedit.exe) to make any changes you may want.

Note: As always, be careful when changing the registry as mistakes can, at worst, render the computer unbootable.

• DropExtensions [SZ] Semicolon-separated list of attachment entries that will make the mail be dropped
• ReencodeBitrate [DWORD] The minimum bitrate to be used to encode the sound files (only used if ReencodeWav is set)
• ReencodeCodec [SZ] The preferred codec to be used to encode the sound files (only used if ReencodeWav is set)
• ReencodeWav [DWORD] If true, reencodes WAV attachments using a voice encoder profile to save space
• Syslog [DWORD] If true, log entries will be sent to a syslog client
• SyslogAddress [SZ] The address to send syslog entries to (only used if Syslog is set)
• SyslogPort [DWORD] The port to send syslog entries to (defaults to 514 and only used if Syslog is set)
• WriteLog [DWORD] If true, writes log entries to a log file located in the same folder as the filter binary

Note that the log file is turned on by default which could grow big depending on the amount of email received by your system. To stop logging to a file, just change the value of WriteLog to zero. Also note that e-mail with at least one attachment with the extension .pif, .scr or .exe will be dropped entirely. To avoid dropping e-mail due to attachment extensions, just change the DropExtensions registry value to an empty string.

By writing 'rcpt to=*' when installing the event sink above the filter will receive all incoming SMTP mail traffic. If the filter should only be used for specific e-mail addresses they can be specified instead of the asterisk. It is also possible to use the format 'mail from=…' to filter only e-mail from a specific address. Multiple items can be separated by semi-colon.

Troubleshooting

Please verify directly after installation that your mail system is still operating as it should. Although this filter has proven very stable on my system it has not been tested on more than one system. If you do run into problems then just uninstall the filter and restart the IIS service (the first two points in the uninstallation instruction below).

Uninstallation

• Remove the filter from the list of SMTP event sinks by typing 'smtpreg.vbs /remove 1 OnArrival FilterSink'
• Restart the IIS SMTP service by running 'iisreset.exe'
• Unregister the filter DLL by running 'regsvr32 /u MailFilter.dll'
• Remove the filter DLL and the registry settings under HKLM\Software\Bergek\MailFilter

License

This application is provided as-is and free of charge as long as it is not included in any commercial offering. If you like it I would appreciate if you would link to my web site (http://www.spotwise.com).

Known issues

• The file name for the attached sound file will change after the transcoding
• Depending on the format of the e-mail received the filter may remove text encodings above 7 bit ASCII.

Attachments

• MailFilter.zip