Any reason for a user to use an email scanner if they don't use any offline mail clients?

Question

I typically recommend that users enable a real-time email scanner (aka a mail shield) in order to detect a possible vector used by malware. Even if they don't use an email application, the rationale is that if their system is infected with malware, the malware might try to use email to perform an undesired function, and the real-time email scanner might catch it.

I've recently been asked by someone who only uses webmail and does not use any email applications if they should run a real-time email scanner. They use Windows 7 SP1 and use a real-time file system and web traffic scanner (I'll leave out the brand because I don't want to sound like I'm plugging products.)

I have been thinking about the correct recommendation to make, but I want to pose the question to this forum before responding to him. Is there any reason for him to have a real-time email scanner installed?

Answer 1

A 'mail scanner' is not necessary with most modern webmail providers.

Most modern webmail providers will scan your email and remove any malware. In addition if the user has a standard Antivirus installed it should catch anything else (download links, etc) when the file is downloaded and created.

You can test this by sending your user a EICAR test file:

http://www.aleph-tec.com/eicar/

They should get an email, but not the file. If they do get it test the second line of defense by downloading the attachment. Hopefully your local Antivirus catches it.