Wouldn't the double extension just get blocked by the exe rule?
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Thursday, December 05, 2002 9:33 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] New Virus: Holar
>At one point you talked about detection of double file extensions. Was
>that ever implemented?
It's a good idea, but tough to implement properly. The problem is with
filenames such as "www.yahoo.com.url", and "spreadsheet.2002.nov.xls".
So
adding such detection would get a bit complicated. Setting it up to
only
catch certain double extensions -- such as "*.*.exe" might be a good
idea,
though.
-Scott
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list. To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This e-mail has been scanned for viruses by the anti-virus systems of
CyberShift, Inc.
The information contained in or attached to this message is intended
solely for the personal and confidential use of the designated
recipients named in the body of the e-mail or within the attached
documents.
This message may be legally privileged, and as such is confidential. If
the
reader of this message is not the intended recipient or any agent
responsible
for delivering it to the intended recipient, you are hereby notified
that you
have received this document in error, and that any review,
dissemination, distribution or copying of this message is strictly
prohibited.
Thank You, The CyberShift NOC
---
This e-mail has been scanned for viruses by the anti-virus systems of CyberShift, Inc.
The information contained in or attached to this message is intended
solely for the personal and confidential use of the designated
recipients named in the body of the e-mail or within the attached documents.
This message may be legally privileged, and as such is confidential. If the
reader of this message is not the intended recipient or any agent responsible
for delivering it to the intended recipient, you are hereby notified that you
have received this document in error, and that any review, dissemination,
distribution or copying of this message is strictly prohibited.
Thank You, The CyberShift NOC
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
