Thanks Scott. Sorry for the first direct mail. Was supposed to been to the mailing list. Would it be possible to spec what double extensions you wouldn't allow?
Say BANEXT TXT.EXE BANEXT JPG.EXE BANEXT GIF.EXE Where you assume there always is a . infront of the first "extension" ? That would work for me. It would make a list but not to bad of one since I think there is about 5-6 normally used extensions .txt, .jpg, .gif, .scr, .doc, .mpg that the viruses uses and 4-5 final extensions they use .exe, .pif, .scr, .bat, .com Which mean one would have to create a list with every possible of the above combination which would result in about 30-40 BANEXT entries one would have to do but that would cover the majority of the normal used viruse worm "tricks" Alt have a "whitelist" entry for allowed double extensions. for example I would see many possibilites would be like .com.txt .net.txt where the first part is a TLD. / Eje >>Curious is there any way to disable/prevent double extensions as >>attachments ? RSP> No. RSP> Part of the problem is that lots of people now use multiple extensions, RSP> often without realizing it -- for example, RSP> "\IMail\Declude\example.com\my.name.JunkMail". That would appear to be a RSP> double extension. RSP> One possibility would be for us to have an option to block files where RSP> there is a period followed by 3 letters followed by another period, and RSP> then another 3 letters (such as ".jpg.exe"). It would still catch some RSP> legitimate mail, but not as much. RSP> -Scott RSP> --- RSP> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] Best regards, Eje Gustafsson mailto:[EMAIL PROTECTED] --- The Family Entertainment Network eFax : 240-376-7272 Phone : 620-231-7777 Fax : 620-231-4066 Online Store http://www.fament.com/catalog/ - Your Full Time Professionals - -- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
