-Scott I'm in favor you competing the programming around the BANEXT EZIP line to include all files within the .zip file. I know I would like to from this point forward block encrypted zip files until there is a business reason for my company not to. If my virus scanners cannot scan the encrypted files for viruses this remains a risk.
Scott Fisher Director of IT Farm Progress Companies >>> [EMAIL PROTECTED] 03/03/04 08:08AM >>> FYI, there is a new virus that came out yesterday, Bagle.J. It spreads in an encrypted .ZIP File. While an AV program can detect a normal virus in an encrypted .ZIP file (by the name, file length, or CRC (the "fingerprint" of the file)), Bagle.J uses random file names, random file sizes, and random CRCs. So it is unlikely that AV programs will be able to detect it. As a result, we are recommending that users of Declude Virus ban all .ZIP files that contain encrypted files. To do this, you need to be running the latest interim release, and add a line "BANEXT EZIP" to your virus.cfg file (it can go anywhere in the file). To get the latest interim release, you must be covered by a Service Agreement; you can download it from http://www.declude.com/interim . -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ --- [This E-mail scanned for viruses by Farm Progress Companies using Declude Virus] --- [This E-mail scanned for viruses by Farm Progress Companies using Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
