Interesting...so it's Outlook's fault, eh?
Understand about text files...they would be next to impossible to determine
what the content really was without greatly increasing processing time and a
lot of effort. However, I still think it is very valuable to add detection
of the obvious types like EXE, COM, ZIP, etc. and allow banning even if
someone renamed it rather than depending on the file extension. In the case
of .js, .vbs, .bat, I would expect that the identified type would be TEXT.
Note that I'm not saying get rid of the file extension banning capabilities,
just supplement with the _real_ type detection rather than whatever
extension it happens to have.
Darin.
----- Original Message -----
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, March 18, 2004 10:17 AM
Subject: Re: [Declude.Virus] Banned extension tripped by Microsoft Outlook,
Build 10.0.3416
>I understand the subsequent discussion in the declude.com example produces
>an attached file, but the original example from Matt was a .gif file, with
>additional querystring parameters that specified WT.js=No. What should
have
>been checked was the ".gif" extension.
Actually, the web page URL was for a .gif file -- but Outlook reported it
as just "nojavascript&WT.js=No", so Declude Virus can't see the .GIF file.
>As far as the other issue regarding the declude.com example, I'll suggest
>again that the ability to check actual file type, rather than extension, be
>added.
We do already have some support for that in Declude Virus Pro. But, the
problem is that it often isn't possible to tell what the file type is
without the extension. In this case, it would be very difficult to
distinguish a .js file from a .txt file, for example.
There is another problem, too -- if you have a file that Declude Virus
identifies as a .GIF file, but it has an .EXE extension, do you really want
it?
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
_____________________________________
[This E-mail virus scanned by 4C Web]
_____________________________________
[This E-mail virus scanned by 4C Web]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
