I was just thinking, is there a way instead of having BANEXT, to allowed EXT?
We want to cut down on employees bypassing the filters by renaming an attachment Maybe if it isn't in the list it is held for review Will this stop blah.txt.exe files though if we wanted .txt's to get through Jay ----- Original Message ----- From: "Jay Calvert" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, March 26, 2004 10:58 AM Subject: Re: [Declude.Virus] BANEXT EXE > But if this is the case, how will a file be caught if somebody renames a > .zip to a .zio? > > Will declude know the difference. Would be wonderful if it did! > > Jay > ----- Original Message ----- > From: "R. Scott Perry" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Friday, March 26, 2004 10:50 AM > Subject: Re: [Declude.Virus] BANEXT EXE > > > > > > >Hi all we just had a case where an email was banned because Declude said > it > > >had an exe in the email, when it only had a TXT. > > > > > >What happened here? > > > > The problem here is that the mail client (a program whose name is as poor > > as its MIME handling: "Mail A.01.77") is giving out 2 different names for > > the file. In one location, it calls the file "EPM11002.FILES.CANJET", in > > the other location it calls it "EPM11002.TXT". While Declude Virus knows > > that a TXT file is safe, it doesn't know that a CANJET file is not > > safe. To ensure that the extension gets handled properly (as the worst > > possible file extension), it is treated as an .EXE file. > > > > -Scott > > --- > > Declude JunkMail: The advanced anti-spam solution for IMail mailservers > > since 2000. > > Declude Virus: Ultra reliable virus detection and the leader in mailserver > > vulnerability detection. > > Find out what you've been missing: Ask for a free 30-day evaluation. > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.Virus mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus". The archives can be found > > at http://www.mail-archive.com. > > --- > > [This E-mail scanned for viruses by Declude Virus] > > > > > > --- > [This E-mail scanned for viruses by Declude Virus] > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus] > > --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
