I have told my users that they should zip everything up. But obviously no one listens. Therefore they need to transfer word, excel docs so I did not block it (actually I removed them after hearing complaints enough times). Additionally we send out notifications to the recipient with a link that enables them to download the suspect email at their own risk. So blocking is not the end all here. The outbound mail was the issue with xls and doc.
DC -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Olden Sent: Wednesday, April 28, 2004 1:47 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] .CPL file blocked Douglas, Can I ask why you block MS Access files (MDB) and not other Office products that can contain macros? John Olden - Systems Administrator Champaign Park District ----- Original Message ----- From: "Douglas Cohn" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, April 27, 2004 3:34 PM Subject: RE: [Declude.Virus] .CPL file blocked > This is the most recent list I was given. (from this list). It has a few more than Johns. > > BANEXT ad > BANEXT adp > BANEXT asp > BANEXT bas > BANEXT bat > BANEXT CEO > BANEXT chm > BANEXT cmd > BANEXT com > BANEXT cpl > BANEXT crt > BANEXT exe > BANEXT hlp > BANEXT hta > BANEXT inf > BANEXT ins > BANEXT isp > BANEXT js > BANEXT jse > BANEXT lnk > BANEXT mdb > BANEXT mde > BANEXT msc > BANEXT msi > BANEXT msp > BANEXT mst > BANEXT pcd > BANEXT pif > BANEXT reg > BANEXT scr > BANEXT sct > BANEXT shb > BANEXT shs > BANEXT url > BANEXT vb > BANEXT vbe > BANEXT vbs > BANEXT vsd > BANEXT vss > BANEXT vst > BANEXT vsw > BANEXT ws > BANEXT wsc > BANEXT wsf > BANEXT wsh > > > BANEXT EZIP > > > ---------- Original Message ---------------------------------- > From: "John Tolmachoff \(Lists\)" <[EMAIL PROTECTED]> > Reply-To: [EMAIL PROTECTED] > Date: Tue, 27 Apr 2004 11:12:07 -0700 > > >Here is my published policy, just revised yesterday: > > > > > > > >http://www.eservicesforyou.com/documents/emailattachments.pdf > > > > > > > >John Tolmachoff > > > >Engineer/Consultant/Owner > > > >eServices For You > > > > > > > >-----Original Message----- > >From: [EMAIL PROTECTED] > >[mailto:[EMAIL PROTECTED] On Behalf Of Bill > >Sent: Tuesday, April 27, 2004 9:19 AM > >To: [EMAIL PROTECTED] > >Subject: RE: [Declude.Virus] .CPL file blocked > > > > > > > >Is this the list that everyone else is using? > > > > > > > >BANEXT BAS > >BANEXT BAT > >BANEXT CMD > >BANEXT COM > >BANEXT CPL > >BANEXT HTA > >BANEXT EXE > >BANEXT MSI > >BANEXT MSP > >BANEXT MST > >BANEXT PIF > >BANEXT REG > >BANEXT SCR > >BANEXT SCT > >BANEXT VB > >BANEXT VBE > >BANEXT VBS > >BANEXT WSC > >BANEXT WSF > >BANEXT WSH > >BANEXT EZIP > > > > > > > >BANZIPEXTS ON > >BANEZIPEXTS ON > > > >-----Original Message----- > >From: [EMAIL PROTECTED] > >[mailto:[EMAIL PROTECTED] On Behalf Of Greg Little > >Sent: Tuesday, April 27, 2004 9:17 AM > >To: [EMAIL PROTECTED] > >Subject: Re: [Declude.Virus] .CPL file blocked > > > >Reminder > >If your not yet blocking CPL, your over due. > >(Also HTA, VBS, exe, scr and com) > > > >Greg > > > >>From http://vil.nai.com/vil/content/v_122415.htm > > > > > > > >Attachment: May be one of the follwing: > > > >* Script dropper - using one of the following file extensions: > > > >* HTA > >* VBS > > > >* Password-protected ZIP archive (detected as W32/Bagle.gen!pwdzip) > >* Executable, using one of the following file extensions: > > > >* exe > >* scr > >* com > >* cpl > > > >* Executable dropper, CPL file with .CPL file extension. > > > >The executable uses the following icon: > > > > > > > >The CPL file uses the following icon: > > > > > > > > > >Don Hickey wrote: > > > > > > > >Here ya go - New Description > > > >http://us.mcafee.com/virusInfo/default.asp?id=description > ><http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=1224 15> > >&virus_k=122415 > > > >Don > > > > > > > > > > > > > > > > > > > > > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
