RE: [Declude.Virus] .vbs 1 byte files

[Rick Hogue]

Here is the list of banned attachments by their file extension: .bat Batch program file .ceo Extension associated with Winevar Worm .cmd Microsoft Windows NT Command script (MS DOS Prompt) .com Microsoft MS-DOS program .cpl Control Panel extension .exe Executable Program .hta Hypertext Application .js _javascript_ file .jse Jscript Encoded Script file .lnk Shortcut .msi Microsoft Windows Installer package .msp Microsoft Windows Installer patch .pcd Photo CD image, Microsoft Visual compiled script .pif Shortcut to MS-DOS program .reg Registration entries .scr Screen saver .sct Windows Script Component .shb Shell Scrap object .shs Shell Scrap object .vb VBScript file .vbe VBScript Encoded script file .vbs VBScript file .wsc Windows Script Component .wsf Windows Script file .wsh Windows Script Host Settings file .zip Encrypted only   Rick Hogue www.intent.net Web Hosting 1-800-866-2983 www.prosperity.com Featured web site       From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Thursday, May 27, 2004 11:20 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] .vbs 1 byte files I've been seeing these for almost a week I believe.  They appear to be damaged versions of know viruses, delivered with MIME headers but no code. If you search the archives, you should be able to find lots of discussions about banned extensions. Matt Jim Matuska (by way of R. Scott Perry ) wrote: I have been seeing a few 1 byte .vbs files being delivered to user accounts, some of them are forged too.  None are being picked up by declude w/Fprot.  I have banned .vbs files now, has anyone seen these coming in and if so are they dangerous or just corrupted?  Also what are the current recommended file extension to ban. Jim Matuska Jr. Computer Tech II CCNA Nez Perce Tribe Information Systems <mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".    The archives can be found at http://www.mail-archive.com. -- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================