I checked a few out and figured they weren't dangerous and told everyone that they were corrupted or "stripped" attachments... but the support calls and e-mails about the passworded zip files that everyone got, what a waste of time, sigh. I did a Baname on what was listed as possible file names for the latest virus. I'm just dreading the next one that I can't Ban all of the possible names....
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, July 21, 2004 1:50 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] OT: "Animal" Messages with Viruses? >I am running 1.79 (I don't remember which interim but >I wil D/l the latest) >I have in my global config: > >BANEXT EZIP >BANEZIPEXTS ON OK, that will ban encrypted .ZIP files, and .ZIP files that have files within them with banned file extensions. >I am still getting some e-mails through. They are zip files 67bytes or so >and don't seem to have anything in them nor are they password protected. Any >way to stop them other than using banname on the following: The problem is that these aren't viruses. At 67 bytes, they don't contain any actual data. Most likely, some bogus mailserver AV program detected the viruses that were in them, removed the viruses, but left the "shell" .ZIP file with nothing in it. Unfortunately, it isn't easy to block such E-mails (but fortunately, they are not at all dangerous). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
