I was just putting the relevant lines in (or what I thought was relevant). I am blocking many extensions. I am trying to make sure this file isn't getting through. It is my belief (hope) that the files getting through are non-viable because:
07/26/2004 15:49:04 Q602e069800d0e086 File(s) are INFECTED [ W32/[EMAIL PROTECTED]: 3] 07/26/2004 15:49:04 Q602e069800d0e086 Deleting file with virus 07/26/2004 15:49:04 Q602e069800d0e086 Deleting E-mail with virus! Mydoom.O has been getting caught. I just want to stop the damn files from getting through to my users so a virus can't slip through and so they don't panic and call and e-mail/call me to death. I am also concerned that I can't seem to ban this file from getting through by any means. Anything to stop double file extensions? I'd like to get this stopped ASAP -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Monday, July 26, 2004 3:50 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Blocking the files in MyDoom You are way behind the times if all you block are com files. What about exe, bat, cmd and a list of others? Also, I have temporarily blocked all zip files, as I am seeing quite a few that are not being caught by banned extension or F-Prot or AVG. I am investigating these. John Tolmachoff Engineer/Consultant/Owner eServices For You > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > On Behalf Of marc catuogno > Sent: Monday, July 26, 2004 12:39 PM > To: [EMAIL PROTECTED] > Subject: [Declude.Virus] Blocking the files in mydoom > > I am running Declude 1.79 and this is in my CFG file: > > BANEZIPEXTS ON > BANEXT com > > In desperation I have added: > > BANNAME prudentialrand.com > BANNAME prudentialrand.com.zip > BANNAME prudentialrand.zip > BANNAME [EMAIL PROTECTED] > BANNAME *prudentialrand.com.zip > > The files are still getting through to my users. Any suggestions? An Imail > rule maybe? > > > --- > [This E-mail scanned for viruses by Declude Virus] > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
