RE: [Declude.Virus] JS/illWill

[John Tolmachoff \(Lists\)]

Here is what I instruct my clients and users: (SAFETY FIRST)   This policy is in place for the security and safety of our clients. If you need help or have questions or comments regarding this policy, please contact us at [EMAIL PROTECTED]   PLEASE NOTE! Due to the increase of virus activity using encrypted password protected zip files, we are forced to permanently ban them. Also, normal zip type files containing one or more banned extensions will be banned. If you need the banned zip file, you will need to follow one of the following options:   1. Compress (zip) the file using WinZip or other such program. You must then rename the resulting files extension to something else like .moc. 2. Change the extension. You could do this by right-clicking on the file, and rename. A suggestion would be to rename only the extension to something else, like .moc, then in the body of the message, instruct the recipient on what to change the extension to. 3. Reply to this message and we will review and requeue the message for delivery. (This is only available to local users. (Example, if you are sending a banned attachment to a user at mail.eservicesforyou.net, that user would have to request the review and release of the message.) NOTE: This may take a few hours to occur.   John Tolmachoff Engineer/Consultant/Owner eServices For You   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert Grosshandler Sent: Monday, August 09, 2004 11:03 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] JS/illWill   Problem is, I want to get "good" zipped exe's.   Oh well.  Until the AV programs start catching it, I've made our e-mail less useful by blocking any zips with exe's in them.   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Monday, August 09, 2004 12:50 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] JS/illWill Declude is indeed stopping it if configured correctly. That is how I am stopping them.   BANZIPEXTS   BANEXT EXE   John Tolmachoff Engineer/Consultant/Owner eServices For You   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert Grosshandler Sent: Monday, August 09, 2004 10:31 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] JS/illWill   We're seeing it too.   McAfee on desktop catching as a "trojan".  AVG and F-Prot not catching it yet. Declude not stopping, either.   newprice.zip is the attachment name.       From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Monday, August 09, 2004 11:23 AM To: [EMAIL PROTECTED] Subject: [Declude.Virus] JS/illWill I've seen several JS/IllWill messages in the past 20 minutes on our system   Looking at http://vil.nai.com/vil/content/v_99242.htm it's an old virus (2001) and I can't remember another one in the past. But now I can see them comming from all different IP-Adresses.   Mailfrom looks like real existing adresses but are definitively forged.   Markus