BANEXT CHM
----- Original Message ----- From: "Hermann Strassner" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, December 15, 2004 4:12 AM
Subject: [Declude.Virus] Blocked Extension getting through
Hello!
I have blocked a few extensions in Declude Virus, e.g. zip, exe, bat, scr, pif, chm and a few others. Normally that workes.
But since a few days some mails (with virus) are getting through. They have an attachment like Rechnung18745514.chm, it is displayed as Rechnung18745514.chm in Outlook or other mail clients, but in virus scan or in raw mail format its name is: ------------86BA342CB7A4 Content-Type: CHEMICAL/X-CS-CHEMDRAW; name="=?koi8-r?B?UmVjaG51bmcxODc0NTUxNC5j?= =?koi8-r?B?aG0=?=" Content-transfer-encoding: base64 Content-Disposition: attachment; filename="=?koi8-r?B?UmVjaG51bmcxODc0NTUxNC5j?= =?koi8-r?B?aG0=?="
What can i do to block this? This is a new worm yet not detected from virus scanners. This happens often. But this mails are blocked by extension filtering. Now they are getting through to the clients.
Hermann
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- This email has been scanned for possible viruses by Declude Antivirus. For more information on Declude Antivirus, Visit www.declude.com
--- This email has been scanned for possible viruses by Declude Antivirus. For more information on Declude Antivirus, Visit www.declude.com
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
