They came from the default list in Symantec Anti-Virus Gateway. It just seemed to be a rather complete list (although by default Symantec blocked *.mdb) so I adopted it. I suppose you could argue that you send out an infected DLL and get the use to drop it somewhere then something else can hook it and then you get hit. Perhaps a bit of a longer shot ....
Goran Jovanovic Omega Network Solutions > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.Virus- > [EMAIL PROTECTED] On Behalf Of John T (Lists) > Sent: Wednesday, November 23, 2005 10:32 AM > To: [email protected] > Subject: RE: [Declude.Virus] Blocking PIF Files > > Well, those are files which of them selves are not executable, rather they > are files which require something else been do to use them. > > I am not sure of the value of blocking those. > > John T > eServices For You > > > > -----Original Message----- > > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] > > On Behalf Of Goran Jovanovic > > Sent: Wednesday, November 23, 2005 7:15 AM > > To: [email protected] > > Subject: RE: [Declude.Virus] Blocking PIF Files > > > > I also ban some more > > > > BANEXT bin > > BANEXT class > > BANEXT dll > > BANEXT jsc > > BANEXT ocx > > BANEXT sys > > BANEXT vxd > > > > Goran Jovanovic > > Omega Network Solutions > > > > > -----Original Message----- > > > From: [EMAIL PROTECTED] [mailto:Declude.Virus- > > > [EMAIL PROTECTED] On Behalf Of Darin Cox > > > Sent: Wednesday, November 23, 2005 10:00 AM > > > To: [email protected] > > > Subject: Re: [Declude.Virus] Blocking PIF Files > > > > > > Here's a list compiled over the years of extensions we ban. The top > > two > > > you > > > will want to consider your userbase before banning, the rest should be > > > fine. > > > Note that we couple this with a banned file notification to the > > intended > > > recipient, which includes a link to requeue the file for delivery if > > it is > > > legitimate. > > > > > > > > > BANEXT EZIP > > > BANEXT rar > > > > > > BANEXT bas > > > BANEXT bat > > > BANEXT ceo > > > BANEXT chm > > > BANEXT cmd > > > BANEXT com > > > BANEXT cpl > > > BANEXT exe > > > BANEXT hta > > > BANEXT inf > > > BANEXT ins > > > BANEXT isp > > > BANEXT js > > > BANEXT jse > > > BANEXT lnk > > > BANEXT msi > > > BANEXT msp > > > BANEXT mst > > > BANEXT pcd > > > BANEXT pif > > > BANEXT reg > > > BANEXT scr > > > BANEXT sct > > > BANEXT shb > > > BANEXT shs > > > BANEXT vb > > > BANEXT vbe > > > BANEXT vbs > > > > > > BANEXT ws > > > BANEXT wsc > > > BANEXT wsf > > > BANEXT wsh > > > > > > > > > Darin. > > > > > > > > > ----- Original Message ----- > > > From: "Dan Geiser" <[EMAIL PROTECTED]> > > > To: <[email protected]> > > > Sent: Wednesday, November 23, 2005 9:26 AM > > > Subject: [Declude.Virus] Blocking PIF Files > > > > > > > > > Hello, All, > > > I don't know whether this would be more appropriate for the virus list > > or > > > the junkmail list so please point me towards junkmail if appropriate. > > > > > > What is the proper technique for blocking messages that have an > > attachment > > > that ends in a "pif" extension like "your_letter.pif"? > > > > > > We are currently using Declude 2.0.6 JunkMail Pro and Virus Standard. > > > > > > Thanks In Advance! > > > Dan Geiser > > > [EMAIL PROTECTED] > > > > > > ------------------------------------------------------------------- > > > E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) > > > > > > --- > > > This E-mail came from the Declude.Virus mailing list. To > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > type "unsubscribe Declude.Virus". The archives can be found > > > at http://www.mail-archive.com. > > > > > > --- > > > This E-mail came from the Declude.Virus mailing list. To > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > type "unsubscribe Declude.Virus". The archives can be found > > > at http://www.mail-archive.com. > > --- > > This E-mail came from the Declude.Virus mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus". The archives can be found > > at http://www.mail-archive.com. > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
