JT> Declude, this is a feature who's time has come. Hear, hear! The ability to ban filenames that are contained in archives would be a good feature, and most of the code must be in place, because Declude Virus already pulls apart at least the zip file format for selective file scanning.
It is also well placed in the market. I checked my up-to-the-minute ScanMail for Exchange from Trend Micro, and they don't have that feature. I also tested it to see whether filename blocking would work anyway, and no, it didn't. Andrew 8) > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of John T (Lists) > Sent: Tuesday, June 27, 2006 3:38 PM > To: declude.virus@declude.com > Subject: RE: [Declude.Virus] New Virus: zipped word doc with > Macro-Virus > Importance: High > > I know. :( > > Declude, this is a feature who's time has come. > > John T > eServices For You > > "Seek, and ye shall find!" > > > > -----Original Message----- > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > > Markus Gufler > > Sent: Tuesday, June 27, 2006 3:10 PM > > To: declude.virus@declude.com > > Subject: RE: [Declude.Virus] New Virus: zipped word doc with > > Macro-Virus > > > > As I know yes but > > > > BANNAME my_notebook.doc > > > > wouldn't work for files within zip-archives. > > > > Markus > > > > > -----Original Message----- > > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of > > > John T (Lists) > > > Sent: Tuesday, June 27, 2006 11:48 PM > > > To: declude.virus@declude.com > > > Subject: RE: [Declude.Virus] New Virus: zipped word doc with > > > Macro-Virus > > > > > > Is the word document only named that? > > > > > > John T > > > eServices For You > > > > > > "Seek, and ye shall find!" > > > > > > > -----Original Message----- > > > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > On Behalf > > > > Of Markus Gufler > > > > Sent: Tuesday, June 27, 2006 11:32 AM > > > > To: declude.virus@declude.com > > > > Subject: [Declude.Virus] New Virus: zipped word doc with > > > > Macro-Virus > > > > > > > > Some of us has noted in the past two hours that > messages with an > > > > zip-file > > > as > > > > attachment has passed our virus filters > > > > > > > > It's a zip-file containing a MS Word Document named > > > "my_notebook.doc" > > > > > > > > Most Virus-Scanners can't catch it. Virustotal has returned > > > only two > > > > scanners with positive results > > > > > > > > Sophos has found "WM97/Kukudro-A" > > > > UNA has found a "Macro Virus" > > > > > > > > No other AV-Engine has catched the suspicious file. > > > > > > > > We've added the following lines to our virus.cfg in order > > > to block as > > > > much was we can at the moment. > > > > > > > > BANNAME prices.zip > > > > BANNAME apple_prices.zip > > > > BANNAME sony_prices.zip > > > > BANNAME hp_prices.zip > > > > BANNAME dell_prices.zip > > > > BANNAME My_Notebook.doc > > > > > > > > Regards > > > > Markus > > > > > > > > > > > > > > > > --- > > > > This E-mail came from the Declude.Virus mailing list. To > > > unsubscribe, > > > > just send an E-mail to [EMAIL PROTECTED], and > > > > type "unsubscribe Declude.Virus". The archives can be found > > > > at http://www.mail-archive.com. > > > > > > > > > > > > > > > --- > > > This E-mail came from the Declude.Virus mailing list. To > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > type "unsubscribe Declude.Virus". The archives can be found > > > at http://www.mail-archive.com. > > > > > > > > > > > > > > --- > > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, > > just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus". The archives can be found > > at http://www.mail-archive.com. > > > > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
