I was thinking about Martins comment below from a while ago and messing around with my Trend IMSS and the following thought popped into mind
Assuming the gateway goes by rule.. and it follows the rules say from top to bottom (i.e. inorder as listed persa) IF you put in say rule 1 as allow-deliver attachment with say *.DOC...etc then the second rule 2 was Strip-disallow-block attachments of say *.* could you almost accomplish the "block everything, allow as listed"? thoughts?? thanks bill -----Original Message----- From: Martin Blackstone [mailto:[EMAIL PROTECTED] Sent: Friday, February 27, 2004 1:38 PM To: Exchange Discussions Subject: RE: Trend ScanMail I could not agree more. Block everything by default, then choose what to admit. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Parker Sent: Friday, February 27, 2004 10:35 AM To: Exchange Discussions Subject: RE: Trend ScanMail Yes. I agree that it sucks. I experienced that a few months ago. Was nice for the attachment mop up in the store but it really caused a fuss. It would be nice if it didn't do that. But I would rather see attachment "permitting" rather than blocking. So you could simply allow the attachments you want, rather than make allowances for those you don't. John Parker, MCSE IS Admin. Senior Technical Specialist Alpha Display Systems. Alpha Video 7711 Computer Ave. Edina, MN. 55435 952-896-9898 Local 800-388-0008 Watts 952-896-9899 Fax 612-804-8769 Cell 952-841-3327 Direct [EMAIL PROTECTED] "Be excellent to each other" ---End of Line--- -----Original Message----- From: Martin Blackstone [mailto:[EMAIL PROTECTED] Sent: Friday, February 27, 2004 12:20 PM To: Exchange Discussions Subject: RE: Trend ScanMail But the GUI sucks!! -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Fyodorov, Andrey FTL Sent: Friday, February 27, 2004 10:14 AM To: Exchange Discussions Subject: RE: Trend ScanMail No contest. Sybari rules. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Martin Blackstone Sent: Friday, February 27, 2004 1:10 PM To: Exchange Discussions Subject: RE: Trend ScanMail This is one feature that makes Sybari stand out. You can set extension blocking sets on different things. They have one for the automatic scan, one for scheduled, and one for manual. That way you decide how you want it. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Fyodorov, Andrey FTL Sent: Friday, February 27, 2004 9:19 AM To: Exchange Discussions Subject: RE: Trend ScanMail Or what was not a thread yesterday could be a threat today. Say a few new viruses got in yesterday before pattern files were available. Do you want to still keep them today? -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Martin Blackstone Sent: Friday, February 27, 2004 12:13 PM To: Exchange Discussions Subject: RE: Trend ScanMail It sounds ridiculous to me. Like I said, what is a threat today may not have been one yesterday. I would hate to rip every zip file out of someone's mailbox just to counter an issue that only recently popped up. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Fyodorov, Andrey FTL Sent: Friday, February 27, 2004 9:12 AM To: Exchange Discussions Subject: RE: Trend ScanMail Sounds logical to me. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bowles, John (OIG/OMP) Sent: Friday, February 27, 2004 11:55 AM To: Exchange Discussions Subject: RE: Trend ScanMail Just talked to a Trend Tech Support guy. And he said that "Yes" ScanMail will go through mailboxes and strip any attachments that reside inside of mailboxes that match your content filtering that you may have setup. __________________ John Bowles Exchange Engineer OIG/HHS [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Bowles, John (OIG/OMP) Sent: Friday, February 27, 2004 11:45 AM To: Exchange Discussions Subject: RE: Trend ScanMail See, we had users say that something went into their mailboxes and manually stripped out all the .zips. On Wednesday I implemented an attachment blocking for .zips. And they're saying that they were removed from their inbox and public folders. Here is one of the messages that was in one of the messages with the attachment removed. REMOVED_BY_THE_EXCHANGE_EMAIL_SCANNING_SERVICE_(hexfilename.txt) The original attachment (actual filename) was quarantined. The original attachement was blocked from delivery due to current attachment blocking rules. You can safely save or delete this replacement attachement. __________________ John Bowles Exchange Engineer OIG/HHS [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Martin Blackstone Sent: Friday, February 27, 2004 11:26 AM To: Exchange Discussions Subject: RE: Trend ScanMail Well, we have been blocking ZIP files for about 3 weeks and I know there are a ton of them already in peoples mailboxes. We do a scheduled scan of all mail every Sunday AM, and I have yet to see an old attachment get striped. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bowles, John (OIG/OMP) Sent: Friday, February 27, 2004 8:26 AM To: Exchange Discussions Subject: RE: Trend ScanMail So it doesn't go in and strip attachments out? After you implemented an attachment filter? Like I said...I thought it only stripped the attachments defined from incoming and outgoing messages. When you do a manual scan it only uses the pattern file to remove any potential viruses? __________________ John Bowles Exchange Engineer OIG/HHS [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Martin Blackstone Sent: Friday, February 27, 2004 11:23 AM To: Exchange Discussions Subject: RE: Trend ScanMail I have never had that happen to me. I have only seen that moving mailboxes, or doing a mailbox import. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Reasoner, Bob (PHES) Sent: Friday, February 27, 2004 7:43 AM To: Exchange Discussions Subject: RE: Trend ScanMail Yes! -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bowles, John (OIG/OMP) Sent: Friday, February 27, 2004 9:36 AM To: Exchange Discussions Subject: OT: Trend ScanMail All, I'm trying to clear something up. If we are doing attachment filtering on our ScanMail servers. If we do a manual scan. Will it go through everyone's mailbox and remove their attachments that were there previous to implementing attachment filtering? Thank you, __________________ John Bowles Exchange Engineer OIG/HHS [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with.
