And if you're scanning all file attachments rather than just files listed.
> -----Original Message----- > From: Don Ely [SMTP:[EMAIL PROTECTED]] > Sent: Tuesday, December 04, 2001 3:35 PM > To: Exchange Discussions > Subject: RE: New Virus outbreak > > I believe most of the scan engines (at least the good to best ones) do > this... > > D > > "It's good to shut up sometimes." -Marcel Marceau > > -----Original Message----- > From: Ryan Malayter [mailto:[EMAIL PROTECTED]] > Sent: Tuesday, December 04, 2001 12:36 PM > To: Exchange Discussions > Subject: RE: New Virus outbreak > > > I ran across a case recently where a tech support person was trying to > send > me an EXE renamed with a .txt extension. Norton for Exchange 2.12 blocked > it > as an Unauthorized file type nonetheless, so NAVMSE must be looking at the > actual file data, not just the extension, to determine if a file is an > executable. > > :::Ryan Malayter, MCSE > :::Bank Administration Institute > :::Chicago, Illinois, USA > > > -----Original Message----- > From: Don Ely [mailto:[EMAIL PROTECTED]] > Sent: Tuesday, December 04, 2001 2:25 PM > To: Exchange Discussions > Subject: RE: New Virus outbreak > > > Well, I've worked with a lot of virus companies and a lot of viruses and > haven't come across this... I always use the digits that follow the "." > and > whatever I enter to be blocked is blocked. > > D > > "The leadership instinct you are born with is the backbone. You develop > the > funny bone and the wishbone that go with it." -Elaine Agather > > -----Original Message----- > From: Murphy, Brian [mailto:[EMAIL PROTECTED]] > Sent: Tuesday, December 04, 2001 12:28 PM > To: Exchange Discussions > Subject: RE: New Virus outbreak > > > I'm not sure about this statement. I'm almost positive that a few AV > vendors about 10 months ago or so had some issues with their "filter > sets". > They subsequently release fixes. Like I said "better safe then sorry." > > > -----Original Message----- > From: Durkee, Peter [mailto:[EMAIL PROTECTED]] > Sent: Tuesday, December 04, 2001 2:13 PM > To: Exchange Discussions > Subject: RE: New Virus outbreak > > > I think the double extension are just meant to throw off humans (with some > help from Windows), not filters. > > -Peter > > > -----Original Message----- > From: Murphy, Brian [mailto:[EMAIL PROTECTED]] > Sent: Tuesday, December 04, 2001 11:59 > To: Exchange Discussions > Subject: RE: New Virus outbreak > > > I don't believe so. Seem's like there are some gotchas with this but I > prob > need to verify this with Sybari before I speak. When I notice a new > "type" > of extension I try to adopt the attitude "better safe then sorry" and add > that to my filter. I guess it would depend on how their filter works. It > seems that the "double" filter was designed to "throw" off some of the > filters out there. > > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] > Sent: Tuesday, December 04, 2001 2:01 PM > To: Exchange Discussions > Subject: RE: New Virus outbreak > > > Won't filtering *.vbs also filter *.txt.vbs? > > Bill Lambert > Endoxy Healthcare > 847-941-9206 > [EMAIL PROTECTED] > > > > -----Original Message----- > From: Murphy, Brian [mailto:[EMAIL PROTECTED]] > Sent: Tuesday, December 04, 2001 1:51 PM > To: Exchange Discussions > Subject: RE: New Virus outbreak > > > I pretty much filter everything. One of the good aspects of Antigen for > Sybari is that I can "quarantine" certain items and "approve" delivery > later > if I choose. For example, I filter all *.exe files but some *.exe files > might serve a legitimate purpose (very rarely happens..but it does). User > will notify me before or after the file is sent. If I deem the executable > worthy then I simply forward it to the recipient using the Antigen > interface. > > Even though I'm filtering just about every extension known to man I still > have to watch out for these double extensions.....(Example: *.txt.vbs,, > *.txt.exe,, *.txt.lnk). ETC. > > The next version of Antigen will allow content filtering. This helps but > can cause other problems so I will use it sparingly. > > > > -----Original Message----- > From: Murphy, Brian [mailto:[EMAIL PROTECTED]] > Sent: Tuesday, December 04, 2001 1:46 PM > To: Exchange Discussions > Subject: RE: New Virus outbreak > > > Not unless it's Java Script. > > -----Original Message----- > From: Tea, Justin [mailto:[EMAIL PROTECTED]] > Sent: Tuesday, December 04, 2001 1:25 PM > To: Exchange Discussions > Subject: RE: New Virus outbreak > > > Isn't .js created by Office product when sending document from within the > productivity suite? > > -----Original Message----- > From: Murphy, Brian [mailto:[EMAIL PROTECTED]] > Sent: Tuesday, December 04, 2001 9:10 AM > To: Exchange Discussions > Subject: RE: New Virus outbreak > > > I am. And, .vbs, .js, .htm, .html, .txt.vbs, > etc............................................. > > My users love it. > > -----Original Message----- > From: Martin Blackstone [mailto:[EMAIL PROTECTED]] > Sent: Tuesday, December 04, 2001 11:05 AM > To: Exchange Discussions > Subject: RE: New Virus outbreak > > > We are all blocking .SCR files anyway...right kids? > > -----Original Message----- > From: Hurst, Paul [mailto:[EMAIL PROTECTED]] > Sent: Tuesday, December 04, 2001 8:15 AM > To: Exchange Discussions > Subject: New Virus outbreak > > > Please note that there is a new Email virus out with an attachment > Gone.scr > > > Cheers > > Paul > > Standards are like toothbrushes, > everybody agrees you should have one, > but no one wants to use yours > > > > ********************************************************************** > The information contained in this message or any of its attachments may be > confidential and is intended for the exclusive use of the addressee(s). > Any > disclosure, reproduction, distribution or other dissemination or use of > this > communication is strictly prohibited without the express permission of the > sender. The views expressed in this email are those of the individual and > not necessarily those of Sony or Sony affiliated companies. Sony email is > for business use only. > > This email and any response may be monitored by Sony UK. > (05) > ********************************************************************** > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > ______________________________________________ > This message is private or privileged. If you are not the person for whom > this message is intended, please delete it and notify me immediately, and > please do not copy or send this message to anyone else. > > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
