Geez. Just block all attachments, then. I don't know about Trend, but Sybari looks inside the file for its type screening rather than depending on filename extensions.
Ed Crowley MCSE+I MVP Tech Consultant Compaq Computer "There are seldom good technological solutions to behavioral problems." -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Whitlock, Teresa Sent: Friday, January 25, 2002 1:48 PM To: Exchange Discussions Subject: RE: Fix from Trend for Exchange 2000 Attachment blocking Forgive me if this has already been covered as I just started with this list today, but does this fix work for files that are sent with double extensions, such as; *.txt.scr? -----Original Message----- From: Soysal, Serdar [mailto:[EMAIL PROTECTED]] Sent: Friday, January 25, 2002 1:51 PM To: Exchange Discussions Subject: RE: Fix from Trend for Exchange 2000 Attachment blocking It did work for .bat files for me. I just tested it and here's the alert received from ScanMail: -----Original Message----- From: System Attendant Sent: Friday, January 25, 2002 4:50 PM To: Soysal, Serdar Subject: ScanMail Message: To Sender virus found or matched file blocking setting. ScanMail for Microsoft Exchange has taken action on the message, please refer to the contents of this message for further details. Sender = Soysal, Serdar Recipient(s) = MPOP_EX06; Subject = asdfasdfsa Scanning Time = 01/25/2002 16:49:39 Engine/Pattern = 5.630-1025/207 Action on message: The attachment hoba.bat matched file blocking settings. ScanMail has taken the Moved action. The attachment was moved to C:\Programs\Trend\Smex\Alert\hoba3c51d2f32.bat_. Warning to sender. ScanMail has detected a virus in an email you sent. -----Original Message----- From: Hooks, Tim [mailto:[EMAIL PROTECTED]] Sent: Friday, January 25, 2002 4:43 PM To: Exchange Discussions Subject: RE: Fix from Trend for Exchange 2000 Attachment blocking Let me know if that blocks .bat files too. It is not for me and I have that set up you suggest. tjh -----Original Message----- From: Soysal, Serdar [mailto:[EMAIL PROTECTED]] Sent: Friday, January 25, 2002 4:40 PM To: Exchange Discussions Subject: RE: Fix from Trend for Exchange 2000 Attachment blocking Just to be clear, you need to include both the attachment extensions and names. The attachment blocking settings should look like: [ ] All attachments [x] Specified attachments Attachments with specified extensions: ade;adp;bas;..... Attachments with specified names: *.ade;*.adp;*.bas;..... S. -----Original Message----- From: Mood, Steve [mailto:[EMAIL PROTECTED]] Sent: Friday, January 25, 2002 4:36 PM To: Exchange Discussions Subject: RE: Fix from Trend for Exchange 2000 Attachment blocking On Exch 5.5 with Scanmail 3.8 and Scan engine 5.630-1025. *. is in place and it is not blocking batch or vbs files. -----Original Message----- From: Soysal, Serdar [mailto:[EMAIL PROTECTED]] Sent: Friday, January 25, 2002 4:32 PM To: Exchange Discussions Subject: RE: Fix from Trend for Exchange 2000 Attachment blocking Well, it worked for me. I put a *. In front of every attachment type I had and boom it started blocking. You are using the same scan engine right? S. -----Original Message----- From: Mood, Steve [mailto:[EMAIL PROTECTED]] Sent: Friday, January 25, 2002 4:25 PM To: Exchange Discussions Subject: RE: Fix from Trend for Exchange 2000 Attachment blocking Suggested change does not seem to be working for Version 3.8 or 3.7. Am I missing something, another check box maybe? (on the phone to Trend now BTW) -----Original Message----- From: Soysal, Serdar [mailto:[EMAIL PROTECTED]] Sent: Friday, January 25, 2002 3:23 PM To: Exchange Discussions Subject: RE: Fix from Trend for Exchange 2000 Attachment blocking Damn! Same on Exchange 5.5 version as well. Version 3.8, pattern 207. I was able to create vbs files in notepad and happily pass them along. Good catch Tim. I'll go ahead and implement the change here as well. S. -----Original Message----- From: Hooks, Tim [mailto:[EMAIL PROTECTED]] Sent: Friday, January 25, 2002 3:07 PM To: Exchange Discussions Subject: Fix from Trend for Exchange 2000 Attachment blocking Just got off the phone with Trend. I noticed .bat files were not being blocked even though they were on my list of attachments to block by file extension. Trend indicates that blocking by file extension interprets by "true file type," meaning a .bat is a .txt file! The fix is to put in the "Attachments with specified file names:" entries like *.bat, *.scr, *.vbs, etc. I added almost my entire list minus a few like gif, jpg, mov, etc that being blocked correctly now. Exchange 2000 SP2 on Windows 2000 SP2 Scan engine version is: 5.630-1025 Pattern is 207 All Product version are: 6.00 Here are my entries: Attachments with specified extensions: bat;gif;jpg;jpeg;386;acm;asp;avb;bin;cla;class;cnv;com;cs;dll;drv;gms;hlp;ht a;htt;inf;ini;lnk;mpd;ocx;sys;tlb;tsp;vxd;wbt;wiz;exe;vbs;avi;mov;mp3;mpg;mp eg;wsh;js;reg;ins;wsf;vbe;jse;pif;wsc;sct;hta;shs;scr;cmd;mht*;ov*; Attachments with specified file names: *.bat;*.386;*.acm;*.asp;*.avb;*.bin;*.cla;*.class;*.cnv;*.com;*.cs;*.dll;*.d rv;*.gms;*.hlp;*.hta;*.htt;*.inf;*.ini;*.lnk;*.mpd;*.ocx;*.sys;*.tlb;*.tsp;* .vxd;*.wbt;*.wiz;*.vbs;*.wsh;*.js;*.reg;*.ins;*.wsf;*.vbe;*.jse;*.pif;*.wsc; *.sct;*.hta;*.shs;*.scr;*.cmd;*.mht*;*.ov*; Timothy J. Hooks, MCSE KBHR Columbus, Ohio _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
