NOW - here is my disclaimer... I don't pretend to have the answer, but
just a solution that works in our environment here for our
circumstances... I block files...
SirCAM - sends names of files you have on your system, but it needs a
way to execute them, so it copies the file names and creates the BATCH
virus... But it has to have an easy way of executing on your system and
this is in a BAT file.
You cannot open a Word DOC and get a virus (with the exception of the
Macro Bugs)... You can open a Word Document (look alike) that is really
a batch file (i.e. "MyWordDocument.doc.bat" - and if you have extensions
turned off - it looks like "MyWordDocument.doc") The
Annakournakova.jpg.vbs virus used this method of delivery.
Here is an excerpt from McAfee site:
This is a HIGH RISK virus that is spread to email recipients found in
the Windows Address Book and addresses found in cached files. The
infected email can come from addresses that you recognize. Attached is a
file with two different extensions. The file name itself varies.
And from Symantec's Web Site:
A file from the sender's computer with the extension .bat, .com, .lnk,
or .pif added to it.
NOW - I don't know about any of you - but I don't send .lnk's .bat's,
.com's or .pif's to people.
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Mailadmin
Sent: Thursday, July 26, 2001 11:19 AM
To: [EMAIL PROTECTED]
Subject: Re: [IMail Forum] W32/SirCam@mm
Won't get them all. Sircam can hid in .doc files and a couple of other
file types. That's one one the reasons I started using Declude.
David Daniels
System Administrator
Starfish Internet Service
[EMAIL PROTECTED]
"Clicking my fingers to the bone"
----- Original Message -----
From: "Bill Teeple" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, July 26, 2001 1:25 PM
Subject: RE: [IMail Forum] W32/SirCam@mm
> I have protected my users with three rules...
>
> B~filename=".*\pvbs":NUL
> B~filename=".*\pscr":NUL
> B~filename=".*\pbat":NUL
>
> And YES it does block all .VBS files, .SCR files, and .BAT files...
> But my users are protected.
>
> Bill
>
>
>
>
>
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]] On Behalf Of Carlos Diaz
> Sent: Thursday, July 26, 2001 9:42 AM
> To: '[EMAIL PROTECTED]'
> Subject: [IMail Forum] W32/SirCam@mm
>
>
> Does anyone know how to block this shi&%?
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
