I don't either. Before I started using Declude I was blocking everything
that you are plus .exe . I got a little negative feedback from customers
about it but not too much. I finally decided to go to real virus scanning
because it seemed like there was something new to block and I always seemed
to get it done after the first few thousand got through. I've found out
since then that very few of my customers ever updated their virus
definitions because even though a reminder is in our welcome packet, we've
sent out emails about it and I'm sure it's in the docs for almost all virus
scanners most of them never bothered to read it. Now that they're getting
notified by Declude they're starting to pay attention. Customer feedback has
been very positive on the new virus scanning. I haven't gotten the first
complaint about it.
David Daniels
System Administrator
Starfish Internet Service
[EMAIL PROTECTED]
"Clicking my fingers to the bone"
----- Original Message -----
From: "Bill Teeple" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, July 26, 2001 3:56 PM
Subject: RE: [IMail Forum] W32/SirCam@mm
> NOW - here is my disclaimer... I don't pretend to have the answer, but
> just a solution that works in our environment here for our
> circumstances... I block files...
>
> SirCAM - sends names of files you have on your system, but it needs a
> way to execute them, so it copies the file names and creates the BATCH
> virus... But it has to have an easy way of executing on your system and
> this is in a BAT file.
>
> You cannot open a Word DOC and get a virus (with the exception of the
> Macro Bugs)... You can open a Word Document (look alike) that is really
> a batch file (i.e. "MyWordDocument.doc.bat" - and if you have extensions
> turned off - it looks like "MyWordDocument.doc") The
> Annakournakova.jpg.vbs virus used this method of delivery.
>
> Here is an excerpt from McAfee site:
>
> This is a HIGH RISK virus that is spread to email recipients found in
> the Windows Address Book and addresses found in cached files. The
> infected email can come from addresses that you recognize. Attached is a
> file with two different extensions. The file name itself varies.
>
>
> And from Symantec's Web Site:
>
> A file from the sender's computer with the extension .bat, .com, .lnk,
> or .pif added to it.
>
>
> NOW - I don't know about any of you - but I don't send .lnk's .bat's,
> .com's or .pif's to people.
>
>
>
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]] On Behalf Of Mailadmin
> Sent: Thursday, July 26, 2001 11:19 AM
> To: [EMAIL PROTECTED]
> Subject: Re: [IMail Forum] W32/SirCam@mm
>
>
> Won't get them all. Sircam can hid in .doc files and a couple of other
> file types. That's one one the reasons I started using Declude.
>
> David Daniels
> System Administrator
> Starfish Internet Service
> [EMAIL PROTECTED]
> "Clicking my fingers to the bone"
> ----- Original Message -----
> From: "Bill Teeple" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Thursday, July 26, 2001 1:25 PM
> Subject: RE: [IMail Forum] W32/SirCam@mm
>
>
> > I have protected my users with three rules...
> >
> > B~filename=".*\pvbs":NUL
> > B~filename=".*\pscr":NUL
> > B~filename=".*\pbat":NUL
> >
> > And YES it does block all .VBS files, .SCR files, and .BAT files...
> > But my users are protected.
> >
> > Bill
> >
> >
> >
> >
> >
> > -----Original Message-----
> > From: [EMAIL PROTECTED]
> > [mailto:[EMAIL PROTECTED]] On Behalf Of Carlos Diaz
> > Sent: Thursday, July 26, 2001 9:42 AM
> > To: '[EMAIL PROTECTED]'
> > Subject: [IMail Forum] W32/SirCam@mm
> >
> >
> > Does anyone know how to block this shi&%?
> >
> > Please visit http://www.ipswitch.com/support/mailing-lists.html
> > to be removed from this list.
> >
> > An Archive of this list is available at:
> > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
> >
> >
> > Please visit http://www.ipswitch.com/support/mailing-lists.html
> > to be removed from this list.
> >
> > An Archive of this list is available at:
> > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
> >
>
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
