Scott,

> FYI,  we  have  just  found  out  that  this can cause problems with
> Declude Virus and F-Prot (which uses the 8.3 file names). This needs
> to  be  set  to 0 if using Declude Virus and F-Prot (and likely some
> other scanners, as well).

Thanks.  Interesting  caveat  (or,  "Wow,  that sucks."). Seems like a
security  hole  to me. I know that Frisk is on top of the internals of
scanning, but it seems they need to look at the externals a little bit
as  well. Scenario: I write a brand-new virus whose payload is turning
off  SFN  auto-create;  even  if  they  update their sigs to catch the
Registry entry, all of the files created in the interim will always be
invisible, even if they contain age-old viruses.

Anyway,  so  much  for  saving  on overhead. Now you've got double the
overhead--Windows creating the SFN alias, then Declude getting the SFN
to  pass  on  to the scanner. And how can we be sure that SMTP32 might
not want to actually use the LFN at some point in the future?

Live and learn,

Sandy


> There isn't a problem using the long file names with 7.06 because Declude 
> Virus will convert the file name into the 8.3 format.  If the 8.3 format is 
> no longer available (as a result of this registry change), Declude will 
> send the virus scanner the long file name.  But, if the virus scanner does 
> not recognize the long file name, it will prevent the scanner from being 
> able to scan the attachments.

>                                                     -Scott
> ---
> Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for 
> IMail.  http://www.declude.com

> ---
> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]


> Please visit http://www.ipswitch.com/support/mailing-lists.html 
> to be removed from this list.

> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/

> Please visit the Knowledge Base for answers to frequently asked
> questions:  http://www.ipswitch.com/support/IMail/


Please visit http://www.ipswitch.com/support/mailing-lists.html 
to be removed from this list.

An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/

Please visit the Knowledge Base for answers to frequently asked
questions:  http://www.ipswitch.com/support/IMail/

Reply via email to