Password protected zip files mark protected files with a plus sign at the end of the file name.
If your antivirus or attachment stripping utility can scan within zip documents, adding "exe+," pif+," etc., may help you block these while allowing non-infected password protected zip documents.
The mailing list was NTBugTraq. An web archive copy is here: http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0403&L=ntbugtraq&F=P&S=&P=70
Regards, Michael Hudson
Welch, Tom wrote:
Do encoded zip files have another extesnion other than .zip?
-----Original Message-----
From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 03, 2004 9:27 AM
To: [EMAIL PROTECTED]
Subject: Re: [IMail Forum] New virus Bagle.J can't be caught bystandard
virus scanners
Importance: Low
To be more clear, our antivirus gateway missed the email when it
arrived
since it had not been updated yet, but after the update I tested by forwarding the email to myself and it was caught.
Is this the one that says "Dear user of your_domain.com e-mail server gateway..." (or similar text)?
I've found out what is happening here.
Bagle.J is sending itself out in both encrypted .ZIP files, and in other
file types (such as .PIF files).
All mailserver virus scanners should be able to the versions in the
other files types. However, it is believe that no mailserver AV program will
be able to detect Bagle.J in encrypted .ZIP files.
As a result, we recommend that everyone (regardless of what mailserver
AV software you use) block encoded .ZIP files, at least temporarily, if
your mailserver AV software allows you to do so.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000.
Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
