William,
While I totally agree that blocking all zips "is like throwing out
the baby with the bathwater." I also have to think about what would happen
(to my rear) if an infection were to occur. I currently have a rule in
place that sends all zips to me and I forward them on from there.
In the company that I work for, .rar is Greek to 99.98% of the people (My
counter-part and I are the .02%).
I would SPECULATE/GUESS (and I stress that) that the reason behind not
scanning inside .rars would be because of licensing. Of course, there is
always the conspiracy theory that AV companies create the viruses themselves
and/or force you into upgrading for the latest protection/features.
You mentioned Imail's attachment blocking, are you referring to the
attachment blocking that you configure in the "AV Premium" or the rules?
Todd Bierbaum - MCP
BankTrust - IT Department
Office: 850-835-3335 ext 106
Cell: 850-598-3993
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of William Van Hefner
Sent: Monday, March 07, 2005 8:41 AM
To: [email protected]
Subject: RE: [IMail Forum] RAR Virus
Todd,
The thing that kind of bugs me about this is that I don't see why antivirus
scanners can't scan inside a .rar file just as easily as they can scan
inside a .zip file? The .rar compression program is far superior to .zip in
most respects, and is gaining increasing popularity. I already block
encrypted or password protected .zip files, but not all .zips. There is just
too much usefulness in allowing users to send using file compression, and I
think that doing away with all .zip or all .rar attachments is like throwing
out the baby with the bathwater. There should be a less drastic solution
available.
Also, lets face it, Imail's attachment blocking ability is hit and miss, at
best. Even Ipswitch will admit that it is not foolproof. I have to use a
separate program to block the encrypted .zips. Strangely, I have seen nary a
word published by the antivirus companies concerning this threat. These .rar
viruses fly right through every single antivirus product I have tried,
including Norton.
William Van Hefner
Network Administrator
Vantek Communications, Inc.
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Todd
> Bierbaum
> Sent: Monday, March 07, 2005 6:14 AM
> To: [email protected]
> Subject: RE: [IMail Forum] RAR Virus
>
>
> I've been blocking RAR files since I read this article:
>
> http://it.slashdot.org/article.pl?sid=05/02/21/1944230&tid=172
> &tid=201&tid=2
> 18
>
> I'm using my Norton AV to block the RAR files but it could be
> accomplished with a rule as well.
>
> Here is the KB article for those that are running Imail's AV:
>
> http://support.ipswitch.com/kb/IM-20041105-DM01.htm
>
>
>
> Todd Bierbaum - MCP
> BankTrust - IT Department
> Office: 850-835-3335 ext 106
> Cell: 850-598-3993
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of William Van
> Hefner
> Sent: Friday, March 04, 2005 2:48 PM
> To: [email protected]
> Subject: [IMail Forum] RAR Virus
>
> All,
>
> I was just wondering if anyone out there has noticed a bunch of these
> .rar viruses today? I've seen users get a couple of these this
> morning. They are not detected by the mail server, which uses MxGuard
> to scan with F-Prot and CLAM AV, and Norton didn't detect it when my
> mail client downloaded it to the desktop, either. They are pretty
> obviously viruses with .rar attachments and a blank body though.
> Anyone have a clue why this virus is not being stopped, or any clue as
> to how to stop it, other than blocking all .rar files (not easy to do
> with Imail). Thanks.
>
> William Van Hefner
> Network Administrator
> Vantek Communications, Inc.
>
>
>
> To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
> List Archive:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
> Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
>
>
> To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
> List Archive:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
> Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
>
>
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
