So with that done, what does the user sending the executable get? Do they get a returned email with an error, and if so, would you be so kind as to show me what message you show people. I just hate to jump in blind, if someone already has it figured out.
Chad -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Thursday, October 02, 2003 3:58 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] MS Security Patch Emails With Declude Virus. In the Virus.cfg file, for each banned extension, you have a line like so: BANEXT exe BANEXT pif And so forth. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.Virus- > [EMAIL PROTECTED] On Behalf Of Chad Killion > Sent: Thursday, October 02, 2003 1:31 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.Virus] MS Security Patch Emails > > What is the best way to exclude these in your opinion??? Can Declude do it, > or Imail? > > Chad > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff > (Lists) > Sent: Thursday, October 02, 2003 1:38 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.Virus] MS Security Patch Emails > > Chad, exe is the absolute first extension that should be banned. > > In the three years I have been doing this, I have had a handful of > complaints about this. Once I explained the reason, they agreed. > > John Tolmachoff MCSE CSSA > Engineer/Consultant > eServices For You > www.eservicesforyou.com > > > > -----Original Message----- > > From: [EMAIL PROTECTED] [mailto:Declude.Virus- > > [EMAIL PROTECTED] On Behalf Of Chad Killion > > Sent: Thursday, October 02, 2003 8:37 AM > > To: [EMAIL PROTECTED] > > Subject: RE: [Declude.Virus] MS Security Patch Emails > > > > We have never filtered EXE before, so it would just cause too many > problems > > to do this now. We have well over 25 thousand customers using this > server, > > and I hate to spring something like that on them. The others, sure, we > can > > exclude those, but just don't want to do EXE. Thanks. > > > > Chad > > > > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of Darrell LaRock > > Sent: Thursday, October 02, 2003 10:14 AM > > To: [EMAIL PROTECTED] > > Subject: RE: [Declude.Virus] MS Security Patch Emails > > > > Chad, > > > > Is there any reason why you can't filter on common virus extensions. This > > will cutdown on many viruses. It is common practice not to accept exe, > com, > > bat, pif, scr, and the list goes on... > > > > Darrell > > > > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of Chad Killion > > Sent: Thursday, October 02, 2003 11:03 AM > > To: [EMAIL PROTECTED] > > Subject: RE: [Declude.Virus] MS Security Patch Emails > > > > Well, I have upgraded to 3.14, but still see TONS of these viruses getting > > through. Please help if you can... > > > > Chad > > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of Sheldon Koehler > > Sent: Wednesday, October 01, 2003 5:38 PM > > To: [EMAIL PROTECTED] > > Subject: Re: [Declude.Virus] MS Security Patch Emails > > > > > No wonder I'm still getting slammed with systems trying to send this > virus > > > to my users. > > > > This was a big thread back in July. F-Prot was only catching the Blaster > > worm if it tried to run (Desktop Real Time). But it was not detected in > the > > scanning of email even after the definition file updates. F-Prot released > > 3.14a to fix this in the actual engine. I was blocking it by banned file > > extensions! So this was another valid reason to block certain extensions. > > > > > > Sheldon > > > > > > Sheldon Koehler, Owner/Partner http://www.tenforward.com > > Ten Forward Communications 360-457-9023 > > Nationwide access, neighborhood support! > > > > "Whenever you find yourself on the side of the majority, it's time > > to pause and reflect." Mark Twain > > > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.Virus mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus". The archives can be found > > at http://www.mail-archive.com. > > > > > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.Virus mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus". The archives can be found > > at http://www.mail-archive.com. > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.Virus mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus". The archives can be found > > at http://www.mail-archive.com. > > > > > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.Virus mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus". The archives can be found > > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
