Re: [Declude.Virus] file extensions banned by domain

[Matt]

I believe like Scott said, JunkMail wasn't designed to do this.  I'm not familiar with SpamCheck, and it may in fact have a capability. I believe that the proper way around this is to request a new feature in Declude Virus.  I am fairly confident that at some point in the future there will be a need for me to customize various Declude Virus settings per domain.  It would be very nice if Scott gave us the ability to create domain specific settings like he does with Declude JunkMail.  It would seem that outside of the scanner definitions and basic settings, one would potentially gain from being able to customize banned extensions, banned file names and vulnerabilities per domain.  Maybe this could be done with a "$default$.virus" file just like $default$.junkmail. I see this as inevitable as Declude continues to progress.  The real issue though is where the users and where Scott feels that this falls in the scope of everything that Declude does.  Right now I don't need this, but at any moment in time, a client may request unique settings for their domain, so this would be nice to see within 3 months IMO.  Maybe others like yourself have more pressing needs, and maybe others have no need at all. Like Andrew suggested in the JunkMail list, I think that a development focus on items related to management (logging, per domain virus settings, SKIPBANNAMEHAS), performance (SKIPIFUNDERWEIGHT, and SKIP functionality to ipfiles, mailfrom, and spamdomains) and completeness of function (shoring up filtering capabilities with NOT functionality before a full release) at this point are more important than adding totally new detection capabilities.  I'm not sure where Scott thinks he should go with things, but I'm sure that some feedback along these lines, or along some other path would help him determine where he should focus his efforts.  I would prefer that he leave full MIME parsing for the 2.0 release :) Matt Gene Head wrote: Matt,   Do you have any ideas how I could improve on this?   I have spamcheck too… I wonder if that would help?   Gene Head ACCRAM Inc. MCP,Net+,A+,CCNA,CCDA [EMAIL PROTECTED] [EMAIL PROTECTED] -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Matt Sent: Thursday, February 26, 2004 9:48 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] file extensions banned by domain   Gene, This will only detect base64 attachments (there are three other encoding formats that might be used), and only ones that follow strict MIME protocol in the format specified.  This is not by any means a safe way to tag all Zip attachments, especially for virus blocking, however it will catch most, especially the legitimate ones. Matt Gene Head wrote: Scott,   I came up with this filter to trigger on emails with attachments with a .zip extension. I created a file called ziptest and added it into the global.cfg file as a filter named zipper.   Ziptest.txt   # Zip test     HEADERS          0       CONTAINS       Content-Type: application/x-zip BODY             0       CONTAINS       Content-Type: application/x-zip   In the .junkmail file for the domain or the individual user in the domain I put an action to take if the email failed this test.   During my limited amount of testing it did stop the emails with a .zip file attached.   Are you aware of any file extensions that may get caught with this filter that isn't a .zip?     Gene Head ACCRAM Inc. MCP,Net+,A+,CCNA,CCDA [EMAIL PROTECTED] [EMAIL PROTECTED]   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Thursday, February 26, 2004 7:24 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] file extensions banned by domain       Would I be able to ban extensions by domain using Declude Junk Mail?       No, Declude JunkMail isn't designed to ban file extensions.                                                       -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation.   --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]   --- This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".    The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus]     --- [This E-mail scanned for viruses by Declude Virus]   --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]   --- This E-mail came from the Declude.Virus mailing list.  To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".    The archives can be found at http://www.mail-archive.com.       -- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ ===================================================== -- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================