Scott
the minimum that would be practicaly usable for us :

1- Notifications based on banned extension: ONLYSENDIFEXT, SKIPIFEXT

AND

2-BANEZIPEXT2 independant from banext, as in
BANEZIPEXT2 exe
BANEZIPEXT2 com
BANEXT scr
BANEZIPEXT ON

AND

3- ONLYSENDIFFORGING

Also, request for 2 cross-product features
1- REVDNS for %REMOTEIP% in virus
2- Test on attachement type in JM

I know your are curently overwhelmed in this bagle issue, but at least let
me know if you are willing to consider adding these features to your todo
list




----- Original Message ----- 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, March 04, 2004 11:22 PM
Subject: Re: [Declude.Virus] Bagle.J / news.com article on AV software
opening zipped files.


>
> >that is going to be a chalenge for scott to incorporate in declude :)
>
> It's unlikely that we will do this.  It makes for a great marketing
> gimmick, but won't work in the long term.  All it will take is for a virus
> to say "The password is  1 2 3 4 5" or "The password is 12344 plus 1", and
> those AV programs will quickly leave the spotlight.
>
> >We are an isp, and for us blocking zips is out of the question.
>
> Remember that all AV programs can catch viruses in standard .ZIP
> files.  It's only the encrypted .ZIP files that pose a problem, and it is
> recommended that people block all encrypted .ZIP files (but allow standard
> .ZIP files through).  That way, extremely few people are inconvenienced,
> but it would be very hard for a virus to get through.
>
>                                                     -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> since 2000.
> Declude Virus: Catches known viruses and is the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.Virus mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.Virus".    The archives can be found
> at http://www.mail-archive.com.
>


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".    The archives can be found
at http://www.mail-archive.com.

Reply via email to