Well, the answer lies within how those features were introduced. When the first wave of viruses came out using zip files, we blocked zip files entirely. But then we asked for a way to pass EZIP files, so Scott added that feature whereby BANEXT ZIP did not ban EZIPs, instead introducing BANEXT EZIP. Then when waves of viruses started to come out using EZIP files, the first thing we did was ban then and then asked Scott to come up with a work around. He did this by introducing BANZIPEXTs and BANEZIPEXTS which only banned a zip or EZIP if it had a file in it that was banned. But that is only for Pro version.
So if you are using Pro version, you can just use BANZIPEXTS and BANEZIPEXTS if desired, leaving "BANEXT ZIP" and "BANEXT EZIP" in the virus.cfg but commented out. That way, if there is a sudden need to do so, it can be done quickly. John T eServices For You > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > On Behalf Of Kevin Rogers > Sent: Tuesday, October 11, 2005 3:36 PM > To: Declude.Virus@declude.com > Subject: Re: [Declude.Virus] Slightly OT: Encrypting or Securing Email Content > > Ok OK already. lol > > So some people block EZIPs and some don't. If you don't block EZIPs but > do block certain file extensions within EZIPs, is it the same security > as if you blocked them outright? Or are there ways to slip bad stuff > through an EZIP even if you block most bad extensions? Or can you > really not scan EZIPs as well as other files..... > > Thanks > > > Scott Fisher wrote: > > > I block all encrypted zips based on the fact that I can't virus scan > > them. > > > > But then again I'm slightly paranoid and should not be trusted with > > sharp objects. > > > > ----- Original Message ----- From: "Kevin Rogers" <[EMAIL PROTECTED]> > > To: <Declude.Virus@declude.com> > > Sent: Tuesday, October 11, 2005 3:08 PM > > Subject: Re: [Declude.Virus] Slightly OT: Encrypting or Securing Email > > Content > > > > > >> So it's this forum's consensus that if I have PRO I should not block > >> all EZIPs - I should just block the other extensions even if they are > >> found within ZIP files? > >> > >> I do send out notices when a file gets blocked, but I don't have a > >> requeue script in place. I'll search for one and see what I can do. > >> Thanks. > >> > >> > >> > >> Darin Cox wrote: > >> > >>> If you have Declude Virus/EVA Pro you can switch to banning extensions > >>> within zips. With Standard, you may want to continue to ban > >>> encrypted zips. > >>> > >>> In either case, you will probably want to send out notices for > >>> banned files, > >>> notifying the intended recipient that a file sent to them was blocked. > >>> Include a link in the notification for them to requeue the message > >>> if it was > >>> legit and they want to receive it. Scripts to requeue messages have > >>> been > >>> posted to the list in the past, but they are very simple to create > >>> by just > >>> moving the Q and D files back to the spool directory... possibly > >>> going as > >>> far as launching the SMTP32 process to immediately send the message > >>> if you > >>> don't want your user to wait for the next queue run. > >>> > >>> Darin. > >>> > >>> > >>> ----- Original Message ----- From: "Kevin Rogers" > >>> <[EMAIL PROTECTED]> > >>> To: <Declude.Virus@declude.com> > >>> Sent: Tuesday, October 11, 2005 1:26 AM > >>> Subject: [Declude.Virus] Slightly OT: Encrypting or Securing Email > >>> Content > >>> > >>> > >>> We're looking for a simple way to opportunistically allow our users to > >>> encrypt or password-protect certain emails and/or their attachments > >>> that > >>> contain sensitive data. We're running Declude Pro and have banned EZIP > >>> extensions (the highly recommended suggestion from several people on > >>> this forum), so that kinda rules out PKZIP and any kind of ZIP program > >>> (because as soon as you password-protect a ZIP file, it becomes an EZIP > >>> file). We looked at PGP, but it seems very complex and seems to > >>> require > >>> a hardware proxy in between our mail server and the Net. Is there a > >>> simple and effective way to encrypt or password protect documents for > >>> email transmission that doesn't cause problems with Imail or Declude > >>> and > >>> doesn't require software to be installed on the recipient's end? > >>> > >>> Thanks. > >>> > >>> Kevin > >>> --- > >>> [This E-mail was scanned for viruses.] > >>> > >>> --- > >>> This E-mail came from the Declude.Virus mailing list. To > >>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >>> type "unsubscribe Declude.Virus". The archives can be found > >>> at http://www.mail-archive.com. > >>> > >>> --- > >>> This E-mail came from the Declude.Virus mailing list. To > >>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >>> type "unsubscribe Declude.Virus". The archives can be found > >>> at http://www.mail-archive.com. > >>> --- > >>> [This E-mail was scanned for viruses.] > >>> > >>> > >>> > >>> > >> --- > >> [This E-mail was scanned for viruses.] > >> > >> --- > >> This E-mail came from the Declude.Virus mailing list. To > >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >> type "unsubscribe Declude.Virus". The archives can be found > >> at http://www.mail-archive.com. > >> > > > > --- > > This E-mail came from the Declude.Virus mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus". The archives can be found > > at http://www.mail-archive.com. > > --- > > [This E-mail was scanned for viruses.] > > > > > > > --- > [This E-mail was scanned for viruses.] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
