You could get some mail monitoring software like mail essentials. The majority of my files blocking, vbs, vbe, mpg, avi etc is done by my antivirus software. Since we have departments that do send out, and receive exes, zips, and jpgs, I set mail essentials to send all incoming and outgoing files to me, and I decide on a case by case basis whether it comes and goes.
This won't help for internal mail, but I have found if I can keep the new elf bowling from coming into the system, then I really don't have to worry about it be passed around internally. Just as a mention for those of us anti-elf bowling time and resource wasting file blockers, I have just added .PPS files to those I examine. I noticed a large amount of the same file going in and out, looked at it and it was a fancy Christmas card thing that was about 1.2MB. John -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Thursday, February 21, 2002 12:11 PM To: MS-Exchange Admin Issues Subject: RE: ScanMail 3.8 for Exchange 5.5 bug Basically, yes... we have no reason to allow a free flow of EXE files back and forth. If on the rare occasion, we did need one, I'd disable the filter for that time. I can't block all ZIP files, as we do get a lot of wok related things in that are, say, a 15MB non-exe file, but I do want to cut down on the, "Hey dude, check out this cool elf bowling game! What? You can't get .exe files? Wait... I'll zip it for you...". Evan -----Original Message----- From: Allen Crawford [mailto:[EMAIL PROTECTED]] Sent: Thursday, February 21, 2002 9:38 AM To: MS-Exchange Admin Issues Subject: RE: ScanMail 3.8 for Exchange 5.5 bug I read that it couldn't do that, but I'm wondering why anyone cares to do that? If you are worried about viruses being transmitted via ZIP files, it seems that you should just block ZIP. I mean, are you just trying to prevent the users from sending ANY EXE files back and forth? Basically the only reason I'm letting ZIPs through are so people CAN actually transmit legitimate files through and a good way to force them to use some form of compression. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Wednesday, February 20, 2002 5:27 PM To: MS-Exchange Admin Issues Subject: RE: ScanMail 3.8 for Exchange 5.5 bug One thing I still kinda wish 3.8 could do is block an .EXE in a Zip. I tried it, and it lets it through. I know I could block all Zip files, but that's not quite what I was looking for. Evan -----Original Message----- From: Allen Crawford [mailto:[EMAIL PROTECTED]] Sent: Wednesday, February 20, 2002 5:21 PM To: MS-Exchange Admin Issues Subject: RE: ScanMail 3.8 for Exchange 5.5 bug By the way, if anyone else uses Martin's list and ScanMail 3.8 and has this same problem, this should save you some time. Don't forget I've added *.REG to the list. File extensions to block: eml;vb;asx;ade;adp;bas;bat;bin;chm;cmd;com;cpl;crt;dll;exe;hiv;hlp;hta;inf;i ns;isp;js;jse;jtd;msc;msi;msp;mst;ocx;oft;ovl;pcd;pif;pl;plx;scr;sct;sh;shb; shs;sys;vbe;vbs;vss;vst;vxd;wsc;wsf;wsh;lnk;reg; File names to block: *.eml;*.vb;*.asx;*.ade;*.adp;*.bas;*.bat;*.bin;*.chm;*.cmd;*.com;*.cpl;*.crt ;*.dll;*.exe;*.hiv;*.hlp;*.hta;*.inf;*.ins;*.isp;*.js;*.jse;*.jtd;*.msc;*.ms i;*.msp;*.mst;*.ocx;*.oft;*.ovl;*.pcd;*.pif;*.pl;*.plx;*.scr;*.sct;*.sh;*.sh b;*.shs;*.sys;*.vbe;*.vbs;*.vss;*.vst;*.vxd;*.wsc;*.wsf;*.wsh;*.lnk;*.reg; -----Original Message----- From: Allen Crawford Sent: Wednesday, February 20, 2002 5:14 PM To: MS-Exchange Admin Issues Subject: ScanMail 3.8 for Exchange 5.5 bug OK, since everyone has been talking about this and Antigen lately, I'll add this. I just got off the phone with Trend's tech support and apparently there is an "issue" with blocking file extensions. I noticed that SYS and VBS files were not being blocked, even though they were on my list (or Martin's list I should say, although I don't think he had REG on his list and I do have it). Anyway, the reason is because it is now performing the true file type scanning. I've already tested this and it does work. For example, I'm not blocking ZIP, so renaming a ZIP to EXE, which I am blocking, will let it through just fine because it knows it is a ZIP. So, in turn, it registers VBS, BAT, my SYS (which was really a text file renamed) as TXT files, which aren't being blocked. The fix is to list them in the file name box (the box right below the blocked extension list) as *.vbs;*.bat;*.sys, etc. Seems to work so far. So I guess to be safe, I'm going to add all of Martin's extensions to both boxes. Hope this helps someone else. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
