Re: [Declude.Virus] banext issue
ok scott, I'll get the latest thanks for looking into it. Insidently, I see that all the time with mac files... spaces at the end pain in the _ss On Friday, August 9, 2002 11:18 AM, R. Scott Perry <[EMAIL PROTECTED]> wrote: > >>so, I looked at the message in the virus folder and there were 4 >>attachments to the message, none of them had extensions. (all >mac files) > >Actually, it turns out that this isn't related to the BinHex files -- the >problem has to do with the attachments not having extensions (and having >spaces in them). If you upgrade to the latest beta, it will take care of >the problem. > -Scott > >--- >[This E-mail was scanned for viruses by Declude Virus >(http://www.declude.com)] > >--- >This E-mail came from the Declude.Virus mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.Virus".The archives can be found >at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] banext issue
>so, I looked at the message in the virus folder and there were 4 >attachments to the message, none of them had extensions. (all mac files) Actually, it turns out that this isn't related to the BinHex files -- the problem has to do with the attachments not having extensions (and having spaces in them). If you upgrade to the latest beta, it will take care of the problem. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] banext issue
done. On Friday, August 9, 2002 10:37 AM, R. Scott Perry <[EMAIL PROTECTED]> wrote: > >>I did not catch that you wanted the message How do I go about taking >>something from the virus folder, change the recipient to [EMAIL PROTECTED]? >> >>just copy and change the sender in both files? > >Probably the easiest thing to do would be to send the .SMD file (from the >virus folder) as an attachment. I'll still get the original E-mail that >way, and can still test it. >-Scott > >--- >[This E-mail was scanned for viruses by Declude Virus >(http://www.declude.com)] > >--- >This E-mail came from the Declude.Virus mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.Virus".The archives can be found >at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] banext issue
>I did not catch that you wanted the message How do I go about taking >something from the virus folder, change the recipient to [EMAIL PROTECTED]? > >just copy and change the sender in both files? Probably the easiest thing to do would be to send the .SMD file (from the virus folder) as an attachment. I'll still get the original E-mail that way, and can still test it. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] banext issue
I did not catch that you wanted the message How do I go about taking something from the virus folder, change the recipient to [EMAIL PROTECTED]? just copy and change the sender in both files? On Friday, August 9, 2002 9:54 AM, John Tolmachoff <[EMAIL PROTECTED]> wrote: >Scott, please post, (although I know you will) what your findings are as >we also have clients with MAC users. > >John Tolmachoff >IT Manager, Network Engineer >RelianceSoft, Inc. >Fullerton, CA 92835 >www.reliancesoft.com > > >-Original Message- >From: [EMAIL PROTECTED] >[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry >Sent: Friday, August 09, 2002 8:18 AM >To: [EMAIL PROTECTED] >Subject: Re: [Declude.Virus] banext issue > >Those headers won't affect whether or not Declude bans the files -- the >*real* filename is one you won't see, becaues it is encoded. > >You can send a copy of the E-mail file to [EMAIL PROTECTED] , and I >can >test it here to see what the real extensions are. >-Scott > >At 11:11 AM 8/9/2002, you wrote: > >> >The catch here is that BinHex (Mac encoding) files have the filename >within >> >the encoded segment. So you can have a situation where the MIME >filename >> >is "safefile.txt", but the BinHex segment says the filename is >> >"evilvirus.exe" (which you won't see, because it is encoded). >> > -Scott >> > >>Here are the attachment headers from the message. I just want to make >sure. >> >>--WBE1028896920052e2aec2af3c9e93cad6a0ff23d4e75 >>Content-Type: application/x-macbinary; name="HOPE COVER" >>Content-Transfer-Encoding: base64 >>Content-Disposition: attachment; filename="HOPE COVER" >> >>--WBE1028896920052e2aec2af3c9e93cad6a0ff23d4e75 >>Content-Type: application/x-macbinary; name="GFSD Handout" >>Content-Transfer-Encoding: base64 >>Content-Disposition: attachment; filename="GFSD Handout" >> >>--WBE1028896920052e2aec2af3c9e93cad6a0ff23d4e75 >>Content-Type: application/x-macbinary; name="middle school scenario" >>Content-Transfer-Encoding: base64 >>Content-Disposition: attachment; filename="middle school scenario" >> >>--WBE1028896920052e2aec2af3c9e93cad6a0ff23d4e75 >>Content-Type: application/x-macbinary; name="One Solution Syndrome" >>Content-Transfer-Encoding: base64 >>Content-Disposition: attachment; filename="One Solution Syndrome" >> >> >>--- >>[This E-mail was scanned for viruses by Declude Virus >>(http://www.declude.com)] >> >>--- >>This E-mail came from the Declude.Virus mailing list. To >>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>type "unsubscribe Declude.Virus".The archives can be found >>at http://www.mail-archive.com. > >--- >[This E-mail was scanned for viruses by Declude Virus >(http://www.declude.com)] > >--- >This E-mail came from the Declude.Virus mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.Virus".The archives can be found >at http://www.mail-archive.com. > >--- >[This E-mail was scanned for viruses by Declude Virus >(http://www.declude.com)] > >--- >This E-mail came from the Declude.Virus mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.Virus".The archives can be found >at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] banext issue
Scott, please post, (although I know you will) what your findings are as we also have clients with MAC users. John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Friday, August 09, 2002 8:18 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] banext issue Those headers won't affect whether or not Declude bans the files -- the *real* filename is one you won't see, becaues it is encoded. You can send a copy of the E-mail file to [EMAIL PROTECTED] , and I can test it here to see what the real extensions are. -Scott At 11:11 AM 8/9/2002, you wrote: > >The catch here is that BinHex (Mac encoding) files have the filename within > >the encoded segment. So you can have a situation where the MIME filename > >is "safefile.txt", but the BinHex segment says the filename is > >"evilvirus.exe" (which you won't see, because it is encoded). > > -Scott > > >Here are the attachment headers from the message. I just want to make sure. > >--WBE1028896920052e2aec2af3c9e93cad6a0ff23d4e75 >Content-Type: application/x-macbinary; name="HOPE COVER" >Content-Transfer-Encoding: base64 >Content-Disposition: attachment; filename="HOPE COVER" > >--WBE1028896920052e2aec2af3c9e93cad6a0ff23d4e75 >Content-Type: application/x-macbinary; name="GFSD Handout" >Content-Transfer-Encoding: base64 >Content-Disposition: attachment; filename="GFSD Handout" > >--WBE1028896920052e2aec2af3c9e93cad6a0ff23d4e75 >Content-Type: application/x-macbinary; name="middle school scenario" >Content-Transfer-Encoding: base64 >Content-Disposition: attachment; filename="middle school scenario" > >--WBE1028896920052e2aec2af3c9e93cad6a0ff23d4e75 >Content-Type: application/x-macbinary; name="One Solution Syndrome" >Content-Transfer-Encoding: base64 >Content-Disposition: attachment; filename="One Solution Syndrome" > > >--- >[This E-mail was scanned for viruses by Declude Virus >(http://www.declude.com)] > >--- >This E-mail came from the Declude.Virus mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.Virus".The archives can be found >at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] banext issue
>ok, so next question... if declude caught the attachment why did it not >list with the %BANEXT% variable? That variable was blank. How would I >determine what file extension was caught. I'm just trying to understand... Once I see the file, I should be able to find out what happened. It may be something like a corrupt name field in the BinHex encoding. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] banext issue
ok, so next question... if declude caught the attachment why did it not list with the %BANEXT% variable? That variable was blank. How would I determine what file extension was caught. I'm just trying to understand... On Friday, August 9, 2002 9:17 AM, R. Scott Perry <[EMAIL PROTECTED]> wrote: >Those headers won't affect whether or not Declude bans the files -- the >*real* filename is one you won't see, becaues it is encoded. > >You can send a copy of the E-mail file to [EMAIL PROTECTED] , and I can >test it here to see what the real extensions are. >-Scott > >At 11:11 AM 8/9/2002, you wrote: > >> >The catch here is that BinHex (Mac encoding) files have the filename within >> >the encoded segment. So you can have a situation where the MIME filename >> >is "safefile.txt", but the BinHex segment says the filename is >> >"evilvirus.exe" (which you won't see, because it is encoded). >> > -Scott >> > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] banext issue
Those headers won't affect whether or not Declude bans the files -- the *real* filename is one you won't see, becaues it is encoded. You can send a copy of the E-mail file to [EMAIL PROTECTED] , and I can test it here to see what the real extensions are. -Scott At 11:11 AM 8/9/2002, you wrote: > >The catch here is that BinHex (Mac encoding) files have the filename within > >the encoded segment. So you can have a situation where the MIME filename > >is "safefile.txt", but the BinHex segment says the filename is > >"evilvirus.exe" (which you won't see, because it is encoded). > > -Scott > > >Here are the attachment headers from the message. I just want to make sure. > >--WBE1028896920052e2aec2af3c9e93cad6a0ff23d4e75 >Content-Type: application/x-macbinary; name="HOPE COVER" >Content-Transfer-Encoding: base64 >Content-Disposition: attachment; filename="HOPE COVER" > >--WBE1028896920052e2aec2af3c9e93cad6a0ff23d4e75 >Content-Type: application/x-macbinary; name="GFSD Handout" >Content-Transfer-Encoding: base64 >Content-Disposition: attachment; filename="GFSD Handout" > >--WBE1028896920052e2aec2af3c9e93cad6a0ff23d4e75 >Content-Type: application/x-macbinary; name="middle school scenario" >Content-Transfer-Encoding: base64 >Content-Disposition: attachment; filename="middle school scenario" > >--WBE1028896920052e2aec2af3c9e93cad6a0ff23d4e75 >Content-Type: application/x-macbinary; name="One Solution Syndrome" >Content-Transfer-Encoding: base64 >Content-Disposition: attachment; filename="One Solution Syndrome" > > >--- >[This E-mail was scanned for viruses by Declude Virus >(http://www.declude.com)] > >--- >This E-mail came from the Declude.Virus mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.Virus".The archives can be found >at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] banext issue
>The catch here is that BinHex (Mac encoding) files have the filename within >the encoded segment. So you can have a situation where the MIME filename >is "safefile.txt", but the BinHex segment says the filename is >"evilvirus.exe" (which you won't see, because it is encoded). > -Scott > Here are the attachment headers from the message. I just want to make sure. --WBE1028896920052e2aec2af3c9e93cad6a0ff23d4e75 Content-Type: application/x-macbinary; name="HOPE COVER" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="HOPE COVER" --WBE1028896920052e2aec2af3c9e93cad6a0ff23d4e75 Content-Type: application/x-macbinary; name="GFSD Handout" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="GFSD Handout" --WBE1028896920052e2aec2af3c9e93cad6a0ff23d4e75 Content-Type: application/x-macbinary; name="middle school scenario" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="middle school scenario" --WBE1028896920052e2aec2af3c9e93cad6a0ff23d4e75 Content-Type: application/x-macbinary; name="One Solution Syndrome" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="One Solution Syndrome" --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] banext issue
>so, I looked at the message in the virus folder and there were 4 >attachments to the message, none of them had extensions. (all mac files) The catch here is that BinHex (Mac encoding) files have the filename within the encoded segment. So you can have a situation where the MIME filename is "safefile.txt", but the BinHex segment says the filename is "evilvirus.exe" (which you won't see, because it is encoded). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
