Actually, no.
The Internet Scan Job in Antigen, filtering on *.com, allows *.*.com to get
through. This is a known bug. It works properly on the Realtime and Manual
scan jobs - its only the Internet Scan Job which is at risk.
I don't know if the issue extends beyond *.com to *.vbs.
This became an issue last week with the My Party worm, where the Internet
Scan Job was letting it into the system, but then the Realtime job was
grabbing it. Antigen is working on a fix. In the meantime, Premium Support
has suggested you configure your Internet Scan Job to filter on *.*.com.
For more information, contact Sybari directly.
Best,
Jesse Wendel
Sr. Messaging Analyst
www.pse.com
-Original Message-
From: Bill Kuhn - MCSE [mailto:[EMAIL PROTECTED]]
Sent: Thursday, February 07, 2002 8:46 AM
To: MS-Exchange Admin Issues
Subject: RE: Antigen filter "*.*.*" - worthwhile?
I don't see the need for it.
Antigen will filter based on the last extension in a file with multiple
extensions. This is the same way Windows associates the file with an
application.
Given a file mytrojan.doc.vbs, Antigen will pick it off if you are set
to filter .VBS.
It's never missed one for me.
-Original Message-
From: Bob Peitzke [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, February 05, 2002 4:36 PM
To: MS-Exchange Admin Issues
Subject: Antigen filter "*.*.*" - worthwhile?
We run Antigen 6.2 on our Exchange 5.5 server. We were advised by
Sybari
support to include the filter, "*.*.*", which they said are often
viruses
(e.g. annakournikova.jpg.vbs). We tried it for a while, but were
quarantining too many valid user attachments, and they rebelled, so I
compromised and removed that filter. We are filtering exe, bat, cmd,
com,
vbs, vb, js, shs, lnk, pif, scr, hta, htm, and "*.*}" (whatever that
is).
Also we are using three AV engines, and updating them frequently. As I
understand it, the "*.*.*" filter would only come into play on a new
virus
for which we don't yet have the signature, and is some other scripting
language that we are not filtering.
I'd like to get feedback on the protection compromise of not filtering
"*.*.*" attachments.
How many of you are using that filter?
Do you think it adds significant protection?
Have we missed any valuable filters?
TIA
Bob Peitzke
Information Systems Manager
Sander A. Kessler & Associates
Santa Monica, CA, USA
[EMAIL PROTECTED]
List Charter and FAQ at:
http://www.sunbelt-software.com/exchange_list_charter.htm
List Charter and FAQ at:
http://www.sunbelt-software.com/exchange_list_charter.htm
List Charter and FAQ at:
http://www.sunbelt-software.com/exchange_list_charter.htm
