Hmm.
For those sites who don't want to block copious amounts of attachment with
these filters, I wonder if a simpler filter that blocked any attachment
called somefile.txt.ext (.ext could be any value) would be a reasonable
compromise: certainly some of the recent ones we've seen try to disguise
the nature of the file by making it appear to have a .txt extension (when
it really has another further extension, the one Windows takes notice of).
This thought was derived from a comment by one of my users about blocking
"double extension" attachments.
Comments?
Jethro.
On Mon, 19 Jun 2000, Douglas Gray Stephens wrote:
>
> Hi,
>
> There is another Windows worm doing the rounds (see
> http://vil.nai.com/villib/dispvirus.asp?virus_k=98668
> ) using an extension of SHS
>
> I am not sure who is maintaining the system_filter.exim file, but the
> current version (0.5)
> ftp://ftp.exim.org/pub/filter/system_filter.exim
> does not trap files with extension "SHS". I believe that the file
> needs updating, with something similar to the attached file.
>
> Cheers,
>
> Douglas.
>
>
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Jethro R Binks Computing Officer, IT Services
Webmaster, Cachemaster, Listmaster; University Of Strathclyde, Glasgow, UK
jethro.binks@???
