[THIN] Re: OT: Security response to BAGLE virus (password protected .zips)

  • From: Henry Sieff <hsieff@xxxxxxxxxxxx>
  • To: "'thin@xxxxxxxxxxxxx'" <thin@xxxxxxxxxxxxx>
  • Date: Thu, 4 Mar 2004 11:23:15 -0600

There is a clever way in NAV for Exchange 2.1 to use the attachment/message
blocking features to block these.

Take the executable extensions you are already blocking, and put a "+" at
the end of them ie *.com = *.com+ and add these to your blocked attachments
list.



> -----Original Message-----
> From: Claus, Brian [mailto:BClaus@xxxxxxxxxxxxx]
> Sent: Thursday, March 04, 2004 7:28 AM
> To: thin@xxxxxxxxxxxxx
> Subject: [THIN] OT: Security response to BAGLE virus 
> (password protected
> .zips)
> 
> 
> Just wondering what others are doing to combat the latest 
> BAGLE worm.  =
> It's password protected so standard AV won't scan into it.  How is =
> everyone else handling delivery of .zip files now?
> 
> We're using the Trend Micro AV suite.
> 
> Do you think the latest password protected BAGLE worm has caused the =
> demise of password protected .zip files?
> 
> My immediate opinion in the matter is that password protected 
> .zip files =
> will now be treated with the same delivery restrictions that 
> the .exe, =
> .scr, .pif, .vbs have come under but I'm not aware of any AV 
> software or =
> other means to differentiate scanning options between p\w 
> protected .zip =
> files and non p\w protected .zip files.
> 
> 
> Thanks,
> =20
> 
>   _____ =20
> 
> =20
> Brian Claus, A+, Network+, MCP
> Network Administrator
> WESCO Distribution, Inc.
> 225 West Station Square Drive, Suite 700
> Pittsburgh, PA 15219-1122
> Phone:  412-454-2412
> Fax:  412-454-2540
> bclaus@xxxxxxxxxxxxx <mailto:bclaus@xxxxxxxxxxxxx>=20
>   _____ =20
> 
> ********************************************************
> This weeks sponsor triCerat Inc.
> triCerat makes your job easier by offering essential
> applications to eliminate your printing, policy and profile,
> and your application management problems.
> http://www.triCerat.com 
> **********************************************************
> Useful Thin Client Computing Links are available at:
> http://thin.net/links.cfm
> ***********************************************************
> For Archives, to Unsubscribe, Subscribe or 
> set Digest or Vacation mode use the below link:
> http://thin.net/citrixlist.cfm
> 
********************************************************
This weeks sponsor triCerat Inc.
triCerat makes your job easier by offering essential
applications to eliminate your printing, policy and profile,
and your application management problems.
http://www.triCerat.com 
**********************************************************
Useful Thin Client Computing Links are available at:
http://thin.net/links.cfm
***********************************************************
For Archives, to Unsubscribe, Subscribe or 
set Digest or Vacation mode use the below link:
http://thin.net/citrixlist.cfm

Other related posts: