[Esa-l]Sircam virus filter

David Collantes david at bus.ucf.edu
Wed Aug 1 09:11:58 PDT 2001

On 01/08/01 at 6:08pm, Michael Meltzer wrote:

|David Collantes wrote:
|> On 01/08/01 at 11:41am, Juan Manuel Calvo wrote:
|> |I have found a very simple solution to the Sircam problem. Your
|> |procmail sanitizer allows defang the attachment but the users
|> |receives the email.
|> I think that is a poor way to do things. I could easily modify SirCam and
|> make the rule above worthless. SirCam comes with double extensions,
|i had two SirCam's with only a single extension. May be this happens if the
|file from which SirCam takes the name for his own Attachment has no extension
|So only checking for double extension is mot enough.

That is why I poison .EXE's, .COM's and others. If poisoning is not an
option, then I mangle.


| David Collantes                || UCFBusiness, UCF, Orlando, FL   |
| Senior Systems Administrator   || Telephone: (407) 823-3418       |

More information about the esd-l mailing list