[ngw] W32/BadTrans.B-mm

Mathew O'Marah mathew.omarah at wwavrc.co.uk
Wed Dec 5 10:01:37 UTC 2001

For the content filtering section do not use the * symbol. It is looking for what you enter a sub-string of the attachment filename. For example *.scr would stop the file "gone*.scr" but not "gone.scr".


Mathew D. O'Marah
Network Support Analyst
Group IT Services

WWAV Rapp Collins Group Limited
Tel:      020 8735 8061
Mobile: 07050 152 497
Fax:      020 8735 8923 
This e-mail and any files transmitted with it are confidential and intended solely for the individual or entity to whom they are addressed. Any views or opinions presented or expressed are those of the author(s) and may not necessarily represent those of the Company or of any WWAV Rapp Collins Group Company and no representation is given nor liability accepted for the accuracy or completeness of any information contained in this email unless expressly stated to the contrary. 
If you are not the intended recipient or have received this e-mail in error, you may not use, disseminate, forward, print or copy it, but please notify the sender that you have received it in error. 
Registered Office: 1 Riverside, Manbre Road, London W6 9WA. Registered in England No. 1581935

>>> maryve1 at starpower.net 05/12/2001 03:55:38 >>>
It's not blocking anything by extension. Maybe we don't have the entries 
right.  In content filtering we put an entry such as *.scr and check the 
file attachment option.

At 12/04/01 01:44 PM, Howard Fleming wrote:
>Yes, but I also block file attachments with the following extensions, which
>(so far) catches most of the problems before the virus updates comes out......
>exe, bat shs, scr, hta, vbs, ocx, mpg, mpeg, htt, com, htc, mp3 mov, avi,
>bas, cmd, js, pif, wav, chm, cpl, jse, lnk
>If I have missed any, someone please let me know......
>On 29 Nov 2001 at 21:58, Mary Van Engelen wrote:
> > Has anyone using Webshield been able to block these things?  We finally
> > got updated signatures and it seems to be detecting it through virus
> > scanning now, but I've been trying to block the attachments by
> > extensions (scr and pif and the combined extensions) and nothing's
> > getting caught.
> >
> > Mary
> >
>Visit http://www.ngwlist.com for help with the list.
>Visit http://www.concentrico.net for GroupWise, NDS, or DirXML development 
>needs and product information.

Visit http://www.ngwlist.com for help with the list.
Visit http://www.concentrico.net for GroupWise, NDS, or DirXML development needs and product information.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://ngwlist.com/pipermail/ngw/attachments/20011205/0c082a30/attachment.html 
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: Mathew O'Marah.vcf
Url: http://ngwlist.com/pipermail/ngw/attachments/20011205/0c082a30/attachment.pl 

More information about the ngw mailing list