anomy-list

RE: About ... doc.lnk

From: Lazur, Eric (15667@xyz.molar.is)
Date: Fri 03 Aug 2001 - 19:29:13 UTC

  • Next message: NTR S.L.: "PARLIS.COM"

    you had the same problem I did. Look at the last file_list_1 line, there
    should be a | after the = sign, like this:

    file_list_1 += |(\.g?z|\.bz\d?)*)$

    Try this and see if it works. Let me know if you have the same problem
    where it "sanitizes" every email with unnamed.txt.
    This will be a great help to us, if I can get it working.

    Eric LaZur
    Senior Infrastructure Engineer
    eCAMPUS.com
    (859) 514-5200
    http://www.ecampus.com
    email: 15800@xyz.molar.is

    -----Original Message-----
    From: Sergio J Rojas H [mailto:15705@xyz.molar.is]
    Sent: Friday, August 03, 2001 3:26 PM
    To: Lazur, Eric
    Cc: 15750@xyz.molar.is
    Subject: RE: [anomy-list]: About ... doc.lnk

     It still doesn-t working!

     This is my anomy.conf:

    --------------------- ANOMY.CONF ---------------------------
    feat_boundaries = 0
    feat_files = 1
    feat_forwards = 1
    feat_html = 0
    feat_lengths = 1
    feat_log_inline = 0
    feat_log_stderr = 1
    feat_scripts = 1
    feat_trust_pgp = 0
    feat_uuencoded = 1
    feat_verbose = 0
    file_list_rules = 4

    # Files we absolutely don't want (mostly executables).
    #
    file_list_1_scanner = 0
    file_list_1_policy = drop
    file_list_1 = (?i)(winmail\.dat
    file_list_1 += |\.(exe|vb[es]|c(om|hm)|bat|pif|lnk|s(ys|cr))
    file_list_1 += (\.g?z|\.bz\d?)*)$
     
    ------------------------------------------------------------------

     Thanx a lot!

             __o
            _`\<,_
           (*)/ (*)
    /\/\/\/\/\/\/\/\/\/\
                        \
     Sergio J Rojas H \(*)|\
     Direccion de Sistemas\ --_\o
     Proeza y Asociados \(*)!
                            \
     Tel 54802659 \
     ICQ 44935299 \
     15705@xyz.molar.is \/\/\/\/\/\
     http://www.proezayasoc.com.mx/~srojas
     There are not problems, only solutions

    On Fri, 3 Aug 2001, Lazur, Eric wrote:

    > This has seemed to work for me
    > file_list_1_scanner = 0
    > file_list_1_policy = save
    > file_list_1 = (?i)(winmail\.dat
    > file_list_1 += |\.(exe|vb[es]|c(om|hm)|bat|pif|lnk|s(ys|cr))
    > file_list_1 += |(\.g?z|\.bz\d?)*)$
    >
    > But I am having a problem where it is saying
    > ****
    > NOTE: An attachment was deleted from this part of the message,
    > because it failed one or more checks by the virus scanning system.
    > The file has been quarantined on the mail server, with the following
    > file name:
    >
    > att-unnamed.txt-3b6aef80.JX
    >
    > The removed attachment's original name was:
    >
    > unnamed.txt
    >
    > It is recommended that you contact your system administrator if you
    > need access to the file. It might also be a good idea to contact the
    > sender, and warn them that their system may be infected.
    > ****
    > For every email. I get this no matter what is in the body of the message.

    >
    > Eric LaZur
    > Senior Infrastructure Engineer
    > eCAMPUS.com
    > (859) 514-5200
    > http://www.ecampus.com
    > email: 15800@xyz.molar.is
    >
    >
    >
    > -----Original Message-----
    > From: Sergio J Rojas H [mailto:15705@xyz.molar.is]
    > Sent: Friday, August 03, 2001 1:27 PM
    > To: Romek
    > Cc: 15750@xyz.molar.is
    > Subject: Re: [anomy-list]: About ... doc.lnk
    >
    >
    >
    > Hello!
    >
    > Yes I know!, but i set on a drop policies .lnk, but it doesn't work.
    > Don't block doc.lnk attachments.
    >
    > How can I block that?
    >
    > Thanx in advance!
    >
    >
    > __o
    > _`\<,_
    > (*)/ (*)
    > /\/\/\/\/\/\/\/\/\/\
    > \
    > Sergio J Rojas H \(*)|\
    > Direccion de Sistemas\ --_\o
    > Proeza y Asociados \(*)!
    > \
    > Tel 54802659 \
    > ICQ 44935299 \
    > 15705@xyz.molar.is \/\/\/\/\/\
    > http://www.proezayasoc.com.mx/~srojas
    > There are not problems, only solutions
    >
    > On Fri, 3 Aug 2001, Romek wrote:
    >
    > >
    > > .doc.lnk is a Sircam.worm - better do not open it.
    > >
    > >
    > > At 21:35 02-08-01 -0500, you wrote:
    > > >
    > > > Hello everybody!
    > > >
    > > > Can Anybody send me how block .doc.lnk attachments.
    > > >
    > > > I see this thread, today.
    > > >
    > > > But i made a mistake and delete that messages ..
    > > >
    > > > Thanx in advance...
    > > >
    > > > __o
    > > > _`\<,_
    > > > (*)/ (*)
    > >
    > > --
    > > Romek Zylla
    > > ~~~~~~~~~~~ after all the work done by Micro$oft (R) ~~~~~~~~~~
    > > Personal Computer Science is an experimental one (C)
    > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    > >
    >
    >
    >



    hosted by molar.is