[Dshield] Any idea why this came after the message.....????? the BANEXT etc

Dean White dean at achillean.com.au
Fri Mar 7 04:09:27 GMT 2003


BJL,
What you have there is an anti-virus solution which has added a list of
banned file extensions to the end of the email. 

I have no idea from the information provided though which av solution
has produced this output. However, many solutions are attaching
statements to the bottom of email's now by default, certifying that the
email has been scanned. I've always turned this feature off, my concern
being that an attacker who knows what av solution I am using and which
version could make a calculated guess as to which malware my solution
may not detect.

I hope this has cleared things up.

Cheers,
Dean White
Incidents.org ISC Asia-Pacific Incident co-ordinator

On Fri, 2003-03-07 at 14:24, BJL wrote:
> I got this odd "list" at the end of the message - any idea ???
> Here's  a copy:
> 
> 
> Date: Wed, 05 Mar 2003 18:32:47 +0100
> From: "Hanke Penning" <hanke.penning at iap.de>
> To: list at dshield.org
> Subject: [Dshield] Integrating DSHIELD IP lookup database
> Message-ID: <3E6642CF.22394.3AD628 at localhost>
> In-Reply-To: <NDBBKLKGELAPHPIFABKCKEFPEPAA.wlarmon at dshield.org>
> References: <14227086047.20030305165727 at admin.fulgan.com>
> Content-Type: text/plain; charset=US-ASCII
> MIME-Version: 1.0
> Content-Transfer-Encoding: 7BIT
> Precedence: list
> Reply-To: General DShield Discussion List <list at dshield.org>
> Message: 1
> 
> Hello,
> 
> > Try http://www.dshield.org/ipinfo_ascii.php?ip=10.10.10.10
> > This looks like what Johannes was working on.
> 
> Yes, that is very useful! 
> Let me ask one question:
> When I look up an address in the database, often appears 
> email=[no email]
> 
> Ok, no matter. Then I looked for some of our own addresses.
> And:
> email=[no email]
> 
> Pfew! What has to be done, that the mail-address appears correctly?
> 
> Yours sincerely
> 
> 
> 
> Hanke Penning     
> 
> BANEXT  ad
> BANEXT  adp
> BANEXT  ASD
> BANEXT  ASF
> BANEXT  ASP
> BANEXT  ASX
> BANEXT  BAS
> BANEXT  BAT
> BANEXT  CAB
> BANEXT CEO
> BANEXT  CHM
> BANEXT  CMD
> BANEXT  COM
> BANEXT  CPL
> BANEXT  CRT
> BANEXT  DLL
> BANEXT ENC
> BANEXT  EXE
> BANEXT  hlp
> BANEXT  HTA
> BANEXT  HTO
> BANEXT  inf
> BANEXT  ins
> BANEXT  isp
> BANEXT  JS
> BANEXT  JSE
> BANEXT  LNK
> BANEXT  mdb
> BANEXT  mde
> BANEXT  msc
> BANEXT  msi
> BANEXT  msp
> BANEXT  MST
> BANEXT  NWS
> BANEXT  OCX
> BANEXT  pcd
> BANEXT  PIF
> BANEXT  PNG
> BANEXT  REG
> BANEXT  SCR
> BANEXT  sct
> BANEXT  shb
> BANEXT  SHS
> BANEXT  SYS
> BANEXT  url
> BANEXT  vb
> BANEXT  VBE
> BANEXT  VBS
> BANEXT  VBX
> BANEXT  vsd
> BANEXT  vss
> BANEXT  vst
> BANEXT  vsw
> BANEXT  ws
> BANEXT  wsc
> BANEXT  WSF
> BANEXT  WSH
> BANEXT  XML
> 
> 
> 
> 
> 
> 
> _______________________________________________
> list mailing list
> list at dshield.org
> To change your subscription options (or unsubscribe), see: http://www.dshield.org/mailman/listinfo/list




More information about the list mailing list