[Dshield] Blocked Dshield list

Kenneth Coney superc at visuallink.com
Tue Sep 23 15:34:05 GMT 2003

Thank you.  I have gotten two digests since then, so maybe they fixed the 
problem.  Volume 9, issue 35 remains trapped and unread in AV limbo, 
possibly forever until deleted.  No reply to emails to Postini of course. 
I will visit the link you suggest and read it.  I suspect you are correct 
as to the cause.  Mime.gen.b is a pretty vague catch all for a slew of 
things that could cause an infection with IE5. There is probably some scary 
header info in it somewhere that the AV alerted on.


Subject: RE: [Dshield] Blocked Dshield list
From: "Wayne Larmon" <wlarmon at dshield.org>
Date: Mon, 22 Sep 2003 12:47:12 -0400
To: "General DShield Discussion List" <list at dshield.org>

 >> My IP decided a few days ago to use Postini.com as an email filter.  As a
 >> result the DShield text streams (the digest) are being trapped by the
 >> McAfee virus screener.  According to it, the DShield streams are all
 >> infected.  The reported specific is: X-pstnvirus: Exploit-MIME.gen.b
 >> Postini advises the emails can not be fixed for forwarding to me.  Emails
 >> to the support desk are not being answered.  I suspect McAfee
 >> doesn't know
 >> how to handle the application known as octet-stream, either that, or the
 >> list really is infected.     Either way I ain't getting the digest.

There has been a lot of malware headers posted lately and it isn't
surprising that virus scanners are being spooked.  It would be more
comforting if the A/V scanners blocked actual malware, rather than blocking
discussions about malware, though.  Maybe the A/V scanning software is just
getting a head start on upcoming laws that prohibit disseminating virus
information.  (Ducks.)

Check our web archives at http://www.dshield.org/pipermail/list/ to catch up
on anything you've missed.

Wayne Larmon

More information about the list mailing list