[Dshield] Delayed Attachment Delivery?

David Vincent david.vincent at mightyoaks.com
Tue Mar 2 21:31:47 GMT 2004


> I am currently fighting this exact problem, one of the latest batch of
> "nastiness" passes through our mail server running 2 AV scanners.
> 
> Simple fix - block all .zip attachments
> 
> Does it make business sense - try doing business with these 
> virii / worms
> running riot through the internal network.
> 
> How to get around the problem - send the attachment as 
> "filename.abc" and
> enclose in the email the actual filename and the actual 
> senders details.
> Hey, how many people should really be getting all these attachments.
> 
> I know it's not a perfect solution, but it works and there is 
> no more "oops,
> I just clicked on this attachment and ..."
> 
> 
> Back to the fire!!

i've managed to get most users to switch and start using "7-Zip"
(http://7-zip.org/) which is an open-source alternative.  this let me block
ZIP attachments with no guilt.  :)  the result is users now create ".7z"
files which are allowed through the gateway.

poof, no problems!

they can still open zips, then can still create zips, and while the UI for
7zip is not as sophisticated as WinZip/WinRAR/WinAce etc. it does the job.

'course i'll revisit the problem should 7-zip become popular and the viri
dudes start using it to compress everything.

-d





More information about the list mailing list