AdmiNotes by Christopher Harvey

03/04/2004 09:03:54 PM - Blocking executable attachments

Blocking executable attachments

As I mentioned on February 25 blocking executable attachments with server side rules gives us many advantages over using McAfee for this function. Here is a dilog box of the rule and which extensions we block.

A picture named M2
Note: we also block .vb but that is a separate rule because we also use an exception.

Comments

Comment posted by Bruce Currier03/05/2004 09:01:40 AM

Chris,
We had a rule like this but had to stop using it because it didn't seem to pay any attention to the period and blocked attachments with names like executive or committee. We're in the process of hacking the mail rules to allow us to check for the attachment extension.

Comment posted by Chris03/05/2004 09:27:59 AM

I just did a test and sent myself an attachment named msiandexealsovb.txt and it came right through the rule I showed above. Apparently it is recognizing the '.'

We are running 6.0.2 CF1 on our mail server. I don't know if that makes a difference?

Bruce - If you have upgraded your server since you first tested you may want to re-test.

Hope it works, let me know how this comes out for you.

Comment posted by Jaime03/21/2004 04:55:37 PM

Thanks dude - very informative blogg site. Will be putting your exclusions filter to work on Monday morning.

--

Jaime

Comment posted by Jaime03/21/2004 04:55:44 PM

Thanks dude - very informative blogg site. Will be putting your exclusions filter to work on Monday morning.
<br />
<br />--
<br />
<br />Jaime

Comment posted by Mike Munnis04/02/2004 02:20:07 PM
Homepage: http://www.mikemunnis.com

Good stuff. I did want to respond to your earlier Feb 25 post though.

McAfee's quarantine doesn't allow me to copy and paste the message to the user's Inbox for retrieval
Symantec AV Filtering for Notes/Domino will allow you to release the message to the user from the quarantine.

McAfee's extension block happens prior to virus blocking (which is more efficient) but then all emails with a ZIP file end up in the same bucket. By blocking attachments with a rule, known viruses are still blocked by McAfee and whatever gets through (which is a much smaller number) can be examined individually in a separate place.
You can create a content rule in Symantec that is seperate from the virus rule. You can order the rule processing, and have it stop processing at any rule, or continue processing the next rule. In the quarantine/logs, the message can be viewed by each type of rule violation. If there were multiple violations, the message shows in each failure view.

By letting McAfee's virus detection stop the virus (instead of by extension) I get a good count of the viruses that are being stopped by type, and not just what attachments are blocked not knowing which viruses they may or may not be associated with.
Similar to the above explanation I guess. Since you can keep pushing a message through each rule, you can record if the file fails multiple rules. Your statistics will accuratly reflect this. So, if a message fails the virus scan first and you have continue processing on, it will now go to your next content violation rule. If it also fails that, both failures get logged for the same message.

So, how does this compare to other products. If you use something else to block viruses on your Domino server, what do you really like about how it works?
Our company has had good success with Symantec. Their desktop product also includes a Notes and Outlook scanner. It scans the message as the user is opening it and will act on the attachment before the user gets a hold of it. Works with the preview pane also.

Comment posted by Eric Parsons12/01/2004 09:51:33 PM
Homepage: http://startingblockcomputing.com

Group Technologies will scan and filter any file. Signatures for common files are included in the package, while others are relatively simple to create. With support, you can send in three examples of the file format, and they will send you the signature.

Has helped us effectively stop executables, no matter the extension. Also has helped with the bandwidth and diskspace for those cute little video files. :) Amazing how many clients will rename the file thinking they can sneak it through.

Quarantine will resend the message as though it never touched the quarantine. Sure drops the number of support calls.

Blocked Response!05/20/2006 09:06:39 PM

This response from IP Address 202.58.85.8 was blocked by the owner of this blog.

Blocked Response!05/20/2006 09:07:06 PM

This response from IP Address 150.187.145.62 was blocked by the owner of this blog.

Blocked Response!05/20/2006 09:07:21 PM

This response from IP Address 218.234.137.12 was blocked by the owner of this blog.

Blocked Response!08/09/2006 07:31:37 AM

This response from IP Address 212.164.87.155 was blocked by the owner of this blog.

Blocked Response!10/06/2006 02:44:44 PM

This response from IP Address 69.41.183.115 was blocked by the owner of this blog.

Blocked Response!10/06/2006 02:44:59 PM

This response from IP Address 72.232.67.246 was blocked by the owner of this blog.

Blocked Response!10/06/2006 02:45:12 PM

This response from IP Address 69.41.183.115 was blocked by the owner of this blog.

Blocked Response!12/19/2006 05:24:40 PM

This response from IP Address 68.6.68.227 was blocked by the owner of this blog.

Blocked Response!01/01/2007 03:43:12 AM

This response from IP Address 203.89.42.167 was blocked by the owner of this blog.

Blocked Response!02/20/2007 06:36:12 AM

This response from IP Address 81.177.26.50 was blocked by the owner of this blog.

Blocked Response!02/22/2007 10:14:42 PM

This response from IP Address 81.177.26.50 was blocked by the owner of this blog.

Blocked Response!02/23/2007 02:22:10 PM

This response from IP Address 81.177.26.50 was blocked by the owner of this blog.

Blocked Response!02/24/2007 07:14:28 PM

This response from IP Address 81.177.26.50 was blocked by the owner of this blog.

Blocked Response!02/25/2007 02:22:57 PM

This response from IP Address 81.177.26.50 was blocked by the owner of this blog.

Blocked Response!02/28/2007 06:31:34 AM

This response from IP Address 81.177.26.50 was blocked by the owner of this blog.

Blocked Response!03/01/2007 05:28:14 AM

This response from IP Address 81.177.26.50 was blocked by the owner of this blog.

Blocked Response!03/18/2007 09:25:22 PM

This response from IP Address 66.79.162.188 was blocked by the owner of this blog.

Blocked Response!03/25/2007 07:34:25 PM

This response from IP Address 66.79.162.188 was blocked by the owner of this blog.

Blocked Response!03/28/2007 07:11:57 PM

This response from IP Address 66.79.163.107 was blocked by the owner of this blog.

Blocked Response!04/22/2007 06:19:28 PM

This response from IP Address 168.188.190.161 was blocked by the owner of this blog.

Blocked Response!04/22/2007 06:20:12 PM

This response from IP Address 168.188.190.161 was blocked by the owner of this blog.

Blocked Response!04/23/2007 02:24:32 AM

This response from IP Address 204.193.117.84 was blocked by the owner of this blog.

Blocked Response!04/23/2007 03:14:40 AM

This response from IP Address 86.106.216.101 was blocked by the owner of this blog.

Blocked Response!04/23/2007 10:00:31 AM

This response from IP Address 221.164.46.100 was blocked by the owner of this blog.

Blocked Response!04/23/2007 10:51:22 AM

This response from IP Address 64.111.144.218 was blocked by the owner of this blog.

Blocked Response!04/23/2007 04:36:23 PM

This response from IP Address 201.255.210.80 was blocked by the owner of this blog.

Blocked Response!04/23/2007 04:37:36 PM

This response from IP Address 201.255.210.80 was blocked by the owner of this blog.

Blocked Response!04/23/2007 08:35:19 PM

This response from IP Address 64.53.66.226 was blocked by the owner of this blog.

Blocked Response!04/23/2007 10:39:22 PM

This response from IP Address 86.106.216.101 was blocked by the owner of this blog.

Blocked Response!04/24/2007 06:53:14 AM

This response from IP Address 84.149.247.79 was blocked by the owner of this blog.

Blocked Response!04/24/2007 10:15:56 AM

This response from IP Address 70.107.155.95 was blocked by the owner of this blog.

Blocked Response!04/24/2007 01:16:36 PM

This response from IP Address 84.153.30.26 was blocked by the owner of this blog.

Blocked Response!04/24/2007 01:37:34 PM

This response from IP Address 124.84.53.250 was blocked by the owner of this blog.

Blocked Response!04/25/2007 12:36:29 PM

This response from IP Address 87.1.77.166 was blocked by the owner of this blog.

Blocked Response!04/25/2007 07:19:56 PM

This response from IP Address 124.51.62.203 was blocked by the owner of this blog.

Blocked Response!04/26/2007 02:22:31 AM

This response from IP Address 122.47.95.75 was blocked by the owner of this blog.

Blocked Response!04/26/2007 06:26:58 PM

This response from IP Address 201.21.236.179 was blocked by the owner of this blog.

Blocked Response!04/26/2007 08:32:40 PM

This response from IP Address 24.188.122.156 was blocked by the owner of this blog.

Blocked Response!04/26/2007 08:39:13 PM

This response from IP Address 60.7.83.49 was blocked by the owner of this blog.

Blocked Response!04/27/2007 12:38:14 AM

This response from IP Address 210.131.1.75 was blocked by the owner of this blog.

Blocked Response!04/27/2007 08:26:13 AM

This response from IP Address 84.181.15.224 was blocked by the owner of this blog.

Blocked Response!04/27/2007 07:14:13 PM

This response from IP Address 218.144.138.7 was blocked by the owner of this blog.

Blocked Response!04/27/2007 07:14:57 PM

This response from IP Address 71.14.109.170 was blocked by the owner of this blog.

Blocked Response!04/28/2007 06:59:13 AM

This response from IP Address 68.227.187.210 was blocked by the owner of this blog.

Blocked Response!04/28/2007 08:36:13 AM

This response from IP Address 201.80.231.130 was blocked by the owner of this blog.

Blocked Response!04/28/2007 02:09:37 PM

This response from IP Address 71.193.6.189 was blocked by the owner of this blog.

Blocked Response!04/29/2007 08:20:01 PM

This response from IP Address 75.47.78.210 was blocked by the owner of this blog.

Blocked Response!04/30/2007 03:03:22 AM

This response from IP Address 58.148.1.4 was blocked by the owner of this blog.

Blocked Response!04/30/2007 11:08:46 AM

This response from IP Address 24.61.7.158 was blocked by the owner of this blog.

Blocked Response!04/30/2007 03:11:07 PM

This response from IP Address 200.82.112.74 was blocked by the owner of this blog.

Blocked Response!04/30/2007 09:21:37 PM

This response from IP Address 201.242.61.201 was blocked by the owner of this blog.

Blocked Response!05/02/2007 01:58:18 AM

This response from IP Address 69.203.218.18 was blocked by the owner of this blog.

Blocked Response!05/02/2007 02:11:45 AM

This response from IP Address 58.120.109.239 was blocked by the owner of this blog.

Blocked Response!05/02/2007 02:12:34 AM

This response from IP Address 76.21.218.206 was blocked by the owner of this blog.

Blocked Response!05/02/2007 02:59:11 AM

This response from IP Address 125.188.4.190 was blocked by the owner of this blog.

Blocked Response!05/02/2007 03:21:32 AM

This response from IP Address 69.14.167.77 was blocked by the owner of this blog.

Blocked Response!05/02/2007 11:38:02 AM

This response from IP Address 83.242.84.176 was blocked by the owner of this blog.

Blocked Response!05/02/2007 02:54:34 PM

This response from IP Address 201.231.40.88 was blocked by the owner of this blog.

Blocked Response!05/02/2007 02:54:54 PM

This response from IP Address 24.132.144.156 was blocked by the owner of this blog.

Blocked Response!05/02/2007 11:11:10 PM

This response from IP Address 125.170.135.57 was blocked by the owner of this blog.

Blocked Response!05/03/2007 12:03:38 AM

This response from IP Address 125.170.135.57 was blocked by the owner of this blog.

Blocked Response!05/03/2007 04:10:46 AM

This response from IP Address 81.177.58.166 was blocked by the owner of this blog.

Blocked Response!05/03/2007 04:39:16 AM

This response from IP Address 80.240.211.77 was blocked by the owner of this blog.

Blocked Response!05/03/2007 04:40:56 AM

This response from IP Address 201.42.48.240 was blocked by the owner of this blog.

Blocked Response!05/03/2007 10:10:26 AM

This response from IP Address 83.67.97.251 was blocked by the owner of this blog.

Blocked Response!05/03/2007 12:45:58 PM

This response from IP Address 124.100.235.143 was blocked by the owner of this blog.

Blocked Response!05/03/2007 09:38:43 PM

This response from IP Address 80.240.211.77 was blocked by the owner of this blog.

Blocked Response!05/03/2007 10:22:30 PM

This response from IP Address 222.237.67.167 was blocked by the owner of this blog.

Blocked Response!05/03/2007 11:18:03 PM

This response from IP Address 68.227.187.210 was blocked by the owner of this blog.

Blocked Response!05/04/2007 09:00:41 AM

This response from IP Address 198.45.24.121 was blocked by the owner of this blog.

Blocked Response!05/04/2007 11:24:19 PM

This response from IP Address 24.45.83.39 was blocked by the owner of this blog.

Blocked Response!05/04/2007 11:44:35 PM

This response from IP Address 84.181.11.204 was blocked by the owner of this blog.

Blocked Response!05/05/2007 03:13:59 AM

This response from IP Address 24.253.155.207 was blocked by the owner of this blog.

Blocked Response!05/05/2007 03:35:14 AM

This response from IP Address 85.33.189.229 was blocked by the owner of this blog.

Blocked Response!05/05/2007 10:01:22 AM

This response from IP Address 203.145.131.158 was blocked by the owner of this blog.

Blocked Response!05/06/2007 07:34:36 PM

This response from IP Address 68.196.5.23 was blocked by the owner of this blog.

Blocked Response!05/06/2007 08:44:45 PM

This response from IP Address 66.98.212.79 was blocked by the owner of this blog.

Blocked Response!05/06/2007 11:05:52 PM

This response from IP Address 58.73.160.26 was blocked by the owner of this blog.

Blocked Response!05/06/2007 11:06:37 PM

This response from IP Address 75.46.21.127 was blocked by the owner of this blog.

Blocked Response!05/06/2007 11:10:28 PM

This response from IP Address 125.182.13.40 was blocked by the owner of this blog.

Blocked Response!05/07/2007 06:28:31 AM

This response from IP Address 121.129.0.55 was blocked by the owner of this blog.

Blocked Response!05/08/2007 06:46:43 PM

This response from IP Address 69.121.40.136 was blocked by the owner of this blog.

Blocked Response!05/08/2007 06:46:51 PM

This response from IP Address 68.6.158.153 was blocked by the owner of this blog.

Blocked Response!05/09/2007 08:38:35 PM

This response from IP Address 67.87.52.160 was blocked by the owner of this blog.

Blocked Response!05/09/2007 10:36:10 PM

This response from IP Address 68.211.182.210 was blocked by the owner of this blog.

Blocked Response!05/10/2007 01:21:32 AM

This response from IP Address 71.241.110.78 was blocked by the owner of this blog.

Blocked Response!05/10/2007 02:16:24 AM

This response from IP Address 71.207.100.57 was blocked by the owner of this blog.

Blocked Response!05/10/2007 02:17:24 AM

This response from IP Address 24.19.236.65 was blocked by the owner of this blog.

Blocked Response!05/10/2007 11:26:16 AM

This response from IP Address 68.227.187.210 was blocked by the owner of this blog.

Blocked Response!05/10/2007 04:23:26 PM

This response from IP Address 68.42.4.120 was blocked by the owner of this blog.

Blocked Response!05/10/2007 09:50:22 PM

This response from IP Address 76.189.17.58 was blocked by the owner of this blog.

Blocked Response!05/10/2007 11:51:56 PM

This response from IP Address 201.235.50.114 was blocked by the owner of this blog.

Blocked Response!05/10/2007 11:52:27 PM

This response from IP Address 76.178.28.180 was blocked by the owner of this blog.

Blocked Response!05/11/2007 02:35:17 AM

This response from IP Address 218.236.75.80 was blocked by the owner of this blog.

Blocked Response!05/11/2007 04:36:13 AM

This response from IP Address 58.149.164.136 was blocked by the owner of this blog.

Blocked Response!05/11/2007 12:26:36 PM

This response from IP Address 203.168.94.234 was blocked by the owner of this blog.

Blocked Response!05/11/2007 10:56:16 PM

This response from IP Address 67.82.212.245 was blocked by the owner of this blog.

Blocked Response!05/12/2007 12:15:33 AM

This response from IP Address 76.173.14.235 was blocked by the owner of this blog.

Blocked Response!05/12/2007 01:58:29 AM

This response from IP Address 221.10.53.122 was blocked by the owner of this blog.

Blocked Response!05/12/2007 03:02:14 AM

This response from IP Address 68.10.68.144 was blocked by the owner of this blog.

Blocked Response!05/12/2007 03:03:06 AM

This response from IP Address 66.98.212.79 was blocked by the owner of this blog.

Blocked Response!05/12/2007 03:04:09 AM

This response from IP Address 68.199.233.218 was blocked by the owner of this blog.

Blocked Response!05/13/2007 09:08:54 PM

This response from IP Address 66.79.163.107 was blocked by the owner of this blog.

Blocked Response!05/13/2007 10:18:43 PM

This response from IP Address 66.79.162.188 was blocked by the owner of this blog.

Blocked Response!05/14/2007 01:00:35 PM

This response from IP Address 71.233.50.141 was blocked by the owner of this blog.

Blocked Response!05/14/2007 10:21:01 PM

This response from IP Address 75.132.154.43 was blocked by the owner of this blog.

Blocked Response!05/15/2007 09:16:56 AM

This response from IP Address 69.125.22.128 was blocked by the owner of this blog.

Blocked Response!05/15/2007 09:17:05 AM

This response from IP Address 24.29.71.91 was blocked by the owner of this blog.

Blocked Response!05/15/2007 08:46:02 PM

This response from IP Address 24.72.13.167 was blocked by the owner of this blog.

Blocked Response!05/16/2007 01:40:05 AM

This response from IP Address 76.22.114.99 was blocked by the owner of this blog.

Blocked Response!05/16/2007 02:33:46 AM

This response from IP Address 207.172.136.146 was blocked by the owner of this blog.

Blocked Response!05/16/2007 02:35:22 AM

This response from IP Address 69.137.36.199 was blocked by the owner of this blog.

Blocked Response!05/16/2007 02:35:49 AM

This response from IP Address 67.11.212.180 was blocked by the owner of this blog.

Blocked Response!05/16/2007 08:37:35 AM

This response from IP Address 24.45.249.82 was blocked by the owner of this blog.

Blocked Response!05/16/2007 09:55:21 PM

This response from IP Address 24.200.142.175 was blocked by the owner of this blog.

Blocked Response!05/16/2007 09:56:21 PM

This response from IP Address 69.116.146.180 was blocked by the owner of this blog.

Blocked Response!05/17/2007 02:02:19 AM

This response from IP Address 67.84.41.156 was blocked by the owner of this blog.

Blocked Response!05/17/2007 04:33:35 AM

This response from IP Address 66.27.155.201 was blocked by the owner of this blog.

Blocked Response!05/19/2007 02:04:01 AM

This response from IP Address 61.67.202.24 was blocked by the owner of this blog.

Blocked Response!05/19/2007 06:47:09 AM

This response from IP Address 74.139.178.168 was blocked by the owner of this blog.

Blocked Response!05/20/2007 11:56:22 PM

This response from IP Address 76.167.201.185 was blocked by the owner of this blog.

Blocked Response!05/20/2007 11:56:29 PM

This response from IP Address 67.84.41.156 was blocked by the owner of this blog.

Blocked Response!05/21/2007 02:28:26 AM

This response from IP Address 76.175.13.196 was blocked by the owner of this blog.

Blocked Response!05/21/2007 02:28:41 AM

This response from IP Address 124.144.158.136 was blocked by the owner of this blog.

Blocked Response!06/27/2007 08:45:38 AM

This response from IP Address 69.125.159.228 was blocked by the owner of this blog.

Blocked Response!06/27/2007 05:18:18 PM

This response from IP Address 68.255.24.127 was blocked by the owner of this blog.

Blocked Response!06/27/2007 09:43:27 PM

This response from IP Address 66.25.100.173 was blocked by the owner of this blog.

Blocked Response!06/28/2007 10:07:29 PM

This response from IP Address 67.82.193.36 was blocked by the owner of this blog.

Blocked Response!07/25/2007 08:46:15 PM

This response from IP Address 72.44.58.145 was blocked by the owner of this blog.

Blocked Response!09/28/2007 02:01:05 PM

This response from IP Address 72.44.50.125 was blocked by the owner of this blog.

Blocked Response!11/11/2007 10:38:22 PM

This response from IP Address 85.124.22.177 was blocked by the owner of this blog.

Blocked Response!03/08/2008 11:52:07 AM

This response from IP Address 217.141.251.202 was blocked by the owner of this blog.

Blocked Response!04/26/2008 07:21:38 AM

This response from IP Address 218.180.60.101 was blocked by the owner of this blog.

Blocked Response!05/08/2008 07:19:11 PM

This response from IP Address 194.8.75.107 was blocked by the owner of this blog.

Blocked Response!08/23/2008 02:26:34 AM

This response from IP Address 93.174.93.224 was blocked by the owner of this blog.

Blocked Response!01/22/2009 04:20:03 AM

This response from IP Address 94.229.65.171 was blocked by the owner of this blog.

Blocked Response!03/12/2009 06:13:01 AM

This response from IP Address 208.91.133.38 was blocked by the owner of this blog.

Blocked Response!03/12/2009 06:13:01 AM

This response from IP Address 208.91.133.35 was blocked by the owner of this blog.

Blocked Response!03/12/2009 06:13:02 AM

This response from IP Address 208.91.133.36 was blocked by the owner of this blog.

Blocked Response!03/12/2009 06:13:02 AM

This response from IP Address 208.91.133.38 was blocked by the owner of this blog.

Blocked Response!03/12/2009 06:13:02 AM

This response from IP Address 208.91.133.34 was blocked by the owner of this blog.

Blocked Response!03/13/2009 03:38:46 PM

This response from IP Address 208.91.133.38 was blocked by the owner of this blog.

Blocked Response!03/13/2009 03:38:46 PM

This response from IP Address 208.91.133.36 was blocked by the owner of this blog.

Blocked Response!03/13/2009 03:38:46 PM

This response from IP Address 208.91.133.35 was blocked by the owner of this blog.

Blocked Response!03/13/2009 03:38:47 PM

This response from IP Address 208.91.133.36 was blocked by the owner of this blog.

Blocked Response!03/13/2009 03:38:47 PM

This response from IP Address 208.91.133.34 was blocked by the owner of this blog.

Blocked Response!03/17/2009 01:36:07 PM