[Esa-l] Files to poison: Hybris

[DaveZ]

Sounds good...

I think that disallowing all *exe files would make me very
unpopular around here..

(Includung my boss...)

:0)

I do know of sites that do this and the users are always
bitchin' about the Sys Admin...

With all the knowledge and experience out there, the
Sys Admin should be able to "filter" email instead
of refusing it all together.

Sort of like having a firewall reject all traffic because
of a potential security risk on 1 port...

What do you think?

Thanks!

Dave
zarnoch at qedinfo.com

> 
> Well I think that was the point of Miguel's post today,
> 
> Not everyone wants to read alt.comp.virus all day so that the user can have
> an up-to-the minute list.  So if they want to make a cron job that will take
> advantage of a poisoned list that lots of informed people add to... well
> that sounds like a good idea to me.  Now I know that it can get complex in a
> hurry, but it does make sense.
> 
> What better way then to update your poisoned once a day/week?
> 
> Now the other side of that is that the list would have to be updated more
> often, I update my list as soon as I see a new virus name that can be
> filtered.  I don't think the master list gets updated near that often.
> 
> What do you guys think?
> Dustin Ankeny
> 
> 
> -----Original Message-----
> From: esa-l-admin at spconnect.com [mailto:esa-l-admin at spconnect.com]On
> Behalf Of Michael H. Martel
> Sent: Wednesday, December 13, 2000 12:02 PM
> To: esa-l at spconnect.com
> Subject: Re: [Esa-l] Files to poison: Hybris
> 
> 
> 
> --On Wednesday, December 13, 2000 9:55 AM -0700 Brett Glass
> <brett at lariat.org> wrote:
> 
> > If you're already poisoning *.scr, as the posted
> > "poisoned" file does, all of the .scr file names
> > in this list are redundant and will slow down your
> > scripts. I just list the exe's.
> 
> I just gave up and now poison all .exe's .  Cuts down on the new viruses.
> 
> :-)
> 
> 
> 
> Michael
> 
> --
> 
>   -------------------------------o--------------------------------
>   Michael H. Martel              | Vermont State Colleges
>   martelm at quark.vsc.edu          | Technical Support Specialist
>   http://probe.vsc.edu/~michael  | PH:802-241-2544 FX:802-241-3363
> 
> 
> _______________________________________________
> E-mail Security Announce list mailing list
> E-mail Security Announce list at spconnect.com
> http://www.spconnect.com/mailman/listinfo/esa-l
> 
> _______________________________________________
> E-mail Security Announce list mailing list
> E-mail Security Announce list at spconnect.com
> http://www.spconnect.com/mailman/listinfo/esa-l