[Esd-l] Hmmm...Very interesting

[Smart,Dan]

Classification: PUBLIC

I know there were hoaxes around about .mp3 viruses.  Do these thing really
exist?  Can you give me an article on how they work from Symantec, McAfee or
the like?

<<Dan>>

|-----Original Message-----
|From: Murray Crane [mailto:mcrane at longbridge.com] 
|Sent: Thursday, November 21, 2002 4:01 AM
|To: Eric Brosius
|Cc: ESD-L
|Subject: Re: [Esd-l] Hmmm...Very interesting
|
|
|Eric,
|
|On Wed, 20 Nov 2002 15:50:57 -0500, Eric Brosius wrote:
|
|>I'm running sanitizer ver 1.133 and a virus came in today, but it was 
|>buried in attachments (i.e. nested attachment and the virus was the 
|>last one).  It was a .mp3 file, so I added *.mp3 to the 
|poisoned-files 
|>list and tested sending a .mp3 file and it wasn't stopped.  
|So I added 
|>it in as a managed attachment.  Why didn't it get stopped??  
|Thanks for 
|>the info.
|
|You need to add *.mp3 to *both* MANGLE_EXTENSIONS and 
|POISONED_EXECUTABLES to have them poisoned.  Suffered at the 
|hands of that one particular problem myself a while back.
|
|If memory serves me, it does mention this "feature" on the 
|sanitizer web pages.
|
|Kind regards
|
|Murray Crane			Tel: +44 (0)20 7208 5858
|Network Systems Administrator	Fax: +44 (0)20 7208 5859
|Longbridge International Plc		http://www.longbridge.com
|
|=====
|If you receive a non-delivery report [NDR] or "bounce" as a result of 
|a reply to this message, please forward it to 
|gracechurchstreet at hotmail.com 
|(including full Internet headers if at all possible) so that 
|Longbridge 
|International IT support staff can diagnose the cause and correct it.
|
|PGP Public Key Fingerprint: D5C2 0387 608B 3283  FFD7 A042 
|72A5 AB5A _______________________________________________
|Esd-l mailing list
|Esd-l at spconnect.com http://www.spconnect.com/mailman/listinfo/esd-l
|