Knowledgebase

Virus Checking and Spam Tagging

We currently run MailScanner/Spam Assassin to scan all incoming email for viruses and spam.:

The MailScanner setup blocks the delivery of e-mail messages with viral payloads, attachments containing certain proscribed file types and attachments with certain proscribed filename extensions. Also, each e-mail message is processed by SpamAssassin and, depending on the total score assigned, is handled accordingly. The prefix {Spam?} is added to the contents of the Subject: header line of mail that has a probabilityof being spam, and mail that has a high certainty of being spam is deleted without being delivered.

The prefix {Disarmed} is added to the contents of the Subject header line of mail that in which MailScanner has disarmed' certain HTML tags. The tags that are impacted are tags and <img> tags that are thought to be WebBugs. WebBugs are very small images used to track whether a messages has been read and IFrames allow various Microsoft Outlook security vulnerabilities to remain unprotected (but are commonly used in Mailing Lists). <hr width="90%" size="1" noshade="noshade" /> Below is the list of the filename and filetype rules that are filtered out due to possible virus infection: Filename rules: Files with very long filenames (over 150 characters) Filenames that contains lots of whitespace (over 10 characters in a row) Filenames trying to hide its real extension by adding a CLSID (e.g. {testhta.txt.{3050F4D8-98B5-11CF-BB82-00AA00BDCE0B}) pretty park.exe "Pretty Park" virus happy99.exe "Happy" virus webpage.rar I-Worm.Yanker virus attachment <table border="0" cellspacing="0" cellpadding="4" width="100%"> <tbody> <tr height="17" bgcolor="#cccccc"> <td height="17"> *.ani </td> <td height="17"> Possible buffer overflow in Windows (Windows animated cursor file) </td> </tr> <tr height="17" bgcolor="#cccccc"> <td width="31%" height="17"> *.bat, </td> <td width="69%" height="17"> Possible malicious batch file script </td> </tr> <tr height="17" bgcolor="#cccccc"> <td height="17"> *.bmp </td> <td height="17"> Possible buffer overflow in Windows (Windows bitmap file) </td> </tr> <tr height="17" bgcolor="#cccccc"> <td height="17"> *.ceo </td> <td height="17"> WinEvar virus attachment </td> </tr> <tr height="17"> <td height="17" bgcolor="#ffffff"> *.chm </td> <td height="17" bgcolor="#ffffff"> Possible compiled Help file-based virus </td> </tr> <tr height="17"> <td height="17" bgcolor="#ffffff"> *.cmd </td> <td height="17" bgcolor="#ffffff"> Possible malicious batch file script </td> </tr> <tr height="17" bgcolor="#cccccc"> <td height="17"> *.cnf </td> <td height="17"> Possible SpeedDial attack </td> </tr> <tr height="17" bgcolor="#cccccc"> <td height="17"> *.com </td> <td height="17"> Windows/DOS Executable </td> </tr> <tr height="17"> <td height="17" bgcolor="#ffffff"> *.cpl </td> <td height="17" bgcolor="#ffffff"> Possible malicious control panel item </td> </tr> <tr height="17"> <td height="17" bgcolor="#ffffff"> *.cur </td> <td height="17" bgcolor="#ffffff"> Possible buffer overflow in Windows (Windows cursor file) </td> </tr> <tr height="17"> <td height="17" bgcolor="#ffffff"> *.exe </td> <td height="17" bgcolor="#ffffff"> Windows/DOS Executable </td> </tr> <tr height="17" bgcolor="#cccccc"> <td height="17"> *.hlp </td> <td height="17"> Possible buffer overflow in Windows (Windows help file) </td> </tr> <tr height="17" bgcolor="#cccccc"> <td height="17"> *.hta </td> <td height="17"> Possible Microsoft HTML archive attack </td> </tr> <tr height="17" bgcolor="#cccccc"> <td height="17"> *.ico </td> <td height="17"> Possible buffer overflow in Windows (Windows icon file) </td> </tr> <tr height="17" bgcolor="#cccccc"> <td height="17"> *.ins </td> <td height="17"> Possible Microsoft Internet Comm. Settings attack </td> </tr> <tr height="17"> <td height="17" bgcolor="#ffffff"> *.its </td> <td height="17" bgcolor="#ffffff"> Dangerous Internet Document Set (according to Microsoft Q883260) </td> </tr> <tr height="17"> <td height="17" bgcolor="#ffffff"> *.job </td> <td height="17" bgcolor="#ffffff"> Possible Microsoft Task Scheduler attack </td> </tr> <tr height="17" bgcolor="#cccccc"> <td height="17"> *.jse </td> <td height="17"> Possible Microsoft JScript attack </td> </tr> <tr height="17" bgcolor="#cccccc"> <td height="17"> *.lnk </td> <td height="17"> Possible Eudora *.lnk security hole attack </td> </tr> <tr height="17"> <td height="17" bgcolor="#ffffff"> *.mad, *.maf, *.mag, *.mam, *.maq, *.mar, *.mas, *.mat, *.mav, *.maw </td> <td height="17" bgcolor="#ffffff"> Possible Microsoft Access Shortcut attack </td> </tr> <tr height="17"> <td height="17" bgcolor="#ffffff"> *.mau </td> <td height="17" bgcolor="#ffffff"> Dangerous attachment type (according to Microsoft Q883260) </td> </tr> <tr height="17" bgcolor="#cccccc"> <td height="17"> *.mda, *.mdz </td> <td height="17"> Dangerous attachment type (according to Microsoft Q883260) </td> </tr> <tr height="17" bgcolor="#cccccc"> <td height="17"> *.mhtml </td> <td height="17"> Possible Eudora meta-refresh attack </td> </tr> <tr height="17"> <td height="17" bgcolor="#ffffff"> *.pif </td> <td height="17" bgcolor="#ffffff"> Possible MS-Dos program shortcut attack </td> </tr> <tr height="17"> <td height="17" bgcolor="#ffffff"> *.prf </td> <td height="17" bgcolor="#ffffff"> Dangerous Outlook Profile Settings (according to Microsoft Q883260) </td> </tr> <tr height="17" bgcolor="#cccccc"> <td height="17"> *.pst </td> <td height="17"> Dangerous Office Data File (according to Microsoft Q883260) </td> </tr> <tr height="17" bgcolor="#cccccc"> <td height="17"> *.reg </td> <td height="17"> Possible Windows registry attack </td> </tr> <tr height="17"> <td height="17" bgcolor="#ffffff"> *.scf </td> <td height="17" bgcolor="#ffffff"> Possible Windows Explorer Command attack </td> </tr> <tr height="17"> <td height="17" bgcolor="#ffffff"> *.sct </td> <td height="17" bgcolor="#ffffff"> Possible Microsoft Windows Script Component attack </td> </tr> <tr height="17" bgcolor="#cccccc"> <td height="17"> *.shb </td> <td height="17"> Possible document shortcut attack </td> </tr> <tr height="17" bgcolor="#cccccc"> <td height="17"> *.shs </td> <td height="17"> Possible Shell Scrap Object attack </td> </tr> <tr height="17"> <td height="17" bgcolor="#ffffff"> *.scr </td> <td height="17" bgcolor="#ffffff"> Possible virus hidden in a screensaver </td> </tr> <tr height="17"> <td height="17" bgcolor="#ffffff"> *.tmp </td> <td height="17" bgcolor="#ffffff"> Dangerous Temporary File (according to Microsoft Q883260) </td> </tr> <tr height="17" bgcolor="#cccccc"> <td height="17"> *.vbe, *.vbs </td> <td height="17"> Possible Microsoft Visual Basic script attack </td> </tr> <tr height="17" bgcolor="#cccccc"> <td height="17"> *.vsmacros </td> <td height="17"> Dangerous Visual Studio Macros (according to Microsoft Q883260) </td> </tr> <tr height="17"> <td height="17" bgcolor="#ffffff"> *.vss, *.vst, *.vsw </td> <td height="17" bgcolor="#ffffff"> Dangerous attachment type (according to Microsoft Q883260) </td> </tr> <tr height="17"> <td height="17" bgcolor="#ffffff"> </td> <td height="17" bgcolor="#ffffff"> </td> </tr> <tr height="17" bgcolor="#cccccc"> <td height="17"> *.ws </td> <td height="17"> Dangerous Windows Script (according to Microsoft Q883260) </td> </tr> <tr height="17" bgcolor="#cccccc"> <td height="17"> *.wsc, *.wsf, *.wsh </td> <td height="17"> Possible Microsoft Windows Script Host attack </td> </tr> <tr height="17"> <td height="17" bgcolor="#ffffff"> *.xnk </td> <td height="17" bgcolor="#ffffff"> Possible Microsoft Exchange Shortcut attack </td> </tr> </tbody> </table> File type rules: self-extract -- No self-extracting archives ELF -- No executables executable -- No executables MPEG -- No MPEG movies AVI -- No AVI movies MNG -- No MNG/PNG movies QuickTime -- No QuickTime movies Registry -- No Windows Registry entries ** Please keep your anti-virus software updated. The MailScanner should not be used as the sole means of blocking computer viruses on your computer. </div> </div> </td> </tr> </tbody> </table>

Add to Favourites

Print this Article