Re: disguised .exe files
Salvatore Toribio <[email protected]> Thu, 17 Mar 2011 10:41:45 +0100
| Newsgroups | gmane.mail.qmail.scanner |
|---|---|
| Message-ID | <a06240802c9a7867f60cf@[10.10.82.254]> |
Hi I have done a quick check to the code in the current version and I didn't find anything that would block an 'exe' file if you changed the extension... Well, I am not sure but I think that in old versions of QS it blocked this kind of files, because I have to change the extension to something like '.ex' in order to pass them through QS... I don't have time now to check the older version, maybe Jason can tell us something about this. ST At 20:03 -0300 16-03-2011, Ethy H. Brito wrote: >Hi All > >I am running some tests with QS and I may be missing something. > >It is blocking ".exe" extension files but if I take this same file and >rename it to ".gif", QS let it pass. > >Curious fact is: > >Mon, 07 Mar 2011 08:48:49 BRT:4748: found C-T attachment filename >"putty_teste.gif" >Mon, 07 Mar 2011 08:48:49 BRT:4748: w_c: attachment 8: Content-Type >of image/gif found >Mon, 07 Mar 2011 08:48:49 BRT:4748: w_c: base64 looks like a Windows >executable, filename=putty_teste.gif,type=image/gif > >As you can see, QS suspect it is a ".exe" file but take no order action. > >What am I doing wrong?? > >Regards > >Ethy ------------------------------------------------------------------------------ Colocation vs. Managed Hosting A question and answer guide to determining the best fit for your organization - today and in the future. http://p.sf.net/sfu/internap-sfd2d