Printable View
how can I delete e-mail with undesired attachments in outlook or take out the attachments with certain extensions.
I have tried using outlook security but it only blocks the attached files from being accessed or saved in outlook. The attachments are still downloaded with the e-mail. I have done this and virus e-mail attachments will still execute when the e-mail is opened.
I would appreciate any guidance.
ER... can you clarify. You say that the attachment is blocked from being downloaded then go on to say that the email still "executes when opened. If the attachment doesn't come down to you then there is nothing left to execute.
Thanks for the clarification. Since the way your system is working your best bet would be an updated anti-virus which would prevent the opening the infected file - assuming it recognizes it as an infection. Unfortunately the viruses were coming up with so many variants in such a short time recently I am beginning to believe that even this is not sufficient since the update you have is useless if the AV vendor doesn't have a signature yet for the variant you have.
I actually gave up with AV on my personal computer at home and now I simply won't open any file that has a potentially harmful extension. it's that easy really. JPG's, MPEG's etc. are fine and I'll open them quite merrily but whena frien sends me an exe, com or whatever that is potentially harmful I just delete it.... Not worth the possibility of a good laugh.
Until that .jpg is stuffed with a trojan. Then the fun and games are over.Quote:
JPG's, MPEG's etc. are fine and I'll open them quite merrily
Atticus: In so far as that is a proof of concept that, by my understanding, proved nothing more that it doesn't work, I'm not that worried..... ;)
Yes, I'm fully aware that the nature of viruses changes daily but it's going to be a long while before someone comes up with a way of infecting "harmless" files and somehow conning the OS into executing the instructions concealed within it. Now that will be a really _huge_ hole in the OS and I find it hard to believe that with the current file types and OS's this will be reliably acheived.
Now, if someone comes up with some fancy new way of packaging data that, for example, has a single file extension and the OS interprets the data and acts upon it dependant on the information held within the file itself, (displaying it as a picture, spreadsheet, database or whatever), then I can see that being a playground that is ripe for that kind of activity. However I don't believe that the software vendors are going to take that risk.
Fair enough.
I just didn`t want swj to think it was harmless to open a picture he get`s from some "supposed" chick on AOL,Just because there`s a .jpg in the ext. Then he go`s to open the picture to see what this chick looks like and *poof*nothing happens (except the trojan server download). take a look
I wasn`t trying to step on your toes...i just wanted to make that point is all.
Mike
NP. I just didn't want people to start thinking that jpg's could harm them right now. They might one day but for now I have no problem telling them "have at it" with one. The poor devils have to believe that $1000 computer they just bought is useful for something..... <LOL>
Thank you for the replies so far.
I do use symantec anti-virus on our network. It works fine. It always catches the bug. But I am worried that one day one of my users will download mail that has a virus the scanner is not ready for. The speed that these viruses are spreading is a big problem.
I want to strip file attachments that could be problems from the e-mail. The outlook security features only block attachments from user access. The attachments are still downloaded with the mail. If a user opens the e-mail with a virus packed attachment the virus is then activated.
There are products out there that you can buy to do this but I dont use an in house e-mail server and to outfit my 50+ users with special software would cost a great deal.
I am looking for any suggestions or direction that would work with MS outlook and are cost effective.
Then i suggest you get a good AV,like Tiger Shark said with the rapid spred of viruses lately it`s not 100% . But for most viruses out it will quarantine them saving you the infection. So your anti-virus(the one you have now as long as it`s updated) and some common sense is pretty good.Quote:
I want to strip file attachments that could be problems from the e-mail. The outlook security features only block attachments from user access. The attachments are still downloaded with the mail. If a user opens the e-mail with a virus packed attachment the virus is then activated
swj: My apologies. I didn't get that this wasn't a home computer you were referring to. Since it's a company environment your firewall might be able to strip all files of given extensions as the email passes through it.
I just implemented that last week here. On the upside even unrecognized viruses will not get in. On the downside, because of their potential for harm I also block mdb, mde and zip files which some of my users need. That requires me to open an FTP site, (which is something I have always avoided), so that these files can be passed backwards and forwards. But I'd rather fix one machine that sits in the DMZ than a hundred machines on the trusted network.... ;)
Take a look at the way your firewall deals with SMTP. You may find it proxies it. If it does then it may give you control over content. If it does..... Bingo...... You're in.
I think even the free version of zone alarm does just that.
Edit - I`m in no way shape or form suggesting to use Zone Alarm, I was just using that as an example.
We are putting a firewall in place next week. I wasn’t aware that it could be configured to examine e-mail communication. I will definitely look into that.
Thanks for the advice. As I am new to network administration I find that you learn much more from others on web sites like this than you would in any classroom.
There is no native way to remove files with certain attachment types from within Exchange. If you are running an Exchange AV product that uses VAPI you can specify that all files with certain exceptions be removed. Symantec, McAfee, and Trendmicro Exchange AV products all have this type of capability.Quote:
Originally posted here by swj
Thank you for the replies so far.
I do use symantec anti-virus on our network. It works fine. It always catches the bug. But I am worried that one day one of my users will download mail that has a virus the scanner is not ready for. The speed that these viruses are spreading is a big problem.
I want to strip file attachments that could be problems from the e-mail. The outlook security features only block attachments from user access. The attachments are still downloaded with the mail. If a user opens the e-mail with a virus packed attachment the virus is then activated.
There are products out there that you can buy to do this but I dont use an in house e-mail server and to outfit my 50+ users with special software would cost a great deal.
I am looking for any suggestions or direction that would work with MS outlook and are cost effective.
Not all firewalls will inspect SMTP emails looking for specific attachment types to block. In fact, most of the high end firewalls are not looking at anything above a packet level. There are certain types of SMTP "firewalls" that allow you to build what is known as an email virus firewall. This keeps all of your email scanning out at the edge of your network.Quote:
We are putting a firewall in place next week. I wasn’t aware that it could be configured to examine e-mail communication. I will definitely look into that.
I just saw this-
If you do not manage the mail server yourself there is very little that you can do to have these items removed before they ever hit the client desktop. You should ask your email vendor if they have the ability to selectively block attachments for you.Quote:
There are products out there that you can buy to do this but I dont use an in house e-mail server and to outfit my 50+ users with special software would cost a great deal.
Hi swj,
You have had some very good advice so far, so please do not think that this is a contradiction.
Have you thought about approaching it from the "opposite direction" like "I don't care what they open/download..........I will stop it from running"?
AnalogX have a thing called "script defender" I think.................not sure if it is still around........there are several others that do the same sort of thing...............I know I have one where you can modify the file extensions that it will allow to run :)
Might that be a useful "second line of defence", which is really what I am suggesting, I suppose.
If you are interested in this line of approach and cannot find what you want, please let me know and I will check out the latest versions for you.
It would help to know what OSes your users are on, as I am suggesting a "rearguard" type solution, which is on the desktop...............that is why I said do not ignore the other (server side) advice
Cheers ;)
WatchGuard firewalls use SMTP proxy and examine the content. I can't believe that they are the only one - just the only firewall appliance I have had any real experience with.