Incorrect "virus" detection?

John Goggan jgoggan at DCG.COM
Tue Jul 9 04:16:39 IST 2002


Gerry Doris wrote:
> >    Report: Attempt to hide real filename extension in evan.agenda.july.doc
> This check is to catch an annoying habit of Windows to only show the first
> extension ie note.doc when in fact the file name is note.doc.vbs (an
> executable visual basic file).  Unsuspecting receivers of such a file will
> execute the file by openning a innocent appearing .doc file.

Yes, I know what it is for...  I'm just not sure it is overly relevant and/or
worth it if I am running a decent virus scanner.

I mean, I just had a person miss a file attachment that was not infected
simply because it ended in .july.doc.  :)

> It's best to leave this option the way it is and try to avoid multiple
> extension file names...they're too dangerous in Windows.

Indeed -- it should be fairly rare, I guess.  Not many Windows people using
"." as a separator in the filename normally.

 - John...



More information about the MailScanner mailing list