?
Solved

DEFANGED......?  Virus....?

Posted on 2002-06-19
5
Medium Priority
?
276 Views
Last Modified: 2013-12-11
Didn't know which category to submit this problem, so I just decided to try Win ME.

When doing an e-mail using Outlook Express and including an attachment, somehow/someway the name of the attached file gets changed. For example:

The file named:
Dock Letter.doc gets changed to: Dock Letter.4367DEFANGED-doc

Special Fund.xls gets changed to: Special Fund.97632DEFANGED-xls

I had e-mailed both of these files from work to myself at home and received both with the changed name.  The original files on the work PC appear as they were originally named.  Always seems to have 4 or 5 numbers followed by the word "DEFANGED" and the file extention preceded by a dash instead of a dot.

Suspecting perhaps a virus, at work using Mcaffee I scanned with negative results.  At home using Norton 2002, I scanned with negative results.

Any thoughts ?  Perhaps I should pose this problem in a different topic area.
0
Comment
Question by:dockboy549
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 20

Expert Comment

by:Dufo G. Belski
ID: 7092379
Virus?  No, sounds more like virus prevention.  Talk to your mail administrator at work.  It sounds like you have some kind of mail scanning software which looks for certain file extensions that could contain viruses (which would certainly include .doc and.xls, because of the possibility that they could contain malicious macros) and scans\cleans them.  That's what "DEFANGED" probably means, though I have no idea which program is being used.
0
 
LVL 20

Accepted Solution

by:
Dufo G. Belski earned 400 total points
ID: 7092569
Have a look here:

http://www.cuenet.com/help/email/virus/#2.0

Also here:

http://www.fes.uwaterloo.ca/computing/services/help/email/procmail.html

"procmail filter  The filter scans all incoming email traffic for attachments and if the attachment displays the signature of a known worm or virus, the message is blocked by the server. Additionally, a reply is sent to the sender indicating why their mail was rejected and suggests that they scan their system for possible worm or viral infection.

Because it is not possible to know what form a new worm or virus attachment might take, the filter also renames ("defangs") all attachments. This step prevents attached worms and viruses from being executed automatically by the system, or by a user inadvertently opening them. The filter accomplishes this by changing the name of the attached file to non-executable name. It does this by inserting a string consisting of a five digit code followed by the text "DEFANGED-", after the period in the file anem and before the original file extension.

Renaming the attachment by removing the added text restores the attachment to its original form. The attachment can then be opened in the usual way, and hopefully it will not contain any worm or virus code. If it does, the virus definitions better be up-to-date."

 
0
 

Author Comment

by:dockboy549
ID: 7094440
OK This all seems reasonable, but where or what (software?) is adding the DEFANGED/MANGLED condition of the attachment ? Can DEFANGED be turned off ?
At work we're using a 4 workstation LAN with two of the workstations using only a DOS based Point of Sale software program with no access to the internet. The other 2 workstations do have access to the internet via a local ISP using dial-up connection.  The server on this LAN only has DOS installed, using DOS version of Novell's net software, and the Point of Sale software.  There is no file sharing, software sharing, printer sharing or any other sharing that might be more typical of a LAN.

Now me here at home I just have my little ole PC using a dial-up local ISP.  (The same one we use at work)
0
 
LVL 20

Expert Comment

by:Dufo G. Belski
ID: 7094557
>>Now me here at home I just have my little ole PC using a >>dial-up local ISP.  (The same one we use at
>>work)

I'm no expert, but it seems to me either your company or your ISP is filtering the mail.  

Sorry I can't be more help, maybe someone else can.
0
 

Author Comment

by:dockboy549
ID: 7097698
Thank-you for your response. I now have a better understanding of what defanged is all about.  I do need to find out what and how an attachment is defanged.
0

Featured Post

On Demand Webinar - Networking for the Cloud Era

This webinar discusses:
-Common barriers companies experience when moving to the cloud
-How SD-WAN changes the way we look at networks
-Best practices customers should employ moving forward with cloud migration
-What happens behind the scenes of SteelConnect’s one-click button

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I was prompted to write this article after the recent World-Wide Ransomware outbreak. For years now, System Administrators around the world have used the excuse of "Waiting a Bit" before applying Security Patch Updates. This type of reasoning to me …
This article shows how to use a free utility called 'Parkdale' to easily test the performance and benchmark any Hard Drive(s) installed in your computer. We also look at RAM Disks and their speed comparisons.
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…
If you’ve ever visited a web page and noticed a cool font that you really liked the look of, but couldn’t figure out which font it was so that you could use it for your own work, then this video is for you! In this Micro Tutorial, you'll learn yo…

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question