Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

DEFANGED......?  Virus....?

Posted on 2002-06-19
5
Medium Priority
?
277 Views
Last Modified: 2013-12-11
Didn't know which category to submit this problem, so I just decided to try Win ME.

When doing an e-mail using Outlook Express and including an attachment, somehow/someway the name of the attached file gets changed. For example:

The file named:
Dock Letter.doc gets changed to: Dock Letter.4367DEFANGED-doc

Special Fund.xls gets changed to: Special Fund.97632DEFANGED-xls

I had e-mailed both of these files from work to myself at home and received both with the changed name.  The original files on the work PC appear as they were originally named.  Always seems to have 4 or 5 numbers followed by the word "DEFANGED" and the file extention preceded by a dash instead of a dot.

Suspecting perhaps a virus, at work using Mcaffee I scanned with negative results.  At home using Norton 2002, I scanned with negative results.

Any thoughts ?  Perhaps I should pose this problem in a different topic area.
0
Comment
Question by:dockboy549
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 20

Expert Comment

by:Dufo G. Belski
ID: 7092379
Virus?  No, sounds more like virus prevention.  Talk to your mail administrator at work.  It sounds like you have some kind of mail scanning software which looks for certain file extensions that could contain viruses (which would certainly include .doc and.xls, because of the possibility that they could contain malicious macros) and scans\cleans them.  That's what "DEFANGED" probably means, though I have no idea which program is being used.
0
 
LVL 20

Accepted Solution

by:
Dufo G. Belski earned 400 total points
ID: 7092569
Have a look here:

http://www.cuenet.com/help/email/virus/#2.0

Also here:

http://www.fes.uwaterloo.ca/computing/services/help/email/procmail.html

"procmail filter  The filter scans all incoming email traffic for attachments and if the attachment displays the signature of a known worm or virus, the message is blocked by the server. Additionally, a reply is sent to the sender indicating why their mail was rejected and suggests that they scan their system for possible worm or viral infection.

Because it is not possible to know what form a new worm or virus attachment might take, the filter also renames ("defangs") all attachments. This step prevents attached worms and viruses from being executed automatically by the system, or by a user inadvertently opening them. The filter accomplishes this by changing the name of the attached file to non-executable name. It does this by inserting a string consisting of a five digit code followed by the text "DEFANGED-", after the period in the file anem and before the original file extension.

Renaming the attachment by removing the added text restores the attachment to its original form. The attachment can then be opened in the usual way, and hopefully it will not contain any worm or virus code. If it does, the virus definitions better be up-to-date."

 
0
 

Author Comment

by:dockboy549
ID: 7094440
OK This all seems reasonable, but where or what (software?) is adding the DEFANGED/MANGLED condition of the attachment ? Can DEFANGED be turned off ?
At work we're using a 4 workstation LAN with two of the workstations using only a DOS based Point of Sale software program with no access to the internet. The other 2 workstations do have access to the internet via a local ISP using dial-up connection.  The server on this LAN only has DOS installed, using DOS version of Novell's net software, and the Point of Sale software.  There is no file sharing, software sharing, printer sharing or any other sharing that might be more typical of a LAN.

Now me here at home I just have my little ole PC using a dial-up local ISP.  (The same one we use at work)
0
 
LVL 20

Expert Comment

by:Dufo G. Belski
ID: 7094557
>>Now me here at home I just have my little ole PC using a >>dial-up local ISP.  (The same one we use at
>>work)

I'm no expert, but it seems to me either your company or your ISP is filtering the mail.  

Sorry I can't be more help, maybe someone else can.
0
 

Author Comment

by:dockboy549
ID: 7097698
Thank-you for your response. I now have a better understanding of what defanged is all about.  I do need to find out what and how an attachment is defanged.
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Windows Server 2003 introduced persistent Volume Shadow Copies and made 2003 a must-do upgrade.  Since then, it's been a must-implement feature for all servers doing any kind of file sharing.
In this modest contribution, I want to share with the IT community (especially system administrators, IT Support Engineers and IT Help Desks) about Windows crashes/hangs and how to deal with these particular problems.
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …
Finding and deleting duplicate (picture) files can be a time consuming task. My wife and I, our three kids and their families all share one dilemma: Managing our pictures. Between desktops, laptops, phones, tablets, and cameras; over the last decade…

609 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question