Solved

DEFANGED......?  Virus....?

Posted on 2002-06-19
5
262 Views
Last Modified: 2013-12-11
Didn't know which category to submit this problem, so I just decided to try Win ME.

When doing an e-mail using Outlook Express and including an attachment, somehow/someway the name of the attached file gets changed. For example:

The file named:
Dock Letter.doc gets changed to: Dock Letter.4367DEFANGED-doc

Special Fund.xls gets changed to: Special Fund.97632DEFANGED-xls

I had e-mailed both of these files from work to myself at home and received both with the changed name.  The original files on the work PC appear as they were originally named.  Always seems to have 4 or 5 numbers followed by the word "DEFANGED" and the file extention preceded by a dash instead of a dot.

Suspecting perhaps a virus, at work using Mcaffee I scanned with negative results.  At home using Norton 2002, I scanned with negative results.

Any thoughts ?  Perhaps I should pose this problem in a different topic area.
0
Comment
Question by:dockboy549
  • 3
  • 2
5 Comments
 
LVL 20

Expert Comment

by:Dufo G. Belski
Comment Utility
Virus?  No, sounds more like virus prevention.  Talk to your mail administrator at work.  It sounds like you have some kind of mail scanning software which looks for certain file extensions that could contain viruses (which would certainly include .doc and.xls, because of the possibility that they could contain malicious macros) and scans\cleans them.  That's what "DEFANGED" probably means, though I have no idea which program is being used.
0
 
LVL 20

Accepted Solution

by:
Dufo G. Belski earned 100 total points
Comment Utility
Have a look here:

http://www.cuenet.com/help/email/virus/#2.0

Also here:

http://www.fes.uwaterloo.ca/computing/services/help/email/procmail.html

"procmail filter  The filter scans all incoming email traffic for attachments and if the attachment displays the signature of a known worm or virus, the message is blocked by the server. Additionally, a reply is sent to the sender indicating why their mail was rejected and suggests that they scan their system for possible worm or viral infection.

Because it is not possible to know what form a new worm or virus attachment might take, the filter also renames ("defangs") all attachments. This step prevents attached worms and viruses from being executed automatically by the system, or by a user inadvertently opening them. The filter accomplishes this by changing the name of the attached file to non-executable name. It does this by inserting a string consisting of a five digit code followed by the text "DEFANGED-", after the period in the file anem and before the original file extension.

Renaming the attachment by removing the added text restores the attachment to its original form. The attachment can then be opened in the usual way, and hopefully it will not contain any worm or virus code. If it does, the virus definitions better be up-to-date."

 
0
 

Author Comment

by:dockboy549
Comment Utility
OK This all seems reasonable, but where or what (software?) is adding the DEFANGED/MANGLED condition of the attachment ? Can DEFANGED be turned off ?
At work we're using a 4 workstation LAN with two of the workstations using only a DOS based Point of Sale software program with no access to the internet. The other 2 workstations do have access to the internet via a local ISP using dial-up connection.  The server on this LAN only has DOS installed, using DOS version of Novell's net software, and the Point of Sale software.  There is no file sharing, software sharing, printer sharing or any other sharing that might be more typical of a LAN.

Now me here at home I just have my little ole PC using a dial-up local ISP.  (The same one we use at work)
0
 
LVL 20

Expert Comment

by:Dufo G. Belski
Comment Utility
>>Now me here at home I just have my little ole PC using a >>dial-up local ISP.  (The same one we use at
>>work)

I'm no expert, but it seems to me either your company or your ISP is filtering the mail.  

Sorry I can't be more help, maybe someone else can.
0
 

Author Comment

by:dockboy549
Comment Utility
Thank-you for your response. I now have a better understanding of what defanged is all about.  I do need to find out what and how an attachment is defanged.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Storage devices are generally used to save the data or sometime transfer the data from one computer system to another system. However, sometimes user accidentally erased their important data from the Storage devices. Users have to know how data reco…
Join Greg Farro and Ethan Banks from Packet Pushers (http://packetpushers.net/podcast/podcasts/pq-show-93-smart-network-monitoring-paessler-sponsored/) and Greg Ross from Paessler (https://www.paessler.com/prtg) for a discussion about smart network …
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now