FromTheRafters wrote in message
Hello,
I've been reading this group for some time now and find it both edifying and
amusing, which is a perfect combination ;-).
On this particular occasion, it is an advantage to be a native speaker of
Polish, like myself. After having made some investigations in an appropriate
Polish NG, I'm now able to answer a few of the questions which have been
asked in this thread.
This is the second time I have read about this in here. I like
this idea also.
You wouldn't, if you knew how it worked ;-)
I don't think it is an anti-virus program per se,
You score a point on this one.
but a detection of the double extension that is being detected.
Half a point this time - it's not only double extensions, the scanner takes
care of all undesirable extensions, but in a rather dumb manner (which you
and the others have actually figured out by now).
If their AV had detected a virus, it probably would have given
a name rather than just stating that it "..can contain a virus.".
It sometimes does. I was prompted in the Polish NG to send an email to an
account at Wirtualna Polska with an empty file attachment named something
like blah.pif.exe , which I did. The mail bounced. The intended recipient
wasn't notified (it goes without saying that I had obtained his consent
prior to my non-scientific tests, though ;-)). As for myself, I got a short
email from WP's auto-responder (with my original headers forwarded to me),
telling me that my message had contained I-Worm.Sircam.c, had hence not been
delivered, but removed from their server instead. I was also urged to back
up my data immediately and to install the most recent AV ;-).
The person who suggested this test to me had learnt about it due to checking
a scared customer's machine for viruses under similar circumstances (an
I-Worm.Sircam.c notification from WP's auto-responder, this time,
unfortunately, in a real environment). The machine turned out to be clean,
so after some additional testing the service person asked WP what was going
on. The sobering answer was that the scanner was just "matching" the
attachment's name to those of viruses spreading through email, and it was
indeed possible that a clean file would be recognized as a virus. WP's
advice was to choose file names which wouldn't match those of viruses. Zip
and rar archives were suggested as being safe in this regard (i.e. safe
names).
I'm not saying that the "Anti-Virus Scanner of Wirtualna Polska
mail system" isn't an AV,
Well, it obviously isn't.
I haven't got an account at Wirtualna Polska, but have had a look at their
site. The online help only states that the antivirus scanner WPSecure
protects the mail accounts against viruses, and that both incoming and
outgoing emails are being taken care of in that way. The scanner is a
built-in feature of their mail system and gets constantly updated as new
viruses appear, that's all they are willing to tell you. And they do
exaggerate.
As you know by now, this so-called protection is at best rudimentary (good
enough, perhaps, in case of spam - the recipient gets a warning and no harm
is done). It can be a source of unjustified alarm in cases like the one
described above. Someone in the Polish NG has pointed out (and I agree with
him) that in case of such false alerts from the scanner the user, especially
an inexperienced one, would tend to blame his regular AV for not being able
to detect a virus allegedly present on his machine. OTOH, after a few false
alerts of this kind, he could become unduly immunized to justified alerts
once they were there.
I somehow got to like the idea of you liking the idea of the scanner ;-) and
am now quite disappointed myself (I have even played the advocatus diaboli
in the Polish NG for a while, but there's no arguing with facts). I know
from that NG that the said scanner lets all sorts of zipped malware (Klez
and Sobig,for instance) in and out. No actual file scanning is involved,
it's just name matching. BTW, the scanner is a built-in feature, as already
said, and cannot be disabled.
A few further details can be found in my other message in this thread.
(