Triple Extension Executable Attachments

[Dunx]

Here's a Register piece about a new exploit to sneak executable attachments past content filters -

http://www.theregister.co.uk/content/56/29137.html

Will the FQ executable attachment filters block these?

[kitchin]

Following the Register link to http://www.messagelabs.com/viruseye/report.asp?id=130
it seems to be an Outlook Express flaw, based on filenames with lots of spaces
“malware.JPG .EXE .JPG”
(more than that)
which affects the display in OE
“malware.JPG …”

But treating it as an .exe is a OE flaw which MS should fix. Apparently Outlook is OK.

[Randall]

An up-to-date virus scanner will catch the malware (in this case, a trojan called Sadhound) when it tries to execute. But AV software can't fix the OE flaw that allows these things to slip past the content filter -- not to mention the "human filter" -- in the first place.

Still no word from Redmond...

Randall