topic How to blok vbs file into zip file? in General Topics

How to blok vbs file into zip file?

Peter_Blasko — Wed, 26 Oct 2016 11:51:06 GMT

Hello, I am getting lot of files (worms) through smtp as vbs file which are put to zip file. This zip file is not encrypted. How can I block this threat.?

Re: How to blok vbs file into zip file?

SarahAtUAB — Thu, 03 Nov 2016 19:59:06 GMT

@PaloAlto

How do we request .vbs file extensions be added to the list of known file types within the file blocking function? VBE files are available but we're seeing the VBS extension.

Thanks!

Re: How to blok vbs file into zip file?

hzayed — Thu, 03 Nov 2016 21:53:49 GMT

Hi!

I believe that we don't support file type, because it does not have a special magic number to identify the content of the file as VBS. If we use the "file" command in a linux box for a VBS file type, we get the following result:
"ASCII text, with CRLF line terminators"

It would be great if you can open a TAC case and provide a zipped file (password protected - important!) containing VBS. A threat specialist can look into this and may be, we could create an IPS signature to detect VBS file within a zipped file.

Best regards,

Haytham