benign three-component attachment names (Was: Re: Win32.Sircam.Worm Alert.....)

From: Cole, Timothy D. (timothy_d_cole@mail.northgrum.com)
Date: 07/27/01 

Subject: benign three-component attachment names (Was: Re: Win32.Sircam.Worm Alert.....)
From: "Cole, Timothy D." <timothy_d_cole@mail.northgrum.com>
To: vuln-dev@securityfocus.com, SECURITY-BASICS@securityfocus.com
Date: 27 Jul 2001 16:44:09 -0400
Message-Id: <996266650.11479.2.camel@w784697.md.esss.northgrum.com>

On 27 Jul 2001 12:15:49 -0400, Meritt James wrote:
> Quite a few add the extension as a way of "hiding" what is going on, not
> just Sircam. If you get an attachment with THREE groupings, assume it
> is a 'bad thing' and act appropriately. Has anyone seen a three-group
> attachment and it been ok?

*.tar.gz