Unreadable multipart MIME messages

[Julian Field]

At 18:12 10/01/2002, you wrote:
>It seems that check_mailscanner, or some code it is calling, is looking
>for other AV scanners. This is a snippet of my mailscanner.conf:
>
>Virus Scanner      = f-prot
>Sweep              = /usr/local/MailScanner/bin/f-protwrapper
>Minimum Code Status = beta

The path should be /usr/local/f-prot/bin/f-protwrapper.

>2. My second issue concerns unparsible messages. I have received a
>couple of messages looking somthing like this:
>
>The following e-mail messages were found to have viruses in them:
>
>    Sender: <user at abc.com>
>Recipient: userx at efg.com
>   Subject:
>MessageID: 16Oaa0-0003o3-00
>    Report: Could not parse message 16Oaa0-0003o3-00
>--
>MailScanner
>Email Virus Scanner
>
>They are multipart MIME messages containing text, html and a word
>document and is generated in Outlook Express. The mail are coming from
>legit senders. From the report sent by MailScanner to the postmaster, I
>am guessing it can't parse and disect the multipart MIME components. If
>there was a virus in the Word document, wouldn't that generate a
>different message?

It is a problem caused by certain versions of Outlook (and Outlook Express)
generating "Microsoft Outlook Rich Text Format" messages that the TNEF
decoder can't cope with.

You have a few choices: either get your users to use HTML for pretty
messages instead of Microsoft's proprietary "Outlook Rich Text Format"
(which only other copies of Outlook can read anyway), or you can make
MailScanner "Deliver Unparsable Messages" (there's an option in the
Advanced section at the bottom of mailscanner.conf to set this). Of course
setting this option means that viruses in unparsable messages cannot be
detected, but it will mean that no mail gets bounced for this reason.
--
Julian Field                Teaching Systems Manager
jkf at ecs.soton.ac.uk         Dept. of Electronics & Computer Science
Tel. 023 8059 2817          University of Southampton
                             Southampton SO17 1BJ