ANNOUNCE: Version 3.20-1 released

[Stephane Lentz]

Hi,

On Fri, Jun 14, 2002 at 11:08:25PM +0200, Ben C. O. Grimm wrote:
>
> One question though. One of our clients is running TrendMicro on his mail
> after receiving mail from our mailservers (which are all running
> FreeBSD/Perl5/Mailscanner/McAfee). This one seems to slip through on a
> consistent basis:
>
> http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=PE_MAGISTR.A
>
> Is it McAfee or Mailscanner (or a Perl-Mime module) that keeps missing this
> one? It is probably one of those curiously malformed attachments designed
> to fool the Outlook parser (if it deserves to be called that).

=> Yes, I heard that some PE_MAGISTR.A variants come in some
malformed MIME encoded message (that can be decoded by Outlook
though). I don't remember where exactly though. Anybody knows
what kind of incorrect Mime stuff is used (double headers or
\r only or something else) ?

Ben, BTW have you applied David F Skoll 's patch for Mime::Tools ?

regards,

SL/

PS:  adding support in Mailscanner for Trend Micro vscan
(included in Interscan or the Free filescanner) should be
great. I once had a look at it quickly but couldn't figure out
all the code changes. Maybe in the future I will have a look at
it again or somebody else (Nick ?) will. The tricky port is that
the exit codes are not well documented.

---
Stephane Lentz / Alcanet International - Internet Services