mailscanner is not processing virus mails of the same kind the same way

[Antony Stone]

On Thursday 21 August 2003 9:33 am, Kim Schulz wrote:

> On Thu, 21 Aug 2003 09:26:52 +0100 Antony Stone wrote:
> >
> > Message PAA31834 identified as containing Sobig.F in application.pif
> > Message QAA03813 contains a .txt attachment, which probably contains a
> > bounce message, itself containing a .pif attachment which is infected
> > with Sobig.F
> > Message QAA03969 identified as containing Sobig.F in application.pif
> > Message QAA04585 identified as containing Sobig.F in application.pif
> >
> > Three were original messages and one was a non-delivery bounce.
>
> The lines i pasted was actually more to show that mailscanner couldn't
> decide  whether to call the message a filename atack or a virus atack.

Well, that depends on the name of the attachment :)   If the attachment if
called application.pif, then it will get marked as infected, and as a bad
filetype.   If the attachment is called msg-982-17.txt then it won't be
marked as a bad filetype, just infected.

Antony.

--

How I want a drink, alcoholic of course, after the heavy chapters
involving quantum mechanics.

 - 3.14159265358979