Attachments with denied extensions aren't being blocked

[David Pollard]

Hi There,

I am having problems with denying file attachments of specified types
getting past my MailScanner.

They are getting blocked further down the track but I would like my
front line of defence to catch them.

 

I first noticed this when the Netsky virus was getting through (.pif)
but following some testing I realised that ALL files with denied
attachments aren't being blocked.

I tried .bat, .pif and .exe and they all got blocked by Outlook and not
my MailScanner.

 

I checked my filename.rules.conf file and it looks good.

Just in case I had something wrong with the file I typed the .pif line
again but that didn't help.

 

I check my MailScanner.conf file and it seems to specify the
filename.rules.conf file correctly.

 

I have made very few changes to these files from the defaults.

 

I'm (almost) sure this used to work and I haven't touched the
configuration for ages.

 

I also notice that no new viruses have been added to my quarantine area
for about a month and a half.

My workstation antivirus software has been blocking NETSKY variants
lately.

 

On Red Hat Linux Version 9

 

I'm running   MailScanner version

MailScanner E-Mail Virus Scanner version 4.25-13 starting...

 

 

I have added the -r flag to Syslog as specified in the doco and
restarted the syslog daemon but a ps still looks like this.

root      4561     1  0 13:02 ?        00:00:00 syslogd -m 0

 

I'm not sure of the correct syntax to add this?

SYSLOGD_OPTIONS="-r -m 0"

 

The above message is the only MailScanner message I see in my logs.

 

Any ideas on what could be going on here?

I'll attach my config files or send them directly if that are likely to
be of any use.

 


-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
For further info about MailScanner, please see the Most Asked
Questions at    http://www.mailscanner.biz/maq/     and the archives
at    http://www.jiscmail.ac.uk/lists/mailscanner.html
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20040427/99ab34d3/attachment.html