Rules

[Jose Julian Buda]

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

so why this message pass through the mailscanning proccess?

should i remove this ruleset and scan everything for security reason?






----- Original Message -----
From: "Julian Field" <mailscanner at ECS.SOTON.AC.UK>
To: <MAILSCANNER at JISCMAIL.AC.UK>
Sent: Wednesday, December 29, 2004 12:17 PM
Subject: Re: Rules


If any of the recipients requested scanning, then the message is
scanned. A message with many recipients is treated as one message.

Jose Julian Buda wrote:

> i have postfix+mailscanner+clamav
>
> i have just this rules Virus Scanning ruleset :
>
> ...
> FromOrTO :  myboss at noticiasargentinas.com
> <mailto:myboss at noticiasargentinas.com>  no
> FromOrTO :  myboss at noticiasargentinas.com.ar
> <mailto:myboss at noticiasargentinas.com.ar>  no
> FromOrTO :  default  yes
> ...
>
>
> to not scan the myboss mailbox...
> but today happen that i recieve an email whit virus on
> jbuda at noticiasargentinas.com <mailto:jbuda at noticiasargentinas.com>
> seeing the email source and the email id i saw that really the
> mail-scanning procces was bypassed
> because an email was sent To:myboss with bcc to jbuda
> is that posible?
> the address on bcc field are not scanned if the "To:" field is seted
> to be bypassed?
>  or am i missing something?

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!