Russian text quarantined as msg-nnnnn-nn.txt

[Dustin Baer]

Hi All,

MailScanner 4.27.7 (yes, way out of date)
Sendmail 8.12.10
Solaris 9

I haven't posted in a while, and haven't been keeping up with the list
lately.  I did take a quick look through the archives, though.

I have a situation where a user in Russia is sending email with Russian
text.  The attachment is a Microsoft Word document.  The problem is that
the TEXT of the email is getting quarantined as msg-23386-15.txt.  The
Word document is passing through appropriately.

When I run `file` on the quarantined text file, it says it is a COM
file:

        # file msg-23386-15.txt
        msg-23386-15.txt:       DOS executable (COM)

The logs are as follows:

Jun 11 05:18:11 mail1 MailScanner[23386]: Filetype Checks: No
executables (i5BBHtPb023854 msg-23386-15.txt)
Jun 11 05:18:11 mail1 MailScanner[23386]: Saved entire message to
/var/spool/MailScanner/quarantine/20040611/i5BBHtPb023854
Jun 11 05:18:11 mail1 MailScanner[23386]: Saved infected
"msg-23386-15.txt" to
/var/spool/MailScanner/quarantine/20040611/i5BBHtPb023854

I have tarred the qf/df pair along with the resulting msg-23386-15.txt
file.  If anyone would like to take a look at the email and figure out
where the issue lies:
http://www.pcisys.net/~baer/MailScanner/i5BBHtPb023854.tar

Thanks,

Dustin
--
Dustin Baer
Unix Administrator/Postmaster
Information Handling Services
15 Inverness Way East
Englewood, CO 80112
303-397-2836

Confidentiality Notice: The information in this e-mail may be
confidential and / or privileged. This e-mail is intended to be reviewed
by only the individual or organization named in the e-mail address. If
you are not the intended recipient, you are hereby notified that any
review, dissemination or copying of this e-mail and attachments, if any,
or the information contained herein, is strictly prohibited.

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html