Outlook Express 6.0 and False Virus Warnings

[Julian Field]

Run the "file" command on the attachment file. It is being rejected by the
file type checks, i.e. one of the rules in filetype.rules.conf. Then add an
"allow" rule for the output you get from "file".

At 19:05 07/05/2004, you wrote:
>Hi all,
>
>I have an employee who is using OE 6.0. Whe she tries to
>attach a file to an email and send it, she and I receive the following
>information that a virus has been detected:
>
>The following e-mail messages were found to have viruses in them:
>
>     Sender: kendra at loanprocessing.net
>IP Address: 192.168.1.61
>  Recipient: mcarlson at bridgecap.com
>    Subject: Fw: File Number 12234439  HUD-1 for Hoang (Tac)
>  MessageID: i47H0cLb029178
>     Report: MailScanner: No programs allowed (msg-24336-96.txt)
>
>
>However, if you look at msg-24336-96.txt it contains the body of her
>email. See below:
>
>
>HUD-1
>----- Original Message -----
>From: "Vivian Sellers" <vsellers at atc-ca.com>
>To: <kendra at loanprocessing.net>
>Sent: Friday, May 07, 2004 9:51 AM
>Subject: File Number 12234439 HUD-1 for Hoang (Tac)
>
>
> > <<ATTACHMENT1.doc>>
> >
>
>We all run Norton Anti-virus on desktops so I'm pretty certain there isn't
>any virus in this message body. I pulled it up in VI and it's just plain text.
>
>We are using MS 4.29.7-1 on FC1. Anybody have an idea what might be
>occuring here? No one else in the office is having this problem.
>
>TIA,
>
>Mike
>
>-------------------------- MailScanner list ----------------------
>To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
>Before posting, please see the Most Asked Questions at
>http://www.mailscanner.biz/maq/     and the archives at
>http://www.jiscmail.ac.uk/lists/mailscanner.html

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html