MailScanner quarantines Outlook "Broken apart large messages"

[Randal, Phil]

Well, you can create a rule, but bear in mind that fragmented messages
could well contain nasties which cannot be detected until the message /
attachment is reassembled in the user's mail reader.  As it's doubtful
your users will be running ClamAV / Bitdefender (for example) on their
desktops, you're courting with disaster...

in MailScanner.conf:

# Do you want to allow partial messages, which only contain a fraction
of
# the attachments, not the whole thing? There is absolutely no way to
# scan these "partial messages" properly for viruses, as MailScanner
never
# sees all of the attachment at the same time. Enabling this option can
# allow viruses through. You have been warned.
# This can also be the filename of a ruleset so you can, for example,
allow
# them in outgoing mail but not in incoming mail.
Allow Partial Messages = %rules-dir%/partial.messages.rules

I've currently got two email addresses in my partial.messages.rules
file, and that's all.

Cheers,

Phil

----
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK  

> -----Original Message-----
> From: MailScanner mailing list 
> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Kai Wang
> Sent: 02 December 2005 17:12
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: MailScanner quarantines Outlook "Broken apart large messages"
> 
> Hi,
> 
> Outlook/OutlookExpress has the "Break apart messages larger 
> than x KB" 
> option. I found MailScanner takes the broken messages as 
> "Fragmented messages cannot be scanned and are removed". Some 
> of our users are complaining about this.
> 
> --
> Kai Wang
> System Services
> Information Technologies, University of Calgary, 2500 
> University Drive, N.W., Calgary, Alberta, Canada T2N 1N4 
> Phone (403) 220-2423, Fax (403) 282-9361
> 
> ------------------------ MailScanner list 
> ------------------------ To unsubscribe, email 
> jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) 
> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 
> Support MailScanner development - buy the book off the website!
> 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!