Denying attachments

[Julian Field]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Is it your MailScanner replacing the viruses with the text files, or 
someone else's earlier in the mail path?
If it's your one doing it, then you probably just want to make sure you have
Silent Viruses = All-Viruses
so that virus-infected messages are just quietly dropped.

Bahadir Kiziltan wrote:

> Hi,
>
> Using MailScanner version 4.47.4 with postfix, bitdefender, clamav and 
> spam enabled on Fedora Core 4 box. Also monitoring and reporting via 
> MailWatch. The results are incredible, at least for us.
>
> I have a minor issue in denying files attached to mail messages. All 
> the files mentioned have zip extension sized below 1KB but actually 
> they're text files with the following more or less the similar content.
>
> ------
> Your attachment "mailtext.zip" contained viruses:
>         "W32.Sober.X at mm!zip",
>         and "W32.Sober.X at mm" at location "File-packed_dataInfo.exe
> It was deleted and replaced with this text file.
> ------
>
> ------
> Your attachment "downloadm.zip" contained viruses:
>         "W32.Sober.X at mm!zip",
>         and "W32.Sober.X at mm" at location "File-packed_dataInfo.exe
> It was deleted and replaced with this text file.
> ------
>
> According to the maillog, such attachment comes to the MTA as is. 
> Sure, not modified by MailScanner.
>
> Set the directive "Minimum Attachment Size" to 1024, they are all 
> denied successfully but also with the "delivered and read" 
> confirmation messages.
>
> What do you recommend in order to deny such file(s) more effectively?
>
> Thanks.
> Bahadir.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!


-- 
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!