Denying attachments

[Bahadir Kiziltan]

No, they're changed somehow before arriving to my MS.

"Silent Viruses" directive has already been set as you suggested.

Can MS replace the infected files with the text content?


>From: Julian Field <MailScanner at ECS.SOTON.AC.UK>
>Reply-To: MailScanner mailing list <MAILSCANNER at JISCMAIL.AC.UK>
>To: MAILSCANNER at JISCMAIL.AC.UK
>Subject: Re: Denying attachments
>Date: Tue, 13 Dec 2005 17:24:50 +0000
>
>Is it your MailScanner replacing the viruses with the text files, or 
>someone else's earlier in the mail path?
>If it's your one doing it, then you probably just want to make sure you 
>have
>Silent Viruses = All-Viruses
>so that virus-infected messages are just quietly dropped.
>
>Bahadir Kiziltan wrote:
>
>>Hi,
>>
>>Using MailScanner version 4.47.4 with postfix, bitdefender, clamav and 
>>spam enabled on Fedora Core 4 box. Also monitoring and reporting via 
>>MailWatch. The results are incredible, at least for us.
>>
>>I have a minor issue in denying files attached to mail messages. All the 
>>files mentioned have zip extension sized below 1KB but actually they're 
>>text files with the following more or less the similar content.
>>
>>------
>>Your attachment "mailtext.zip" contained viruses:
>>         "W32.Sober.X at mm!zip",
>>         and "W32.Sober.X at mm" at location "File-packed_dataInfo.exe
>>It was deleted and replaced with this text file.
>>------
>>
>>------
>>Your attachment "downloadm.zip" contained viruses:
>>         "W32.Sober.X at mm!zip",
>>         and "W32.Sober.X at mm" at location "File-packed_dataInfo.exe
>>It was deleted and replaced with this text file.
>>------
>>
>>According to the maillog, such attachment comes to the MTA as is. Sure, 
>>not modified by MailScanner.
>>
>>Set the directive "Minimum Attachment Size" to 1024, they are all denied 
>>successfully but also with the "delivered and read" confirmation messages.
>>
>>What do you recommend in order to deny such file(s) more effectively?
>>
>>Thanks.
>>Bahadir.
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>
>
>--
>Julian Field
>www.MailScanner.info
>Buy the MailScanner book at www.MailScanner.info/store
>Professional Support Services at www.MailScanner.biz
>MailScanner thanks transtec Computers for their support
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>
>--
>This message has been scanned for viruses and
>dangerous content by MailScanner, and is
>believed to be clean.
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the Wiki (http://wiki.mailscanner.info/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!