bogus filename/type warnings, grrr

[Jeff A. Earickson]

Gang,

I have long had the following set in MailScanner.conf:

Notify Senders Of Viruses = no
Notify Senders Of Blocked Filenames Or Filetypes = yes

and I've noticed a sudden uptick in bogus filename/filetype
messages coming out of our MS because of what new viruses are
doing.  I'm loath to turn off "Notify Senders Of Blocked Filenames"
but I might have to.  Comments on this problem?  Suggestions?
Time for a ruleset here?

Jeff Earickson
Colby College

---------- Forwarded message ----------
Date: Wed, 16 Feb 2005 18:04:33 -0500 (EST)
From: MailScanner <postmaster at colby.edu>
To: postmaster at colby.edu
Subject: Warning: E-mail viruses detected

Our e-mail content detector has just been triggered by a message you sent:
   To: xxx at colby.edu
   Subject:
   Date: Wed Feb 16 18:04:33 2005

One or more of the attachments (letter.zip, letter.html   .pif) are on
the list of unacceptable attachments for this site and will not have
been delivered.

Consider renaming the files to avoid this constraint.

The virus detector said this about the message:
Report: MailScanner: Very long filenames are good signs of attacks against Microsoft e-mail packages (letter.html   .pif)
Report: MailScanner: Very long filenames are good signs of attacks against Microsoft e-mail packages (letter.html   .pif)


--
MailScanner
Email Virus Scanner
Colby College Information Technology Services
www.colby.edu/info.tech

MailScanner thanks transtec Computers for their support

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!