Quoted Printable

Julian Field MailScanner at ecs.soton.ac.uk
Mon Feb 21 12:15:54 GMT 2005


    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I specifically didn't make the phishing net do more than alter the
message if it needs to. If it doesn't detect a phishing attack, does it
still rebuild the message? I may well be able to stop it doing that if
it is.

Roger Jochem wrote:

>Too bad...
>
>In this case I would have to disable the Phising Detection...
>
>Could you consider doing an option of blocking, forwarding, deleting the
>phishing mails instead of changing the content of it (like spam)? The
>phishing mails found by clamav are already treated as virus, not forwarded,
>so I don't see any problem in blocking MailScanner's too... And this would
>be and option, some users would send the message with the changed body,
>another ones would block them. They could be sended to an single account
>with a modified subject like it's already done with spam, maybe
>"{Phishing?}".
>
>Another option would be to MailScanner modify only the header of the
>message, instead of the body, putting the "{Phishing?}" before the mail
>subject...
>
>
>
>>Yes. It's the message being rebuilt by MailScanner. Outlook Express
>>shouldn't be sending these things out as Quoted Printable, but use
>>base64 instead. This one is *very* hard for me to solve. We have already
>>put in an exception for most PDF files, these look like more problems.
>>
>>Roger Jochem wrote:
>>
>>
>>
>>>Hello, Julian!
>>>
>>>I made some tests with MailScanner to find out the problem with my
>>>Outlook Express Quoted Printable attachments that change size and
>>>format (between DOS and UNIX). I find out that if I disable the
>>>Phishing Detection the e-mails passes without any change to the
>>>attachment, and if I enable the Phishing Detection again, the file
>>>comes with the wrokg size and converted to Unix. Makes sense?
>>>
>>>
>>>
--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!




More information about the MailScanner mailing list