Quoted Printable

[Julian Field]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

So what was the change you perceived between the prior version and the
current version?
Just want to double-check that you think it has changed.

Roger Jochem wrote:

>But in the prior version, I was with HTML Content on, and just disabling the
>phishing net solved my problem...
>
>This version is making the same, with the phishing net enabled the files are
>changing sizes... Disabling it solves the problem...
>
>----- Original Message -----
>From: "Julian Field" <MailScanner at ECS.SOTON.AC.UK>
>To: <MAILSCANNER at JISCMAIL.AC.UK>
>Sent: Monday, February 21, 2005 3:18 PM
>Subject: Re: Quoted Printable
>
>
>
>
>>Yes. But to be sure you will have to switch off all the HTML content
>>
>>
>checks.
>
>
>>Roger Jochem wrote:
>>
>>
>>
>>>In 4.39.2-1? I downloaded it about an hour ago...
>>>
>>>
>>>----- Original Message -----
>>>From: "Julian Field" <MailScanner at ECS.SOTON.AC.UK>
>>>To: <MAILSCANNER at JISCMAIL.AC.UK>
>>>Sent: Monday, February 21, 2005 11:42 AM
>>>Subject: Re: Quoted Printable
>>>
>>>
>>>
>>>
>>>
>>>
>>>>It should already be doing that. It watches to see if it actually
>>>>applies the phishing messages to the email, and only then does it mark
>>>>the message for rebuild.
>>>>
>>>>Roger Jochem wrote:
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>>This could work too...
>>>>>
>>>>>These messages didn't have any phishing attack on it. If they weren't
>>>>>rebuild, this would solve the problem...
>>>>>
>>>>>----- Original Message -----
>>>>>From: "Julian Field" <MailScanner at ECS.SOTON.AC.UK>
>>>>>To: <MAILSCANNER at JISCMAIL.AC.UK>
>>>>>Sent: Monday, February 21, 2005 9:15 AM
>>>>>Subject: Re: Quoted Printable
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>>I specifically didn't make the phishing net do more than alter the
>>>>>>message if it needs to. If it doesn't detect a phishing attack, does
>>>>>>
>>>>>>
>it
>
>
>>>>>>still rebuild the message? I may well be able to stop it doing that if
>>>>>>it is.
>>>>>>
>>>>>>Roger Jochem wrote:
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>>Too bad...
>>>>>>>
>>>>>>>In this case I would have to disable the Phising Detection...
>>>>>>>
>>>>>>>Could you consider doing an option of blocking, forwarding, deleting
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>the
>>>
>>>
>>>
>>>
>>>>>>>phishing mails instead of changing the content of it (like spam)? The
>>>>>>>phishing mails found by clamav are already treated as virus, not
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>forwarded,
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>>>so I don't see any problem in blocking MailScanner's too... And this
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>would
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>>>be and option, some users would send the message with the changed
>>>>>>>
>>>>>>>
>body,
>
>
>>>>>>>another ones would block them. They could be sended to an single
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>account
>>>
>>>
>>>
>>>
>>>>>>>with a modified subject like it's already done with spam, maybe
>>>>>>>"{Phishing?}".
>>>>>>>
>>>>>>>Another option would be to MailScanner modify only the header of the
>>>>>>>message, instead of the body, putting the "{Phishing?}" before the
>>>>>>>
>>>>>>>
>mail
>
>
>>>>>>>subject...
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>>Yes. It's the message being rebuilt by MailScanner. Outlook Express
>>>>>>>>shouldn't be sending these things out as Quoted Printable, but use
>>>>>>>>base64 instead. This one is *very* hard for me to solve. We have
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>already
>>>
>>>
>>>
>>>
>>>>>>>>put in an exception for most PDF files, these look like more
>>>>>>>>
>>>>>>>>
>problems.
>
>
>>>>>>>>Roger Jochem wrote:
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>>Hello, Julian!
>>>>>>>>>
>>>>>>>>>I made some tests with MailScanner to find out the problem with my
>>>>>>>>>Outlook Express Quoted Printable attachments that change size and
>>>>>>>>>format (between DOS and UNIX). I find out that if I disable the
>>>>>>>>>Phishing Detection the e-mails passes without any change to the
>>>>>>>>>attachment, and if I enable the Phishing Detection again, the file
>>>>>>>>>comes with the wrokg size and converted to Unix. Makes sense?
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>--
>>>>>>Julian Field
>>>>>>www.MailScanner.info
>>>>>>Buy the MailScanner book at www.MailScanner.info/store
>>>>>>
>>>>>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>>>>>
>>>>>>------------------------ MailScanner list ------------------------
>>>>>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>>>>>'leave mailscanner' in the body of the email.
>>>>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>>>
>>>>>>Support MailScanner development - buy the book off the website!
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>------------------------ MailScanner list ------------------------
>>>>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>>>>'leave mailscanner' in the body of the email.
>>>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>>
>>>>>Support MailScanner development - buy the book off the website!
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>--
>>>>Julian Field
>>>>www.MailScanner.info
>>>>Buy the MailScanner book at www.MailScanner.info/store
>>>>
>>>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>>>
>>>>------------------------ MailScanner list ------------------------
>>>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>>>'leave mailscanner' in the body of the email.
>>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>
>>>>Support MailScanner development - buy the book off the website!
>>>>
>>>>
>>>>
>>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>>
>>>
>>>
>>>
>>>
>>--
>>Julian Field
>>www.MailScanner.info
>>Buy the MailScanner book at www.MailScanner.info/store
>>Professional Support Services at www.MailScanner.biz
>>MailScanner thanks transtec Computers for their support
>>
>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!