Quoted Printable

Mon Feb 21 18:39:49 GMT 2005

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Yes. I was just saying about the parameters that changed with this
release... To prove I upgraded...

I didn't understood your question before. I didn't perceived any change
regarding the phishing detection between this version and the prior one...

----- Original Message -----
From: "Julian Field" <MailScanner at ECS.SOTON.AC.UK>
To: <MAILSCANNER at JISCMAIL.AC.UK>
Sent: Monday, February 21, 2005 3:36 PM
Subject: Re: Quoted Printable

> But I thought your subject was to do with phishing problems and message
> rebuild. This doesn't appear at first glance to be connected with clamav
> module parameters.
>
> Roger Jochem wrote:
>
> >There are new parameters about clamav module in the instalation...
> >
> >----- Original Message -----
> >From: "Julian Field" <MailScanner at ECS.SOTON.AC.UK>
> >To: <MAILSCANNER at JISCMAIL.AC.UK>
> >Sent: Monday, February 21, 2005 3:28 PM
> >Subject: Re: Quoted Printable
> >
> >
> >
> >
> >>So what was the change you perceived between the prior version and the
> >>current version?
> >>Just want to double-check that you think it has changed.
> >>
> >>Roger Jochem wrote:
> >>
> >>
> >>
> >>>But in the prior version, I was with HTML Content on, and just
disabling
> >>>
> >>>
> >the
> >
> >
> >>>phishing net solved my problem...
> >>>
> >>>This version is making the same, with the phishing net enabled the
files
> >>>
> >>>
> >are
> >
> >
> >>>changing sizes... Disabling it solves the problem...
> >>>
> >>>----- Original Message -----
> >>>From: "Julian Field" <MailScanner at ECS.SOTON.AC.UK>
> >>>To: <MAILSCANNER at JISCMAIL.AC.UK>
> >>>Sent: Monday, February 21, 2005 3:18 PM
> >>>Subject: Re: Quoted Printable
> >>>
> >>>
> >>>
> >>>
> >>>
> >>>
> >>>>Yes. But to be sure you will have to switch off all the HTML content
> >>>>
> >>>>
> >>>>
> >>>>
> >>>checks.
> >>>
> >>>
> >>>
> >>>
> >>>>Roger Jochem wrote:
> >>>>
> >>>>
> >>>>
> >>>>
> >>>>
> >>>>>In 4.39.2-1? I downloaded it about an hour ago...
> >>>>>
> >>>>>
> >>>>>----- Original Message -----
> >>>>>From: "Julian Field" <MailScanner at ECS.SOTON.AC.UK>
> >>>>>To: <MAILSCANNER at JISCMAIL.AC.UK>
> >>>>>Sent: Monday, February 21, 2005 11:42 AM
> >>>>>Subject: Re: Quoted Printable
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>>>It should already be doing that. It watches to see if it actually
> >>>>>>applies the phishing messages to the email, and only then does it
mark
> >>>>>>the message for rebuild.
> >>>>>>
> >>>>>>Roger Jochem wrote:
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>>This could work too...
> >>>>>>>
> >>>>>>>These messages didn't have any phishing attack on it. If they
weren't
> >>>>>>>rebuild, this would solve the problem...
> >>>>>>>
> >>>>>>>----- Original Message -----
> >>>>>>>From: "Julian Field" <MailScanner at ECS.SOTON.AC.UK>
> >>>>>>>To: <MAILSCANNER at JISCMAIL.AC.UK>
> >>>>>>>Sent: Monday, February 21, 2005 9:15 AM
> >>>>>>>Subject: Re: Quoted Printable
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>>I specifically didn't make the phishing net do more than alter the
> >>>>>>>>message if it needs to. If it doesn't detect a phishing attack,
does
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>it
> >>>
> >>>
> >>>
> >>>
> >>>>>>>>still rebuild the message? I may well be able to stop it doing
that
> >>>>>>>>
> >>>>>>>>
> >if
> >
> >
> >>>>>>>>it is.
> >>>>>>>>
> >>>>>>>>Roger Jochem wrote:
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>>Too bad...
> >>>>>>>>>
> >>>>>>>>>In this case I would have to disable the Phising Detection...
> >>>>>>>>>
> >>>>>>>>>Could you consider doing an option of blocking, forwarding,
> >>>>>>>>>
> >>>>>>>>>
> >deleting
> >
> >
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>the
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>>>>>>phishing mails instead of changing the content of it (like spam)?
> >>>>>>>>>
> >>>>>>>>>
> >The
> >
> >
> >>>>>>>>>phishing mails found by clamav are already treated as virus, not
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>forwarded,
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>>>so I don't see any problem in blocking MailScanner's too... And
> >>>>>>>>>
> >>>>>>>>>
> >this
> >
> >
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>would
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>>>be and option, some users would send the message with the changed
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>body,
> >>>
> >>>
> >>>
> >>>
> >>>>>>>>>another ones would block them. They could be sended to an single
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>account
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>>>>>>with a modified subject like it's already done with spam, maybe
> >>>>>>>>>"{Phishing?}".
> >>>>>>>>>
> >>>>>>>>>Another option would be to MailScanner modify only the header of
> >>>>>>>>>
> >>>>>>>>>
> >the
> >
> >
> >>>>>>>>>message, instead of the body, putting the "{Phishing?}" before
the
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>mail
> >>>
> >>>
> >>>
> >>>
> >>>>>>>>>subject...
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>>Yes. It's the message being rebuilt by MailScanner. Outlook
> >>>>>>>>>>
> >>>>>>>>>>
> >Express
> >
> >
> >>>>>>>>>>shouldn't be sending these things out as Quoted Printable, but
use
> >>>>>>>>>>base64 instead. This one is *very* hard for me to solve. We have
> >>>>>>>>>>
> >>>>>>>>>>
> >>>>>>>>>>
> >>>>>>>>>>
> >>>>>>>>>>
> >>>>>>>>>>
> >>>>>already
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>>>>>>>put in an exception for most PDF files, these look like more
> >>>>>>>>>>
> >>>>>>>>>>
> >>>>>>>>>>
> >>>>>>>>>>
> >>>problems.
> >>>
> >>>
> >>>
> >>>
> >>>>>>>>>>Roger Jochem wrote:
> >>>>>>>>>>
> >>>>>>>>>>
> >>>>>>>>>>
> >>>>>>>>>>
> >>>>>>>>>>
> >>>>>>>>>>
> >>>>>>>>>>
> >>>>>>>>>>
> >>>>>>>>>>
> >>>>>>>>>>
> >>>>>>>>>>
> >>>>>>>>>>>Hello, Julian!
> >>>>>>>>>>>
> >>>>>>>>>>>I made some tests with MailScanner to find out the problem with
> >>>>>>>>>>>
> >>>>>>>>>>>
> >my
> >
> >
> >>>>>>>>>>>Outlook Express Quoted Printable attachments that change size
and
> >>>>>>>>>>>format (between DOS and UNIX). I find out that if I disable the
> >>>>>>>>>>>Phishing Detection the e-mails passes without any change to the
> >>>>>>>>>>>attachment, and if I enable the Phishing Detection again, the
> >>>>>>>>>>>
> >>>>>>>>>>>
> >file
> >
> >
> >>>>>>>>>>>comes with the wrokg size and converted to Unix. Makes sense?
> >>>>>>>>>>>
> >>>>>>>>>>>
> >>>>>>>>>>>
> >>>>>>>>>>>
> >>>>>>>>>>>
> >>>>>>>>>>>
> >>>>>>>>>>>
> >>>>>>>>>>>
> >>>>>>>>>>>
> >>>>>>>>>>>
> >>>>>>>>>>>
> >>>>>>>>--
> >>>>>>>>Julian Field
> >>>>>>>>www.MailScanner.info
> >>>>>>>>Buy the MailScanner book at www.MailScanner.info/store
> >>>>>>>>
> >>>>>>>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> >>>>>>>>
> >>>>>>>>------------------------ MailScanner list ------------------------
> >>>>>>>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> >>>>>>>>'leave mailscanner' in the body of the email.
> >>>>>>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> >>>>>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >>>>>>>>
> >>>>>>>>Support MailScanner development - buy the book off the website!
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>------------------------ MailScanner list ------------------------
> >>>>>>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> >>>>>>>'leave mailscanner' in the body of the email.
> >>>>>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> >>>>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >>>>>>>
> >>>>>>>Support MailScanner development - buy the book off the website!
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>--
> >>>>>>Julian Field
> >>>>>>www.MailScanner.info
> >>>>>>Buy the MailScanner book at www.MailScanner.info/store
> >>>>>>
> >>>>>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> >>>>>>
> >>>>>>------------------------ MailScanner list ------------------------
> >>>>>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> >>>>>>'leave mailscanner' in the body of the email.
> >>>>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> >>>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >>>>>>
> >>>>>>Support MailScanner development - buy the book off the website!
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>------------------------ MailScanner list ------------------------
> >>>>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> >>>>>'leave mailscanner' in the body of the email.
> >>>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> >>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >>>>>
> >>>>>Support MailScanner development - buy the book off the website!
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>--
> >>>>Julian Field
> >>>>www.MailScanner.info
> >>>>Buy the MailScanner book at www.MailScanner.info/store
> >>>>Professional Support Services at www.MailScanner.biz
> >>>>MailScanner thanks transtec Computers for their support
> >>>>
> >>>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> >>>>
> >>>>------------------------ MailScanner list ------------------------
> >>>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> >>>>'leave mailscanner' in the body of the email.
> >>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> >>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >>>>
> >>>>Support MailScanner development - buy the book off the website!
> >>>>
> >>>>
> >>>>
> >>>>
> >>>------------------------ MailScanner list ------------------------
> >>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> >>>'leave mailscanner' in the body of the email.
> >>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >>>
> >>>Support MailScanner development - buy the book off the website!
> >>>
> >>>
> >>>
> >>>
> >>>
> >>--
> >>Julian Field
> >>www.MailScanner.info
> >>Buy the MailScanner book at www.MailScanner.info/store
> >>Professional Support Services at www.MailScanner.biz
> >>MailScanner thanks transtec Computers for their support
> >>
> >>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> >>
> >>------------------------ MailScanner list ------------------------
> >>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> >>'leave mailscanner' in the body of the email.
> >>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >>
> >>Support MailScanner development - buy the book off the website!
> >>
> >>
> >
> >------------------------ MailScanner list ------------------------
> >To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> >'leave mailscanner' in the body of the email.
> >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> >Support MailScanner development - buy the book off the website!
> >
> >
> >
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!