filetype rule false positive

[Adri Koppes]

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Peter,

You could edit the magic number database use by the 'file' command to use
another magic number for PE executables.....
Or you could remove the PE executables from the filetype rules database...
I'd be happy to know what other magic numbers could be used besides the
string 'LZ' at the start.

Adri.


> -----Original Message-----
> From: Peter Peters [mailto:P.G.M.Peters at UTWENTE.NL]
> Sent: 23 February, 2005 14:14
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: filetype rule false positive
>
>
> Julian Field wrote on 22-2-2005 18:14:
>
> >> This isn't really a MailScanner issue. This is a problem
> with the "file"
> >> command and how it attempts to detect the mime content of messages.
> >> I've run
> >> into similar problems with certain text being picked up as
> AVI's. If it
> >> happens quite frequently, your best bet is to disable the
> file content
> >> detection.
> >>
> > Fortunately the users can easily work around it, just by
> adding a space
> > or a blank line at the start of their message.
>
> This sound like Microsoft telling people not to use the word begin at
> the beginning of a line. The recipients have the "problem" and the
> senders have to take action. It's not something my users like.
>
> --
> Peter Peters, senior beheerder (Security)
> Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
> Universiteit Twente,  Postbus 217,  7500 AE  Enschede
> telefoon: 053 - 489 2301, fax: 053 - 489 2383,
http://www.utwente.nl/itbe

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!