Win32.Netsky.P slipping through.

[Tony Enderby]

Greetings Folks,

I have noticed a few messages slipping past mailscanner file type detection
and AV scan today but being blocked by spamassassin

The attachment type varies between .wav and .pif sometimes with heaps of
white space in the filename

i.e document.txt
.pif

I have noticed that if I take the infected attachment from quarantine and
resend via the mailscanner box, that the attachment is picked up and
detected as a virus / bad content.

Could anyone shed some light on why these may be slipping through
mailscanner when sent from external sources.
MS version is 4.43.8 and I'm running Clam AV and Bit Defender.    A copy of
the headers from one of the messages in question below.
In this particular instance, the attachment was a .wav file but most of the
others have been .pif

Any help would be welcomed.

Tony.

-----------------------

Subject: Mail Delivery (failure -address removed-)
Date: Fri, 8 Jul 2005 15:33:49 +1000
MIME-Version: 1.0
Content-Type: multipart/related;
     type="multipart/alternative";
     boundary="----=_NextPart_000_001B_01C0CA80.6B015D10"
X-Priority: 3
X-MSMail-Priority: Normal

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!