confusing message {Virus Scanned}

[Scott Silva]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Christo Bezuidenhout wrote:
> Is that one file or two different files. In WindoZE you can create a file
> with a ',' in the filename. That could be why it has been blocked. Because
> of the length of the single file.
> 
> Christo
> 
>  
> 
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf
> Of Craig White
> Sent: 08 June 2005 03:22 AM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: confusing message {Virus Scanned}
> 
> # rpm -qa mailscanner
> mailscanner-4.40.5-1
> 
> One of my users reports this error...
> 
> Our e-mail content detector has just been triggered by a message you
> sent:
>   To: obscured_email_address
>   Subject: Homeowners Financial
>   Date: Tue Jun  7 12:00:04 2005
> 
> One or more of the attachments (Payroll Adjust.doc, Payroll
> Adjust-1.doc) are on the list of unacceptable attachments for this site and
> will not have been delivered.
> 
> Consider renaming the files to avoid this constraint.
> 
> The virus detector said this about the message:
> Report: Report: MailScanner: Very long filenames are good signs of attacks
> against Microsoft e-mail packages (Payroll Adjust.doc)
> Report: MailScanner: Very long filenames are good signs of attacks against
> Microsoft e-mail packages (Payroll Adjust-1.doc)
> ---
> 
> Is this a .doc filetype problem? It complains about filename lengths but
> these seem sufficiently short to me.
> 
> Not knowing what else to do, I have added to filename.rules.conf
> 
> allow   \.doc$                  -       -
> 

It is hitting the rule "deny	.{150,}" But that is looking for a lot of
characters after the first dot.
Although the error message shows a short file name, some of the messages
get "sanitized" filenames. You need to look at the original message to
see whats up.


-- 
   ,---.____________      _        ============   .
 /'                  \   |  \       I_  O  _I_,==.:
| A beer doesn't get  >--|===`-----'I `---' I |  |:
| upset if you come  /  _ \         I       I |  |:'
| home with another /  (   `-,----============:__;:
| beer!            /  (_    O   __)       \_      :
| ,,---.__________/     (______)          (_)
:/

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!