releasing from quarantine

[Martin, Jeremy]

Hi,

 

I am using MailWatch with MailScanner but I believe this is more
MailScanner related, so I‘m asking here.

 

In MailWatch when I try to release a message blocked because of the file
types, it keeps getting re-quarantined.

 

In my spam.whitelist.rules I am whitelisting the From: email address
MailWatch is using when it releases the message. I am also whitelisting
that address in virus.scanning.rules … and my MailScanner.conf
definitely has it looking at those two rule sets.

 

The status of the message in MailWatch is showing up as “W/L, Bad
Content” .. One of the attachments is an .exe blocked by the
filename.rules.conf and the two other files are .dll’s but not
listed in filename.rules.conf … The report I’m getting
emailed seems to be the stored.content.message.txt and it’s saying

 

“At Wed May  4 09:13:21 2005 the virus scanner said:

   MailScanner: Executable DOS/Windows programs are dangerous in email
(ExportBatchService.exe)

   MailScanner: Attempt to hide real filename extension
(Dart.PowerTCP.Ftp.dll)”

 

So how do I further whitelist the From email address these ‘release
from quarantine’ emails are coming from, in addition to the current
whitelist in my spam.whitelist.rules and virus.scanning.rules, so it
doesn’t get re-quarantined?

 

Thanks!!
Jeremy

 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!