releasing from quarantine

[Martin Hepworth]

    [ The following text is in the "windows-1252" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Jeremy

there's stuff in the Mailwatch archives about this, but you need to mak 
all the possible traps in mailScanner (Iframe checking etc etc) a 
ruleset. Then in the ruleset make sure that emails from 127.0.0.1 are 
excempt from the checks.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Martin, Jeremy wrote:
> Hi,
> 
>  
> 
> I am using MailWatch with MailScanner but I believe this is more 
> MailScanner related, so I^Ñm asking here.
> 
>  
> 
> In MailWatch when I try to release a message blocked because of the file 
> types, it keeps getting re-quarantined.
> 
>  
> 
> In my spam.whitelist.rules I am whitelisting the From: email address 
> MailWatch is using when it releases the message. I am also whitelisting 
> that address in virus.scanning.rules ^Å and my MailScanner.conf 
> definitely has it looking at those two rule sets.
> 
>  
> 
> The status of the message in MailWatch is showing up as ^ÓW/L, Bad 
> Content^Ô .. One of the attachments is an .exe blocked by the 
> filename.rules.conf and the two other files are .dll^Òs but not listed in 
> filename.rules.conf ^Å The report I^Òm getting emailed seems to be the 
> stored.content.message.txt and it^Òs saying
> 
>  
> 
> ^ÓAt Wed May  4 09:13:21 2005 the virus scanner said:
> 
>    MailScanner: Executable DOS/Windows programs are dangerous in email 
> (ExportBatchService.exe)
> 
>    MailScanner: Attempt to hide real filename extension 
> (Dart.PowerTCP.Ftp.dll)^Ô
> 
>  
> 
> So how do I further whitelist the From email address these ^Ñrelease from 
> quarantine^Ò emails are coming from, in addition to the current whitelist 
> in my spam.whitelist.rules and virus.scanning.rules, so it doesn^Òt get 
> re-quarantined?
> 
>  
> 
> Thanks!!
> Jeremy
> 
>  
> 
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/)
> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 
> *Support MailScanner development - buy the book off the website!*

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.	

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!