Filename problem

[David Lee]

(MailScanner version 4.50.14: a little old, I know, but probably
irrelevant.)

We recently had a report from a user of a ".jar" file that didn't get
through.  Instead it seemed to trip over "filename.rules.conf".

The (default) text of the replaced attachment was:
--------------
The original e-mail attachment "enable.jar"
is on the list of unacceptable attachments for this site and has been
replaced by this warning message.

[...] the virus scanner said:
   MailScanner: Very long filenames are good signs of attacks against
Microsoft
e-mail packages (SelectInfoorPr1.cla)
--------------

In "filename.rules.conf", the relevant rule seems to be the (default?):

deny	.{150,}		[...]

Any idea what might be going on?  The filename is believed to be a simple
"enable.jar", and yet MS is reporting about "SelectInfoorPr1.cla" and
about some file whose name exceeds 150 characters.

(Have I overlooked something in the comments?  FAQ?  MAQ?)

Thanks.

-- 

:  David Lee                                I.T. Service          :
:  Senior Systems Programmer                Computer Centre       :
:                                           Durham University     :
:  http://www.dur.ac.uk/t.d.lee/            South Road            :
:                                           Durham DH1 3LE        :
:  Phone: +44 191 334 2752                  U.K.                  :