Filename problem

[Dhawal Doshy]

David Lee wrote:
> (MailScanner version 4.50.14: a little old, I know, but probably
> irrelevant.)
> 
> We recently had a report from a user of a ".jar" file that didn't get
> through.  Instead it seemed to trip over "filename.rules.conf".
> 
> The (default) text of the replaced attachment was:
> --------------
> The original e-mail attachment "enable.jar"
> is on the list of unacceptable attachments for this site and has been
> replaced by this warning message.
> 
> [...] the virus scanner said:
>    MailScanner: Very long filenames are good signs of attacks against
> Microsoft
> e-mail packages (SelectInfoorPr1.cla)
> --------------
> 
> In "filename.rules.conf", the relevant rule seems to be the (default?):
> 
> deny	.{150,}		[...]
> 
> Any idea what might be going on?  The filename is believed to be a simple
> "enable.jar", and yet MS is reporting about "SelectInfoorPr1.cla" and
> about some file whose name exceeds 150 characters.
> 
> (Have I overlooked something in the comments?  FAQ?  MAQ?)

See 
http://mailscanner.info/MailScanner.conf.index.html#Maximum%20Archive%20Depth

- dhawal