Filename problem

Scott Silva ssilva at
Thu Jun 22 17:24:47 IST 2006

David Lee spake the following on 6/22/2006 9:10 AM:
> (MailScanner version 4.50.14: a little old, I know, but probably
> irrelevant.)
> We recently had a report from a user of a ".jar" file that didn't get
> through.  Instead it seemed to trip over "filename.rules.conf".
> The (default) text of the replaced attachment was:
> --------------
> The original e-mail attachment "enable.jar"
> is on the list of unacceptable attachments for this site and has been
> replaced by this warning message.
> [...] the virus scanner said:
>    MailScanner: Very long filenames are good signs of attacks against
> Microsoft
> e-mail packages (SelectInfoorPr1.cla)
> --------------
> In "filename.rules.conf", the relevant rule seems to be the (default?):
> deny	.{150,}		[...]
> Any idea what might be going on?  The filename is believed to be a simple
> "enable.jar", and yet MS is reporting about "SelectInfoorPr1.cla" and
> about some file whose name exceeds 150 characters.
> (Have I overlooked something in the comments?  FAQ?  MAQ?)
> Thanks.
You need to look in the logs to get more detail, as the filename in the
response message is "sanitized", and the real name could be much longer.
I have added the code for the message ID in all my reports to make it easier
to find the message in the logs.


MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

More information about the MailScanner mailing list