Filename problem

[Scott Silva]

David Lee spake the following on 6/22/2006 9:10 AM:
> (MailScanner version 4.50.14: a little old, I know, but probably
> irrelevant.)
> 
> We recently had a report from a user of a ".jar" file that didn't get
> through.  Instead it seemed to trip over "filename.rules.conf".
> 
> The (default) text of the replaced attachment was:
> --------------
> The original e-mail attachment "enable.jar"
> is on the list of unacceptable attachments for this site and has been
> replaced by this warning message.
> 
> [...] the virus scanner said:
>    MailScanner: Very long filenames are good signs of attacks against
> Microsoft
> e-mail packages (SelectInfoorPr1.cla)
> --------------
> 
> In "filename.rules.conf", the relevant rule seems to be the (default?):
> 
> deny	.{150,}		[...]
> 
> Any idea what might be going on?  The filename is believed to be a simple
> "enable.jar", and yet MS is reporting about "SelectInfoorPr1.cla" and
> about some file whose name exceeds 150 characters.
> 
> (Have I overlooked something in the comments?  FAQ?  MAQ?)
> 
> Thanks.
> 
You need to look in the logs to get more detail, as the filename in the
response message is "sanitized", and the real name could be much longer.
I have added the code for the message ID in all my reports to make it easier
to find the message in the logs.


-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!