zero byte exe files filling quarantine, help!!

[Drew Marshall]

On Tue, January 30, 2007 14:28, Jeff A. Earickson wrote:
> Gang,
>
> I'm running beta version 4.58.7, and I've noticed this morning that a
ton of stuff is getting dumped into my MailScanner quarantine
> directory.  Everything that ends up there is a zero-byte exe
> file like "postcard.exe" or "Greeting Card.exe" (virus?), that
> generates a quarantine message back to the sender.  These quarantine
message will make MailScanner look **bad**.  Version 4.57.7 does this
too.  Running sophos 4.14 and the latest clam.
>
> The only quick fix I could think of was to change "Quarantine
Infections"
> from yes to no.  Anybody else seeing this issue??

I found this issue a while a go and Jason Desai was able to provide a fix:

---- Quote ----
Sorry for the late reply - still catching up on the list.  I just dealt
with this recently.  Here's what I did.  I modified languages.conf,
changing AttachmentTooSmall to be "Attachment is too small (too-small)".
For completeness, I changed AttachmentTooLarge in the same way.  Then I
modified MailScanner.conf, and added "too-small" to the list of Silent
Viruses.  This seems to prevent notifications.  You don't have to use
"too-small", you could use some other string which has no spaces in
AttachmentTooSmall and Silent Viruses.

----Quote Ends -----

The small files then get treated like viruses rather than invalid file
types so you can then play games with silent viruses and quarantine rule
sets etc.

HTH

Drew



-- 
In line with our policy, this message has been scanned 
for viruses and dangerous content by the Technology Tiger MailScanner.
Further information can be found at www.technologytiger.net/policy

Technology Tiger Limited is registered in Scotland with registration number: 310997
Registered Office 55-57 West High Street Inverurie AB51 3QQ