zero byte exe files filling quarantine, help!!

[Jeff A. Earickson]

On Tue, 30 Jan 2007, Julian Field wrote:

> Date: Tue, 30 Jan 2007 16:11:00 +0000
> From: Julian Field <MailScanner at ecs.soton.ac.uk>
> Reply-To: MailScanner discussion <mailscanner at lists.mailscanner.info>
> To: MailScanner discussion <mailscanner at lists.mailscanner.info>
> Subject: Re: zero byte exe files filling quarantine, help!!
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Will 1 configuration setting do, like this:
>
> Notify Senders Of Too Large Or Too Small Attachments = yes or no
>
> You don't really need separate configurations for too large and too
> small do you? Please say no :-)
>
> Jules.

I consider zero-byte attachments a pathological case where no notification
is needed, ever.  Anything > 0 would be legit; then it is just a case
of "too large" and whether or not to notify.

Hmmm, I just noticed this in MailScanner.conf:

# The minimum size, in bytes, of any attachment in a message.
# If this is set less than or equal to zero, then no size checking is done.
# It is very useful to set this to 1 as it removes any zero-length
# attachments which may be created by broken viruses.
# This can also be the filename of a ruleset.
Minimum Attachment Size = -1

If I set this to 1, per the comment, would I have avoided this morning's
problems?  Maybe the default for this *should* be one???

Jeff Earickson
Colby College