Wrong MPEG movie detection (for e-mails written in czech language)

Fri Jun 15 09:14:36 IST 2007

Hello,

after MailScanner upgrade from old old version to 4.61.2 have problem. I 
found too much e-mails marked as "MailScanner: No MPEG movies allowed". 
After "little" analysis i found this: when e-mail begin with "Vážený 
pane" (english equivalent "Dear Sir") in ISO-8859-2 encoding, is 
detected as MPEG video. Is possibe to make in the future better MPEG 
detection ?

Attaching one e-mail as sample and here is MailScanner report:

     Sender: junec at skrin.cz
IP Address: 194.228.2.92
  Recipient: cernoch at juli.cz
    Subject: Re: Mail z Vasich WWW stranek - NEODPOVIDEJTE NA TENTO MAIL
  MessageID: l58D50LM014485
Quarantine: /var/spool/MailScanner/quarantine/20070608/l58D50LM014485
     Report: MailScanner: No MPEG movies allowed (msg-5984-27.txt)

Thanks for answer

Petr Zeman
JULI Motorenwerk

-------------- next part --------------
Return-Path: <g>
Received: from smtp-out4.iol.cz (smtp-out4.iol.cz [194.228.2.92])
	by mail.juli.cz (8.13.3/8.13.1/SuSE Linux 0.7) with ESMTP id l58D50LM014485
	for <cernoch at juli.cz>; Fri, 8 Jun 2007 15:05:12 +0200
Received: from antivir6.iol.cz (unknown [192.168.30.215])
	by smtp-out4.iol.cz (Postfix) with ESMTP id 5E45216581A
	for <cernoch at juli.cz>; Fri,  8 Jun 2007 13:04:48 +0000 (UTC)
Received: from localhost (antivir6.iol.cz [127.0.0.1])
	by antivir6.iol.cz (Postfix) with ESMTP id 26D43260042
	for <cernoch at juli.cz>; Fri,  8 Jun 2007 15:04:48 +0200 (CEST)
X-Virus-Scanned: amavisd-new at iol.cz
Received: from antivir6.iol.cz ([127.0.0.1])
	by localhost (antivir6.iol.cz [127.0.0.1]) (amavisd-new, port 10224)
	with LMTP id 26TAGpBj-B4D for <cernoch at juli.cz>;
	Fri,  8 Jun 2007 15:04:47 +0200 (CEST)
Received: from smtp-out4.iol.cz (mta-out4 [192.168.30.31])
	by antivir6.iol.cz (Postfix) with ESMTP id ABE16260036
	for <cernoch at juli.cz>; Fri,  8 Jun 2007 15:04:47 +0200 (CEST)
Received: from [83.208.58.173] (173.58.broadband2.iol.cz [83.208.58.173])
	by smtp-out4.iol.cz (Postfix) with ESMTP id E612E47E47
	for <cernoch at juli.cz>; Fri,  8 Jun 2007 15:04:44 +0200 (CEST)
Message-ID: <466953ED.7060602 at skrin.cz>
Disposition-Notification-To: Petr Junec <junec at skrin.cz>
Date: Fri, 08 Jun 2007 15:04:45 +0200
From: Petr Junec <junec at skrin.cz>
Reply-To: junec at skrin.cz
User-Agent: Thunderbird 1.5.0.12 (Windows/20070509)
MIME-Version: 1.0
To: cernoch at juli.cz
Subject: Re: Mail z Vasich WWW stranek - NEODPOVIDEJTE NA TENTO MAIL
References: <200706051637.l55GbphO010197 at venuse.savvy.cz>
In-Reply-To: <200706051637.l55GbphO010197 at venuse.savvy.cz>
Content-Type: multipart/mixed;
 boundary="------------050802030307060908060903"

This is a multi-part message in MIME format.
--------------050802030307060908060903
Content-Type: multipart/alternative;
 boundary="------------060700050007070903000105"

--------------060700050007070903000105
Content-Type: text/plain; charset=ISO-8859-2; format=flowed
Content-Transfer-Encoding: 8bit

Vážený pane Černochu, sdělte mi prosím  kvůli naší marketingové studii, 
odkud jste přišel na naše www.stránky.
(vyhledavač: SEZNAM, CENTRUM, ATLAS atd
hledání na klíčové slovo - ?
na internetu nbo ve firmách?

díky moc

www.skrin.cz napsal(a):
> Zakaznik vyplnil a odeslal formular:
> NA TENTO MAIL NIKDY NEODPOVIDEJTE VASE ZPRAVA NEBUDE NIKAM DORUCENA!!!!!!
> POUZIJTE ADRESU KTEROU ZAKAZNIK UVEDL.
> MAIL ODESLAN ZE STRANKY:
> http://www.skrin.cz/poptavkovy-formular.php
>
> ---------------------------
> Jmeno: Petr Černoch
> Mesto: 612 00 Brno
> E-mail: cernoch at juli.cz
> Adresa: 
> Telefon: 603286114
>
> Rozměry skříně
> Vyska: 280
> Sirka: 400
> Hloubka: 70
>
> Dvere: kombinace
> Dezen vestavby: lamino dřevodekor
>
> Doplnky
> satni tyc (delka): 200
> zasuvky  (ks): 16
> kos (vyska 200mm) (ks): 
> kos (výška 100mm)  (ks): 
> sklopna tyc: 
> kravatnik: ANO
> police na boty: 
> věšák na kalhoty: 
> zehlici prkno: 
> vysuv na prepravku: 
> drzak na hadici vysavace: 
> ---------------------------
>   

--------------060700050007070903000105
Content-Type: multipart/related;
 boundary="------------070402090100010301000405"

--------------070402090100010301000405
Content-Type: text/html; charset=ISO-8859-2
Content-Transfer-Encoding: 8bit

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
 <meta content="text/html;charset=ISO-8859-2" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000099">
Vážený pane Černochu, sdělte mi prosím  kvůli
naší marketingové studii, odkud jste přišel na naše <a class="moz-txt-link-abbreviated" href="http://www.stránky">www.stránky</a>. 
(vyhledavač: SEZNAM, CENTRUM, ATLAS atd 
hledání na klíčové slovo - ? 
na internetu nbo ve firmách? 
 
díky moc 
 
<img alt="" src="cid:part1.08080407.03030909 at skrin.cz" height="159"
 width="188"> 
 
 
 
 
<a class="moz-txt-link-abbreviated" href="http://www.skrin.cz">www.skrin.cz</a> napsal(a):
<blockquote cite="mid200706051637.l55GbphO010197 at venuse.savvy.cz"
 type="cite">
 <pre wrap="">Zakaznik vyplnil a odeslal formular:
NA TENTO MAIL NIKDY NEODPOVIDEJTE VASE ZPRAVA NEBUDE NIKAM DORUCENA!!!!!!
POUZIJTE ADRESU KTEROU ZAKAZNIK UVEDL.
MAIL ODESLAN ZE STRANKY:
<a class="moz-txt-link-freetext" href="http://www.skrin.cz/poptavkovy-formular.php">http://www.skrin.cz/poptavkovy-formular.php</a>

---------------------------
Jmeno: Petr Černoch
Mesto: 612 00 Brno
E-mail: <a class="moz-txt-link-abbreviated" href="mailto:cernoch at juli.cz">cernoch at juli.cz</a>
Adresa: 
Telefon: 603286114

Rozměry skříně
Vyska: 280
Sirka: 400
Hloubka: 70

Dvere: kombinace
Dezen vestavby: lamino dřevodekor

Doplnky
satni tyc (delka): 200
zasuvky  (ks): 16
kos (vyska 200mm) (ks): 
kos (výška 100mm)  (ks): 
sklopna tyc: 
kravatnik: ANO
police na boty: 
věšák na kalhoty: 
zehlici prkno: 
vysuv na prepravku: 
drzak na hadici vysavace: 
---------------------------
  </pre>
</blockquote>
</body>
</html>

--------------070402090100010301000405
Content-Type: image/jpeg;
 name="UBUS.jpg"
Content-Transfer-Encoding: base64
Content-ID: <part1.08080407.03030909 at skrin.cz>
Content-Disposition: inline;
 filename="UBUS.jpg"

/9j/4AAQSkZJRgABAQEASABIAAD/2wBDABQODxIPDRQSEBIXFRQYHjIhHhwcHj0sLiQySUBM
S0dARkVQWnNiUFVtVkVGZIhlbXd7gYKBTmCNl4x9lnN+gXz/2wBDARUXFx4aHjshITt8U0ZT
fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHz/wAAR
CACfALwDASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAA
AgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkK
FhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWG
h4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl
5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREA
AgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYk
NOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOE
hYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk
5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwDs6KKKACiiigAooooAKKKKACiiigAooooA
KKKKACiikJxycAd6AFqvc3cVuyq7He33UVSxP4Co2lkuiVtyUiBw0uMk/wC7/j/PtNBBHCDs
UAseT1LH3NABHMsjldrBgASCPXP+FSjpVaEb7meX+E7Yx6HGSSPxYj8KsjpQAtFFFABRRRQA
UUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUh60AIxABJOAOuaplZLt/nzHbqeFxzJ9fQe3fv
xwXEi7ZgcG3U4IxneQefw/mfpzbX7o/rQAKAFAHAFBHOaWigBsaCONUXooxTqKKACiiigAoo
ooAKKKKACmmkY7cknjqcmqQZr5TlXS3z64MuP5L/AD9u4BN9oaYkWqhwDjeT8ue49T+H50wW
tyclr6QE5wEjQAfmCf1q4gCqAoAAGAAMYpaAIIXkBMUuCw6MP4x64qYVXnZUu7Zj95y0Q/EF
v/ZKsCgBaKKKACiionmiWVY2kQSN91Sw3H6D8KAJaq3TMzLBHkPICSwONqjGSPfkY/8ArUT3
ccHy8vLjIiTBYjpnHp79Ko6be+cZ7m4TyVeTZHl927bxgDHt2oA1kVURVQBVUYAAwAKU1nSa
n5aGQWVy6Y67QuT6YYgk/hWb9quNXuDayQyQDbuaIgrtGcDeSOc84AB/HkAA3YbiK4DGJw4V
tpI6Z+tRG/thdJb+eDK5ICgZ5AzyRwPxpkWnRIqxtzEg2rEB+7A9x3Puac1rILlpFlURlAgX
ZkoO+0578fkKALg6VXnvbeCQRySDzD0Qcn8qRLNdp853n3dRIwIP4AAfpU8caRqFjRUUdFUY
AoAga4fgpbTuM4yNq/jhiDTfNujIwW1ULj7zy4J/AA1cooArwtcMT58UaAdCkhbP5qKnHSlo
oAKYSQ33fxzTj0rNu5JDIIFY725PsB1/Pp+PtQAshW/ZkdFNup7n/WEf0B/z1Bt+Y395KrKq
ooVRhV4H0paALG5j/GgoKyno4qvUc0jIAI13yH7q54/H2oATUXMIt3lIP74be/JBHTqevQet
L9pu/tAVrd1hJAEpYck/7PUDp+dVp49ktqztvlabGX+bHyk/LnhenbrRcXLXl2LdDuig+edR
kFz/AAqOnXuOew9aALC6pkyZjcIgBDlMb8g8L69KSS7lWN5biRYIlzwowe/Un8OMUWEckWZb
wiS4dy7FW+RT0wo9MYqe5jt7vYsyM6I24L2J9x3x1oAr211cXMEYIMY2DdJ3Y47Dtz3P/wBe
o5IZVuoRagRwrud33bmZsYHJ64B7nHTrjB0v3Htz6Zo8uHs2PxoAqs3k2/lxf6yVsF2PLMep
/LJ/CnRtBZxOYoEjX7x2gLn/AOvQ6o14iZG2NC5Poeg/TdUpijbAMimgCvEC8wubhQ8mP3Yx
jYv+PvTpHxcRSBRvOUGOeDz/AOyip/KU9JFqsULaisQOUSPex9CTgfyagCz9obtjFH2hvQUv
2cn+IUht2HQg0AKLg45X9aes6nqCKgaN16im0AXVYN0p1VYFJbIOAOtWqACiiigCOV1jRnch
VUZJz0Hc1VhgdwJZQElflgDnb6AfhU12jSBFAJXzFLbTg4Bz/MDPsTU46UARrAgHIzThGn90
flT6huJVhjZ257AdCx7Ae/p9aAGTMqMERFMjdF/r9KdFbqinIyx6npSQRMm55TmV+WweB7D0
HFTjpQBSuoEaSLYAZEJdVJ4Pykc+3Ipmn6alnbBNzNI53SuT99+5qwwD3wIPzRxHI/3iMf8A
oJqzQBX+z/7X6UfZv9r9KsUUAVvsx/vCj7Mf7wqzSHrQBSjtyZZmJAYEKpx1AAI/UmpxbDH3
jRabvKbecnzH59txx+lT0AVzCiqSxbjk1DbQFleUlkaQ5Cn+EDgfyzT7lWnlEAX93w0h7Edl
/Hv7fWrQ6UARCNwOJD+Ipf3o/usKlooAjDNj5k/I0jbHHzZX3IxipaSgBEAVAB0p1IBgYpaA
CiiigAooooAQmq0Z8+beQQicIPU9z/T86fcFjiONtjv364A6n/PqKljVUQKgAVeAAOg9KAFA
wKD1oprkKCx6AZNAFa2RTLczg7vMfAPpt4x+YNWxjHFQ2iFLWMOAHI3OB/ePJ/UmpqAFopKK
V0AtNPX3paQ98UXAbbkNCpGPfHr3/Wo5nIYrGAZCB16KPU/4f/XwkduIi/lyOqsd2zjaCeTj
j15qZVCg+p6nPWmAyGFYVwg5JyxPVj61KKKKAFopKKAFooooAKKKKACiiigApp5NOqC6LeSw
QlWb5Aw6qTxn8M0ANgBeR5m3cnCqwwVA4/pmrNNjRY41ReFUAD6U6gCG5JWFiDg1zGpa4Ypb
i2dCyooLZfG8ZGR+R/Q1011/qHrhNfIS5uOqvIy8/wCyFH9f5e1YtXmWnaJrQeIGmsri48uR
fIxx5nXNVv8AhLGzxBJ6f6z/AD61nafxoup/8A/nWWv3h+FCitQvY67UPELWN00BjkfABz5m
Ooz6VW/4S1v+eEn/AH9/+tWZ4g/5Cz/7q/yqrA9strcCZC0pA8ojse9CiuVMG2dDB4pSWVUl
jljDHAYPmpdQ8QNY3Jh2O/yg5EmM/pXK28ElzKI4VLMfTt71f8QLt1MqeoRQfyocVzWHzM3L
XxA1zBdTCORfIXdjfnNVP+Esbj9w/wD39zWfpP8AyDtS/wCuI/rWUeh+hoUVqHMzsr/XxZeW
pEkkrqG2huAPeqX/AAlj/wDPB/8Av7/9aqGvwSLdRzFT5bRKA3bPoao2j2yl1uomdWXAZTyh
9RRGKtcG2joIvFm6QLLFIik4LCTOPetiS4kKqySvgjIO48iubtdHsLxR5F+zNjG0qA35VvyK
sMEakjaigZJ9qlNcyQfZHfaJv+e0n/fRo+0Tf89pP++jVA6lZdDcx/nT2vbVYhKZkEZOAc9T
XQZlz7RN/wA9pP8Avo0faJv+e0n/AH0apC/tCVHnx5bpg0st7bQMFlnRWPYmgC39omzkTSfi
xrbtyTbxk9So/lXMxXltO+yGZGb0B610tt/x7Rf7g/lQBLUErK1zFHk7gC/H/fP/ALN+lT1C
qr9pkkBycBD7d/8A2agCUdKWkHQUtAEF3/qH+lee68+/VJPlUYCgFe47V3uoNiHZn5nOB1+p
6ewP6VzGq6G95cCa2dFJGGVsgHtWLkoy1LSujKsJEXR9QRmUMdmAT15rNX7w69R1rX/4Ru9/
vw/99H/Cpbbw3P5ym4ljCAgnb3xzinzRV2HK2VfEH/IVf/dX+VV7aCCSxupJX2yRqpjG7GT9
O9bWq6LcXt688TxqrAABicj9Kqf8I1d/89YfzP8AhUqceVIbi7mRFK0EqyRsVZTkY+taPiBt
+qFj1ZFP6Vat/DUvnKZ5kCA5Ozv7Vc1fRWvZFlt3RWCBMNnkChzjzAouxkaXIiafqIdgpaIY
BPXrWYeh+hrYPhu9PO+H/vo/4VJB4auDKvnyxhAcnBPIqueKuxKLZbvtaWzdbZrYSjy1Jyev
H0rMb7DqEVzIsItHjXcMScPz0wa1tW0Q3siy28gR1UKQ+cH0rNPhu9yfnh/76P8AhUQcFsU1
IyAxUhl4YYII7HrXaXSvc6aBn55Is5z6gVjQ+GrguPOliVP4tpJOK3L2DzLMwKSv7sqDVcy5
lYSulqck0LWe5Ly2Yqe/QjnsasXX2f8AsuI2u/aZzuDnODipRo16sckQki2ORkZPOD9KlbRp
/sCRK6F/M8wnPA4xWxmQWukC8sYZUk8tiGDEgnPPWoLqP/iciJ8MN6IfccV0GnW72lnHDIVL
LnJU5HWs++0m4lvTcQOg3EEbj0I/CgCjYqE1tFUAASsBj8a9Ftv+PaL/AHB/KuIstJuIr4XM
7x8Evhe+c129t/x7Rf7g/lQBLVeD/X3X/XUf+gLViq8IPnXOehkGP++FoAsUhpaguXZV2pne
/wAowOnqfw/z1oAairLO8hAZVG1cgfiR+g/4DUvlJ/dX8qWJFjjCqoUDsO1PpNXHcj8qP+4v
5UeVH/cX8qkoo5UFyPyo/wC4v5UeVH/cX8qkoo5UFyPyo/7i/lR5Sf3F/KpKKOVC1I/Kj/uL
+VHlR/3F/KpKKXKh3I/Kj/uL+VHlR/3F/KpKKfKguR+VH/dX8qQwx941P/ARUtFFkK7IvIi/
55J/3yKPIi/55J/3yKlopgReRF/zyT/vkUeRF/zyT/vkVLRQBF5EX/PJP++RUgAAwMY9qWig
AqBgVudx5RlwR6Ef/WJ/Kp6ZIocFW+vFACSOkSF5GCqOpJ4qKMGSQzkY4wn0/wDr8H8KiS0a
TP2qY3Ee7cqlAAAPX155q6OlAAOlLRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFF
FFABRRRQB//Z
--------------070402090100010301000405--

--------------060700050007070903000105--

--------------050802030307060908060903
Content-Type: text/x-vcard; charset=utf-8;
 name="junec.vcf"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
 filename="junec.vcf"

begin:vcard
fn:Petr Junec
n:Junec;Petr
org:Petr Junec
adr;quoted-printable;quoted-printable;dom:;;Mikul=C4=8Dice 20;Mikul=C4=8Dice;;69619
email;internet:junec at skrin.cz
tel;cell:603111575
url:http://www.skrin.cz
version:2.1
end:vcard

--------------050802030307060908060903--