Betr.: Re: Problems with office files being wrongfully blocked

[Julian Field]

On 01/03/2010 16:02, Arjan Melein wrote:
>>>> Op 1-3-2010 om 16:10 is door Julian Field<MailScanner at ecs.soton.ac.uk>
>>>>          
> geschreven:
>
>    
>> And what does the "file" command say (without the "-i") ?
>>
>>      
> Replaced characters with x and numbers with # for confidentiality reasons as it contained personal info.
>
> xxxxx##.x## xxxxxxxxxxx xxxxxxx ## xxx.doc: CDF V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Title: xxxxxxxxxxx xxx xxxxx xxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx, Subject: xxxxxxxxxxx xxx xxxxx xxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxx, Author: x. xxxxxxxx, Keywords: NL, Comments: xxxxxxxxxxx, Template: Brief.dot, Last Saved By: x. xxxxxxxx, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Total Editing Time: 15:00, Last Printed: Mon Sep 24 10:53:00 2001, Create Time/Date: Sun Jan 31 13:23:00 2010, Last Saved Time/Date: Sun Jan 31 13:39:00 2010, Number of Pages: 1, Number of Words: 993, Number of Characters: 6172, Security: 0
>
>    
>> MailScanner can and will use both, and you probably have rules that use
>> both of them (in different rules) too.
>>      
>>> I'm not sure how to go about debugging this, it does not do it with every
>>>        
>> file but it is consistent with blocking whatever file got initially blocked,
>> so it's not just a glitch.
>> Jules
>>      
> I'm basically using the default rules that came with it with only a minor adjustment so it would reject media files as well(which it does).
In which case pretty much all your rules will use the output of "file" 
and not "file -i". The logs will tell you more about what rule(s) it 
matched.

Jules

-- 
Julian Field MEng CITP CEng
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

Need help customising MailScanner?
Contact me!
Need help fixing or optimising your systems?
Contact me!
Need help getting you started solving new requirements from your boss?
Contact me!

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
Follow me at twitter.com/JulesFM and twitter.com/MailScanner


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.