(no subject)

[Glenn Steen]

2011/10/3 Glenn Steen <glenn.steen at gmail.com>:
> Don't do clam on full message text, and this should go away (it's a toggle
> in MS.conf), IIRC. There's little risk to do so...;-)
>

Here is the relevant bit from MailScanner.conf :
# There are now sets of signatures available from places such as
# www.sanesecurity.co.uk which use ClamAV to detect spam. Some of these
# signatures rely on being passed the whole message as one file. By setting
# this option to "yes", each entire message is written out to the scanning
# area, thus enabling these signatures to work reliably.
# It has a slight speed impact but is worth it for the extra spam-spotting
# ability.
#
# This option cannot be the filename of a ruleset, it must be "yes" or "no".
ClamAV Full Message Scan = yes

.... Set that to no, since it bites you.

Cheers
-- 
-- Glenn

> Den 3 okt 2011 11:54 skrev "Mogens Melander" <mogens at fumlersoft.dk>:
>> Hi guys
>>
>> I'm having problems with text being detected as MPEG files.
>> The error I'm getting from MS is:
>>
>> The following e-mails were found to have: Bad Filename Detected
>>
>> Sender: xxxxx at example.com
>> IP Address: 192.168.0.210
>> Recipient: yyyyy at example.org
>> Subject: RE: Statistik
>> MessageID: p937N5Zx000344
>> Quarantine: /var/spool/MailScanner/quarantine/20111003/p937N5Zx000344
>> Report: MailScanner: No MPEG movies allowed (msg-2048-10.txt)
>>
>> This has been up before, but can't seem to find the solution.
>>
>> Any clues on how to handle this?
>>
>> The first couple of lines in the file is ( ? = danish character ć ):
>>
>> V?rsgo
>>
>> Glostrup Pakke blev ikke solgt i denne periode...
>>
>> The first 8 bytes of 'msg-2048-10.txt' in HEX are:
>>
>> 00000000 56 E6 72 73 Ś 67 6F 0A 20
>>
>> Using the file command, i get:
>>
>> # file msg-2048-10.txt
>> msg-2048-10.txt: MPEG-4 LOAS
>>
>> Adding an -i parameter give:
>>
>> # file -i msg-2048-10.txt
>> msg-2048-10.txt: audio/x-mp4a-latm; charset=iso-8859-1
>>
>> # MailScanner -V
>> Running on
>> Linux gphgw 2.6.30.5 #1 SMP PREEMPT Mon Sep 14 11:49:43 CEST 2009
>> i686 Intel(R) Core(TM)2 Duo CPU E7400 @ 2.80GHz GenuineIntel GNU/Linux
>>
>> This is Perl version 5.010001 (5.10.1)
>> This is MailScanner version 4.82.6
>> SpamAssassin 3.3.1
>>
>> All perl modules are up to date.
>>
>> --
>> Later
>>
>> Mogens Melander
>>
>>
>>
>> --
>> This message has been scanned for viruses and
>> dangerous content by MailScanner, and is
>> believed to be clean.
>>
>> --
>> MailScanner mailing list
>> mailscanner at lists.mailscanner.info
>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>
>> Before posting, read http://wiki.mailscanner.info/posting
>>
>> Support MailScanner development - buy the book off the website!
>



-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se