glenn.steen at gmail.com
Mon Oct 3 13:35:54 IST 2011
2011/10/3 Glenn Steen <glenn.steen at gmail.com>:
> Don't do clam on full message text, and this should go away (it's a toggle
> in MS.conf), IIRC. There's little risk to do so...;-)
Here is the relevant bit from MailScanner.conf :
# There are now sets of signatures available from places such as
# www.sanesecurity.co.uk which use ClamAV to detect spam. Some of these
# signatures rely on being passed the whole message as one file. By setting
# this option to "yes", each entire message is written out to the scanning
# area, thus enabling these signatures to work reliably.
# It has a slight speed impact but is worth it for the extra spam-spotting
# This option cannot be the filename of a ruleset, it must be "yes" or "no".
ClamAV Full Message Scan = yes
.... Set that to no, since it bites you.
> Den 3 okt 2011 11:54 skrev "Mogens Melander" <mogens at fumlersoft.dk>:
>> Hi guys
>> I'm having problems with text being detected as MPEG files.
>> The error I'm getting from MS is:
>> The following e-mails were found to have: Bad Filename Detected
>> Sender: xxxxx at example.com
>> IP Address: 192.168.0.210
>> Recipient: yyyyy at example.org
>> Subject: RE: Statistik
>> MessageID: p937N5Zx000344
>> Quarantine: /var/spool/MailScanner/quarantine/20111003/p937N5Zx000344
>> Report: MailScanner: No MPEG movies allowed (msg-2048-10.txt)
>> This has been up before, but can't seem to find the solution.
>> Any clues on how to handle this?
>> The first couple of lines in the file is ( ? = danish character ć ):
>> Glostrup Pakke blev ikke solgt i denne periode...
>> The first 8 bytes of 'msg-2048-10.txt' in HEX are:
>> 00000000 56 E6 72 73 Ś 67 6F 0A 20
>> Using the file command, i get:
>> # file msg-2048-10.txt
>> msg-2048-10.txt: MPEG-4 LOAS
>> Adding an -i parameter give:
>> # file -i msg-2048-10.txt
>> msg-2048-10.txt: audio/x-mp4a-latm; charset=iso-8859-1
>> # MailScanner -V
>> Running on
>> Linux gphgw 184.108.40.206 #1 SMP PREEMPT Mon Sep 14 11:49:43 CEST 2009
>> i686 Intel(R) Core(TM)2 Duo CPU E7400 @ 2.80GHz GenuineIntel GNU/Linux
>> This is Perl version 5.010001 (5.10.1)
>> This is MailScanner version 4.82.6
>> SpamAssassin 3.3.1
>> All perl modules are up to date.
>> Mogens Melander
>> This message has been scanned for viruses and
>> dangerous content by MailScanner, and is
>> believed to be clean.
>> MailScanner mailing list
>> mailscanner at lists.mailscanner.info
>> Before posting, read http://wiki.mailscanner.info/posting
>> Support MailScanner development - buy the book off the website!
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
More information about the MailScanner