(no subject)

[Mogens Melander]

On Mon, October 3, 2011 15:51, Johan Hendriks wrote:
>>Hi guys
>>
>>I'm having problems with text being detected as MPEG files.
>>The error I'm getting from MS is:
>>
>>The following e-mails were found to have: Bad Filename Detected
>>
>>    Sender: xxxxx at example.com
>>IP Address: 192.168.0.210
>> Recipient: yyyyy at example.>org
>>   Subject: RE: Statistik
>> MessageID: p937N5Zx000344
>>Quarantine: /var/spool/MailScanner/quarantine/20111003/p937N5Zx000344
>>    Report: MailScanner: No MPEG movies allowed (msg-2048-10.txt)
>>
>>This has been up before, but can't seem to find the solution.
>>
>>Any clues on how to handle this?
>>
>>The first couple of lines in the file is ( ? = danish character æ ):
>>
>>V?rsgo
>>
>>Glostrup Pakke blev ikke solgt i denne periode...
>>
>>The first 8 bytes of 'msg-2048-10.txt' in HEX are:
>>
>>00000000 56 E6 72 73 ¦ 67 6F 0A 20
>>
>>Using the file command, i get:
>>
>># file msg-2048-10.txt
>>msg-2048-10.txt: MPEG-4 LOAS
>>
>>Adding an -i parameter give:
>>
>># file -i msg-2048-10.txt
>>msg-2048-10.txt: audio/x-mp4a-latm; charset=iso-8859-1
>>
>># MailScanner -V
>>Running on
>>Linux gphgw 2.6.30.5 #1 SMP PREEMPT Mon Sep 14 11:49:43 CEST 2009
>>i686 Intel(R) Core(TM)2 Duo CPU E7400 @ 2.80GHz GenuineIntel GNU/Linux
>>
>>This is Perl version 5.010001 (5.10.1)
>>This is MailScanner version 4.82.6
>>SpamAssassin 3.3.1
>>
>>All perl modules are up to date.
>>
>>--
>>Later
>>
>>Mogens Melander
>
> As far as i know, it is not clamav that Marks this as a non deliverable mail but Mailscanner
> itself.
> I have the same problem, but on my systems (FreeBSD) these file manifest themselves as .com aka
> executeables.
>
>     Sender: xxxx at yyyy.com
> IP Address: 85.233.160.19
>  Recipient: aaaaaa at bbbbbbb.com
>    Subject: ??: {Filename?} ??: ??? ????
>  MessageID: 6CE3ED46417.AFAF9
> Quarantine: /var/spool/MailScanner/quarantine/20110929/6CE3ED46417.AFAF9
>     Report: MailScanner: No programs allowed (msg-85973-48.txt)
>
> I still have not find a way to let them pass without allowing executeables for the domains that
> send them.
>
> Regards
> Johan Hendriks

I believe Glenn's solution is right. But i will know in a few days.

-- 
Later

Mogens Melander



-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.