(no subject)

[Kevin Kobb]

On 10/3/2011 9:51 AM, Johan Hendriks wrote:
>> Hi guys
>>
>> I'm having problems with text being detected as MPEG files.
>> The error I'm getting from MS is:
>>
>> The following e-mails were found to have: Bad Filename Detected
>>
>>    Sender: xxxxx at example.com
>> IP Address: 192.168.0.210
>> Recipient: yyyyy at example.>org
>>   Subject: RE: Statistik
>> MessageID: p937N5Zx000344
>> Quarantine: /var/spool/MailScanner/quarantine/20111003/p937N5Zx000344
>>    Report: MailScanner: No MPEG movies allowed (msg-2048-10.txt)
>>
>> This has been up before, but can't seem to find the solution.
>>
>> Any clues on how to handle this?
>>
>> The first couple of lines in the file is ( ? = danish character æ ):
>>
>> V?rsgo
>>
>> Glostrup Pakke blev ikke solgt i denne periode...
>>
>> The first 8 bytes of 'msg-2048-10.txt' in HEX are:
>>
>> 00000000 56 E6 72 73 ¦ 67 6F 0A 20
>>
>> Using the file command, i get:
>>
>> # file msg-2048-10.txt
>> msg-2048-10.txt: MPEG-4 LOAS
>>
>> Adding an -i parameter give:
>>
>> # file -i msg-2048-10.txt
>> msg-2048-10.txt: audio/x-mp4a-latm; charset=iso-8859-1
>>
>> # MailScanner -V
>> Running on
>> Linux gphgw 2.6.30.5 #1 SMP PREEMPT Mon Sep 14 11:49:43 CEST 2009
>> i686 Intel(R) Core(TM)2 Duo CPU E7400 @ 2.80GHz GenuineIntel GNU/Linux
>>
>> This is Perl version 5.010001 (5.10.1)
>> This is MailScanner version 4.82.6
>> SpamAssassin 3.3.1
>>
>> All perl modules are up to date.
>>
>> -- 
>> Later
>>
>> Mogens Melander
> 
> As far as i know, it is not clamav that Marks this as a non deliverable mail but Mailscanner itself.
> I have the same problem, but on my systems (FreeBSD) these file manifest themselves as .com aka executeables.
> 
>     Sender: xxxx at yyyy.com
> IP Address: 85.233.160.19
>  Recipient: aaaaaa at bbbbbbb.com
>    Subject: ??: {Filename?} ??: ??? ????
>  MessageID: 6CE3ED46417.AFAF9
> Quarantine: /var/spool/MailScanner/quarantine/20110929/6CE3ED46417.AFAF9
>     Report: MailScanner: No programs allowed (msg-85973-48.txt)
> 
> I still have not find a way to let them pass without allowing executeables for the domains that send them.
> 
> Regards
> Johan Hendriks
> 
> 
> 
> 
>  
On FreeBSD, I have found that using the file command from ports
(sysutils/file) rather than the base system, took care of a lot of these
problems. The ports version is much newer.

Just make sure to update the file command path in your mailscanner config.