File(name|type) rules - was hijacked: "Allow Script Tags" affects attachments?

[Mark Sapiro]

On 02/08/2017 03:39 PM, Paul Scott wrote:
> 
> Unfortunately, in the meantime, I also had another incident where a sender sending an attachment resulted in this bounce-back email again (I added those "--START OF MESSAGE-- and --END..." banners):
> 
> 
> --START OF MESSAGE--
> Warning: This message has had one or more attachments removed
> Warning: (the entire message).
> Warning: Please read the "EdenUSAInc-Attachment-Warning.txt" attachment(s) for more information.
> 
> This is a message from the MailScanner E-Mail Virus Protection Service
> ----------------------------------------------------------------------
> The original e-mail attachment "the entire message"
> was believed to be dangerous and/or infected by a virus and has been replaced by this warning message.
> 
> Due to limitations placed on us by the Regulation of Investigatory Powers Act 2000, we were unable to keep a copy of the infected attachment. Please ask the sender of the message to disinfect their original version and send you a clean copy.
> 
> At Wed Feb  8 07:28:11 2017 the scanner said:
>    Too many attachments in message
> 
> --
> Postmaster
> Eden USA, Inc.
> www.edenitservices.com
> 
> For all your IT requirements visit: http://www.transtec.co.uk
> --END OF MESSAGE--


I am unable to duplicate this exactly, so I can't help much, but in
another post you said

> 1. I already had the number of attachments allowed set to allow as many as a client wishes (the -1 setting).


If you are thinking of "Maximum Attachment Size", thois is OK, but if
you really mean "Maximum Attachments Per Message", there is no
"unlimited" value, but '-1' might be interpreted as a very large,
unsigned number, so it might be OK.


> Also, where is that very last line coming from?  "For all your IT requirements visit: http://www.transteck.co.uk"


>From some ISP's MTA, either the sender or the recipient of the message.


> I really need to get this fixed.  Do you have any more ideas?  I simply need to SHUT OFF all file attachment scanning, and tell MailScanner somehow to stop doing anything at all with attachments.  I just want to allow everything through, in terms of attachments.


What does MailScanner log in the mail log for this message?

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan