<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html><head><title></title>
<META http-equiv=Content-Type content="text/html; charset=windows-1252">
<meta http-equiv="Content-Style-Type" content="text/css">
<style type="text/css"><!--
body {
margin: 5px 5px 5px 5px;
background-color: #ffffff;
}
/* ---------- Text Styles ---------- */
hr { color: #000000}
body, table /* Normal text */
{
font-size: 9pt;
font-family: 'Courier New';
font-style: normal;
font-weight: normal;
color: #000000;
text-decoration: none;
}
span.rvts1 /* Heading */
{
font-size: 10pt;
font-family: 'Arial';
font-weight: bold;
color: #0000ff;
}
span.rvts2 /* Subheading */
{
font-size: 10pt;
font-family: 'Arial';
font-weight: bold;
color: #000080;
}
span.rvts3 /* Keywords */
{
font-size: 10pt;
font-family: 'Arial';
font-style: italic;
color: #800000;
}
a.rvts4, span.rvts4 /* Jump 1 */
{
font-size: 10pt;
font-family: 'Arial';
color: #008000;
text-decoration: underline;
}
a.rvts5, span.rvts5 /* Jump 2 */
{
font-size: 10pt;
font-family: 'Arial';
color: #008000;
text-decoration: underline;
}
span.rvts6
{
font-weight: bold;
color: #800000;
}
span.rvts7
{
font-weight: bold;
color: #800080;
}
a.rvts8, span.rvts8
{
color: #0000ff;
text-decoration: underline;
}
span.rvts9
{
font-weight: bold;
color: #800080;
}
/* ---------- Para Styles ---------- */
p,ul,ol /* Paragraph Style */
{
text-align: left;
text-indent: 0px;
padding: 0px 0px 0px 0px;
margin: 0px 0px 0px 0px;
}
.rvps1 /* Centered */
{
text-align: center;
}
--></style>
</head>
<body>
<p>That was my first question too! according to logs file:</p>
<p><br></p>
<p>Jan 22 14:51:35 firewall sendmail[8685]: l0MEpX6K008685: from=<jlcostinha@halla.pt>, size=4577117, class=0, nrcpts=1, msgid=<3210629128.20070122145335@halla.pt>, proto=ESMTP, daemon=MTA, relay=[192.168.10.191]</p>
<p>Jan 22 14:51:37 firewall MailScanner[1877]: New Batch: Scanning 1 messages, 4577581 bytes</p>
<p>Jan 22 14:51:37 firewall MailScanner[1877]: Expired 1 records from the SpamAssassin cache</p>
<p>Jan 22 14:51:38 firewall MailScanner[1877]: Virus and Content Scanning: Starting</p>
<p>Jan 22 14:51:42 firewall MailScanner[1877]: Password protected file ./l0MEpX6K008685/horascompensa%%E7.xls</p>
<p>Jan 22 14:51:42 firewall MailScanner[1877]: Virus Scanning: Sophos found 1 infections</p>
<p>Jan 22 14:51:44 firewall MailScanner[1877]: Virus Scanning: Panda found 1 infections</p>
<p>Jan 22 14:51:44 firewall MailScanner[1877]: Infected message l0MEpX6K008685 came from 192.168.10.191</p>
<p>Jan 22 14:51:44 firewall MailScanner[1877]: Virus Scanning: Found 1 viruses</p>
<p><br></p>
<p>i would say yes to your question, right?</p>
<p><br></p>
<p><span class=rvts6>> Password protected = virus? Are you sure?</span></p>
<p><br></p>
<p><span class=rvts6>> Jorge Costinha wrote:</span></p>
<p><span class=rvts7>>> greatings all,</span></p>
<p><br></p>
<p><br></p>
<p><br></p>
<p><span class=rvts7>>> here what i have tried, unsuccessful:</span></p>
<p><br></p>
<p><br></p>
<p><span class=rvts7>>> in Mailscanner.conf</span></p>
<p><br></p>
<p><br></p>
<p><span class=rvts7>>> .</span></p>
<p><br></p>
<p><span class=rvts7>>> .</span></p>
<p><br></p>
<p><span class=rvts7>>> .</span></p>
<p><br></p>
<p><span class=rvts7>>> Notify Senders of Viruses = %rules-dir%/NotifyVirusSenders.rules</span></p>
<p><br></p>
<p><span class=rvts7>>> .</span></p>
<p><br></p>
<p><span class=rvts7>>> .</span></p>
<p><br></p>
<p><span class=rvts7>>> .</span></p>
<p><br></p>
<p><br></p>
<p><br></p>
<p><span class=rvts7>>> contents of NotifyVirusSenders.rules</span></p>
<p><br></p>
<p><br></p>
<p><span class=rvts7>>> From: 192.168.10. yes</span></p>
<p><br></p>
<p><span class=rvts7>>> FromOrTo: Default no</span></p>
<p><br></p>
<p><br></p>
<p><br></p>
<p><span class=rvts7>>> ive tried change the ip to my domain, something like</span></p>
<p><br></p>
<p><br></p>
<p><span class=rvts7>>> From: *@mydomain.com <</span><a class=rvts8 href="mailto:*@mydomain.com">mailto:*@mydomain.com</a><span class=rvts9>> yes </span></p>
<p><br></p>
<p><br></p>
<p><span class=rvts7>>> didnt work. the purpose of this started when someone inside my network </span></p>
<p><span class=rvts7>>> sent an excel password-protected file. The email wasnt delivered and the </span></p>
<p><span class=rvts7>>> sender didnt get any notification. I figure that internal users should </span></p>
<p><span class=rvts7>>> be receive notifications. if anyone has a better idead, i would </span></p>
<p><span class=rvts7>>> appreciate. Anyway, i cant seem to identify the problem. </span></p>
<p><br></p>
<p><br></p>
<p><span class=rvts7>>> thanks in advance </span></p>
<p><br></p>
<p><span class=rvts7>>> __</span></p>
<p><br></p>
<p><span class=rvts7>>> Jorge Costinha</span></p>
<p><br></p>
<p><br></p>
<p><br></p>
<p><br></p>
<p><span class=rvts7>>> -- </span></p>
<p><span class=rvts7>>> This message has been scanned for viruses and</span></p>
<p><span class=rvts7>>> dangerous content by HCC Mailscanner software, and is</span></p>
<p><span class=rvts7>>> believed to be clean.</span></p>
<p><br></p>
<p><span class=rvts6>> -- </span></p>
<p><span class=rvts6>> MailScanner mailing list</span></p>
<p><a class=rvts8 href="mailto:mailscanner@lists.mailscanner.info">> mailscanner@lists.mailscanner.info</a></p>
<p><a class=rvts8 href="http://lists.mailscanner.info/mailman/listinfo/mailscanner"><font color="red"><b>MailScanner has detected a possible fraud attempt from "lists.mailscanner.info" claiming to be</b></font> > http://lists.mailscanner.info/mailman/listinfo/mailscanner</a></p>
<p><br></p>
<p><span class=rvts6>> Before posting, read </span><a class=rvts8 href="http://wiki.mailscanner.info/posting">http://wiki.mailscanner.info/posting</a></p>
<p><br></p>
<p><span class=rvts6>> Support MailScanner development - buy the book off the website! </span></p>
<p><br></p>
<p><br></p>
<p><br></p>
<p>__</p>
<p>Jorge Costinha</p>
<p>MIS Sénior Specialist</p>
<p>Halla climate Control Portugal</p>
<p>telf. 21 233 8825 Fax. 21 233 8801</p>
</body><br />--
<br />This message has been scanned for viruses and
<br />dangerous content by HCC Mailscanner software, and is
<br />believed to be clean.
</html>