<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">The other thing is to use the Sanesecurity patterns for ClamAV.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">They catch these pretty quickly.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Cheers,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><br>
Phil<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D">--</span><span style="color:#1F497D">
<br>
</span><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D">Phil Randal | Infrastructure Engineer</span><span style="color:#1F497D">
<br>
</span><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#400040">NHS Herefordshire & Herefordshire Council |</span><span style="color:#1F497D">
</span><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D">Deputy Chief Executive's Office | I.C.T. Services Division</span><span style="color:#1F497D">
<br>
</span><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D">Thorn Office Centre, Rotherwas, Hereford, HR2 6JT</span><span style="color:#1F497D">
<br>
</span><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D">Tel: 01432 260160</span><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info]
<b>On Behalf Of </b>Martin Hepworth<br>
<b>Sent:</b> 05 April 2011 14:09<br>
<b>To:</b> MailScanner discussion<br>
<b>Subject:</b> Re: Blocking emails with dangerous attachments<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">check you're scanning inside zip archives - these are coming in as zip not .exe<br>
<br clear="all">
-- <br>
Martin Hepworth<br>
Oxford, UK<br>
<br>
<o:p></o:p></p>
<div>
<p class="MsoNormal">On 5 April 2011 10:45, Richard Coombe <<a href="mailto:richard.coombe@taffhousing.co.uk">richard.coombe@taffhousing.co.uk</a>> wrote:<o:p></o:p></p>
<p class="MsoNormal">Hi,<br>
<br>
We're blocking all incoming exe attachments. However we're getting some spam/virus email with exe attachments, ("Your DHL / UPS package is ready" type stuff). The exe gets removed and then the rest of the message is delivered with an attachment warning report.
This is annoying my end users as they're not interested in the email in any way.<br>
<br>
Is there a config setting to quarantine emails that have had their attachments stripped?<br>
<br>
I can only find 'Deliver Cleaned Messages' in MailScanner.conf. However I also have emails from other legitimate mailing lists that have URLs in them which get 'disarmed' and I _do_ want to deliver these message. So I don't think I can change this to 'no',
I think I need a more fine grained approach.<br>
<br>
Am using Mailscanner with spamassassin and clamav.<br>
<br>
Cheers,<br>
Richard<br>
IT Manager, Taff Housing Association<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
This message is private and confidential. If you have received this message in error, please notify us and remove it from your system.<br>
Please consider the environment before printing this email.<br>
<br>
Any views or other information in this message which do not relate to our business are not authorised by us, nor does this message form part of any contract unless so stated.<br>
<br>
Taff Housing Association - <a href="http://www.taffhousing.co.uk" target="_blank">
www.taffhousing.co.uk</a> - A Charitable Housing Association registered under the Industrial and Provident Societies Acts 1965 No. 21408R. Registered by The National Assembly for Wales No. L009. Registered address: Alexandra House, 307-315 Cowbridge Road East,
Cardiff CF5 1JD. VAT Registration Number: 869 8405 65.<br>
<span style="color:#888888">--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">
http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!</span><o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<DIV> </DIV>Any opinion expressed in this e-mail or any attached files are those of the individual and not necessarily those of Herefordshire Council.<br>You should be aware that Herefordshire Council monitors its email service.<br>This e-mail and any attached files are confidential and intended solely for the use of the addressee. This communication may contain material protected by law from being passed on. If you are not the intended recipient and have received this e-mail in error, you are advised that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please contact the sender immediately and destroy all copies of it.</body>
</html>