<p><br>
Den 3 okt 2011 15:57 skrev "Johan Hendriks" <<a href="mailto:Johan@double-l.nl">Johan@double-l.nl</a>>:<br>
><br>
> >Hi guys<br>
> ><br>
> >I'm having problems with text being detected as MPEG files.<br>
> >The error I'm getting from MS is:<br>
> ><br>
> >The following e-mails were found to have: Bad Filename Detected<br>
> ><br>
> > Sender: <a href="mailto:xxxxx@example.com">xxxxx@example.com</a><br>
> >IP Address: 192.168.0.210<br>
> > Recipient: yyyyy@example.>org<br>
> > Subject: RE: Statistik<br>
> > MessageID: p937N5Zx000344<br>
> >Quarantine: /var/spool/MailScanner/quarantine/20111003/p937N5Zx000344<br>
> > Report: MailScanner: No MPEG movies allowed (msg-2048-10.txt)<br>
> ><br>
> >This has been up before, but can't seem to find the solution.<br>
> ><br>
> >Any clues on how to handle this?<br>
> ><br>
> >The first couple of lines in the file is ( ? = danish character ć ):<br>
> ><br>
> >V?rsgo<br>
> ><br>
> >Glostrup Pakke blev ikke solgt i denne periode...<br>
> ><br>
> >The first 8 bytes of 'msg-2048-10.txt' in HEX are:<br>
> ><br>
> >00000000 56 E6 72 73 ¦ 67 6F 0A 20<br>
> ><br>
> >Using the file command, i get:<br>
> ><br>
> ># file msg-2048-10.txt<br>
> >msg-2048-10.txt: MPEG-4 LOAS<br>
> ><br>
> >Adding an -i parameter give:<br>
> ><br>
> ># file -i msg-2048-10.txt<br>
> >msg-2048-10.txt: audio/x-mp4a-latm; charset=iso-8859-1<br>
> ><br>
> ># MailScanner -V<br>
> >Running on<br>
> >Linux gphgw 2.6.30.5 #1 SMP PREEMPT Mon Sep 14 11:49:43 CEST 2009<br>
> >i686 Intel(R) Core(TM)2 Duo CPU E7400 @ 2.80GHz GenuineIntel GNU/Linux<br>
> ><br>
> >This is Perl version 5.010001 (5.10.1)<br>
> >This is MailScanner version 4.82.6<br>
> >SpamAssassin 3.3.1<br>
> ><br>
> >All perl modules are up to date.<br>
> ><br>
> >--<br>
> >Later<br>
> ><br>
> >Mogens Melander<br>
><br>
> As far as i know, it is not clamav that Marks this as a non deliverable mail but Mailscanner itself.</p>
<p>Mogens (and possibly your) problem is not caused by clam itself, but is a side effect of presenting clam with the message text as a separate file/attachment. Doing that means that all filters (including the file command) will be run on that file... Fine for the anglophones, less good for greek, danish, swedish etc, since common phrases will trigger ... naive ... magic strings. So you can attack the problem two ways:<br>
- tell MS not to store the message text for scanning, or<br>
- change the magic strings to be less naive.</p>
<p>In the case of microsoft com executables, the magic is real bad, often consisting of a singel byte of data, so there I'd recommend the latter approach... Or turn off and be done using clam for spam, more or less;-) </p>
<p>Cheers<br>
-- <br>
-- Glenn</p>
<p>> I have the same problem, but on my systems (FreeBSD) these file manifest themselves as .com aka executeables.<br>
><br>
> Sender: <a href="mailto:xxxx@yyyy.com">xxxx@yyyy.com</a><br>
> IP Address: 85.233.160.19<br>
> Recipient: <a href="mailto:aaaaaa@bbbbbbb.com">aaaaaa@bbbbbbb.com</a><br>
> Subject: ??: {Filename?} ??: ??? ????<br>
> MessageID: 6CE3ED46417.AFAF9<br>
> Quarantine: /var/spool/MailScanner/quarantine/20110929/6CE3ED46417.AFAF9<br>
> Report: MailScanner: No programs allowed (msg-85973-48.txt)<br>
><br>
> I still have not find a way to let them pass without allowing executeables for the domains that send them.<br>
><br>
> Regards<br>
> Johan Hendriks<br>
><br>
><br>
><br>
><br>
><br>
> --<br>
> MailScanner mailing list<br>
> <a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
> <a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
><br>
> Before posting, read <a href="http://wiki.mailscanner.info/posting">http://wiki.mailscanner.info/posting</a><br>
><br>
> Support MailScanner development - buy the book off the website!<br>
</p>