I notice that the email starting with &ecaute; (é - small e with acute accent) are quarantined. To reproduce it, the email must be send from a webmail (like gmail), with Outlook not happens.
I tried some instructions found on Internet:
h t t p://lists.mailscanner.info/pipermail/mailscanner/2009-May/091419.html
with no success, or the message is quarantined or seems like all executable message are considered clean (regardless of MIME type).
Like above url comments I try to add on /usr/mailscanner/etc/filetype.rules.conf above of the deny rule (with tab separation):
Code: Select all
allow executable text - -
Code: Select all
allow executable texxxxxt - -
text/plain; charset=iso-8859-1
text\/plain
and so on...
The file command information of one of the emails involved:
# file ./20100125/1NZOLT-00089J-AG/msg-31235-17.txt
./20100125/1NZOLT-00089J-AG/msg-31235-17.txt: DOS executable (COM)
# file -i ./20100125/1NZOLT-00089J-AG/msg-31235-17.txt
./20100125/1NZOLT-00089J-AG/msg-31235-17.txt: text/plain; charset=iso-8859-1
Finally, I applied the instructions on:
h t t p:// article.gmane.org/gmane.mail.virus.mailscanner/20385/
1.- Change /usr/share/file/magic adding:
Code: Select all
0 byte 0xe9 DOS executable ISO 8859-1 text
Code: Select all
# file -C
Code: Select all
allow DOS executable ISO 8859-1 text - -
Any suggestion will be appreciated.
Thanks in advance.
Regards