[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: [cobalt-users] MailScanner: Warning: E-mail viruses detected



At 05:16 PM 2/15/2004 +0000, you wrote:

> Hi
>
> i've got 2 error messages from my server:
>
> #The following e-mail messages were found to have viruses in them:
> # Sender: uid@xxxxxxxxxx IP Address: 194.90.9.20
> #Recipient: uid1@xxxxxxxxxx
> #Subject:
> =?windows-1255?B?7Onj6SDh+iDy7ukgLSDg+eM6IOzy6eXvIOXg+eX4IPnsIPnu5eDs?=
> #MessageID: i1FErku03737
> #Report: Could not parse Outlook Rich Text attachment
>
> And this:
>
> #Our virus detector failed to completely analyse a message you sent:-
> #To: uid1@xxxxxxxxxx
> #Subject:
> =?windows-1255?B?7Onj6SDh+iDy7ukgLSDg+eM6IOzy6eXvIOXg+eX4IPnsIPnu5eDs?=
> #Date: Sun Feb 15 16:53:53 2004
> #Any parts of the message that could not be analysed will not have been
> delivered.
> #If you are using Microsoft Outlook, we strongly recommend you change your
> outgoing message format from "Rich Text" to "HTML" or "Plain Text".
> #1) Click on the "Tools" menu and choose "Options..."
> #2) Got to the "Mail Format" tab
> #3) For message format, select "HTML" or "Plain text"
> #4) Click OK
> #The virus detector said this about the message:
> #Report: Could not parse Outlook Rich Text attachment
>
> this was a HTML-formatted mail w/ MS Office 2003 .doc attachments.
> What could I do?
> Thank you
>
>
> Arthur Sherman
> IT Manager

Check the file names of the attachments, if it is something like "report
w.mids.doc" mailscanner will see it as a double extension and trap it
because of that. I've had that a couple of times.

Phil

It's most likely the TNEF check. It does break on some MS Office attachments. You'll need to look into the parsing of HTML content and attachments in your MailScanner.conf. Don't forget: changes do not take effect until you stop/start or restart MailScanner!