RE: [AMaViS-user] Testvirus

[Bojan Z. <Boj...@LS...>]

Hi Mark, 

> -----Original Message-----
> From: ama...@li... 
> [mailto:ama...@li...] On Behalf Of 
> Mark Martinec
> Sent: Saturday, 17 April 2004 7:22 a.m.
> To: ama...@li...
> Subject: Re: [AMaViS-user] Testvirus
> 
> The #24 contains 'Content-type: message/partial' MIME type.
> You can block it as suggested in the example:
> 
> $banned_filename_re = new_RE(
>   ...
>   qr'^message/partial$'i,   # block rfc2046

Argh, thanks, I managed to miss that :)

> | #25 - Attachment with a CLSID extension which may hide the real file
> | extension. This does not include Eicar virus, but your mail 
> server still
> | must block this since it can hide the true extension of a file.
> 
> amavisd-new does not rely much on file names and types as given
> in the mail headers or subheaders. If such mail would contain
> a virus or a banned file(1) type, it would be blocked,
> regardless of what hidden extension holds.

Excellent, this is what I hoped you'll write.
Thanks for your answers, they are very helpful as always.

Cheers,

Bojan