Re: [AMaViS-user] failed tests (16, 24, 25) for testvirus.org

[Eddy B. <edd...@he...>]

> Eddy Beliveau wrote:
> > Test #16: Eicar string in HTML, to ensure that your mail server scans HTML segments
> >
> > Test #24: Test for the "Partial (Fragmented) Vulnerability". This does not include Eicar virus,
but
> > your mail server still must block this since it can break a virus into multiple emails and
> > reassemble it in your inbox. (attachment can be opened by virtually any mail program)
> >
> > Test #25: Attachment with a CLSID extension which may hide the real file extension. This does
not
> > include Eicar virus, but your mail server still must block this since it can hide the true
extension
> > of a file. (attachment can be opened by any Windows computer)

da...@eg... said:
> Not sure on 16. 24 and 25 have examples in the amavisd.conf file on how
> to block them.  24 means including the attachment/partial and some such
> in your block list. 25 means including the [{}] string in your block list.
>
> If it ever gets posted to the list (Suspicious header?!) see my message
> with my amavisd.conf for examples.
>
> Why are you using p8-rc3? Use p9.

Hi! Dan,

I upgrade to p9.  Thanks for the suggestion

I did change the block list as you recommend
Now tests 24 and 25 are getting block correctly... thanks   :-)

But test 16 is NOT getting blocked

Can you try to block test 16 and tell me the reject message that get on your maillog

Thanks,
Eddy