Hi, I have a client trying to send us Premavara files (scheduling drawings) however it get bounced with this error. The thing is that there is not an .exe file attached and if he zip's the file we get the same error. I am using amavisd-new with ClamAV, SA and Postfix. I think the error is coming ClamAV but if it is coming from one of the other prgs please let me know.
-------------------------------------------------
No viruses were found.
A banned name (.exe) was found.
BANNED CONTENTS ALERT
Our content checker found
banned name: .exe
in email presumably from you (<[EMAIL PROTECTED]>), to the following
recipients:
-> [EMAIL PROTECTED]
-> [EMAIL PROTECTED]
Delivery of the email was stopped!
The message has been blocked because it contains a component
(as a MIME part or nested within) with declared name
or MIME type or contents type violating our access policy.
To transfer contents that may be considered risky or unwanted
by site policies, or simply too large for mailing, please consider
publishing your content on the web, and only sending an URL of the
document to the recipient.
Depending on the recipient and sender site policies, with a little
effort it might still be possible to send any contents (including
viruses) using one of the following methods:
- encrypted using pgp, gpg or other encryption methods;
- wrapped in a password-protected or scrambled container or archive
(e.g.: zip -e, arj -g, arc g, rar -p, or other methods)
Note that if the contents is not intended to be secret, the
encryption key or password may be included in the same message
for recipient's convenience.
We are sorry for inconvenience if the contents was not malicious.
The purpose of these restrictions is to cut the most common propagation
methods used by viruses and other malware. These often exploit automatic
mechanisms and security holes in certain mail readers (Microsoft mail
readers and browsers are a common and easy target). By requiring an
explicit and decisive action from the recipient to decode mail,
the dangers of automatic malware propagation is largely reduced.
For your reference, here are headers from your email:
The mail originated from: <[EMAIL PROTECTED]>
According to the 'Received:' trace, the message originated at:
PROJECTMANAGER [68.233.75.58]
The message WAS NOT delivered to:
<[EMAIL PROTECTED]>:
550 5.7.1 Message content rejected, id=17085-07 - BANNED: .exe
<[EMAIL PROTECTED]>:
550 5.7.1 Message content rejected, id=17085-07 - BANNED: .exe
The message has been quarantined as:
/var/amavisd/quarantine/virus-20040909-095702-17085-07
------------------------- BEGIN HEADERS -----------------------------
Return-Path: <[EMAIL PROTECTED]>
Received: from mail.cormackbuilders.com (ns2.locustcreek.net [64.30.43.3])
by gateway.sdcassociates.com (Postfix) with ESMTP;
Thu, 9 Sep 2004 09:56:54 -0700 (PDT)
Received: from PROJECTMANAGER [68.233.75.58] by mail.cormackbuilders.com with ESMTP
(SMTPD32-8.12) id AB3F2ACF008C; Thu, 09 Sep 2004 12:56:31 -0400
Reply-To: <[EMAIL PROTECTED]>
From: "Tim Opgenorth" <[EMAIL PROTECTED]>
To: "Anwar Hafeez" <[EMAIL PROTECTED]>
Cc: "Dakus Gunn" <[EMAIL PROTECTED]>
Subject: Primavera project: (Project Groups): CB01:FGRD
Date: Thu, 9 Sep 2004 12:56:30 -0400
Message-ID: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_007C_01C4966C.6D1FC710"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441
Importance: Normal
-------------------------- END HEADERS ------------------------------
- Re: [Clamav-users] Banned file type is not there!! Sean Hafeez
