Thanks for posting your quarantine-attachments.txt entries. I had a few of those, but the list sure helped. Also, add:
Information.zip 0 Bagle-H/I
...just got it that one.
File sizes I've seen are: MoreInfo.pif 12288 bytes TextFile.zip 12416 bytes Attach.zip 12420 bytes Readme.zip 12422 bytes Information.zip 12420 bytes
My message sizes (encoded or zipped) do not amount to 21440 bytes. Even any of the raw messages, with headers and all, don't amount to that much. ???
How about this: Is it possible to put a range in qmail-scanner? e.g.: .zip 12000-13000 Bagle-H/I
Ted
--On Tuesday, March 02, 2004 5:35 PM -0600 Trey Nolen <[EMAIL PROTECTED]> wrote:
It was getting through on us, and I added some stuff to the quarantine-attachements.txt file for qmail-scanner. Here is what I added:
AttachedFile.zip 0 Bagle-H/I Attach.zip 0 Bagle-H/I TextDocument.zip 0 Bagle-H/I Readme.zip 0 Bagle-H/I Msg.zip 0 Bagle-H/I MsgInfo.zip 0 Bagle-H/I Document.zip 0 Bagle-H/I Info.zip 0 Bagle-H/I AttachedDocument.zip 0 Bagle-H/I TextDocument.zip 0 Bagle-H/I Text.zip 0 Bagle-H/I TextFile.zip 0 Bagle-H/I Letter.zip 0 Bagle-H/I MoreInfo.zip 0 Bagle-H/I Message.zip 0 Bagle-H/I
Remember, those are <TABS> between the columns! Anyway, I saw a couple of attachments that were 21140 bytes in size and I'd like to use that in the middle column. Does anyone know if all the attachments are that size? Both Bagle-H and Bagle-I use the same filenames, but I don't know if the zip file is the same size, so I put 0 to catch all sizes.
Trey Nolen
Anyone else seeing the Bagle-H virus getting thru? I am using Q-S and sophie and it is not stopping them. Sophie sees that the ZIP file is password encrypted so can't check it for viruses and Q-S goes ahead and passes it thru. Does anyone know of any way to catch this one? For now I am blocking all ZIP attachments...
Thanks, --- Ed
------------------------------------------------------- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click _______________________________________________ Qmail-scanner-general mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
------------------------------------------------------- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click _______________________________________________ Qmail-scanner-general mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
