On Sun, 30 Mar 2003 15:33:01 -0500, Samuel W. Heywood wrote:
> On Sun, 30 Mar 2003 19:13:10 +00, Bastiaan Edelman, PA3FFZ wrote:
>> Hi Samuel,
>> Are you sure Arachne did not decode the attachment?
>> It may not have been written to a file yet... but it is written to the
>> cache already, decoded.
>> CU, Bastiaan
> Yes, I am sure. Executable programs sent as MIME-encoded email
> attachments and received by Arachne's email client do not get
> automagically decoded and written to cache unless one clicks on
> the attachment ikon.
Sorry to contradict you, but....
You are mistaken in that assumption.
The attachment is "dettached" and written into the cache directory
As so as we view the .CNM, .TBS .SNT or .MES itself.
Have a look at the text along with that "icon" for the attachment.
>From the bottom of the viewed .TBS I just now saved into my outbox
to-which I attached djpeg32.exe
File "\arachne\cache\djpeg32.exe" written.
I have not as-yet "clicked" on the attachment icon.
-- dir listing of my cache ---
Volume in drive L is MS-RAMDRIVE
Directory of L:\ARACHNE\CACHE
. <DIR> 3-31-03 6:11p
.. <DIR> 3-31-03 6:11p
HEADERS <DIR> 3-31-03 6:11p
49153631 HTM 3306 3-31-03 6:33p
DJPEG32 EXE 110745 3-31-03 6:33p
5 File(s) 56659968 bytes free
______________________________
>> On Sat, 29 Mar 2003 23:55:55 -0500, Samuel W. Heywood wrote:
>>> I have noticed that F-prot AV will discover, flag, identify, and report
>>> any MIME-encoded email attachments containing viruses in messages
>>> received by Arachne's email client, even if the the attachment has not
>>> yet been decoded and saved to a file.
>>> In the case of messages received by Nettamer's email client a
>>> MIME-encoded attachment containing a virus will not get caught by
>>> F-prot until after the attachment has been decoded and saved to a
>>> file.
>>> This applies even in the case of same virus, different email client.
>>> I wonder why this is so. Does anyone know why?
> Sam Heywood
> - --
> This mail was written by user of The Arachne Browser:
> http://browser.arachne.cz/
> ------------------------------
--
Glenn
http://arachne.cz/
http://www.delorie.com/listserv/mime/
http://www.cisnet.com/glennmcc/
