so you think something like filename="=?
shouldn't appear in a legal mail? that would give us the opportunity to filter for camouflaged attachmentnames. -----Ursprungliche Nachricht----- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Auftrag von R. Scott Perry Gesendet: Montag, 31. Januar 2005 19:58 An: [email protected] Betreff: Re: [Declude.JunkMail] new decoding-problem >we received a new mail, wich contains an attachment. the filename is coded >as follows: > >Content-Type: application/octet-stream; > name="=?koi8-r?B?NC5wZGYuZXhl?=" > >we are running a filter that searches for combinations like this, but with >the used encoding, declude seems to be unable to track this attachmentname. If I recall correctly, this isn't technically legal. However, we are looking at the possibility of decoding filenames for banning file extensions (virus scanning will still work properly with these encoded filenames). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
