Reposting -----Original Message----- From: Beach, Bill Sent: Thursday, February 10, 2005 8:10 AM To: '[email protected]' Subject: RE: [Declude.Virus] Mismatched extensions
Scott, Is there an RFC I can reference/research to forward to the sender? They're using an automated program for sending these out and I'd like to be able to provide them with something to go back to the developer(s) with to show that they're doing it wrong. Bill -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Tuesday, February 08, 2005 2:13 PM To: [email protected] Subject: Re: [Declude.Virus] Mismatched extensions >02/04/2005 15:43:04 Qde56270 Found file with mismatched extensions >[24580000.pdf- "24580000.pdf"]; assuming .exe Here, the filename was included twice in the MIME headers, once correctly, and once incorrectly (with quotes). So the second instance appears as an extension of '.pdf"', which is different than the .pdf extension. Since Declude Virus can't know if a .pdf" extension is better or worse than a .pdf extension, it treats the file as an .exe. >I know this was discussed a couple of years ago >(http://www.mail-archive.com/[email protected]/msg04123.html) >(in fact I posted that it was happening to me then), but I was just >informed that one of my users isn't getting his newsletter. > >Any suggestions? Get the sender to fix the problem. :) -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
