On Wed, 29 Sep 2004, Joseph Brennan wrote:
> http://www.columbia.edu/~brennan/virusmail.txt
If you feed that to mimedefang.pl -structure, you get:
$ mimedefang.pl -structure < virusmail.txt
non-leaf: type=multipart/digest; fname=; disp=inline
leaf: type=text/plain; fname=; disp=inline
non-leaf: type=message/rfc822; fname=vim_12313.ezm; disp=inline
leaf: type=text/plain; fname=; disp=inline
non-leaf: type=message/rfc822; fname=vim_12323.ezm; disp=inline
leaf: type=text/plain; fname=; disp=inline
non-leaf: type=message/rfc822; fname=vim_12345.ezm; disp=inline
leaf: type=text/plain; fname=; disp=inline
non-leaf: type=message/rfc822; fname=vim_12346.ezm; disp=inline
leaf: type=text/plain; fname=; disp=inline
non-leaf: type=message/rfc822; fname=vim_12348.ezm; disp=inline
leaf: type=text/plain; fname=; disp=inline
non-leaf: type=message/rfc822; fname=vim_12489.ezm; disp=inline
non-leaf: type=multipart/alternative; fname=; disp=inline
leaf: type=text/plain; fname=; disp=inline
leaf: type=text/html; fname=; disp=inline
non-leaf: type=message/rfc822; fname=vim_12507.ezm; disp=inline
leaf: type=text/plain; fname=; disp=inline
> A few mime parts down, see an executable attachment called
> message.scr.
The "attachment" is just plain text shoved as-is into the first
text/plain part. It isn't even seen by MIMEDefang, nor should it
be seen or decoded by a correctly-written MUA.
That's not to say a stupid MUA won't try to extract it...
Regards,
David.
_______________________________________________
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
