Excuse the noob question, but which log file would I look at to determine what is causing the false positive?

Ron Allison

On 9/16/05, Jake Vickers <[EMAIL PROTECTED]> wrote:
Ron Allison wrote:

> So what is the default attachment handling setup for qmailtoaster?
>
> I ask because I have a fairly default setup and one of my associates
> got an error while trying to send an email with an attachment.
> Specifically he got the error:
>
> 554 invalid message content (#5.3.2)
>
> He actually sent three different emails, all with PDF's attached and
> this is the only one that got an error.
>
> Thanks.
>
> Ron Allison

I think that one is failing because of Warlord.  We had a problem with
ZIP files (with a Word document inside, in a folder, which had to
contain a space) that had the same initial signature as the MyDoom virus.
The signature files are located at /var/qmail/control and are
badmimetypes, and badloadertypes.   Figure out which signature is giving
you false-positives and comment it out. Then run either
/var/qmail/bin/qmail-badloadertypes or /var/qmail/bin/badmimetypes to
recompile the db file. No reboot needed.  It's probably going to be in
badloadertypes. I had an Excel sheet that worked for months, and once
some more data was entered, it was blocked.  The badloadertypes file
takes the signature, and if ANY PART of the attachment matches, it
fails.  The badmimetype signature only match the first few bytes of the
file.

---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


Reply via email to