BANNED attachment Alert

I got an email with the following in the header.  However,
when I
released it, there was no attachment, just some html text
from a guy in
Russia.  Am I understanding this right?  This tells me that
there was a
file with a .exe extension, which was blocked.

 

X-Amavis-Alert: BANNED, message contains part:
multipart/alternative |

        text/plain,.exe

 

Wazir A. Shpoon

Senior Application Engineer
>|SECNAP Network Security

Winner - Hot Companies of 2008
Office: 561-999-5000 x 1256
Direct: 561-939-7256

 


____________________________________________________________
_____________
This email has been scanned and certified safe by
SpammerTrap(tm). 
For Information please see http://www.spammertrap.com

____________________________________________________________
_____________

------------------------------------------------------------
-------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

Wazir,

> I got an email with the following in the header. 
However, when I
> released it, there was no attachment, just some html
text from a guy in
> Russia.

amavisd does not strip attachments: neither when a message
is passed directly,
nor on releasing from a quarantine.

> Am I understanding this right?  This tells me that
there was a 
> file with a .exe extension, which was blocked.

> X-Amavis-Alert: BANNED, message contains part:
>   multipart/alternative | text/plain,.exe

No, there was no attachment. There was a single MIME leaf
part
wrapped within a multipart/alternative container.

The leaf node was (MIME-)declared as text/plain,
no filename was suggested in a header,
and the file(1) utility recognized it as some
executable (not a Microsoft executable).
It is quite possible the file(1) verdict was wrong,
as can sometimes happen with text in 8-bit character sets.

  Mark

------------------------------------------------------------
-------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/