[Mimedefang] SoBig.E slipping through

Minica, Nelson (EDS) Nelson.Minica at RailAmerica.com
Tue Jul 1 11:03:00 EDT 2003

Perfect Michael, thanks!  Mimedefang was seeing a " in front, where Outlook
was not...

     Quarantined attachment "your_details.zip contains a virus: [SoBig.E]


-----Original Message-----
From: Michael Sims [mailto:michaels at crye-leike.com] 

I did some testing with Sobig.E and noticed that frequently MD thought the
filename was:


Note the trailing double quote.  I'm not sure why as I didn't spend a lot of
time with it, but I'm sure it has something to do with invalid MIME.  I
suggest you use a regex instead of the eq operator.  I suggest using this

if ($fname =~ /your_details\.zi/i) {

More information about the MIMEDefang mailing list