[email protected] wrote:
EMail to a mailing list that is mirrored on a local newsgroup in dNews from 1 particular user is bounced on a regular basis.
Can you get the user in question to send a similar email to us please ([EMAIL PROTECTED]) and then we can examine the headers and try and figure out why it's giving a false positive.
ChrisP.
Admin receives this notice:
The following LOCAL POST was blocked by the spam rules line 1: Message contains executable programs You either have a local spammer who needs to be found Or your spam rules, filter.dat etc may need adjusting Examine dnews.in and dnews.log for more details line 1: Message contains executable programs Set spam_noreport true in dnews.conf to stop these emails First 2000 characters of spam item follows
_____________________________
I look at the original message and there's no attachment in sight. The only thing I can think of is maybe the filter sees this in the headers:
X-MS-Has-Attach: X-MIME-Autoconverted: from quoted-printable to 8bit by news.wolfcrews.com
id j0IGroC8500391
_____________________________
My exe filter is simply:
# cat /usr/admin/news_spam_filter
if (attach("*.exe,*.com,*.zip,*.pif,*.scr,*.vbs,*.bat,*.jav*")) reject
"Message contains executable programs"
accept "This message is ok"
#
____________________________
The message makes it's way around the mailing list itself with no problem, just the news server rejecting it.
Jeff
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Jeffrey James Wolfanger Sick * '01 FXSTI
UNIX Systems Programmer - Buffalo State College http://www.wolfcrews.com - All My Sites ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
