Good morning. Here's a new twist.
I got one this morning that read:
The mail server for continentaloffice.com does not accept E-mail with
attachments that contain the readme.zip extension.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Shacklett
Sent: Thursday, March 04, 2004 1:25 PM
To: [EMAIL PROTECTED]
Subject: [Declude.Virus] Bannotify.eml missing extension.
I saw this in the flood of messages today [or was it yesterday] and I can't
find it to chime in with a [forgive me] me too.
I have this line in my bannotify.eml:
quote
The mail server for %LOCALHOST% does not accept E-mail with attachments that
contain the %BANEXT% extension.
/quote
I just received a notification message that said:
quote
The mail server for continentaloffice.com does not accept E-mail with
attachments that contain the extension.
/quote
I dug out the D-file for that message and here's the relevant hunk out of
the MIME headers:
quote
--pbgivjxdscnisewbjysa
Content-Type: application/octet-stream; name=Readme.zip
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=Readme.zip
/quote
I have the D-file, and I have the log extract. This only happens
intermittently, but we've gotten so many over the last few days that I've
noticed them more than I would have otherwise. This was an encrypted ZIP
attachment, with an EXE inside. I'm doing BANZIPEXTSON and BANEZIPEXTS
ON, but not BANEXT ZIP or its ezip cousin. And finally, I am getting
other notifications with ZIP-scr or ZIP-exe in the %BANEXT% spot.
Having said all that: is this further evidence of a glitch or not? [I'm
almost totally befuddled at this point, and I hate being a me too. Sorry.]
--
John Shacklett
[EMAIL PROTECTED]
[EMAIL PROTECTED]
www.continentaloffice.com
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list. To unsubscribe, just
send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.
