Re: [Mimedefang] Warning: Malformed MIME virus in the wild

2014-02-12 Thread David F. Skoll
On Tue, 11 Feb 2014 22:19:01 +0100 (CET) Kees Theunissen wrote: > I found this old message when I was searching my mailboxes for > malformed "Content-Disposition" MIME headers. > Note that the "name=" field in the Content-Disposition header above is > also wrong. This should be a "filename=" fiel

Re: [Mimedefang] Warning: Malformed MIME virus in the wild

2014-02-11 Thread Kees Theunissen
On Thu, 10 Oct 2013, David F. Skoll wrote: >Hi, > >We've run into a malformed MIME virus that has a structure like this: > >= >To: some...@example.com >Subject: Payroll Received by Intuit >MIME-Version: 1.0 >Conten

Re: [Mimedefang] Warning: Malformed MIME virus in the wild

2013-10-10 Thread Kevin A. McGrail
On 10/10/2013 4:46 PM, David F. Skoll wrote: full __RP_ZIP_TYPE /name\s{0,2}=\s{0,2}.{0,80}\.zip/i full __RP_EMPTY_CTYPE /Content-Type:\s{0,4};/i meta RP_ZIP_ECTYP __RP_EMPTY_CTYPE && __RP_ZIP_TYPE describe RP_ZIP_ECTYP Zip file attachment with bogus Content-Type: header scoreRP_ZIP_E

[Mimedefang] Warning: Malformed MIME virus in the wild

2013-10-10 Thread David F. Skoll
Hi, We've run into a malformed MIME virus that has a structure like this: = To: some...@example.com Subject: Payroll Received by Intuit MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="--boundary" -