Hi Chris, Seems to me, that the scanner reported the virus, that is running wild on the internet right now, it's called SirCam and is a worm. It uses a randomly chosen document attachments for its spreading out and disguises itself as a word document, but as you can see because of the .com extension it really is an executable. Check out http:[EMAIL PROTECTED] for further information. The last few days our Anti-Virus SMTP Gateway cleaned about 300 documents containing this beast. Regards Reto Inversini ----- Original Message ----- From: "Chris Moore" <[EMAIL PROTECTED]> To: "Qmail (E-mail)" <[EMAIL PROTECTED]> Sent: Thursday, July 26, 2001 7:34 PM Subject: Qmail-scanner or spam problem?? > Hi, in the last few days, I have been getting about 30-50 of the following > error messages daily related to qmail-scanner whereas I used to get only > about 10 a day: > > ----------------------------------------------------------- > Attention: System Anti-Virus Administrator. > > [This message was _not_ sent to the originator, as they appear to > be a mailing-list or other automated Email message] > > > A Illegal attachment type was found in an Email message you sent. > This Email scanner intercepted it and stopped the entire message > reaching it's destination. > > The Illegal attachment type was reported to be: > > Executables > > > Please contact your I.T support personnel with any queries regarding this > policy. > > > Your message was sent with the following envelope: > > MAIL FROM: > RCPT TO: [EMAIL PROTECTED] > > ... and with the following headers: > > From: System Administrator <[EMAIL PROTECTED]> > To: [EMAIL PROTECTED] > Subject: Undeliverable: New Microsoft Word Document > Message-ID: <89F778E18E64D511992900010276889622116C@MERCURY> > Date: Thu, 26 Jul 2001 13:20:52 -0400 > > > > The original message is kept in: > > xxxxxxxxxxxxxx.com:/var/spool/qmailscan/quarantine > > where the System Anti-Virus Administrator can further diagnose it. > > The Email scanner reported the following when it scanned that message: > > --- > > ---perlscanner results --- > Illegal attachment type 'Executables' found in file > /var/spool/qmailscan/xxxxxxxxxxxxxx.com9961680364862/_Microsoft_Word_Documen > t.doc.com > -------------------------------------------------------- > > It appears to be relay spam, but could it be a problem with the > scanning?...or a message stuck in the queue? I don't know the originator, > but I assume they keep sending it periodically. It also looks like a way to > get DoS by filling my disk with attachments. > > Anyone have any ideas or a workaround or solution? > > Thanks! > ... > Chris
