<html><head><title>Banned files claiming to be quarantined, but not in quarantine</title>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-15">
</head>
<body>
<span style=" font-family:'Courier New'; font-size: 9pt;">So, I've had two of these:<br>
<br>
The server gets a message with winmail.dat which is banned through the rule that blocks tnef's.<br>
Which, while may not be exactly how I want it to act, I'm fine with it so far.<br>
<br>
This is the "report" for the banned file:<br>
---<br>
No viruses were found.<br>
<br>
Banned name: .image,.png,image001.png,image001.png<br>
Content type: Banned<br>
Internal reference code for the message is 21212-12/vdxXxXxXxXxX<br>
<br>
First upstream SMTP client IP address: [12.121.212.121] xyxz-xyz.zxy.xyz.zzx.xxxzzz.com<br>
According to a 'Received:' trace, the message originated at: [45.545.454.545],<br>
xyzxyzxyz@xyz.com [5.4.3.2]<br>
<br>
Return-Path: <xyzxyzxyz@xyz.com><br>
From: "ABC XYZ" <xyzxyzxyz@xyz.com><br>
Message-ID:<br>
<123456789.123456789@xyz.com><br>
Subject: blah blah blah blah blah blah<br>
The message has been quarantined as: abc@def.com<br>
<br>
The message WAS NOT relayed to:<br>
<def@def.com>:<br>
250 2.7.0 Ok, discarded, id=19676-18 - BANNED: .image,.png,image001.png,image001.png<br>
<ghi@def.com>:<br>
250 2.7.0 Ok, discarded, id=19676-18 - BANNED: .image,.png,image001.png,image001.png<br>
---<br>
<br>
So, it claims to have quarantined it - there's no file name that it quarantined it as. And if I search the quarantine directories for this message, it's simply not there.<br>
<br>
Can someone shed some light on this?<br>
<br>
Amavis-new 2.6.5 on Ubuntu 12.04, with Postfix and Dovecot.<br>
Pre-accept proxy setup.<br>
Relevent vars:<br>
$final_banned_destiny = D_DISCARD;<br>
$virus_admin = '</span><a style=" font-family:'Courier New'; font-size: 9pt;" href="mailto:sysop.alerts@royalmoore.com'">it-ops@somewhere.zzz'</a><span style=" font-family:'Courier New'; font-size: 9pt;">;<br>
$banned_quarantine_to = '</span><a style=" font-family:'Courier New'; font-size: 9pt;" href="mailto:sysop.alerts@royalmoore.com'">it-ops@somewhere.zzz'</a><span style=" font-family:'Courier New'; font-size: 9pt;">;<br>
<br>
Other messages - at least all we've seen so far get quarantined properly - it just appears to happen to messages with winmail.dat attachments.<br>
<br>
TIA<br>
-Greg</body></html>