Koozali.org: home of the SME Server

Obsolete Releases => SME Server 7.x => Topic started by: CKConsulting on September 12, 2006, 04:35:37 AM

Title: Content to Block????
Post by: CKConsulting on September 12, 2006, 04:35:37 AM

Am I blind???

Under EMAIL and "Content to Block"
How do I find out what it is blocking (PC Executable TVoAAAAA) means nothing to me?

I searched but I keep coming up black, it's been a long day and my users are starting to get an email about Virus'a and Worm's  and Please run this update...........

Thanks
Rick

Title: Content to Block????
Post by: william_syd on September 12, 2006, 06:28:29 AM

Quote from: "Someone_on_the_net"

The filter works by looking for the base64 encoded start of a windows executable, which supposedly always looks the same.

Title: Re: Content to Block????
Post by: raem on September 12, 2006, 09:49:28 AM

CKConsulting

> How do I find out what it is blocking (PC Executable TVoAAAAA) means nothing to me?

Read the original HowTo for technical background, see Analyzing and creating patterns, note there are additional patterns in sme7.


> ....my users are starting to get an email about Virus'a and Worm's  and Please run this update...........

The pattern matching feature is blocking incoming emails with attachments with executable content.
Your issue sounds more like you have a local virus infection or are receiving messages sent by a virus infection on someone else's PC, or even a bogus email trying to infect you when you click on the link to update. It could be a browser hijack too.