Date: Tue, 27 May 2003 12:19:14 GMT
From: aves-test-1054037954@bre.klaki.net
Message-Id: <200305271219.h4RCJE921460@is105.filter.complex.is>
To: bre@klaki.net
Subject: Póstsķupróf (EXE skrį), beta0.is105.filter.complex.is, 12:19 27-05-2003Content-Type: multipart/mixed; boundary="filter-test-boundary"
X-Sanitizer: This message has been sanitized!
X-Sanitizer-URL: http://mailtools.anomy.net/
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="MIMEStream=_+testing99"
Content-Disposition: inline


--MIMEStream=_+testing99
Content-Type: multipart/alternative; boundary="MIMEStream=_+testing100"
Content-Disposition: inline


--MIMEStream=_+testing100
Content-Type: text/un.known+foo; charset="iso-8859-1"; name="unknown.000"
Content-Disposition: inline

Žetta er tilraunaskeyti til aš lįta reyna į uppsetningu póstsķu fyrir
bre@klaki.net, sent gegnum vélina beta0.is105.filter.complex.is.

Žetta skeyti er meš eitt višhengi sem žykist vera .EXE skrį.

--
Bjarni R. Einarsson                      / FRISK Software International
--------------------------v--------------------------------------------
Email:     xxx@xxxxx.is   | Company home page:  http://www.frisk.is/
Phone/SMS: +354-XXXXXXX   | Personal home page: http://bre.klaki.net/

--MIMEStream=_+testing100
Content-Type: text/html; charset="iso-8859-1"
Content-Disposition: inline

<html><body>
Žetta er tilraunaskeyti til aš lįta reyna į uppsetningu póstsķu fyrir
bre@klaki.net, sent gegnum vélina beta0.is105.filter.complex.is. <p>

Žetta skeyti er meš eitt višhengi sem žykist vera .EXE skrį.
<p>

<pre>
--
Bjarni R. Einarsson                      / FRISK Software International
--------------------------v--------------------------------------------
Email:     xxx@xxxxx.is   | Company home page:  http://www.frisk.is/
Phone/SMS: +354-XXXXXXX   | Personal home page: http://bre.klaki.net/
</pre>
</body></html>

--MIMEStream=_+testing100--
--MIMEStream=_+testing99
Content-Type: text/plain; charset="iso-8859-1"; name="DEFANGED-102.txt"
Content-Transfer-Encoding: 8bit
Content-Disposition: inline; name="DEFANGED-102.txt"

****
NOTE:  An attachment was deleted from this part of the message,
because it failed one or more checks by the virus scanning system.
See the attached sanitization log for more details or contact your
system administrator.

The removed attachment's name was:

	foo.txt (evaluated as test.exe)

It might be a good idea to contact the sender and warn them that
their system is infected.
****
--MIMEStream=_+testing99
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
Content-Disposition: inline

****
NOTE:  An attachment was deleted from this part of the message,
because it failed one or more checks by the virus scanning system.
See the attached sanitization log for more details or contact your
system administrator.

The removed attachment's name was:

	foo.txt (evaluated as unnamed.exe)

It might be a good idea to contact the sender and warn them that
their system is infected.
****
--MIMEStream=_+testing99
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
Content-Disposition: inline
Content-Description: Renamed from 'evil.exe' to 'DEFANGED-104.txt'

****
NOTE:  An attachment was deleted from this part of the message,
because it failed one or more checks by the virus scanning system.
See the attached sanitization log for more details or contact your
system administrator.

The removed attachment's name was:

	unnamed.txt (evaluated as evil.exe)

It might be a good idea to contact the sender and warn them that
their system is infected.
****
--MIMEStream=_+testing99
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
Content-Disposition: inline
Content-ID: <DEFANGED-105>

****
NOTE:  An attachment was deleted from this part of the message,
because it failed one or more checks by the virus scanning system.
See the attached sanitization log for more details or contact your
system administrator.

The removed attachment's name was:

	unnamed.txt (evaluated as evil.exe)

It might be a good idea to contact the sender and warn them that
their system is infected.
****
--MIMEStream=_+testing99
Content-Type: application/pdf; charset="us-ascii"
Content-Transfer-Encoding: 8bit
Content-Disposition: attachment; filename="foo.txt"
Content-ID: <alphabet>

This is text file with a PDF MIME type.

--MIMEStream=_+testing99
Content-Type: text/sanitizer-log; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
Content-Disposition: attachment; filename="sanitizer.log"

This message has been 'sanitized'.  This means that potentially
dangerous content has been rewritten or removed.  The following
log describes which actions were taken.

Sanitizer (start="0"):
  ParseHeader ():
    Using aves-test-1054037954@bre.klaki.net as reply-to address.
    Using aves-test-1054037954@bre.klaki.net as errors address.
    Got MIME info: _boundpre="--", _disposition="inline", _encoding="8bit", _type="multipart/mixed", boundary="filter-test-boundary", charset="iso-8859-1", undecoded-boundary="filter-test-boundary"

  Finished parsing message header.
  Parsing body as multipart/*
  CleanMultipart
  Replaced MIME boundary: >>filter-test-boundary<<
                    with: >>MIMEStream=_+testing99<<
  Writer (pos="394"):
    Set MIME info to: _boundpre="--", _disposition="inline", _encoding="8bit", _type="multipart/mixed", boundary="MIMEStream=_+testing99", charset="iso-8859-1", undecoded-boundary="filter-test-boundary"
    Total modifications so far: 7

  ParserUnclosedMultipart
  Part (pos="417"):
    ParseHeader ():
      Got MIME info: _boundpre="--", _disposition="inline", _encoding="8bit", _type="multipart/alternative", boundary="filter-test-2bound", charset="iso-8859-1", undecoded-boundary="filter-test-2bound"

    Parsing body as multipart/*
    CleanMultipart
    Replaced MIME boundary: >>filter-test-2bound<<
                      with: >>MIMEStream=_+testing100<<
    Writer (pos="96"):
      Set MIME info to: _boundpre="--", _disposition="inline", _encoding="8bit", _type="multipart/alternative", boundary="MIMEStream=_+testing100", charset="iso-8859-1", undecoded-boundary="filter-test-2bound"

    ParserUnclosedMultipart
    Part (pos="117"):
      ParseHeader ():
        Got MIME info: _boundpre="--", _disposition="inline", _encoding="8bit", _type="text/un.known+foo", boundary="", charset="iso-8859-1"

      Parsing body as text/*
      CleanUnknown
      CleanText
      SanitizeFile (filename="unknown.000", mimetype="text/un.known+foo"):
        No attachment name found, using default (unknown.000).
        Rule 1: .exe$
        Match (rule="default"):
          Enforced policy: accept

      Writer (pos="81"):
        Set MIME info to: _boundpre="--", _disposition="inline", _encoding="8bit", _type="text/un.known+foo", boundary="", charset="iso-8859-1", name="unknown.000"

    Part (pos="704"):
      ParseHeader ():
        Got MIME info: _boundpre="--", _disposition="inline", _encoding="8bit", _type="text/html", boundary="", charset="iso-8859-1"

      Parsing body as text/*
      CleanUnknown
      CleanText
      SanitizeFile (filename="unnamed.html, filetype.html", mimetype="text/html"):
        Rule 1: .exe$
        Match (rule="default"):
          Enforced policy: accept

      Writer (pos="73"):
        Set MIME info to: _boundpre="--", _disposition="inline", _encoding="8bit", _type="text/html", boundary="", charset="iso-8859-1"

  Part (pos="1774"):
    ParseHeader ():
      Got MIME info: _boundpre="--", _disposition="attachment", _encoding="8bit", _type="text/plain", boundary="", charset="us-ascii", filename="foo.txt", name="foo.txt"

    Parsing body as text/*
    CleanUnknown
    CleanText
    SanitizeFile (filename="foo.txt, test.exe, unnamed.txt", mimetype="text/plain"):
      Rule 1: .exe$
      Match (names="test.exe", rule="1"):
        Enforced policy: drop

      Replaced file name with: DEFANGED-102.txt

    Writer (pos="-170"):
      Set MIME info to: _boundpre="--", _disposition="inline", _encoding="8bit", _id="<DEFANGED-102>", _type="text/plain", boundary="", charset="iso-8859-1", filename="DEFANGED-102.txt", name="DEFANGED-102.txt"

  Part (pos="2019"):
    ParseHeader ():
      Got MIME info: _boundpre="--", _disposition="attachment", _encoding="8bit", _type="application/x-ms-dos-executable", boundary="", charset="us-ascii", filename="foo.txt"

    Parsing body as DEFAULT.
    CleanUnknown
    CleanText
    SanitizeFile (filename="foo.txt, unnamed.exe", mimetype="application/x-ms-dos-executable"):
      Rule 1: .exe$
      Match (names="unnamed.exe", rule="1"):
        Enforced policy: drop

      Replaced mime type with: text/plain
      Replaced file name with: DEFANGED-103.txt

    Writer (pos="-206"):
      Set MIME info to: _boundpre="--", _disposition="inline", _encoding="8bit", _id="<DEFANGED-103>", _type="text/plain", boundary="", charset="iso-8859-1", filename="DEFANGED-103.txt", name="DEFANGED-103.txt"

  Part (pos="2231"):
    ParseHeader ():
      Got MIME info: _boundpre="--", _description="evil.exe", _disposition="attachment", _encoding="8bit", _type="text/plain", boundary="", charset="us-ascii"

    Parsing body as text/*
    CleanUnknown
    CleanText
    SanitizeFile (filename="unnamed.txt, evil.exe", mimetype="text/plain"):
      Rule 1: .exe$
      Match (names="evil.exe", rule="1"):
        Enforced policy: drop

      Replaced file name with: DEFANGED-104.txt

    Writer (pos="-220"):
      Set MIME info to: _boundpre="--", _description="Renamed from 'evil.exe' to 'DEFANGED-104.txt'", _disposition="inline", _encoding="8bit", _id="<DEFANGED-104>", _type="text/plain", boundary="", charset="iso-8859-1"

  Part (pos="2430"):
    ParseHeader ():
      Got MIME info: _boundpre="--", _disposition="attachment", _encoding="8bit", _id="<evil.exe>>", _type="text/plain", boundary="", charset="us-ascii"

    Parsing body as text/*
    CleanUnknown
    CleanText
    SanitizeFile (filename="unnamed.txt, evil.exe", mimetype="text/plain"):
      Rule 1: .exe$
      Match (names="evil.exe", rule="1"):
        Enforced policy: drop

      Replaced file name with: DEFANGED-105.txt

    Writer (pos="-226"):
      Set MIME info to: _boundpre="--", _disposition="inline", _encoding="8bit", _id="<DEFANGED-105>", _type="text/plain", boundary="", charset="iso-8859-1"

  Part (pos="2623"):
    ParseHeader ():
      Got MIME info: _boundpre="--", _disposition="attachment", _encoding="8bit", _id="<alphabet>", _type="application/pdf", boundary="", charset="us-ascii", filename="foo.txt"

    Parsing body as DEFAULT.
    CleanUnknown
    CleanText
    SanitizeFile (filename="foo.txt, unnamed.pdf", mimetype="application/pdf"):
      Rule 1: .exe$
      Match (rule="default"):
        Enforced policy: accept

    Writer (pos="158"):
      Set MIME info to: _boundpre="--", _disposition="attachment", _encoding="8bit", _id="<alphabet>", _type="application/pdf", boundary="", charset="us-ascii", filename="foo.txt", name="foo.txt"



--MIMEStream=_+testing99--
*** Exit code was 0 ***
