Message-Id: <s29d4b.073@dx3.wdt.com>
X-Mailer: Novell GroupWise Internet Agent 6.5.3 
Date: Wed, 25 May 2005 06:37:24 -0400
From: "Reilly" <oom@wooment.com>
To: <keviald@cit.on.ca>, <cloly@eir.et>,
   <ord@eom.net>
Subject: Fwd: FW:
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="=__Part9FBC4474.1__="
X-Sanitizer: This message has been sanitized!
X-Sanitizer-URL: http://mailtools.anomy.net/


--=__Part9FBC4474.1__=
Content-Type: application/DEFANGED-99; charset="ISO-8859-1"
Content-Transfer-Encoding: 8bit
Content-Disposition: inline

MZevilfile in disguise!

--=__Part9FBC4474.1__=
Content-Type: application/DEFANGED-100; charset="ISO-8859-1"
Content-Transfer-Encoding: 8bit
Content-Disposition: attachment; filename="homey_pdf.DEFANGED-100"

This is neither an HTML file nor a PDF.

--=__Part9FBC4474.1__=
Content-Type: application/DEFANGED-101; charset="ISO-8859-1"
Content-Transfer-Encoding: 8bit
Content-Disposition: attachment; filename="homey_jpg.DEFANGED-101"

This isn not a jpeg.

--=__Part9FBC4474.1__=
Content-Type: application/DEFANGED-102; charset="ISO-8859-1"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="wmf-file_jpg.DEFANGED-102"

AQAJAAADUh8AAAYAPQAAAAAAEQAAACYGDwAYAP//////ABAAAAAAAAAAAADAA4UA
0AIAAAkAAAAmBg8ACAD/////AgAAABcAAAAmBg8AIwD/////BAAbAFROUFAUACAA
uAAyBgAA//9PABQAAABNAGkAAAAKAAAAJgYPAAoAVE5QUAAAAgD0AwkAAAAmBg8A
CAD/////AwAAAA8AAAAmBg8AFABUTlBQBAAMAAEAAAABAAAAAAAAAAUAAAALAgAA
AAAFAAAADALQAsADBAAAAAQBDQAHAAAA/AIAAAAAZgAAAAQAAAAtAQAACQAAAPoC
--=__Part9FBC4474.1__=
Content-Type: application/DEFANGED-103; charset="ISO-8859-1"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="wmf-file2_jpg.DEFANGED-103"

AQAJAAADUh8AAAYAPQAAAAAAEQAAACYGDwAYAP//////ABAAAAAAAAAAAADAA4UA
0AIAAAkAAAAmBg8ACAD/////AgAAABcAAAAmBg8AIwD/////BAAbAFROUFAUACAA
uAAyBgAA//9PABQAAABNAGkAAAAKAAAAJgYPAAoAVE5QUAAAAgD0AwkAAAAmBg8A
CAD/////AwAAAA8AAAAmBg8AFABUTlBQBAAMAAEAAAABAAAAAAAAAAUAAAALAgAA
AAAFAAAADALQAsADBAAAAAQBDQAHAAAA/AIAAAAAZgAAAAQAAAAtAQAACQAAAPoC
--=__Part9FBC4474.1__=
Content-Type: text/sanitizer-log; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
Content-Disposition: attachment; filename="sanitizer.log"

This message has been 'sanitized'.  This means that potentially
dangerous content has been rewritten or removed.  The following
log describes which actions were taken.

Sanitizer (start="0"):
  ParseHeader ():
    Using "Reilly" <oom@wooment.com> as reply-to address.
    Using "Reilly" <oom@wooment.com> as errors address.
    Got MIME info: _boundpre="--", _disposition="inline", _encoding="8bit", _type="multipart/mixed", boundary="=__Part9FBC4474.1__=", charset="iso-8859-1", undecoded-boundary="=__Part9FBC4474.1__="

  Finished parsing message header.
  Parsing body as multipart/*
  CleanMultipart
  ParserUnclosedMultipart
  Part (pos="338"):
    ParseHeader ():
      Got MIME info: _boundpre="--", _disposition="inline", _encoding="8bit", _type="text/plain", boundary="", charset="ISO-8859-1"

    Parsing body as text/*
    CleanUnknown
    CleanText
    SanitizeFile (filename="unnamed.txt, filetype.exe", mimetype="text/plain"):
      Rule 1: (?i)(\.([0-9a-z_]{2,4}\.(com|exe|pif|lnk|bat|sc[rt]|vb[se]?))|(ants3set|wtc|readme|sslpatch)\.exe)\.?$
      Rule 5: (?i)\.(do[tc]|xl[aswct]|p[po]t|pps|rtf|md[abw])$
      Rule 7: (?i)\.(exe|com|cmd|bat|sys|vb[se]?|hta|shb|shs|hlp|chm|eml|ocx|wsf|wsh|js|msi|msp|cpl|lib|pif|sc[rt]|lnk|dll)\.?$
      Match (names="filetype.exe", rule="7"):
        Enforced policy: defang

      Replaced mime type with: application/DEFANGED-99
      Replaced file name with: filetype_exe.DEFANGED-99

    Writer (pos="106"):
      Set MIME info to: _boundpre="--", _disposition="inline", _encoding="8bit", _id="<DEFANGED-99>", _type="application/DEFANGED-99", boundary="", charset="ISO-8859-1"

  Part (pos="492"):
    ParseHeader ():
      Got MIME info: _boundpre="--", _disposition="attachment", _encoding="8bit", _type="image/jpeg", boundary="", charset="ISO-8859-1", filename="homey.pdf"

    Parsing body as DEFAULT.
    CleanUnknown
    SanitizeFile (filename="homey.pdf", mimetype="image/jpeg"):
      Rule 1: (?i)(\.([0-9a-z_]{2,4}\.(com|exe|pif|lnk|bat|sc[rt]|vb[se]?))|(ants3set|wtc|readme|sslpatch)\.exe)\.?$
      Rule 5: (?i)\.(do[tc]|xl[aswct]|p[po]t|pps|rtf|md[abw])$
      Rule 7: (?i)\.(exe|com|cmd|bat|sys|vb[se]?|hta|shb|shs|hlp|chm|eml|ocx|wsf|wsh|js|msi|msp|cpl|lib|pif|sc[rt]|lnk|dll)\.?$
      Rule 9: (?i)\.(gif|tiff?|jpe?g|pn[mg]|x[pb]m|dvi|e?ps|p(df|cx|fm)|fdf|fon|[ot]tf|bmp|ico|mp\d|wav|au|ram?|avi|mov|mpe?g|aif[fc]?|cda|midi?|asf|wm[avf]|t(xt|ex)|csv|l(og|yx)|ini|[ch](pp|\+\+)?|cc|hh|s|inc|asm|pa(tch|s)|java|php\d?|[ja]sp|[sp]?html?|css|xml)(\.[gb]?z\d?)?\.?$
      Match (names="homey.pdf", rule="9"):
        Enforced policy: accept

      File name doesn't match MIME type, defanging.
      Replaced mime type with: application/DEFANGED-100
      Replaced file name with: homey_pdf.DEFANGED-100

    Writer (pos="133"):
      Set MIME info to: _boundpre="--", _disposition="attachment", _encoding="8bit", _type="application/DEFANGED-100", boundary="", charset="ISO-8859-1", filename="homey_pdf.DEFANGED-100", name="homey_pdf.DEFANGED-100"

    ParserCat

  Part (pos="689"):
    ParseHeader ():
      Got MIME info: _boundpre="--", _disposition="attachment", _encoding="8bit", _type="text/plain", boundary="", charset="ISO-8859-1", filename="homey.jpg"

    Parsing body as text/*
    CleanUnknown
    CleanText
    SanitizeFile (filename="homey.jpg", mimetype="text/plain"):
      Rule 1: (?i)(\.([0-9a-z_]{2,4}\.(com|exe|pif|lnk|bat|sc[rt]|vb[se]?))|(ants3set|wtc|readme|sslpatch)\.exe)\.?$
      Rule 5: (?i)\.(do[tc]|xl[aswct]|p[po]t|pps|rtf|md[abw])$
      Rule 7: (?i)\.(exe|com|cmd|bat|sys|vb[se]?|hta|shb|shs|hlp|chm|eml|ocx|wsf|wsh|js|msi|msp|cpl|lib|pif|sc[rt]|lnk|dll)\.?$
      Rule 9: (?i)\.(gif|tiff?|jpe?g|pn[mg]|x[pb]m|dvi|e?ps|p(df|cx|fm)|fdf|fon|[ot]tf|bmp|ico|mp\d|wav|au|ram?|avi|mov|mpe?g|aif[fc]?|cda|midi?|asf|wm[avf]|t(xt|ex)|csv|l(og|yx)|ini|[ch](pp|\+\+)?|cc|hh|s|inc|asm|pa(tch|s)|java|php\d?|[ja]sp|[sp]?html?|css|xml)(\.[gb]?z\d?)?\.?$
      Match (names="homey.jpg", rule="9"):
        Enforced policy: accept

      File name doesn't match file contents, defanging.
      Replaced mime type with: application/DEFANGED-101
      Replaced file name with: homey_jpg.DEFANGED-101

    Writer (pos="133"):
      Set MIME info to: _boundpre="--", _disposition="attachment", _encoding="8bit", _type="application/DEFANGED-101", boundary="", charset="ISO-8859-1", filename="homey_jpg.DEFANGED-101", name="homey_jpg.DEFANGED-101"

  Part (pos="867"):
    ParseHeader ():
      Got MIME info: _boundpre="--", _disposition="attachment", _encoding="base64", _type="image/jpeg", boundary="", charset="ISO-8859-1", filename="wmf-file.jpg"

    Parsing body as DEFAULT.
    CleanUnknown
    SanitizeFile (filename="wmf-file.jpg, filetype.wmf", mimetype="image/jpeg"):
      Rule 1: (?i)(\.([0-9a-z_]{2,4}\.(com|exe|pif|lnk|bat|sc[rt]|vb[se]?))|(ants3set|wtc|readme|sslpatch)\.exe)\.?$
      Rule 5: (?i)\.(do[tc]|xl[aswct]|p[po]t|pps|rtf|md[abw])$
      Rule 7: (?i)\.(exe|com|cmd|bat|sys|vb[se]?|hta|shb|shs|hlp|chm|eml|ocx|wsf|wsh|js|msi|msp|cpl|lib|pif|sc[rt]|lnk|dll)\.?$
      Rule 9: (?i)\.(gif|tiff?|jpe?g|pn[mg]|x[pb]m|dvi|e?ps|p(df|cx|fm)|fdf|fon|[ot]tf|bmp|ico|mp\d|wav|au|ram?|avi|mov|mpe?g|aif[fc]?|cda|midi?|asf|wm[avf]|t(xt|ex)|csv|l(og|yx)|ini|[ch](pp|\+\+)?|cc|hh|s|inc|asm|pa(tch|s)|java|php\d?|[ja]sp|[sp]?html?|css|xml)(\.[gb]?z\d?)?\.?$
      Match (names="wmf-file.jpg, filetype.wmf", rule="9"):
        Enforced policy: accept

      File name doesn't match file contents, defanging.
      Replaced mime type with: application/DEFANGED-102
      Replaced file name with: wmf-file_jpg.DEFANGED-102

    Writer (pos="138"):
      Set MIME info to: _boundpre="--", _disposition="attachment", _encoding="base64", _type="application/DEFANGED-102", boundary="", charset="ISO-8859-1", filename="wmf-file_jpg.DEFANGED-102", name="wmf-file_jpg.DEFANGED-102"

    ParserCat

  Part (pos="1354"):
    ParseHeader ():
      Got MIME info: _boundpre="--", _disposition="attachment", _encoding="base64", _type="image/jpeg", boundary="", charset="ISO-8859-1", filename="wmf-file2.jpg"

    Parsing body as DEFAULT.
    CleanUnknown
    SanitizeFile (filename="wmf-file2.jpg, filetype.wmf", mimetype="image/jpeg"):
      Rule 1: (?i)(\.([0-9a-z_]{2,4}\.(com|exe|pif|lnk|bat|sc[rt]|vb[se]?))|(ants3set|wtc|readme|sslpatch)\.exe)\.?$
      Rule 5: (?i)\.(do[tc]|xl[aswct]|p[po]t|pps|rtf|md[abw])$
      Rule 7: (?i)\.(exe|com|cmd|bat|sys|vb[se]?|hta|shb|shs|hlp|chm|eml|ocx|wsf|wsh|js|msi|msp|cpl|lib|pif|sc[rt]|lnk|dll)\.?$
      Rule 9: (?i)\.(gif|tiff?|jpe?g|pn[mg]|x[pb]m|dvi|e?ps|p(df|cx|fm)|fdf|fon|[ot]tf|bmp|ico|mp\d|wav|au|ram?|avi|mov|mpe?g|aif[fc]?|cda|midi?|asf|wm[avf]|t(xt|ex)|csv|l(og|yx)|ini|[ch](pp|\+\+)?|cc|hh|s|inc|asm|pa(tch|s)|java|php\d?|[ja]sp|[sp]?html?|css|xml)(\.[gb]?z\d?)?\.?$
      Match (names="wmf-file2.jpg, filetype.wmf", rule="9"):
        Enforced policy: accept

      File name doesn't match file contents, defanging.
      Replaced mime type with: application/DEFANGED-103
      Replaced file name with: wmf-file2_jpg.DEFANGED-103

    Writer (pos="139"):
      Set MIME info to: _boundpre="--", _disposition="attachment", _encoding="base64", _type="application/DEFANGED-103", boundary="", charset="ISO-8859-1", filename="wmf-file2_jpg.DEFANGED-103", name="wmf-file2_jpg.DEFANGED-103"

    ParserCat

  Total modifications so far: 5



--=__Part9FBC4474.1__=--
*** Exit code was 0 ***
