Re: exiscan not finding some W32/MyDoom-O viruses

Nigel Wade wrote:

> I may try rejecting level 1 errors and monitor the logs closely to see 
> what gets rejected. Is there a list of what level each MIME error is?

 From the code (sorry it is missing in the docs):

/* MIME errorlevel settings */

#define MIME_ERRORLEVEL_LONG_LINE        3,US"line length in message or 
single header size exceeds %u bytes",MIME_SANITY_MAX_LINE_LENGTH
#define MIME_ERRORLEVEL_TOO_MANY_PARTS   3,US"too many MIME parts (max 
%u)",MIME_SANITY_MAX_DUMP_FILES
#define MIME_ERRORLEVEL_MESSAGE_PARTIAL  3,US"'message/partial' MIME type"
#define MIME_ERRORLEVEL_FILENAME_LENGTH  3,US"proposed filename exceeds 
%u characters",MIME_SANITY_MAX_FILENAME
#define MIME_ERRORLEVEL_BOUNDARY_LENGTH  3,US"boundary length exceeds %u 
characters",MIME_SANITY_MAX_BOUNDARY_LENGTH
#define MIME_ERRORLEVEL_DOUBLE_HEADERS   2,US"double headers 
(content-type, content-disposition or content-transfer-encoding)"
#define MIME_ERRORLEVEL_UU_MISALIGNED    1,US"uuencoded line length is 
not a multiple of 4 characters"
#define MIME_ERRORLEVEL_UU_LINE_LENGTH   1,US"uuencoded line length does 
not match advertised number of bytes"
#define MIME_ERRORLEVEL_B64_LINE_LENGTH  1,US"base64 line length exceeds 
%u characters",MIME_SANITY_MAX_B64_LINE_LENGTH
#define MIME_ERRORLEVEL_B64_ILLEGAL_CHAR 2,US"base64 line contains 
illegal character"
#define MIME_ERRORLEVEL_B64_MISALIGNED   1,US"base64 line length is not 
a multiple of 4 characters"
#define MIME_ERRORLEVEL_QP_ILLEGAL_CHAR  1,US"quoted-printable encoding 
contains illegal character"

The one you want is MIME_ERRORLEVEL_B64_ILLEGAL_CHAR, scored with 2 (so 
you must reject >1 instead of >2).

/tom