Jun-07-17 21:50:37 [Main_Thread] Info: analyze detected: IP: '192.168.1.2' ,
HELO: 'astaro1.bordo.com.au' , assp-Host: 'mail.bordo.com.au'
Jun-07-17 21:50:38 [Main_Thread] [scoring] DKIM signature verified-OK - pass -
sender policy is: accept - author policy is: accept
Jun-07-17 21:50:38 [Main_Thread] Info: domain qq.com has published a DMARC
record
Jun-07-17 21:50:40 [Main_Thread] Warning: possibly virus infected file (can't
read entry in archive header)
'/assp/tmp/zip_0_1496836240/80000797_798_Shipping_Documents.zip' - <-20> -
Pathname cannot be converted from UTF-8 to current locale. - tried correction
to (/assp/tmp/zip_0_1496836240/.10/) failed - Pathname cannot be converted from
UTF-8 to current locale.
Jun-07-17 21:50:40 [Main_Thread] Warning: warn - libarchive extract
'/assp/tmp/zip_0_1496836240/80000797_798_Shipping_Documents.zip' - <-20> -
Pathname cannot be converted from UTF-8 to current locale.
Jun-07-17 21:50:40 [Main_Thread] HMM Check [scoring] - Prob: 0.00000 => ham -
answer/query relation: 100% of 275
James.
> On 7 Jun 2017, at 7:57 pm, Thomas Eckardt <[email protected]> wrote:
>
> James, pipe the mail in question in to the analyzer (GUI or per email) and
> watch the maillog.txt.
>
> Thomas
>
>
>
>
>
> Von: James Brown via Assp-test <[email protected]>
> An: ASSP development mailing list <[email protected]>
> Kopie: James Brown <[email protected]>
> Datum: 07.06.2017 11:43
> Betreff: Re: [Assp-test] Bad Attachment: Pathname cannot be converted
> from UTF-8 to current locale.
>
>
>
> Wow, thanks Thomas!
>
> Have put 4.54 on now.
>
> Will see how it goes.
>
> Thanks again,
>
> James.
>
> On 7 Jun 2017, at 6:53 pm, Thomas Eckardt <[email protected]
> <mailto:[email protected]>> wrote:
>
> James,
>
> I've just published ASSP_AFC 4.54 at SF-CVS.
>
> Until 4.53 - if the conversion error was detected, the plugin stopped
> processing.
> Now - the plugin tries to change the wrong path name to a valid one.
> I'm unable to test this. It may work or not - but it will show why.
>
> Thomas
>
>
>
>
> Von: James Brown via Assp-test <[email protected]
> <mailto:[email protected]>>
> An: ASSP development mailing list <[email protected]
> <mailto:[email protected]>>
> Kopie: James Brown <[email protected]
> <mailto:[email protected]>>
> Datum: 07.06.2017 08:11
> Betreff: [Assp-test] Bad Attachment: Pathname cannot be converted from
> UTF-8 to current locale.
>
>
>
> Anyone know how to get these archived scanned by AFC?
>
>
> Jun-07-17 12:54:17 [Worker_2] Warning: possibly virus infected file (can't
> read entry in archive header)
> '/assp/tmp/zip_2_1496804057/80000797_798_Shipping_Documents.zip' - <-20> -
> Pathname cannot be converted from UTF-8 to current locale.
> Jun-07-17 12:54:17 [Worker_2] Warning: warn - libarchive extract
> '/assp/tmp/zip_2_1496804057/80000797_798_Shipping_Documents.zip' - <-20> -
> Pathname cannot be converted from UTF-8 to current locale.
> Jun-07-17 12:54:17 id-04046-19702 [Worker_2] [TLS-out] [Attachment]
> 192.168.1.2 [OIP: 112.90.139.244] <[email protected] <mailto:[email protected]>>
> to: [email protected] <mailto:[email protected]> SPAM FOUND bad
> attachment '80000797&798 Shipping Documents.zip' cause: 'possibly virus
> infected file (can't extract archive)'
> Jun-07-17 12:54:17 id-04046-19702 [Worker_2] [TLS-out] 192.168.1.2 [OIP:
> 112.90.139.244] <[email protected] <mailto:[email protected]>> to:
> [email protected] <mailto:[email protected]> Message-Score: added 5
> (baValencePB) for bad attachment '80000797&798 Shipping Documents.zip' cause:
> 'possibly virus infected file (can't extract archive)', total score for this
> message is now -20
> Jun-07-17 12:54:17 id-04046-19702 [Worker_2] [TLS-out] [Attachment]
> 192.168.1.2 [OIP: 112.90.139.244] <[email protected] <mailto:[email protected]>>
> to: [email protected] <mailto:[email protected]> mail blocked by
> Plugin ASSP_AFC - reason BadAttachment
> Jun-07-17 12:54:17 id-04046-19702 [Worker_2] [TLS-out] [Attachment]
> 192.168.1.2 [OIP: 112.90.139.244] <[email protected] <mailto:[email protected]>>
> to: [email protected] <mailto:[email protected]> [spam found]
> (BadAttachment) [fwd Fw Fw 80000797 798 Shipping Documents] ->
> /assp/virii/fwd_Fw_Fw_80000797_798_Shipping_Documents--148368.eml;
>
> ASSP 2.5.6(17151)
>
> AFC 4.53
>
> Thanks,
>
> James.
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org <http://slashdot.org/>!
> http://sdm.link/slashdot <http://sdm.link/slashdot>
> _______________________________________________
> Assp-test mailing list
> [email protected] <mailto:[email protected]>
> https://lists.sourceforge.net/lists/listinfo/assp-test
> <https://lists.sourceforge.net/lists/listinfo/assp-test>
>
>
>
>
>
>
> DISCLAIMER:
> *******************************************************
> This email and any files transmitted with it may be confidential, legally
> privileged and protected in law and are intended solely for the use of the
> individual to whom it is addressed.
> This email was multiple times scanned for viruses. There should be no known
> virus in this email!
> *******************************************************
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org <http://slashdot.org/>!
> http://sdm.link/slashdot_______________________________________________
> <http://sdm.link/slashdot_______________________________________________>
> Assp-test mailing list
> [email protected] <mailto:[email protected]>
> https://lists.sourceforge.net/lists/listinfo/assp-test
> <https://lists.sourceforge.net/lists/listinfo/assp-test>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> <http://sdm.link/slashdot>_______________________________________________
> Assp-test mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/assp-test
> <https://lists.sourceforge.net/lists/listinfo/assp-test>
>
>
>
>
> DISCLAIMER:
> *******************************************************
> This email and any files transmitted with it may be confidential, legally
> privileged and protected in law and are intended solely for the use of the
> individual to whom it is addressed.
> This email was multiple times scanned for viruses. There should be no known
> virus in this email!
> *******************************************************
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org!
> http://sdm.link/slashdot_______________________________________________
> Assp-test mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/assp-test
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Assp-test mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-test
