Although I second the previous post about an option to forward messages on a one-off basis to recipients, I have a more immediate problem. Because of the proliferation of ZIP attachments with Netsky, I currently have our ASL set to block emails with ZIPped attachments as well as executables. Unfortunately, about one in 20 ZIPped attachments is a legitimate file we actually need.
I've tried forwarding those messages to my Postmaster address, but something appears to be corrupted in the message when I do so. . .as I am unable to decode the attachment from the forwarded email. The message comes thru as an attachment to a message from the firewall itself; when I save or open that attachment from Outlook Express, the entire message, with headers & all, is displayed in plain text.
I thought that if I were to save that plain-text message and then apply it to another MIME decoder I should be able to extract the attachment, but this is not working. Sometimes the decoder can't even detect a MIME-encoded file in the message; other times it does so, but the ZIP file that is created by the decode is un-extractable by my ZIP utility.
Just to rule out other problems, I tried creating a ZIP file of my own, sending it to myself, then forwarding it to the postmaster, and I still can't extract the result when it comes back; of course, if I turn off the blocking of ZIP files everything comes thru smoothly. Unfortunately, I don't always have foreknowledge of legitimate ZIPs coming through.
Anyone have a suggestion how I can retrieve desired attachments? Ideally, I'd like to see an option in the Proxy Content Manager that permits the administrator to download attached files directly if desired. Alternatively, selective forwarding of single, authorized messages to their original recipients would be a good thing (although even then, being able to download and evaluate the attachment first myself would be preferable).
As it is, I have no successful method of retrieving blocked attachments. I'm loathe to remove ZIP blocking while Netsky is going rampant; particularly as some script kiddie might come up with an alternative that still uses ZIP attachments but is not yet detectable by our antivirus software. . .Any suggestions would be appreciated.
Dan
This thread was automatically locked due to age.
