We're using Exim version 3.35 and this filter:
ftp://ftp.exim.org/pub/filter/system_filter.exim to try to bounce
everything that has attachments with certain filenames (I'm aware of the
problems with bouncing virus messages, but for now I have assumed that
it's less bad than dropping them). The problem is it lets "Swen" through
(The spoof Microsoft announcements). I have tried to send test messages
containing the same line: 'Content-Type: application/x-msdownload;
name="Upgrade6379.exe"', and they are correctly blocked. I have the
hypothesis that Exim filters, like Spam Assassin, stop scanning after a
certain length - this Content-Type line is positioned somewhere around the
14000'd byte in the message. Is that possible, and if so, can it be
configured?
