[Esa-l]Sircam with application/mixed

[Lee Howard]

I have John's sanitizer running on my mail server in conjunction with an
antivirus program.  The antivirus program is run before the sanitizer soas
to prevent quarantining of known virii and worms.

Currently I'm seeing 40-50 instances of Sircam get caught daily, but I am
seeing some few get through.  The only oddity about them that I notice is
this:

X-Content-Security: [server.deanox.com] original Content-Type was
application/mixed;
Content-Type: application/octet-stream;
name="eurotecnica.doc.6177DEFANGED-bat"
Content-Disposition: attachment;  filename="eurotecnica.doc.6177DEFANGED-bat"

If I then run the same antivirus program on that attachment the antivirus
program catches the virus just fine.  So, my assumption then, is that
metamail is not decoding to file the MIME attachment because of the
Content-Type being "application/mixed".

Can anyone comment on this?  I'd rather not run the antivirus program both
before *and* after the sanitizer is run.

Thanks.

Lee Howard