Goner-A problems - false alarm

brandon pearson (BITS) brandon.pearson at BBSRC.AC.UK
Mon Dec 10 17:24:29 GMT 2001


Unfortunately all the delivered mail that I know contained viruses were
deleted at the remote site before I could see any of them.

However we did get a mail this morning, before I changed back to queue_only,
that mailscanner let through and our internal groupshield quarantined as
containing a W32/Badtrans at MM virus. This mail again caused a "Resource
temporarily unavailable" error in syslog and was delivered from the outgoing
queue. Here are its headers.

Received: from mhub1.bbsrc.ac.uk ([149.155.202.1]) by exrout.cc.bbsrc.ac.uk
with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13)
        id YK5X5SAH; Mon, 10 Dec 2001 06:17:15 -0000
Received: from [202.54.1.88] (helo=mmb4.vsnl.net.in)
        by mhub1.bbsrc.ac.uk with esmtp (Exim 3.31 #1)
        id 16DJkB-000522-03
        for amanda.king at bbsrc.ac.uk; Mon, 10 Dec 2001 06:16:52 +0000
Received: from aol.com (unknown [203.199.170.245])
        by mmb4.vsnl.net.in (Postfix) with SMTP id CFF69EDC4
        for <amanda.king at bbsrc.ac.uk>; Mon, 10 Dec 2001 11:46:16 +0530 (IST)
From: "sheetal desai" <_gffaroma at bom3.vsnl.net.in>
To: amanda.king at bbsrc.ac.uk
Subject: Re: Announcement of Networking Meeting - Rothamsted International
Bio Market 2001
MIME-Version: 1.0
Content-Type: multipart/related;
         type="multipart/alternative";
         boundary="====_ABC1234567890DEF_===="
X-Priority: 3
X-MSMail-Priority: Normal
X-Unsent: 1
Message-Id: <20011210061616.CFF69EDC4 at mmb4.vsnl.net.in>
Date: Mon, 10 Dec 2001 11:46:16 +0530 (IST)
X-ECS-MailScanner-BBSRC: Found to be clean

--====_ABC1234567890DEF_====
Content-Type: multipart/alternative;
         boundary="====_ABC0987654321DEF_===="

--====_ABC0987654321DEF_====
Content-Type: text/html;
         charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

--====_ABC0987654321DEF_====--

--====_ABC1234567890DEF_====
Content-Type: audio/x-wav;
         name="HAMSTER.DOC.pif"
Content-Transfer-Encoding: base64
Content-ID: <EA4DMGBP9p>

Thanks,

Brandon


-----Original Message-----
From: Nick Phillips [mailto:nwp at LEMON-COMPUTING.COM]
Sent: Monday, December 10, 2001 4:28 PM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: Goner-A problems - false alarm


On Mon, Dec 10, 2001 at 04:09:09PM -0000, brandon pearson (BITS) wrote:
> Nick,
>     As far as I can see all the mails were delivered from the outgoing
> queue. The following extract is for one of the mails that got through with
a
> goner virus. Two entries in the incoming log then two entries in the
> outgoing log.

Hmmm... did the message that got delivered have a mailscanner header in it?
If so, what did it say?

--
Nick Phillips -- nwp at lemon-computing.com
You will be surprised by a loud noise.



More information about the MailScanner mailing list