Sophos and PDF revisited

[Julian Field]

Can you put the troublesome PDF into a password-protected zip file and mail
it to me please (off-list).
I'm slightly at a loss as to why this option works sometimes (e.g.
detecting corrupt files) but not in your case. I need to be able to
reproduce the problem.

At 18:55 07/08/2003, you wrote:
>Julian Field wrote:
> >
> > And you are doing a "reload" of MailScanner after changing the
> > MailScanner.conf file?
>
>Yes:
>
># ps -ef | grep MailScanner
>
>     root  6320  6315  1 10:10:25 ?        0:38 /usr/bin/perl
>-I/opt/MailScanner/lib /opt/MailScanner/bin/MailScanner /opt/Mail
>     root 14404  6337  0 11:47:59 ?        0:00 /usr/bin/perl
>-I/opt/MailScanner/lib /opt/MailScanner/bin/MailScanner /opt/Mail
>     root  6316  6315  1 10:10:14 ?        0:42 /usr/bin/perl
>-I/opt/MailScanner/lib /opt/MailScanner/bin/MailScanner /opt/Mail
>     root  6333  6315  2 10:10:45 ?        0:41 /usr/bin/perl
>-I/opt/MailScanner/lib /opt/MailScanner/bin/MailScanner /opt/Mail
>     root  6326  6315  0 10:10:35 ?        0:36 /usr/bin/perl
>-I/opt/MailScanner/lib /opt/MailScanner/bin/MailScanner /opt/Mail
>     root  6337  6315  1 10:10:55 ?        0:37 /usr/bin/perl
>-I/opt/MailScanner/lib /opt/MailScanner/bin/MailScanner /opt/Mail
>     root  6315     1  0 10:10:14 ?        0:00 /usr/bin/perl
>-I/opt/MailScanner/lib /opt/MailScanner/bin/MailScanner /opt/Mail
>
># sudo pkill MailScanner
># ps -ef | grep MailScanner
>
>(nothing)
>
># sudo /opt/MailScanner/bin/check_mailscanner
># ps -ef | grep MailScanner
>     root 14577 14576  1 11:50:10 ?        0:00 /usr/bin/perl
>-I/opt/MailScanner/lib /opt/MailScanner/bin/MailScanner /opt/Mail
>     root 14513 14483  6 11:49:38 ?        0:04 /usr/bin/perl
>-I/opt/MailScanner/lib /opt/MailScanner/bin/MailScanner /opt/Mail
>     root 14554 14483  8 11:49:58 ?        0:02 /usr/bin/perl
>-I/opt/MailScanner/lib /opt/MailScanner/bin/MailScanner /opt/Mail
>     root 14576 14513  0 11:50:10 ?        0:00 /usr/bin/perl
>-I/opt/MailScanner/lib /opt/MailScanner/bin/MailScanner /opt/Mail
>     root 14575 14528  2 11:50:09 ?        0:00 /usr/bin/perl
>-I/opt/MailScanner/lib /opt/MailScanner/bin/MailScanner /opt/Mail
>     root 14528 14483  9 11:49:48 ?        0:04 /usr/bin/perl
>-I/opt/MailScanner/lib /opt/MailScanner/bin/MailScanner /opt/Mail
>     root 14498 14483  3 11:49:28 ?        0:04 /usr/bin/perl
>-I/opt/MailScanner/lib /opt/MailScanner/bin/MailScanner /opt/Mail
>     root 14483     1  0 11:49:17 ?        0:00 /usr/bin/perl
>-I/opt/MailScanner/lib /opt/MailScanner/bin/MailScanner /opt/Mail
>     root 14484 14483  3 11:49:17 ?        0:05 /usr/bin/perl
>-I/opt/MailScanner/lib /opt/MailScanner/bin/MailScanner /opt/Mail
>
>Sent another test message and received the same error:
>
>Report: Could not check ./h77HpFbR014728/blah.pdf (unexpected error
>[0x80040202])
>
>Dustin
>
>
>
>
>
> > At 17:44 07/08/2003, you wrote:
> > >Good Day,
> > >
> > >Setup: MS 4.22-5, Sendmail 8.12.9, SpamAssassin 2.55, current version of
> > >Sophos
> > >
> > >I am receiving the following error messages on some PDFs that go through
> > >MailScanner:
> > >
> > >         Report: Could not check ./h77FLfbR002021/blah.pdf (unexpected
> error
> > >[0x80040202])
> > >
> > >According to MailScanner.conf, "Anything on the next line that appears
> > >in brackets at the end of a line of output from Sophos will cause the
> > >error/infection to be ignored."
> > >
> > >I have added "0x80040202" to "Allowed Sophos Error Messages=" but the
> > >quarantine still occurs.  I have also tried adding "unexpected error,"
> > >with no luck.
> > >
> > >So, I decided to add "allow \.pdf$ - -" to filename.rules.conf, but the
> > >quarantined still occurs.
> > >
> > >Any suggestions on what I could do to allow the PDFs with the above
> > >error message?
> > >
> > >Thanks,
> > >
> > >Dustin
> > >--
> > >Dustin Baer
> > >Unix Administrator/Postmaster
> > >Information Handling Services
> > >15 Inverness Way East
> > >Englewood, CO 80112
> > >303-397-2836
> >
> > --
> > Julian Field
> > www.MailScanner.info
> > Professional Support Services at www.MailScanner.biz
> > MailScanner thanks transtec Computers for their support

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support