Quarantined Message is Warning Instead of Content - MORE INFO

[Julian Field]

I will take a look.
Whether it will make it into the next release, I can't guarantee.

At 20:22 30/03/2004, you wrote:
>I've started noticing some problems others have had with the quarantined
>message being the warning message instead of the original one.  Last I
>remember, Julian said that he was not able to duplicate the problem.  I hope
>some information here may help to fix it.
>
>It looks like the problem happens when the message does not have any
>attachments but still contains an "infection".  I turned on some of the
>print STDERR lines in Message.pm.  The following is some of what was printed
>out:
>
>In Clean message, type = v and quar? = 1
>File = "msg-8381-1.txt"
>this = "MailScanner::Message=HASH(0x971e27c)"
>Entity to clean is MIME::Entity=HASH(0x973a960)
>root entity is MIME::Entity=HASH(0x973a960)
>CleanEntity: In 1B80kF-0002sp-00 entity is MIME::Entity=HASH(0x973a960) and
>its parent is
>
>I noticed that the entity does not have a parent.  So, I think if there is
>no parent, MailScanner replaces the whole body with the warning.  The only
>problem is that it has not been quarantined yet.  So when it does get
>quarantined, the warning gets stored and not the original message.
>
>One possible solution might be to switch the order of $batch->Clean() and
>$batch->QuarantineInfections() in bin/MailScanner.  But I'm not sure if this
>would be a safe thing to do.
>
>I am running MailScanner 4.28.6 with McAfee and ClamAV.  I can provide Exim
>queue files of a message that McAfee catches and triggers this problem if
>that will help.
>
>Julian, can you take another look?  Thanks.
>
>Jason

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654