"{Blocked Content} Warning: E-mail error detected" with no particular reason!

[Ugo Bellavance]

Idan Plotnik wrote:
> Hi All,
>
> I am having some tests on a new MailScanner machine and every messege
> that I am sending (not spam and not with virus) is blocked by the
> MailScanner with the reason "{Blocked Content} Warning: E-mail error
> detected"
>
> Someone can explain this phenomenon please ?

Here is a hint:

-From your logs :

 > May 25 12:45:39 exmail01 MailScanner[1585]: Attachment size check: 333 >
 > 10 (msg-1585-270.txt)

-From the generated messages

At Tue May 25 12:17:05 2004 the virus scanner said:
    MailScanner: Attachment is too large


You must know that the max size setting is in bytes, not in megs.

>
> Thanks a lot.
>
>
> This is a part of the maillog file:
> You can see that he have a problem with the "Attachment size" and I
> don't have appachment at all, and I disable the "Attachment size check"
> in the MailScanner.conf, so what is going on here ?
>
>
> May 25 12:45:37 exmail01 MailScanner[1549]: Sender Warnings: Delivered 4
> warnings to virus senders
> May 25 12:45:37 exmail01 MailScanner[1581]: New Batch: Found 7 messages
> waiting
> May 25 12:45:39 exmail01 MailScanner[1590]: Virus and Content Scanning:
> Starting
> May 25 12:45:39 exmail01 MailScanner[1581]: New Batch: Scanning 2
> messages, 2957 bytes
> May 25 12:45:39 exmail01 MailScanner[1585]: Attachment size check: 333 >
> 10 (msg-1585-270.txt)
> May 25 12:45:31 exmail01 sendmail[17840]: i4P9jUIn017840:
> from=spam at exlibris.co.il, size=1005, class=0, nrcpts=1,
> msgid=<200405250945.i4P9jUIn017840 at exmail01.exlibris.co.il>,
> relay=root at localhost
> May 25 12:45:40 exmail01 MailScanner[1581]: Spam Checks: Starting
> May 25 12:45:40 exmail01 MailScanner[1585]: Content Checks: Found 1
> problems
> May 25 12:45:41 exmail01 MailScanner[1585]: Saved infected
> "msg-1585-270.txt" to
> /var/spool/MailScanner/quarantine/20040525/i4P9jHUe017805
>
>
> This is the mail that the recipient is getting form the MailScanner:
>
> From: MailScanner [mailto:postmaster at ptr77.exlibris.co.il]
> Sent: Tuesday, May 25, 2004 11:16 AM
> To: spam at exlibris.co.il
> Subject: {Blocked Content} Warning: E-mail error detected
>
> Warning: This message has had one or more attachments removed
> Warning: (the entire message).
> Warning: Please read the "yoursite-Attachment-Warning.txt" attachment(s)
> for
> more information.
>
> This is a message from the MailScanner E-Mail Virus Protection Service
> ----------------------------------------------------------------------
> The original e-mail attachment "the entire message"
> was believed to be infected by a virus and has been replaced by this
> warning
> message.
>
> If you wish to receive a copy of the *infected* attachment, please
> e-mail helpdesk and include the whole of this message
> in your request. Alternatively, you can call them, with
> the contents of this message to hand when you call.
>
> At Tue May 25 12:17:05 2004 the virus scanner said:
>    MailScanner: Attachment is too large
>
> Note to Help Desk: Look on the yoursite MailScanner in
> /var/spool/MailScanner/quarantine/20040525 (message i4P9FtUe013132).

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html