From dh at UPTIME.AT  Mon Nov  1 00:39:04 2004
From: dh at UPTIME.AT (David H.)
Date: Thu Jan 12 21:27:25 2006
Subject: new rename feature or something
Message-ID: <mailman.4129.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "UTF-8" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

Marco Benton wrote:
<snip>>
| so a long time ago i written a Sendmail milter to do this, but now
| wanted to do it all within MailScanner.  i'm not a lover of Perl, i'm an
| old fashion C programmer.  looking at Perl code makes me vomit, but i
| can at least hack my way around and attempt to hack what i want.  but
| where do i begin within MailScanner code?  or can i bribe someone
here? ;-)
|
If you have a milter that does this, then leave it there. As a personal
advice, if you will accept it, there is no reason for MailScanner to
waste processing cycles when your Milter already does it at the MTA level.

- -d

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.3.6 (Darwin)

iD8DBQFBhYWoPMoaMn4kKR4RAzu8AJ4gRkvOIEKOjTLuKwjQXpXZpu7YGgCfcyL/
GHPEEfLNO1jY/h/CZcwC2BQ=
=LHGx
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From marco at XSSNET.COM  Mon Nov  1 00:54:52 2004
From: marco at XSSNET.COM (Marco Benton)
Date: Thu Jan 12 21:27:25 2006
Subject: new rename feature or something
Message-ID: <mailman.4130.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

David H. wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: RIPEMD160
>
> Marco Benton wrote:
> <snip>>
> | so a long time ago i written a Sendmail milter to do this, but now
> | wanted to do it all within MailScanner.  i'm not a lover of Perl,
> i'm an
> | old fashion C programmer.  looking at Perl code makes me vomit, but i
> | can at least hack my way around and attempt to hack what i want.  but
> | where do i begin within MailScanner code?  or can i bribe someone
> here? ;-)
> |
> If you have a milter that does this, then leave it there. As a personal
> advice, if you will accept it, there is no reason for MailScanner to
> waste processing cycles when your Milter already does it at the MTA
> level.


i was thinking more of zip files.  or am i asking the impossible?

--

Marco Benton - BOFH, BSMFH
Network Consultant
Phone: (774) 808-4051
Fax  : (508) 519-6033

BOFH excuse #32: The cause of the problem is: piezo-electric interference

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From raymond at PROLOCATION.NET  Mon Nov  1 01:10:01 2004
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:27:25 2006
Subject: new rename feature or something
Message-ID: <mailman.4131.1137101245.24926.mailscanner@lists.mailscanner.info>

Hi!

>> If you have a milter that does this, then leave it there. As a personal
>> advice, if you will accept it, there is no reason for MailScanner to
>> waste processing cycles when your Milter already does it at the MTA
>> level.

> i was thinking more of zip files.  or am i asking the impossible?

You want to zip them? Dont think this will scale up very much.

Bye,
Raymond.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Q.G.Campbell at NEWCASTLE.AC.UK  Mon Nov  1 07:43:25 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:25 2006
Subject: Bagle-Au - Perhaps we should not be so smug?
Message-ID: <mailman.4132.1137101245.24926.mailscanner@lists.mailscanner.info>

Julian

I am running MS-4.35.5-1 (BETA) with SA 3.0.1 on one of our 8 mail
gateways. This and the other gateways use both Sophos and McAfee A-V
engines.

When I checked the logs for the Bagle-AU virus this morning I found that
on the 4.35.5-1 system _only_ of the 8 gateways, the logs show
MailScanner + Sophos finding the Bagle-AU virus mutiple times in the
_same_ message; that is it has the same Sendmail queue ID.

It appears that MailSanner is not removing some Bagle-infected messages
from "mqueue.in". Some messages have been (re-)scanned 320+ times since
early this morning.

The problem seems to have started on Saturday although we have been
detecting the virus since at least midday Friday with Sophos. We have
Sophos IDE 386.200411010710 currently in use.

I have restarted MailScanner but that has no effect. Am investigating
further.

Quentin
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own."  

>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>Sent: 31 October 2004 01:27
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Bagle-AU
>
>John Rudd wrote:
>
>>Julian Field wrote:
>>
>>
>>>Are we allowed to sit around feeling smug?
>>>:o)
>>>
>>>My MailScanners are currently trapping this for 5 separate reasons.
>>>
>>>
>>>
>>
>>Just out of curiosity, what are the different reasons?
>>
>>(we block all zips currently, because I haven't been able to 
>upgrade our
>>MS since before the option to block encrypted zips only came out; I'm
>>sort of hoping that both of these new viruses are blockable 
>via our zip
>>blocking alone)
>>
>>
>
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz
>MailScanner thanks transtec Computers for their support
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From davidj at synaq.com  Mon Nov  1 07:56:08 2004
From: davidj at synaq.com (David Jacobson)
Date: Thu Jan 12 21:27:25 2006
Subject: clamav output bug(s)
Message-ID: <mailman.4133.1137101245.24926.mailscanner@lists.mailscanner.info>

Hi All,

While debugging my setup I found two random files lying around in my
directory to send through to me... (quite ironically) both random files
produced clamav output errors:

d476a0e8cac2d1f7e6e6f70cb451cb39  lrk4.shad.tar.gz
0e5efa08578bccffeda7577b24ee28dc  ssh_2.5.2p2-1_i386.deb

You can find a copy of these files at www.leet.org/debug

Please be careful as lrk4 is an old rootkit.

Attached please find the clamav output error (clamav_output.log)

Maybe this could be squeezed in before the latest stable is released!

Running on
Linux securemx1.synaq.com 2.6.8-1.521custom #1 SMP Thu Sep 30 15:42:46
SAST 2004 i686 i686 i386 GNU/Linux
This is Fedora Core release 2 (Tettnang)
This is Perl version 5.008003 (5.8.3)

This is MailScanner version 4.34.8
Module versions are:
1.00    AnyDBM_File
1.13    Archive::Zip
1.01    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.05    Fcntl
2.72    File::Basename
2.07    File::Copy
2.01    FileHandle
1.06    File::Path
0.14    File::Temp
1.27    HTML::Entities
3.35    HTML::Parser
2.28    HTML::TokeParser
1.21    IO
1.10    IO::File
1.122   IO::Pipe
3.03    MIME::Base64
5.413   MIME::Decoder
5.413   MIME::Decoder::UU
5.413   MIME::Head
5.413   MIME::Parser
3.03    MIME::QuotedPrint
5.413   MIME::Tools
0.09    Net::CIDR
1.07    POSIX
1.76    Socket
0.04    Sys::Syslog
1.02    Time::localtime

Optional module versions are:
1.808   DB_File
1.05    Digest
1.01    Digest::HMAC
2.33    Digest::MD5
2.33    Digest::MD5
2.01    Digest::SHA1
missing Inline
missing Mail::ClamAV
3.000001        Mail::SpamAssassin
missing Mail::SPF::Query
missing Net::CIDR::Lite
0.23    Net::DNS
missing Net::LDAP
missing Parse::RecDescent
missing SAVI
missing Sys::Hostname::Long
2.40    Test::Harness
0.47    Test::Simple
1.95    Text::Balanced
1.19    URI

-- 
Regards,

David Jacobson
Technical Director
SYNAQ (Pty) Ltd

Tel:    011 290 6388
Cell:   083 235 0760
Mail:   davidj@synaq.com
WWW:    http://www.synaq.com	

Key Fingerprint
8246 FCE1 3C22 7EFB E61B  18DF 6E8B 65E8 BD50 78A1

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 1.2, Text/X-LOG (charset: UTF-8 "Internet-standard Unicode") ]
    [ (Name: "clamav_output.log")  1,289 lines. ]
    [ Unable to print this part. ]


    [ Part 2, "This is a digitally signed message part"  ]
    [ Application/PGP-SIGNATURE  196bytes. ]
    [ Unable to print this part. ]


From Q.G.Campbell at NEWCASTLE.AC.UK  Mon Nov  1 08:17:59 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:25 2006
Subject: Bagle-Au - Perhaps we should not be so smug?
Message-ID: <mailman.4134.1137101245.24926.mailscanner@lists.mailscanner.info>

Julian

Re. my earlier message, when running MS in debug mode I see the
following message:

"syslog: expected both priority and mask at
/usr/lib/MailScanner/MailScanner/Log.pm line 140". 

I also note that at least one of the Sendmail queue IDs that repeatedly
appears in the logs no longer corresponds to a qf/df pair in
"mqueue.in".

We do roll the logs each morning but this problem has persisted over a
number of days and a number of MS restarts. The OS is RH AS3.

Quentin
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own."  

>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Quentin Campbell
>Sent: 01 November 2004 07:43
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Bagle-Au - Perhaps we should not be so smug?
>
>Julian
>
>I am running MS-4.35.5-1 (BETA) with SA 3.0.1 on one of our 8 mail
>gateways. This and the other gateways use both Sophos and McAfee A-V
>engines.
>
>When I checked the logs for the Bagle-AU virus this morning I 
>found that
>on the 4.35.5-1 system _only_ of the 8 gateways, the logs show
>MailScanner + Sophos finding the Bagle-AU virus mutiple times in the
>_same_ message; that is it has the same Sendmail queue ID.
>
>It appears that MailSanner is not removing some Bagle-infected messages
>from "mqueue.in". Some messages have been (re-)scanned 320+ times since
>early this morning.
>
>The problem seems to have started on Saturday although we have been
>detecting the virus since at least midday Friday with Sophos. We have
>Sophos IDE 386.200411010710 currently in use.
>
>I have restarted MailScanner but that has no effect. Am investigating
>further.
>
>Quentin
>---
>PHONE: +44 191 222 8209    Information Systems and Services (ISS),
>                           University of Newcastle,
>                           Newcastle upon Tyne,
>FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
>---------------------------------------------------------------
>---------
>"Any opinion expressed above is mine. The University can get 
>its own."  
>
>>-----Original Message-----
>>From: MailScanner mailing list 
>>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>>Sent: 31 October 2004 01:27
>>To: MAILSCANNER@JISCMAIL.AC.UK
>>Subject: Re: Bagle-AU
>>
>>John Rudd wrote:
>>
>>>Julian Field wrote:
>>>
>>>
>>>>Are we allowed to sit around feeling smug?
>>>>:o)
>>>>
>>>>My MailScanners are currently trapping this for 5 separate reasons.
>>>>
>>>>
>>>>
>>>
>>>Just out of curiosity, what are the different reasons?
>>>
>>>(we block all zips currently, because I haven't been able to 
>>upgrade our
>>>MS since before the option to block encrypted zips only came out; I'm
>>>sort of hoping that both of these new viruses are blockable 
>>via our zip
>>>blocking alone)
>>>
>>>
>>
>>--
>>Julian Field
>>www.MailScanner.info
>>Professional Support Services at www.MailScanner.biz
>>MailScanner thanks transtec Computers for their support
>>Buy the MailScanner book at www.MailScanner.info/store
>>
>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From davidj at synaq.com  Mon Nov  1 08:39:02 2004
From: davidj at synaq.com (David Jacobson)
Date: Thu Jan 12 21:27:25 2006
Subject: dspam!
Message-ID: <mailman.4135.1137101245.24926.mailscanner@lists.mailscanner.info>

Hi guys,

From steve.freegard at LBSLTD.CO.UK  Mon Nov  1 10:10:58 2004
From: steve.freegard at LBSLTD.CO.UK (Steve Freegard)
Date: Thu Jan 12 21:27:25 2006
Subject: Beta BUG? - SA Auto Whitelist
Message-ID: <mailman.4137.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi All,

I upgraded one of my scanners to the latest beta and SA 3.01 on Saturday
and have just been checking up on it's progress this morning and noticed
that quite a few spams had got through - further investigation showed
that all of them sneaked through because of the 'AWL' (auto white-list)
rule.

In MailScanner.conf - I've got:

SpamAssassin Auto Whitelist = no

However this seems to be ignored if SA3 is used - I found the following
in SA.pm:

     if (MailScanner::Config::Value('spamassassinautowhitelist')) {
       # JKF 14/6/2002 Enable the auto-whitelisting functionality
       MailScanner::Log::InfoLog("Enabling SpamAssassin auto-whitelist
functionality...");
       if ($SAversion<3) {
        <snip>
       }
     }

So I've added:

use_auto_whitelist 0

to spam.assassin.prefs.conf which has disabled it successfully.

Has anyone else experienced this?? - it's probably worth a mention
somewhere for upgraders.

Kind regards,
Steve.

--
Steve Freegard
Systems Manager
Littlehampton Book Services Ltd.

--
This message has been scanned for viruses and dangerous content by MailScanner.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From raymond at PROLOCATION.NET  Mon Nov  1 10:23:24 2004
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:27:25 2006
Subject: Beta BUG? - SA Auto Whitelist
Message-ID: <mailman.4138.1137101245.24926.mailscanner@lists.mailscanner.info>

Hi!

> In MailScanner.conf - I've got:
>
> SpamAssassin Auto Whitelist = no
>
> However this seems to be ignored if SA3 is used - I found the following
> in SA.pm:
>
>    if (MailScanner::Config::Value('spamassassinautowhitelist')) {
>      # JKF 14/6/2002 Enable the auto-whitelisting functionality
>      MailScanner::Log::InfoLog("Enabling SpamAssassin auto-whitelist
> functionality...");
>      if ($SAversion<3) {
>       <snip>
>      }
>    }
>
> So I've added:
>
> use_auto_whitelist 0

# AUTO WHITELISTING OFF
score AWL 0.0

Thats what i use.

Bye,
Raymond.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Jan-Peter.Koopmann at SECEIDOS.DE  Mon Nov  1 10:42:32 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:25 2006
Subject: MailScanner plugins for Exchange and Domino
Message-ID: <mailman.4139.1137101245.24926.mailscanner@lists.mailscanner.info>

>> http://www.mailshell.com/mail/client/oem2.html/step/exchangeplugin
>> This free Exchange plugin can create a spam folder in each user's
>> Exchange mailbox and move any incoming message that is
> marked with a specific mail header by MailScanner, to that folder.

I am having big trouble installing this one on our Exchange 2003
installation. DCOM and event sink registration stuff. I contacted their
support. Let's see if they can fix it. Julian: Could you maybe give me
the e-mail address of Tonny Yu so I can contact him directly if needed?

Regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Jan-Peter.Koopmann at SECEIDOS.DE  Mon Nov  1 10:44:32 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:25 2006
Subject: dspam!
Message-ID: <mailman.4140.1137101245.24926.mailscanner@lists.mailscanner.info>

> From what I can see dspam looks better than spamassassin...

It does? Exactly why?

> How hard would it be to perhaps have dspam support in MailScanner?

If I recall correctly this has been covered here several times. Please
have a look at the mailing list archives.

Regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From dhawal at NETMAGICSOLUTIONS.COM  Mon Nov  1 11:08:17 2004
From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy)
Date: Thu Jan 12 21:27:26 2006
Subject: dspam!
Message-ID: <mailman.4141.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

David Jacobson wrote:
> Hi guys,
>
> From what I can see dspam looks better than spamassassin...
> How hard would it be to perhaps have dspam support in MailScanner?
>
> As it calls an external program I don't think it would be too difficult.
>
Having read this
http://www.jiscmail.ac.uk/cgi-bin/webadmin?A2=ind0402&L=mailscanner&D=0&I=-1&P=173426
and quoting 'Wietse Venema' "don't depend on one solution for spam", I
wouldn't mind MailScanner supporting both SA as well as dspam.

- dhawal

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From michele at BLACKNIGHTSOLUTIONS.COM  Mon Nov  1 11:27:11 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:26 2006
Subject: dspam!
Message-ID: <mailman.4142.1137101246.24926.mailscanner@lists.mailscanner.info>

>
> Having read this
> http://www.jiscmail.ac.uk/cgi-bin/webadmin?A2=ind0402&L=mailsc
> anner&D=0&I=-1&P=173426 and quoting 'Wietse Venema' "don't depend on
> one solution for spam", I wouldn't mind MailScanner supporting both
> SA as well as dspam.
>

Did you actually read what Julian said?

Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
Proud sponsors of MM04 {http://www.mm04.net}

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Jan-Peter.Koopmann at SECEIDOS.DE  Mon Nov  1 11:50:52 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:26 2006
Subject: dspam!
Message-ID: <mailman.4143.1137101246.24926.mailscanner@lists.mailscanner.info>

On : Blacknight Solutions MailScanner mailing list wrote:

>> Having read this
>> http://www.jiscmail.ac.uk/cgi-bin/webadmin?A2=ind0402&L=mailsc
>> anner&D=0&I=-1&P=173426 and quoting 'Wietse Venema' "don't depend on
>> one solution for spam", I wouldn't mind MailScanner supporting both
>> SA as well as dspam. 
>> 
> 
> Did you actually read what Julian said?

My thoughts exactly. Probably not.

David, please read the posting again. It states that Dspam is the one
relying on one (or few) solutions for fighting spam whereas SpamAssassin
is using several different approaches. SpamAssassin is the way to go...

Regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From davidj at synaq.com  Mon Nov  1 12:27:45 2004
From: davidj at synaq.com (David Jacobson)
Date: Thu Jan 12 21:27:26 2006
Subject: dspam!
Message-ID: <mailman.4144.1137101246.24926.mailscanner@lists.mailscanner.info>

<QUOTE>> Did you actually read what Julian said?
My thoughts exactly. Probably not.</QUOTE>

Perhaps you should take your own advise and see that I never wrote the
second post.  Maybe _READING_ would help before replying with no useful
information and addressing it to the wrong person.

On Mon, 2004-11-01 at 13:50, Jan-Peter Koopmann wrote:
> On : Blacknight Solutions MailScanner mailing list wrote:
> 
> >> Having read this
> >> http://www.jiscmail.ac.uk/cgi-bin/webadmin?A2=ind0402&L=mailsc
> >> anner&D=0&I=-1&P=173426 and quoting 'Wietse Venema' "don't depend on
> >> one solution for spam", I wouldn't mind MailScanner supporting both
> >> SA as well as dspam. 
> >> 
> > 
> > Did you actually read what Julian said?
> 
> My thoughts exactly. Probably not.
> 
> David, please read the posting again. It states that Dspam is the one
> relying on one (or few) solutions for fighting spam whereas SpamAssassin
> is using several different approaches. SpamAssassin is the way to go...
> 
> Regards,
>   JP
> 
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
-- 
Regards,

David Jacobson
Technical Director
SYNAQ (Pty) Ltd

Tel:    011 290 6388
Cell:   083 235 0760
Mail:   davidj@synaq.com
WWW:    http://www.synaq.com	

Key Fingerprint
8246 FCE1 3C22 7EFB E61B  18DF 6E8B 65E8 BD50 78A1

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, "This is a digitally signed message part"  ]
    [ Application/PGP-SIGNATURE  196bytes. ]
    [ Unable to print this part. ]


From michele at BLACKNIGHTSOLUTIONS.COM  Mon Nov  1 12:44:07 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:26 2006
Subject: dspam!
Message-ID: <mailman.4145.1137101246.24926.mailscanner@lists.mailscanner.info>

> <QUOTE>> Did you actually read what Julian said? My thoughts
> exactly. Probably not.</QUOTE> Perhaps you should take your
> own advise and see that I never wrote the second post.  Maybe
> _READING_ would help before replying with no useful
> information and addressing it to the wrong person.
David

Your name is not mentioned in either my post or Jan's so there is no need
for you to get up on your "high horse".


Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
Proud sponsors of MM04 {http://www.mm04.net}

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From dhawal at NETMAGICSOLUTIONS.COM  Mon Nov  1 12:14:17 2004
From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy)
Date: Thu Jan 12 21:27:26 2006
Subject: dspam!
Message-ID: <mailman.4146.1137101246.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Michele Neylon :: Blacknight Solutions wrote:
>>Having read this
>>http://www.jiscmail.ac.uk/cgi-bin/webadmin?A2=ind0402&L=mailsc
>>anner&D=0&I=-1&P=173426 and quoting 'Wietse Venema' "don't depend on
>>one solution for spam", I wouldn't mind MailScanner supporting both
>>SA as well as dspam.
>>
>
>
> Did you actually read what Julian said?
>

Yup I have, Julian's observations were pretty valid in Feb this year,
however it's november and dspam has matured over the months.. So rather
than being dependent only on SA, it would be a worthwhile idea to
evaluate how MS can use both (and let SA continue as the primary spam
engine).

If we can have multiple rbls and multiple anti-virus engines, why not
multiple anti-spam engines.. for that matter why just dspam there are a
lot other bayesian / non-bayesian engines out there.
http://www.paulgraham.com/filters.html

2 cents,
- dhawal

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Steve.Swaney at FSL.COM  Mon Nov  1 12:26:34 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:26 2006
Subject: Beta BUG? - SA Auto Whitelist
Message-ID: <mailman.4147.1137101246.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Steve Freegard
> Sent: Monday, November 01, 2004 5:11 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Beta BUG? - SA Auto Whitelist
>
> Hi All,
>
> I upgraded one of my scanners to the latest beta and SA 3.01 on Saturday
> and have just been checking up on it's progress this morning and noticed
> that quite a few spams had got through - further investigation showed
> that all of them sneaked through because of the 'AWL' (auto white-list)
> rule.
>
> In MailScanner.conf - I've got:
>
> SpamAssassin Auto Whitelist = no
>
> However this seems to be ignored if SA3 is used - I found the following
> in SA.pm:
>
>      if (MailScanner::Config::Value('spamassassinautowhitelist')) {
>        # JKF 14/6/2002 Enable the auto-whitelisting functionality
>        MailScanner::Log::InfoLog("Enabling SpamAssassin auto-whitelist
> functionality...");
>        if ($SAversion<3) {
>         <snip>
>        }
>      }
>
> So I've added:
>
> use_auto_whitelist 0
>
> to spam.assassin.prefs.conf which has disabled it successfully.
>
> Has anyone else experienced this?? - it's probably worth a mention
> somewhere for upgraders.
>
> Kind regards,
> Steve.
>

Yes. This option and a few other are correctly set in our sample
spam.assassin.prefs.conf available at:

        http://www.fsl.com/support

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com
> --
> Steve Freegard
> Systems Manager
> Littlehampton Book Services Ltd.
>
> --
> This message has been scanned for viruses and dangerous content by
> MailScanner.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> Fortress Systems Ltd.
> www.fsl.com
>



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Jan-Peter.Koopmann at SECEIDOS.DE  Mon Nov  1 12:52:53 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:26 2006
Subject: dspam!
Message-ID: <mailman.4148.1137101246.24926.mailscanner@lists.mailscanner.info>

> <QUOTE>> Did you actually read what Julian said?
> My thoughts exactly. Probably not.</QUOTE>
> 
> Perhaps you should take your own advise and see that I never
> wrote the second post.  Maybe _READING_ would help before
> replying with no useful information and addressing it to the wrong
> person. 

Another touchy morning? Let's see:

You stated that dspam looks better than spamassassin...

I asked why you think so. Up to this time: No reply. I moreover told you
that this topic has been covered a few times and asked you to have a
look at the archives. What is your definition of "useful information"?
Do you expect me to go through the archives again for you to extract
that information? Probably not. So why exactly are you getting all that
excited?

>> 
>> My thoughts exactly. Probably not.

Whoever posted the link did not read and/or understand it. That's what
Michele and I am referring to. I was not insulting you in any way.

>> David, please read the posting again. It states that Dspam is the one
>> relying on one (or few) solutions for fighting spam whereas
>> SpamAssassin is using several different approaches.
>> SpamAssassin is the way to go...

And this is still true. Read the posting Dhawal provided (even though
interpreting it the wrong way). In my interpretation that posting tells
you why SpamAssassin is a far superior tool for the job. Until someone
tells me why this is not true I personally do not see the point in
having Julian support dspam as well. It will just consume more of his
resources without any benefit.

Regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Jan-Peter.Koopmann at SECEIDOS.DE  Mon Nov  1 13:39:50 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:26 2006
Subject: dspam!
Message-ID: <mailman.4149.1137101246.24926.mailscanner@lists.mailscanner.info>

On Monday, November 01, 2004 1:14 PM MailScanner mailing list wrote:

> Yup I have, Julian's observations were pretty valid in Feb
> this year, however it's november and dspam has matured over
> the months.. 

I see. Now... It was not quite that obvious from your first posting...
:-)

> If we can have multiple rbls and multiple anti-virus engines,
> why not multiple anti-spam engines.. for that matter why just

Multiple anti-virus engines definately make sense since a new virus is
sometimes detected by scanner A much faster than by scanner B. Therefore
this means a lot more security. First of all we could start a big
argument whether or not the same is true for SpamAssassin and Dspam (or
any other scanner) that is: Is there spam out there that Dspam will
frequently catch a lot faster than SpamAssassin? But more importantly:
Even if that is the case, is it really worth the effort? With effort I
mean Julian programming and maintaining the support and your hardware
having to go through a lot more trouble. 

If Dspam catches less spam: Why bother.

If Dspam catches more spam: I would agree. I am not convinced this is
the case though.

If Dspam in combination with SpamAssassin catches let's say 1% more spam
than SA alone: Personally I would not want to spend resources on this
especially since I can be pretty sure that the SA folks (or the guys at
SURBL or rulesemporium) will "fix" this pretty soon.

Kind regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From kodak at FRONTIERHOMEMORTGAGE.COM  Mon Nov  1 14:01:29 2004
From: kodak at FRONTIERHOMEMORTGAGE.COM (Jason Balicki)
Date: Thu Jan 12 21:27:26 2006
Subject: Out of Office AutoReply: Way OT: SMTP/POP/IMAP (Whole
    mailserver, actually) redundancy
Message-ID: <mailman.4150.1137101246.24926.mailscanner@lists.mailscanner.info>

Turn off your vacation auto-reply, or configure it to not send mail
to mailing lists.

It is a HUGE security risk to you, and annoying to people who
actually PARTICIPATE in mailing lists as opposed to just lurking.

Do you know how annoying it is to have hundreds of list users tell
me that they're on vacation when I DON'T KNOW THEM AND I DON'T CARE?

Also, now anyone who sends a message to this mailing list
is going to know that you're on vacation and not watching
your stuff.  Consider the following scenario:

Bad guy: "Hi, I know <this guy's> out today, but he had
mentioned that I could do some maintenance for him, problem
is I forgot <some piece of information that can be wheedled
from your cow-orker and used to gain unauthorized access>
could you tell me what that was again?"

Your cow-orker:  "Yeah, sure, if you know <this guy>, here's
the <password | PIN | dress size>."

Since you've probably given your phone number, alternate
contact, etc, it makes it that much easier for an attacker
to socially engineer information out of your cow-orkers.

This has been a form letter.  Be aware that I'm equally annoyed
by each and every "Out of Office" message I receive.

--J(K)

PS:  yes, I mean "cow-orker".

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Denis.Beauchemin at USHERBROOKE.CA  Mon Nov  1 14:44:43 2004
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:27:26 2006
Subject: Some Questions
Message-ID: <mailman.4151.1137101246.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Dhawal Doshy wrote:

> A few question for the list..
>
> 2. Also does McAfee updates use the daily dat or the weekly + extra dats
>
Dhawal,

/usr/lib/MailScanner/mcafee-autoupdate only gets the weekly DATs.  There 
is some code in the script to fetch the extra.dat but it isn't complete 
(and it doesn't work yet).

Denis

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From drew at THEMARSHALLS.CO.UK  Mon Nov  1 15:25:52 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:26 2006
Subject: MailScanner/Postfix message duplication - possible fix 2
Message-ID: <mailman.4152.1137101246.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From michele at BLACKNIGHTSOLUTIONS.COM  Mon Nov  1 15:24:40 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:26 2006
Subject: Some Questions
Message-ID: <mailman.4153.1137101246.24926.mailscanner@lists.mailscanner.info>

> 3. How do I integrate a "Report as spam" mechanism with
> horde/imp, squirrelmail and sqwebmail

You'd need to look at the documentation for those programs. You'd also have
to decide how you wanted to handle the report ie what you would send and
where etc



Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
Proud sponsors of MM04 {http://www.mm04.net}

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mkettler at EVI-INC.COM  Mon Nov  1 16:06:03 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:26 2006
Subject: Beta BUG? - SA Auto Whitelist
Message-ID: <mailman.4154.1137101246.24926.mailscanner@lists.mailscanner.info>

At 05:23 AM 11/1/2004, Raymond Dijkxhoorn wrote:
># AUTO WHITELISTING OFF
>score AWL 0.0
>
>Thats what i use.

I'd strongly suggest that you do not do that. The AWL is not a rule, it's a
score averaging subsystem of the SA code itself, and this method does not
reliably disable the AWL, although bugs in SA might cause it to nullify the
score, this should be regarded as a SA bug and not used to configure SA.


Steven's question isn't about how to disable the AWL. It's about why the
normal MailScanner method doesn't work.

I think this might be a subtle API change on the SA end. Use the
"use_auto_whitelist" option until Julian can fix it. Julian's been aware of
the problem since SA 3.0 came out. In the meantime, if you've got SA 3.x
disable it with the use_auto_whitelist option as Steve did.

For those using 2.6x, SpamAssassin Auto Whitelist = no in MailScanner.conf
should work fine on it's own. Eventualy it should work for 3.0 again, but
use_auto_whitelist is a good workaround in the meantime.

Using a score 0 setting for the AWL is a bad idea. This works well for
rules with fixed scores, but not so well for the AWL which has a dynamic
scoring system and doesn't normally even have a score statement.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From dhawal at NETMAGICSOLUTIONS.COM  Mon Nov  1 16:07:04 2004
From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy)
Date: Thu Jan 12 21:27:26 2006
Subject: dspam!
Message-ID: <mailman.4155.1137101246.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Jan-Peter Koopmann wrote:
> Multiple anti-virus engines definately make sense since a new virus is
> sometimes detected by scanner A much faster than by scanner B. Therefore
> this means a lot more security. First of all we could start a big
> argument whether or not the same is true for SpamAssassin and Dspam (or
> any other scanner) that is: Is there spam out there that Dspam will
> frequently catch a lot faster than SpamAssassin? But more importantly:
> Even if that is the case, is it really worth the effort? With effort I
> mean Julian programming and maintaining the support and your hardware
> having to go through a lot more trouble.
>
> If Dspam catches less spam: Why bother.
>
> If Dspam catches more spam: I would agree. I am not convinced this is
> the case though.
>
> If Dspam in combination with SpamAssassin catches let's say 1% more spam
> than SA alone: Personally I would not want to spend resources on this
> especially since I can be pretty sure that the SA folks (or the guys at
> SURBL or rulesemporium) will "fix" this pretty soon.
>

Looking at the overwhelming support for SA I hereby withdraw my request
to support multiple spam engines (specially ones containing the word
dspam). Ok, I understand as Jan says that adding dspam or the likes
would make no great difference to spam detection (unless the engine is
truly revolutionary) and at the same time would increase Julian's effort
in maintaining the code (and my hardware requirement). Plus the fact
that the secondary engine would serve no purpose since all obvious spam
would be dropped at the primary engine (leaving the secondary only with
mostly ham).

But this is where I see open-source making a difference, anyone
convinced of dspam's capability is free to start a patch supporting
dspam (or libdspam).

anyways
-- End of topic -- (for me atleast)
- dhawal

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Jan-Peter.Koopmann at SECEIDOS.DE  Mon Nov  1 16:07:48 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:26 2006
Subject: Out of Office AutoReply: Way OT: SMTP/POP/IMAP (Whole
    mailserver, actually) redundancy
Message-ID: <mailman.4156.1137101246.24926.mailscanner@lists.mailscanner.info>

> Turn off your vacation auto-reply, or configure it to not
> send mail to mailing lists.

*clap*

Did you mail it to Steve directly as well?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From michele at BLACKNIGHTSOLUTIONS.COM  Mon Nov  1 16:20:46 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:26 2006
Subject: dspam!
Message-ID: <mailman.4157.1137101246.24926.mailscanner@lists.mailscanner.info>

> Looking at the overwhelming support for SA I hereby withdraw
> my request to support multiple spam engines (specially ones
> containing the word dspam). Ok, I understand as Jan says that
> adding dspam or the likes would make no great difference to
> spam detection (unless the engine is truly revolutionary) and
> at the same time would increase Julian's effort in
> maintaining the code (and my hardware requirement). Plus the
> fact that the secondary engine would serve no purpose since
> all obvious spam would be dropped at the primary engine
> (leaving the secondary only with mostly ham).
>
> But this is where I see open-source making a difference,
> anyone convinced of dspam's capability is free to start a
> patch supporting dspam (or libdspam).
>
You've hit the nail on the head.
If you want to patch/fork to support it you are free to do so :)


Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
Proud sponsors of MM04 {http://www.mm04.net}

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From drew at THEMARSHALLS.CO.UK  Mon Nov  1 16:24:20 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:26 2006
Subject: MailScanner/Postfix message duplication - possible fix 2
Message-ID: <mailman.4158.1137101246.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Sorry guys (And Gals!)

It would appear that my Palm MultiMail has had a fit and sent a load (Yes
sadly more than one but not to this list thank goodness!) of very old
mail that it had in it's inbox to it's outbox. :-(
Sorry for disturbing your afternoon :-[

I'm off to beat up some software to try to make it understand why it
shouldn't misbehave like this..

Drew

Drew Marshall wrote:

 ------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
  


--
In line with our policy, this message has been scanned for
viruses and dangerous content by MailScanner, and is
believed to be clean. ------------------------ MailScanner list
------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk
with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From jrudd at UCSC.EDU  Mon Nov  1 16:51:01 2004
From: jrudd at UCSC.EDU (John Rudd)
Date: Thu Jan 12 21:27:26 2006
Subject: dspam!
Message-ID: <mailman.4159.1137101246.24926.mailscanner@lists.mailscanner.info>

Jan-Peter Koopmann wrote:
> If Dspam catches less spam: Why bother.

While I don't have an opinion about Dspam itself, I think the logic
behind this statement is rather faulty.  It's not important whether or
not Dspam catches more or less spam than SA.  What's important is
whether or not it catches _different_ spam than SA.

The "more or less" argument only applies if someone is asserting that
we should use Dspam instead of SA.  That's not necessarily what is
being asserted here.  What's being requested is the ability to use them
together.  The value of such a situation lies in whether or not Dspam
would catch a group of spam that SA misses, even if the total amount of
spam that Dspam catches is stuff that SA misses (just like the value of
using multiple virus scanners: it's not a matter of whether or not the
2nd scanner catches as much as the first one, it's useful to you as
long as it has the potential to be catching a group of things the first
scanner doesn't catch).

And whether or not the SA folks catch that other group of spam soon is
immaterial.  What spam you can catch with SA in the next release
doesn't help you much while you're using the current release.

I think something like the generic external virus scanner option that
was set up would be a useful thing to have for spam scanners as well.
Have a program group that can be set up to give a "it's not spam",
"it's spam" or "it's high spam" result (perhaps with a report string
that gets put in the 2nd part of the spamcheck report) after
mailscanner sends that program the message.  It's probably not
efficient, but it gives people options.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From dhawal at NETMAGICSOLUTIONS.COM  Mon Nov  1 16:24:23 2004
From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy)
Date: Thu Jan 12 21:27:26 2006
Subject: Some Questions
Message-ID: <mailman.4160.1137101246.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian Field wrote:
>
> Yes.
> I'll have to leave other people to answer the others.
>

To answer my own question, changing the following "Quarantine Whole
Messages As Queue Files = no" allows me not only to release messages
cleanly but also view them in the MW interface is required..

btw if it concerns anyone, we've been using the mcafee daily dats (on
production qmail servers with qmail-scanner) quite successfully for more
than a year now and have faced minimal trouble with viruses. Extra dats
need manual intervention though.

thanks everyone,
- dhawal

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Mon Nov  1 16:59:10 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:26 2006
Subject: dspam!
Message-ID: <mailman.4161.1137101246.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

John Rudd wrote:

> I think something like the generic external virus scanner option that
> was set up would be a useful thing to have for spam scanners as well.
> Have a program group that can be set up to give a "it's not spam",
> "it's spam" or "it's high spam" result (perhaps with a report string
> that gets put in the 2nd part of the spamcheck report) after
> mailscanner sends that program the message.  It's probably not
> efficient, but it gives people options.

That sounds like a good idea. I'll put it on the list of things to do at
some point. Don't hold your breath though!

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From chris.ferron at INTELLIGRAPHICS.COM  Mon Nov  1 16:56:46 2004
From: chris.ferron at INTELLIGRAPHICS.COM (Chris Ferron)
Date: Thu Jan 12 21:27:26 2006
Subject: Outgoing Mail
Message-ID: <mailman.4162.1137101246.24926.mailscanner@lists.mailscanner.info>

Could someone explain to me how to get outgoing messages with executable
in zips from being scanned from internal mail address. Anytime someone
try's to send a message with a com, cab, exe, msi file that is zipped it
get stopped.
Thanks for the help

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From raymond at PROLOCATION.NET  Mon Nov  1 16:10:26 2004
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:27:26 2006
Subject: Beta BUG? - SA Auto Whitelist
Message-ID: <mailman.4163.1137101246.24926.mailscanner@lists.mailscanner.info>

Hi Matt,

> I think this might be a subtle API change on the SA end. Use the
> "use_auto_whitelist" option until Julian can fix it. Julian's been aware of
> the problem since SA 3.0 came out. In the meantime, if you've got SA 3.x
> disable it with the use_auto_whitelist option as Steve did.
>
> For those using 2.6x, SpamAssassin Auto Whitelist = no in MailScanner.conf
> should work fine on it's own. Eventualy it should work for 3.0 again, but
> use_auto_whitelist is a good workaround in the meantime.
>
> Using a score 0 setting for the AWL is a bad idea. This works well for
> rules with fixed scores, but not so well for the AWL which has a dynamic
> scoring system and doesn't normally even have a score statement.

Well, it was told by one of the SA guys, in a porivate chat, but if its
fixed somewhere else, fine by me ;) It works for me, as a very quick fix
to get the (for me) irrtating AWL out of there :)

Bye,
Raymond

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From kodak at FRONTIERHOMEMORTGAGE.COM  Mon Nov  1 16:56:02 2004
From: kodak at FRONTIERHOMEMORTGAGE.COM (Jason Balicki)
Date: Thu Jan 12 21:27:26 2006
Subject: Out of Office AutoReply: Way OT: SMTP/POP/IMAP (Whole
    mailserver, actually) redundancy
Message-ID: <mailman.4164.1137101246.24926.mailscanner@lists.mailscanner.info>

Jan-Peter Koopmann <> wrote:
> Did you mail it to Steve directly as well?

So, yeah, here's the irony:

I set this up a long time ago to automatically reply to
those who send OOO replies, however since I always get
them directly from the sender everything is fine, but
in this case the message came THROUGH the mailing list,
a condition I (stupidly) didn't account for.  So,
sorry for spamming the list.  I'm hanging my head in
shame, especially considering the subject matter.

The filter is off until I get time to fix the conditions.

Again, I apologize everyone.  I'll do my best to keep
it from happening again.

--J(K)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Mon Nov  1 17:50:11 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:26 2006
Subject: Outgoing Mail
Message-ID: <mailman.4165.1137101246.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

You need to read up about rulesets. You can do all sorts of setups like
this with a simple ruleset. They have been discussed to death here, in
the documentation (look at the MAQ referred to in the sig at the bottom
of the posting) and in files in /etc/MailScanner/rules.

You should find all you need there.

Chris Ferron wrote:

> Could someone explain to me how to get outgoing messages with executable
> in zips from being scanned from internal mail address. Anytime someone
> try's to send a message with a com, cab, exe, msi file that is zipped it
> get stopped.

--

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Jan-Peter.Koopmann at SECEIDOS.DE  Mon Nov  1 18:02:39 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:26 2006
Subject: Out of Office AutoReply: Way OT: SMTP/POP/IMAP (Whole
    mailserver, actually) redundancy
Message-ID: <mailman.4166.1137101246.24926.mailscanner@lists.mailscanner.info>

On Monday, November 01, 2004 5:56 PM MailScanner mailing list wrote:

> So, yeah, here's the irony:

LOL. Indeed. Funny.

> Again, I apologize everyone.  I'll do my best to keep it from
> happening again. 

No need to apologize. We should work on a filter that automatically
replies to "Out of Office" mails that do come from mailing lists... :-) 

Regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From combs at magnet.fsu.edu  Mon Nov  1 18:06:16 2004
From: combs at magnet.fsu.edu (Tom Combs)
Date: Thu Jan 12 21:27:26 2006
Subject: Off Topic: Eudora connection time outs
Message-ID: <mailman.4167.1137101246.24926.mailscanner@lists.mailscanner.info>

Hi,

 Excuse me for posting a non-mailscanner question here but I'm desperate
 and respect the amount of knowlegde on this list.

 I've just upgraded to a new email server and now Eudora clients are
 getting 10060 connection time out errors on a regular bases. I see
 no sendmail, imap, pop or OS errors and the system isn't even breaking
 a sweat with the load staying under 1.0. I've check the Advanced network
 settings in Eudora and the time outs are set to 300 and the buffer size
 is set to 4096.

 The server is a Dell Power Edge 1750 with dual Xeons running RedHat Ent.
 Linux V3, sendmail 8.13.1, UW imap 2004a, MailScanner 4.34.8-4, SA 3.0.

 Only Eudora is getting the time outs with all other clients working fine.

 Has anyone seen this problem before and can tell me how to fix it?


 TIA.  --Tom Combs

--
Tom Combs                                      E-mail: combs@magnet.fsu.edu
National High Magnetic Field Laboratory        Phone:  (850) 644-1657
1800 E. Paul Dirac Drive                       Tallahassee, FL 32310

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mkettler at EVI-INC.COM  Mon Nov  1 18:07:30 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:26 2006
Subject: Beta BUG? - SA Auto Whitelist
Message-ID: <mailman.4168.1137101246.24926.mailscanner@lists.mailscanner.info>

At 11:10 AM 11/1/2004, Raymond Dijkxhoorn wrote:
> > Using a score 0 setting for the AWL is a bad idea. This works well for
> > rules with fixed scores, but not so well for the AWL which has a dynamic
> > scoring system and doesn't normally even have a score statement.
>
>Well, it was told by one of the SA guys, in a porivate chat, but if its
>fixed somewhere else, fine by me ;) It works for me, as a very quick fix
>to get the (for me) irrtating AWL out of there :)

Really? that seems quite shocking to me.

I've never heard any of them suggest such a thing before, and I can only
find two references to such a thing on the web. One is part of a university
mailsystem patch to libs/UMR/SpamPrefs.pm. The other is a post by someone
claiming that setting wasn't disabling the AWL (in german).

Are you sure it was one of the actual SA guys, i.e. one of the developers,
and not a general SA user who might not know what he or she is talking about?

Just based on how the AWL works, I'm quite shocked it has any effect at all.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From krausem at gmail.com  Mon Nov  1 18:17:32 2004
From: krausem at gmail.com (Matt Krause)
Date: Thu Jan 12 21:27:26 2006
Subject: Catching spam from the Return-Path: header
Message-ID: <mailman.4169.1137101246.24926.mailscanner@lists.mailscanner.info>

How would I go about doing this?

Something like

header   SAMPLE_RULE  Return-Path =~ blah@aol.com

Would that work?

Thanks.
--
Matt Krause
krausem@gmail.com
http://www.mattkrause.net

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Steve.Swaney at FSL.COM  Mon Nov  1 18:04:56 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:26 2006
Subject: RPM package conflict error
Message-ID: <mailman.4170.1137101246.24926.mailscanner@lists.mailscanner.info>

If you still receive this error:

RPM package conflict error.  The message was:
Test install failed because of package conflicts:
package perl-5.8.0-88.7 is already installed

When running `up2date -u` or `yum update` after installing MailScanner
4.35.9-1, you should be able to repair the rpm database by running the
following commands:

        rpm -e --nodeps perl

Yes I do mean this :) Then run:

        up2date -u

or

        yum update

Big disclaimer - This worked for me, your mileage may vary!

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From michele at BLACKNIGHTSOLUTIONS.COM  Mon Nov  1 17:51:34 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:26 2006
Subject: Out of Office AutoReply: Way OT: SMTP/POP/IMAP (Whole
    mailserver, actually) redundancy
Message-ID: <mailman.4171.1137101246.24926.mailscanner@lists.mailscanner.info>

> I set this up a long time ago to automatically reply to those
> who send OOO replies, however since I always get them
> directly from the sender everything is fine, but in this case
> the message came THROUGH the mailing list, a condition I
> (stupidly) didn't account for.  So, sorry for spamming the
> list.  I'm hanging my head in shame, especially considering the
> subject matter.
>
> The filter is off until I get time to fix the conditions.
>
> Again, I apologize everyone.  I'll do my best to keep it from
> happening again.
>
I wouldn't worry about it. I find the out of office replies far more
annoying than your response to them.



Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
Proud sponsors of MM04 {http://www.mm04.net}

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mkettler at EVI-INC.COM  Mon Nov  1 18:26:28 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:26 2006
Subject: Catching spam from the Return-Path: header
Message-ID: <mailman.4172.1137101246.24926.mailscanner@lists.mailscanner.info>

At 01:17 PM 11/1/2004, Matt Krause wrote:
>How would I go about doing this?
>
>Something like
>
>header   SAMPLE_RULE  Return-Path =~ blah@aol.com
>
>Would that work?

You need to include a few other things, but you're on the right path.

Escape punctuation with \'es. Begin and end the regex with /'es. Append an
i to make it case-insensitive:

header   SAMPLE_RULE  Return-Path =~ /blah\@aol\.com/i

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Kevin_Miller at CI.JUNEAU.AK.US  Mon Nov  1 17:52:39 2004
From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller)
Date: Thu Jan 12 21:27:26 2006
Subject: Out of Office AutoReply: Way OT: SMTP/POP/IMAP (Whole mailser
    ver, actually) redundancy
Message-ID: <mailman.4173.1137101246.24926.mailscanner@lists.mailscanner.info>

Jason Balicki wrote:
> Jan-Peter Koopmann <> wrote:
>> Did you mail it to Steve directly as well?
>
> So, yeah, here's the irony:
>
> I set this up a long time ago to automatically reply to those who
> send OOO replies, however since I always get them directly from the
> sender everything is fine, but in this case the message came THROUGH
> the mailing list, a condition I (stupidly) didn't account for.  So,
> sorry for spamming the list.  I'm hanging my head in shame,
> especially considering the subject matter.
>
> The filter is off until I get time to fix the conditions.
>
> Again, I apologize everyone.  I'll do my best to keep it from
> happening again.

Oh, I don't know - maybe your script could be the next feature edition to
MS?  As long as we're filtering annoying spam, phishing schemes, viruses,
etc. maybe a OOO message filter would be nifty...


...Kevin
--
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Admin., Mail Admin.
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From marcin.rozek at IOS.EDU.PL  Mon Nov  1 18:33:46 2004
From: marcin.rozek at IOS.EDU.PL ([ISO-8859-2] Marcin Rożek)
Date: Thu Jan 12 21:27:26 2006
Subject: Off Topic: Eudora connection time outs
Message-ID: <mailman.4174.1137101246.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-2" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Tom Combs wrote:
>  I've just upgraded to a new email server and now Eudora clients are
>  getting 10060 connection time out errors on a regular bases. I see
>  no sendmail, imap, pop or OS errors and the system isn't even breaking
>  a sweat with the load staying under 1.0. I've check the Advanced network
>  settings in Eudora and the time outs are set to 300 and the buffer size
>  is set to 4096.
Perhaps you block(drop) connections on port 113 (ident). If that's the
case then try to reject them instead of drop.

Regards,
Marcin

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Steve.Swaney at FSL.COM  Mon Nov  1 18:26:19 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:26 2006
Subject: RPM package conflict error
Message-ID: <mailman.4175.1137101246.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: Steve Swaney [mailto:Steve.Swaney@fsl.com]
> Sent: Monday, November 01, 2004 1:05 PM
> To: 'MAILSCANNER@JISCMAIL.AC.UK'
> Subject: RPM package conflict error
>
> If you still receive this error:
>
> RPM package conflict error.  The message was:
> Test install failed because of package conflicts:
> package perl-5.8.0-88.7 is already installed
>
> When running `up2date -u` or `yum update` after installing MailScanner
> 4.35.9-1, you should be able to repair the rpm database by running the
> following commands:
>
>       rpm -e --nodeps perl
>
> Yes I do mean this :) Then run:
>
>       up2date -u
>
> or
>
>       yum update
>
> Big disclaimer - This worked for me, your mileage may vary!

I should have added:

Thoroughly test MailScanner processing and email delivery. If you see any
"cannot decode" error messages. Simply stop MailScanner, then run the
MailScanner 4.35.9-1 install script again.

Start MailScanner and again thoroughly test MailScanner Processing and email
delivery.

All should now be well.

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com




--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From gregg at GBCOMPUTERS.COM  Mon Nov  1 19:40:02 2004
From: gregg at GBCOMPUTERS.COM (Gregg Berkholtz)
Date: Thu Jan 12 21:27:26 2006
Subject: ANNOUNCE: MailScanner 4.35.9 stable released
Message-ID: <mailman.4176.1137101246.24926.mailscanner@lists.mailscanner.info>

Julian, thanks for the reply, though I'm using Debian, not an RPM
system.

Though I cannot seem to find any straightforward documentation in regards
to removing an existing Perl module installed via CPAN and/or
MailScanner. Even Google is not revealing anything useful - any insight
in regards to a basic rundown?

For example, for Base64, I've tried searching the filesystem for
"Base64", and came up with:
 /usr/lib/perl5/auto/MIME/Base64
 /usr/lib/perl5/auto/MIME/Base64/Base64.bs
 /usr/lib/perl5/auto/MIME/Base64/Base64.so
 /usr/lib/perl5/MIME/Base64.pm
 /usr/local/lib/site_perl/i386-linux/auto/MIME/Base64
 /usr/local/lib/site_perl/i386-linux/auto/MIME/Base64/.packlist
 /usr/local/lib/site_perl/i386-linux/auto/MIME/Base64/Base64.bs
 /usr/local/lib/site_perl/i386-linux/auto/MIME/Base64/Base64.so
 /usr/local/lib/site_perl/i386-linux/MIME/Base64.pm
 /usr/local/lib/site_perl/MIME/Decoder/Base64.pm
 /usr/local/share/perl/5.6.1/MIME/Decoder/Base64.pm
 /usr/share/perl5/MIME/Decoder/Base64.pm

Should I remove everything listed? Is that a clean uninstall?

@INC shows:
 /usr/local/lib/perl/5.6.1
 /usr/local/share/perl/5.6.1
 /usr/lib/perl5
 /usr/share/perl5
 /usr/lib/perl/5.6.1
 /usr/share/perl/5.6.1
 /usr/local/lib/site_perl/i386-linux
 /usr/local/lib/site_perl

Gregg

On Mon, Nov 01, 2004 at 01:23:17PM -0500, Julian Field wrote:
> You need to install the MIME::Base64 that comes with MailScanner, it is
> designed to be installed in a location that does not screw up the RPM
> database. Remove MIME::Base64 and MIME::QuotedPrint and try again.
>
> Gregg Berkholtz wrote:
>
> >I'm running a Debian Woody system, with Perl 5.6.1, and while running
> >the install.sh script to upgrade from 4.32.4-1 to 4.35.9-1, I'm
> >encountering
> >an error when install.sh tries to compile MIME-tools.
> >
> >I've used CPAN to check the version of MIME::QuotedPrint, and MIME::Base64
> >-
> >with both reporting that I'm using the latest version, any ideas?
> >
> >LOG:
> >Attempting to build and install
> >MIME-tools-5.415
> >Unpacking perl-tar/MIME-tools-5.415.tar.gz
> >
> >Do not worry too much about errors from the next command.
> >It is quite likely that some of the Perl modules are
> >already installed on your system.
> >
> >The important ones are HTML-Parser and MIME-tools.
> >
> >Checking if your kit is complete...
> >Looks good
> >Warning: prerequisite MIME::Base64 3.03 not found. We have 2.12.
> >Writing Makefile for MIME-tools
> >cp lib/MIME/Parser/Filer.pm blib/lib/MIME/Parser/Filer.pm
> >cp lib/MIME/Field/ContDisp.pm blib/lib/MIME/Field/ContDisp.pm
> >cp set-version.pl blib/lib/set-version.pl
> >cp lib/MIME/Parser/Results.pm blib/lib/MIME/Parser/Results.pm
> >cp lib/MIME/Decoder/Base64.pm blib/lib/MIME/Decoder/Base64.pm
> >cp lib/MIME/WordDecoder.pm blib/lib/MIME/WordDecoder.pm
> >cp lib/MIME/Decoder/NBit.pm blib/lib/MIME/Decoder/NBit.pm
> >cp lib/MIME/Decoder/Binary.pm blib/lib/MIME/Decoder/Binary.pm
> >cp lib/MIME/Body.pm blib/lib/MIME/Body.pm
> >cp lib/MIME/Decoder/BinHex.pm blib/lib/MIME/Decoder/BinHex.pm
> >cp lib/MIME/Parser/Reader.pm blib/lib/MIME/Parser/Reader.pm
> >cp lib/MIME/Decoder/UU.pm blib/lib/MIME/Decoder/UU.pm
> >cp lib/MIME/Field/ParamVal.pm blib/lib/MIME/Field/ParamVal.pm
> >cp lib/MIME/Decoder/Gzip64.pm blib/lib/MIME/Decoder/Gzip64.pm
> >cp lib/MIME/Decoder/QuotedPrint.pm blib/lib/MIME/Decoder/QuotedPrint.pm
> >cp lib/MIME/Field/ContType.pm blib/lib/MIME/Field/ContType.pm
> >cp lib/MIME/Entity.pm blib/lib/MIME/Entity.pm
> >cp lib/MIME/Head.pm blib/lib/MIME/Head.pm
> >cp lib/MIME/Parser.pm blib/lib/MIME/Parser.pm
> >cp lib/MIME/Tools.pm blib/lib/MIME/Tools.pm
> >cp lib/MIME/Words.pm blib/lib/MIME/Words.pm
> >cp lib/MIME/Decoder.pm blib/lib/MIME/Decoder.pm
> >cp lib/MIME/Field/ConTraEnc.pm blib/lib/MIME/Field/ConTraEnc.pm
> >Manifying blib/man3/MIME::Field::ContDisp.3pm
> >Manifying blib/man3/MIME::Parser::Filer.3pm
> >Manifying blib/man3/MIME::Decoder::Base64.3pm
> >Manifying blib/man3/MIME::WordDecoder.3pm
> >Manifying blib/man3/MIME::Parser::Results.3pm
> >Manifying blib/man3/MIME::Decoder::NBit.3pm
> >Manifying blib/man3/MIME::Decoder::Binary.3pm
> >Manifying blib/man3/MIME::Body.3pm
> >Manifying blib/man3/MIME::Decoder::BinHex.3pm
> >Manifying blib/man3/MIME::Parser::Reader.3pm
> >Manifying blib/man3/MIME::Decoder::UU.3pm
> >Manifying blib/man3/MIME::Decoder::Gzip64.3pm
> >Manifying blib/man3/MIME::Field::ParamVal.3pm
> >Manifying blib/man3/MIME::Decoder::QuotedPrint.3pm
> >Manifying blib/man3/MIME::Entity.3pm
> >Manifying blib/man3/MIME::Parser.3pm
> >Manifying blib/man3/MIME::Head.3pm
> >Manifying blib/man3/MIME::Field::ContType.3pm
> >Manifying blib/man3/MIME::Tools.3pm
> >Manifying blib/man3/MIME::Words.3pm
> >Manifying blib/man3/MIME::Decoder.3pm
> >Manifying blib/man3/MIME::Field::ConTraEnc.3pm
> >PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e"
> >"test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
> >t/Body...........ok
> >t/Decoder........ok
> >t/Entity.........MIME::QuotedPrint version 3.03 required--this is only
> >version 2.03 at /tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
> >BEGIN failed--compilation aborted at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
> >Compilation failed in require at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/Head.pm line 123.
> >BEGIN failed--compilation aborted at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/Head.pm line 123.
> >Compilation failed in require at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/Entity.pm line 235.
> >BEGIN failed--compilation aborted at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/Entity.pm line 235.
> >Compilation failed in require at t/Entity.t line 3.
> >BEGIN failed--compilation aborted at t/Entity.t line 3.
> >t/Entity.........dubious
> >       Test returned status 255 (wstat 65280, 0xff00)
> >t/Gauntlet.......MIME::QuotedPrint version 3.03 required--this is only
> >version 2.03 at /tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
> >BEGIN failed--compilation aborted at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
> >Compilation failed in require at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/Head.pm line 123.
> >BEGIN failed--compilation aborted at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/Head.pm line 123.
> >Compilation failed in require at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/Parser.pm line 147.
> >BEGIN failed--compilation aborted at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/Parser.pm line 147.
> >Compilation failed in require at t/Gauntlet.t line 3.
> >BEGIN failed--compilation aborted at t/Gauntlet.t line 3.
> >t/Gauntlet.......dubious
> >       Test returned status 255 (wstat 65280, 0xff00)
> >t/Head...........MIME::QuotedPrint version 3.03 required--this is only
> >version 2.03 at /tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
> >BEGIN failed--compilation aborted at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
> >Compilation failed in require at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/Head.pm line 123.
> >BEGIN failed--compilation aborted at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/Head.pm line 123.
> >Compilation failed in require at t/Head.t line 2.
> >BEGIN failed--compilation aborted at t/Head.t line 2.
> >t/Head...........dubious
> >       Test returned status 255 (wstat 65280, 0xff00)
> >t/Misc...........MIME::QuotedPrint version 3.03 required--this is only
> >version 2.03 at /tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
> >BEGIN failed--compilation aborted at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
> >Compilation failed in require at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/Head.pm line 123.
> >BEGIN failed--compilation aborted at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/Head.pm line 123.
> >Compilation failed in require at t/Misc.t line 2.
> >BEGIN failed--compilation aborted at t/Misc.t line 2.
> >t/Misc...........dubious
> >       Test returned status 255 (wstat 65280, 0xff00)
> >t/Parser.........MIME::QuotedPrint version 3.03 required--this is only
> >version 2.03 at /tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
> >BEGIN failed--compilation aborted at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
> >Compilation failed in require at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/Head.pm line 123.
> >BEGIN failed--compilation aborted at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/Head.pm line 123.
> >Compilation failed in require at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/Parser.pm line 147.
> >BEGIN failed--compilation aborted at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/Parser.pm line 147.
> >Compilation failed in require at t/Parser.t line 10.
> >BEGIN failed--compilation aborted at t/Parser.t line 10.
> >t/Parser.........dubious
> >       Test returned status 255 (wstat 65280, 0xff00)
> >t/Ref............MIME::QuotedPrint version 3.03 required--this is only
> >version 2.03 at /tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
> >BEGIN failed--compilation aborted at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
> >Compilation failed in require at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/WordDecoder.pm line 77.
> >BEGIN failed--compilation aborted at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/WordDecoder.pm line 77.
> >Compilation failed in require at t/Ref.t line 8.
> >BEGIN failed--compilation aborted at t/Ref.t line 8.
> >t/Ref............dubious
> >       Test returned status 255 (wstat 65280, 0xff00)
> >t/WordDecoder....MIME::QuotedPrint version 3.03 required--this is only
> >version 2.03 at /tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
> >BEGIN failed--compilation aborted at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
> >Compilation failed in require at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/WordDecoder.pm line 77.
> >BEGIN failed--compilation aborted at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/WordDecoder.pm line 77.
> >Compilation failed in require at t/WordDecoder.t line 7.
> >BEGIN failed--compilation aborted at t/WordDecoder.t line 7.
> >t/WordDecoder....dubious
> >       Test returned status 2 (wstat 512, 0x200)
> >t/Words..........MIME::QuotedPrint version 3.03 required--this is only
> >version 2.03 at /tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
> >BEGIN failed--compilation aborted at
> >/tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
> >Compilation failed in require at t/Words.t line 7.
> >BEGIN failed--compilation aborted at t/Words.t line 7.
> >t/Words..........dubious
> >       Test returned status 2 (wstat 512, 0x200)
> >Failed Test     Stat Wstat Total Fail  Failed  List of Failed
> >-------------------------------------------------------------------------------
> >t/Entity.t       255 65280    ??   ??       %  ??
> >t/Gauntlet.t     255 65280    ??   ??       %  ??
> >t/Head.t         255 65280    ??   ??       %  ??
> >t/Misc.t         255 65280    ??   ??       %  ??
> >t/Parser.t       255 65280    ??   ??       %  ??
> >t/Ref.t          255 65280    ??   ??       %  ??
> >t/WordDecoder.t    2   512    ??   ??       %  ??
> >t/Words.t          2   512    ??   ??       %  ??
> >Failed 8/10 test scripts, 20.00% okay. 0/26 subtests failed, 100.00% okay.
> >make: *** [test_dynamic] Error 11
> >
> >Thanks,
> >Gregg Berkholtz
> >
> >On Mon, Nov 01, 2004 at 11:07:49AM -0500, Julian Field wrote:
> >
> >
> >>Hi all!
> >>
> >>I have just released the latest stable release, version 4.35.9.
> >>
> >>
> >>
> >
> ><SNIP>
> >
> >
> >
>
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>

--
Confidentiality Notice (updated May 8, 2001):  This message is transmitted
across public networks outside the security and control of the sender who
therefore cannot be responsible in any way for delays, loss, damages or
claims resulting from destruction, alteration, theft, misappropriation,
misuse, or discovery of this message, even though it may be confidential
and exempt from disclosure under the law.  If you are neither an intended
reader of this message nor an agent responsible for delivering this message
to an intended reader, you are hereby notified that distribution of any
kind or copying of this communication is strictly prohibited.  If you have
received this message in error, please destroy it immediately.  If you wish
that in the future we did not send you information on public systems,
please notify us immediately.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mike at CAMAROSS.NET  Mon Nov  1 20:27:13 2004
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:27:26 2006
Subject: Time Difference
Message-ID: <mailman.4177.1137101246.24926.mailscanner@lists.mailscanner.info>

What would cause this:

Oct 31 07:52:33 www MailScanner[8666]: SophosSAVI::INFECTED::
W32/Bagle-AU:: ./i9VFqOg14300/price.scr

Oct 31 07:52:34 www MailScanner[8666]: Virus Scanning: SophosSAVI
found 1 infections

Oct 31 07:52:34 www MailScanner[8666]: Infected message i9VFqOg14300
came from 70.113.52.139

Oct 31 07:52:34 www MailScanner[8666]: Virus Scanning: Found 1 viruses

Oct 31 07:52:34 www MailScanner[8666]: Filename Checks: Possible
virus hidden in a screensaver (i9VFqOg14300 price.scr)

Oct 31 07:52:34 www MailScanner[8666]: Other Checks: Found 1 problems

Oct 31 09:52:34 www sendmail[14306]: i9VFqY514306: from=postmaster,
size=1036, class=0, nrcpts=1,
msgid=<200410311552.i9VFqY514306@www.abby.com>, relay=root@localhost

Oct 31 07:52:34 www MailScanner[8666]: Notices: Warned about 1
messages

The time that sendmail stamps in the log is correct.  The time that
MailScanner (or perl) stamps in the log is 2 hours behind.

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Mon Nov  1 20:27:22 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:26 2006
Subject: Off Topic: Eudora connection time outs
Message-ID: <mailman.4178.1137101246.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-2" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Marcin Rożek wrote:

> Tom Combs wrote:
>
>>  I've just upgraded to a new email server and now Eudora clients are
>>  getting 10060 connection time out errors on a regular bases. I see
>>  no sendmail, imap, pop or OS errors and the system isn't even breaking
>>  a sweat with the load staying under 1.0. I've check the Advanced 
>> network
>>  settings in Eudora and the time outs are set to 300 and the buffer size
>>  is set to 4096.
>
> Perhaps you block(drop) connections on port 113 (ident). If that's the
> case then try to reject them instead of drop.

Yes. On your Windows clients, set the Windows firewall to allow in port 
113 queries. The difference is this:
When you block port 113, Windows just drops the packets and the ident 
check done by the server has to timeout.
When you accept port 113 (but run no identd on the Windows boxes), 
Windows rejects the 113 connections immediately, so the server doesn't 
have to wait for a response.

I often have to do this on our Windows clients.

-- 
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Mon Nov  1 20:28:53 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:26 2006
Subject: ANNOUNCE: MailScanner 4.35.9 stable released
Message-ID: <mailman.4179.1137101246.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

You need to get rid of all "QuotedPrint" files as well as "Base64".

Gregg Berkholtz wrote:

>Julian, thanks for the reply, though I'm using Debian, not an RPM
>system.
>
>Though I cannot seem to find any straightforward documentation in regards
>to removing an existing Perl module installed via CPAN and/or
>MailScanner. Even Google is not revealing anything useful - any insight
>in regards to a basic rundown?
>
>For example, for Base64, I've tried searching the filesystem for
>"Base64", and came up with:
> /usr/lib/perl5/auto/MIME/Base64
> /usr/lib/perl5/auto/MIME/Base64/Base64.bs
> /usr/lib/perl5/auto/MIME/Base64/Base64.so
> /usr/lib/perl5/MIME/Base64.pm
> /usr/local/lib/site_perl/i386-linux/auto/MIME/Base64
> /usr/local/lib/site_perl/i386-linux/auto/MIME/Base64/.packlist
> /usr/local/lib/site_perl/i386-linux/auto/MIME/Base64/Base64.bs
> /usr/local/lib/site_perl/i386-linux/auto/MIME/Base64/Base64.so
> /usr/local/lib/site_perl/i386-linux/MIME/Base64.pm
> /usr/local/lib/site_perl/MIME/Decoder/Base64.pm
> /usr/local/share/perl/5.6.1/MIME/Decoder/Base64.pm
> /usr/share/perl5/MIME/Decoder/Base64.pm
>
>Should I remove everything listed? Is that a clean uninstall?
>
>@INC shows:
> /usr/local/lib/perl/5.6.1
> /usr/local/share/perl/5.6.1
> /usr/lib/perl5
> /usr/share/perl5
> /usr/lib/perl/5.6.1
> /usr/share/perl/5.6.1
> /usr/local/lib/site_perl/i386-linux
> /usr/local/lib/site_perl
>
>Gregg
>
>On Mon, Nov 01, 2004 at 01:23:17PM -0500, Julian Field wrote:
>
>
>>You need to install the MIME::Base64 that comes with MailScanner, it is
>>designed to be installed in a location that does not screw up the RPM
>>database. Remove MIME::Base64 and MIME::QuotedPrint and try again.
>>
>>Gregg Berkholtz wrote:
>>
>>
>>
>>>I'm running a Debian Woody system, with Perl 5.6.1, and while running
>>>the install.sh script to upgrade from 4.32.4-1 to 4.35.9-1, I'm
>>>encountering
>>>an error when install.sh tries to compile MIME-tools.
>>>
>>>I've used CPAN to check the version of MIME::QuotedPrint, and MIME::Base64
>>>-
>>>with both reporting that I'm using the latest version, any ideas?
>>>
>>>LOG:
>>>Attempting to build and install
>>>MIME-tools-5.415
>>>Unpacking perl-tar/MIME-tools-5.415.tar.gz
>>>
>>>Do not worry too much about errors from the next command.
>>>It is quite likely that some of the Perl modules are
>>>already installed on your system.
>>>
>>>The important ones are HTML-Parser and MIME-tools.
>>>
>>>Checking if your kit is complete...
>>>Looks good
>>>Warning: prerequisite MIME::Base64 3.03 not found. We have 2.12.
>>>Writing Makefile for MIME-tools
>>>cp lib/MIME/Parser/Filer.pm blib/lib/MIME/Parser/Filer.pm
>>>cp lib/MIME/Field/ContDisp.pm blib/lib/MIME/Field/ContDisp.pm
>>>cp set-version.pl blib/lib/set-version.pl
>>>cp lib/MIME/Parser/Results.pm blib/lib/MIME/Parser/Results.pm
>>>cp lib/MIME/Decoder/Base64.pm blib/lib/MIME/Decoder/Base64.pm
>>>cp lib/MIME/WordDecoder.pm blib/lib/MIME/WordDecoder.pm
>>>cp lib/MIME/Decoder/NBit.pm blib/lib/MIME/Decoder/NBit.pm
>>>cp lib/MIME/Decoder/Binary.pm blib/lib/MIME/Decoder/Binary.pm
>>>cp lib/MIME/Body.pm blib/lib/MIME/Body.pm
>>>cp lib/MIME/Decoder/BinHex.pm blib/lib/MIME/Decoder/BinHex.pm
>>>cp lib/MIME/Parser/Reader.pm blib/lib/MIME/Parser/Reader.pm
>>>cp lib/MIME/Decoder/UU.pm blib/lib/MIME/Decoder/UU.pm
>>>cp lib/MIME/Field/ParamVal.pm blib/lib/MIME/Field/ParamVal.pm
>>>cp lib/MIME/Decoder/Gzip64.pm blib/lib/MIME/Decoder/Gzip64.pm
>>>cp lib/MIME/Decoder/QuotedPrint.pm blib/lib/MIME/Decoder/QuotedPrint.pm
>>>cp lib/MIME/Field/ContType.pm blib/lib/MIME/Field/ContType.pm
>>>cp lib/MIME/Entity.pm blib/lib/MIME/Entity.pm
>>>cp lib/MIME/Head.pm blib/lib/MIME/Head.pm
>>>cp lib/MIME/Parser.pm blib/lib/MIME/Parser.pm
>>>cp lib/MIME/Tools.pm blib/lib/MIME/Tools.pm
>>>cp lib/MIME/Words.pm blib/lib/MIME/Words.pm
>>>cp lib/MIME/Decoder.pm blib/lib/MIME/Decoder.pm
>>>cp lib/MIME/Field/ConTraEnc.pm blib/lib/MIME/Field/ConTraEnc.pm
>>>Manifying blib/man3/MIME::Field::ContDisp.3pm
>>>Manifying blib/man3/MIME::Parser::Filer.3pm
>>>Manifying blib/man3/MIME::Decoder::Base64.3pm
>>>Manifying blib/man3/MIME::WordDecoder.3pm
>>>Manifying blib/man3/MIME::Parser::Results.3pm
>>>Manifying blib/man3/MIME::Decoder::NBit.3pm
>>>Manifying blib/man3/MIME::Decoder::Binary.3pm
>>>Manifying blib/man3/MIME::Body.3pm
>>>Manifying blib/man3/MIME::Decoder::BinHex.3pm
>>>Manifying blib/man3/MIME::Parser::Reader.3pm
>>>Manifying blib/man3/MIME::Decoder::UU.3pm
>>>Manifying blib/man3/MIME::Decoder::Gzip64.3pm
>>>Manifying blib/man3/MIME::Field::ParamVal.3pm
>>>Manifying blib/man3/MIME::Decoder::QuotedPrint.3pm
>>>Manifying blib/man3/MIME::Entity.3pm
>>>Manifying blib/man3/MIME::Parser.3pm
>>>Manifying blib/man3/MIME::Head.3pm
>>>Manifying blib/man3/MIME::Field::ContType.3pm
>>>Manifying blib/man3/MIME::Tools.3pm
>>>Manifying blib/man3/MIME::Words.3pm
>>>Manifying blib/man3/MIME::Decoder.3pm
>>>Manifying blib/man3/MIME::Field::ConTraEnc.3pm
>>>PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e"
>>>"test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
>>>t/Body...........ok
>>>t/Decoder........ok
>>>t/Entity.........MIME::QuotedPrint version 3.03 required--this is only
>>>version 2.03 at /tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
>>>BEGIN failed--compilation aborted at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
>>>Compilation failed in require at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/Head.pm line 123.
>>>BEGIN failed--compilation aborted at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/Head.pm line 123.
>>>Compilation failed in require at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/Entity.pm line 235.
>>>BEGIN failed--compilation aborted at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/Entity.pm line 235.
>>>Compilation failed in require at t/Entity.t line 3.
>>>BEGIN failed--compilation aborted at t/Entity.t line 3.
>>>t/Entity.........dubious
>>>      Test returned status 255 (wstat 65280, 0xff00)
>>>t/Gauntlet.......MIME::QuotedPrint version 3.03 required--this is only
>>>version 2.03 at /tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
>>>BEGIN failed--compilation aborted at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
>>>Compilation failed in require at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/Head.pm line 123.
>>>BEGIN failed--compilation aborted at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/Head.pm line 123.
>>>Compilation failed in require at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/Parser.pm line 147.
>>>BEGIN failed--compilation aborted at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/Parser.pm line 147.
>>>Compilation failed in require at t/Gauntlet.t line 3.
>>>BEGIN failed--compilation aborted at t/Gauntlet.t line 3.
>>>t/Gauntlet.......dubious
>>>      Test returned status 255 (wstat 65280, 0xff00)
>>>t/Head...........MIME::QuotedPrint version 3.03 required--this is only
>>>version 2.03 at /tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
>>>BEGIN failed--compilation aborted at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
>>>Compilation failed in require at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/Head.pm line 123.
>>>BEGIN failed--compilation aborted at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/Head.pm line 123.
>>>Compilation failed in require at t/Head.t line 2.
>>>BEGIN failed--compilation aborted at t/Head.t line 2.
>>>t/Head...........dubious
>>>      Test returned status 255 (wstat 65280, 0xff00)
>>>t/Misc...........MIME::QuotedPrint version 3.03 required--this is only
>>>version 2.03 at /tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
>>>BEGIN failed--compilation aborted at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
>>>Compilation failed in require at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/Head.pm line 123.
>>>BEGIN failed--compilation aborted at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/Head.pm line 123.
>>>Compilation failed in require at t/Misc.t line 2.
>>>BEGIN failed--compilation aborted at t/Misc.t line 2.
>>>t/Misc...........dubious
>>>      Test returned status 255 (wstat 65280, 0xff00)
>>>t/Parser.........MIME::QuotedPrint version 3.03 required--this is only
>>>version 2.03 at /tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
>>>BEGIN failed--compilation aborted at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
>>>Compilation failed in require at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/Head.pm line 123.
>>>BEGIN failed--compilation aborted at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/Head.pm line 123.
>>>Compilation failed in require at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/Parser.pm line 147.
>>>BEGIN failed--compilation aborted at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/Parser.pm line 147.
>>>Compilation failed in require at t/Parser.t line 10.
>>>BEGIN failed--compilation aborted at t/Parser.t line 10.
>>>t/Parser.........dubious
>>>      Test returned status 255 (wstat 65280, 0xff00)
>>>t/Ref............MIME::QuotedPrint version 3.03 required--this is only
>>>version 2.03 at /tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
>>>BEGIN failed--compilation aborted at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
>>>Compilation failed in require at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/WordDecoder.pm line 77.
>>>BEGIN failed--compilation aborted at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/WordDecoder.pm line 77.
>>>Compilation failed in require at t/Ref.t line 8.
>>>BEGIN failed--compilation aborted at t/Ref.t line 8.
>>>t/Ref............dubious
>>>      Test returned status 255 (wstat 65280, 0xff00)
>>>t/WordDecoder....MIME::QuotedPrint version 3.03 required--this is only
>>>version 2.03 at /tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
>>>BEGIN failed--compilation aborted at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
>>>Compilation failed in require at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/WordDecoder.pm line 77.
>>>BEGIN failed--compilation aborted at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/WordDecoder.pm line 77.
>>>Compilation failed in require at t/WordDecoder.t line 7.
>>>BEGIN failed--compilation aborted at t/WordDecoder.t line 7.
>>>t/WordDecoder....dubious
>>>      Test returned status 2 (wstat 512, 0x200)
>>>t/Words..........MIME::QuotedPrint version 3.03 required--this is only
>>>version 2.03 at /tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
>>>BEGIN failed--compilation aborted at
>>>/tmp/MIME-tools-5.415/blib/lib/MIME/Words.pm line 86.
>>>Compilation failed in require at t/Words.t line 7.
>>>BEGIN failed--compilation aborted at t/Words.t line 7.
>>>t/Words..........dubious
>>>      Test returned status 2 (wstat 512, 0x200)
>>>Failed Test     Stat Wstat Total Fail  Failed  List of Failed
>>>-------------------------------------------------------------------------------
>>>t/Entity.t       255 65280    ??   ??       %  ??
>>>t/Gauntlet.t     255 65280    ??   ??       %  ??
>>>t/Head.t         255 65280    ??   ??       %  ??
>>>t/Misc.t         255 65280    ??   ??       %  ??
>>>t/Parser.t       255 65280    ??   ??       %  ??
>>>t/Ref.t          255 65280    ??   ??       %  ??
>>>t/WordDecoder.t    2   512    ??   ??       %  ??
>>>t/Words.t          2   512    ??   ??       %  ??
>>>Failed 8/10 test scripts, 20.00% okay. 0/26 subtests failed, 100.00% okay.
>>>make: *** [test_dynamic] Error 11
>>>
>>>Thanks,
>>>Gregg Berkholtz
>>>
>>>On Mon, Nov 01, 2004 at 11:07:49AM -0500, Julian Field wrote:
>>>
>>>
>>>
>>>
>>>>Hi all!
>>>>
>>>>I have just released the latest stable release, version 4.35.9.
>>>>
>>>>
>>>>
>>>>
>>>>
>>><SNIP>
>>>
>>>
>>>
>>>
>>>
>>--
>>Julian Field
>>www.MailScanner.info
>>Professional Support Services at www.MailScanner.biz
>>MailScanner thanks transtec Computers for their support
>>Buy the MailScanner book at www.MailScanner.info/store
>>
>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>
>>
>>
>>
>
>--
>Confidentiality Notice (updated May 8, 2001):  This message is transmitted
>across public networks outside the security and control of the sender who
>therefore cannot be responsible in any way for delays, loss, damages or
>claims resulting from destruction, alteration, theft, misappropriation,
>misuse, or discovery of this message, even though it may be confidential
>and exempt from disclosure under the law.  If you are neither an intended
>reader of this message nor an agent responsible for delivering this message
>to an intended reader, you are hereby notified that distribution of any
>kind or copying of this communication is strictly prohibited.  If you have
>received this message in error, please destroy it immediately.  If you wish
>that in the future we did not send you information on public systems,
>please notify us immediately.
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
>

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Steve.Swaney at FSL.COM  Mon Nov  1 20:33:53 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:26 2006
Subject: FW: RPM package conflict error
Message-ID: <mailman.4180.1137101246.24926.mailscanner@lists.mailscanner.info>

Please note the important addition at the bottom.

> -----Original Message-----
> From: Steve Swaney [mailto:Steve.Swaney@fsl.com]
> Sent: Monday, November 01, 2004 1:05 PM
> To: 'MAILSCANNER@JISCMAIL.AC.UK'
> Subject: RPM package conflict error
>
> If you still receive this error:
>
> RPM package conflict error.  The message was:
> Test install failed because of package conflicts:
> package perl-5.8.0-88.7 is already installed
>
> When running `up2date -u` or `yum update` after installing MailScanner
> 4.35.9-1, you should be able to repair the rpm database by running the
> following commands:
>
>       rpm -e --nodeps perl
>
> Yes I do mean this :) Then run:
>
>       up2date -u
>
> or
>
>       yum update
>
> Big disclaimer - This worked for me, your mileage may vary!

I should have added:

Thoroughly test MailScanner processing and email delivery. If you see any
"cannot decode" error messages. Simply stop MailScanner, then run the
MailScanner 4.35.9-1 install script again.

Start MailScanner and again thoroughly test MailScanner Processing and email
delivery.

All should now be well.

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mkettler at EVI-INC.COM  Mon Nov  1 20:36:55 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:26 2006
Subject: Time Difference
Message-ID: <mailman.4181.1137101246.24926.mailscanner@lists.mailscanner.info>

Hmm, that's quite strange.. However, consider this fact:

Neither MailScanner nor sendmail creates those timestamps.... they are
created by syslogd.

 From the looks of it, your local system clock hiccuped by 2 hours and went
back again, but MailScanner and sendmail have nothing to do with this. They
can't.

Do you have a NTP client running on that box that may have gone awry?




At 03:27 PM 11/1/2004, Mike Kercher wrote:
>Oct 31 07:52:33 www MailScanner[8666]: SophosSAVI::INFECTED::
>W32/Bagle-AU:: ./i9VFqOg14300/price.scr
>
>Oct 31 07:52:34 www MailScanner[8666]: Virus Scanning: SophosSAVI
>found 1 infections
>
>Oct 31 07:52:34 www MailScanner[8666]: Infected message i9VFqOg14300
>came from 70.113.52.139
>
>Oct 31 07:52:34 www MailScanner[8666]: Virus Scanning: Found 1 viruses
>
>Oct 31 07:52:34 www MailScanner[8666]: Filename Checks: Possible
>virus hidden in a screensaver (i9VFqOg14300 price.scr)
>
>Oct 31 07:52:34 www MailScanner[8666]: Other Checks: Found 1 problems
>
>Oct 31 09:52:34 www sendmail[14306]: i9VFqY514306: from=postmaster,
>size=1036, class=0, nrcpts=1,
>msgid=<200410311552.i9VFqY514306@www.abby.com>, relay=root@localhost
>
>Oct 31 07:52:34 www MailScanner[8666]: Notices: Warned about 1
>messages
>
>The time that sendmail stamps in the log is correct.  The ti

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ELKNET.NET  Mon Nov  1 19:56:26 2004
From: mailscanner at ELKNET.NET (Alan)
Date: Thu Jan 12 21:27:26 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.4182.1137101246.24926.mailscanner@lists.mailscanner.info>

Julian & Matt,

I never did have a chance to try manually adding in Julian's patch to move
the 'Envelope From' header to the top of the headers. But today I saw that
Julian had added that patch to the stable release, so I went ahead and
installed it and tested this rule.

And, for the first time since SA3 was released, I'm again getting hits on
the 'NO_DNS_FOR_FROM' rule!

So, bottom line to get this rule working is MS 4.35.9 or newer must be
installed, and you MUST set 'Envelope From Header = X-Envelope-From:' in
MailScanner.conf.

SA3 will ONLY recognize the from header 'X-Envelope-From:' and it will ONLY
accept it at the top of the headers.

Perhaps there should be an FAQ entry explaining this, or better yet a
comment in the MailScanner.conf dialog immediatly above the ''Envelope From
Header =' setting.

Anyway, thanks to both of you for helping me get this rule working again!

-Alan



On Sat, 16 Oct 2004 12:23:48 +0100, Julian Field
<mailscanner@ECS.SOTON.AC.UK> wrote:

>In which case you are going to have to apply the patches by hand. Open up
>each patch file and try to find the bit of code that matches in your
>particular versions of these files. Patch files are easy to understand.
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From martelm at QUARK.VSC.EDU  Mon Nov  1 20:43:59 2004
From: martelm at QUARK.VSC.EDU (Michael H. Martel)
Date: Thu Jan 12 21:27:26 2006
Subject: Found a script in HTML message
Message-ID: <mailman.4183.1137101246.24926.mailscanner@lists.mailscanner.info>

Hello!

I've had decent luck getting MailScanner to behave the way I want it to,
but now I've got one odd problem.

MailScanner finds messages like this and tells me that they're blocked.


At Mon Nov  1 14:18:07 2004 the content filters said:
   MailScanner: Found a script in HTML message


With IFrames I was able to change a setting to disarm them. Is there a
setting to disarm scripts and not have the email get blocked ?

I must be missing something simple.

Thanks!


Michael

--

  --------------------------------o---------------------------------
   Michael H. Martel              | Systems Administrator
   martelm@quark.vsc.edu          | Vermont State Colleges
   http://probe.vsc.edu/~michael  | PH:802-241-2544 FX:802-241-3363

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Mon Nov  1 20:46:56 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:26 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.4184.1137101246.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Ah, in which case I misunderstood one of the previous postings on this.
I thought that as long as the header name was "reasonable", SA would
find it if it was at the top of the headers. I didn't realise it had to
have exactly the right name as well.

Can someone else confirm that I now have this right please?
If so, I will change the default in the supplied conf file, and add a
comment about this requirement.

Alan wrote:

>Julian & Matt,
>
>I never did have a chance to try manually adding in Julian's patch to move
>the 'Envelope From' header to the top of the headers. But today I saw that
>Julian had added that patch to the stable release, so I went ahead and
>installed it and tested this rule.
>
>And, for the first time since SA3 was released, I'm again getting hits on
>the 'NO_DNS_FOR_FROM' rule!
>
>So, bottom line to get this rule working is MS 4.35.9 or newer must be
>installed, and you MUST set 'Envelope From Header = X-Envelope-From:' in
>MailScanner.conf.
>
>SA3 will ONLY recognize the from header 'X-Envelope-From:' and it will ONLY
>accept it at the top of the headers.
>
>Perhaps there should be an FAQ entry explaining this, or better yet a
>comment in the MailScanner.conf dialog immediatly above the ''Envelope From
>Header =' setting.
>
>Anyway, thanks to both of you for helping me get this rule working again!
>
>-Alan
>
>
>
>On Sat, 16 Oct 2004 12:23:48 +0100, Julian Field
><mailscanner@ECS.SOTON.AC.UK> wrote:
>
>
>
>>In which case you are going to have to apply the patches by hand. Open up
>>each patch file and try to find the bit of code that matches in your
>>particular versions of these files. Patch files are easy to understand.
>>
>>
>>
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
>

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From peter at UCGBOOK.COM  Mon Nov  1 20:47:35 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:26 2006
Subject: Found a script in HTML message
Message-ID: <mailman.4185.1137101246.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Michael H. Martel wrote:
> Hello!
>
> I've had decent luck getting MailScanner to behave the way I want it to,
> but now I've got one odd problem.
>
> MailScanner finds messages like this and tells me that they're blocked.
>
>
> At Mon Nov  1 14:18:07 2004 the content filters said:
>   MailScanner: Found a script in HTML message
>
>
> With IFrames I was able to change a setting to disarm them. Is there a
> setting to disarm scripts and not have the email get blocked ?
>
> I must be missing something simple.

Yes, the comments in the config file are very helpful if you read them. :-)

# Do you want to allow <Script> tags in email messages? This is a bad idea
# as these are used to exploit vulnerabilities in email applications and
# web browsers.
# Value: yes     => Allow these tags to be in the message
#        no      => Ban messages containing these tags
#        disarm  => Allow these tags, but stop these tags from working
#                   Note: Disarming can be defeated, it is not 100% safe!
# This can also be the filename of a ruleset.
Allow Script Tags = disarm


--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Mon Nov  1 20:48:17 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:26 2006
Subject: Found a script in HTML message
Message-ID: <mailman.4186.1137101246.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Allow Script Tags = disarm

This is now the default setting in new installations.

Michael H. Martel wrote:

> Hello!
>
> I've had decent luck getting MailScanner to behave the way I want it to,
> but now I've got one odd problem.
>
> MailScanner finds messages like this and tells me that they're blocked.
>
>
> At Mon Nov  1 14:18:07 2004 the content filters said:
>   MailScanner: Found a script in HTML message
>
>
> With IFrames I was able to change a setting to disarm them. Is there a
> setting to disarm scripts and not have the email get blocked ?
>
> I must be missing something simple.

--

Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From michele at BLACKNIGHTSOLUTIONS.COM  Mon Nov  1 20:48:49 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon : Blacknight Solutions)
Date: Thu Jan 12 21:27:26 2006
Subject: Found a script in HTML message
Message-ID: <mailman.4187.1137101246.24926.mailscanner@lists.mailscanner.info>

On Mon, 2004-11-01 at 15:43 -0500, Michael H. Martel wrote:
> Hello!
>
> I've had decent luck getting MailScanner to behave the way I want it to,
> but now I've got one odd problem.
>
> MailScanner finds messages like this and tells me that they're blocked.
>
>
> At Mon Nov  1 14:18:07 2004 the content filters said:
>    MailScanner: Found a script in HTML message
>
>
> With IFrames I was able to change a setting to disarm them. Is there a
> setting to disarm scripts and not have the email get blocked ?

Yes
>
> I must be missing something simple.
Have a look through MailScanner.conf the option is there :)

--
Mr Michele Neylon
Blacknight Solutions
http://www.blacknight.ie
059 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mike at CAMAROSS.NET  Mon Nov  1 21:11:23 2004
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:27:26 2006
Subject: Time Difference
Message-ID: <mailman.4188.1137101246.24926.mailscanner@lists.mailscanner.info>

Matt Kettler wrote:
> Hmm, that's quite strange.. However, consider this fact:
>
> Neither MailScanner nor sendmail creates those timestamps.... they
> are created by syslogd.
>
>  From the looks of it, your local system clock hiccuped by 2 hours
> and went back again, but MailScanner and sendmail have nothing to do
> with this. They can't.
>
> Do you have a NTP client running on that box that may have gone awry?
>
>
>
>
> At 03:27 PM 11/1/2004, Mike Kercher wrote:
>> Oct 31 07:52:33 www MailScanner[8666]: SophosSAVI::INFECTED::
>> W32/Bagle-AU:: ./i9VFqOg14300/price.scr
>>
>> Oct 31 07:52:34 www MailScanner[8666]: Virus Scanning: SophosSAVI
>> found 1 infections
>>
>> Oct 31 07:52:34 www MailScanner[8666]: Infected message i9VFqOg14300
>> came from 70.113.52.139
>>
>> Oct 31 07:52:34 www MailScanner[8666]: Virus Scanning: Found 1
>> viruses
>>
>> Oct 31 07:52:34 www MailScanner[8666]: Filename Checks: Possible
>> virus hidden in a screensaver (i9VFqOg14300 price.scr)
>>
>> Oct 31 07:52:34 www MailScanner[8666]: Other Checks: Found 1 problems
>>
>> Oct 31 09:52:34 www sendmail[14306]: i9VFqY514306: from=postmaster,
>> size=1036, class=0, nrcpts=1,
>> msgid=<200410311552.i9VFqY514306@www.abby.com>, relay=root@localhost
>>
>> Oct 31 07:52:34 www MailScanner[8666]: Notices: Warned about 1
>> messages
>>
>> The time that sendmail stamps in the log is correct.  The ti
>

This happens consistently...day after day.  It's not a one time deal.  The
clock syncs regularly with time.nist.gov and the hwclock is sync'd to the
system time.  The system time is also correct.  It's only the log entries by
MailScanner that are 2 hours behind.  Is there a timezone that perl
recognizes independent of the system time?

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From jaearick at COLBY.EDU  Mon Nov  1 21:28:53 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:26 2006
Subject: 4.35.9: file command disabled?
Message-ID: <mailman.4189.1137101246.24926.mailscanner@lists.mailscanner.info>

Julian,

MailScanner.conf now has:

File Command = #DISABLED /usr/bin/file

Does this mean "don't use this setting anymore?".  Previously
(4.34.8) I had this defined as:

File Command = /usr/bin/file

What's the story here?

Jeff Earickson
Colby College

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From phil at ICSERV.NET  Mon Nov  1 21:31:06 2004
From: phil at ICSERV.NET (Philip Larkin Waters)
Date: Thu Jan 12 21:27:26 2006
Subject: Time Difference
Message-ID: <mailman.4190.1137101246.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Is there a time zone setting somewhere that makes syslog report the time
as 9 instead of  7

Is your clock set to UTC time?
What time zone are you in?

____
Theory is when you know something, but it doesn't work.
Practice is when something works, but you don't know why.
Programmers combine theory and practice:
Nothing works and they don't know why.
--Unknown
----- Original Message -----
From: "Mike Kercher" <mike@CAMAROSS.NET>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Monday, November 01, 2004 1:27 PM
Subject: Time Difference


> What would cause this:
>
> Oct 31 07:52:33 www MailScanner[8666]: SophosSAVI::INFECTED::
> W32/Bagle-AU:: ./i9VFqOg14300/price.scr
>
> Oct 31 07:52:34 www MailScanner[8666]: Virus Scanning: SophosSAVI
> found 1 infections
>
> Oct 31 07:52:34 www MailScanner[8666]: Infected message i9VFqOg14300
> came from 70.113.52.139
>
> Oct 31 07:52:34 www MailScanner[8666]: Virus Scanning: Found 1 viruses
>
> Oct 31 07:52:34 www MailScanner[8666]: Filename Checks: Possible
> virus hidden in a screensaver (i9VFqOg14300 price.scr)
>
> Oct 31 07:52:34 www MailScanner[8666]: Other Checks: Found 1 problems
>
> Oct 31 09:52:34 www sendmail[14306]: i9VFqY514306: from=postmaster,
> size=1036, class=0, nrcpts=1,
> msgid=<200410311552.i9VFqY514306@www.abby.com>, relay=root@localhost
>
> Oct 31 07:52:34 www MailScanner[8666]: Notices: Warned about 1
> messages
>
> The time that sendmail stamps in the log is correct.  The time that
> MailScanner (or perl) stamps in the log is 2 hours behind.
>
> Mike
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Mon Nov  1 22:13:17 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:26 2006
Subject: 4.35.9: file command disabled?
Message-ID: <mailman.4191.1137101246.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I need to change the default. I don't want it switched on by default, as
it has to know where to find your "file" command and what sort of output
it produces.
Just reset it to /usr/bin/file again and you'll be fine.

I'm not sure what to set the default to, it's a bit awkward. I guess I
could enable it by default, and just not squeal too loudly if the file
can't be found.
What do you think?

Jeff A. Earickson wrote:

> Julian,
>
> MailScanner.conf now has:
>
> File Command = #DISABLED /usr/bin/file
>
> Does this mean "don't use this setting anymore?".  Previously
> (4.34.8) I had this defined as:
>
> File Command = /usr/bin/file
>
> What's the story here?


--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From peter at UCGBOOK.COM  Mon Nov  1 22:49:25 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:26 2006
Subject: 4.35.9: file command disabled?
Message-ID: <mailman.4192.1137101246.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian Field wrote:
> I need to change the default. I don't want it switched on by default, as
> it has to know where to find your "file" command and what sort of output
> it produces.
> Just reset it to /usr/bin/file again and you'll be fine.
>
> I'm not sure what to set the default to, it's a bit awkward. I guess I
> could enable it by default, and just not squeal too loudly if the file
> can't be found.
> What do you think?

It's fine as it is as long as something like the above is in the
comment. I have not yet downloaded so I don't know what it says.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mike at CAMAROSS.NET  Mon Nov  1 23:40:35 2004
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:27:26 2006
Subject: Time Difference
Message-ID: <mailman.4193.1137101246.24926.mailscanner@lists.mailscanner.info>

Philip Larkin Waters wrote:
> Is there a time zone setting somewhere that makes syslog report the
> time as 9 instead of  7
>
> Is your clock set to UTC time?
> What time zone are you in?
>
> ____
> Theory is when you know something, but it doesn't work.
> Practice is when something works, but you don't know why.
> Programmers combine theory and practice:
> Nothing works and they don't know why.
> --Unknown
> ----- Original Message -----
> From: "Mike Kercher" <mike@CAMAROSS.NET>
> To: <MAILSCANNER@JISCMAIL.AC.UK>
> Sent: Monday, November 01, 2004 1:27 PM
> Subject: Time Difference
>
>
>> What would cause this:
>>
>> Oct 31 07:52:33 www MailScanner[8666]: SophosSAVI::INFECTED::
>> W32/Bagle-AU:: ./i9VFqOg14300/price.scr
>>
>> Oct 31 07:52:34 www MailScanner[8666]: Virus Scanning: SophosSAVI
>> found 1 infections
>>
>> Oct 31 07:52:34 www MailScanner[8666]: Infected message i9VFqOg14300
>> came from 70.113.52.139
>>
>> Oct 31 07:52:34 www MailScanner[8666]: Virus Scanning: Found 1
>> viruses
>>
>> Oct 31 07:52:34 www MailScanner[8666]: Filename Checks: Possible
>> virus hidden in a screensaver (i9VFqOg14300 price.scr)
>>
>> Oct 31 07:52:34 www MailScanner[8666]: Other Checks: Found 1 problems
>>
>> Oct 31 09:52:34 www sendmail[14306]: i9VFqY514306: from=postmaster,
>> size=1036, class=0, nrcpts=1,
>> msgid=<200410311552.i9VFqY514306@www.abby.com>, relay=root@localhost
>>
>> Oct 31 07:52:34 www MailScanner[8666]: Notices: Warned about 1
>> messages
>>
>> The time that sendmail stamps in the log is correct.  The time that
>> MailScanner (or perl) stamps in the log is 2 hours behind.
>>
>> Mike
>>


I may have solved it myself.  This is on a customer's older RAQ machine and
I had forgotten about the syslog -r option that used to be required.  Since
setting that, it seems to be logging the date and time correctly.  Thanks
for nudging me in the right direction!

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ELKNET.NET  Mon Nov  1 23:55:08 2004
From: mailscanner at ELKNET.NET (Alan)
Date: Thu Jan 12 21:27:26 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.4194.1137101246.24926.mailscanner@lists.mailscanner.info>

There is actually a means to fix NO_DNS_FOR_FROM without changing the header
to 'X-Envelope-From' (it still needs to be at the top though). If you want
to use something other than 'X-Envelope-From', you have to define what you
will be using in 'spam.assassin.prefs.conf' using the
'envelope_sender_header' option.

So, if we want to use something other than the default 'X-Envelope-From'
header that SA is looking for, we just have to let SA know about it. For me,
its just easier to use what SA is already looking for.

This is from the SpamAssassin Bugzilla database regarding this issue:

"The discussion there indicates that MailScanner inserts a header named
X-MailScanner-From instead of X-Envelope-From. It also inserts it at the
bottom of the headers, where SpamAssassin can't trust it."

-Alan

On Mon, 1 Nov 2004 15:46:56 -0500, Julian Field
<mailscanner@ECS.SOTON.AC.UK> wrote:

>Ah, in which case I misunderstood one of the previous postings on this.
>I thought that as long as the header name was "reasonable", SA would
>find it if it was at the top of the headers. I didn't realise it had to
>have exactly the right name as well.
>
>Can someone else confirm that I now have this right please?
>If so, I will change the default in the supplied conf file, and add a
>comment about this requirement.
>
>Alan wrote:
>
>>Julian & Matt,
>>
>>I never did have a chance to try manually adding in Julian's patch to move
>>the 'Envelope From' header to the top of the headers. But today I saw that
>>Julian had added that patch to the stable release, so I went ahead and
>>installed it and tested this rule.
>>
>>And, for the first time since SA3 was released, I'm again getting hits on
>>the 'NO_DNS_FOR_FROM' rule!
>>
>>So, bottom line to get this rule working is MS 4.35.9 or newer must be
>>installed, and you MUST set 'Envelope From Header = X-Envelope-From:' in
>>MailScanner.conf.
>>
>>SA3 will ONLY recognize the from header 'X-Envelope-From:' and it will ONLY
>>accept it at the top of the headers.
>>
>>Perhaps there should be an FAQ entry explaining this, or better yet a
>>comment in the MailScanner.conf dialog immediatly above the ''Envelope From
>>Header =' setting.
>>
>>Anyway, thanks to both of you for helping me get this rule working again!
>>
>>-Alan
>>
>>
>>
>>On Sat, 16 Oct 2004 12:23:48 +0100, Julian Field
>><mailscanner@ECS.SOTON.AC.UK> wrote:
>>
>>
>>
>>>In which case you are going to have to apply the patches by hand. Open up
>>>each patch file and try to find the bit of code that matches in your
>>>particular versions of these files. Patch files are easy to understand.
>>>
>>>
>>>
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>
>>
>
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz
>MailScanner thanks transtec Computers for their support
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Mathias.Koerber at LIGHTSPEED.COM.SG  Tue Nov  2 01:14:11 2004
From: Mathias.Koerber at LIGHTSPEED.COM.SG (Mathias Koerber)
Date: Thu Jan 12 21:27:26 2006
Subject: quarantine whole / resend and cyrus duplicate check
Message-ID: <mailman.4195.1137101246.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-15" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I set my MailScanner to 'quarantine whole messages as queue files'

now, when I want to re-send a quarantined message because it is found
to be harmless/wanted after all, all I need to do is to copy the qf* and
df*  files to /var/spool/mqueue.

But... cyrus lmtpd has a duplicate check mechanism. The original message
which had the attachment removed will already have been recorded, and
the re-inserted one will be dropped due to the same message-id.

Does anyone have a recipe for cleanly handling this?

a) edit the message-id in the queue file?
b) use a script to re-send the message (possibly as its own attachment)
[ mets-send, otehrs ]
c) other ideas?

thanks and regards
-- 
Mathias Körber
mathias@lightspeed.com.sg

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Tue Nov  2 01:25:23 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:26 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.4196.1137101246.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Would people therefore like me to:
a) Change X-MailScanner-From to X-Envelope-From in MailScanner.conf
or
b) Tell SpamAssassin what to expect in spam.assassin.prefs.conf
or
c) Neither
?

Alan wrote:

>There is actually a means to fix NO_DNS_FOR_FROM without changing the header
>to 'X-Envelope-From' (it still needs to be at the top though). If you want
>to use something other than 'X-Envelope-From', you have to define what you
>will be using in 'spam.assassin.prefs.conf' using the
>'envelope_sender_header' option.
>
>So, if we want to use something other than the default 'X-Envelope-From'
>header that SA is looking for, we just have to let SA know about it. For me,
>its just easier to use what SA is already looking for.
>
>This is from the SpamAssassin Bugzilla database regarding this issue:
>
>"The discussion there indicates that MailScanner inserts a header named
>X-MailScanner-From instead of X-Envelope-From. It also inserts it at the
>bottom of the headers, where SpamAssassin can't trust it."
>
>-Alan
>
>On Mon, 1 Nov 2004 15:46:56 -0500, Julian Field
><mailscanner@ECS.SOTON.AC.UK> wrote:
>
>
>
>>Ah, in which case I misunderstood one of the previous postings on this.
>>I thought that as long as the header name was "reasonable", SA would
>>find it if it was at the top of the headers. I didn't realise it had to
>>have exactly the right name as well.
>>
>>Can someone else confirm that I now have this right please?
>>If so, I will change the default in the supplied conf file, and add a
>>comment about this requirement.
>>
>>Alan wrote:
>>
>>
>>
>>>Julian & Matt,
>>>
>>>I never did have a chance to try manually adding in Julian's patch to move
>>>the 'Envelope From' header to the top of the headers. But today I saw that
>>>Julian had added that patch to the stable release, so I went ahead and
>>>installed it and tested this rule.
>>>
>>>And, for the first time since SA3 was released, I'm again getting hits on
>>>the 'NO_DNS_FOR_FROM' rule!
>>>
>>>So, bottom line to get this rule working is MS 4.35.9 or newer must be
>>>installed, and you MUST set 'Envelope From Header = X-Envelope-From:' in
>>>MailScanner.conf.
>>>
>>>SA3 will ONLY recognize the from header 'X-Envelope-From:' and it will ONLY
>>>accept it at the top of the headers.
>>>
>>>Perhaps there should be an FAQ entry explaining this, or better yet a
>>>comment in the MailScanner.conf dialog immediatly above the ''Envelope From
>>>Header =' setting.
>>>
>>>Anyway, thanks to both of you for helping me get this rule working again!
>>>
>>>-Alan
>>>
>>>
>>>
>>>On Sat, 16 Oct 2004 12:23:48 +0100, Julian Field
>>><mailscanner@ECS.SOTON.AC.UK> wrote:
>>>
>>>
>>>
>>>
>>>
>>>>In which case you are going to have to apply the patches by hand. Open up
>>>>each patch file and try to find the bit of code that matches in your
>>>>particular versions of these files. Patch files are easy to understand.
>>>>
>>>>
>>>>
>>>>
>>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>
>>>
>>>
>>>
>>--
>>Julian Field
>>www.MailScanner.info
>>Professional Support Services at www.MailScanner.biz
>>MailScanner thanks transtec Computers for their support
>>Buy the MailScanner book at www.MailScanner.info/store
>>
>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
>

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mkettler at EVI-INC.COM  Tue Nov  2 01:36:52 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:26 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.4197.1137101246.24926.mailscanner@lists.mailscanner.info>

At 08:25 PM 11/1/2004, Julian Field wrote:
>Would people therefore like me to:
>a) Change X-MailScanner-From to X-Envelope-From in MailScanner.conf
>or
>b) Tell SpamAssassin what to expect in spam.assassin.prefs.conf
>or
>c) Neither
>?

I personally like b).

It seems the simplest, safest, and most straightforward method. It also
ensures that MS won't clobber any X-Envelope-From's added by the MTA.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Mathias.Koerber at LIGHTSPEED.COM.SG  Tue Nov  2 02:13:44 2004
From: Mathias.Koerber at LIGHTSPEED.COM.SG (Mathias [ISO-8859-1] Körber)
Date: Thu Jan 12 21:27:26 2006
Subject: not considering authenticated submission as SPAM
Message-ID: <mailman.4198.1137101246.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-15" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi MailScanner list.

How do I make mailscanner NOT consider email SPAM which was received
with SMTP AUTH?

In the following case, a user sent email from their home (dynamic IP)
via the office server authenticating themselves. The dynamic home IP
is listed in SBL+XBL (actually CBL). But as the user has authenticated,
I would like to ignore that...

Is this doable?
How would I configure this?
How would I distinguish between cases like this and cases where a
remote host relays to me using SMTP-AUTH but is not the originating
site? I would guess it has to check that
        1. this is the first hop and it has been authenticated?

any help is appreciated
regards
Mathias

[...]
Received: from scv (cm103.sigma2.maxonline.com.sg [218.212.2.103])
        (authenticated bits=0)
        by ... (8.12.10/8.12.4) with ESMTP id iA1GM5n2013651;
        Tue, 2 Nov 2004 00:22:05 +0800
[...]
X-SRT-MailScanner: Found to be clean
X-SRT-MailScanner-SpamCheck: spam, SBL+XBL, SpamAssassin (score=0,
        required 6, autolearn=not spam)
-- 
Mathias Körber
mathias@lightspeed.com.sg

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Tue Nov  2 03:25:08 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:26 2006
Subject: not considering authenticated submission as SPAM
Message-ID: <mailman.4199.1137101246.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-15" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I think there is a SpamAssassin rule that checks for SMTP auth 
information in Received headers.
But I'm not 100% sure. I think you can force it to do it with the 
"trusted networks" settings. Take a look at "man 
Mail::SpamAssassin::Conf" for more information on trusted networks.

MailScanner doesn't currently do it on its own.

Mathias Körber wrote:

>Hi MailScanner list.
>
>How do I make mailscanner NOT consider email SPAM which was received
>with SMTP AUTH?
>
>In the following case, a user sent email from their home (dynamic IP)
>via the office server authenticating themselves. The dynamic home IP
>is listed in SBL+XBL (actually CBL). But as the user has authenticated,
>I would like to ignore that...
>
>Is this doable?
>How would I configure this?
>How would I distinguish between cases like this and cases where a
>remote host relays to me using SMTP-AUTH but is not the originating
>site? I would guess it has to check that
>        1. this is the first hop and it has been authenticated?
>
>any help is appreciated
>regards
>Mathias
>
>[...]
>Received: from scv (cm103.sigma2.maxonline.com.sg [218.212.2.103])
>        (authenticated bits=0)
>        by ... (8.12.10/8.12.4) with ESMTP id iA1GM5n2013651;
>        Tue, 2 Nov 2004 00:22:05 +0800
>[...]
>X-SRT-MailScanner: Found to be clean
>X-SRT-MailScanner-SpamCheck: spam, SBL+XBL, SpamAssassin (score=0,
>        required 6, autolearn=not spam)
>  
>

-- 
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From BBerglund at TECHPRO.COM  Tue Nov  2 04:40:54 2004
From: BBerglund at TECHPRO.COM (Brian Berglund)
Date: Thu Jan 12 21:27:26 2006
Subject: MySQL logging
Message-ID: <mailman.4200.1137101246.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I am trying to get Mysql logging working with version 4.34.8
 
Which of these do I need to follow?
Getting SQL mail logging up and running: step by step, quick and
dirtyhere

 (NOTE: This document is README.sql-logging in the MailScanner distribution.)

This document assumes that you have MailScanner 4.12+ installed and configured to taste.

1) Install MySQL and start the daemon running. Instructions are available at
http://www.mysql.com/doc/

2) Create a database called 'mailscanner'.

# mysqladmin create mailscanner

3) Create a table called maillog. The easiest way is to copy the following text to a file and
'source' it. That is, open the MySQL client (as root)

# mysql

and type 'use mailscanner', then 'source <filename>'.

-- BEGIN SQL ***

CREATE TABLE maillog (
  timestamp timestamp(14) NOT NULL,
  id text,
  size bigint(20) default NULL,
  from_address text,
  to_address text,
  subject text,
  clientip text,
  archives text,
  isspam tinyint(1) default NULL,
  ishighspam tinyint(1) default NULL,
  sascore decimal(7,2) default NULL,
  spamreport text,
  filename text,
  filereport text
) TYPE=MyISAM;

-- END SQL

4) (optional) Create a dedicated user for this logging function. The default code in
MailScanner uses the 'root' MySQL user, with no password. While easy, it's very insecure.
In the MySQL client:

> GRANT ALL ON mailscanner TO mailscanner@localhost IDENTIFIED BY '<password>';

This command creates the 'mailscanner' user and grants it privileges to the 'mailscanner' 
database from 'localhost' only. To allow remote logins (say, if MySQL is located on a 
different machine), replace 'localhost' with an IP address. (NB: '%' is the wildcard 
character, so you can use it, e.g. 'mailscanner@10.12.%' to allow connections from 
specified networks.)

5) Test that you can log in to the database with that username and password.

$ mysql -u mailscanner -p<password> (NOTE: No space between -p and <password>)
> use mailscanner
> show tables;

If this is successful, then you should be good to go. If MySQL is on a separate machine,
use -h <host> in the above command. Test it from the MailScanner machine to make sure that
you did the 'grant' command correctly.

6) If you haven't gotten it already, install the Perl 'DBI' and 'DBD-Mysql' packages. I
had trouble when I got them through CPAN and had better luck with RPMs; YMMV. 

At this point, you should be ready to enable SQL logging in MailScanner.

7) Uncomment the 'use DBI;' line in the SQL logging section of CustomConfig.pm

8) In MailScanner.conf, change the value of 'Always Looked At Last' from 'No' to 
'&SQLLogging'

9) Restart MailScanner. Check your mail log for 'Starting SQL Logging' message. If
you don't see any errors, you should be all set. Send some test messages and restart
MailScanner to force it to write the logs to the database. Check the mail log again
to see if it kicked up DB errors.

10) Open up mysql and check the database to see if it logged your messages.

# mysql
> use mailscanner
> SELECT to_address, from_address, subject FROM maillog;

If it returns a table with that information, you should be all set!

------------------
Send corrections, additions to andrew.magnusson@cocc.com

 Is there a way to change this, so the body of the email is logged as well?

 For version 4.25-14, Custom Config appears to have changed
since the above instructions.  It uses three tables and some
other clarifications are needed.

1)The SQL should probably look more like (from Andy Magnusson):

-- MySQL dump 8.22
--
-- Host: localhost    Database: mailscanner
---------------------------------------------------------
-- Server version       3.23.56

--
-- Table structure for table 'maillog_mail'
--

CREATE TABLE maillog_mail (
  id int(10) unsigned NOT NULL auto_increment,
  time timestamp(14) NOT NULL,
  msg_id varchar(15) binary default NULL,
  size bigint(20) default NULL,
  from_user varchar(35) default NULL,
  from_domain varchar(35) default NULL,
  subject text,
  clientip text,
  archives text,
  isspam int(1) default NULL,
  ishighspam int(1) default NULL,
  sascore decimal(7,2) default NULL,
  spamreport text,
  PRIMARY KEY  (id),
  KEY msg_id (msg_id),
  KEY from_domain (from_domain,from_user)
) TYPE=MyISAM;

--
-- Table structure for table 'maillog_recipient'
--

CREATE TABLE maillog_recipient (
  id bigint(20) NOT NULL auto_increment,
  msg_id varchar(15) binary default NULL,
  to_user varchar(35) default NULL,
  to_domain varchar(35) default NULL,
  PRIMARY KEY  (id),
  KEY msg_id (msg_id),
  KEY to_domain (to_domain,to_user)
) TYPE=MyISAM;

--
-- Table structure for table 'maillog_report'
--

CREATE TABLE maillog_report (
  id bigint(20) NOT NULL auto_increment,
  msg_id varchar(15) binary default NULL,
  filename text,
  filereport text,
  PRIMARY KEY  (id),
  KEY msg_id (msg_id)
) TYPE=MyISAM;



2) In addition to uncommenting "use DBI;" Look for the following
several lines below:

  # Create database connection
  my($dbh);
  $dbh = DBI->connect("DBI:mysql:mailscanner:192.168.0.51",
                      "mailscanner", "",
                      {'PrintError' => 0})

And change it to:

  # Create database connection
  my($dbh);
  $dbh = DBI->connect("DBI:mysql:$DATABASE_NAME:$IPADDRESS",
                      "$USERNAME", "$PASSWORD",
                      {'PrintError' => 0})

where:
$DATABASE_NAME = Replace with the name of your database
$IPADDRESS = Replace with the IP address of your database server or "localhost"
if on the same server as MailSacnner
$USERNAME = Replace with the Database username you wish to connect to
$PASSWORD = Replace with the password for that username

3) I crank down the time interval that MailScanner restarts from 24
hours to about 30 min.  Upside is that at most I'll loose 30 min worth
of mail logging and have a more current database.  Downside is that
Mailscannerrestarts much more frequently and increases the load on the
server.  

To change, look for "Restart Every = 14400" in MailScanner.conf and
change it to the number of seconds you wish.  I tested my setup with
120 (2 min.) and sent bunches of test messages.  Once I was confident
it was working, I changed it to 1800 (30 Min.) YMMV of course.

 - Andy Sutton
   sutton at pessimists.net
 
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mark at TIPPINGMAR.COM  Tue Nov  2 06:11:02 2004
From: mark at TIPPINGMAR.COM (Mark Nienberg)
Date: Thu Jan 12 21:27:26 2006
Subject: not considering authenticated submission as SPAM
Message-ID: <mailman.4201.1137101246.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Monday, November 1, 2004, at 06:13  PM, Mathias Körber wrote:
> How do I make mailscanner NOT consider email SPAM which was received
> with SMTP AUTH?
>
> In the following case, a user sent email from their home (dynamic IP)
> via the office server authenticating themselves. The dynamic home IP
> is listed in SBL+XBL (actually CBL). But as the user has authenticated,
> I would like to ignore that...
>
> Is this doable?
> How would I configure this?
> How would I distinguish between cases like this and cases where a
> remote host relays to me using SMTP-AUTH but is not the originating
> site? I would guess it has to check that
>         1. this is the first hop and it has been authenticated?
>
I do this by writing a spamassassin rule to check for a particular 
received header.  Like this:

header   OUR_AUTH       Received =~ /from mydomain\.com 
.*\(authenticated .* by mailserver\.mydomain\.com .* cipher=/i
describe OUR_AUTH       Sent through our server using authentication
tflags   OUR_AUTH       nice
score    OUR_AUTH       -4

The score can be whatever it takes to compensate for your typical 
remote users.  In addition to dial-up rbls, you'll probably find that 
spf rules are triggered, and maybe some others.

Messages received from our users have our domain name in them as shown, 
and the "authenticated" part.  If you are paranoid (like me) and want 
to make sure that spammers don't start putting fake headers in messages 
to try to trigger your negative rule, then you can modify the header 
that your mta puts in the message, so that it is unique to your server. 
  In fact, I have done this so my rule is slightly different than the 
one I showed you above.

The easiest way to modify the Received header in sendmail is to add a 
line like the following to "sendmail.mc" (then m4 etc).

dnl # We redefine the Received header part so it will
dnl # be unique to our site.  Then, we can filter on it in SpamAssassin
dnl # without worrying that it is forged. See cfhead.m4 for default.
dnl # We changed "authenticated" to "authenticated secretword" in the 
following line.
define(`_REC_AUTH_', `$.$?{auth_type}(authenticated secretword')dnl

This only modifies the received header for mail that has been 
authenticated.  Start by copying the appropriate line from "cfhead.m4" 
and pasting it into your "sendmail.mc".  Then edit the line only as 
needed to make it unique, so you don't mess it up.

Now you can modify the spamassassin rule to look like this:

header   OUR_AUTH       Received =~ /from mydomain\.com 
.*\(authenticated secretword .* by mailserver\.mydomain\.com .* 
cipher=/i

Mark Nienberg
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Jan-Peter.Koopmann at SECEIDOS.DE  Tue Nov  2 07:41:46 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:26 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.4202.1137101246.24926.mailscanner@lists.mailscanner.info>

Hi,

> So, if we want to use something other than the default
> 'X-Envelope-From' header that SA is looking for, we just have to let
> SA know 
> about it. For me, its just easier to use what SA is already
> looking for.

Is this test somehow related to the SPF checks? At first I did not get
SPF within SA up and running. I then changed the envelope_sender_header
and SPF started right away. Since I did not like that very much though I
tought Exim to put the Envelope-From in ist Received line as suggested
by the SpamAssassin folks. 

http://wiki.apache.org/spamassassin/EnvelopeSenderInReceived?action=high
light&value=SPF

And guess what: SPF worked without envelope_sender_header at once.
Unfortunately I do not see any NO_DNS_FOR_FROM hits anymore which leads
me to suspect that this might be a bug in SA. Opinions?

Regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Jan-Peter.Koopmann at SECEIDOS.DE  Tue Nov  2 08:32:52 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:26 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.4203.1137101246.24926.mailscanner@lists.mailscanner.info>

Hi,

I just had a look at the SA code. Unfortunately even though the SA wiki
suggests putting the Envelope-From in the Received Header SA will not
use it for all of its tests. I suspect this is a bug and filed one just
in case.

If however you set envelope_sender_headers in the config, it will be
used regardless of its position. It does not need to be at the top
(which I do not like at all anyways).


Therefore:

> b) Tell SpamAssassin what to expect in spam.assassin.prefs.conf

I am in favour of this solution since this will definately work. There
might be some screwup with fetchmail etc. though depending on your
configuration. But for "normal" MTA operations this probably is the way
to go.


Kind regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From JEN at AH.DK  Tue Nov  2 08:43:09 2004
From: JEN at AH.DK (Jan Elmqvist Nielsen)
Date: Thu Jan 12 21:27:26 2006
Subject: amavisd-new and (INVALID CHARACTERS OR SPACE GAP)
Message-ID: <mailman.4204.1137101246.24926.mailscanner@lists.mailscanner.info>

Hi

I'am using mailscanner 4.28.6-1 with danish report selection

The last 2 days I have recived 2 undeliverable mails - both from
servers using amavisd-new


>>> "Content-filter at mail.xxxx.xx" <postmaster@mail.xxxx.xx>
02-11-2004 09:06:21 >>>
INVALID HEADER (INVALID CHARACTERS OR SPACE GAP)

Non-encoded 8-bit data (char E5 hex) in message header
'xx-MailScanner-SpamCheck': xx-MailScanner-SpamCheck: ikkespam,
SpamAssassin (bedoemmelse=0, p\345kr\346vet 5)\n

This nondelivery report was generated by the amavisd-new program
at host mail.xxxx.xx. Our internal reference code for your message
is 74770-03.

When I switch to english language in the report section there is no
problem


any solutions other than using english language?

/Jan Elmqvist Nielsen

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From marcin.rozek at IOS.EDU.PL  Tue Nov  2 08:55:08 2004
From: marcin.rozek at IOS.EDU.PL ([ISO-8859-2] Marcin Rożek)
Date: Thu Jan 12 21:27:26 2006
Subject: request: minimum attachment size?
Message-ID: <mailman.4205.1137101246.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-2" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hello,
during the weekend we've bombarded by many copies of broken (zero-length) virus
(probably bagle) which was blocked because of .exe or .com extension. The
problem is that our MS delivered that mails (without attachment) to recipients.
Is it possible to add an option to MS that would prevent delivering empty
attachments? I suggest to name that option "Minimum Attachment Size" (similar to
Maximum Attachment Size).
Perhaps it would be good to set it to 0 or -1 by default to disable it.


Regards,
Marcin

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From kte at NEXIS.BE  Tue Nov  2 11:37:45 2004
From: kte at NEXIS.BE (Koen Teugels)
Date: Thu Jan 12 21:27:26 2006
Subject: {Scanned} Re: ProcessClamAVOutput: unrecognised line ...   
    contact the authors
Message-ID: <mailman.4206.1137101246.24926.mailscanner@lists.mailscanner.info>

I'm in the atest version of mailscanner (35.1) en and rpm version of
clamav 0.80.1 (and the compiled version) I have the same messages.

Koen

Julian Field wrote:

> Please upgrade to the latest MailScanner first, I well might have already
> sorted this.
>
> At 10:28 20/10/2004, you wrote:
>
>> Julian
>>
>>   I guess that "contact the authors" means you !!
>>
>>  Since upgrading to Clam 0.80, we have started seeing
>> messages like the following in our /var/log/maillog
>>
>>
>>  MailScanner[32597]: ProcessClamAVOutput: unrecognised line
>> "moc_sisl.cpp". Please contact the authors!
>>
>> Oct 17 12:27:28 mailr-w MailScanner[32597]: ProcessClamAVOutput:
>> unrecognised line "buildrun.log". Please contact the authors!
>>
>>
>>  This is version 4.30.3 of MailScanner.
>
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From kte at NEXIS.BE  Tue Nov  2 11:39:31 2004
From: kte at NEXIS.BE (Koen Teugels)
Date: Thu Jan 12 21:27:26 2006
Subject: {Scanned} bitdefender updates
Message-ID: <mailman.4207.1137101246.24926.mailscanner@lists.mailscanner.info>

I don't think that the wapper scripts update bitdefender.
Because the date of the virusdatabase doesn't change. Ans when I do a
manual update I can see some changes. Any idee?
thanks Koen

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From anders.andersson at LTKALMAR.SE  Tue Nov  2 11:45:11 2004
From: anders.andersson at LTKALMAR.SE (Anders Andersson, IT)
Date: Thu Jan 12 21:27:26 2006
Subject: 4.35.9: file command disabled?
Message-ID: <mailman.4208.1137101246.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list 
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
> Sent: Monday, November 01, 2004 11:13 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: 4.35.9: file command disabled?
> 
> I need to change the default. I don't want it switched on by 
> default, as it has to know where to find your "file" command 
> and what sort of output it produces.
> Just reset it to /usr/bin/file again and you'll be fine.
> 
> I'm not sure what to set the default to, it's a bit awkward. 
> I guess I could enable it by default, and just not squeal too 
> loudly if the file can't be found.
> What do you think?
I personally would rather have it set disabled but with a description
why and what to do to enable it. I think that is easier for beginners 


> 
> Jeff A. Earickson wrote:
> 
> > Julian,
> >
> > MailScanner.conf now has:
> >
> > File Command = #DISABLED /usr/bin/file
> >
> > Does this mean "don't use this setting anymore?".  Previously
> > (4.34.8) I had this defined as:
> >
> > File Command = /usr/bin/file
> >
> > What's the story here?
> 
> 
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz 
> MailScanner thanks transtec Computers for their support Buy 
> the MailScanner book at www.MailScanner.info/store
> 
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> 
> ------------------------ MailScanner list 
> ------------------------ To unsubscribe, email 
> jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ 
> (http://www.mailscanner.biz/maq/) and the archives 
> (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Steve.Swaney at FSL.COM  Tue Nov  2 12:10:25 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:26 2006
Subject: {Scanned} Re: ProcessClamAVOutput: unrecognised line ...   
    contact the authors
Message-ID: <mailman.4209.1137101246.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Koen Teugels
> Sent: Tuesday, November 02, 2004 6:38 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: {Scanned} Re: ProcessClamAVOutput: unrecognised line ... contact
> the authors
>
> I'm in the atest version of mailscanner (35.1) en and rpm version of
> clamav 0.80.1 (and the compiled version) I have the same messages.
>

Latest version is Version 4.35.9-1 which was released yesterday. 4.35.1 is a
beta version that does not work properly.

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com

> Koen
>
> Julian Field wrote:
>
> > Please upgrade to the latest MailScanner first, I well might have
> already
> > sorted this.
> >
> > At 10:28 20/10/2004, you wrote:
> >
> >> Julian
> >>
> >>   I guess that "contact the authors" means you !!
> >>
> >>  Since upgrading to Clam 0.80, we have started seeing
> >> messages like the following in our /var/log/maillog
> >>
> >>
> >>  MailScanner[32597]: ProcessClamAVOutput: unrecognised line
> >> "moc_sisl.cpp". Please contact the authors!
> >>
> >> Oct 17 12:27:28 mailr-w MailScanner[32597]: ProcessClamAVOutput:
> >> unrecognised line "buildrun.log". Please contact the authors!
> >>
> >>
> >>  This is version 4.30.3 of MailScanner.
> >
> >
> > --



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From jaearick at COLBY.EDU  Tue Nov  2 12:15:34 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:26 2006
Subject: 4.35.9: phishing fraud syslogs
Message-ID: <mailman.4210.1137101246.24926.mailscanner@lists.mailscanner.info>

Julian,

Please tweak the syslog message for phishing fraud to include
the message ID, something like:

Found phishing fraud attack in iA25FnB7002189 from http://(etc)

The message ID is always important when grepping the syslog.
Thanks.

Jeff Earickson
Colby College

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ugob at CAMO-ROUTE.COM  Tue Nov  2 12:13:04 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:26 2006
Subject: 4.35.9: file command disabled?
Message-ID: <mailman.4211.1137101246.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Anders Andersson, IT wrote:
>>-----Original Message-----
>>From: MailScanner mailing list
>>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>>Sent: Monday, November 01, 2004 11:13 PM
>>To: MAILSCANNER@JISCMAIL.AC.UK
>>Subject: Re: 4.35.9: file command disabled?
>>
>>I need to change the default. I don't want it switched on by
>>default, as it has to know where to find your "file" command
>>and what sort of output it produces.
>>Just reset it to /usr/bin/file again and you'll be fine.
>>
>>I'm not sure what to set the default to, it's a bit awkward.
>>I guess I could enable it by default, and just not squeal too
>>loudly if the file can't be found.
>>What do you think?
>
> I personally would rather have it set disabled but with a description
> why and what to do to enable it. I think that is easier for beginners

 From what I can recall, it was disabled when I first installed
MailScanner 1 year ago.  It was just commented out, without the "DISABLED".

I think it is better to have it disabled as well.

Ugo

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mike at ZANKER.ORG  Tue Nov  2 11:58:43 2004
From: mike at ZANKER.ORG (Mike Zanker)
Date: Thu Jan 12 21:27:27 2006
Subject: ANNOUNCE: MailScanner 4.35.9 stable released
Message-ID: <mailman.4212.1137101247.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian Field wrote:

> - Fixed problems with MIME::Base64 dependencies.

Unfortunately this doesn't seem to be the case for me :(

I installed on RHEL 3 AS and everything seemed to go to plan, except
that when running "uptodate -u" I started getting package conflict
errors with the main perl RPM again. Followed Steve Swaney's advice and
removed then reinstalled the main perl RPM and then started getting

Can't locate object method "init" via package "MIME::Decoder::QuotedPrint"

errors in the logs. Re-installed latest Base64 from the RPM that
MailScanner built and then started getting perl package conflicts with
up2date again.

I'm just going round in circles with this - is there a definitive solution?

Thanks,

Mike.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From kte at NEXIS.BE  Tue Nov  2 12:40:25 2004
From: kte at NEXIS.BE (Koen Teugels)
Date: Thu Jan 12 21:27:27 2006
Subject: {Scanned} ProcessClamAVOutput: unrecognised line ...    contact
    the authors
Message-ID: <mailman.4213.1137101247.24926.mailscanner@lists.mailscanner.info>

Sorry typo. I'm in the latest version of mailscanner
(MailScanner-4.35.9-1.rpm.tar.gz) en and rpm version of clamav 0.80.1
(and the compiled version)
I have the same messages.
grtz Koen

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From kte at NEXIS.BE  Tue Nov  2 13:49:36 2004
From: kte at NEXIS.BE (Koen Teugels)
Date: Thu Jan 12 21:27:27 2006
Subject: {Scanned} ProcessClamAVOutput: unrecognised line ...    contact
    the authors
Message-ID: <mailman.4214.1137101247.24926.mailscanner@lists.mailscanner.info>

Sorry typo. I'm in the latest version of mailscanner
(MailScanner-4.35.9-1.rpm.tar.gz) en and rpm version of clamav 0.80.1
(and the compiled version)
I have the same messages.

Nov  2 14:42:58 scanmail MailScanner[1685]: New Batch: Scanning 1
messages, 9722407 bytes
Nov  2 14:42:58 scanmail MailScanner[1685]: Spam Checks: Starting
Nov  2 14:43:13 scanmail MailScanner[1685]: Virus and Content Scanning:
Starting
Nov  2 14:43:19 scanmail MailScanner[1685]:
copfilter_200408300326_setup.tgz
Nov  2 14:43:19 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "copfilter_200408300326_setup.tgz". Please contact the
authors!
Nov  2 14:43:19 scanmail MailScanner[1685]: setup.sh
Nov  2 14:43:19 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "setup.sh". Please contact the authors!
Nov  2 14:43:19 scanmail MailScanner[1685]: var/log/copfilter/0.0.95/
Nov  2 14:43:19 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/". Please contact the authors!
Nov  2 14:43:20 scanmail MailScanner[1685]: var/log/copfilter/0.0.95/etc/
Nov  2 14:43:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/etc/". Please contact the
authors!
Nov  2 14:43:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/etc/global_settings
Nov  2 14:43:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/etc/global_settings". Please
contact the authors!
Nov  2 14:43:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/etc/clamd_counter
Nov  2 14:43:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/etc/clamd_counter". Please
contact the authors!
Nov  2 14:43:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/etc/global_settings.backup2
Nov  2 14:43:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/etc/global_settings.backup2". Please contact
the authors!
Nov  2 14:43:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/etc/fprot_counter
Nov  2 14:43:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/etc/fprot_counter". Please
contact the authors!
Nov  2 14:43:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/etc/clamd_counter.conf
Nov  2 14:43:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/etc/clamd_counter.conf".
Please contact the authors!
Nov  2 14:43:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/etc/fprot_counter.conf
Nov  2 14:43:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/etc/fprot_counter.conf".
Please contact the authors!
Nov  2 14:43:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/etc/rules_du_jour_counter.conf
Nov  2 14:43:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/etc/rules_du_jour_counter.conf". Please
contact the authors!
Nov  2 14:43:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/etc/rules_du_jour_counter
Nov  2 14:43:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/etc/rules_du_jour_counter".
Please contact the authors!
Nov  2 14:43:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/etc/p3scan_rm_counter
Nov  2 14:43:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/etc/p3scan_rm_counter".
Please contact the authors!
Nov  2 14:43:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/etc/fprot_prg_counter
Nov  2 14:43:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/etc/fprot_prg_counter".
Please contact the authors!
Nov  2 14:43:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/etc/p3scan_rm_counter.conf
Nov  2 14:43:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/etc/p3scan_rm_counter.conf".
Please contact the authors!
Nov  2 14:43:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/etc/fprot_prg_counter.conf
Nov  2 14:43:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/etc/fprot_prg_counter.conf".
Please contact the authors!
Nov  2 14:43:20 scanmail MailScanner[1685]: var/log/copfilter/0.0.95/doc/
Nov  2 14:43:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/doc/". Please contact the
authors!
Nov  2 14:43:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/doc/CHANGELOG
Nov  2 14:43:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/doc/CHANGELOG". Please
contact the authors!
Nov  2 14:43:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/doc/FEATURES
Nov  2 14:43:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/doc/FEATURES". Please
contact the authors!
Nov  2 14:43:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/doc/INSTALL
Nov  2 14:43:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/doc/INSTALL". Please contact
the authors!
Nov  2 14:43:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/doc/MANUAL
Nov  2 14:43:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/doc/MANUAL". Please contact
the authors!
Nov  2 14:43:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/doc/TODO
Nov  2 14:43:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/doc/TODO". Please contact
the authors!
Nov  2 14:43:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/doc/TESTING
Nov  2 14:43:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/doc/TESTING". Please contact
the authors!
Nov  2 14:43:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/doc/FAQ
Nov  2 14:43:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/doc/FAQ". Please contact the
authors!
Nov  2 14:43:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/doc/README.1st
Nov  2 14:43:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/doc/README.1st". Please
contact the authors!
Nov  2 14:43:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/doc/BUGS
Nov  2 14:43:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/doc/BUGS". Please contact
the authors!
Nov  2 14:43:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/doc/TRANSLATIONS
Nov  2 14:43:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/doc/TRANSLATIONS". Please
contact the authors!
Nov  2 14:43:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/doc/LINKS
Nov  2 14:43:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/doc/LINKS". Please contact
the authors!
Nov  2 14:43:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/doc/CREDITS
Nov  2 14:43:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/doc/CREDITS". Please contact
the authors!
Nov  2 14:43:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/doc/copfilter_screenshot-0.0.94.jpg
Nov  2 14:43:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/doc/copfilter_screenshot-0.0.94.jpg". Please
contact the authors!
Nov  2 14:43:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/
Nov  2 14:43:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/install/". Please contact
the authors!
Nov  2 14:43:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/perl_modules_for_spamassassin_NEW_not_compiled_yet.tgz

Nov  2 14:43:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/install/perl_modules_for_spamassassin_NEW_not_compiled_yet.tgz".
Please contact the authors!
Nov  2 14:43:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/usr_local_bin.tgz
Nov  2 14:43:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/install/usr_local_bin.tgz".
Please contact the authors!
Nov  2 14:43:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/usr_local_bin_src.tgz
Nov  2 14:43:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/install/usr_local_bin_src.tgz". Please contact
the authors!
Nov  2 14:43:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/webgui/
Nov  2 14:43:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/install/webgui/". Please
contact the authors!
Nov  2 14:43:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/webgui/copfilter.cgi
Nov  2 14:43:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/install/webgui/copfilter.cgi". Please contact
the authors!
Nov  2 14:43:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/webgui/header.pl
Nov  2 14:43:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/install/webgui/header.pl".
Please contact the authors!
Nov  2 14:43:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/webgui/en.pl
Nov  2 14:43:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/install/webgui/en.pl".
Please contact the authors!
Nov  2 14:43:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/usr_local_bin.tgz.list
Nov  2 14:43:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/install/usr_local_bin.tgz.list". Please
contact the authors!
Nov  2 14:43:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/old_perl_modules_now_all_self_compiled/
Nov  2 14:43:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/install/old_perl_modules_now_all_self_compiled/".
Please contact the authors!
Nov  2 14:43:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/old_perl_modules_now_all_self_compiled/perl_modules_for_f-prot_2.tgz

Nov  2 14:43:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/install/old_perl_modules_now_all_self_compiled/perl_modules_for_f-prot_2.tgz".
Please contact the authors!
Nov  2 14:43:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/old_perl_modules_now_all_self_compiled/perl_modules_for_spamassassin_copied_from_ipcop_LFS_1.tgz

Nov  2 14:43:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/install/old_perl_modules_now_all_self_compiled/perl_modules_for_spamassassin_copied_from_ipcop_LFS_1.tgz".
Please contact the authors!
Nov  2 14:43:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/old_perl_modules_now_all_self_compiled/perl_modules_for_spamassassin_selfcompiled.tgz

Nov  2 14:43:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/install/old_perl_modules_now_all_self_compiled/perl_modules_for_spamassassin_selfcompiled.tgz".
Please contact the authors!
Nov  2 14:43:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/old_perl_modules_now_all_self_compiled/perl_modules_for_spamassassin_selfcompiled.tgz.list

Nov  2 14:43:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/install/old_perl_modules_now_all_self_compiled/perl_modules_for_spamassassin_selfcompiled.tgz.list".
Please contact the authors!
Nov  2 14:43:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/compile_scripts.tgz
Nov  2 14:43:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/install/compile_scripts.tgz". Please contact
the authors!
Nov  2 14:43:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/backup3/
Nov  2 14:43:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/install/backup3/". Please
contact the authors!
Nov  2 14:43:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/backup3/copfilter_check-updates_clamav.c
Nov  2 14:43:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/install/backup3/copfilter_check-updates_clamav.c".
Please contact the authors!
Nov  2 14:43:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/backup3/copfilter_check-updates_f-prot.c
Nov  2 14:43:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/install/backup3/copfilter_check-updates_f-prot.c".
Please contact the authors!
Nov  2 14:43:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/backup3/copfilter_make_command
Nov  2 14:43:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/install/backup3/copfilter_make_command".
Please contact the authors!
Nov  2 14:43:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/backup3/copfilter_make_test.c
Nov  2 14:43:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/install/backup3/copfilter_make_test.c". Please
contact the authors!
Nov  2 14:43:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/backup3/copfilter_restartclamd.c
Nov  2 14:43:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/install/backup3/copfilter_restartclamd.c".
Please contact the authors!
Nov  2 14:43:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/backup3/copfilter_restartp3scan.c
Nov  2 14:43:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/install/backup3/copfilter_restartp3scan.c".
Please contact the authors!
Nov  2 14:43:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/backup3/copfilter_restartp3scan_debug.c
Nov  2 14:43:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/install/backup3/copfilter_restartp3scan_debug.c".
Please contact the authors!
Nov  2 14:43:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/backup3/copfilter_restartprivoxy.c
Nov  2 14:43:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/install/backup3/copfilter_restartprivoxy.c".
Please contact the authors!
Nov  2 14:43:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/backup3/copfilter_restartrenattach.c
Nov  2 14:43:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/install/backup3/copfilter_restartrenattach.c".
Please contact the authors!
Nov  2 14:43:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/backup3/copfilter_restartspamd.c
Nov  2 14:43:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/install/backup3/copfilter_restartspamd.c".
Please contact the authors!
Nov  2 14:43:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install/backup3/copfilter_updates_rules_du_jour.c
Nov  2 14:43:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/install/backup3/copfilter_updates_rules_du_jour.c".
Please contact the authors!
Nov  2 14:43:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install_f-prot.sh
Nov  2 14:43:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/install_f-prot.sh". Please
contact the authors!
Nov  2 14:43:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/install.sh
Nov  2 14:43:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/install.sh". Please contact
the authors!
Nov  2 14:43:22 scanmail MailScanner[1685]: var/log/copfilter/0.0.95/opt/
Nov  2 14:43:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/". Please contact the
authors!
Nov  2 14:43:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/
Nov  2 14:43:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/clamav/". Please contact
the authors!
Nov  2 14:43:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/
Nov  2 14:43:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/clamav/0.75.1/". Please
contact the authors!
Nov  2 14:43:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/lib/
Nov  2 14:43:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/clamav/0.75.1/lib/".
Please contact the authors!
Nov  2 14:43:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/lib/libclamav.so.1.0.4
Nov  2 14:43:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/0.75.1/lib/libclamav.so.1.0.4".
Please contact the authors!
Nov  2 14:43:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/lib/libclamav.so.1
Nov  2 14:43:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/0.75.1/lib/libclamav.so.1". Please
contact the authors!
Nov  2 14:43:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/lib/libclamav.so
Nov  2 14:43:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/0.75.1/lib/libclamav.so". Please
contact the authors!
Nov  2 14:43:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/lib/libclamav.la
Nov  2 14:43:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/0.75.1/lib/libclamav.la". Please
contact the authors!
Nov  2 14:43:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/lib/libclamav.a
Nov  2 14:43:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/0.75.1/lib/libclamav.a". Please
contact the authors!
Nov  2 14:43:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/lib/pkgconfig/
Nov  2 14:43:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/0.75.1/lib/pkgconfig/". Please
contact the authors!
Nov  2 14:43:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/lib/pkgconfig/libclamav.pc
Nov  2 14:43:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/0.75.1/lib/pkgconfig/libclamav.pc".
Please contact the authors!
Nov  2 14:43:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/include/
Nov  2 14:43:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/clamav/0.75.1/include/".
Please contact the authors!
Nov  2 14:43:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/include/clamav.h
Nov  2 14:43:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/0.75.1/include/clamav.h". Please
contact the authors!
Nov  2 14:43:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/bin/
Nov  2 14:43:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/clamav/0.75.1/bin/".
Please contact the authors!
Nov  2 14:43:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/bin/clamscan
Nov  2 14:43:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/0.75.1/bin/clamscan". Please
contact the authors!
Nov  2 14:43:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/bin/clamdscan
Nov  2 14:43:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/0.75.1/bin/clamdscan". Please
contact the authors!
Nov  2 14:43:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/bin/freshclam
Nov  2 14:43:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/0.75.1/bin/freshclam". Please
contact the authors!
Nov  2 14:43:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/bin/sigtool
Nov  2 14:43:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/0.75.1/bin/sigtool". Please contact
the authors!
Nov  2 14:43:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/bin/clamav-config
Nov  2 14:43:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/0.75.1/bin/clamav-config". Please
contact the authors!
Nov  2 14:43:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/sbin/
Nov  2 14:43:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/clamav/0.75.1/sbin/".
Please contact the authors!
Nov  2 14:43:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/sbin/clamd
Nov  2 14:43:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/0.75.1/sbin/clamd". Please contact
the authors!
Nov  2 14:43:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/man/
Nov  2 14:43:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/clamav/0.75.1/man/".
Please contact the authors!
Nov  2 14:43:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/man/man1/
Nov  2 14:43:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/0.75.1/man/man1/". Please contact
the authors!
Nov  2 14:43:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/man/man1/clamscan.1
Nov  2 14:43:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/0.75.1/man/man1/clamscan.1". Please
contact the authors!
Nov  2 14:43:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/man/man1/freshclam.1
Nov  2 14:43:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/0.75.1/man/man1/freshclam.1".
Please contact the authors!
Nov  2 14:43:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/man/man1/sigtool.1
Nov  2 14:43:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/0.75.1/man/man1/sigtool.1". Please
contact the authors!
Nov  2 14:43:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/man/man1/clamdscan.1
Nov  2 14:43:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/0.75.1/man/man1/clamdscan.1".
Please contact the authors!
Nov  2 14:43:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/man/man5/
Nov  2 14:43:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/0.75.1/man/man5/". Please contact
the authors!
Nov  2 14:43:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/man/man5/clamav.conf.5
Nov  2 14:43:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/0.75.1/man/man5/clamav.conf.5".
Please contact the authors!
Nov  2 14:43:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/man/man5/freshclam.conf.5
Nov  2 14:43:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/0.75.1/man/man5/freshclam.conf.5".
Please contact the authors!
Nov  2 14:43:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/man/man8/
Nov  2 14:43:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/0.75.1/man/man8/". Please contact
the authors!
Nov  2 14:43:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/man/man8/clamd.8
Nov  2 14:43:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/0.75.1/man/man8/clamd.8". Please
contact the authors!
Nov  2 14:43:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/0.75.1/man/man8/clamav-milter.8
Nov  2 14:43:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/0.75.1/man/man8/clamav-milter.8".
Please contact the authors!
Nov  2 14:43:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/default
Nov  2 14:43:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/clamav/default". Please
contact the authors!
Nov  2 14:43:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/etc/
Nov  2 14:43:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/clamav/etc/". Please
contact the authors!
Nov  2 14:43:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/etc/clamav.conf
Nov  2 14:43:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/clamav/etc/clamav.conf".
Please contact the authors!
Nov  2 14:43:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/etc/freshclam.conf
Nov  2 14:43:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/etc/freshclam.conf". Please contact
the authors!
Nov  2 14:43:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/etc/init.d/
Nov  2 14:43:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/clamav/etc/init.d/".
Please contact the authors!
Nov  2 14:43:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/etc/init.d/clamd
Nov  2 14:43:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/clamav/etc/init.d/clamd". Please contact
the authors!
Nov  2 14:43:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/virdb/
Nov  2 14:43:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/clamav/virdb/". Please
contact the authors!
Nov  2 14:43:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/virdb/main.cvd
Nov  2 14:43:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/clamav/virdb/main.cvd".
Please contact the authors!
Nov  2 14:43:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/clamav/virdb/daily.cvd
Nov  2 14:43:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/clamav/virdb/daily.cvd".
Please contact the authors!
Nov  2 14:43:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/
Nov  2 14:43:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/tools/". Please contact
the authors!
Nov  2 14:43:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/bin/
Nov  2 14:43:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/tools/bin/". Please
contact the authors!
Nov  2 14:43:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/bin/ncftp
Nov  2 14:43:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/tools/bin/ncftp". Please
contact the authors!
Nov  2 14:43:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/bin/ncftpget
Nov  2 14:43:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/tools/bin/ncftpget".
Please contact the authors!
Nov  2 14:43:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/bin/renattach
Nov  2 14:43:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/tools/bin/renattach".
Please contact the authors!
Nov  2 14:43:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/bin/ripmime
Nov  2 14:43:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/tools/bin/ripmime".
Please contact the authors!
Nov  2 14:43:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/bin/wget
Nov  2 14:43:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/tools/bin/wget". Please
contact the authors!
Nov  2 14:43:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/bin/sendEmail
Nov  2 14:43:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/tools/bin/sendEmail".
Please contact the authors!
Nov  2 14:43:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/bin/old/
Nov  2 14:43:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/tools/bin/old/". Please
contact the authors!
Nov  2 14:43:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/bin/old/my_rules_du_jour_old
Nov  2 14:43:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/tools/bin/old/my_rules_du_jour_old".
Please contact the authors!
Nov  2 14:43:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/bin/old/rules_du_jour_old
Nov  2 14:43:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/tools/bin/old/rules_du_jour_old". Please
contact the authors!
Nov  2 14:43:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/bin/my_rules_du_jour
Nov  2 14:43:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/tools/bin/my_rules_du_jour". Please
contact the authors!
Nov  2 14:43:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/bin/backup/
Nov  2 14:43:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/tools/bin/backup/".
Please contact the authors!
Nov  2 14:43:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/bin/backup/mailscanner.sh_fprot_template
Nov  2 14:43:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/tools/bin/backup/mailscanner.sh_fprot_template".
Please contact the authors!
Nov  2 14:43:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/bin/check-updates_clamav.sh
Nov  2 14:43:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/tools/bin/check-updates_clamav.sh". Please
contact the authors!
Nov  2 14:43:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/bin/check-updates_f-prot.sh
Nov  2 14:43:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/tools/bin/check-updates_f-prot.sh". Please
contact the authors!
Nov  2 14:43:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/bin/mailscanner.sh
Nov  2 14:43:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/tools/bin/mailscanner.sh". Please contact
the authors!
Nov  2 14:43:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/bin/rules_du_jour
Nov  2 14:43:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/tools/bin/rules_du_jour". Please contact
the authors!
Nov  2 14:43:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/bin/sendEmail_orig
Nov  2 14:43:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/tools/bin/sendEmail_orig". Please contact
the authors!
Nov  2 14:43:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/bin/sendEmail-v1_42-smtp-auth
Nov  2 14:43:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/tools/bin/sendEmail-v1_42-smtp-auth".
Please contact the authors!
Nov  2 14:43:25 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/bin/smtpclient
Nov  2 14:43:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/tools/bin/smtpclient".
Please contact the authors!
Nov  2 14:43:25 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/bin/unzip
Nov  2 14:43:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/tools/bin/unzip". Please
contact the authors!
Nov  2 14:43:25 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/etc/
Nov  2 14:43:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/tools/etc/". Please
contact the authors!
Nov  2 14:43:25 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/etc/renattach.conf.ex
Nov  2 14:43:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/tools/etc/renattach.conf.ex". Please
contact the authors!
Nov  2 14:43:25 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/etc/wgetrc
Nov  2 14:43:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/tools/etc/wgetrc".
Please contact the authors!
Nov  2 14:43:25 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/etc/init.d/
Nov  2 14:43:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/tools/etc/init.d/".
Please contact the authors!
Nov  2 14:43:25 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/etc/init.d/renattach
Nov  2 14:43:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/tools/etc/init.d/renattach". Please
contact the authors!
Nov  2 14:43:25 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/etc/renattach.conf
Nov  2 14:43:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/tools/etc/renattach.conf". Please contact
the authors!
Nov  2 14:43:25 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/man/
Nov  2 14:43:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/tools/man/". Please
contact the authors!
Nov  2 14:43:25 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/man/man1/
Nov  2 14:43:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/tools/man/man1/". Please
contact the authors!
Nov  2 14:43:25 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/man/man1/renattach.1
Nov  2 14:43:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/tools/man/man1/renattach.1". Please
contact the authors!
Nov  2 14:43:25 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/man/man1/wget.1
Nov  2 14:43:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/tools/man/man1/wget.1".
Please contact the authors!
Nov  2 14:43:25 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/info/
Nov  2 14:43:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/tools/info/". Please
contact the authors!
Nov  2 14:43:25 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/info/wget.info
Nov  2 14:43:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/tools/info/wget.info".
Please contact the authors!
Nov  2 14:43:25 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/info/wget.info-1
Nov  2 14:43:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/tools/info/wget.info-1".
Please contact the authors!
Nov  2 14:43:25 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/info/wget.info-2
Nov  2 14:43:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/tools/info/wget.info-2".
Please contact the authors!
Nov  2 14:43:25 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/info/wget.info-3
Nov  2 14:43:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/tools/info/wget.info-3".
Please contact the authors!
Nov  2 14:43:25 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/tools/info/wget.info-4
Nov  2 14:43:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/tools/info/wget.info-4".
Please contact the authors!
Nov  2 14:43:25 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/
Nov  2 14:43:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/privoxy/". Please
contact the authors!
Nov  2 14:43:25 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/
Nov  2 14:43:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/".
Please contact the authors!
Nov  2 14:43:25 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/sbin/
Nov  2 14:43:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/sbin/". Please
contact the authors!
Nov  2 14:43:25 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/sbin/privoxy
Nov  2 14:43:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/sbin/privoxy". Please
contact the authors!
Nov  2 14:43:25 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/
Nov  2 14:43:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/". Please
contact the authors!
Nov  2 14:43:25 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/
Nov  2 14:43:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/". Please
contact the authors!
Nov  2 14:43:26 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/
Nov  2 14:43:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/".
Please contact the authors!
Nov  2 14:43:26 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/

Nov  2 14:43:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/".
Please contact the authors!
Nov  2 14:43:26 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/actions-file.html

Nov  2 14:43:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/actions-file.html".
Please contact the authors!
Nov  2 14:43:26 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/appendix.html

Nov  2 14:43:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/appendix.html".
Please contact the authors!
Nov  2 14:43:26 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/config.html

Nov  2 14:43:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/config.html".
Please contact the authors!
Nov  2 14:43:26 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/configuration.html

Nov  2 14:43:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/configuration.html".
Please contact the authors!
Nov  2 14:43:26 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/contact.html

Nov  2 14:43:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/contact.html".
Please contact the authors!
Nov  2 14:43:26 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/copyright.html

Nov  2 14:43:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/copyright.html".
Please contact the authors!
Nov  2 14:43:26 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/filter-file.html

Nov  2 14:43:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/filter-file.html".
Please contact the authors!
Nov  2 14:43:26 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/index.html

Nov  2 14:43:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/index.html".
Please contact the authors!
Nov  2 14:43:26 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/installation.html

Nov  2 14:43:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/installation.html".
Please contact the authors!
Nov  2 14:43:26 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/introduction.html

Nov  2 14:43:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/introduction.html".
Please contact the authors!
Nov  2 14:43:26 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/quickstart.html

Nov  2 14:43:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/quickstart.html".
Please contact the authors!
Nov  2 14:43:26 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/seealso.html

Nov  2 14:43:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/seealso.html".
Please contact the authors!
Nov  2 14:43:26 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/startup.html

Nov  2 14:43:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/startup.html".
Please contact the authors!
Nov  2 14:43:26 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/templates.html

Nov  2 14:43:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/templates.html".
Please contact the authors!
Nov  2 14:43:26 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/upgradersnote.html

Nov  2 14:43:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/user-manual/upgradersnote.html".
Please contact the authors!
Nov  2 14:43:26 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/faq/
Nov  2 14:43:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/faq/".
Please contact the authors!
Nov  2 14:43:26 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/faq/configuration.html

Nov  2 14:43:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/faq/configuration.html".
Please contact the authors!
Nov  2 14:43:26 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/faq/contact.html

Nov  2 14:43:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/faq/contact.html".
Please contact the authors!
Nov  2 14:43:26 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/faq/copyright.html

Nov  2 14:43:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/faq/copyright.html".
Please contact the authors!
Nov  2 14:43:26 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/faq/general.html

Nov  2 14:43:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/faq/general.html".
Please contact the authors!
Nov  2 14:43:26 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/faq/index.html

Nov  2 14:43:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/faq/index.html".
Please contact the authors!
Nov  2 14:43:26 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/faq/installation.html

Nov  2 14:43:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/faq/installation.html".
Please contact the authors!
Nov  2 14:43:27 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/faq/misc.html

Nov  2 14:43:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/faq/misc.html".
Please contact the authors!
Nov  2 14:43:27 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/faq/trouble.html

Nov  2 14:43:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/faq/trouble.html".
Please contact the authors!
Nov  2 14:43:27 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/developer-manual/

Nov  2 14:43:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/developer-manual/".
Please contact the authors!
Nov  2 14:43:27 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/developer-manual/coding.html

Nov  2 14:43:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/developer-manual/coding.html".
Please contact the authors!
Nov  2 14:43:27 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/developer-manual/contact.html

Nov  2 14:43:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/developer-manual/contact.html".
Please contact the authors!
Nov  2 14:43:27 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/developer-manual/copyright.html

Nov  2 14:43:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/developer-manual/copyright.html".
Please contact the authors!
Nov  2 14:43:27 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/developer-manual/cvs.html

Nov  2 14:43:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/developer-manual/cvs.html".
Please contact the authors!
Nov  2 14:43:27 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/developer-manual/documentation.html

Nov  2 14:43:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/developer-manual/documentation.html".
Please contact the authors!
Nov  2 14:43:27 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/developer-manual/index.html

Nov  2 14:43:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/developer-manual/index.html".
Please contact the authors!
Nov  2 14:43:27 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/developer-manual/introduction.html

Nov  2 14:43:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/developer-manual/introduction.html".
Please contact the authors!
Nov  2 14:43:27 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/developer-manual/newrelease.html

Nov  2 14:43:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/developer-manual/newrelease.html".
Please contact the authors!
Nov  2 14:43:27 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/developer-manual/quickstart.html

Nov  2 14:43:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/developer-manual/quickstart.html".
Please contact the authors!
Nov  2 14:43:27 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/developer-manual/seealso.html

Nov  2 14:43:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/developer-manual/seealso.html".
Please contact the authors!
Nov  2 14:43:27 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/developer-manual/testing.html

Nov  2 14:43:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/developer-manual/testing.html".
Please contact the authors!
Nov  2 14:43:27 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/developer-manual/webserver-update.html

Nov  2 14:43:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/developer-manual/webserver-update.html".
Please contact the authors!
Nov  2 14:43:27 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/man-page/

Nov  2 14:43:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/man-page/".
Please contact the authors!
Nov  2 14:43:27 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/man-page/privoxy-man-page.html

Nov  2 14:43:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/man-page/privoxy-man-page.html".
Please contact the authors!
Nov  2 14:43:27 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/images/
Nov  2 14:43:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/images/".
Please contact the authors!
Nov  2 14:43:27 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/images/files-in-use.jpg

Nov  2 14:43:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/images/files-in-use.jpg".
Please contact the authors!
Nov  2 14:43:27 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/images/proxy_setup.jpg

Nov  2 14:43:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/images/proxy_setup.jpg".
Please contact the authors!
Nov  2 14:43:27 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/index.html

Nov  2 14:43:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/index.html".
Please contact the authors!
Nov  2 14:43:27 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/AUTHORS
Nov  2 14:43:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/AUTHORS".
Please contact the authors!
Nov  2 14:43:27 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/LICENSE
Nov  2 14:43:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/LICENSE".
Please contact the authors!
Nov  2 14:43:28 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/README
Nov  2 14:43:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/README".
Please contact the authors!
Nov  2 14:43:28 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/ChangeLog

Nov  2 14:43:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/ChangeLog".
Please contact the authors!
Nov  2 14:43:28 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/p_doc.css

Nov  2 14:43:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/share/doc/privoxy/p_doc.css".
Please contact the authors!
Nov  2 14:43:28 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/var/
Nov  2 14:43:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/var/". Please contact
the authors!
Nov  2 14:43:28 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/var/log/
Nov  2 14:43:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/var/log/". Please
contact the authors!
Nov  2 14:43:28 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/var/log/privoxy/
Nov  2 14:43:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/var/log/privoxy/".
Please contact the authors!
Nov  2 14:43:28 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/var/log/privoxy/logfile
Nov  2 14:43:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/var/log/privoxy/logfile".
Please contact the authors!
Nov  2 14:43:28 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/var/log/privoxy/jarfile
Nov  2 14:43:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/var/log/privoxy/jarfile".
Please contact the authors!
Nov  2 14:43:28 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/var/run/
Nov  2 14:43:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/var/run/". Please
contact the authors!
Nov  2 14:43:28 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/var/run/privoxy.pid
Nov  2 14:43:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/var/run/privoxy.pid".
Please contact the authors!
Nov  2 14:43:28 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/man/
Nov  2 14:43:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/man/". Please contact
the authors!
Nov  2 14:43:28 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/man/man1/
Nov  2 14:43:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/man/man1/". Please
contact the authors!
Nov  2 14:43:28 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/man/man1/privoxy.1
Nov  2 14:43:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/3.0.3-stable/man/man1/privoxy.1".
Please contact the authors!
Nov  2 14:43:28 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/
Nov  2 14:43:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/privoxy/etc/". Please
contact the authors!
Nov  2 14:43:28 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/
Nov  2 14:43:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/privoxy/etc/templates/".
Please contact the authors!
Nov  2 14:43:28 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/mod-title
Nov  2 14:43:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/mod-title". Please
contact the authors!
Nov  2 14:43:28 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/blocked
Nov  2 14:43:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/blocked". Please
contact the authors!
Nov  2 14:43:28 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/default
Nov  2 14:43:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/default". Please
contact the authors!
Nov  2 14:43:28 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/cgi-error-404
Nov  2 14:43:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/cgi-error-404".
Please contact the authors!
Nov  2 14:43:28 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/cgi-error-bad-param
Nov  2 14:43:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/cgi-error-bad-param".
Please contact the authors!
Nov  2 14:43:28 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/cgi-error-disabled
Nov  2 14:43:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/cgi-error-disabled".
Please contact the authors!
Nov  2 14:43:28 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/cgi-error-file
Nov  2 14:43:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/cgi-error-file".
Please contact the authors!
Nov  2 14:43:28 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/cgi-error-file-read-only
Nov  2 14:43:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/cgi-error-file-read-only".
Please contact the authors!
Nov  2 14:43:29 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/cgi-error-modified
Nov  2 14:43:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/cgi-error-modified".
Please contact the authors!
Nov  2 14:43:29 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/cgi-error-parse
Nov  2 14:43:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/cgi-error-parse".
Please contact the authors!
Nov  2 14:43:29 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/cgi-style.css
Nov  2 14:43:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/cgi-style.css".
Please contact the authors!
Nov  2 14:43:29 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/connect-failed
Nov  2 14:43:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/connect-failed".
Please contact the authors!
Nov  2 14:43:29 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/edit-actions-add-url-form

Nov  2 14:43:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/edit-actions-add-url-form".
Please contact the authors!
Nov  2 14:43:29 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/edit-actions-for-url
Nov  2 14:43:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/edit-actions-for-url".
Please contact the authors!
Nov  2 14:43:29 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/edit-actions-for-url-filter

Nov  2 14:43:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/edit-actions-for-url-filter".
Please contact the authors!
Nov  2 14:43:29 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/edit-actions-list
Nov  2 14:43:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/edit-actions-list".
Please contact the authors!
Nov  2 14:43:29 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/edit-actions-list-button
Nov  2 14:43:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/edit-actions-list-button".
Please contact the authors!
Nov  2 14:43:29 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/edit-actions-list-section

Nov  2 14:43:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/edit-actions-list-section".
Please contact the authors!
Nov  2 14:43:29 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/edit-actions-list-url
Nov  2 14:43:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/edit-actions-list-url".
Please contact the authors!
Nov  2 14:43:29 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/edit-actions-remove-url-form

Nov  2 14:43:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/edit-actions-remove-url-form".
Please contact the authors!
Nov  2 14:43:29 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/edit-actions-url-form
Nov  2 14:43:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/edit-actions-url-form".
Please contact the authors!
Nov  2 14:43:29 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/mod-local-help
Nov  2 14:43:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/mod-local-help".
Please contact the authors!
Nov  2 14:43:29 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/mod-support-and-service
Nov  2 14:43:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/mod-support-and-service".
Please contact the authors!
Nov  2 14:43:29 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/mod-unstable-warning
Nov  2 14:43:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/mod-unstable-warning".
Please contact the authors!
Nov  2 14:43:29 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/no-such-domain
Nov  2 14:43:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/no-such-domain".
Please contact the authors!
Nov  2 14:43:29 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/show-request
Nov  2 14:43:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/show-request".
Please contact the authors!
Nov  2 14:43:29 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/show-status
Nov  2 14:43:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/show-status". Please
contact the authors!
Nov  2 14:43:29 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/show-status-file
Nov  2 14:43:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/show-status-file".
Please contact the authors!
Nov  2 14:43:29 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/show-url-info
Nov  2 14:43:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/show-url-info".
Please contact the authors!
Nov  2 14:43:29 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/show-version
Nov  2 14:43:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/show-version".
Please contact the authors!
Nov  2 14:43:29 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/toggle
Nov  2 14:43:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/toggle". Please
contact the authors!
Nov  2 14:43:30 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/toggle-mini
Nov  2 14:43:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/toggle-mini". Please
contact the authors!
Nov  2 14:43:30 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/templates/untrusted
Nov  2 14:43:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/templates/untrusted". Please
contact the authors!
Nov  2 14:43:30 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/config
Nov  2 14:43:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/privoxy/etc/config".
Please contact the authors!
Nov  2 14:43:30 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/trust
Nov  2 14:43:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/privoxy/etc/trust".
Please contact the authors!
Nov  2 14:43:30 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/default.action
Nov  2 14:43:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/default.action". Please
contact the authors!
Nov  2 14:43:30 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/standard.action
Nov  2 14:43:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/standard.action". Please
contact the authors!
Nov  2 14:43:30 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/user.action
Nov  2 14:43:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/user.action". Please contact
the authors!
Nov  2 14:43:30 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/default.filter
Nov  2 14:43:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/default.filter". Please
contact the authors!
Nov  2 14:43:30 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/init.d/
Nov  2 14:43:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/privoxy/etc/init.d/".
Please contact the authors!
Nov  2 14:43:30 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/etc/init.d/privoxy
Nov  2 14:43:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/etc/init.d/privoxy". Please
contact the authors!
Nov  2 14:43:30 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/default
Nov  2 14:43:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/privoxy/default". Please
contact the authors!
Nov  2 14:43:30 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/var/
Nov  2 14:43:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/privoxy/var/". Please
contact the authors!
Nov  2 14:43:30 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/var/log/
Nov  2 14:43:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/privoxy/var/log/".
Please contact the authors!
Nov  2 14:43:30 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/privoxy/var/log/privoxy/
Nov  2 14:43:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/privoxy/var/log/privoxy/". Please contact
the authors!
Nov  2 14:43:30 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/
Nov  2 14:43:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/p3scan/". Please contact
the authors!
Nov  2 14:43:30 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/
Nov  2 14:43:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/".
Please contact the authors!
Nov  2 14:43:30 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/sbin/
Nov  2 14:43:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/sbin/". Please contact
the authors!
Nov  2 14:43:30 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/sbin/p3scan
Nov  2 14:43:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/sbin/p3scan". Please
contact the authors!
Nov  2 14:43:30 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/var/
Nov  2 14:43:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/var/". Please contact
the authors!
Nov  2 14:43:30 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/var/spool/
Nov  2 14:43:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/var/spool/". Please
contact the authors!
Nov  2 14:43:30 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/var/spool/children/
Nov  2 14:43:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/var/spool/children/".
Please contact the authors!
Nov  2 14:43:30 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/var/spool/p3scan/
Nov  2 14:43:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/var/spool/p3scan/".
Please contact the authors!
Nov  2 14:43:30 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/var/spool/p3scan/children/
Nov  2 14:43:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/var/spool/p3scan/children/".
Please contact the authors!
Nov  2 14:43:31 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/var/spool/p3scannotify/
Nov  2 14:43:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/var/spool/p3scannotify/".
Please contact the authors!
Nov  2 14:43:31 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/var/run/
Nov  2 14:43:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/var/run/". Please
contact the authors!
Nov  2 14:43:31 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/var/run/p3scan/
Nov  2 14:43:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/var/run/p3scan/".
Please contact the authors!
Nov  2 14:43:31 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/var/run/p3scan/p3scan.pid
Nov  2 14:43:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/var/run/p3scan/p3scan.pid".
Please contact the authors!
Nov  2 14:43:31 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/man/
Nov  2 14:43:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/man/". Please contact
the authors!
Nov  2 14:43:31 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/man/man8/
Nov  2 14:43:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/man/man8/". Please
contact the authors!
Nov  2 14:43:31 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/man/man8/p3scan.8.gz
Nov  2 14:43:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/man/man8/p3scan.8.gz".
Please contact the authors!
Nov  2 14:43:31 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/man/man8/p3scan_readme.8.gz

Nov  2 14:43:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/man/man8/p3scan_readme.8.gz".
Please contact the authors!
Nov  2 14:43:31 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/doc/
Nov  2 14:43:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/doc/". Please contact
the authors!
Nov  2 14:43:31 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/doc/p3scan-1.0.99-05dev/
Nov  2 14:43:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/doc/p3scan-1.0.99-05dev/".
Please contact the authors!
Nov  2 14:43:31 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/doc/p3scan-1.0.99-05dev/AUTHORS

Nov  2 14:43:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/doc/p3scan-1.0.99-05dev/AUTHORS".
Please contact the authors!
Nov  2 14:43:31 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/doc/p3scan-1.0.99-05dev/CHANGELOG

Nov  2 14:43:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/doc/p3scan-1.0.99-05dev/CHANGELOG".
Please contact the authors!
Nov  2 14:43:31 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/doc/p3scan-1.0.99-05dev/LICENSE

Nov  2 14:43:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/doc/p3scan-1.0.99-05dev/LICENSE".
Please contact the authors!
Nov  2 14:43:31 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/doc/p3scan-1.0.99-05dev/NEWS

Nov  2 14:43:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/doc/p3scan-1.0.99-05dev/NEWS".
Please contact the authors!
Nov  2 14:43:31 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/doc/p3scan-1.0.99-05dev/README

Nov  2 14:43:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/doc/p3scan-1.0.99-05dev/README".
Please contact the authors!
Nov  2 14:43:31 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/doc/p3scan-1.0.99-05dev/README-rpm

Nov  2 14:43:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/1.0.99-05dev/doc/p3scan-1.0.99-05dev/README-rpm".
Please contact the authors!
Nov  2 14:43:31 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/etc/
Nov  2 14:43:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/p3scan/etc/". Please
contact the authors!
Nov  2 14:43:31 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/etc/p3scan.conf
Nov  2 14:43:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/p3scan/etc/p3scan.conf".
Please contact the authors!
Nov  2 14:43:31 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/etc/p3scan.mail
Nov  2 14:43:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/p3scan/etc/p3scan.mail".
Please contact the authors!
Nov  2 14:43:31 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/etc/init.d/
Nov  2 14:43:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/p3scan/etc/init.d/".
Please contact the authors!
Nov  2 14:43:31 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/etc/init.d/p3scan
Nov  2 14:43:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/etc/init.d/p3scan". Please contact
the authors!
Nov  2 14:43:31 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/etc/init.d/p3scan.org
Nov  2 14:43:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/etc/init.d/p3scan.org". Please
contact the authors!
Nov  2 14:43:31 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/etc/org/
Nov  2 14:43:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/p3scan/etc/org/". Please
contact the authors!
Nov  2 14:43:32 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/etc/org/p3scan.conf.org
Nov  2 14:43:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/etc/org/p3scan.conf.org". Please
contact the authors!
Nov  2 14:43:32 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/etc/org/p3scan.mail.org
Nov  2 14:43:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/p3scan/etc/org/p3scan.mail.org". Please
contact the authors!
Nov  2 14:43:32 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/p3scan/default
Nov  2 14:43:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/p3scan/default". Please
contact the authors!
Nov  2 14:43:32 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/
Nov  2 14:43:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/mail-spamassassin/".
Please contact the authors!
Nov  2 14:43:32 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/default
Nov  2 14:43:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/default". Please contact
the authors!
Nov  2 14:43:32 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/
Nov  2 14:43:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/". Please
contact the authors!
Nov  2 14:43:32 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/
Nov  2 14:43:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/". Please
contact the authors!
Nov  2 14:43:32 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/
Nov  2 14:43:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/".
Please contact the authors!
Nov  2 14:43:32 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/

Nov  2 14:43:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/".
Please contact the authors!
Nov  2 14:43:32 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/

Nov  2 14:43:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/".
Please contact the authors!
Nov  2 14:43:32 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/i386-linux/

Nov  2 14:43:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/i386-linux/".
Please contact the authors!
Nov  2 14:43:32 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/i386-linux/auto/

Nov  2 14:43:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/i386-linux/auto/".
Please contact the authors!
Nov  2 14:43:32 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/i386-linux/auto/Mail/

Nov  2 14:43:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/i386-linux/auto/Mail/".
Please contact the authors!
Nov  2 14:43:32 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/i386-linux/auto/Mail/SpamAssassin/

Nov  2 14:43:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/i386-linux/auto/Mail/SpamAssassin/".
Please contact the authors!
Nov  2 14:43:32 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/i386-linux/auto/Mail/SpamAssassin/.packlist

Nov  2 14:43:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/i386-linux/auto/Mail/SpamAssassin/.packlist".
Please contact the authors!
Nov  2 14:43:32 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/

Nov  2 14:43:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/".
Please contact the authors!
Nov  2 14:43:32 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin.pm

Nov  2 14:43:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin.pm".
Please contact the authors!
Nov  2 14:43:32 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/

Nov  2 14:43:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/".
Please contact the authors!
Nov  2 14:43:32 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/AutoWhitelist.pm

Nov  2 14:43:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/AutoWhitelist.pm".
Please contact the authors!
Nov  2 14:43:32 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Dns.pm

Nov  2 14:43:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Dns.pm".
Please contact the authors!
Nov  2 14:43:32 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/BayesStore.pm

Nov  2 14:43:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/BayesStore.pm".
Please contact the authors!
Nov  2 14:43:32 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Locker.pm

Nov  2 14:43:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Locker.pm".
Please contact the authors!
Nov  2 14:43:32 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/PluginHandler.pm

Nov  2 14:43:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/PluginHandler.pm".
Please contact the authors!
Nov  2 14:43:32 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Conf.pm

Nov  2 14:43:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Conf.pm".
Please contact the authors!
Nov  2 14:43:33 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Util.pm

Nov  2 14:43:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Util.pm".
Please contact the authors!
Nov  2 14:43:33 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Message.pm

Nov  2 14:43:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Message.pm".
Please contact the authors!
Nov  2 14:43:33 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/ArchiveIterator.pm

Nov  2 14:43:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/ArchiveIterator.pm".
Please contact the authors!
Nov  2 14:43:33 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/MailingList.pm

Nov  2 14:43:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/MailingList.pm".
Please contact the authors!
Nov  2 14:43:33 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Reporter.pm

Nov  2 14:43:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Reporter.pm".
Please contact the authors!
Nov  2 14:43:33 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Locales.pm

Nov  2 14:43:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Locales.pm".
Please contact the authors!
Nov  2 14:43:33 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Bayes.pm

Nov  2 14:43:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Bayes.pm".
Please contact the authors!
Nov  2 14:43:33 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/HTML.pm

Nov  2 14:43:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/HTML.pm".
Please contact the authors!
Nov  2 14:43:33 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/DBBasedAddrList.pm

Nov  2 14:43:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/DBBasedAddrList.pm".
Please contact the authors!
Nov  2 14:43:33 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/NetSet.pm

Nov  2 14:43:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/NetSet.pm".
Please contact the authors!
Nov  2 14:43:33 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Constants.pm

Nov  2 14:43:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Constants.pm".
Please contact the authors!
Nov  2 14:43:33 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Plugin.pm

Nov  2 14:43:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Plugin.pm".
Please contact the authors!
Nov  2 14:43:33 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/TextCat.pm

Nov  2 14:43:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/TextCat.pm".
Please contact the authors!
Nov  2 14:43:33 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/PerMsgStatus.pm

Nov  2 14:43:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/PerMsgStatus.pm".
Please contact the authors!
Nov  2 14:43:33 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/PerMsgLearner.pm

Nov  2 14:43:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/PerMsgLearner.pm".
Please contact the authors!
Nov  2 14:43:33 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/EvalTests.pm

Nov  2 14:43:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/EvalTests.pm".
Please contact the authors!
Nov  2 14:43:33 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/SQLBasedAddrList.pm

Nov  2 14:43:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/SQLBasedAddrList.pm".
Please contact the authors!
Nov  2 14:43:33 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/PersistentAddrList.pm

Nov  2 14:43:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/PersistentAddrList.pm".
Please contact the authors!
Nov  2 14:43:33 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Message/

Nov  2 14:43:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Message/".
Please contact the authors!
Nov  2 14:43:33 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Message/Metadata.pm

Nov  2 14:43:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Message/Metadata.pm".
Please contact the authors!
Nov  2 14:43:33 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Message/Node.pm

Nov  2 14:43:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Message/Node.pm".
Please contact the authors!
Nov  2 14:43:33 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Message/Metadata/

Nov  2 14:43:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Message/Metadata/".
Please contact the authors!
Nov  2 14:43:33 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Message/Metadata/Received.pm

Nov  2 14:43:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Message/Metadata/Received.pm".
Please contact the authors!
Nov  2 14:43:34 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Conf/

Nov  2 14:43:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Conf/".
Please contact the authors!
Nov  2 14:43:34 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Conf/Parser.pm

Nov  2 14:43:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Conf/Parser.pm".
Please contact the authors!
Nov  2 14:43:34 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Conf/LDAP.pm

Nov  2 14:43:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Conf/LDAP.pm".
Please contact the authors!
Nov  2 14:43:34 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Conf/SQL.pm

Nov  2 14:43:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Conf/SQL.pm".
Please contact the authors!
Nov  2 14:43:34 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Conf/Parser.pm.old

Nov  2 14:43:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Conf/Parser.pm.old".
Please contact the authors!
Nov  2 14:43:34 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/BayesStore/

Nov  2 14:43:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/BayesStore/".
Please contact the authors!
Nov  2 14:43:34 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/BayesStore/DBM.pm

Nov  2 14:43:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/BayesStore/DBM.pm".
Please contact the authors!
Nov  2 14:43:34 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/BayesStore/SQL.pm

Nov  2 14:43:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/BayesStore/SQL.pm".
Please contact the authors!
Nov  2 14:43:34 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Plugin/

Nov  2 14:43:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Plugin/".
Please contact the authors!
Nov  2 14:43:34 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Plugin/Hashcash.pm

Nov  2 14:43:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Plugin/Hashcash.pm".
Please contact the authors!
Nov  2 14:43:34 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Plugin/SPF.pm

Nov  2 14:43:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Plugin/SPF.pm".
Please contact the authors!
Nov  2 14:43:34 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Plugin/URIDNSBL.pm

Nov  2 14:43:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Plugin/URIDNSBL.pm".
Please contact the authors!
Nov  2 14:43:34 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Plugin/Test.pm

Nov  2 14:43:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Plugin/Test.pm".
Please contact the authors!
Nov  2 14:43:34 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Plugin/RelayCountry.pm

Nov  2 14:43:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Plugin/RelayCountry.pm".
Please contact the authors!
Nov  2 14:43:34 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Locker/

Nov  2 14:43:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Locker/".
Please contact the authors!
Nov  2 14:43:34 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Locker/Flock.pm

Nov  2 14:43:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Locker/Flock.pm".
Please contact the authors!
Nov  2 14:43:34 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Locker/UnixNFSSafe.pm

Nov  2 14:43:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Locker/UnixNFSSafe.pm".
Please contact the authors!
Nov  2 14:43:34 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Locker/Win32.pm

Nov  2 14:43:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Locker/Win32.pm".
Please contact the authors!
Nov  2 14:43:34 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Util/

Nov  2 14:43:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Util/".
Please contact the authors!
Nov  2 14:43:34 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Util/RegistrarBoundaries.pm

Nov  2 14:43:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Util/RegistrarBoundaries.pm".
Please contact the authors!
Nov  2 14:43:34 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Conf.pm.org

Nov  2 14:43:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/Conf.pm.org".
Please contact the authors!
Nov  2 14:43:34 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/5.8.2/
Nov  2 14:43:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/5.8.2/".
Please contact the authors!
Nov  2 14:43:34 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/5.8.2/i386-linux/

Nov  2 14:43:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/5.8.2/i386-linux/".
Please contact the authors!
Nov  2 14:43:34 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/5.8.2/i386-linux/perllocal.pod

Nov  2 14:43:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/lib/perl5/5.8.2/i386-linux/perllocal.pod".
Please contact the authors!
Nov  2 14:43:34 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/
Nov  2 14:43:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/".
Please contact the authors!
Nov  2 14:43:35 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/
Nov  2 14:43:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/".
Please contact the authors!
Nov  2 14:43:35 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man1/
Nov  2 14:43:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man1/".
Please contact the authors!
Nov  2 14:43:35 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man1/sa-learn.1

Nov  2 14:43:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man1/sa-learn.1".
Please contact the authors!
Nov  2 14:43:35 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man1/spamassassin.1

Nov  2 14:43:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man1/spamassassin.1".
Please contact the authors!
Nov  2 14:43:35 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man1/spamd.1

Nov  2 14:43:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man1/spamd.1".
Please contact the authors!
Nov  2 14:43:35 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man1/spamc.1

Nov  2 14:43:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man1/spamc.1".
Please contact the authors!
Nov  2 14:43:35 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/
Nov  2 14:43:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/".
Please contact the authors!
Nov  2 14:43:35 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::AutoWhitelist.3

Nov  2 14:43:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::AutoWhitelist.3".
Please contact the authors!
Nov  2 14:43:35 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::Plugin.3

Nov  2 14:43:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::Plugin.3".
Please contact the authors!
Nov  2 14:43:35 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::Plugin::Hashcash.3

Nov  2 14:43:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::Plugin::Hashcash.3".
Please contact the authors!
Nov  2 14:43:35 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::Message::Metadata.3

Nov  2 14:43:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::Message::Metadata.3".
Please contact the authors!
Nov  2 14:43:35 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::BayesStore::SQL.3

Nov  2 14:43:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::BayesStore::SQL.3".
Please contact the authors!
Nov  2 14:43:35 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin.3

Nov  2 14:43:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin.3".
Please contact the authors!
Nov  2 14:43:35 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::BayesStore.3

Nov  2 14:43:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::BayesStore.3".
Please contact the authors!
Nov  2 14:43:35 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::Plugin::SPF.3

Nov  2 14:43:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::Plugin::SPF.3".
Please contact the authors!
Nov  2 14:43:35 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::Message::Node.3

Nov  2 14:43:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::Message::Node.3".
Please contact the authors!
Nov  2 14:43:35 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::PluginHandler.3

Nov  2 14:43:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::PluginHandler.3".
Please contact the authors!
Nov  2 14:43:35 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::Conf::SQL.3

Nov  2 14:43:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::Conf::SQL.3".
Please contact the authors!
Nov  2 14:43:35 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::Conf.3

Nov  2 14:43:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::Conf.3".
Please contact the authors!
Nov  2 14:43:35 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::PerMsgStatus.3

Nov  2 14:43:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::PerMsgStatus.3".
Please contact the authors!
Nov  2 14:43:35 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::Message.3

Nov  2 14:43:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::Message.3".
Please contact the authors!
Nov  2 14:43:35 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::PerMsgLearner.3

Nov  2 14:43:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::PerMsgLearner.3".
Please contact the authors!
Nov  2 14:43:35 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::SQLBasedAddrList.3

Nov  2 14:43:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::SQLBasedAddrList.3".
Please contact the authors!
Nov  2 14:43:36 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::Conf::Parser.3

Nov  2 14:43:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::Conf::Parser.3".
Please contact the authors!
Nov  2 14:43:36 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::Plugin::URIDNSBL.3

Nov  2 14:43:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::Plugin::URIDNSBL.3".
Please contact the authors!
Nov  2 14:43:36 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::Conf::LDAP.3

Nov  2 14:43:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::Conf::LDAP.3".
Please contact the authors!
Nov  2 14:43:36 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::PersistentAddrList.3

Nov  2 14:43:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::PersistentAddrList.3".
Please contact the authors!
Nov  2 14:43:36 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::Bayes.3

Nov  2 14:43:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::Bayes.3".
Please contact the authors!
Nov  2 14:43:36 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::Plugin::RelayCountry.3

Nov  2 14:43:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/man/man3/Mail::SpamAssassin::Plugin::RelayCountry.3".
Please contact the authors!
Nov  2 14:43:36 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/

Nov  2 14:43:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/".
Please contact the authors!
Nov  2 14:43:36 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/10_misc.cf

Nov  2 14:43:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/10_misc.cf".
Please contact the authors!
Nov  2 14:43:36 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/20_anti_ratware.cf

Nov  2 14:43:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/20_anti_ratware.cf".
Please contact the authors!
Nov  2 14:43:36 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/20_body_tests.cf

Nov  2 14:43:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/20_body_tests.cf".
Please contact the authors!
Nov  2 14:43:36 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/20_compensate.cf

Nov  2 14:43:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/20_compensate.cf".
Please contact the authors!
Nov  2 14:43:36 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/20_dnsbl_tests.cf

Nov  2 14:43:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/20_dnsbl_tests.cf".
Please contact the authors!
Nov  2 14:43:36 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/20_drugs.cf

Nov  2 14:43:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/20_drugs.cf".
Please contact the authors!
Nov  2 14:43:36 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/20_fake_helo_tests.cf

Nov  2 14:43:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/20_fake_helo_tests.cf".
Please contact the authors!
Nov  2 14:43:36 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/20_head_tests.cf

Nov  2 14:43:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/20_head_tests.cf".
Please contact the authors!
Nov  2 14:43:36 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/20_html_tests.cf

Nov  2 14:43:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/20_html_tests.cf".
Please contact the authors!
Nov  2 14:43:36 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/20_meta_tests.cf

Nov  2 14:43:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/20_meta_tests.cf".
Please contact the authors!
Nov  2 14:43:36 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/20_phrases.cf

Nov  2 14:43:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/20_phrases.cf".
Please contact the authors!
Nov  2 14:43:36 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/20_porn.cf

Nov  2 14:43:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/20_porn.cf".
Please contact the authors!
Nov  2 14:43:36 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/20_ratware.cf

Nov  2 14:43:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/20_ratware.cf".
Please contact the authors!
Nov  2 14:43:36 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/20_uri_tests.cf

Nov  2 14:43:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/20_uri_tests.cf".
Please contact the authors!
Nov  2 14:43:36 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/23_bayes.cf

Nov  2 14:43:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/23_bayes.cf".
Please contact the authors!
Nov  2 14:43:37 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/25_body_tests_es.cf

Nov  2 14:43:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/25_body_tests_es.cf".
Please contact the authors!
Nov  2 14:43:37 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/25_hashcash.cf

Nov  2 14:43:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/25_hashcash.cf".
Please contact the authors!
Nov  2 14:43:37 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/25_spf.cf

Nov  2 14:43:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/25_spf.cf".
Please contact the authors!
Nov  2 14:43:37 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/25_uribl.cf

Nov  2 14:43:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/25_uribl.cf".
Please contact the authors!
Nov  2 14:43:37 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/30_text_de.cf

Nov  2 14:43:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/30_text_de.cf".
Please contact the authors!
Nov  2 14:43:37 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/30_text_fr.cf

Nov  2 14:43:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/30_text_fr.cf".
Please contact the authors!
Nov  2 14:43:37 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/30_text_nl.cf

Nov  2 14:43:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/30_text_nl.cf".
Please contact the authors!
Nov  2 14:43:37 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/30_text_pl.cf

Nov  2 14:43:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/30_text_pl.cf".
Please contact the authors!
Nov  2 14:43:37 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/50_scores.cf

Nov  2 14:43:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/50_scores.cf".
Please contact the authors!
Nov  2 14:43:37 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/60_whitelist.cf

Nov  2 14:43:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/60_whitelist.cf".
Please contact the authors!
Nov  2 14:43:37 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/user_prefs.template

Nov  2 14:43:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/user_prefs.template".
Please contact the authors!
Nov  2 14:43:37 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/triplets.txt

Nov  2 14:43:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/triplets.txt".
Please contact the authors!
Nov  2 14:43:37 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/languages

Nov  2 14:43:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/share/spamassassin/languages".
Please contact the authors!
Nov  2 14:43:37 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/bin/
Nov  2 14:43:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/bin/". Please
contact the authors!
Nov  2 14:43:37 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/bin/spamc
Nov  2 14:43:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/bin/spamc".
Please contact the authors!
Nov  2 14:43:37 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/bin/sa-learn
Nov  2 14:43:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/bin/sa-learn".
Please contact the authors!
Nov  2 14:43:37 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/bin/spamassassin
Nov  2 14:43:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/bin/spamassassin".
Please contact the authors!
Nov  2 14:43:37 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/bin/spamd
Nov  2 14:43:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/3.0.0-rc1/bin/spamd".
Please contact the authors!
Nov  2 14:43:37 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/
Nov  2 14:43:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/".
Please contact the authors!
Nov  2 14:43:37 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/
Nov  2 14:43:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/". Please
contact the authors!
Nov  2 14:43:37 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/
Nov  2 14:43:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/".
Please contact the authors!
Nov  2 14:43:37 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/local.cf

Nov  2 14:43:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/local.cf".
Please contact the authors!
Nov  2 14:43:37 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/init.pre

Nov  2 14:43:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/init.pre".
Please contact the authors!
Nov  2 14:43:37 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/local.cf.orig

Nov  2 14:43:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/local.cf.orig".
Please contact the authors!
Nov  2 14:43:37 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/not_used/

Nov  2 14:43:38 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/not_used/".
Please contact the authors!
Nov  2 14:43:38 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/not_used/local_cf_modified_html_scores

Nov  2 14:43:38 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/not_used/local_cf_modified_html_scores".
Please contact the authors!
Nov  2 14:43:38 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/not_used/local_cf_org

Nov  2 14:43:38 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/not_used/local_cf_org".
Please contact the authors!
Nov  2 14:43:38 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/not_used/backhair.cf

Nov  2 14:43:38 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/not_used/backhair.cf".
Please contact the authors!
Nov  2 14:43:38 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/not_used/chickenpox.cf

Nov  2 14:43:38 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/not_used/chickenpox.cf".
Please contact the authors!
Nov  2 14:43:38 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/not_used/weeds.cf

Nov  2 14:43:38 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/not_used/weeds.cf".
Please contact the authors!
Nov  2 14:43:38 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/not_used/weeds2.cf

Nov  2 14:43:38 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/not_used/weeds2.cf".
Please contact the authors!
Nov  2 14:43:38 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/not_used/french_rules.cf

Nov  2 14:43:38 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/not_used/french_rules.cf".
Please contact the authors!
Nov  2 14:43:38 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/not_used/cf_files_increases_spamassassin_memory_requirements_if_used/

Nov  2 14:43:38 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/not_used/cf_files_increases_spamassassin_memory_requirements_if_used/".
Please contact the authors!
Nov  2 14:43:38 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/not_used/cf_files_increases_spamassassin_memory_requirements_if_used/blacklist-uri.cf

Nov  2 14:43:38 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/not_used/cf_files_increases_spamassassin_memory_requirements_if_used/blacklist-uri.cf".
Please contact the authors!
Nov  2 14:43:38 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/not_used/cf_files_increases_spamassassin_memory_requirements_if_used/bigevil.cf

Nov  2 14:43:38 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/not_used/cf_files_increases_spamassassin_memory_requirements_if_used/bigevil.cf".
Please contact the authors!
Nov  2 14:43:38 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/FREQS
Nov  2 14:43:38 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/FREQS".
Please contact the authors!
Nov  2 14:43:38 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/ISSUES
Nov  2 14:43:38 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/ISSUES".
Please contact the authors!
Nov  2 14:43:38 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/local.cf.copfilter

Nov  2 14:43:38 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/local.cf.copfilter".
Please contact the authors!
Nov  2 14:43:38 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/

Nov  2 14:43:38 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/".
Please contact the authors!
Nov  2 14:43:38 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/25_body_tests_de.cf

Nov  2 14:43:38 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/25_body_tests_de.cf".
Please contact the authors!
Nov  2 14:43:38 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/25_head_tests_de.cf

Nov  2 14:43:38 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/25_head_tests_de.cf".
Please contact the authors!
Nov  2 14:43:38 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/25_uri_tests_de.cf

Nov  2 14:43:38 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/25_uri_tests_de.cf".
Please contact the authors!
Nov  2 14:43:38 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/55_scores_de.cf

Nov  2 14:43:38 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/55_scores_de.cf".
Please contact the authors!
Nov  2 14:43:38 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/70_sare_adult.cf

Nov  2 14:43:38 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/70_sare_adult.cf".
Please contact the authors!
Nov  2 14:43:38 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/70_sare_ratware.cf

Nov  2 14:43:38 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/70_sare_ratware.cf".
Please contact the authors!
Nov  2 14:43:38 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/70_sare_specific.cf

Nov  2 14:43:38 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/70_sare_specific.cf".
Please contact the authors!
Nov  2 14:43:38 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/72_sare_bml_post25x.cf

Nov  2 14:43:38 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/72_sare_bml_post25x.cf".
Please contact the authors!
Nov  2 14:43:38 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/99_sare_adult.cf

Nov  2 14:43:39 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/99_sare_adult.cf".
Please contact the authors!
Nov  2 14:43:39 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/99_sare_biz_market_learn_post25x.cf

Nov  2 14:43:39 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/99_sare_biz_market_learn_post25x.cf".
Please contact the authors!
Nov  2 14:43:39 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/99_sare_fraud_post25x.cf

Nov  2 14:43:39 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/99_sare_fraud_post25x.cf".
Please contact the authors!
Nov  2 14:43:39 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/antidrug.cf

Nov  2 14:43:39 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/antidrug.cf".
Please contact the authors!
Nov  2 14:43:39 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/backhair.cf

Nov  2 14:43:39 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/backhair.cf".
Please contact the authors!
Nov  2 14:43:39 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/chickenpox.cf

Nov  2 14:43:39 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/chickenpox.cf".
Please contact the authors!
Nov  2 14:43:39 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/evilnumbers.cf

Nov  2 14:43:39 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/evilnumbers.cf".
Please contact the authors!
Nov  2 14:43:39 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/french_rules.cf

Nov  2 14:43:39 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/french_rules.cf".
Please contact the authors!
Nov  2 14:43:39 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/local.cf

Nov  2 14:43:39 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/local.cf".
Please contact the authors!
Nov  2 14:43:39 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/mr_wiggly.cf

Nov  2 14:43:39 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/mr_wiggly.cf".
Please contact the authors!
Nov  2 14:43:39 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/random.cf

Nov  2 14:43:39 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/random.cf".
Please contact the authors!
Nov  2 14:43:39 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/tripwire.cf

Nov  2 14:43:39 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/tripwire.cf".
Please contact the authors!
Nov  2 14:43:39 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/weeds2.cf

Nov  2 14:43:39 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/improve_spam_detection/weeds2.cf".
Please contact the authors!
Nov  2 14:43:39 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/RulesDuJour/

Nov  2 14:43:39 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/mail/spamassassin/RulesDuJour/".
Please contact the authors!
Nov  2 14:43:39 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/init.d/
Nov  2 14:43:39 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/init.d/". Please
contact the authors!
Nov  2 14:43:39 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/init.d/spamd
Nov  2 14:43:39 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/init.d/spamd".
Please contact the authors!
Nov  2 14:43:39 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/.spamassassin/
Nov  2 14:43:39 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/.spamassassin/".
Please contact the authors!
Nov  2 14:43:39 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/.spamassassin/auto-whitelist

Nov  2 14:43:39 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/mail-spamassassin/etc/.spamassassin/auto-whitelist".
Please contact the authors!
Nov  2 14:43:39 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/
Nov  2 14:43:39 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/razor-agents/". Please
contact the authors!
Nov  2 14:43:39 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/
Nov  2 14:43:39 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/razor-agents/2.61/".
Please contact the authors!
Nov  2 14:43:39 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/
Nov  2 14:43:39 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/".
Please contact the authors!
Nov  2 14:43:39 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/
Nov  2 14:43:39 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/". Please
contact the authors!
Nov  2 14:43:39 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/
Nov  2 14:43:39 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/".
Please contact the authors!
Nov  2 14:43:39 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/
Nov  2 14:43:39 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/".
Please contact the authors!
Nov  2 14:43:40 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/

Nov  2 14:43:40 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/".
Please contact the authors!
Nov  2 14:43:40 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/auto/

Nov  2 14:43:40 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/auto/".
Please contact the authors!
Nov  2 14:43:40 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/auto/Razor2/

Nov  2 14:43:40 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/auto/Razor2/".
Please contact the authors!
Nov  2 14:43:40 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/auto/Razor2/Preproc/

Nov  2 14:43:40 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/auto/Razor2/Preproc/".
Please contact the authors!
Nov  2 14:43:40 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/auto/Razor2/Preproc/deHTMLxs/

Nov  2 14:43:40 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/auto/Razor2/Preproc/deHTMLxs/".
Please contact the authors!
Nov  2 14:43:40 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/auto/Razor2/Preproc/deHTMLxs/deHTMLxs.so

Nov  2 14:43:40 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/auto/Razor2/Preproc/deHTMLxs/deHTMLxs.so".
Please contact the authors!
Nov  2 14:43:40 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/auto/Razor2/Preproc/deHTMLxs/deHTMLxs.bs

Nov  2 14:43:40 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/auto/Razor2/Preproc/deHTMLxs/deHTMLxs.bs".
Please contact the authors!
Nov  2 14:43:40 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/auto/Razor2/Preproc/deHTMLxs/autosplit.ix

Nov  2 14:43:40 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/auto/Razor2/Preproc/deHTMLxs/autosplit.ix".
Please contact the authors!
Nov  2 14:43:40 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/auto/Razor2/Syslog/

Nov  2 14:43:40 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/auto/Razor2/Syslog/".
Please contact the authors!
Nov  2 14:43:40 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/auto/Razor2/Syslog/autosplit.ix

Nov  2 14:43:40 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/auto/Razor2/Syslog/autosplit.ix".
Please contact the authors!
Nov  2 14:43:40 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/auto/razor-agents/

Nov  2 14:43:40 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/auto/razor-agents/".
Please contact the authors!
Nov  2 14:43:40 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/auto/razor-agents/.packlist

Nov  2 14:43:40 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/auto/razor-agents/.packlist".
Please contact the authors!
Nov  2 14:43:40 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/

Nov  2 14:43:40 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/".
Please contact the authors!
Nov  2 14:43:40 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Logger.pm

Nov  2 14:43:40 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Logger.pm".
Please contact the authors!
Nov  2 14:43:40 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/String.pm

Nov  2 14:43:40 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/String.pm".
Please contact the authors!
Nov  2 14:43:40 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Errorhandler.pm

Nov  2 14:43:40 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Errorhandler.pm".
Please contact the authors!
Nov  2 14:43:40 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Syslog.pm

Nov  2 14:43:40 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Syslog.pm".
Please contact the authors!
Nov  2 14:43:40 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Signature/

Nov  2 14:43:40 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Signature/".
Please contact the authors!
Nov  2 14:43:40 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Signature/Whiplash.pm

Nov  2 14:43:40 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Signature/Whiplash.pm".
Please contact the authors!
Nov  2 14:43:40 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Signature/Ephemeral.pm

Nov  2 14:43:40 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Signature/Ephemeral.pm".
Please contact the authors!
Nov  2 14:43:40 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Preproc/

Nov  2 14:43:40 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Preproc/".
Please contact the authors!
Nov  2 14:43:40 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Preproc/deBase64.pm

Nov  2 14:43:40 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Preproc/deBase64.pm".
Please contact the authors!
Nov  2 14:43:40 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Preproc/deQP.pm

Nov  2 14:43:40 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Preproc/deQP.pm".
Please contact the authors!
Nov  2 14:43:40 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Preproc/deNewline.pm

Nov  2 14:43:40 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Preproc/deNewline.pm".
Please contact the authors!
Nov  2 14:43:41 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Preproc/enBase64.pm

Nov  2 14:43:41 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Preproc/enBase64.pm".
Please contact the authors!
Nov  2 14:43:41 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Preproc/Manager.pm

Nov  2 14:43:41 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Preproc/Manager.pm".
Please contact the authors!
Nov  2 14:43:41 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Preproc/deHTML.pm

Nov  2 14:43:41 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Preproc/deHTML.pm".
Please contact the authors!
Nov  2 14:43:41 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Preproc/deHTMLxs.pm

Nov  2 14:43:41 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Preproc/deHTMLxs.pm".
Please contact the authors!
Nov  2 14:43:41 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Client/

Nov  2 14:43:41 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Client/".
Please contact the authors!
Nov  2 14:43:41 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Client/Core.pm

Nov  2 14:43:41 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Client/Core.pm".
Please contact the authors!
Nov  2 14:43:41 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Client/Version.pm

Nov  2 14:43:41 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Client/Version.pm".
Please contact the authors!
Nov  2 14:43:41 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Client/Config.pm

Nov  2 14:43:41 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Client/Config.pm".
Please contact the authors!
Nov  2 14:43:41 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Client/Agent.pm

Nov  2 14:43:41 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Client/Agent.pm".
Please contact the authors!
Nov  2 14:43:41 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Client/Engine.pm

Nov  2 14:43:41 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Client/Engine.pm".
Please contact the authors!
Nov  2 14:43:41 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Engine/

Nov  2 14:43:41 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Engine/".
Please contact the authors!
Nov  2 14:43:41 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Engine/VR8.pm

Nov  2 14:43:41 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/site_perl/5.8.2/i386-linux/Razor2/Engine/VR8.pm".
Please contact the authors!
Nov  2 14:43:41 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/5.8.2/
Nov  2 14:43:41 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/5.8.2/".
Please contact the authors!
Nov  2 14:43:41 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/5.8.2/i386-linux/
Nov  2 14:43:41 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/5.8.2/i386-linux/".
Please contact the authors!
Nov  2 14:43:41 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/5.8.2/i386-linux/perllocal.pod

Nov  2 14:43:41 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/lib/perl5/5.8.2/i386-linux/perllocal.pod".
Please contact the authors!
Nov  2 14:43:41 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/share/
Nov  2 14:43:41 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/share/". Please contact
the authors!
Nov  2 14:43:41 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/share/man/
Nov  2 14:43:41 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/share/man/". Please
contact the authors!
Nov  2 14:43:41 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/share/man/man1/
Nov  2 14:43:41 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/share/man/man1/". Please
contact the authors!
Nov  2 14:43:41 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/share/man/man1/razor-check.1
Nov  2 14:43:41 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/share/man/man1/razor-check.1".
Please contact the authors!
Nov  2 14:43:41 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/share/man/man1/razor-admin.1
Nov  2 14:43:41 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/share/man/man1/razor-admin.1".
Please contact the authors!
Nov  2 14:43:41 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/share/man/man1/razor-report.1

Nov  2 14:43:41 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/share/man/man1/razor-report.1".
Please contact the authors!
Nov  2 14:43:41 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/share/man/man1/razor-revoke.1

Nov  2 14:43:41 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/share/man/man1/razor-revoke.1".
Please contact the authors!
Nov  2 14:43:41 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/share/man/man3/
Nov  2 14:43:41 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/share/man/man3/". Please
contact the authors!
Nov  2 14:43:41 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/share/man/man3/Razor2::Preproc::deHTMLxs.3

Nov  2 14:43:41 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/share/man/man3/Razor2::Preproc::deHTMLxs.3".
Please contact the authors!
Nov  2 14:43:42 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/share/man/man3/Razor2::Syslog.3

Nov  2 14:43:42 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/share/man/man3/Razor2::Syslog.3".
Please contact the authors!
Nov  2 14:43:42 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/share/man/man3/Razor2::Errorhandler.3

Nov  2 14:43:42 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/share/man/man3/Razor2::Errorhandler.3".
Please contact the authors!
Nov  2 14:43:42 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/man/
Nov  2 14:43:42 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/razor-agents/2.61/man/".
Please contact the authors!
Nov  2 14:43:42 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/man/man5/
Nov  2 14:43:42 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/man/man5/". Please
contact the authors!
Nov  2 14:43:42 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/man/man5/razor-agent.conf.5
Nov  2 14:43:42 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/man/man5/razor-agent.conf.5".
Please contact the authors!
Nov  2 14:43:42 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/man/man5/razor-agents.5
Nov  2 14:43:42 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/man/man5/razor-agents.5".
Please contact the authors!
Nov  2 14:43:42 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/man/man5/razor-whitelist.5
Nov  2 14:43:42 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/man/man5/razor-whitelist.5".
Please contact the authors!
Nov  2 14:43:42 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/
Nov  2 14:43:42 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/".
Please contact the authors!
Nov  2 14:43:42 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/razor-client
Nov  2 14:43:42 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/razor-client".
Please contact the authors!
Nov  2 14:43:42 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/razor-check
Nov  2 14:43:42 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/razor-check". Please
contact the authors!
Nov  2 14:43:42 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/razor-report
Nov  2 14:43:42 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/razor-report".
Please contact the authors!
Nov  2 14:43:42 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/razor-revoke
Nov  2 14:43:42 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/razor-revoke".
Please contact the authors!
Nov  2 14:43:42 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/razor-admin
Nov  2 14:43:42 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/razor-admin". Please
contact the authors!
Nov  2 14:43:42 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/
Nov  2 14:43:42 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/". Please
contact the authors!
Nov  2 14:43:42 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Logger.pm
Nov  2 14:43:42 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Logger.pm".
Please contact the authors!
Nov  2 14:43:42 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/String.pm
Nov  2 14:43:42 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/String.pm".
Please contact the authors!
Nov  2 14:43:42 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Errorhandler.pm
Nov  2 14:43:42 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Errorhandler.pm".
Please contact the authors!
Nov  2 14:43:42 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Syslog.pm
Nov  2 14:43:42 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Syslog.pm".
Please contact the authors!
Nov  2 14:43:42 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Preproc/
Nov  2 14:43:42 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Preproc/".
Please contact the authors!
Nov  2 14:43:42 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Preproc/deBase64.pm

Nov  2 14:43:42 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Preproc/deBase64.pm".
Please contact the authors!
Nov  2 14:43:42 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Preproc/deQP.pm
Nov  2 14:43:42 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Preproc/deQP.pm".
Please contact the authors!
Nov  2 14:43:42 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Preproc/VR1.pm
Nov  2 14:43:42 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Preproc/VR1.pm".
Please contact the authors!
Nov  2 14:43:42 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Preproc/deNewline.pm

Nov  2 14:43:42 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Preproc/deNewline.pm".
Please contact the authors!
Nov  2 14:43:43 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Preproc/enBase64.pm

Nov  2 14:43:43 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Preproc/enBase64.pm".
Please contact the authors!
Nov  2 14:43:43 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Preproc/Manager.pm

Nov  2 14:43:43 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Preproc/Manager.pm".
Please contact the authors!
Nov  2 14:43:43 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Preproc/deHTML.pm
Nov  2 14:43:43 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Preproc/deHTML.pm".
Please contact the authors!
Nov  2 14:43:43 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Preproc/deHTMLxs.pm

Nov  2 14:43:43 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Preproc/deHTMLxs.pm".
Please contact the authors!
Nov  2 14:43:43 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Client/
Nov  2 14:43:43 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Client/".
Please contact the authors!
Nov  2 14:43:43 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Client/Core.pm
Nov  2 14:43:43 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Client/Core.pm".
Please contact the authors!
Nov  2 14:43:43 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Client/Version.pm
Nov  2 14:43:43 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Client/Version.pm".
Please contact the authors!
Nov  2 14:43:43 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Client/Config.pm
Nov  2 14:43:43 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Client/Config.pm".
Please contact the authors!
Nov  2 14:43:43 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Client/Agent.pm
Nov  2 14:43:43 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Client/Agent.pm".
Please contact the authors!
Nov  2 14:43:43 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Client/Engine.pm
Nov  2 14:43:43 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Client/Engine.pm".
Please contact the authors!
Nov  2 14:43:43 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Signature/
Nov  2 14:43:43 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Signature/".
Please contact the authors!
Nov  2 14:43:43 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Signature/Ephemeral.pm

Nov  2 14:43:43 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/razor-agents/2.61/bin/Razor2/Signature/Ephemeral.pm".
Please contact the authors!
Nov  2 14:43:43 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/razor-agents/default
Nov  2 14:43:43 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/razor-agents/default".
Please contact the authors!
Nov  2 14:43:43 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/
Nov  2 14:43:43 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/dcc-dccd/". Please
contact the authors!
Nov  2 14:43:43 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/bin/
Nov  2 14:43:43 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/dcc-dccd/bin/". Please
contact the authors!
Nov  2 14:43:43 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/bin/cdcc
Nov  2 14:43:43 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/dcc-dccd/bin/cdcc".
Please contact the authors!
Nov  2 14:43:43 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/bin/dccproc
Nov  2 14:43:43 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/dcc-dccd/bin/dccproc".
Please contact the authors!
Nov  2 14:43:43 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/
Nov  2 14:43:43 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/".
Please contact the authors!
Nov  2 14:43:43 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/dccsight
Nov  2 14:43:43 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/dccsight". Please contact
the authors!
Nov  2 14:43:43 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/wlist
Nov  2 14:43:43 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/wlist".
Please contact the authors!
Nov  2 14:43:43 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/cron-dccd
Nov  2 14:43:43 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/cron-dccd". Please
contact the authors!
Nov  2 14:43:43 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/fetch-testmsg-whitelist
Nov  2 14:43:43 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/fetch-testmsg-whitelist".
Please contact the authors!
Nov  2 14:43:43 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/hackmc
Nov  2 14:43:43 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/hackmc". Please contact
the authors!
Nov  2 14:43:43 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/logger
Nov  2 14:43:43 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/logger". Please contact
the authors!
Nov  2 14:43:44 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/newwebuser
Nov  2 14:43:44 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/newwebuser". Please
contact the authors!
Nov  2 14:43:44 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/rcDCC
Nov  2 14:43:44 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/rcDCC".
Please contact the authors!
Nov  2 14:43:44 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/start-dccd
Nov  2 14:43:44 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/start-dccd". Please
contact the authors!
Nov  2 14:43:44 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/start-grey
Nov  2 14:43:44 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/start-grey". Please
contact the authors!
Nov  2 14:43:44 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/start-dccifd
Nov  2 14:43:44 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/start-dccifd". Please
contact the authors!
Nov  2 14:43:44 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/start-dccm
Nov  2 14:43:44 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/start-dccm". Please
contact the authors!
Nov  2 14:43:44 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/stop-dccd
Nov  2 14:43:44 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/stop-dccd". Please
contact the authors!
Nov  2 14:43:44 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/dcc-stats-collect
Nov  2 14:43:44 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/dcc-stats-collect".
Please contact the authors!
Nov  2 14:43:44 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/stats-get
Nov  2 14:43:44 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/stats-get". Please
contact the authors!
Nov  2 14:43:44 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/dcc-stats-graph
Nov  2 14:43:44 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/dcc-stats-graph". Please
contact the authors!
Nov  2 14:43:44 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/dcc-stats-init
Nov  2 14:43:44 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/dcc-stats-init". Please
contact the authors!
Nov  2 14:43:44 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/updatedcc
Nov  2 14:43:44 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/dcc-dccd/libexec/updatedcc". Please
contact the authors!
Nov  2 14:43:44 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/log/
Nov  2 14:43:44 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/dcc-dccd/log/". Please
contact the authors!
Nov  2 14:43:44 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/map.txt
Nov  2 14:43:44 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/dcc-dccd/map.txt".
Please contact the authors!
Nov  2 14:43:44 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/flod
Nov  2 14:43:44 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/dcc-dccd/flod". Please
contact the authors!
Nov  2 14:43:44 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/grey_flod
Nov  2 14:43:44 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/dcc-dccd/grey_flod".
Please contact the authors!
Nov  2 14:43:44 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/whitelist
Nov  2 14:43:44 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/dcc-dccd/whitelist".
Please contact the authors!
Nov  2 14:43:44 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/grey_whitelist
Nov  2 14:43:44 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/dcc-dccd/grey_whitelist". Please contact
the authors!
Nov  2 14:43:44 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/whiteclnt
Nov  2 14:43:44 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/dcc-dccd/whiteclnt".
Please contact the authors!
Nov  2 14:43:44 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/whitecommon
Nov  2 14:43:44 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/dcc-dccd/whitecommon".
Please contact the authors!
Nov  2 14:43:44 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/ids
Nov  2 14:43:44 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/dcc-dccd/ids". Please
contact the authors!
Nov  2 14:43:44 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/map
Nov  2 14:43:44 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/dcc-dccd/map". Please
contact the authors!
Nov  2 14:43:44 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/cgi-bin/
Nov  2 14:43:44 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/dcc-dccd/cgi-bin/".
Please contact the authors!
Nov  2 14:43:45 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/cgi-bin/chgpasswd
Nov  2 14:43:45 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/dcc-dccd/cgi-bin/chgpasswd". Please
contact the authors!
Nov  2 14:43:45 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/cgi-bin/edit-whiteclnt
Nov  2 14:43:45 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/dcc-dccd/cgi-bin/edit-whiteclnt". Please
contact the authors!
Nov  2 14:43:45 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/cgi-bin/list-log
Nov  2 14:43:45 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/dcc-dccd/cgi-bin/list-log". Please contact
the authors!
Nov  2 14:43:45 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/cgi-bin/list-msg
Nov  2 14:43:45 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/dcc-dccd/cgi-bin/list-msg". Please contact
the authors!
Nov  2 14:43:45 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/cgi-bin/http2https
Nov  2 14:43:45 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/dcc-dccd/cgi-bin/http2https". Please
contact the authors!
Nov  2 14:43:45 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/cgi-bin/README
Nov  2 14:43:45 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/dcc-dccd/cgi-bin/README". Please contact
the authors!
Nov  2 14:43:45 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/cgi-bin/common
Nov  2 14:43:45 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/dcc-dccd/cgi-bin/common". Please contact
the authors!
Nov  2 14:43:45 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/cgi-bin/webuser-notify
Nov  2 14:43:45 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/dcc-dccd/cgi-bin/webuser-notify". Please
contact the authors!
Nov  2 14:43:45 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/dcc-dccd/dcc_conf
Nov  2 14:43:45 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/dcc-dccd/dcc_conf".
Please contact the authors!
Nov  2 14:43:45 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/
Nov  2 14:43:45 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/". Please
contact the authors!
Nov  2 14:43:45 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/
Nov  2 14:43:45 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/". Please contact
the authors!
Nov  2 14:43:45 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/
Nov  2 14:43:45 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/". Please
contact the authors!
Nov  2 14:43:45 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/IO-stringy/
Nov  2 14:43:45 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/IO-stringy/".
Please contact the authors!
Nov  2 14:43:45 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/IO-stringy/.packlist

Nov  2 14:43:45 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/IO-stringy/.packlist".
Please contact the authors!
Nov  2 14:43:45 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/MIME-tools/
Nov  2 14:43:45 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/MIME-tools/".
Please contact the authors!
Nov  2 14:43:45 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/MIME-tools/.packlist

Nov  2 14:43:45 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/MIME-tools/.packlist".
Please contact the authors!
Nov  2 14:43:45 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Mail/
Nov  2 14:43:45 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Mail/".
Please contact the authors!
Nov  2 14:43:45 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Mail/Audit/
Nov  2 14:43:45 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Mail/Audit/".
Please contact the authors!
Nov  2 14:43:45 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Mail/Audit/.packlist

Nov  2 14:43:45 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Mail/Audit/.packlist".
Please contact the authors!
Nov  2 14:43:45 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Mail/SPF/
Nov  2 14:43:45 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Mail/SPF/".
Please contact the authors!
Nov  2 14:43:45 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Mail/SPF/Query/
Nov  2 14:43:45 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Mail/SPF/Query/".
Please contact the authors!
Nov  2 14:43:45 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Mail/SPF/Query/.packlist

Nov  2 14:43:45 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Mail/SPF/Query/.packlist".
Please contact the authors!
Nov  2 14:43:45 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/ExtUtils/
Nov  2 14:43:45 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/ExtUtils/".
Please contact the authors!
Nov  2 14:43:46 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/ExtUtils/MakeMaker/

Nov  2 14:43:46 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/ExtUtils/MakeMaker/".
Please contact the authors!
Nov  2 14:43:46 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/ExtUtils/MakeMaker/.packlist

Nov  2 14:43:46 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/ExtUtils/MakeMaker/.packlist".
Please contact the authors!
Nov  2 14:43:46 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/ExtUtils/CBuilder/

Nov  2 14:43:46 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/ExtUtils/CBuilder/".
Please contact the authors!
Nov  2 14:43:46 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/ExtUtils/CBuilder/.packlist

Nov  2 14:43:46 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/ExtUtils/CBuilder/.packlist".
Please contact the authors!
Nov  2 14:43:46 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/ExtUtils/ParseXS/
Nov  2 14:43:46 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/ExtUtils/ParseXS/".
Please contact the authors!
Nov  2 14:43:46 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/ExtUtils/ParseXS/.packlist

Nov  2 14:43:46 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/ExtUtils/ParseXS/.packlist".
Please contact the authors!
Nov  2 14:43:46 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Cwd/
Nov  2 14:43:46 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Cwd/". Please
contact the authors!
Nov  2 14:43:46 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Cwd/Cwd.so
Nov  2 14:43:46 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Cwd/Cwd.so".
Please contact the authors!
Nov  2 14:43:46 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Cwd/Cwd.bs
Nov  2 14:43:46 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Cwd/Cwd.bs".
Please contact the authors!
Nov  2 14:43:46 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Cwd/.packlist
Nov  2 14:43:46 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Cwd/.packlist".
Please contact the authors!
Nov  2 14:43:46 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/File/
Nov  2 14:43:46 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/File/".
Please contact the authors!
Nov  2 14:43:46 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/File/Spec/
Nov  2 14:43:46 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/File/Spec/".
Please contact the authors!
Nov  2 14:43:46 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/File/Spec/.packlist

Nov  2 14:43:46 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/File/Spec/.packlist".
Please contact the authors!
Nov  2 14:43:46 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/File/Find/
Nov  2 14:43:46 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/File/Find/".
Please contact the authors!
Nov  2 14:43:46 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/File/Find/Rule/
Nov  2 14:43:46 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/File/Find/Rule/".
Please contact the authors!
Nov  2 14:43:46 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/File/Find/Rule/.packlist

Nov  2 14:43:46 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/File/Find/Rule/.packlist".
Please contact the authors!
Nov  2 14:43:46 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Pod/
Nov  2 14:43:46 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Pod/". Please
contact the authors!
Nov  2 14:43:46 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Pod/Parser/
Nov  2 14:43:46 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Pod/Parser/".
Please contact the authors!
Nov  2 14:43:46 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Pod/Parser/.packlist

Nov  2 14:43:46 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Pod/Parser/.packlist".
Please contact the authors!
Nov  2 14:43:46 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Pod/Escapes/
Nov  2 14:43:46 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Pod/Escapes/".
Please contact the authors!
Nov  2 14:43:46 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Pod/Escapes/.packlist

Nov  2 14:43:46 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Pod/Escapes/.packlist".
Please contact the authors!
Nov  2 14:43:46 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Pod/Simple/
Nov  2 14:43:46 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Pod/Simple/".
Please contact the authors!
Nov  2 14:43:46 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Pod/Simple/.packlist

Nov  2 14:43:47 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Pod/Simple/.packlist".
Please contact the authors!
Nov  2 14:43:47 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Pod/.packlist
Nov  2 14:43:47 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Pod/.packlist".
Please contact the authors!
Nov  2 14:43:47 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/
Nov  2 14:43:47 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/".
Please contact the authors!
Nov  2 14:43:47 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/Storable.so

Nov  2 14:43:47 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/Storable.so".
Please contact the authors!
Nov  2 14:43:47 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/Storable.bs

Nov  2 14:43:47 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/Storable.bs".
Please contact the authors!
Nov  2 14:43:47 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/logcroak.al

Nov  2 14:43:47 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/logcroak.al".
Please contact the authors!
Nov  2 14:43:47 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/logcarp.al

Nov  2 14:43:47 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/logcarp.al".
Please contact the authors!
Nov  2 14:43:47 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/CAN_FLOCK.al

Nov  2 14:43:47 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/CAN_FLOCK.al".
Please contact the authors!
Nov  2 14:43:47 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/show_file_magic.al

Nov  2 14:43:47 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/show_file_magic.al".
Please contact the authors!
Nov  2 14:43:47 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/read_magic.al

Nov  2 14:43:47 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/read_magic.al".
Please contact the authors!
Nov  2 14:43:47 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/store.al
Nov  2 14:43:47 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/store.al".
Please contact the authors!
Nov  2 14:43:47 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/nstore.al

Nov  2 14:43:47 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/nstore.al".
Please contact the authors!
Nov  2 14:43:47 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/lock_store.al

Nov  2 14:43:47 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/lock_store.al".
Please contact the authors!
Nov  2 14:43:47 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/lock_nstore.al

Nov  2 14:43:47 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/lock_nstore.al".
Please contact the authors!
Nov  2 14:43:47 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/_store.al

Nov  2 14:43:47 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/_store.al".
Please contact the authors!
Nov  2 14:43:47 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/store_fd.al

Nov  2 14:43:47 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/store_fd.al".
Please contact the authors!
Nov  2 14:43:47 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/nstore_fd.al

Nov  2 14:43:47 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/nstore_fd.al".
Please contact the authors!
Nov  2 14:43:47 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/_store_fd.al

Nov  2 14:43:47 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/_store_fd.al".
Please contact the authors!
Nov  2 14:43:47 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/freeze.al

Nov  2 14:43:47 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/freeze.al".
Please contact the authors!
Nov  2 14:43:47 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/nfreeze.al

Nov  2 14:43:47 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/nfreeze.al".
Please contact the authors!
Nov  2 14:43:47 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/_freeze.al

Nov  2 14:43:47 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/_freeze.al".
Please contact the authors!
Nov  2 14:43:47 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/retrieve.al

Nov  2 14:43:47 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/retrieve.al".
Please contact the authors!
Nov  2 14:43:47 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/lock_retrieve.al

Nov  2 14:43:47 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/lock_retrieve.al".
Please contact the authors!
Nov  2 14:43:47 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/_retrieve.al

Nov  2 14:43:48 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/_retrieve.al".
Please contact the authors!
Nov  2 14:43:48 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/fd_retrieve.al

Nov  2 14:43:48 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/fd_retrieve.al".
Please contact the authors!
Nov  2 14:43:48 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/thaw.al
Nov  2 14:43:48 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/thaw.al".
Please contact the authors!
Nov  2 14:43:48 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/autosplit.ix

Nov  2 14:43:48 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/autosplit.ix".
Please contact the authors!
Nov  2 14:43:48 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/.packlist

Nov  2 14:43:48 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Storable/.packlist".
Please contact the authors!
Nov  2 14:43:48 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Compress/
Nov  2 14:43:48 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Compress/".
Please contact the authors!
Nov  2 14:43:48 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Compress/Zlib/
Nov  2 14:43:48 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Compress/Zlib/".
Please contact the authors!
Nov  2 14:43:48 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Compress/Zlib/Zlib.so

Nov  2 14:43:48 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Compress/Zlib/Zlib.so".
Please contact the authors!
Nov  2 14:43:48 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Compress/Zlib/Zlib.bs

Nov  2 14:43:48 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Compress/Zlib/Zlib.bs".
Please contact the authors!
Nov  2 14:43:48 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Compress/Zlib/autosplit.ix

Nov  2 14:43:48 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Compress/Zlib/autosplit.ix".
Please contact the authors!
Nov  2 14:43:48 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Compress/Zlib/.packlist

Nov  2 14:43:48 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Compress/Zlib/.packlist".
Please contact the authors!
Nov  2 14:43:48 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Test/
Nov  2 14:43:48 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Test/".
Please contact the authors!
Nov  2 14:43:48 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Test/Builder/
Nov  2 14:43:48 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Test/Builder/".
Please contact the authors!
Nov  2 14:43:48 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Test/Builder/Tester/

Nov  2 14:43:48 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Test/Builder/Tester/".
Please contact the authors!
Nov  2 14:43:48 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Test/Builder/Tester/.packlist

Nov  2 14:43:48 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Test/Builder/Tester/.packlist".
Please contact the authors!
Nov  2 14:43:48 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Test/Pod/
Nov  2 14:43:48 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Test/Pod/".
Please contact the authors!
Nov  2 14:43:48 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Test/Pod/.packlist

Nov  2 14:43:48 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Test/Pod/.packlist".
Please contact the authors!
Nov  2 14:43:48 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Test/Manifest/
Nov  2 14:43:48 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Test/Manifest/".
Please contact the authors!
Nov  2 14:43:48 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Test/Manifest/.packlist

Nov  2 14:43:48 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Test/Manifest/.packlist".
Please contact the authors!
Nov  2 14:43:48 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Test/Simple/
Nov  2 14:43:48 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Test/Simple/".
Please contact the authors!
Nov  2 14:43:48 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Test/Simple/.packlist

Nov  2 14:43:48 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Test/Simple/.packlist".
Please contact the authors!
Nov  2 14:43:48 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Archive/
Nov  2 14:43:48 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Archive/".
Please contact the authors!
Nov  2 14:43:48 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Archive/Tar/
Nov  2 14:43:48 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Archive/Tar/".
Please contact the authors!
Nov  2 14:43:48 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Archive/Tar/.packlist

Nov  2 14:43:48 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Archive/Tar/.packlist".
Please contact the authors!
Nov  2 14:43:48 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/YAML/
Nov  2 14:43:49 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/YAML/".
Please contact the authors!
Nov  2 14:43:49 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/YAML/.packlist
Nov  2 14:43:49 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/YAML/.packlist".
Please contact the authors!
Nov  2 14:43:49 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Text/
Nov  2 14:43:49 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Text/".
Please contact the authors!
Nov  2 14:43:49 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Text/Glob/
Nov  2 14:43:49 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Text/Glob/".
Please contact the authors!
Nov  2 14:43:49 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Text/Glob/.packlist

Nov  2 14:43:49 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Text/Glob/.packlist".
Please contact the authors!
Nov  2 14:43:49 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Text/.packlist
Nov  2 14:43:49 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Text/.packlist".
Please contact the authors!
Nov  2 14:43:49 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Number/
Nov  2 14:43:49 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Number/".
Please contact the authors!
Nov  2 14:43:49 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Number/Compare/
Nov  2 14:43:49 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Number/Compare/".
Please contact the authors!
Nov  2 14:43:49 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Number/Compare/.packlist

Nov  2 14:43:49 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Number/Compare/.packlist".
Please contact the authors!
Nov  2 14:43:49 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Business/
Nov  2 14:43:49 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Business/".
Please contact the authors!
Nov  2 14:43:49 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Business/ISBN/
Nov  2 14:43:49 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Business/ISBN/".
Please contact the authors!
Nov  2 14:43:49 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Business/ISBN/.packlist

Nov  2 14:43:49 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Business/ISBN/.packlist".
Please contact the authors!
Nov  2 14:43:49 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/HTML/
Nov  2 14:43:49 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/HTML/".
Please contact the authors!
Nov  2 14:43:49 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/HTML/Tagset/
Nov  2 14:43:49 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/HTML/Tagset/".
Please contact the authors!
Nov  2 14:43:49 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/HTML/Tagset/.packlist

Nov  2 14:43:49 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/HTML/Tagset/.packlist".
Please contact the authors!
Nov  2 14:43:49 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/HTML/Parser/
Nov  2 14:43:49 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/HTML/Parser/".
Please contact the authors!
Nov  2 14:43:49 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/HTML/Parser/Parser.so

Nov  2 14:43:49 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/HTML/Parser/Parser.so".
Please contact the authors!
Nov  2 14:43:49 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/HTML/Parser/Parser.bs

Nov  2 14:43:49 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/HTML/Parser/Parser.bs".
Please contact the authors!
Nov  2 14:43:49 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/HTML/Parser/.packlist

Nov  2 14:43:49 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/HTML/Parser/.packlist".
Please contact the authors!
Nov  2 14:43:49 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/URI/
Nov  2 14:43:49 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/URI/". Please
contact the authors!
Nov  2 14:43:49 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/URI/.packlist
Nov  2 14:43:49 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/URI/.packlist".
Please contact the authors!
Nov  2 14:43:49 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/libwww-perl/
Nov  2 14:43:49 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/libwww-perl/".
Please contact the authors!
Nov  2 14:43:49 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/libwww-perl/.packlist

Nov  2 14:43:49 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/libwww-perl/.packlist".
Please contact the authors!
Nov  2 14:43:50 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Geography/
Nov  2 14:43:50 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Geography/".
Please contact the authors!
Nov  2 14:43:50 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Geography/Countries/

Nov  2 14:43:50 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Geography/Countries/".
Please contact the authors!
Nov  2 14:43:50 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Geography/Countries/.packlist

Nov  2 14:43:50 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Geography/Countries/.packlist".
Please contact the authors!
Nov  2 14:43:50 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/IP/
Nov  2 14:43:50 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/IP/". Please
contact the authors!
Nov  2 14:43:50 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/IP/Country/
Nov  2 14:43:50 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/IP/Country/".
Please contact the authors!
Nov  2 14:43:50 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/IP/Country/.packlist

Nov  2 14:43:50 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/IP/Country/.packlist".
Please contact the authors!
Nov  2 14:43:50 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Digest/
Nov  2 14:43:50 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Digest/".
Please contact the authors!
Nov  2 14:43:50 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Digest/HMAC/
Nov  2 14:43:50 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Digest/HMAC/".
Please contact the authors!
Nov  2 14:43:50 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Digest/HMAC/.packlist

Nov  2 14:43:50 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Digest/HMAC/.packlist".
Please contact the authors!
Nov  2 14:43:50 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Digest/.packlist
Nov  2 14:43:50 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Digest/.packlist".
Please contact the authors!
Nov  2 14:43:50 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Digest/SHA1/
Nov  2 14:43:50 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Digest/SHA1/".
Please contact the authors!
Nov  2 14:43:50 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Digest/SHA1/SHA1.so

Nov  2 14:43:50 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Digest/SHA1/SHA1.so".
Please contact the authors!
Nov  2 14:43:50 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Digest/SHA1/SHA1.bs

Nov  2 14:43:50 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Digest/SHA1/SHA1.bs".
Please contact the authors!
Nov  2 14:43:50 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Digest/SHA1/.packlist

Nov  2 14:43:50 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Digest/SHA1/.packlist".
Please contact the authors!
Nov  2 14:43:50 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Digest/MD5/
Nov  2 14:43:50 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Digest/MD5/".
Please contact the authors!
Nov  2 14:43:50 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Digest/MD5/MD5.so
Nov  2 14:43:50 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Digest/MD5/MD5.so".
Please contact the authors!
Nov  2 14:43:50 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Digest/MD5/MD5.bs
Nov  2 14:43:50 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Digest/MD5/MD5.bs".
Please contact the authors!
Nov  2 14:43:50 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Digest/MD5/.packlist

Nov  2 14:43:50 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Digest/MD5/.packlist".
Please contact the authors!
Nov  2 14:43:50 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Net/
Nov  2 14:43:50 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Net/". Please
contact the authors!
Nov  2 14:43:50 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Net/DNS/
Nov  2 14:43:50 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Net/DNS/".
Please contact the authors!
Nov  2 14:43:50 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Net/DNS/DNS.so
Nov  2 14:43:50 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Net/DNS/DNS.so".
Please contact the authors!
Nov  2 14:43:50 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Net/DNS/DNS.bs
Nov  2 14:43:50 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Net/DNS/DNS.bs".
Please contact the authors!
Nov  2 14:43:50 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Net/DNS/.packlist
Nov  2 14:43:50 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Net/DNS/.packlist".
Please contact the authors!
Nov  2 14:43:51 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Net/CIDR/
Nov  2 14:43:51 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Net/CIDR/".
Please contact the authors!
Nov  2 14:43:51 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Net/CIDR/Lite/
Nov  2 14:43:51 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Net/CIDR/Lite/".
Please contact the authors!
Nov  2 14:43:51 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Net/CIDR/Lite/.packlist

Nov  2 14:43:51 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Net/CIDR/Lite/.packlist".
Please contact the authors!
Nov  2 14:43:51 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Net/.packlist
Nov  2 14:43:51 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Net/.packlist".
Please contact the authors!
Nov  2 14:43:51 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Net/Telnet/
Nov  2 14:43:51 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Net/Telnet/".
Please contact the authors!
Nov  2 14:43:51 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Net/Telnet/.packlist

Nov  2 14:43:51 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Net/Telnet/.packlist".
Please contact the authors!
Nov  2 14:43:51 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Sys/
Nov  2 14:43:51 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Sys/". Please
contact the authors!
Nov  2 14:43:51 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Sys/Hostname/
Nov  2 14:43:51 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Sys/Hostname/".
Please contact the authors!
Nov  2 14:43:51 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Sys/Hostname/Long/

Nov  2 14:43:51 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Sys/Hostname/Long/".
Please contact the authors!
Nov  2 14:43:51 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Sys/Hostname/Long/.packlist

Nov  2 14:43:51 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Sys/Hostname/Long/.packlist".
Please contact the authors!
Nov  2 14:43:51 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Time/
Nov  2 14:43:51 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Time/".
Please contact the authors!
Nov  2 14:43:51 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Time/HiRes/
Nov  2 14:43:51 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Time/HiRes/".
Please contact the authors!
Nov  2 14:43:51 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Time/HiRes/HiRes.so

Nov  2 14:43:51 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Time/HiRes/HiRes.so".
Please contact the authors!
Nov  2 14:43:51 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Time/HiRes/HiRes.bs

Nov  2 14:43:51 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Time/HiRes/HiRes.bs".
Please contact the authors!
Nov  2 14:43:51 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Time/HiRes/.packlist

Nov  2 14:43:51 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/Time/HiRes/.packlist".
Please contact the authors!
Nov  2 14:43:51 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/MIME/
Nov  2 14:43:51 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/MIME/".
Please contact the authors!
Nov  2 14:43:51 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/MIME/Base64/
Nov  2 14:43:51 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/MIME/Base64/".
Please contact the authors!
Nov  2 14:43:51 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/MIME/Base64/Base64.so

Nov  2 14:43:51 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/MIME/Base64/Base64.so".
Please contact the authors!
Nov  2 14:43:51 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/MIME/Base64/Base64.bs

Nov  2 14:43:51 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/MIME/Base64/Base64.bs".
Please contact the authors!
Nov  2 14:43:51 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/MIME/Base64/.packlist

Nov  2 14:43:51 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/MIME/Base64/.packlist".
Please contact the authors!
Nov  2 14:43:51 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/DB_File/
Nov  2 14:43:51 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/DB_File/".
Please contact the authors!
Nov  2 14:43:51 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/DB_File/DB_File.so

Nov  2 14:43:51 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/DB_File/DB_File.so".
Please contact the authors!
Nov  2 14:43:51 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/DB_File/DB_File.bs

Nov  2 14:43:51 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/DB_File/DB_File.bs".
Please contact the authors!
Nov  2 14:43:51 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/DB_File/autosplit.ix

Nov  2 14:43:51 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/DB_File/autosplit.ix".
Please contact the authors!
Nov  2 14:43:51 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/DB_File/.packlist
Nov  2 14:43:52 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/auto/DB_File/.packlist".
Please contact the authors!
Nov  2 14:43:52 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/perllocal.pod
Nov  2 14:43:52 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/perllocal.pod".
Please contact the authors!
Nov  2 14:43:52 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Cwd.pm
Nov  2 14:43:52 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Cwd.pm". Please
contact the authors!
Nov  2 14:43:52 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Storable.pm
Nov  2 14:43:52 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Storable.pm".
Please contact the authors!
Nov  2 14:43:52 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Compress/
Nov  2 14:43:52 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Compress/". Please
contact the authors!
Nov  2 14:43:52 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Compress/Zlib.pm
Nov  2 14:43:52 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Compress/Zlib.pm".
Please contact the authors!
Nov  2 14:43:52 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/HTML/
Nov  2 14:43:52 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/HTML/". Please
contact the authors!
Nov  2 14:43:52 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/HTML/PullParser.pm
Nov  2 14:43:52 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/HTML/PullParser.pm".
Please contact the authors!
Nov  2 14:43:52 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/HTML/Parser.pm
Nov  2 14:43:52 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/HTML/Parser.pm".
Please contact the authors!
Nov  2 14:43:52 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/HTML/Entities.pm
Nov  2 14:43:52 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/HTML/Entities.pm".
Please contact the authors!
Nov  2 14:43:52 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/HTML/TokeParser.pm
Nov  2 14:43:52 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/HTML/TokeParser.pm".
Please contact the authors!
Nov  2 14:43:52 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/HTML/LinkExtor.pm
Nov  2 14:43:52 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/HTML/LinkExtor.pm".
Please contact the authors!
Nov  2 14:43:52 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/HTML/Filter.pm
Nov  2 14:43:52 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/HTML/Filter.pm".
Please contact the authors!
Nov  2 14:43:52 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/HTML/HeadParser.pm
Nov  2 14:43:52 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/HTML/HeadParser.pm".
Please contact the authors!
Nov  2 14:43:52 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/
Nov  2 14:43:52 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/". Please
contact the authors!
Nov  2 14:43:52 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS.pm
Nov  2 14:43:52 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS.pm".
Please contact the authors!
Nov  2 14:43:52 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/
Nov  2 14:43:52 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/". Please
contact the authors!
Nov  2 14:43:52 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/Header.pm
Nov  2 14:43:52 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/Header.pm".
Please contact the authors!
Nov  2 14:43:52 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/Update.pm
Nov  2 14:43:52 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/Update.pm".
Please contact the authors!
Nov  2 14:43:52 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/Resolver.pm
Nov  2 14:43:52 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/Resolver.pm".
Please contact the authors!
Nov  2 14:43:52 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/Nameserver.pm
Nov  2 14:43:52 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/Nameserver.pm".
Please contact the authors!
Nov  2 14:43:52 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/FAQ.pod
Nov  2 14:43:52 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/FAQ.pod".
Please contact the authors!
Nov  2 14:43:52 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/Question.pm
Nov  2 14:43:52 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/Question.pm".
Please contact the authors!
Nov  2 14:43:52 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/Packet.pm
Nov  2 14:43:53 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/Packet.pm".
Please contact the authors!
Nov  2 14:43:53 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR.pm
Nov  2 14:43:53 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR.pm".
Please contact the authors!
Nov  2 14:43:53 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/
Nov  2 14:43:53 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/".
Please contact the authors!
Nov  2 14:43:53 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/A.pm
Nov  2 14:43:53 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/A.pm".
Please contact the authors!
Nov  2 14:43:53 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/Unknown.pm
Nov  2 14:43:53 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/Unknown.pm".
Please contact the authors!
Nov  2 14:43:53 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/EID.pm
Nov  2 14:43:53 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/EID.pm".
Please contact the authors!
Nov  2 14:43:53 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/ISDN.pm
Nov  2 14:43:53 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/ISDN.pm".
Please contact the authors!
Nov  2 14:43:53 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/MX.pm
Nov  2 14:43:53 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/MX.pm".
Please contact the authors!
Nov  2 14:43:53 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/SOA.pm
Nov  2 14:43:53 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/SOA.pm".
Please contact the authors!
Nov  2 14:43:53 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/OPT.pm
Nov  2 14:43:53 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/OPT.pm".
Please contact the authors!
Nov  2 14:43:53 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/NIMLOC.pm
Nov  2 14:43:53 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/NIMLOC.pm".
Please contact the authors!
Nov  2 14:43:53 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/TXT.pm
Nov  2 14:43:53 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/TXT.pm".
Please contact the authors!
Nov  2 14:43:53 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/DNAME.pm
Nov  2 14:43:53 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/DNAME.pm".
Please contact the authors!
Nov  2 14:43:53 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/AAAA.pm
Nov  2 14:43:53 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/AAAA.pm".
Please contact the authors!
Nov  2 14:43:53 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/X25.pm
Nov  2 14:43:53 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/X25.pm".
Please contact the authors!
Nov  2 14:43:53 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/RP.pm
Nov  2 14:43:53 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/RP.pm".
Please contact the authors!
Nov  2 14:43:53 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/PTR.pm
Nov  2 14:43:53 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/PTR.pm".
Please contact the authors!
Nov  2 14:43:53 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/NS.pm
Nov  2 14:43:53 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/NS.pm".
Please contact the authors!
Nov  2 14:43:53 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/TSIG.pm
Nov  2 14:43:53 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/TSIG.pm".
Please contact the authors!
Nov  2 14:43:53 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/PX.pm
Nov  2 14:43:53 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/PX.pm".
Please contact the authors!
Nov  2 14:43:53 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/NULL.pm
Nov  2 14:43:53 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/NULL.pm".
Please contact the authors!
Nov  2 14:43:53 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/LOC.pm
Nov  2 14:43:53 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/LOC.pm".
Please contact the authors!
Nov  2 14:43:53 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/SRV.pm
Nov  2 14:43:53 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/SRV.pm".
Please contact the authors!
Nov  2 14:43:53 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/RT.pm
Nov  2 14:43:54 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/RT.pm".
Please contact the authors!
Nov  2 14:43:54 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/AFSDB.pm
Nov  2 14:43:54 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/AFSDB.pm".
Please contact the authors!
Nov  2 14:43:54 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/MINFO.pm
Nov  2 14:43:54 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/MINFO.pm".
Please contact the authors!
Nov  2 14:43:54 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/MR.pm
Nov  2 14:43:54 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/MR.pm".
Please contact the authors!
Nov  2 14:43:54 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/CNAME.pm
Nov  2 14:43:54 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/CNAME.pm".
Please contact the authors!
Nov  2 14:43:54 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/SSHFP.pm
Nov  2 14:43:54 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/SSHFP.pm".
Please contact the authors!
Nov  2 14:43:54 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/NAPTR.pm
Nov  2 14:43:54 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/NAPTR.pm".
Please contact the authors!
Nov  2 14:43:54 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/HINFO.pm
Nov  2 14:43:54 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/HINFO.pm".
Please contact the authors!
Nov  2 14:43:54 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/MG.pm
Nov  2 14:43:54 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/MG.pm".
Please contact the authors!
Nov  2 14:43:54 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/TKEY.pm
Nov  2 14:43:54 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/TKEY.pm".
Please contact the authors!
Nov  2 14:43:54 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/NSAP.pm
Nov  2 14:43:54 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/NSAP.pm".
Please contact the authors!
Nov  2 14:43:54 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/CERT.pm
Nov  2 14:43:54 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/CERT.pm".
Please contact the authors!
Nov  2 14:43:54 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/MB.pm
Nov  2 14:43:54 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/RR/MB.pm".
Please contact the authors!
Nov  2 14:43:54 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/Resolver/
Nov  2 14:43:54 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/Resolver/".
Please contact the authors!
Nov  2 14:43:54 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/Resolver/Win32.pm

Nov  2 14:43:54 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/Resolver/Win32.pm".
Please contact the authors!
Nov  2 14:43:54 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/Resolver/Recurse.pm

Nov  2 14:43:54 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/Resolver/Recurse.pm".
Please contact the authors!
Nov  2 14:43:54 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/Resolver/Cygwin.pm

Nov  2 14:43:54 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/Resolver/Cygwin.pm".
Please contact the authors!
Nov  2 14:43:54 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/Resolver/UNIX.pm

Nov  2 14:43:54 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/Resolver/UNIX.pm".
Please contact the authors!
Nov  2 14:43:54 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/Resolver/Base.pm

Nov  2 14:43:54 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Net/DNS/Resolver/Base.pm".
Please contact the authors!
Nov  2 14:43:54 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Digest/
Nov  2 14:43:54 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Digest/". Please
contact the authors!
Nov  2 14:43:54 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Digest/SHA1.pm
Nov  2 14:43:54 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Digest/SHA1.pm".
Please contact the authors!
Nov  2 14:43:54 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Digest/MD5.pm
Nov  2 14:43:54 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Digest/MD5.pm".
Please contact the authors!
Nov  2 14:43:54 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Time/
Nov  2 14:43:54 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Time/". Please
contact the authors!
Nov  2 14:43:54 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Time/HiRes.pm
Nov  2 14:43:54 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/Time/HiRes.pm".
Please contact the authors!
Nov  2 14:43:54 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/MIME/
Nov  2 14:43:55 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/MIME/". Please
contact the authors!
Nov  2 14:43:55 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/MIME/QuotedPrint.pm
Nov  2 14:43:55 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/MIME/QuotedPrint.pm".
Please contact the authors!
Nov  2 14:43:55 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/MIME/Base64.pm
Nov  2 14:43:55 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/MIME/Base64.pm".
Please contact the authors!
Nov  2 14:43:55 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/DB_File.pm
Nov  2 14:43:55 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/i386-linux/DB_File.pm".
Please contact the authors!
Nov  2 14:43:55 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/
Nov  2 14:43:55 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/share/".
Please contact the authors!
Nov  2 14:43:55 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/
Nov  2 14:43:55 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/". Please contact
the authors!
Nov  2 14:43:55 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/
Nov  2 14:43:55 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/". Please
contact the authors!
Nov  2 14:43:55 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IO::Lines.3
Nov  2 14:43:55 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IO::Lines.3".
Please contact the authors!
Nov  2 14:43:55 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IO::ScalarArray.3
Nov  2 14:43:55 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IO::ScalarArray.3".
Please contact the authors!
Nov  2 14:43:55 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IO::Stringy.3
Nov  2 14:43:55 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IO::Stringy.3".
Please contact the authors!
Nov  2 14:43:55 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IO::Wrap.3
Nov  2 14:43:55 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IO::Wrap.3".
Please contact the authors!
Nov  2 14:43:55 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IO::AtomicFile.3
Nov  2 14:43:55 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IO::AtomicFile.3".
Please contact the authors!
Nov  2 14:43:55 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IO::Scalar.3
Nov  2 14:43:55 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IO::Scalar.3".
Please contact the authors!
Nov  2 14:43:55 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IO::InnerFile.3
Nov  2 14:43:55 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IO::InnerFile.3".
Please contact the authors!
Nov  2 14:43:55 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IO::WrapTie.3
Nov  2 14:43:55 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IO::WrapTie.3".
Please contact the authors!
Nov  2 14:43:55 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Decoder::Gzip64.3

Nov  2 14:43:55 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Decoder::Gzip64.3".
Please contact the authors!
Nov  2 14:43:55 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Body.3
Nov  2 14:43:55 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Body.3".
Please contact the authors!
Nov  2 14:43:55 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Field::ContDisp.3

Nov  2 14:43:55 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Field::ContDisp.3".
Please contact the authors!
Nov  2 14:43:55 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Parser::Results.3

Nov  2 14:43:55 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Parser::Results.3".
Please contact the authors!
Nov  2 14:43:55 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Field::ContType.3

Nov  2 14:43:55 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Field::ContType.3".
Please contact the authors!
Nov  2 14:43:55 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Decoder::NBit.3

Nov  2 14:43:55 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Decoder::NBit.3".
Please contact the authors!
Nov  2 14:43:55 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Entity.3
Nov  2 14:43:55 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Entity.3".
Please contact the authors!
Nov  2 14:43:55 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Head.3
Nov  2 14:43:55 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Head.3".
Please contact the authors!
Nov  2 14:43:55 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Parser::Filer.3

Nov  2 14:43:55 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Parser::Filer.3".
Please contact the authors!
Nov  2 14:43:55 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Words.3
Nov  2 14:43:56 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Words.3".
Please contact the authors!
Nov  2 14:43:56 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Field::ParamVal.3

Nov  2 14:43:56 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Field::ParamVal.3".
Please contact the authors!
Nov  2 14:43:56 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Field::ConTraEnc.3

Nov  2 14:43:56 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Field::ConTraEnc.3".
Please contact the authors!
Nov  2 14:43:56 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Tools.3
Nov  2 14:43:56 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Tools.3".
Please contact the authors!
Nov  2 14:43:56 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Decoder::Binary.3

Nov  2 14:43:56 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Decoder::Binary.3".
Please contact the authors!
Nov  2 14:43:56 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Decoder.3
Nov  2 14:43:56 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Decoder.3".
Please contact the authors!
Nov  2 14:43:56 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Decoder::UU.3

Nov  2 14:43:56 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Decoder::UU.3".
Please contact the authors!
Nov  2 14:43:56 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Decoder::Base64.3

Nov  2 14:43:56 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Decoder::Base64.3".
Please contact the authors!
Nov  2 14:43:56 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Decoder::QuotedPrint.3

Nov  2 14:43:56 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Decoder::QuotedPrint.3".
Please contact the authors!
Nov  2 14:43:56 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::WordDecoder.3

Nov  2 14:43:56 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::WordDecoder.3".
Please contact the authors!
Nov  2 14:43:56 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Parser.3
Nov  2 14:43:56 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Parser.3".
Please contact the authors!
Nov  2 14:43:56 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Parser::Reader.3

Nov  2 14:43:56 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Parser::Reader.3".
Please contact the authors!
Nov  2 14:43:56 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Mail::Audit::KillDups.3

Nov  2 14:43:56 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Mail::Audit::KillDups.3".
Please contact the authors!
Nov  2 14:43:56 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Mail::Audit::Razor.3

Nov  2 14:43:56 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Mail::Audit::Razor.3".
Please contact the authors!
Nov  2 14:43:56 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Mail::Audit::List.3

Nov  2 14:43:56 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Mail::Audit::List.3".
Please contact the authors!
Nov  2 14:43:56 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Mail::Audit::PGP.3
Nov  2 14:43:56 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Mail::Audit::PGP.3".
Please contact the authors!
Nov  2 14:43:56 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Mail::Audit::MAPS.3

Nov  2 14:43:56 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Mail::Audit::MAPS.3".
Please contact the authors!
Nov  2 14:43:56 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Mail::Audit.3
Nov  2 14:43:56 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Mail::Audit.3".
Please contact the authors!
Nov  2 14:43:56 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::Installed.3

Nov  2 14:43:56 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::Installed.3".
Please contact the authors!
Nov  2 14:43:56 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MM_OS2.3
Nov  2 14:43:56 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MM_OS2.3".
Please contact the authors!
Nov  2 14:43:56 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MakeMaker.3

Nov  2 14:43:56 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MakeMaker.3".
Please contact the authors!
Nov  2 14:43:56 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::Install.3

Nov  2 14:43:56 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::Install.3".
Please contact the authors!
Nov  2 14:43:56 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::Manifest.3

Nov  2 14:43:56 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::Manifest.3".
Please contact the authors!
Nov  2 14:43:56 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::Command.3

Nov  2 14:43:56 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::Command.3".
Please contact the authors!
Nov  2 14:43:56 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MM_Unix.3

Nov  2 14:43:56 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MM_Unix.3".
Please contact the authors!
Nov  2 14:43:57 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::Mksymlists.3

Nov  2 14:43:57 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::Mksymlists.3".
Please contact the authors!
Nov  2 14:43:57 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MM.3
Nov  2 14:43:57 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MM.3".
Please contact the authors!
Nov  2 14:43:57 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MM_Win32.3

Nov  2 14:43:57 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MM_Win32.3".
Please contact the authors!
Nov  2 14:43:57 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MM_UWIN.3

Nov  2 14:43:57 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MM_UWIN.3".
Please contact the authors!
Nov  2 14:43:57 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::testlib.3

Nov  2 14:43:57 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::testlib.3".
Please contact the authors!
Nov  2 14:43:57 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MakeMaker::vmsish.3

Nov  2 14:43:57 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MakeMaker::vmsish.3".
Please contact the authors!
Nov  2 14:43:57 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MY.3
Nov  2 14:43:57 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MY.3".
Please contact the authors!
Nov  2 14:43:57 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MM_DOS.3
Nov  2 14:43:57 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MM_DOS.3".
Please contact the authors!
Nov  2 14:43:57 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MM_Cygwin.3

Nov  2 14:43:57 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MM_Cygwin.3".
Please contact the authors!
Nov  2 14:43:57 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MM_MacOS.3

Nov  2 14:43:57 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MM_MacOS.3".
Please contact the authors!
Nov  2 14:43:57 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MM_Win95.3

Nov  2 14:43:57 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MM_Win95.3".
Please contact the authors!
Nov  2 14:43:57 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MM_VMS.3
Nov  2 14:43:57 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MM_VMS.3".
Please contact the authors!
Nov  2 14:43:57 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MM_BeOS.3

Nov  2 14:43:57 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MM_BeOS.3".
Please contact the authors!
Nov  2 14:43:57 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::Liblist.3

Nov  2 14:43:57 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::Liblist.3".
Please contact the authors!
Nov  2 14:43:57 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MakeMaker::Tutorial.3

Nov  2 14:43:57 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MakeMaker::Tutorial.3".
Please contact the authors!
Nov  2 14:43:57 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::Packlist.3

Nov  2 14:43:57 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::Packlist.3".
Please contact the authors!
Nov  2 14:43:57 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::Mkbootstrap.3

Nov  2 14:43:57 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::Mkbootstrap.3".
Please contact the authors!
Nov  2 14:43:57 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MakeMaker::FAQ.3

Nov  2 14:43:57 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MakeMaker::FAQ.3".
Please contact the authors!
Nov  2 14:43:57 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::Command::MM.3

Nov  2 14:43:57 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::Command::MM.3".
Please contact the authors!
Nov  2 14:43:57 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MakeMaker::bytes.3

Nov  2 14:43:57 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MakeMaker::bytes.3".
Please contact the authors!
Nov  2 14:43:57 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MM_NW5.3
Nov  2 14:43:57 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MM_NW5.3".
Please contact the authors!
Nov  2 14:43:57 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MM_Any.3
Nov  2 14:43:57 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::MM_Any.3".
Please contact the authors!
Nov  2 14:43:57 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Cwd.3
Nov  2 14:43:57 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Cwd.3". Please
contact the authors!
Nov  2 14:43:57 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/File::Spec::OS2.3
Nov  2 14:43:57 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/File::Spec::OS2.3".
Please contact the authors!
Nov  2 14:43:58 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/File::Spec::Mac.3
Nov  2 14:43:58 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/File::Spec::Mac.3".
Please contact the authors!
Nov  2 14:43:58 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/File::Spec::VMS.3
Nov  2 14:43:58 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/File::Spec::VMS.3".
Please contact the authors!
Nov  2 14:43:58 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/File::Spec::Functions.3

Nov  2 14:43:58 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/File::Spec::Functions.3".
Please contact the authors!
Nov  2 14:43:58 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/File::Spec::Epoc.3
Nov  2 14:43:58 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/File::Spec::Epoc.3".
Please contact the authors!
Nov  2 14:43:58 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/File::Spec::Cygwin.3

Nov  2 14:43:58 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/File::Spec::Cygwin.3".
Please contact the authors!
Nov  2 14:43:58 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/File::Spec.3
Nov  2 14:43:58 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/File::Spec.3".
Please contact the authors!
Nov  2 14:43:58 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/File::Spec::Unix.3
Nov  2 14:43:58 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/File::Spec::Unix.3".
Please contact the authors!
Nov  2 14:43:58 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/File::Spec::Win32.3

Nov  2 14:43:58 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/File::Spec::Win32.3".
Please contact the authors!
Nov  2 14:43:58 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::InputObjects.3

Nov  2 14:43:58 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::InputObjects.3".
Please contact the authors!
Nov  2 14:43:58 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Select.3
Nov  2 14:43:58 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Select.3".
Please contact the authors!
Nov  2 14:43:58 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::PlainText.3
Nov  2 14:43:58 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::PlainText.3".
Please contact the authors!
Nov  2 14:43:58 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Checker.3
Nov  2 14:43:58 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Checker.3".
Please contact the authors!
Nov  2 14:43:58 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::ParseUtils.3
Nov  2 14:43:58 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::ParseUtils.3".
Please contact the authors!
Nov  2 14:43:58 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Find.3
Nov  2 14:43:58 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Find.3".
Please contact the authors!
Nov  2 14:43:58 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Usage.3
Nov  2 14:43:58 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Usage.3".
Please contact the authors!
Nov  2 14:43:58 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Parser.3
Nov  2 14:43:58 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Parser.3".
Please contact the authors!
Nov  2 14:43:58 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Escapes.3
Nov  2 14:43:58 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Escapes.3".
Please contact the authors!
Nov  2 14:43:58 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Compress::Zlib.3
Nov  2 14:43:58 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Compress::Zlib.3".
Please contact the authors!
Nov  2 14:43:58 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Test::Builder::Tester::Color.3

Nov  2 14:43:58 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Test::Builder::Tester::Color.3".
Please contact the authors!
Nov  2 14:43:58 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Test::Builder::Tester.3

Nov  2 14:43:58 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Test::Builder::Tester.3".
Please contact the authors!
Nov  2 14:43:58 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::LinkSection.3

Nov  2 14:43:58 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::LinkSection.3".
Please contact the authors!
Nov  2 14:43:58 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::DumpAsText.3

Nov  2 14:43:58 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::DumpAsText.3".
Please contact the authors!
Nov  2 14:43:58 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::XMLOutStream.3

Nov  2 14:43:59 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::XMLOutStream.3".
Please contact the authors!
Nov  2 14:43:59 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::TextContent.3

Nov  2 14:43:59 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::TextContent.3".
Please contact the authors!
Nov  2 14:43:59 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::Text.3

Nov  2 14:43:59 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::Text.3".
Please contact the authors!
Nov  2 14:43:59 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::Search.3

Nov  2 14:43:59 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::Search.3".
Please contact the authors!
Nov  2 14:43:59 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::PullParserStartToken.3

Nov  2 14:43:59 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::PullParserStartToken.3".
Please contact the authors!
Nov  2 14:43:59 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::Debug.3

Nov  2 14:43:59 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::Debug.3".
Please contact the authors!
Nov  2 14:43:59 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/perlpodspec.3
Nov  2 14:43:59 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/perlpodspec.3".
Please contact the authors!
Nov  2 14:43:59 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::Methody.3

Nov  2 14:43:59 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::Methody.3".
Please contact the authors!
Nov  2 14:43:59 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::PullParserTextToken.3

Nov  2 14:43:59 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::PullParserTextToken.3".
Please contact the authors!
Nov  2 14:43:59 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::PullParserEndToken.3

Nov  2 14:43:59 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::PullParserEndToken.3".
Please contact the authors!
Nov  2 14:43:59 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::HTMLBatch.3

Nov  2 14:43:59 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::HTMLBatch.3".
Please contact the authors!
Nov  2 14:43:59 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::RTF.3
Nov  2 14:43:59 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::RTF.3".
Please contact the authors!
Nov  2 14:43:59 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::Checker.3

Nov  2 14:43:59 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::Checker.3".
Please contact the authors!
Nov  2 14:43:59 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::PullParser.3

Nov  2 14:43:59 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::PullParser.3".
Please contact the authors!
Nov  2 14:43:59 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::SimpleTree.3

Nov  2 14:43:59 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::SimpleTree.3".
Please contact the authors!
Nov  2 14:43:59 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::PullParserToken.3

Nov  2 14:43:59 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::PullParserToken.3".
Please contact the authors!
Nov  2 14:43:59 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/perlpod.3
Nov  2 14:43:59 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/perlpod.3".
Please contact the authors!
Nov  2 14:43:59 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::HTML.3

Nov  2 14:43:59 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::HTML.3".
Please contact the authors!
Nov  2 14:43:59 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::Subclassing.3

Nov  2 14:43:59 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::Subclassing.3".
Please contact the authors!
Nov  2 14:43:59 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple.3
Nov  2 14:43:59 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple.3".
Please contact the authors!
Nov  2 14:43:59 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::DumpAsXML.3

Nov  2 14:43:59 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Simple::DumpAsXML.3".
Please contact the authors!
Nov  2 14:43:59 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Test::Pod.3
Nov  2 14:43:59 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Test::Pod.3".
Please contact the authors!
Nov  2 14:43:59 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::CBuilder::Platform::Windows.3

Nov  2 14:43:59 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::CBuilder::Platform::Windows.3".
Please contact the authors!
Nov  2 14:43:59 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::CBuilder.3

Nov  2 14:43:59 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::CBuilder.3".
Please contact the authors!
Nov  2 14:43:59 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Archive::Tar.3
Nov  2 14:44:00 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Archive::Tar.3".
Please contact the authors!
Nov  2 14:44:00 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Archive::Tar::File.3

Nov  2 14:44:00 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Archive::Tar::File.3".
Please contact the authors!
Nov  2 14:44:00 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::ParseXS.3

Nov  2 14:44:00 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/ExtUtils::ParseXS.3".
Please contact the authors!
Nov  2 14:44:00 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/YAML::Node.3
Nov  2 14:44:00 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/YAML::Node.3".
Please contact the authors!
Nov  2 14:44:00 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/YAML.3
Nov  2 14:44:00 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/YAML.3".
Please contact the authors!
Nov  2 14:44:00 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Text::Glob.3
Nov  2 14:44:00 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Text::Glob.3".
Please contact the authors!
Nov  2 14:44:00 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Number::Compare.3
Nov  2 14:44:00 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Number::Compare.3".
Please contact the authors!
Nov  2 14:44:00 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/File::Find::Rule.3
Nov  2 14:44:00 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/File::Find::Rule.3".
Please contact the authors!
Nov  2 14:44:00 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/File::Find::Rule::Extending.3

Nov  2 14:44:00 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/File::Find::Rule::Extending.3".
Please contact the authors!
Nov  2 14:44:00 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/File::Find::Rule::Procedural.3

Nov  2 14:44:00 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/File::Find::Rule::Procedural.3".
Please contact the authors!
Nov  2 14:44:00 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Test::Manifest.3
Nov  2 14:44:00 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Test::Manifest.3".
Please contact the authors!
Nov  2 14:44:00 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Business::ISBN.3
Nov  2 14:44:00 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Business::ISBN.3".
Please contact the authors!
Nov  2 14:44:00 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTML::Tagset.3
Nov  2 14:44:00 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTML::Tagset.3".
Please contact the authors!
Nov  2 14:44:00 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/URI::WithBase.3
Nov  2 14:44:00 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/URI::WithBase.3".
Please contact the authors!
Nov  2 14:44:00 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/URI::URL.3
Nov  2 14:44:00 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/URI::URL.3".
Please contact the authors!
Nov  2 14:44:00 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/URI.3
Nov  2 14:44:00 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/URI.3". Please
contact the authors!
Nov  2 14:44:00 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/URI::file.3
Nov  2 14:44:00 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/URI::file.3".
Please contact the authors!
Nov  2 14:44:00 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/URI::Split.3
Nov  2 14:44:00 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/URI::Split.3".
Please contact the authors!
Nov  2 14:44:00 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/URI::data.3
Nov  2 14:44:00 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/URI::data.3".
Please contact the authors!
Nov  2 14:44:00 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/URI::ldap.3
Nov  2 14:44:00 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/URI::ldap.3".
Please contact the authors!
Nov  2 14:44:00 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/URI::Escape.3
Nov  2 14:44:00 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/URI::Escape.3".
Please contact the authors!
Nov  2 14:44:00 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/URI::QueryParam.3
Nov  2 14:44:00 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/URI::QueryParam.3".
Please contact the authors!
Nov  2 14:44:00 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/URI::Heuristic.3
Nov  2 14:44:00 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/URI::Heuristic.3".
Please contact the authors!
Nov  2 14:44:00 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTML::PullParser.3
Nov  2 14:44:00 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTML::PullParser.3".
Please contact the authors!
Nov  2 14:44:01 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTML::Entities.3
Nov  2 14:44:01 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTML::Entities.3".
Please contact the authors!
Nov  2 14:44:01 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTML::Parser.3
Nov  2 14:44:01 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTML::Parser.3".
Please contact the authors!
Nov  2 14:44:01 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTML::LinkExtor.3
Nov  2 14:44:01 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTML::LinkExtor.3".
Please contact the authors!
Nov  2 14:44:01 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTML::TokeParser.3
Nov  2 14:44:01 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTML::TokeParser.3".
Please contact the authors!
Nov  2 14:44:01 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTML::HeadParser.3
Nov  2 14:44:01 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTML::HeadParser.3".
Please contact the authors!
Nov  2 14:44:01 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTML::Filter.3
Nov  2 14:44:01 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTML::Filter.3".
Please contact the authors!
Nov  2 14:44:01 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/LWP::RobotUA.3
Nov  2 14:44:01 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/LWP::RobotUA.3".
Please contact the authors!
Nov  2 14:44:01 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/LWP::Authen::Ntlm.3

Nov  2 14:44:01 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/LWP::Authen::Ntlm.3".
Please contact the authors!
Nov  2 14:44:01 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/LWP.3
Nov  2 14:44:01 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/LWP.3". Please
contact the authors!
Nov  2 14:44:01 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/LWP::Protocol.3
Nov  2 14:44:01 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/LWP::Protocol.3".
Please contact the authors!
Nov  2 14:44:01 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTTP::Request::Common.3

Nov  2 14:44:01 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTTP::Request::Common.3".
Please contact the authors!
Nov  2 14:44:01 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/lwptut.3
Nov  2 14:44:01 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/lwptut.3".
Please contact the authors!
Nov  2 14:44:01 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTTP::Message.3
Nov  2 14:44:01 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTTP::Message.3".
Please contact the authors!
Nov  2 14:44:01 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTML::Form.3
Nov  2 14:44:01 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTML::Form.3".
Please contact the authors!
Nov  2 14:44:01 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTTP::Cookies::Netscape.3

Nov  2 14:44:01 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTTP::Cookies::Netscape.3".
Please contact the authors!
Nov  2 14:44:01 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::HTTP::NB.3
Nov  2 14:44:01 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::HTTP::NB.3".
Please contact the authors!
Nov  2 14:44:01 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTTP::Status.3
Nov  2 14:44:01 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTTP::Status.3".
Please contact the authors!
Nov  2 14:44:01 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTTP::Headers::Util.3

Nov  2 14:44:01 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTTP::Headers::Util.3".
Please contact the authors!
Nov  2 14:44:01 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTTP::Cookies::Microsoft.3

Nov  2 14:44:01 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTTP::Cookies::Microsoft.3".
Please contact the authors!
Nov  2 14:44:01 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/LWP::UserAgent.3
Nov  2 14:44:01 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/LWP::UserAgent.3".
Please contact the authors!
Nov  2 14:44:01 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/LWP::MemberMixin.3
Nov  2 14:44:01 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/LWP::MemberMixin.3".
Please contact the authors!
Nov  2 14:44:01 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/LWP::Debug.3
Nov  2 14:44:01 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/LWP::Debug.3".
Please contact the authors!
Nov  2 14:44:01 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::HTTP.3
Nov  2 14:44:01 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::HTTP.3".
Please contact the authors!
Nov  2 14:44:02 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTTP::Daemon.3
Nov  2 14:44:02 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTTP::Daemon.3".
Please contact the authors!
Nov  2 14:44:02 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTTP::Cookies.3
Nov  2 14:44:02 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTTP::Cookies.3".
Please contact the authors!
Nov  2 14:44:02 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/LWP::ConnCache.3
Nov  2 14:44:02 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/LWP::ConnCache.3".
Please contact the authors!
Nov  2 14:44:02 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/File::Listing.3
Nov  2 14:44:02 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/File::Listing.3".
Please contact the authors!
Nov  2 14:44:02 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/WWW::RobotRules::AnyDBM_File.3

Nov  2 14:44:02 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/WWW::RobotRules::AnyDBM_File.3".
Please contact the authors!
Nov  2 14:44:02 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/lwpcook.3
Nov  2 14:44:02 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/lwpcook.3".
Please contact the authors!
Nov  2 14:44:02 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/LWP::MediaTypes.3
Nov  2 14:44:02 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/LWP::MediaTypes.3".
Please contact the authors!
Nov  2 14:44:02 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTTP::Date.3
Nov  2 14:44:02 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTTP::Date.3".
Please contact the authors!
Nov  2 14:44:02 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/WWW::RobotRules.3
Nov  2 14:44:02 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/WWW::RobotRules.3".
Please contact the authors!
Nov  2 14:44:02 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTTP::Negotiate.3
Nov  2 14:44:02 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTTP::Negotiate.3".
Please contact the authors!
Nov  2 14:44:02 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTTP::Request.3
Nov  2 14:44:02 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTTP::Request.3".
Please contact the authors!
Nov  2 14:44:02 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/LWP::DebugFile.3
Nov  2 14:44:02 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/LWP::DebugFile.3".
Please contact the authors!
Nov  2 14:44:02 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTTP::Response.3
Nov  2 14:44:02 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTTP::Response.3".
Please contact the authors!
Nov  2 14:44:02 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTTP::Headers.3
Nov  2 14:44:02 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/HTTP::Headers.3".
Please contact the authors!
Nov  2 14:44:02 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/LWP::Simple.3
Nov  2 14:44:02 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/LWP::Simple.3".
Please contact the authors!
Nov  2 14:44:02 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Bundle::LWP.3
Nov  2 14:44:02 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Bundle::LWP.3".
Please contact the authors!
Nov  2 14:44:02 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Geography::Countries.3

Nov  2 14:44:02 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Geography::Countries.3".
Please contact the authors!
Nov  2 14:44:02 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IP::Authority.3
Nov  2 14:44:02 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IP::Authority.3".
Please contact the authors!
Nov  2 14:44:02 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IP::Country::Medium.3

Nov  2 14:44:02 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IP::Country::Medium.3".
Please contact the authors!
Nov  2 14:44:02 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IP::Country::Fast.3

Nov  2 14:44:02 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IP::Country::Fast.3".
Please contact the authors!
Nov  2 14:44:02 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IP::Country::MaxMind.3

Nov  2 14:44:02 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IP::Country::MaxMind.3".
Please contact the authors!
Nov  2 14:44:02 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IP::Country::Slow.3

Nov  2 14:44:02 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IP::Country::Slow.3".
Please contact the authors!
Nov  2 14:44:02 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IP::Country.3
Nov  2 14:44:02 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/IP::Country.3".
Please contact the authors!
Nov  2 14:44:02 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Digest::HMAC_MD5.3
Nov  2 14:44:03 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Digest::HMAC_MD5.3".
Please contact the authors!
Nov  2 14:44:03 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Digest::HMAC.3
Nov  2 14:44:03 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Digest::HMAC.3".
Please contact the authors!
Nov  2 14:44:03 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Digest::HMAC_SHA1.3

Nov  2 14:44:03 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Digest::HMAC_SHA1.3".
Please contact the authors!
Nov  2 14:44:03 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::A.3
Nov  2 14:44:03 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::A.3".
Please contact the authors!
Nov  2 14:44:03 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::Unknown.3

Nov  2 14:44:03 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::Unknown.3".
Please contact the authors!
Nov  2 14:44:03 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::Resolver::Win32.3

Nov  2 14:44:03 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::Resolver::Win32.3".
Please contact the authors!
Nov  2 14:44:03 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::EID.3

Nov  2 14:44:03 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::EID.3".
Please contact the authors!
Nov  2 14:44:03 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::ISDN.3

Nov  2 14:44:03 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::ISDN.3".
Please contact the authors!
Nov  2 14:44:03 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::MX.3
Nov  2 14:44:03 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::MX.3".
Please contact the authors!
Nov  2 14:44:03 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::Header.3
Nov  2 14:44:03 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::Header.3".
Please contact the authors!
Nov  2 14:44:03 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::SOA.3

Nov  2 14:44:03 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::SOA.3".
Please contact the authors!
Nov  2 14:44:03 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::OPT.3

Nov  2 14:44:03 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::OPT.3".
Please contact the authors!
Nov  2 14:44:03 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::NIMLOC.3

Nov  2 14:44:03 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::NIMLOC.3".
Please contact the authors!
Nov  2 14:44:03 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::TXT.3

Nov  2 14:44:03 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::TXT.3".
Please contact the authors!
Nov  2 14:44:03 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::DNAME.3

Nov  2 14:44:03 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::DNAME.3".
Please contact the authors!
Nov  2 14:44:03 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::AAAA.3

Nov  2 14:44:03 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::AAAA.3".
Please contact the authors!
Nov  2 14:44:03 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS.3
Nov  2 14:44:03 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS.3".
Please contact the authors!
Nov  2 14:44:03 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::X25.3

Nov  2 14:44:03 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::X25.3".
Please contact the authors!
Nov  2 14:44:03 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::RP.3
Nov  2 14:44:03 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::RP.3".
Please contact the authors!
Nov  2 14:44:03 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::PTR.3

Nov  2 14:44:03 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::PTR.3".
Please contact the authors!
Nov  2 14:44:03 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::Resolver::Cygwin.3

Nov  2 14:44:03 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::Resolver::Cygwin.3".
Please contact the authors!
Nov  2 14:44:03 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::Resolver::Recurse.3

Nov  2 14:44:03 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::Resolver::Recurse.3".
Please contact the authors!
Nov  2 14:44:03 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::TSIG.3

Nov  2 14:44:04 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::TSIG.3".
Please contact the authors!
Nov  2 14:44:04 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::NS.3
Nov  2 14:44:04 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::NS.3".
Please contact the authors!
Nov  2 14:44:04 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::Update.3
Nov  2 14:44:04 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::Update.3".
Please contact the authors!
Nov  2 14:44:04 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::Resolver.3

Nov  2 14:44:04 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::Resolver.3".
Please contact the authors!
Nov  2 14:44:04 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::PX.3
Nov  2 14:44:04 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::PX.3".
Please contact the authors!
Nov  2 14:44:04 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::Nameserver.3

Nov  2 14:44:04 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::Nameserver.3".
Please contact the authors!
Nov  2 14:44:04 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::NULL.3

Nov  2 14:44:04 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::NULL.3".
Please contact the authors!
Nov  2 14:44:04 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::LOC.3

Nov  2 14:44:04 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::LOC.3".
Please contact the authors!
Nov  2 14:44:04 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::SRV.3

Nov  2 14:44:04 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::SRV.3".
Please contact the authors!
Nov  2 14:44:04 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::RT.3
Nov  2 14:44:04 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::RT.3".
Please contact the authors!
Nov  2 14:44:04 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::AFSDB.3

Nov  2 14:44:04 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::AFSDB.3".
Please contact the authors!
Nov  2 14:44:04 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::MINFO.3

Nov  2 14:44:04 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::MINFO.3".
Please contact the authors!
Nov  2 14:44:04 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::MR.3
Nov  2 14:44:04 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::MR.3".
Please contact the authors!
Nov  2 14:44:04 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::FAQ.3
Nov  2 14:44:04 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::FAQ.3".
Please contact the authors!
Nov  2 14:44:04 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::CNAME.3

Nov  2 14:44:04 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::CNAME.3".
Please contact the authors!
Nov  2 14:44:04 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::Question.3

Nov  2 14:44:04 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::Question.3".
Please contact the authors!
Nov  2 14:44:04 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::SSHFP.3

Nov  2 14:44:04 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::SSHFP.3".
Please contact the authors!
Nov  2 14:44:04 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::NAPTR.3

Nov  2 14:44:04 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::NAPTR.3".
Please contact the authors!
Nov  2 14:44:04 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR.3
Nov  2 14:44:04 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR.3".
Please contact the authors!
Nov  2 14:44:04 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::Packet.3
Nov  2 14:44:04 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::Packet.3".
Please contact the authors!
Nov  2 14:44:04 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::HINFO.3

Nov  2 14:44:04 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::HINFO.3".
Please contact the authors!
Nov  2 14:44:04 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::MG.3
Nov  2 14:44:04 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::MG.3".
Please contact the authors!
Nov  2 14:44:04 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::TKEY.3

Nov  2 14:44:04 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::TKEY.3".
Please contact the authors!
Nov  2 14:44:04 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::NSAP.3

Nov  2 14:44:05 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::NSAP.3".
Please contact the authors!
Nov  2 14:44:05 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::CERT.3

Nov  2 14:44:05 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::CERT.3".
Please contact the authors!
Nov  2 14:44:05 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::Resolver::UNIX.3

Nov  2 14:44:05 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::Resolver::UNIX.3".
Please contact the authors!
Nov  2 14:44:05 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::MB.3
Nov  2 14:44:05 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::RR::MB.3".
Please contact the authors!
Nov  2 14:44:05 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::Resolver::Base.3

Nov  2 14:44:05 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::DNS::Resolver::Base.3".
Please contact the authors!
Nov  2 14:44:05 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Digest.3
Nov  2 14:44:05 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Digest.3".
Please contact the authors!
Nov  2 14:44:05 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Digest::base.3
Nov  2 14:44:05 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Digest::base.3".
Please contact the authors!
Nov  2 14:44:05 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Digest::SHA1.3
Nov  2 14:44:05 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Digest::SHA1.3".
Please contact the authors!
Nov  2 14:44:05 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::CIDR::Lite.3
Nov  2 14:44:05 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::CIDR::Lite.3".
Please contact the authors!
Nov  2 14:44:05 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Sys::Hostname::Long.3

Nov  2 14:44:05 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Sys::Hostname::Long.3".
Please contact the authors!
Nov  2 14:44:05 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Mail::SPF::Query.3
Nov  2 14:44:05 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Mail::SPF::Query.3".
Please contact the authors!
Nov  2 14:44:05 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Time::HiRes.3
Nov  2 14:44:05 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Time::HiRes.3".
Please contact the authors!
Nov  2 14:44:05 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Test::Simple.3
Nov  2 14:44:05 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Test::Simple.3".
Please contact the authors!
Nov  2 14:44:05 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Test::Builder.3
Nov  2 14:44:05 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Test::Builder.3".
Please contact the authors!
Nov  2 14:44:05 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Test::More.3
Nov  2 14:44:05 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Test::More.3".
Please contact the authors!
Nov  2 14:44:05 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Test::Tutorial.3
Nov  2 14:44:05 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Test::Tutorial.3".
Please contact the authors!
Nov  2 14:44:05 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::QuotedPrint.3

Nov  2 14:44:05 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::QuotedPrint.3".
Please contact the authors!
Nov  2 14:44:05 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Base64.3
Nov  2 14:44:05 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/MIME::Base64.3".
Please contact the authors!
Nov  2 14:44:05 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Digest::MD5.3
Nov  2 14:44:05 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Digest::MD5.3".
Please contact the authors!
Nov  2 14:44:05 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::POP3.3
Nov  2 14:44:05 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::POP3.3".
Please contact the authors!
Nov  2 14:44:05 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::SMTP.3
Nov  2 14:44:05 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::SMTP.3".
Please contact the authors!
Nov  2 14:44:05 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::Config.3
Nov  2 14:44:05 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::Config.3".
Please contact the authors!
Nov  2 14:44:05 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::libnetFAQ.3
Nov  2 14:44:05 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::libnetFAQ.3".
Please contact the authors!
Nov  2 14:44:05 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::Domain.3
Nov  2 14:44:05 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::Domain.3".
Please contact the authors!
Nov  2 14:44:06 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::Cmd.3
Nov  2 14:44:06 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::Cmd.3".
Please contact the authors!
Nov  2 14:44:06 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::FTP.3
Nov  2 14:44:06 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::FTP.3".
Please contact the authors!
Nov  2 14:44:06 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::Netrc.3
Nov  2 14:44:06 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::Netrc.3".
Please contact the authors!
Nov  2 14:44:06 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::NNTP.3
Nov  2 14:44:06 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::NNTP.3".
Please contact the authors!
Nov  2 14:44:06 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::Time.3
Nov  2 14:44:06 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::Time.3".
Please contact the authors!
Nov  2 14:44:06 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::Telnet.3
Nov  2 14:44:06 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Net::Telnet.3".
Please contact the authors!
Nov  2 14:44:06 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/DB_File.3
Nov  2 14:44:06 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/DB_File.3".
Please contact the authors!
Nov  2 14:44:06 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Text::Tabs.3
Nov  2 14:44:06 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Text::Tabs.3".
Please contact the authors!
Nov  2 14:44:06 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Text::Wrap.3
Nov  2 14:44:06 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Text::Wrap.3".
Please contact the authors!
Nov  2 14:44:06 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::ParseLink.3
Nov  2 14:44:06 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::ParseLink.3".
Please contact the authors!
Nov  2 14:44:06 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Text::Termcap.3

Nov  2 14:44:06 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Text::Termcap.3".
Please contact the authors!
Nov  2 14:44:06 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Text.3
Nov  2 14:44:06 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Text.3".
Please contact the authors!
Nov  2 14:44:06 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Text::Color.3
Nov  2 14:44:06 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Text::Color.3".
Please contact the authors!
Nov  2 14:44:06 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Text::Overstrike.3

Nov  2 14:44:06 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Text::Overstrike.3".
Please contact the authors!
Nov  2 14:44:06 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Man.3
Nov  2 14:44:06 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man3/Pod::Man.3".
Please contact the authors!
Nov  2 14:44:06 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man1/
Nov  2 14:44:06 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man1/". Please
contact the authors!
Nov  2 14:44:06 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man1/instmodsh.1
Nov  2 14:44:06 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man1/instmodsh.1".
Please contact the authors!
Nov  2 14:44:06 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man1/pod2usage.1
Nov  2 14:44:06 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man1/pod2usage.1".
Please contact the authors!
Nov  2 14:44:06 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man1/podchecker.1
Nov  2 14:44:06 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man1/podchecker.1".
Please contact the authors!
Nov  2 14:44:06 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man1/podselect.1
Nov  2 14:44:06 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man1/podselect.1".
Please contact the authors!
Nov  2 14:44:06 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man1/xyx.1
Nov  2 14:44:06 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man1/xyx.1". Please
contact the authors!
Nov  2 14:44:06 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man1/ysh.1
Nov  2 14:44:06 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man1/ysh.1". Please
contact the authors!
Nov  2 14:44:06 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man1/yaml2outline.1
Nov  2 14:44:07 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man1/yaml2outline.1".
Please contact the authors!
Nov  2 14:44:07 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man1/phone2yaml.1
Nov  2 14:44:07 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man1/phone2yaml.1".
Please contact the authors!
Nov  2 14:44:07 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man1/findrule.1
Nov  2 14:44:07 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man1/findrule.1".
Please contact the authors!
Nov  2 14:44:07 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man1/ip2cc.1
Nov  2 14:44:07 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man1/ip2cc.1".
Please contact the authors!
Nov  2 14:44:07 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man1/pod2man.1
Nov  2 14:44:07 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man1/pod2man.1".
Please contact the authors!
Nov  2 14:44:07 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/share/man/man1/pod2text.1
Nov  2 14:44:07 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/share/man/man1/pod2text.1".
Please contact the authors!
Nov  2 14:44:07 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/IO/
Nov  2 14:44:07 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/IO/".
Please contact the authors!
Nov  2 14:44:07 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/IO/Lines.pm
Nov  2 14:44:07 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/IO/Lines.pm". Please contact
the authors!
Nov  2 14:44:07 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/IO/Stringy.pm
Nov  2 14:44:07 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/IO/Stringy.pm". Please
contact the authors!
Nov  2 14:44:07 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/IO/ScalarArray.pm
Nov  2 14:44:07 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/IO/ScalarArray.pm". Please
contact the authors!
Nov  2 14:44:07 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/IO/Wrap.pm
Nov  2 14:44:07 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/IO/Wrap.pm". Please contact
the authors!
Nov  2 14:44:07 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/IO/Scalar.pm.html
Nov  2 14:44:07 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/IO/Scalar.pm.html". Please
contact the authors!
Nov  2 14:44:07 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/IO/AtomicFile.pm
Nov  2 14:44:07 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/IO/AtomicFile.pm". Please
contact the authors!
Nov  2 14:44:07 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/IO/Scalar.pm
Nov  2 14:44:07 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/IO/Scalar.pm". Please contact
the authors!
Nov  2 14:44:07 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/IO/InnerFile.pm
Nov  2 14:44:07 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/IO/InnerFile.pm". Please
contact the authors!
Nov  2 14:44:07 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/IO/WrapTie.pm
Nov  2 14:44:07 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/IO/WrapTie.pm". Please
contact the authors!
Nov  2 14:44:07 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/MIME/
Nov  2 14:44:07 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/MIME/".
Please contact the authors!
Nov  2 14:44:07 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/MIME/Body.pm
Nov  2 14:44:07 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/MIME/Body.pm". Please contact
the authors!
Nov  2 14:44:07 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/MIME/Entity.pm
Nov  2 14:44:07 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/MIME/Entity.pm". Please
contact the authors!
Nov  2 14:44:07 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/MIME/Head.pm
Nov  2 14:44:07 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/MIME/Head.pm". Please contact
the authors!
Nov  2 14:44:07 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/MIME/Words.pm
Nov  2 14:44:07 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/MIME/Words.pm". Please
contact the authors!
Nov  2 14:44:07 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/MIME/Tools.pm
Nov  2 14:44:07 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/MIME/Tools.pm". Please
contact the authors!
Nov  2 14:44:07 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/MIME/Decoder.pm
Nov  2 14:44:07 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/MIME/Decoder.pm". Please
contact the authors!
Nov  2 14:44:07 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/MIME/WordDecoder.pm
Nov  2 14:44:07 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/MIME/WordDecoder.pm". Please
contact the authors!
Nov  2 14:44:08 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/MIME/Parser.pm
Nov  2 14:44:08 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/MIME/Parser.pm". Please
contact the authors!
Nov  2 14:44:08 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/MIME/Decoder/
Nov  2 14:44:08 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/MIME/Decoder/". Please
contact the authors!
Nov  2 14:44:08 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/MIME/Decoder/Gzip64.pm
Nov  2 14:44:08 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/MIME/Decoder/Gzip64.pm".
Please contact the authors!
Nov  2 14:44:08 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/MIME/Decoder/NBit.pm
Nov  2 14:44:08 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/MIME/Decoder/NBit.pm". Please
contact the authors!
Nov  2 14:44:08 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/MIME/Decoder/Binary.pm
Nov  2 14:44:08 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/MIME/Decoder/Binary.pm".
Please contact the authors!
Nov  2 14:44:08 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/MIME/Decoder/UU.pm
Nov  2 14:44:08 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/MIME/Decoder/UU.pm". Please
contact the authors!
Nov  2 14:44:08 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/MIME/Decoder/QuotedPrint.pm
Nov  2 14:44:08 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/MIME/Decoder/QuotedPrint.pm".
Please contact the authors!
Nov  2 14:44:08 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/MIME/Decoder/Base64.pm
Nov  2 14:44:08 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/MIME/Decoder/Base64.pm".
Please contact the authors!
Nov  2 14:44:08 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/MIME/Field/
Nov  2 14:44:08 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/MIME/Field/". Please contact
the authors!
Nov  2 14:44:08 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/MIME/Field/ContDisp.pm
Nov  2 14:44:08 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/MIME/Field/ContDisp.pm".
Please contact the authors!
Nov  2 14:44:08 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/MIME/Field/ContType.pm
Nov  2 14:44:08 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/MIME/Field/ContType.pm".
Please contact the authors!
Nov  2 14:44:08 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/MIME/Field/ParamVal.pm
Nov  2 14:44:08 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/MIME/Field/ParamVal.pm".
Please contact the authors!
Nov  2 14:44:08 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/MIME/Field/ConTraEnc.pm
Nov  2 14:44:08 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/MIME/Field/ConTraEnc.pm".
Please contact the authors!
Nov  2 14:44:08 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/MIME/Parser/
Nov  2 14:44:08 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/MIME/Parser/". Please contact
the authors!
Nov  2 14:44:08 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/MIME/Parser/Results.pm
Nov  2 14:44:08 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/MIME/Parser/Results.pm".
Please contact the authors!
Nov  2 14:44:08 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/MIME/Parser/Filer.pm
Nov  2 14:44:08 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/MIME/Parser/Filer.pm". Please
contact the authors!
Nov  2 14:44:08 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/MIME/Parser/Reader.pm
Nov  2 14:44:08 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/MIME/Parser/Reader.pm".
Please contact the authors!
Nov  2 14:44:08 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Mail/
Nov  2 14:44:08 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/Mail/".
Please contact the authors!
Nov  2 14:44:08 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Mail/Audit.pm
Nov  2 14:44:08 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Mail/Audit.pm". Please
contact the authors!
Nov  2 14:44:08 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Mail/Audit/
Nov  2 14:44:08 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Mail/Audit/". Please contact
the authors!
Nov  2 14:44:08 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Mail/Audit/MimeEntity.pm
Nov  2 14:44:09 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Mail/Audit/MimeEntity.pm".
Please contact the authors!
Nov  2 14:44:09 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Mail/Audit/KillDups.pm
Nov  2 14:44:09 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Mail/Audit/KillDups.pm".
Please contact the authors!
Nov  2 14:44:09 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Mail/Audit/List.pm
Nov  2 14:44:09 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Mail/Audit/List.pm". Please
contact the authors!
Nov  2 14:44:09 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Mail/Audit/MAPS.pm
Nov  2 14:44:09 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Mail/Audit/MAPS.pm". Please
contact the authors!
Nov  2 14:44:09 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Mail/Audit/Razor.pm
Nov  2 14:44:09 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Mail/Audit/Razor.pm". Please
contact the authors!
Nov  2 14:44:09 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Mail/Audit/MailInternet.pm
Nov  2 14:44:09 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Mail/Audit/MailInternet.pm".
Please contact the authors!
Nov  2 14:44:09 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Mail/Audit/PGP.pm
Nov  2 14:44:09 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Mail/Audit/PGP.pm". Please
contact the authors!
Nov  2 14:44:09 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Mail/SPF/
Nov  2 14:44:09 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/Mail/SPF/".
Please contact the authors!
Nov  2 14:44:09 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Mail/SPF/Query.pm
Nov  2 14:44:09 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Mail/SPF/Query.pm". Please
contact the authors!
Nov  2 14:44:09 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/bin/
Nov  2 14:44:09 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/bin/".
Please contact the authors!
Nov  2 14:44:09 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/bin/instmodsh
Nov  2 14:44:09 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/bin/instmodsh". Please
contact the authors!
Nov  2 14:44:09 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/bin/pod2usage
Nov  2 14:44:09 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/bin/pod2usage". Please
contact the authors!
Nov  2 14:44:09 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/bin/podchecker
Nov  2 14:44:09 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/bin/podchecker". Please
contact the authors!
Nov  2 14:44:09 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/bin/podselect
Nov  2 14:44:09 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/bin/podselect". Please
contact the authors!
Nov  2 14:44:09 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/bin/ptar
Nov  2 14:44:09 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/bin/ptar".
Please contact the authors!
Nov  2 14:44:09 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/bin/xyx
Nov  2 14:44:09 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/bin/xyx".
Please contact the authors!
Nov  2 14:44:09 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/bin/ysh
Nov  2 14:44:09 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/bin/ysh".
Please contact the authors!
Nov  2 14:44:09 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/bin/yaml2outline
Nov  2 14:44:09 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/bin/yaml2outline". Please
contact the authors!
Nov  2 14:44:09 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/bin/phone2yaml
Nov  2 14:44:09 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/bin/phone2yaml". Please
contact the authors!
Nov  2 14:44:09 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/bin/findrule
Nov  2 14:44:09 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/bin/findrule". Please contact
the authors!
Nov  2 14:44:09 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/bin/ip2cc
Nov  2 14:44:09 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/bin/ip2cc".
Please contact the authors!
Nov  2 14:44:09 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/bin/spfd
Nov  2 14:44:09 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/bin/spfd".
Please contact the authors!
Nov  2 14:44:10 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/bin/spfquery
Nov  2 14:44:10 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/bin/spfquery". Please contact
the authors!
Nov  2 14:44:10 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/bin/decode-qp
Nov  2 14:44:10 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/bin/decode-qp". Please
contact the authors!
Nov  2 14:44:10 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/bin/encode-qp
Nov  2 14:44:10 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/bin/encode-qp". Please
contact the authors!
Nov  2 14:44:10 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/bin/decode-base64
Nov  2 14:44:10 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/bin/decode-base64". Please
contact the authors!
Nov  2 14:44:10 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/bin/encode-base64
Nov  2 14:44:10 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/bin/encode-base64". Please
contact the authors!
Nov  2 14:44:10 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/bin/pod2man
Nov  2 14:44:10 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/bin/pod2man". Please contact
the authors!
Nov  2 14:44:10 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/bin/pod2text
Nov  2 14:44:10 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/bin/pod2text". Please contact
the authors!
Nov  2 14:44:10 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/
Nov  2 14:44:10 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/".
Please contact the authors!
Nov  2 14:44:10 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/Installed.pm
Nov  2 14:44:10 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/Installed.pm".
Please contact the authors!
Nov  2 14:44:10 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MakeMaker.pm
Nov  2 14:44:10 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MakeMaker.pm".
Please contact the authors!
Nov  2 14:44:10 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MM_OS2.pm
Nov  2 14:44:10 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MM_OS2.pm". Please
contact the authors!
Nov  2 14:44:10 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/Install.pm
Nov  2 14:44:10 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/Install.pm". Please
contact the authors!
Nov  2 14:44:10 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/Command.pm
Nov  2 14:44:10 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/Command.pm". Please
contact the authors!
Nov  2 14:44:10 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/Manifest.pm
Nov  2 14:44:10 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/Manifest.pm". Please
contact the authors!
Nov  2 14:44:10 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MM_Unix.pm
Nov  2 14:44:10 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MM_Unix.pm". Please
contact the authors!
Nov  2 14:44:10 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/Mksymlists.pm
Nov  2 14:44:10 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/Mksymlists.pm".
Please contact the authors!
Nov  2 14:44:10 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MM.pm
Nov  2 14:44:10 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MM.pm". Please
contact the authors!
Nov  2 14:44:10 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MANIFEST.SKIP
Nov  2 14:44:10 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MANIFEST.SKIP".
Please contact the authors!
Nov  2 14:44:10 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MM_UWIN.pm
Nov  2 14:44:10 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MM_UWIN.pm". Please
contact the authors!
Nov  2 14:44:10 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MM_Win32.pm
Nov  2 14:44:10 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MM_Win32.pm". Please
contact the authors!
Nov  2 14:44:10 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/testlib.pm
Nov  2 14:44:10 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/testlib.pm". Please
contact the authors!
Nov  2 14:44:10 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MM_Cygwin.pm
Nov  2 14:44:10 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MM_Cygwin.pm".
Please contact the authors!
Nov  2 14:44:10 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MM_DOS.pm
Nov  2 14:44:10 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MM_DOS.pm". Please
contact the authors!
Nov  2 14:44:10 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MY.pm
Nov  2 14:44:11 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MY.pm". Please
contact the authors!
Nov  2 14:44:11 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MM_MacOS.pm
Nov  2 14:44:11 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MM_MacOS.pm". Please
contact the authors!
Nov  2 14:44:11 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MM_VMS.pm
Nov  2 14:44:11 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MM_VMS.pm". Please
contact the authors!
Nov  2 14:44:11 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MM_Win95.pm
Nov  2 14:44:11 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MM_Win95.pm". Please
contact the authors!
Nov  2 14:44:11 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MM_BeOS.pm
Nov  2 14:44:11 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MM_BeOS.pm". Please
contact the authors!
Nov  2 14:44:11 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/Liblist.pm
Nov  2 14:44:11 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/Liblist.pm". Please
contact the authors!
Nov  2 14:44:11 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/Packlist.pm
Nov  2 14:44:11 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/Packlist.pm". Please
contact the authors!
Nov  2 14:44:11 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/Mkbootstrap.pm
Nov  2 14:44:11 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/Mkbootstrap.pm".
Please contact the authors!
Nov  2 14:44:11 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MM_NW5.pm
Nov  2 14:44:11 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MM_NW5.pm". Please
contact the authors!
Nov  2 14:44:11 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MM_Any.pm
Nov  2 14:44:11 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MM_Any.pm". Please
contact the authors!
Nov  2 14:44:11 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MakeMaker/
Nov  2 14:44:11 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MakeMaker/". Please
contact the authors!
Nov  2 14:44:11 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MakeMaker/vmsish.pm
Nov  2 14:44:11 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MakeMaker/vmsish.pm".
Please contact the authors!
Nov  2 14:44:11 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MakeMaker/Tutorial.pod
Nov  2 14:44:11 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MakeMaker/Tutorial.pod".
Please contact the authors!
Nov  2 14:44:11 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MakeMaker/FAQ.pod
Nov  2 14:44:11 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MakeMaker/FAQ.pod".
Please contact the authors!
Nov  2 14:44:11 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MakeMaker/bytes.pm
Nov  2 14:44:11 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/MakeMaker/bytes.pm".
Please contact the authors!
Nov  2 14:44:11 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/Liblist/
Nov  2 14:44:11 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/Liblist/". Please
contact the authors!
Nov  2 14:44:11 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/Liblist/Kid.pm
Nov  2 14:44:11 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/Liblist/Kid.pm".
Please contact the authors!
Nov  2 14:44:11 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/Command/
Nov  2 14:44:11 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/Command/". Please
contact the authors!
Nov  2 14:44:11 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/Command/MM.pm
Nov  2 14:44:11 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/Command/MM.pm".
Please contact the authors!
Nov  2 14:44:11 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/CBuilder.pm
Nov  2 14:44:11 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/CBuilder.pm". Please
contact the authors!
Nov  2 14:44:11 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/CBuilder/
Nov  2 14:44:11 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/CBuilder/". Please
contact the authors!
Nov  2 14:44:11 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/CBuilder/Base.pm
Nov  2 14:44:11 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/CBuilder/Base.pm".
Please contact the authors!
Nov  2 14:44:11 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/CBuilder/Platform/
Nov  2 14:44:11 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/CBuilder/Platform/".
Please contact the authors!
Nov  2 14:44:12 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/CBuilder/Platform/Windows.pm

Nov  2 14:44:12 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/CBuilder/Platform/Windows.pm".
Please contact the authors!
Nov  2 14:44:12 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/CBuilder/Platform/aix.pm
Nov  2 14:44:12 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/CBuilder/Platform/aix.pm".
Please contact the authors!
Nov  2 14:44:12 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/CBuilder/Platform/cygwin.pm

Nov  2 14:44:12 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/CBuilder/Platform/cygwin.pm".
Please contact the authors!
Nov  2 14:44:12 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/CBuilder/Platform/VMS.pm
Nov  2 14:44:12 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/CBuilder/Platform/VMS.pm".
Please contact the authors!
Nov  2 14:44:12 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/CBuilder/Platform/Unix.pm

Nov  2 14:44:12 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/CBuilder/Platform/Unix.pm".
Please contact the authors!
Nov  2 14:44:12 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/CBuilder/Platform/darwin.pm

Nov  2 14:44:12 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/CBuilder/Platform/darwin.pm".
Please contact the authors!
Nov  2 14:44:12 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/CBuilder/Platform/os2.pm
Nov  2 14:44:12 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/CBuilder/Platform/os2.pm".
Please contact the authors!
Nov  2 14:44:12 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/ParseXS.pm
Nov  2 14:44:12 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/ParseXS.pm". Please
contact the authors!
Nov  2 14:44:12 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/xsubpp
Nov  2 14:44:12 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/ExtUtils/xsubpp". Please
contact the authors!
Nov  2 14:44:12 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/File/
Nov  2 14:44:12 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/File/".
Please contact the authors!
Nov  2 14:44:12 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/File/Spec.pm
Nov  2 14:44:12 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/File/Spec.pm". Please contact
the authors!
Nov  2 14:44:12 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/File/Spec/
Nov  2 14:44:12 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/File/Spec/". Please contact
the authors!
Nov  2 14:44:12 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/File/Spec/Mac.pm
Nov  2 14:44:12 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/File/Spec/Mac.pm". Please
contact the authors!
Nov  2 14:44:12 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/File/Spec/OS2.pm
Nov  2 14:44:12 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/File/Spec/OS2.pm". Please
contact the authors!
Nov  2 14:44:12 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/File/Spec/VMS.pm
Nov  2 14:44:12 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/File/Spec/VMS.pm". Please
contact the authors!
Nov  2 14:44:12 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/File/Spec/Cygwin.pm
Nov  2 14:44:12 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/File/Spec/Cygwin.pm". Please
contact the authors!
Nov  2 14:44:12 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/File/Spec/Epoc.pm
Nov  2 14:44:12 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/File/Spec/Epoc.pm". Please
contact the authors!
Nov  2 14:44:12 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/File/Spec/Functions.pm
Nov  2 14:44:12 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/File/Spec/Functions.pm".
Please contact the authors!
Nov  2 14:44:12 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/File/Spec/Unix.pm
Nov  2 14:44:12 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/File/Spec/Unix.pm". Please
contact the authors!
Nov  2 14:44:12 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/File/Spec/Win32.pm
Nov  2 14:44:12 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/File/Spec/Win32.pm". Please
contact the authors!
Nov  2 14:44:12 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/File/Find/
Nov  2 14:44:12 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/File/Find/". Please contact
the authors!
Nov  2 14:44:12 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/File/Find/Rule.pm
Nov  2 14:44:12 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/File/Find/Rule.pm". Please
contact the authors!
Nov  2 14:44:12 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/File/Find/Rule/
Nov  2 14:44:12 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/File/Find/Rule/". Please
contact the authors!
Nov  2 14:44:12 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/File/Find/Rule/Extending.pod
Nov  2 14:44:13 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/File/Find/Rule/Extending.pod".
Please contact the authors!
Nov  2 14:44:13 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/File/Find/Rule/Procedural.pod
Nov  2 14:44:13 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/File/Find/Rule/Procedural.pod".
Please contact the authors!
Nov  2 14:44:13 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/File/Listing.pm
Nov  2 14:44:13 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/File/Listing.pm". Please
contact the authors!
Nov  2 14:44:13 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/
Nov  2 14:44:13 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/Pod/".
Please contact the authors!
Nov  2 14:44:13 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/InputObjects.pm
Nov  2 14:44:13 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/InputObjects.pm". Please
contact the authors!
Nov  2 14:44:13 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Select.pm
Nov  2 14:44:13 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Select.pm". Please
contact the authors!
Nov  2 14:44:13 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Checker.pm
Nov  2 14:44:13 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Checker.pm". Please
contact the authors!
Nov  2 14:44:13 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/PlainText.pm
Nov  2 14:44:13 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/PlainText.pm". Please
contact the authors!
Nov  2 14:44:13 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Find.pm
Nov  2 14:44:13 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Find.pm". Please contact
the authors!
Nov  2 14:44:13 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/ParseUtils.pm
Nov  2 14:44:13 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/ParseUtils.pm". Please
contact the authors!
Nov  2 14:44:13 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Usage.pm
Nov  2 14:44:13 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Usage.pm". Please contact
the authors!
Nov  2 14:44:13 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Parser.pm
Nov  2 14:44:13 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Parser.pm". Please
contact the authors!
Nov  2 14:44:13 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Escapes.pm
Nov  2 14:44:13 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Escapes.pm". Please
contact the authors!
Nov  2 14:44:13 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple.pm
Nov  2 14:44:13 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple.pm". Please
contact the authors!
Nov  2 14:44:13 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple.pod
Nov  2 14:44:13 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple.pod". Please
contact the authors!
Nov  2 14:44:13 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/
Nov  2 14:44:13 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/". Please contact
the authors!
Nov  2 14:44:13 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/DumpAsText.pm
Nov  2 14:44:13 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/DumpAsText.pm".
Please contact the authors!
Nov  2 14:44:13 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/LinkSection.pm
Nov  2 14:44:13 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/LinkSection.pm".
Please contact the authors!
Nov  2 14:44:13 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/Progress.pm
Nov  2 14:44:13 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/Progress.pm".
Please contact the authors!
Nov  2 14:44:13 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/XMLOutStream.pm
Nov  2 14:44:13 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/XMLOutStream.pm".
Please contact the authors!
Nov  2 14:44:13 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/TextContent.pm
Nov  2 14:44:13 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/TextContent.pm".
Please contact the authors!
Nov  2 14:44:13 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/Search.pm
Nov  2 14:44:13 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/Search.pm". Please
contact the authors!
Nov  2 14:44:13 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/TranscodeSmart.pm
Nov  2 14:44:13 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/TranscodeSmart.pm".
Please contact the authors!
Nov  2 14:44:14 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/Text.pm
Nov  2 14:44:14 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/Text.pm". Please
contact the authors!
Nov  2 14:44:14 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/Debug.pm
Nov  2 14:44:14 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/Debug.pm". Please
contact the authors!
Nov  2 14:44:14 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/PullParserStartToken.pm

Nov  2 14:44:14 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/PullParserStartToken.pm".
Please contact the authors!
Nov  2 14:44:14 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/Methody.pm
Nov  2 14:44:14 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/Methody.pm".
Please contact the authors!
Nov  2 14:44:14 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/PullParserEndToken.pm
Nov  2 14:44:14 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/PullParserEndToken.pm".
Please contact the authors!
Nov  2 14:44:14 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/PullParserTextToken.pm
Nov  2 14:44:14 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/PullParserTextToken.pm".
Please contact the authors!
Nov  2 14:44:14 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/TranscodeDumb.pm
Nov  2 14:44:14 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/TranscodeDumb.pm".
Please contact the authors!
Nov  2 14:44:14 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/HTMLBatch.pm
Nov  2 14:44:14 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/HTMLBatch.pm".
Please contact the authors!
Nov  2 14:44:14 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/RTF.pm
Nov  2 14:44:14 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/RTF.pm". Please
contact the authors!
Nov  2 14:44:14 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/Checker.pm
Nov  2 14:44:14 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/Checker.pm".
Please contact the authors!
Nov  2 14:44:14 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/PullParser.pm
Nov  2 14:44:14 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/PullParser.pm".
Please contact the authors!
Nov  2 14:44:14 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/PullParserToken.pm
Nov  2 14:44:14 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/PullParserToken.pm".
Please contact the authors!
Nov  2 14:44:14 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/SimpleTree.pm
Nov  2 14:44:14 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/SimpleTree.pm".
Please contact the authors!
Nov  2 14:44:14 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/TiedOutFH.pm
Nov  2 14:44:14 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/TiedOutFH.pm".
Please contact the authors!
Nov  2 14:44:14 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/HTML.pm
Nov  2 14:44:14 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/HTML.pm". Please
contact the authors!
Nov  2 14:44:14 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/Subclassing.pod
Nov  2 14:44:14 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/Subclassing.pod".
Please contact the authors!
Nov  2 14:44:14 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/BlackBox.pm
Nov  2 14:44:14 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/BlackBox.pm".
Please contact the authors!
Nov  2 14:44:14 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/HTMLLegacy.pm
Nov  2 14:44:14 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/HTMLLegacy.pm".
Please contact the authors!
Nov  2 14:44:14 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/DumpAsXML.pm
Nov  2 14:44:14 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/DumpAsXML.pm".
Please contact the authors!
Nov  2 14:44:14 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/Transcode.pm
Nov  2 14:44:14 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Simple/Transcode.pm".
Please contact the authors!
Nov  2 14:44:14 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/ParseLink.pm
Nov  2 14:44:14 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/ParseLink.pm". Please
contact the authors!
Nov  2 14:44:14 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Text.pm
Nov  2 14:44:14 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Text.pm". Please contact
the authors!
Nov  2 14:44:14 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Man.pm
Nov  2 14:44:14 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Man.pm". Please contact
the authors!
Nov  2 14:44:15 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Text/
Nov  2 14:44:15 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/Pod/Text/".
Please contact the authors!
Nov  2 14:44:15 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Text/Termcap.pm
Nov  2 14:44:15 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Text/Termcap.pm". Please
contact the authors!
Nov  2 14:44:15 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Text/Color.pm
Nov  2 14:44:15 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Text/Color.pm". Please
contact the authors!
Nov  2 14:44:15 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Pod/Text/Overstrike.pm
Nov  2 14:44:15 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Pod/Text/Overstrike.pm".
Please contact the authors!
Nov  2 14:44:15 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Test/
Nov  2 14:44:15 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/Test/".
Please contact the authors!
Nov  2 14:44:15 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Test/Builder/
Nov  2 14:44:15 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Test/Builder/". Please
contact the authors!
Nov  2 14:44:15 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Test/Builder/Tester.pm
Nov  2 14:44:15 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Test/Builder/Tester.pm".
Please contact the authors!
Nov  2 14:44:15 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Test/Builder/Tester/
Nov  2 14:44:15 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Test/Builder/Tester/". Please
contact the authors!
Nov  2 14:44:15 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Test/Builder/Tester/Color.pm
Nov  2 14:44:15 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Test/Builder/Tester/Color.pm".
Please contact the authors!
Nov  2 14:44:15 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Test/Pod.pm
Nov  2 14:44:15 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Test/Pod.pm". Please contact
the authors!
Nov  2 14:44:15 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Test/Manifest.pm
Nov  2 14:44:15 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Test/Manifest.pm". Please
contact the authors!
Nov  2 14:44:15 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Test/Builder.pm
Nov  2 14:44:15 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Test/Builder.pm". Please
contact the authors!
Nov  2 14:44:15 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Test/Simple.pm
Nov  2 14:44:15 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Test/Simple.pm". Please
contact the authors!
Nov  2 14:44:15 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Test/More.pm
Nov  2 14:44:15 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Test/More.pm". Please contact
the authors!
Nov  2 14:44:15 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Test/Tutorial.pod
Nov  2 14:44:15 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Test/Tutorial.pod". Please
contact the authors!
Nov  2 14:44:15 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/perlpodspec.pod
Nov  2 14:44:15 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/perlpodspec.pod". Please
contact the authors!
Nov  2 14:44:15 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/perlpod.pod
Nov  2 14:44:15 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/perlpod.pod". Please contact
the authors!
Nov  2 14:44:15 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Archive/
Nov  2 14:44:15 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/Archive/".
Please contact the authors!
Nov  2 14:44:15 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Archive/Tar.pm
Nov  2 14:44:15 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Archive/Tar.pm". Please
contact the authors!
Nov  2 14:44:15 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Archive/Tar/
Nov  2 14:44:15 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Archive/Tar/". Please contact
the authors!
Nov  2 14:44:15 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Archive/Tar/Constant.pm
Nov  2 14:44:15 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Archive/Tar/Constant.pm".
Please contact the authors!
Nov  2 14:44:15 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Archive/Tar/File.pm
Nov  2 14:44:15 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Archive/Tar/File.pm". Please
contact the authors!
Nov  2 14:44:15 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/YAML.pod
Nov  2 14:44:16 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/YAML.pod".
Please contact the authors!
Nov  2 14:44:16 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/YAML.pm
Nov  2 14:44:16 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/YAML.pm".
Please contact the authors!
Nov  2 14:44:16 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/YAML/
Nov  2 14:44:16 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/YAML/".
Please contact the authors!
Nov  2 14:44:16 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/YAML/Node.pm
Nov  2 14:44:16 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/YAML/Node.pm". Please contact
the authors!
Nov  2 14:44:16 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/YAML/Transfer.pm
Nov  2 14:44:16 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/YAML/Transfer.pm". Please
contact the authors!
Nov  2 14:44:16 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/YAML/Family.pm
Nov  2 14:44:16 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/YAML/Family.pm". Please
contact the authors!
Nov  2 14:44:16 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/YAML/Error.pm
Nov  2 14:44:16 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/YAML/Error.pm". Please
contact the authors!
Nov  2 14:44:16 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Text/
Nov  2 14:44:16 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/Text/".
Please contact the authors!
Nov  2 14:44:16 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Text/Glob.pm
Nov  2 14:44:16 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Text/Glob.pm". Please contact
the authors!
Nov  2 14:44:16 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Text/Wrap.pm
Nov  2 14:44:16 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Text/Wrap.pm". Please contact
the authors!
Nov  2 14:44:16 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Text/Tabs.pm
Nov  2 14:44:16 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Text/Tabs.pm". Please contact
the authors!
Nov  2 14:44:16 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Number/
Nov  2 14:44:16 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/Number/".
Please contact the authors!
Nov  2 14:44:16 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Number/Compare.pm
Nov  2 14:44:16 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Number/Compare.pm". Please
contact the authors!
Nov  2 14:44:16 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Business/
Nov  2 14:44:16 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/Business/".
Please contact the authors!
Nov  2 14:44:16 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Business/ISBN.pm
Nov  2 14:44:16 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Business/ISBN.pm". Please
contact the authors!
Nov  2 14:44:16 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Business/ISBN/
Nov  2 14:44:16 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Business/ISBN/". Please
contact the authors!
Nov  2 14:44:16 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Business/ISBN/Data.pm
Nov  2 14:44:16 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Business/ISBN/Data.pm".
Please contact the authors!
Nov  2 14:44:16 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/HTML/
Nov  2 14:44:16 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/HTML/".
Please contact the authors!
Nov  2 14:44:16 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/HTML/Tagset.pm
Nov  2 14:44:16 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/HTML/Tagset.pm". Please
contact the authors!
Nov  2 14:44:16 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/HTML/Form.pm
Nov  2 14:44:16 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/HTML/Form.pm". Please contact
the authors!
Nov  2 14:44:16 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI.pm
Nov  2 14:44:16 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/URI.pm".
Please contact the authors!
Nov  2 14:44:16 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/
Nov  2 14:44:16 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/URI/".
Please contact the authors!
Nov  2 14:44:16 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/_ldap.pm
Nov  2 14:44:16 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/_ldap.pm". Please contact
the authors!
Nov  2 14:44:16 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/ftp.pm
Nov  2 14:44:16 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/ftp.pm". Please contact
the authors!
Nov  2 14:44:17 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/_segment.pm
Nov  2 14:44:17 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/_segment.pm". Please
contact the authors!
Nov  2 14:44:17 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/_generic.pm
Nov  2 14:44:17 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/_generic.pm". Please
contact the authors!
Nov  2 14:44:17 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/tn3270.pm
Nov  2 14:44:17 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/tn3270.pm". Please
contact the authors!
Nov  2 14:44:17 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/nntp.pm
Nov  2 14:44:17 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/nntp.pm". Please contact
the authors!
Nov  2 14:44:17 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/QueryParam.pm
Nov  2 14:44:17 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/QueryParam.pm". Please
contact the authors!
Nov  2 14:44:17 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/sips.pm
Nov  2 14:44:17 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/sips.pm". Please contact
the authors!
Nov  2 14:44:17 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/gopher.pm
Nov  2 14:44:17 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/gopher.pm". Please
contact the authors!
Nov  2 14:44:17 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/WithBase.pm
Nov  2 14:44:17 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/WithBase.pm". Please
contact the authors!
Nov  2 14:44:17 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/ldapi.pm
Nov  2 14:44:17 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/ldapi.pm". Please contact
the authors!
Nov  2 14:44:17 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/mailto.pm
Nov  2 14:44:17 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/mailto.pm". Please
contact the authors!
Nov  2 14:44:17 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/data.pm
Nov  2 14:44:17 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/data.pm". Please contact
the authors!
Nov  2 14:44:17 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/_userpass.pm
Nov  2 14:44:17 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/_userpass.pm". Please
contact the authors!
Nov  2 14:44:17 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/urn.pm
Nov  2 14:44:17 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/urn.pm". Please contact
the authors!
Nov  2 14:44:17 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/ldap.pm
Nov  2 14:44:17 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/ldap.pm". Please contact
the authors!
Nov  2 14:44:17 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/telnet.pm
Nov  2 14:44:17 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/telnet.pm". Please
contact the authors!
Nov  2 14:44:17 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/mms.pm
Nov  2 14:44:17 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/mms.pm". Please contact
the authors!
Nov  2 14:44:17 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/_foreign.pm
Nov  2 14:44:17 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/_foreign.pm". Please
contact the authors!
Nov  2 14:44:17 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/Heuristic.pm
Nov  2 14:44:17 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/Heuristic.pm". Please
contact the authors!
Nov  2 14:44:17 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/_server.pm
Nov  2 14:44:17 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/_server.pm". Please
contact the authors!
Nov  2 14:44:17 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/URL.pm
Nov  2 14:44:17 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/URL.pm". Please contact
the authors!
Nov  2 14:44:17 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/rtsp.pm
Nov  2 14:44:17 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/rtsp.pm". Please contact
the authors!
Nov  2 14:44:17 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/_query.pm
Nov  2 14:44:17 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/_query.pm". Please
contact the authors!
Nov  2 14:44:17 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/file.pm
Nov  2 14:44:17 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/file.pm". Please contact
the authors!
Nov  2 14:44:17 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/Split.pm
Nov  2 14:44:17 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/Split.pm". Please contact
the authors!
Nov  2 14:44:18 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/rlogin.pm
Nov  2 14:44:18 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/rlogin.pm". Please
contact the authors!
Nov  2 14:44:18 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/news.pm
Nov  2 14:44:18 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/news.pm". Please contact
the authors!
Nov  2 14:44:18 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/ssh.pm
Nov  2 14:44:18 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/ssh.pm". Please contact
the authors!
Nov  2 14:44:18 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/http.pm
Nov  2 14:44:18 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/http.pm". Please contact
the authors!
Nov  2 14:44:18 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/rsync.pm
Nov  2 14:44:18 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/rsync.pm". Please contact
the authors!
Nov  2 14:44:18 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/https.pm
Nov  2 14:44:18 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/https.pm". Please contact
the authors!
Nov  2 14:44:18 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/ldaps.pm
Nov  2 14:44:18 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/ldaps.pm". Please contact
the authors!
Nov  2 14:44:18 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/snews.pm
Nov  2 14:44:18 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/snews.pm". Please contact
the authors!
Nov  2 14:44:18 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/pop.pm
Nov  2 14:44:18 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/pop.pm". Please contact
the authors!
Nov  2 14:44:18 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/rtspu.pm
Nov  2 14:44:18 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/rtspu.pm". Please contact
the authors!
Nov  2 14:44:18 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/Escape.pm
Nov  2 14:44:18 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/Escape.pm". Please
contact the authors!
Nov  2 14:44:18 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/sip.pm
Nov  2 14:44:18 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/sip.pm". Please contact
the authors!
Nov  2 14:44:18 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/_login.pm
Nov  2 14:44:18 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/_login.pm". Please
contact the authors!
Nov  2 14:44:18 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/file/
Nov  2 14:44:18 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/URI/file/".
Please contact the authors!
Nov  2 14:44:18 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/file/OS2.pm
Nov  2 14:44:18 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/file/OS2.pm". Please
contact the authors!
Nov  2 14:44:18 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/file/QNX.pm
Nov  2 14:44:18 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/file/QNX.pm". Please
contact the authors!
Nov  2 14:44:18 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/file/Base.pm
Nov  2 14:44:18 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/file/Base.pm". Please
contact the authors!
Nov  2 14:44:18 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/file/Unix.pm
Nov  2 14:44:18 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/file/Unix.pm". Please
contact the authors!
Nov  2 14:44:18 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/file/Win32.pm
Nov  2 14:44:18 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/file/Win32.pm". Please
contact the authors!
Nov  2 14:44:18 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/file/FAT.pm
Nov  2 14:44:18 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/file/FAT.pm". Please
contact the authors!
Nov  2 14:44:18 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/file/Mac.pm
Nov  2 14:44:18 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/file/Mac.pm". Please
contact the authors!
Nov  2 14:44:18 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/urn/
Nov  2 14:44:18 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/URI/urn/".
Please contact the authors!
Nov  2 14:44:18 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/urn/oid.pm
Nov  2 14:44:18 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/urn/oid.pm". Please
contact the authors!
Nov  2 14:44:19 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/URI/urn/isbn.pm
Nov  2 14:44:19 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/URI/urn/isbn.pm". Please
contact the authors!
Nov  2 14:44:19 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP.pm
Nov  2 14:44:19 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/LWP.pm".
Please contact the authors!
Nov  2 14:44:19 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/lwptut.pod
Nov  2 14:44:19 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/lwptut.pod". Please contact
the authors!
Nov  2 14:44:19 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/lwpcook.pod
Nov  2 14:44:19 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/lwpcook.pod". Please contact
the authors!
Nov  2 14:44:19 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/
Nov  2 14:44:19 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/LWP/".
Please contact the authors!
Nov  2 14:44:19 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/RobotUA.pm
Nov  2 14:44:19 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/RobotUA.pm". Please
contact the authors!
Nov  2 14:44:19 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol.pm
Nov  2 14:44:19 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol.pm". Please
contact the authors!
Nov  2 14:44:19 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/UserAgent.pm
Nov  2 14:44:19 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/UserAgent.pm". Please
contact the authors!
Nov  2 14:44:19 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/MemberMixin.pm
Nov  2 14:44:19 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/MemberMixin.pm". Please
contact the authors!
Nov  2 14:44:19 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/Debug.pm
Nov  2 14:44:19 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/Debug.pm". Please contact
the authors!
Nov  2 14:44:19 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/media.types
Nov  2 14:44:19 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/media.types". Please
contact the authors!
Nov  2 14:44:19 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/ConnCache.pm
Nov  2 14:44:19 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/ConnCache.pm". Please
contact the authors!
Nov  2 14:44:19 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/MediaTypes.pm
Nov  2 14:44:19 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/MediaTypes.pm". Please
contact the authors!
Nov  2 14:44:19 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/DebugFile.pm
Nov  2 14:44:19 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/DebugFile.pm". Please
contact the authors!
Nov  2 14:44:19 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/Simple.pm
Nov  2 14:44:19 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/Simple.pm". Please
contact the authors!
Nov  2 14:44:19 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/Authen/
Nov  2 14:44:19 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/Authen/". Please contact
the authors!
Nov  2 14:44:19 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/Authen/Ntlm.pm
Nov  2 14:44:19 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/Authen/Ntlm.pm". Please
contact the authors!
Nov  2 14:44:19 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/Authen/Digest.pm
Nov  2 14:44:19 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/Authen/Digest.pm". Please
contact the authors!
Nov  2 14:44:19 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/Authen/Basic.pm
Nov  2 14:44:19 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/Authen/Basic.pm". Please
contact the authors!
Nov  2 14:44:19 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/
Nov  2 14:44:19 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/". Please
contact the authors!
Nov  2 14:44:19 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/ftp.pm
Nov  2 14:44:19 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/ftp.pm". Please
contact the authors!
Nov  2 14:44:19 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/gopher.pm
Nov  2 14:44:19 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/gopher.pm".
Please contact the authors!
Nov  2 14:44:19 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/cpan.pm
Nov  2 14:44:19 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/cpan.pm". Please
contact the authors!
Nov  2 14:44:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/nntp.pm
Nov  2 14:44:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/nntp.pm". Please
contact the authors!
Nov  2 14:44:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/loopback.pm
Nov  2 14:44:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/loopback.pm".
Please contact the authors!
Nov  2 14:44:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/mailto.pm
Nov  2 14:44:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/mailto.pm".
Please contact the authors!
Nov  2 14:44:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/https10.pm
Nov  2 14:44:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/https10.pm".
Please contact the authors!
Nov  2 14:44:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/http.pm
Nov  2 14:44:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/http.pm". Please
contact the authors!
Nov  2 14:44:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/file.pm
Nov  2 14:44:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/file.pm". Please
contact the authors!
Nov  2 14:44:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/http10.pm
Nov  2 14:44:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/http10.pm".
Please contact the authors!
Nov  2 14:44:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/GHTTP.pm
Nov  2 14:44:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/GHTTP.pm".
Please contact the authors!
Nov  2 14:44:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/data.pm
Nov  2 14:44:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/data.pm". Please
contact the authors!
Nov  2 14:44:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/nogo.pm
Nov  2 14:44:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/nogo.pm". Please
contact the authors!
Nov  2 14:44:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/https.pm
Nov  2 14:44:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/LWP/Protocol/https.pm".
Please contact the authors!
Nov  2 14:44:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/HTTP/
Nov  2 14:44:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/HTTP/".
Please contact the authors!
Nov  2 14:44:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Message.pm
Nov  2 14:44:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Message.pm". Please
contact the authors!
Nov  2 14:44:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Status.pm
Nov  2 14:44:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Status.pm". Please
contact the authors!
Nov  2 14:44:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Daemon.pm
Nov  2 14:44:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Daemon.pm". Please
contact the authors!
Nov  2 14:44:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Cookies.pm
Nov  2 14:44:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Cookies.pm". Please
contact the authors!
Nov  2 14:44:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Date.pm
Nov  2 14:44:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Date.pm". Please contact
the authors!
Nov  2 14:44:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Request.pm
Nov  2 14:44:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Request.pm". Please
contact the authors!
Nov  2 14:44:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Negotiate.pm
Nov  2 14:44:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Negotiate.pm". Please
contact the authors!
Nov  2 14:44:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Response.pm
Nov  2 14:44:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Response.pm". Please
contact the authors!
Nov  2 14:44:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Headers.pm
Nov  2 14:44:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Headers.pm". Please
contact the authors!
Nov  2 14:44:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Headers/
Nov  2 14:44:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Headers/". Please
contact the authors!
Nov  2 14:44:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Headers/ETag.pm
Nov  2 14:44:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Headers/ETag.pm". Please
contact the authors!
Nov  2 14:44:20 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Headers/Util.pm
Nov  2 14:44:20 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Headers/Util.pm". Please
contact the authors!
Nov  2 14:44:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Headers/Auth.pm
Nov  2 14:44:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Headers/Auth.pm". Please
contact the authors!
Nov  2 14:44:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Request/
Nov  2 14:44:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Request/". Please
contact the authors!
Nov  2 14:44:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Request/Common.pm
Nov  2 14:44:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Request/Common.pm".
Please contact the authors!
Nov  2 14:44:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Cookies/
Nov  2 14:44:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Cookies/". Please
contact the authors!
Nov  2 14:44:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Cookies/Netscape.pm
Nov  2 14:44:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Cookies/Netscape.pm".
Please contact the authors!
Nov  2 14:44:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Cookies/Microsoft.pm
Nov  2 14:44:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/HTTP/Cookies/Microsoft.pm".
Please contact the authors!
Nov  2 14:44:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Net/
Nov  2 14:44:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/Net/".
Please contact the authors!
Nov  2 14:44:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Net/HTTPS.pm
Nov  2 14:44:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Net/HTTPS.pm". Please contact
the authors!
Nov  2 14:44:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Net/HTTP.pm
Nov  2 14:44:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Net/HTTP.pm". Please contact
the authors!
Nov  2 14:44:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Net/HTTP/
Nov  2 14:44:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/Net/HTTP/".
Please contact the authors!
Nov  2 14:44:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Net/HTTP/NB.pm
Nov  2 14:44:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Net/HTTP/NB.pm". Please
contact the authors!
Nov  2 14:44:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Net/HTTP/Methods.pm
Nov  2 14:44:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Net/HTTP/Methods.pm". Please
contact the authors!
Nov  2 14:44:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Net/CIDR/
Nov  2 14:44:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/Net/CIDR/".
Please contact the authors!
Nov  2 14:44:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Net/CIDR/Lite.pm
Nov  2 14:44:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Net/CIDR/Lite.pm". Please
contact the authors!
Nov  2 14:44:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Net/POP3.pm
Nov  2 14:44:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Net/POP3.pm". Please contact
the authors!
Nov  2 14:44:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Net/SMTP.pm
Nov  2 14:44:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Net/SMTP.pm". Please contact
the authors!
Nov  2 14:44:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Net/Config.pm
Nov  2 14:44:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Net/Config.pm". Please
contact the authors!
Nov  2 14:44:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Net/libnetFAQ.pod
Nov  2 14:44:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Net/libnetFAQ.pod". Please
contact the authors!
Nov  2 14:44:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Net/Domain.pm
Nov  2 14:44:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Net/Domain.pm". Please
contact the authors!
Nov  2 14:44:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Net/Cmd.pm
Nov  2 14:44:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Net/Cmd.pm". Please contact
the authors!
Nov  2 14:44:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Net/FTP.pm
Nov  2 14:44:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Net/FTP.pm". Please contact
the authors!
Nov  2 14:44:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Net/libnet.cfg
Nov  2 14:44:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Net/libnet.cfg". Please
contact the authors!
Nov  2 14:44:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Net/Netrc.pm
Nov  2 14:44:21 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Net/Netrc.pm". Please contact
the authors!
Nov  2 14:44:21 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Net/NNTP.pm
Nov  2 14:44:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Net/NNTP.pm". Please contact
the authors!
Nov  2 14:44:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Net/Time.pm
Nov  2 14:44:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Net/Time.pm". Please contact
the authors!
Nov  2 14:44:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Net/FTP/
Nov  2 14:44:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/Net/FTP/".
Please contact the authors!
Nov  2 14:44:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Net/FTP/dataconn.pm
Nov  2 14:44:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Net/FTP/dataconn.pm". Please
contact the authors!
Nov  2 14:44:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Net/FTP/E.pm
Nov  2 14:44:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Net/FTP/E.pm". Please contact
the authors!
Nov  2 14:44:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Net/FTP/L.pm
Nov  2 14:44:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Net/FTP/L.pm". Please contact
the authors!
Nov  2 14:44:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Net/FTP/A.pm
Nov  2 14:44:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Net/FTP/A.pm". Please contact
the authors!
Nov  2 14:44:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Net/FTP/I.pm
Nov  2 14:44:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Net/FTP/I.pm". Please contact
the authors!
Nov  2 14:44:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Net/Telnet.pm
Nov  2 14:44:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Net/Telnet.pm". Please
contact the authors!
Nov  2 14:44:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/WWW/
Nov  2 14:44:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/WWW/".
Please contact the authors!
Nov  2 14:44:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/WWW/RobotRules.pm
Nov  2 14:44:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/WWW/RobotRules.pm". Please
contact the authors!
Nov  2 14:44:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/WWW/RobotRules/
Nov  2 14:44:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/WWW/RobotRules/". Please
contact the authors!
Nov  2 14:44:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/WWW/RobotRules/AnyDBM_File.pm
Nov  2 14:44:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/WWW/RobotRules/AnyDBM_File.pm".
Please contact the authors!
Nov  2 14:44:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Bundle/
Nov  2 14:44:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/Bundle/".
Please contact the authors!
Nov  2 14:44:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Bundle/LWP.pm
Nov  2 14:44:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Bundle/LWP.pm". Please
contact the authors!
Nov  2 14:44:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Geography/
Nov  2 14:44:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Geography/". Please contact
the authors!
Nov  2 14:44:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Geography/Countries.pm
Nov  2 14:44:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Geography/Countries.pm".
Please contact the authors!
Nov  2 14:44:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/IP/
Nov  2 14:44:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/IP/".
Please contact the authors!
Nov  2 14:44:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/IP/Authority.pm
Nov  2 14:44:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/IP/Authority.pm". Please
contact the authors!
Nov  2 14:44:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/IP/Country.pm
Nov  2 14:44:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/IP/Country.pm". Please
contact the authors!
Nov  2 14:44:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/IP/Country/
Nov  2 14:44:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/IP/Country/". Please contact
the authors!
Nov  2 14:44:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/IP/Country/Fast.pm
Nov  2 14:44:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/IP/Country/Fast.pm". Please
contact the authors!
Nov  2 14:44:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/IP/Country/Medium.pm
Nov  2 14:44:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/IP/Country/Medium.pm". Please
contact the authors!
Nov  2 14:44:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/IP/Country/MaxMind.pm
Nov  2 14:44:22 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/IP/Country/MaxMind.pm".
Please contact the authors!
Nov  2 14:44:22 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/IP/Country/Slow.pm
Nov  2 14:44:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/IP/Country/Slow.pm". Please
contact the authors!
Nov  2 14:44:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/IP/Country/Fast/
Nov  2 14:44:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/IP/Country/Fast/". Please
contact the authors!
Nov  2 14:44:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/IP/Country/Fast/cc.gif
Nov  2 14:44:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/IP/Country/Fast/cc.gif".
Please contact the authors!
Nov  2 14:44:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/IP/Country/Fast/ip.gif
Nov  2 14:44:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/IP/Country/Fast/ip.gif".
Please contact the authors!
Nov  2 14:44:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/IP/Authority/
Nov  2 14:44:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/IP/Authority/". Please
contact the authors!
Nov  2 14:44:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/IP/Authority/ipauth.gif
Nov  2 14:44:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/IP/Authority/ipauth.gif".
Please contact the authors!
Nov  2 14:44:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/IP/Authority/auth.gif
Nov  2 14:44:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/IP/Authority/auth.gif".
Please contact the authors!
Nov  2 14:44:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Digest/
Nov  2 14:44:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/Digest/".
Please contact the authors!
Nov  2 14:44:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Digest/HMAC_MD5.pm
Nov  2 14:44:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Digest/HMAC_MD5.pm". Please
contact the authors!
Nov  2 14:44:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Digest/HMAC.pm
Nov  2 14:44:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Digest/HMAC.pm". Please
contact the authors!
Nov  2 14:44:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Digest/HMAC_SHA1.pm
Nov  2 14:44:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Digest/HMAC_SHA1.pm". Please
contact the authors!
Nov  2 14:44:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Digest/base.pm
Nov  2 14:44:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Digest/base.pm". Please
contact the authors!
Nov  2 14:44:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Digest.pm
Nov  2 14:44:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/Digest.pm".
Please contact the authors!
Nov  2 14:44:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Sys/
Nov  2 14:44:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/perl_modules/Sys/".
Please contact the authors!
Nov  2 14:44:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Sys/Hostname/
Nov  2 14:44:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Sys/Hostname/". Please
contact the authors!
Nov  2 14:44:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Sys/Hostname/testall.pl
Nov  2 14:44:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Sys/Hostname/testall.pl".
Please contact the authors!
Nov  2 14:44:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/perl_modules/Sys/Hostname/Long.pm
Nov  2 14:44:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/opt/perl_modules/Sys/Hostname/Long.pm". Please
contact the authors!
Nov  2 14:44:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/opt/f-prot/
Nov  2 14:44:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/opt/f-prot/". Please contact
the authors!
Nov  2 14:44:23 scanmail MailScanner[1685]: var/log/copfilter/0.0.95/tests/
Nov  2 14:44:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/tests/". Please contact the
authors!
Nov  2 14:44:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/tests/virus/
Nov  2 14:44:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/tests/virus/". Please
contact the authors!
Nov  2 14:44:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/tests/virus/eicar.com
Nov  2 14:44:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/tests/virus/eicar.com".
Please contact the authors!
Nov  2 14:44:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/tests/virus/eicar.zip
Nov  2 14:44:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/tests/virus/eicar.zip".
Please contact the authors!
Nov  2 14:44:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/tests/virus/eicar_com.zip
Nov  2 14:44:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/tests/virus/eicar_com.zip".
Please contact the authors!
Nov  2 14:44:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/tests/virus/eicarcom2.zip
Nov  2 14:44:23 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/tests/virus/eicarcom2.zip".
Please contact the authors!
Nov  2 14:44:23 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/tests/virus/send_virus_mail.sh
Nov  2 14:44:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/tests/virus/send_virus_mail.sh". Please
contact the authors!
Nov  2 14:44:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/tests/virus/test_attachment.exe
Nov  2 14:44:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/tests/virus/test_attachment.exe". Please
contact the authors!
Nov  2 14:44:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/tests/virus/send_exe_file_mail.sh
Nov  2 14:44:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/tests/virus/send_exe_file_mail.sh". Please
contact the authors!
Nov  2 14:44:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/tests/all_tests/
Nov  2 14:44:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/tests/all_tests/". Please
contact the authors!
Nov  2 14:44:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/tests/all_tests/test_pkg.sh
Nov  2 14:44:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/tests/all_tests/test_pkg.sh". Please contact
the authors!
Nov  2 14:44:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/tests/spam/
Nov  2 14:44:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/tests/spam/". Please contact
the authors!
Nov  2 14:44:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/tests/spam/spam_mail
Nov  2 14:44:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/tests/spam/spam_mail".
Please contact the authors!
Nov  2 14:44:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/tests/spam/spam_mail_without_html
Nov  2 14:44:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/tests/spam/spam_mail_without_html". Please
contact the authors!
Nov  2 14:44:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/tests/spam/attachment.html
Nov  2 14:44:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/tests/spam/attachment.html".
Please contact the authors!
Nov  2 14:44:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/tests/spam/send_spam_mail.sh
Nov  2 14:44:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"var/log/copfilter/0.0.95/tests/spam/send_spam_mail.sh". Please contact
the authors!
Nov  2 14:44:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/tests/spam/t.sh
Nov  2 14:44:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/tests/spam/t.sh". Please
contact the authors!
Nov  2 14:44:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/tests/make_all_tests.sh
Nov  2 14:44:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/tests/make_all_tests.sh".
Please contact the authors!
Nov  2 14:44:24 scanmail MailScanner[1685]:
var/log/copfilter/0.0.95/uninstall.sh
Nov  2 14:44:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "var/log/copfilter/0.0.95/uninstall.sh". Please
contact the authors!
Nov  2 14:44:24 scanmail MailScanner[1685]: IPC/
Nov  2 14:44:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "IPC/". Please contact the authors!
Nov  2 14:44:24 scanmail MailScanner[1685]: IPC/Open2.pm
Nov  2 14:44:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "IPC/Open2.pm". Please contact the authors!
Nov  2 14:44:24 scanmail MailScanner[1685]: IPC/Open3.pm
Nov  2 14:44:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "IPC/Open3.pm". Please contact the authors!
Nov  2 14:44:24 scanmail MailScanner[1685]:
usr/local/bin/copfilter_check-updates_clamav
Nov  2 14:44:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/local/bin/copfilter_check-updates_clamav". Please
contact the authors!
Nov  2 14:44:24 scanmail MailScanner[1685]:
usr/local/bin/copfilter_check-updates_f-prot
Nov  2 14:44:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/local/bin/copfilter_check-updates_f-prot". Please
contact the authors!
Nov  2 14:44:24 scanmail MailScanner[1685]: usr/local/bin/copfilter_cron
Nov  2 14:44:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/local/bin/copfilter_cron". Please contact the
authors!
Nov  2 14:44:24 scanmail MailScanner[1685]:
usr/local/bin/copfilter_make_test
Nov  2 14:44:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/local/bin/copfilter_make_test". Please contact
the authors!
Nov  2 14:44:24 scanmail MailScanner[1685]:
usr/local/bin/copfilter_restartclamd
Nov  2 14:44:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/local/bin/copfilter_restartclamd". Please contact
the authors!
Nov  2 14:44:24 scanmail MailScanner[1685]:
usr/local/bin/copfilter_restartp3scan
Nov  2 14:44:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/local/bin/copfilter_restartp3scan". Please
contact the authors!
Nov  2 14:44:24 scanmail MailScanner[1685]:
usr/local/bin/copfilter_restartp3scan_debug
Nov  2 14:44:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/local/bin/copfilter_restartp3scan_debug". Please
contact the authors!
Nov  2 14:44:24 scanmail MailScanner[1685]:
usr/local/bin/copfilter_restartprivoxy
Nov  2 14:44:24 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/local/bin/copfilter_restartprivoxy". Please
contact the authors!
Nov  2 14:44:25 scanmail MailScanner[1685]:
usr/local/bin/copfilter_restartrenattach
Nov  2 14:44:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/local/bin/copfilter_restartrenattach". Please
contact the authors!
Nov  2 14:44:25 scanmail MailScanner[1685]:
usr/local/bin/copfilter_restartspamd
Nov  2 14:44:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/local/bin/copfilter_restartspamd". Please contact
the authors!
Nov  2 14:44:25 scanmail MailScanner[1685]:
usr/local/bin/copfilter_updates_rules_du_jour
Nov  2 14:44:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/local/bin/copfilter_updates_rules_du_jour".
Please contact the authors!
Nov  2 14:44:25 scanmail MailScanner[1685]: backup3/
Nov  2 14:44:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "backup3/". Please contact the authors!
Nov  2 14:44:25 scanmail MailScanner[1685]:
backup3/copfilter_check-updates_clamav.c
Nov  2 14:44:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "backup3/copfilter_check-updates_clamav.c". Please
contact the authors!
Nov  2 14:44:25 scanmail MailScanner[1685]:
backup3/copfilter_check-updates_f-prot.c
Nov  2 14:44:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "backup3/copfilter_check-updates_f-prot.c". Please
contact the authors!
Nov  2 14:44:25 scanmail MailScanner[1685]: backup3/copfilter_make_command
Nov  2 14:44:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "backup3/copfilter_make_command". Please contact the
authors!
Nov  2 14:44:25 scanmail MailScanner[1685]: backup3/copfilter_make_test.c
Nov  2 14:44:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "backup3/copfilter_make_test.c". Please contact the
authors!
Nov  2 14:44:25 scanmail MailScanner[1685]:
backup3/copfilter_restartclamd.c
Nov  2 14:44:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "backup3/copfilter_restartclamd.c". Please contact the
authors!
Nov  2 14:44:25 scanmail MailScanner[1685]:
backup3/copfilter_restartp3scan.c
Nov  2 14:44:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "backup3/copfilter_restartp3scan.c". Please contact
the authors!
Nov  2 14:44:25 scanmail MailScanner[1685]:
backup3/copfilter_restartp3scan_debug.c
Nov  2 14:44:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "backup3/copfilter_restartp3scan_debug.c". Please
contact the authors!
Nov  2 14:44:25 scanmail MailScanner[1685]:
backup3/copfilter_restartprivoxy.c
Nov  2 14:44:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "backup3/copfilter_restartprivoxy.c". Please contact
the authors!
Nov  2 14:44:25 scanmail MailScanner[1685]:
backup3/copfilter_restartrenattach.c
Nov  2 14:44:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "backup3/copfilter_restartrenattach.c". Please contact
the authors!
Nov  2 14:44:25 scanmail MailScanner[1685]:
backup3/copfilter_restartspamd.c
Nov  2 14:44:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "backup3/copfilter_restartspamd.c". Please contact the
authors!
Nov  2 14:44:25 scanmail MailScanner[1685]:
backup3/copfilter_updates_rules_du_jour.c
Nov  2 14:44:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "backup3/copfilter_updates_rules_du_jour.c". Please
contact the authors!
Nov  2 14:44:25 scanmail MailScanner[1685]: HTTP/
Nov  2 14:44:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "HTTP/". Please contact the authors!
Nov  2 14:44:25 scanmail MailScanner[1685]: HTTP/Request.pm
Nov  2 14:44:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "HTTP/Request.pm". Please contact the authors!
Nov  2 14:44:25 scanmail MailScanner[1685]: HTTP/Message.pm
Nov  2 14:44:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "HTTP/Message.pm". Please contact the authors!
Nov  2 14:44:25 scanmail MailScanner[1685]: HTTP/Headers.pm
Nov  2 14:44:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "HTTP/Headers.pm". Please contact the authors!
Nov  2 14:44:25 scanmail MailScanner[1685]: HTTP/Response.pm
Nov  2 14:44:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "HTTP/Response.pm". Please contact the authors!
Nov  2 14:44:25 scanmail MailScanner[1685]: HTTP/Status.pm
Nov  2 14:44:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "HTTP/Status.pm". Please contact the authors!
Nov  2 14:44:25 scanmail MailScanner[1685]: HTTP/Date.pm
Nov  2 14:44:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "HTTP/Date.pm". Please contact the authors!
Nov  2 14:44:25 scanmail MailScanner[1685]: LWP/
Nov  2 14:44:25 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "LWP/". Please contact the authors!
Nov  2 14:44:25 scanmail MailScanner[1685]: LWP/UserAgent.pm
Nov  2 14:44:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "LWP/UserAgent.pm". Please contact the authors!
Nov  2 14:44:26 scanmail MailScanner[1685]: LWP/Debug.pm
Nov  2 14:44:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "LWP/Debug.pm". Please contact the authors!
Nov  2 14:44:26 scanmail MailScanner[1685]: LWP/Protocol.pm
Nov  2 14:44:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "LWP/Protocol.pm". Please contact the authors!
Nov  2 14:44:26 scanmail MailScanner[1685]: LWP/MemberMixin.pm
Nov  2 14:44:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "LWP/MemberMixin.pm". Please contact the authors!
Nov  2 14:44:26 scanmail MailScanner[1685]: LWP/Protocol/
Nov  2 14:44:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "LWP/Protocol/". Please contact the authors!
Nov  2 14:44:26 scanmail MailScanner[1685]: LWP/Protocol/http.pm
Nov  2 14:44:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "LWP/Protocol/http.pm". Please contact the authors!
Nov  2 14:44:26 scanmail MailScanner[1685]: LWP.pm
Nov  2 14:44:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "LWP.pm". Please contact the authors!
Nov  2 14:44:26 scanmail MailScanner[1685]: Net/
Nov  2 14:44:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "Net/". Please contact the authors!
Nov  2 14:44:26 scanmail MailScanner[1685]: Net/FTP.pm
Nov  2 14:44:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "Net/FTP.pm". Please contact the authors!
Nov  2 14:44:26 scanmail MailScanner[1685]: Net/Cmd.pm
Nov  2 14:44:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "Net/Cmd.pm". Please contact the authors!
Nov  2 14:44:26 scanmail MailScanner[1685]: Net/Config.pm
Nov  2 14:44:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "Net/Config.pm". Please contact the authors!
Nov  2 14:44:26 scanmail MailScanner[1685]: Net/libnet.cfg
Nov  2 14:44:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "Net/libnet.cfg". Please contact the authors!
Nov  2 14:44:26 scanmail MailScanner[1685]: Net/HTTP.pm
Nov  2 14:44:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "Net/HTTP.pm". Please contact the authors!
Nov  2 14:44:26 scanmail MailScanner[1685]: Net/HTTP/
Nov  2 14:44:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "Net/HTTP/". Please contact the authors!
Nov  2 14:44:26 scanmail MailScanner[1685]: Net/HTTP/Methods.pm
Nov  2 14:44:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "Net/HTTP/Methods.pm". Please contact the authors!
Nov  2 14:44:26 scanmail MailScanner[1685]: Net/FTP/
Nov  2 14:44:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "Net/FTP/". Please contact the authors!
Nov  2 14:44:26 scanmail MailScanner[1685]: Net/FTP/I.pm
Nov  2 14:44:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "Net/FTP/I.pm". Please contact the authors!
Nov  2 14:44:26 scanmail MailScanner[1685]: Net/FTP/dataconn.pm
Nov  2 14:44:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "Net/FTP/dataconn.pm". Please contact the authors!
Nov  2 14:44:26 scanmail MailScanner[1685]: URI/
Nov  2 14:44:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "URI/". Please contact the authors!
Nov  2 14:44:26 scanmail MailScanner[1685]: URI/Escape.pm
Nov  2 14:44:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "URI/Escape.pm". Please contact the authors!
Nov  2 14:44:26 scanmail MailScanner[1685]: URI/http.pm
Nov  2 14:44:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "URI/http.pm". Please contact the authors!
Nov  2 14:44:26 scanmail MailScanner[1685]: URI/_server.pm
Nov  2 14:44:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "URI/_server.pm". Please contact the authors!
Nov  2 14:44:26 scanmail MailScanner[1685]: URI/_generic.pm
Nov  2 14:44:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "URI/_generic.pm". Please contact the authors!
Nov  2 14:44:26 scanmail MailScanner[1685]: URI/_query.pm
Nov  2 14:44:26 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "URI/_query.pm". Please contact the authors!
Nov  2 14:44:27 scanmail MailScanner[1685]: URI.pm
Nov  2 14:44:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "URI.pm". Please contact the authors!
Nov  2 14:44:27 scanmail MailScanner[1685]: IPC/
Nov  2 14:44:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "IPC/". Please contact the authors!
Nov  2 14:44:27 scanmail MailScanner[1685]: IPC/Open2.pm
Nov  2 14:44:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "IPC/Open2.pm". Please contact the authors!
Nov  2 14:44:27 scanmail MailScanner[1685]: IPC/Open3.pm
Nov  2 14:44:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "IPC/Open3.pm". Please contact the authors!
Nov  2 14:44:27 scanmail MailScanner[1685]: Pod/
Nov  2 14:44:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "Pod/". Please contact the authors!
Nov  2 14:44:27 scanmail MailScanner[1685]: Pod/InputObjects.pm
Nov  2 14:44:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "Pod/InputObjects.pm". Please contact the authors!
Nov  2 14:44:27 scanmail MailScanner[1685]: Pod/ParseLink.pm
Nov  2 14:44:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "Pod/ParseLink.pm". Please contact the authors!
Nov  2 14:44:27 scanmail MailScanner[1685]: Pod/Parser.pm
Nov  2 14:44:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "Pod/Parser.pm". Please contact the authors!
Nov  2 14:44:27 scanmail MailScanner[1685]: Pod/Select.pm
Nov  2 14:44:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "Pod/Select.pm". Please contact the authors!
Nov  2 14:44:27 scanmail MailScanner[1685]: Pod/Text.pm
Nov  2 14:44:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "Pod/Text.pm". Please contact the authors!
Nov  2 14:44:27 scanmail MailScanner[1685]: Pod/Usage.pm
Nov  2 14:44:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "Pod/Usage.pm". Please contact the authors!
Nov  2 14:44:27 scanmail MailScanner[1685]: Text/
Nov  2 14:44:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "Text/". Please contact the authors!
Nov  2 14:44:27 scanmail MailScanner[1685]: Text/Tabs.pm
Nov  2 14:44:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "Text/Tabs.pm". Please contact the authors!
Nov  2 14:44:27 scanmail MailScanner[1685]: Text/Wrap.pm
Nov  2 14:44:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "Text/Wrap.pm". Please contact the authors!
Nov  2 14:44:27 scanmail MailScanner[1685]: usr/
Nov  2 14:44:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/". Please contact the authors!
Nov  2 14:44:27 scanmail MailScanner[1685]: usr/lib/
Nov  2 14:44:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/". Please contact the authors!
Nov  2 14:44:27 scanmail MailScanner[1685]: usr/lib/perl5/
Nov  2 14:44:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/". Please contact the authors!
Nov  2 14:44:27 scanmail MailScanner[1685]: usr/lib/perl5/site_perl/
Nov  2 14:44:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/". Please contact the authors!
Nov  2 14:44:27 scanmail MailScanner[1685]: usr/lib/perl5/site_perl/5.8.2/
Nov  2 14:44:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/". Please contact the
authors!
Nov  2 14:44:27 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/
Nov  2 14:44:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/i386-linux/". Please
contact the authors!
Nov  2 14:44:27 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/
Nov  2 14:44:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/".
Please contact the authors!
Nov  2 14:44:27 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/HTML/
Nov  2 14:44:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/HTML/".
Please contact the authors!
Nov  2 14:44:27 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/HTML/Tagset/
Nov  2 14:44:27 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/HTML/Tagset/". Please
contact the authors!
Nov  2 14:44:28 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/HTML/Tagset/.packlist
Nov  2 14:44:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/HTML/Tagset/.packlist".
Please contact the authors!
Nov  2 14:44:28 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/HTML/Parser/
Nov  2 14:44:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/HTML/Parser/". Please
contact the authors!
Nov  2 14:44:28 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/HTML/Parser/Parser.so
Nov  2 14:44:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/HTML/Parser/Parser.so".
Please contact the authors!
Nov  2 14:44:28 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/HTML/Parser/Parser.bs
Nov  2 14:44:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/HTML/Parser/Parser.bs".
Please contact the authors!
Nov  2 14:44:28 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/HTML/Parser/.packlist
Nov  2 14:44:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/HTML/Parser/.packlist".
Please contact the authors!
Nov  2 14:44:28 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Digest/
Nov  2 14:44:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Digest/". Please contact
the authors!
Nov  2 14:44:28 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Digest/SHA1/
Nov  2 14:44:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Digest/SHA1/". Please
contact the authors!
Nov  2 14:44:28 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Digest/SHA1/SHA1.so
Nov  2 14:44:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Digest/SHA1/SHA1.so".
Please contact the authors!
Nov  2 14:44:28 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Digest/SHA1/SHA1.bs
Nov  2 14:44:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Digest/SHA1/SHA1.bs".
Please contact the authors!
Nov  2 14:44:28 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Digest/SHA1/.packlist
Nov  2 14:44:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Digest/SHA1/.packlist".
Please contact the authors!
Nov  2 14:44:28 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Digest/HMAC/
Nov  2 14:44:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Digest/HMAC/". Please
contact the authors!
Nov  2 14:44:28 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Digest/HMAC/.packlist
Nov  2 14:44:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Digest/HMAC/.packlist".
Please contact the authors!
Nov  2 14:44:28 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Digest/Nilsimsa/
Nov  2 14:44:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Digest/Nilsimsa/". Please
contact the authors!
Nov  2 14:44:28 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Digest/Nilsimsa/Nilsimsa.so
Nov  2 14:44:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Digest/Nilsimsa/Nilsimsa.so".
Please contact the authors!
Nov  2 14:44:28 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Digest/Nilsimsa/Nilsimsa.bs
Nov  2 14:44:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Digest/Nilsimsa/Nilsimsa.bs".
Please contact the authors!
Nov  2 14:44:28 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Digest/Nilsimsa/.packlist
Nov  2 14:44:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Digest/Nilsimsa/.packlist".
Please contact the authors!
Nov  2 14:44:28 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Net/
Nov  2 14:44:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Net/".
Please contact the authors!
Nov  2 14:44:28 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Net/DNS/
Nov  2 14:44:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Net/DNS/". Please contact
the authors!
Nov  2 14:44:28 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Net/DNS/.packlist
Nov  2 14:44:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Net/DNS/.packlist".
Please contact the authors!
Nov  2 14:44:28 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/URI/
Nov  2 14:44:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/URI/".
Please contact the authors!
Nov  2 14:44:28 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/URI/.packlist
Nov  2 14:44:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/URI/.packlist". Please
contact the authors!
Nov  2 14:44:28 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Mail/
Nov  2 14:44:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Mail/".
Please contact the authors!
Nov  2 14:44:28 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Mail/.packlist
Nov  2 14:44:28 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Mail/.packlist". Please
contact the authors!
Nov  2 14:44:28 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Mail/Audit/
Nov  2 14:44:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Mail/Audit/". Please
contact the authors!
Nov  2 14:44:29 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Mail/Audit/.packlist
Nov  2 14:44:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/auto/Mail/Audit/.packlist".
Please contact the authors!
Nov  2 14:44:29 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/HTML/
Nov  2 14:44:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/i386-linux/HTML/".
Please contact the authors!
Nov  2 14:44:29 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/HTML/PullParser.pm
Nov  2 14:44:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/HTML/PullParser.pm". Please
contact the authors!
Nov  2 14:44:29 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/HTML/Parser.pm
Nov  2 14:44:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/HTML/Parser.pm". Please
contact the authors!
Nov  2 14:44:29 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/HTML/Entities.pm
Nov  2 14:44:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/HTML/Entities.pm". Please
contact the authors!
Nov  2 14:44:29 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/HTML/TokeParser.pm
Nov  2 14:44:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/HTML/TokeParser.pm". Please
contact the authors!
Nov  2 14:44:29 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/HTML/LinkExtor.pm
Nov  2 14:44:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/HTML/LinkExtor.pm". Please
contact the authors!
Nov  2 14:44:29 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/HTML/Filter.pm
Nov  2 14:44:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/HTML/Filter.pm". Please
contact the authors!
Nov  2 14:44:29 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/HTML/HeadParser.pm
Nov  2 14:44:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/HTML/HeadParser.pm". Please
contact the authors!
Nov  2 14:44:29 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/Digest/
Nov  2 14:44:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/i386-linux/Digest/".
Please contact the authors!
Nov  2 14:44:29 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/Digest/SHA1.pm
Nov  2 14:44:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/Digest/SHA1.pm". Please
contact the authors!
Nov  2 14:44:29 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/i386-linux/Digest/Nilsimsa.pm
Nov  2 14:44:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/i386-linux/Digest/Nilsimsa.pm". Please
contact the authors!
Nov  2 14:44:29 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/HTML/
Nov  2 14:44:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/HTML/". Please contact
the authors!
Nov  2 14:44:29 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/HTML/Tagset.pm
Nov  2 14:44:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/HTML/Tagset.pm". Please
contact the authors!
Nov  2 14:44:29 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Digest/
Nov  2 14:44:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Digest/". Please
contact the authors!
Nov  2 14:44:29 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Digest/HMAC_MD5.pm
Nov  2 14:44:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Digest/HMAC_MD5.pm".
Please contact the authors!
Nov  2 14:44:29 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Digest/HMAC.pm
Nov  2 14:44:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Digest/HMAC.pm". Please
contact the authors!
Nov  2 14:44:29 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Digest/HMAC_SHA1.pm
Nov  2 14:44:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Digest/HMAC_SHA1.pm".
Please contact the authors!
Nov  2 14:44:29 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/
Nov  2 14:44:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/". Please contact
the authors!
Nov  2 14:44:29 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS.pm
Nov  2 14:44:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS.pm". Please
contact the authors!
Nov  2 14:44:29 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/
Nov  2 14:44:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/". Please
contact the authors!
Nov  2 14:44:29 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/Header.pm
Nov  2 14:44:29 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/Header.pm".
Please contact the authors!
Nov  2 14:44:29 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/Select.pm
Nov  2 14:44:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/Select.pm".
Please contact the authors!
Nov  2 14:44:30 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/Update.pm
Nov  2 14:44:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/Update.pm".
Please contact the authors!
Nov  2 14:44:30 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/Resolver.pm
Nov  2 14:44:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/Resolver.pm".
Please contact the authors!
Nov  2 14:44:30 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/Nameserver.pm
Nov  2 14:44:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/Nameserver.pm".
Please contact the authors!
Nov  2 14:44:30 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/FAQ.pod
Nov  2 14:44:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/FAQ.pod".
Please contact the authors!
Nov  2 14:44:30 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/Question.pm
Nov  2 14:44:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/Question.pm".
Please contact the authors!
Nov  2 14:44:30 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR.pm
Nov  2 14:44:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR.pm". Please
contact the authors!
Nov  2 14:44:30 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/Packet.pm
Nov  2 14:44:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/Packet.pm".
Please contact the authors!
Nov  2 14:44:30 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/
Nov  2 14:44:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/". Please
contact the authors!
Nov  2 14:44:30 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/A.pm
Nov  2 14:44:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/A.pm".
Please contact the authors!
Nov  2 14:44:30 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/EID.pm
Nov  2 14:44:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/EID.pm".
Please contact the authors!
Nov  2 14:44:30 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/ISDN.pm
Nov  2 14:44:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/ISDN.pm".
Please contact the authors!
Nov  2 14:44:30 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/MX.pm
Nov  2 14:44:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/MX.pm".
Please contact the authors!
Nov  2 14:44:30 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/SOA.pm
Nov  2 14:44:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/SOA.pm".
Please contact the authors!
Nov  2 14:44:30 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/OPT.pm
Nov  2 14:44:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/OPT.pm".
Please contact the authors!
Nov  2 14:44:30 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/NIMLOC.pm
Nov  2 14:44:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/NIMLOC.pm".
Please contact the authors!
Nov  2 14:44:30 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/TXT.pm
Nov  2 14:44:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/TXT.pm".
Please contact the authors!
Nov  2 14:44:30 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/DNAME.pm
Nov  2 14:44:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/DNAME.pm".
Please contact the authors!
Nov  2 14:44:30 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/AAAA.pm
Nov  2 14:44:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/AAAA.pm".
Please contact the authors!
Nov  2 14:44:30 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/RP.pm
Nov  2 14:44:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/RP.pm".
Please contact the authors!
Nov  2 14:44:30 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/X25.pm
Nov  2 14:44:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/X25.pm".
Please contact the authors!
Nov  2 14:44:30 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/PTR.pm
Nov  2 14:44:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/PTR.pm".
Please contact the authors!
Nov  2 14:44:30 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/TSIG.pm
Nov  2 14:44:30 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/TSIG.pm".
Please contact the authors!
Nov  2 14:44:31 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/NS.pm
Nov  2 14:44:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/NS.pm".
Please contact the authors!
Nov  2 14:44:31 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/PX.pm
Nov  2 14:44:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/PX.pm".
Please contact the authors!
Nov  2 14:44:31 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/NULL.pm
Nov  2 14:44:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/NULL.pm".
Please contact the authors!
Nov  2 14:44:31 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/LOC.pm
Nov  2 14:44:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/LOC.pm".
Please contact the authors!
Nov  2 14:44:31 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/SRV.pm
Nov  2 14:44:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/SRV.pm".
Please contact the authors!
Nov  2 14:44:31 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/AFSDB.pm
Nov  2 14:44:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/AFSDB.pm".
Please contact the authors!
Nov  2 14:44:31 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/RT.pm
Nov  2 14:44:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/RT.pm".
Please contact the authors!
Nov  2 14:44:31 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/MR.pm
Nov  2 14:44:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/MR.pm".
Please contact the authors!
Nov  2 14:44:31 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/MINFO.pm
Nov  2 14:44:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/MINFO.pm".
Please contact the authors!
Nov  2 14:44:31 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/CNAME.pm
Nov  2 14:44:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/CNAME.pm".
Please contact the authors!
Nov  2 14:44:31 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/NAPTR.pm
Nov  2 14:44:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/NAPTR.pm".
Please contact the authors!
Nov  2 14:44:31 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/HINFO.pm
Nov  2 14:44:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/HINFO.pm".
Please contact the authors!
Nov  2 14:44:31 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/MG.pm
Nov  2 14:44:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/MG.pm".
Please contact the authors!
Nov  2 14:44:31 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/TKEY.pm
Nov  2 14:44:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/TKEY.pm".
Please contact the authors!
Nov  2 14:44:31 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/NSAP.pm
Nov  2 14:44:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/NSAP.pm".
Please contact the authors!
Nov  2 14:44:31 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/CERT.pm
Nov  2 14:44:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/CERT.pm".
Please contact the authors!
Nov  2 14:44:31 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/MB.pm
Nov  2 14:44:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Net/DNS/RR/MB.pm".
Please contact the authors!
Nov  2 14:44:31 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI.pm
Nov  2 14:44:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI.pm". Please contact
the authors!
Nov  2 14:44:31 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/
Nov  2 14:44:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/". Please contact
the authors!
Nov  2 14:44:31 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/ftp.pm
Nov  2 14:44:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/ftp.pm". Please
contact the authors!
Nov  2 14:44:31 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/_segment.pm
Nov  2 14:44:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/_segment.pm".
Please contact the authors!
Nov  2 14:44:31 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/_generic.pm
Nov  2 14:44:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/_generic.pm".
Please contact the authors!
Nov  2 14:44:31 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/nntp.pm
Nov  2 14:44:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/nntp.pm". Please
contact the authors!
Nov  2 14:44:31 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/QueryParam.pm
Nov  2 14:44:31 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/QueryParam.pm".
Please contact the authors!
Nov  2 14:44:32 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/tn3270.pm
Nov  2 14:44:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/tn3270.pm". Please
contact the authors!
Nov  2 14:44:32 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/sips.pm
Nov  2 14:44:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/sips.pm". Please
contact the authors!
Nov  2 14:44:32 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/gopher.pm
Nov  2 14:44:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/gopher.pm". Please
contact the authors!
Nov  2 14:44:32 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/WithBase.pm
Nov  2 14:44:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/WithBase.pm".
Please contact the authors!
Nov  2 14:44:32 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/mailto.pm
Nov  2 14:44:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/mailto.pm". Please
contact the authors!
Nov  2 14:44:32 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/data.pm
Nov  2 14:44:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/data.pm". Please
contact the authors!
Nov  2 14:44:32 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/_userpass.pm
Nov  2 14:44:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/_userpass.pm".
Please contact the authors!
Nov  2 14:44:32 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/urn.pm
Nov  2 14:44:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/urn.pm". Please
contact the authors!
Nov  2 14:44:32 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/ldap.pm
Nov  2 14:44:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/ldap.pm". Please
contact the authors!
Nov  2 14:44:32 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/telnet.pm
Nov  2 14:44:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/telnet.pm". Please
contact the authors!
Nov  2 14:44:32 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/_foreign.pm
Nov  2 14:44:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/_foreign.pm".
Please contact the authors!
Nov  2 14:44:32 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/Heuristic.pm
Nov  2 14:44:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/Heuristic.pm".
Please contact the authors!
Nov  2 14:44:32 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/_server.pm
Nov  2 14:44:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/_server.pm". Please
contact the authors!
Nov  2 14:44:32 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/URL.pm
Nov  2 14:44:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/URL.pm". Please
contact the authors!
Nov  2 14:44:32 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/rtsp.pm
Nov  2 14:44:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/rtsp.pm". Please
contact the authors!
Nov  2 14:44:32 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/_query.pm
Nov  2 14:44:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/_query.pm". Please
contact the authors!
Nov  2 14:44:32 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/file.pm
Nov  2 14:44:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/file.pm". Please
contact the authors!
Nov  2 14:44:32 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/rlogin.pm
Nov  2 14:44:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/rlogin.pm". Please
contact the authors!
Nov  2 14:44:32 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/news.pm
Nov  2 14:44:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/news.pm". Please
contact the authors!
Nov  2 14:44:32 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/ssh.pm
Nov  2 14:44:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/ssh.pm". Please
contact the authors!
Nov  2 14:44:32 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/http.pm
Nov  2 14:44:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/http.pm". Please
contact the authors!
Nov  2 14:44:32 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/rsync.pm
Nov  2 14:44:32 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/rsync.pm". Please
contact the authors!
Nov  2 14:44:32 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/https.pm
Nov  2 14:44:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/https.pm". Please
contact the authors!
Nov  2 14:44:33 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/snews.pm
Nov  2 14:44:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/snews.pm". Please
contact the authors!
Nov  2 14:44:33 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/pop.pm
Nov  2 14:44:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/pop.pm". Please
contact the authors!
Nov  2 14:44:33 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/rtspu.pm
Nov  2 14:44:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/rtspu.pm". Please
contact the authors!
Nov  2 14:44:33 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/Escape.pm
Nov  2 14:44:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/Escape.pm". Please
contact the authors!
Nov  2 14:44:33 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/sip.pm
Nov  2 14:44:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/sip.pm". Please
contact the authors!
Nov  2 14:44:33 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/_login.pm
Nov  2 14:44:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/_login.pm". Please
contact the authors!
Nov  2 14:44:33 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/file/
Nov  2 14:44:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/file/". Please
contact the authors!
Nov  2 14:44:33 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/file/OS2.pm
Nov  2 14:44:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/file/OS2.pm".
Please contact the authors!
Nov  2 14:44:33 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/file/QNX.pm
Nov  2 14:44:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/file/QNX.pm".
Please contact the authors!
Nov  2 14:44:33 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/file/Base.pm
Nov  2 14:44:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/file/Base.pm".
Please contact the authors!
Nov  2 14:44:33 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/file/Unix.pm
Nov  2 14:44:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/file/Unix.pm".
Please contact the authors!
Nov  2 14:44:33 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/file/Win32.pm
Nov  2 14:44:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/file/Win32.pm".
Please contact the authors!
Nov  2 14:44:33 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/file/FAT.pm
Nov  2 14:44:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/file/FAT.pm".
Please contact the authors!
Nov  2 14:44:33 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/file/Mac.pm
Nov  2 14:44:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/file/Mac.pm".
Please contact the authors!
Nov  2 14:44:33 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/urn/
Nov  2 14:44:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/urn/". Please
contact the authors!
Nov  2 14:44:33 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/urn/oid.pm
Nov  2 14:44:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/urn/oid.pm". Please
contact the authors!
Nov  2 14:44:33 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/URI/urn/isbn.pm
Nov  2 14:44:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/URI/urn/isbn.pm".
Please contact the authors!
Nov  2 14:44:33 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/auto/
Nov  2 14:44:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/auto/". Please contact
the authors!
Nov  2 14:44:33 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/auto/Mail/
Nov  2 14:44:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/auto/Mail/". Please
contact the authors!
Nov  2 14:44:33 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/auto/Mail/Internet/
Nov  2 14:44:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/auto/Mail/Internet/".
Please contact the authors!
Nov  2 14:44:33 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/auto/Mail/Internet/reply.al
Nov  2 14:44:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/auto/Mail/Internet/reply.al". Please
contact the authors!
Nov  2 14:44:33 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/auto/Mail/Internet/add_signature.al
Nov  2 14:44:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/auto/Mail/Internet/add_signature.al".
Please contact the authors!
Nov  2 14:44:33 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/auto/Mail/Internet/sign.al
Nov  2 14:44:33 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/auto/Mail/Internet/sign.al". Please
contact the authors!
Nov  2 14:44:33 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/auto/Mail/Internet/_prephdr.al
Nov  2 14:44:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/auto/Mail/Internet/_prephdr.al". Please
contact the authors!
Nov  2 14:44:34 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/auto/Mail/Internet/smtpsend.al
Nov  2 14:44:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/auto/Mail/Internet/smtpsend.al". Please
contact the authors!
Nov  2 14:44:34 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/auto/Mail/Internet/send.al
Nov  2 14:44:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/auto/Mail/Internet/send.al". Please
contact the authors!
Nov  2 14:44:34 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/auto/Mail/Internet/nntppost.al
Nov  2 14:44:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/auto/Mail/Internet/nntppost.al". Please
contact the authors!
Nov  2 14:44:34 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/auto/Mail/Internet/escape_from.al
Nov  2 14:44:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/auto/Mail/Internet/escape_from.al".
Please contact the authors!
Nov  2 14:44:34 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/auto/Mail/Internet/unescape_from.al
Nov  2 14:44:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/auto/Mail/Internet/unescape_from.al".
Please contact the authors!
Nov  2 14:44:34 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/auto/Mail/Internet/autosplit.ix
Nov  2 14:44:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/auto/Mail/Internet/autosplit.ix". Please
contact the authors!
Nov  2 14:44:34 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/auto/Mail/Util/
Nov  2 14:44:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/auto/Mail/Util/".
Please contact the authors!
Nov  2 14:44:34 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/auto/Mail/Util/read_mbox.al
Nov  2 14:44:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/auto/Mail/Util/read_mbox.al". Please
contact the authors!
Nov  2 14:44:34 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/auto/Mail/Util/maildomain.al
Nov  2 14:44:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/auto/Mail/Util/maildomain.al". Please
contact the authors!
Nov  2 14:44:34 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/auto/Mail/Util/mailaddress.al
Nov  2 14:44:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/auto/Mail/Util/mailaddress.al". Please
contact the authors!
Nov  2 14:44:34 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/auto/Mail/Util/autosplit.ix
Nov  2 14:44:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/auto/Mail/Util/autosplit.ix". Please
contact the authors!
Nov  2 14:44:34 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Mail/
Nov  2 14:44:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/". Please contact
the authors!
Nov  2 14:44:34 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Mail/Cap.pm
Nov  2 14:44:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Cap.pm". Please
contact the authors!
Nov  2 14:44:34 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Mail/Header.pm
Nov  2 14:44:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Header.pm". Please
contact the authors!
Nov  2 14:44:34 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Mail/Mailer.pm
Nov  2 14:44:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Mailer.pm". Please
contact the authors!
Nov  2 14:44:34 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Mail/Filter.pm
Nov  2 14:44:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Filter.pm". Please
contact the authors!
Nov  2 14:44:34 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Mail/Send.pm
Nov  2 14:44:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Send.pm". Please
contact the authors!
Nov  2 14:44:34 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Mail/Field.pm
Nov  2 14:44:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Field.pm". Please
contact the authors!
Nov  2 14:44:34 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Mail/Internet.pm
Nov  2 14:44:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Internet.pm".
Please contact the authors!
Nov  2 14:44:34 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Mail/Util.pm
Nov  2 14:44:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Util.pm". Please
contact the authors!
Nov  2 14:44:34 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Mail/Address.pm
Nov  2 14:44:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Address.pm".
Please contact the authors!
Nov  2 14:44:34 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Mail/Mailer/
Nov  2 14:44:34 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Mailer/". Please
contact the authors!
Nov  2 14:44:34 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Mail/Mailer/rfc822.pm
Nov  2 14:44:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Mailer/rfc822.pm".
Please contact the authors!
Nov  2 14:44:35 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Mail/Mailer/test.pm
Nov  2 14:44:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Mailer/test.pm".
Please contact the authors!
Nov  2 14:44:35 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Mail/Mailer/mail.pm
Nov  2 14:44:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Mailer/mail.pm".
Please contact the authors!
Nov  2 14:44:35 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Mail/Mailer/sendmail.pm
Nov  2 14:44:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/Mail/Mailer/sendmail.pm". Please contact
the authors!
Nov  2 14:44:35 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Mail/Mailer/smtp.pm
Nov  2 14:44:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Mailer/smtp.pm".
Please contact the authors!
Nov  2 14:44:35 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Mail/Field/
Nov  2 14:44:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Field/". Please
contact the authors!
Nov  2 14:44:35 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Mail/Field/Date.pm
Nov  2 14:44:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Field/Date.pm".
Please contact the authors!
Nov  2 14:44:35 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Mail/Field/AddrList.pm
Nov  2 14:44:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/Mail/Field/AddrList.pm". Please contact
the authors!
Nov  2 14:44:35 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Mail/Audit.pm
Nov  2 14:44:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Audit.pm". Please
contact the authors!
Nov  2 14:44:35 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Mail/Audit/
Nov  2 14:44:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Audit/". Please
contact the authors!
Nov  2 14:44:35 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Mail/Audit/KillDups.pm
Nov  2 14:44:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/site_perl/5.8.2/Mail/Audit/KillDups.pm". Please contact
the authors!
Nov  2 14:44:35 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Mail/Audit/List.pm
Nov  2 14:44:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Audit/List.pm".
Please contact the authors!
Nov  2 14:44:35 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Mail/Audit/PGP.pm
Nov  2 14:44:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Audit/PGP.pm".
Please contact the authors!
Nov  2 14:44:35 scanmail MailScanner[1685]:
usr/lib/perl5/site_perl/5.8.2/Mail/Audit/MAPS.pm
Nov  2 14:44:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Audit/MAPS.pm".
Please contact the authors!
Nov  2 14:44:35 scanmail MailScanner[1685]: usr/lib/perl5/5.8.2/
Nov  2 14:44:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/". Please contact the authors!
Nov  2 14:44:35 scanmail MailScanner[1685]: usr/lib/perl5/5.8.2/i386-linux/
Nov  2 14:44:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/i386-linux/". Please contact the
authors!
Nov  2 14:44:35 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/i386-linux/perllocal.pod
Nov  2 14:44:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/i386-linux/perllocal.pod". Please
contact the authors!
Nov  2 14:44:35 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/i386-linux/auto/
Nov  2 14:44:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/i386-linux/auto/". Please contact
the authors!
Nov  2 14:44:35 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/i386-linux/auto/Net/
Nov  2 14:44:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/i386-linux/auto/Net/". Please
contact the authors!
Nov  2 14:44:35 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/i386-linux/auto/Net/.packlist
Nov  2 14:44:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/i386-linux/auto/Net/.packlist".
Please contact the authors!
Nov  2 14:44:35 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/i386-linux/auto/Test/
Nov  2 14:44:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/i386-linux/auto/Test/". Please
contact the authors!
Nov  2 14:44:35 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/i386-linux/auto/Test/Simple/
Nov  2 14:44:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/i386-linux/auto/Test/Simple/".
Please contact the authors!
Nov  2 14:44:35 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/i386-linux/auto/Test/Simple/.packlist
Nov  2 14:44:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/5.8.2/i386-linux/auto/Test/Simple/.packlist". Please
contact the authors!
Nov  2 14:44:35 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/i386-linux/auto/DB_File/
Nov  2 14:44:35 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/i386-linux/auto/DB_File/". Please
contact the authors!
Nov  2 14:44:36 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/i386-linux/auto/DB_File/DB_File.so
Nov  2 14:44:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/5.8.2/i386-linux/auto/DB_File/DB_File.so". Please contact
the authors!
Nov  2 14:44:36 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/i386-linux/auto/DB_File/DB_File.bs
Nov  2 14:44:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/5.8.2/i386-linux/auto/DB_File/DB_File.bs". Please contact
the authors!
Nov  2 14:44:36 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/i386-linux/auto/DB_File/autosplit.ix
Nov  2 14:44:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/5.8.2/i386-linux/auto/DB_File/autosplit.ix". Please
contact the authors!
Nov  2 14:44:36 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/i386-linux/auto/DB_File/.packlist
Nov  2 14:44:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line
"usr/lib/perl5/5.8.2/i386-linux/auto/DB_File/.packlist". Please contact
the authors!
Nov  2 14:44:36 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/i386-linux/DB_File.pm
Nov  2 14:44:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/i386-linux/DB_File.pm". Please
contact the authors!
Nov  2 14:44:36 scanmail MailScanner[1685]: usr/lib/perl5/5.8.2/Net/
Nov  2 14:44:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/Net/". Please contact the authors!
Nov  2 14:44:36 scanmail MailScanner[1685]: usr/lib/perl5/5.8.2/Net/POP3.pm
Nov  2 14:44:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/Net/POP3.pm". Please contact the
authors!
Nov  2 14:44:36 scanmail MailScanner[1685]: usr/lib/perl5/5.8.2/Net/SMTP.pm
Nov  2 14:44:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/Net/SMTP.pm". Please contact the
authors!
Nov  2 14:44:36 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/Net/Config.pm
Nov  2 14:44:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/Net/Config.pm". Please contact
the authors!
Nov  2 14:44:36 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/Net/libnetFAQ.pod
Nov  2 14:44:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/Net/libnetFAQ.pod". Please
contact the authors!
Nov  2 14:44:36 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/Net/Domain.pm
Nov  2 14:44:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/Net/Domain.pm". Please contact
the authors!
Nov  2 14:44:36 scanmail MailScanner[1685]: usr/lib/perl5/5.8.2/Net/Cmd.pm
Nov  2 14:44:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/Net/Cmd.pm". Please contact the
authors!
Nov  2 14:44:36 scanmail MailScanner[1685]: usr/lib/perl5/5.8.2/Net/FTP.pm
Nov  2 14:44:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/Net/FTP.pm". Please contact the
authors!
Nov  2 14:44:36 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/Net/libnet.cfg
Nov  2 14:44:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/Net/libnet.cfg". Please contact
the authors!
Nov  2 14:44:36 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/Net/Netrc.pm
Nov  2 14:44:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/Net/Netrc.pm". Please contact the
authors!
Nov  2 14:44:36 scanmail MailScanner[1685]: usr/lib/perl5/5.8.2/Net/NNTP.pm
Nov  2 14:44:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/Net/NNTP.pm". Please contact the
authors!
Nov  2 14:44:36 scanmail MailScanner[1685]: usr/lib/perl5/5.8.2/Net/Time.pm
Nov  2 14:44:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/Net/Time.pm". Please contact the
authors!
Nov  2 14:44:36 scanmail MailScanner[1685]: usr/lib/perl5/5.8.2/Net/FTP/
Nov  2 14:44:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/Net/FTP/". Please contact the
authors!
Nov  2 14:44:36 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/Net/FTP/dataconn.pm
Nov  2 14:44:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/Net/FTP/dataconn.pm". Please
contact the authors!
Nov  2 14:44:36 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/Net/FTP/E.pm
Nov  2 14:44:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/Net/FTP/E.pm". Please contact the
authors!
Nov  2 14:44:36 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/Net/FTP/A.pm
Nov  2 14:44:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/Net/FTP/A.pm". Please contact the
authors!
Nov  2 14:44:36 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/Net/FTP/L.pm
Nov  2 14:44:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/Net/FTP/L.pm". Please contact the
authors!
Nov  2 14:44:36 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/Net/FTP/I.pm
Nov  2 14:44:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/Net/FTP/I.pm". Please contact the
authors!
Nov  2 14:44:36 scanmail MailScanner[1685]: usr/lib/perl5/5.8.2/Test/
Nov  2 14:44:36 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/Test/". Please contact the authors!
Nov  2 14:44:37 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/Test/Builder.pm
Nov  2 14:44:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/Test/Builder.pm". Please contact
the authors!
Nov  2 14:44:37 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/Test/Simple.pm
Nov  2 14:44:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/Test/Simple.pm". Please contact
the authors!
Nov  2 14:44:37 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/Test/More.pm
Nov  2 14:44:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/Test/More.pm". Please contact the
authors!
Nov  2 14:44:37 scanmail MailScanner[1685]:
usr/lib/perl5/5.8.2/Test/Tutorial.pod
Nov  2 14:44:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "usr/lib/perl5/5.8.2/Test/Tutorial.pod". Please
contact the authors!
Nov  2 14:44:37 scanmail MailScanner[1685]: compile_cache_prgs.sh
Nov  2 14:44:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "compile_cache_prgs.sh". Please contact the authors!
Nov  2 14:44:37 scanmail MailScanner[1685]:
compile_cache_prgs.sh_p3scan_manually
Nov  2 14:44:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "compile_cache_prgs.sh_p3scan_manually". Please
contact the authors!
Nov  2 14:44:37 scanmail MailScanner[1685]:
compile_cache_prgs_perl_stuff.sh_manuall
Nov  2 14:44:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "compile_cache_prgs_perl_stuff.sh_manuall". Please
contact the authors!
Nov  2 14:44:37 scanmail MailScanner[1685]:
compile_cache_prgs_perl_stuff.sh_manuall_with_cpan
Nov  2 14:44:37 scanmail MailScanner[1685]: ProcessClamAVOutput:
unrecognised line "compile_cache_prgs_perl_stuff.sh_manuall_with_cpan".
Please contact the authors!
Nov  2 14:44:50 scanmail MailScanner[1685]:
/tmp/clamav.2963/clamav-0ea25c208fed1cf8/var/log/copfilter/0.0.95/tests/virus/eicar.com:
Eicar-Test-Signature FOUND
Nov  2 14:44:50 scanmail MailScanner[1685]:
/tmp/clamav.2963/clamav-0ea25c208fed1cf8/var/log/copfilter/0.0.95/tests/virus/eicar.zip:
Eicar-Test-Signature FOUND
Nov  2 14:44:50 scanmail MailScanner[1685]:
/tmp/clamav.2963/clamav-0ea25c208fed1cf8/var/log/copfilter/0.0.95/tests/virus/eicar_com.zip:
Eicar-Test-Signature FOUND
Nov  2 14:44:50 scanmail MailScanner[1685]:
/tmp/clamav.2963/clamav-0ea25c208fed1cf8/var/log/copfilter/0.0.95/tests/virus/eicarcom2.zip:
Eicar-Test-Signature FOUND
Nov  2 14:44:55 scanmail MailScanner[1685]: Virus Scanning: ClamAV found
4 infections
Nov  2 14:44:55 scanmail MailScanner[1685]: Virus Scanning: Found 4 viruses


grtz Koen

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From jaearick at COLBY.EDU  Tue Nov  2 14:23:08 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:27 2006
Subject: 4.35.9: phishing fraud syslogs
Message-ID: <mailman.4215.1137101247.24926.mailscanner@lists.mailscanner.info>

Julian,

Also, please remove the word "attack" from this line when you
tweak it, eg:

Found phishing fraud in iA25FnB7002189 from http://(etc)

My syslog summarizer (logcheck,
http://www.smittyware.com/contrib/psionic.php/) generates lots
of compliants when it sees the word "attack" in the syslog.
Thanks.

Jeff

On Tue, 2 Nov 2004, Jeff A. Earickson wrote:

> Date: Tue, 2 Nov 2004 07:15:34 -0500
> From: Jeff A. Earickson <jaearick@colby.edu>
> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: 4.35.9: phishing fraud syslogs
>
> Julian,
>
> Please tweak the syslog message for phishing fraud to include
> the message ID, something like:
>
> Found phishing fraud attack in iA25FnB7002189 from http://(etc)
>
> The message ID is always important when grepping the syslog.
> Thanks.
>
> Jeff Earickson
> Colby College
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Denis.Beauchemin at USHERBROOKE.CA  Tue Nov  2 14:24:40 2004
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:27:27 2006
Subject: amavisd-new and (INVALID CHARACTERS OR SPACE GAP)
Message-ID: <mailman.4216.1137101247.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Jan Elmqvist Nielsen wrote:

>Hi
>
>I'am using mailscanner 4.28.6-1 with danish report selection
>
>The last 2 days I have recived 2 undeliverable mails - both from
>servers using amavisd-new
>
>
>  
>
>>>>"Content-filter at mail.xxxx.xx" <postmaster@mail.xxxx.xx>
>>>>        
>>>>
>02-11-2004 09:06:21 >>>
>INVALID HEADER (INVALID CHARACTERS OR SPACE GAP)
>
>Non-encoded 8-bit data (char E5 hex) in message header
>'xx-MailScanner-SpamCheck': xx-MailScanner-SpamCheck: ikkespam,
>SpamAssassin (bedoemmelse=0, p\345kr\346vet 5)\n
>
>This nondelivery report was generated by the amavisd-new program
>at host mail.xxxx.xx. Our internal reference code for your message
>is 74770-03.
>
>When I switch to english language in the report section there is no
>problem
>
>
>any solutions other than using english language?
>
>/Jan Elmqvist Nielsen
>
>  
>

Jan,

I believe you have to encode tbe "required = required" string in your 
languages.conf file (or you can rewrite it without accented 
characters).  The way I do it is by sending myself an email with the 
desired string in the subject line.  The message I receive has the 
string encoded.  I just copy it and paste it back in the config file.

Denis

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From kte at NEXIS.BE  Tue Nov  2 14:48:17 2004
From: kte at NEXIS.BE (Koen Teugels)
Date: Thu Jan 12 21:27:27 2006
Subject: {Scanned} ProcessClamAVOutput: unrecognised line ...    contact
    the authors
Message-ID: <mailman.4217.1137101247.24926.mailscanner@lists.mailscanner.info>

Sorry typo. I'm in the latest version of mailscanner
(MailScanner-4.35.9-1.rpm.tar.gz) en and rpm version of clamav 0.80.1
(and the compiled version)
It looks that Mailscanner has a problem when you have an attachment like
copfilter-0.0.95.tgz. Does anyone experience the same problem.


grtz Koen

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From john at OMEGADATA.NO  Tue Nov  2 14:44:39 2004
From: john at OMEGADATA.NO (John Berntsen)
Date: Thu Jan 12 21:27:27 2006
Subject: perl-MIME-Base64
Message-ID: <mailman.4218.1137101247.24926.mailscanner@lists.mailscanner.info>

Hi

Regarding the new release 4.35.9 on Suse9.1 pro

When installing perl-MIME-Base64 it wants to remove the main perl
package, just to try on my test server i did a ./install.sh nodeps
and it removed my perl package.

Could not find anything strange with the spec file either, except
that maybe the auto filelist generating might add something that
make this package want to remove the main perl package.

I saw on the list that the same problem arised on RHEL3

Any solutions?

Med vennlig hilsen / Regards
John Berntsen

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From jaearick at COLBY.EDU  Tue Nov  2 14:56:02 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:27 2006
Subject: 4.35.9: file command disabled?
Message-ID: <mailman.4219.1137101247.24926.mailscanner@lists.mailscanner.info>

Julian,

I'm curious as to why you need to change the default.  It has been
"default off" for quite a while and those who want to use it (like me)
turn it on.  This puts in responsibility of having a working "file"
command in our laps.  I had just been puzzled by the change in the
MailScanner.conf file.

The quality of what "file" tells you is based on what the vendor (Sun
in my case) bothers to put into /etc/magic.  There were super-duper
/etc/magic files floating around on the Internet a few years ago that
could identify just about anything; a quick google didn't give me much
this morning.  Maybe you want to think about using "file -m yourmagicfile"
where you have an industrial strength magic file for MailScanner's use?

Jeff Earickson
Colby College

On Mon, 1 Nov 2004, Julian Field wrote:

> Date: Mon, 1 Nov 2004 17:13:17 -0500
> From: Julian Field <mailscanner@ECS.SOTON.AC.UK>
> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: 4.35.9: file command disabled?
>
> I need to change the default. I don't want it switched on by default, as
> it has to know where to find your "file" command and what sort of output
> it produces.
> Just reset it to /usr/bin/file again and you'll be fine.
>
> I'm not sure what to set the default to, it's a bit awkward. I guess I
> could enable it by default, and just not squeal too loudly if the file
> can't be found.
> What do you think?
>
> Jeff A. Earickson wrote:
>
>> Julian,
>>
>> MailScanner.conf now has:
>>
>> File Command = #DISABLED /usr/bin/file
>>
>> Does this mean "don't use this setting anymore?".  Previously
>> (4.34.8) I had this defined as:
>>
>> File Command = /usr/bin/file
>>
>> What's the story here?
>
>
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From alex at SKYNET-SRL.COM  Tue Nov  2 15:46:49 2004
From: alex at SKYNET-SRL.COM (Alessandro Bianchi)
Date: Thu Jan 12 21:27:27 2006
Subject: perl MIME errors on Fedora 2 again
Message-ID: <mailman.4220.1137101247.24926.mailscanner@lists.mailscanner.info>

Hi everyone

I'm still experiencing some troubles on FC2 with MS 4.35.9

I've removed all tha packages and the reinstalled everything, but
running apt-get still reports:

The following packages have unmet dependencies:
   perl: Obsoletes: perl-MIME-Base64 but 3.05-2 is installed

FC 2 seems to  use a rpm called perl-MIME-XBase64 with the very same
version number 3.05

Fom the rpm description:

This is the MIME-Base64 module, renamed MIME-XBase64 in order to avoid
clashing with the earlier MIME-Base64 package that is built into the
perl RPM package.

This package contains a base64 encoder/decoder and a quoted-printable
encoder/decoder.  These encoding methods are specified in RFC 2045 -
MIME (Multipurpose Internet Mail Extensions).

The base64 encoding is designed to represent arbitrary sequences of
octets in a form that need not be humanly readable. A 65-character
subset ([A-Za-z0-9+/=]) of US-ASCII is used, enabling 6 bits to be
represented per printable character.

The quoted-printable encoding is intended to represent data that
largely consists of bytes that correspond to printable characters in
the ASCII character set.  Each non-printable character is represented by
a triplet consisting of the character "=" followed by two hexadecimal
digits.

Uninstalling the "obsolete" and reinstalling the XBase doesn't work

MS crashes on start

Any idea?

Thanks to all

Best regards

Alex

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mike at ZANKER.ORG  Tue Nov  2 15:24:49 2004
From: mike at ZANKER.ORG (Mike Zanker)
Date: Thu Jan 12 21:27:27 2006
Subject: perl-MIME-Base64
Message-ID: <mailman.4221.1137101247.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

John Berntsen wrote:

> When installing perl-MIME-Base64 it wants to remove the main perl
> package, just to try on my test server i did a ./install.sh nodeps
> and it removed my perl package.
>
> Could not find anything strange with the spec file either, except
> that maybe the auto filelist generating might add something that
> make this package want to remove the main perl package.
>
> I saw on the list that the same problem arised on RHEL3

It's annoying - we have the same problem on 3 RHEL boxes now, all
running the latest stable version.

The problem seems to be that the Red Hat perl RPM includes an older
version of MIME::Base64 and it sounds like the SuSE one does, too. If
you force an install of the perl RPM it removes Julian's
perl-MIME-Base64 RPM; if you force Julian's RPM then it clashes with the
perl RPM.

Incidentally, the old solution of installing MIME-Tools and Base64 from
CPAN doesn't work any more - MailScanner refuses to run at all, saying
that various perl module versions are too old.

Mike.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ELKNET.NET  Tue Nov  2 15:44:11 2004
From: mailscanner at ELKNET.NET (Alan)
Date: Thu Jan 12 21:27:27 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.4222.1137101247.24926.mailscanner@lists.mailscanner.info>

As I tested this a week or so ago and confirmed that the 'NO_DNS_FOR_FROM'
test will not work unless the recognized Envelope_From header is at the top,
you will really need to convince me that the location does not matter.

When MS placed the Envelope From header at the bottom, SA refused to 'trust'
it and would therefore skip the 'NO_DNS_FOR_FROM' test.

Here is the log entry that proves that:
>"debug: X-Envelope-From header found after 1 or more Received lines, cannot
>trust envelope-from"

To cast my vote to Julian's poll, I prefer option 'A' to change MS's entry
to "X-Envelope-From:" for the shallow but simple reason that its what SA
expects by default, hence a pseudo-standard.

-Alan

On Tue, 2 Nov 2004 09:32:52 +0100, Jan-Peter Koopmann
<Jan-Peter.Koopmann@SECEIDOS.DE> wrote:

>If however you set envelope_sender_headers in the config, it will be
>used regardless of its position. It does not need to be at the top
>(which I do not like at all anyways).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Tue Nov  2 15:55:06 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:27 2006
Subject: request: minimum attachment size?
Message-ID: <mailman.4223.1137101247.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-2" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Sounds like a good idea, and it's pretty simple to add. By default it 
will be switched off.

Marcin Rożek wrote:

> Hello,
> during the weekend we've bombarded by many copies of broken 
> (zero-length) virus
> (probably bagle) which was blocked because of .exe or .com extension. The
> problem is that our MS delivered that mails (without attachment) to 
> recipients.
> Is it possible to add an option to MS that would prevent delivering empty
> attachments? I suggest to name that option "Minimum Attachment Size" 
> (similar to
> Maximum Attachment Size).
> Perhaps it would be good to set it to 0 or -1 by default to disable it.
>
>
> Regards,
> Marcin
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

-- 
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From kte at NEXIS.BE  Tue Nov  2 16:09:13 2004
From: kte at NEXIS.BE (Koen Teugels)
Date: Thu Jan 12 21:27:27 2006
Subject: {Scanned} Spamassassin test
Message-ID: <mailman.4224.1137101247.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I see that some modules are not loaded or installeddebug: bayes: DB_File
module not installed, cannot use Bayes
How can you do this just compiled spamasssin on TAO linux.

grtz Koen



debug: SpamAssassin version 3.0.1
debug: Score set 0 chosen.
debug: running in taint mode? yes
debug: Running in taint mode, removing unsafe env vars, and resetting PATH
debug: PATH included '/usr/kerberos/sbin', keeping.
debug: PATH included '/usr/kerberos/bin', keeping.
debug: PATH included '/usr/local/sbin', keeping.
debug: PATH included '/usr/local/bin', keeping.
debug: PATH included '/sbin', keeping.
debug: PATH included '/bin', keeping.
debug: PATH included '/usr/sbin', keeping.
debug: PATH included '/usr/bin', keeping.
debug: PATH included '/usr/X11R6/bin', keeping.
debug: PATH included '/root/bin', which doesn't exist, dropping.
debug: Final PATH set to:
/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin
debug: diag: module not installed: DBI ('require' failed)
debug: diag: module not installed: DB_File ('require' failed)
debug: diag: module installed: Digest::SHA1, version 2.01
debug: diag: module installed: IO::Socket::UNIX, version 1.2
debug: diag: module installed: MIME::Base64, version 3.05
debug: diag: module installed: Net::DNS, version 0.23
debug: diag: module not installed: Net::LDAP ('require' failed)
debug: diag: module installed: Razor2::Client::Agent, version 2.61
debug: diag: module installed: Storable, version 2.06
debug: diag: module installed: URI, version 1.19
debug: ignore: using a test message to lint rules
debug: using "/etc/mail/spamassassin/init.pre" for site rules init.pre
debug: config: read file /etc/mail/spamassassin/init.pre
debug: using "/usr/share/spamassassin" for default rules dir
debug: config: read file /usr/share/spamassassin/10_misc.cf
debug: config: read file /usr/share/spamassassin/20_anti_ratware.cf
debug: config: read file /usr/share/spamassassin/20_body_tests.cf
debug: config: read file /usr/share/spamassassin/20_compensate.cf
debug: config: read file /usr/share/spamassassin/20_dnsbl_tests.cf
debug: config: read file /usr/share/spamassassin/20_drugs.cf
debug: config: read file /usr/share/spamassassin/20_fake_helo_tests.cf
debug: config: read file /usr/share/spamassassin/20_head_tests.cf
debug: config: read file /usr/share/spamassassin/20_html_tests.cf
debug: config: read file /usr/share/spamassassin/20_meta_tests.cf
debug: config: read file /usr/share/spamassassin/20_phrases.cf
debug: config: read file /usr/share/spamassassin/20_porn.cf
debug: config: read file /usr/share/spamassassin/20_ratware.cf
debug: config: read file /usr/share/spamassassin/20_uri_tests.cf
debug: config: read file /usr/share/spamassassin/23_bayes.cf
debug: config: read file /usr/share/spamassassin/25_body_tests_es.cf
debug: config: read file /usr/share/spamassassin/25_hashcash.cf
debug: config: read file /usr/share/spamassassin/25_spf.cf
debug: config: read file /usr/share/spamassassin/25_uribl.cf
debug: config: read file /usr/share/spamassassin/30_text_de.cf
debug: config: read file /usr/share/spamassassin/30_text_fr.cf
debug: config: read file /usr/share/spamassassin/30_text_nl.cf
debug: config: read file /usr/share/spamassassin/30_text_pl.cf
debug: config: read file /usr/share/spamassassin/50_scores.cf
debug: config: read file /usr/share/spamassassin/60_whitelist.cf
debug: using "/etc/mail/spamassassin" for site rules dir
debug: config: read file /etc/mail/spamassassin/local.cf
debug: using "/root/.spamassassin" for user state dir
debug: using "/root/.spamassassin/user_prefs" for user prefs file
debug: config: read file /root/.spamassassin/user_prefs
debug: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
debug: plugin: registered
Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
debug: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC
debug: plugin: registered
Mail::SpamAssassin::Plugin::Hashcash=HASH(0x902576c)
debug: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
debug: plugin: registered Mail::SpamAssassin::Plugin::SPF=HASH(0x9003580)
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
implements 'parse_config'
debug: plugin: Mail::SpamAssassin::Plugin::Hashcash=HASH(0x902576c)
implements 'parse_config'
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
inhibited further callbacks
debug: bayes: DB_File module not installed, cannot use Bayes
debug: Score set 1 chosen.
debug: ---- MIME PARSER START ----
debug: main message type: text/plain
debug: parsing normal part
debug: added part, type: text/plain
debug: ---- MIME PARSER END ----
debug: bayes: DB_File module not installed, cannot use Bayes
debug: metadata: X-Spam-Relays-Trusted:
debug: metadata: X-Spam-Relays-Untrusted:
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
implements 'parsed_metadata'
debug: Net::DNS version is 0.23, but need 0.34
debug: decoding: no encoding detected
debug: Running tests for priority: 0
debug: running header regexp tests; score so far=0
debug: registering glue method for check_hashcash_double_spend
(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x902576c))
debug: registering glue method for check_for_spf_helo_pass
(Mail::SpamAssassin::Plugin::SPF=HASH(0x9003580))
debug: all '*From' addrs: ignore@compiling.spamassassin.taint.org
debug: registering glue method for check_hashcash_value
(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x902576c))
debug: all '*To' addrs:
debug: registering glue method for check_for_spf_softfail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x9003580))
debug: registering glue method for check_for_spf_pass
(Mail::SpamAssassin::Plugin::SPF=HASH(0x9003580))
debug: registering glue method for check_for_spf_helo_softfail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x9003580))
debug: registering glue method for check_for_spf_helo_fail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x9003580))
debug: running body-text per-line regexp tests; score so far=-2.623
debug: running uri tests; score so far=-2.623
debug: registering glue method for check_uridnsbl
(Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4))
debug: Razor2 is available
debug: entering helper-app run mode
 Razor-Log: Computed razorhome from env: /root/.razor
 Razor-Log: Found razorhome: /root/.razor
 Razor-Log: read_file: 16 items read from /root/.razor/razor-agent.conf
Nov 02 17:05:20.851396 check[5350]: [ 2] [bootup] Logging initiated
LogDebugLevel=9 to stdout
Nov 02 17:05:20.852366 check[5350]: [ 5] computed
razorhome=/root/.razor, conf=/root/.razor/razor-agent.conf,
ident=/root/.razor/identity-ruK_QnJy62
Nov 02 17:05:20.852833 check[5350]: [ 8] Client supported_engines: 4 8
Nov 02 17:05:20.853768 check[5350]: [ 8]  prep_mail done: mail 1
headers=93, mime0=1376
Nov 02 17:05:20.854525 check[5350]: [ 5] read_file: 1 items read from
/root/.razor/servers.discovery.lst
Nov 02 17:05:20.855233 check[5350]: [ 5] read_file: 2 items read from
/root/.razor/servers.nomination.lst
Nov 02 17:05:20.855940 check[5350]: [ 5] read_file: 3 items read from
/root/.razor/servers.catalogue.lst
Nov 02 17:05:20.856757 check[5350]: [ 9] Assigning defaults to
joy.cloudmark.com
Nov 02 17:05:20.857174 check[5350]: [ 9] Assigning defaults to
folly.cloudmark.com
Nov 02 17:05:20.857570 check[5350]: [ 9] Assigning defaults to
thrill.cloudmark.com
Nov 02 17:05:20.857946 check[5350]: [ 9] Assigning defaults to
pride.cloudmark.com
Nov 02 17:05:20.858328 check[5350]: [ 9] Assigning defaults to
wonder.cloudmark.com
Nov 02 17:05:20.860118 check[5350]: [ 5] read_file: 12 items read from
/root/.razor/server.joy.cloudmark.com.conf
Nov 02 17:05:20.861302 check[5350]: [ 5] read_file: 12 items read from
/root/.razor/server.joy.cloudmark.com.conf
Nov 02 17:05:20.862565 check[5350]: [ 5] read_file: 13 items read from
/root/.razor/server.folly.cloudmark.com.conf
Nov 02 17:05:20.863765 check[5350]: [ 5] read_file: 13 items read from
/root/.razor/server.folly.cloudmark.com.conf
Nov 02 17:05:20.865171 check[5350]: [ 5] read_file: 16 items read from
/root/.razor/server.thrill.cloudmark.com.conf
Nov 02 17:05:20.866552 check[5350]: [ 5] read_file: 16 items read from
/root/.razor/server.thrill.cloudmark.com.conf
Nov 02 17:05:20.867958 check[5350]: [ 5] read_file: 16 items read from
/root/.razor/server.wonder.cloudmark.com.conf
Nov 02 17:05:20.869311 check[5350]: [ 5] read_file: 16 items read from
/root/.razor/server.wonder.cloudmark.com.conf
Nov 02 17:05:20.870692 check[5350]: [ 5] read_file: 16 items read from
/root/.razor/server.pride.cloudmark.com.conf
Nov 02 17:05:20.872041 check[5350]: [ 5] read_file: 16 items read from
/root/.razor/server.pride.cloudmark.com.conf
Nov 02 17:05:20.872501 check[5350]: [ 5] 151326 seconds before closest
server discovery
Nov 02 17:05:20.872935 check[5350]: [ 6] thrill.cloudmark.com is a
Catalogue Server srl 5048; computed min_cf=6, Server se: C8
Nov 02 17:05:20.873351 check[5350]: [ 8] Computed supported_engines: 4 8
Nov 02 17:05:20.873666 check[5350]: [ 8] Using next closest server
thrill.cloudmark.com:2703, cached info srl 5048
Nov 02 17:05:20.873919 check[5350]: [ 8] mail 1 has no subject
Nov 02 17:05:20.874673 check[5350]: [ 6] preproc: mail 1.0 went from
1376 bytes to 1339
Nov 02 17:05:20.874996 check[5350]: [ 6] computing sigs for mail 1.0,
len 1339
Nov 02 17:05:20.879076 check[5350]: [ 6] Engine (8) didn't produce a
signature for mail 1.0
Nov 02 17:05:20.879554 check[5350]: [ 6] skipping whitelist file
(empty?): /root/.razor/razor-whitelist
Nov 02 17:05:20.879921 check[5350]: [ 5] Connecting to
thrill.cloudmark.com ...
Nov 02 17:05:21.200301 check[5350]: [ 8] Connection established
Nov 02 17:05:21.200718 check[5350]: [ 4] thrill.cloudmark.com >> 36
server greeting: sn=C&srl=5048&a=l&a=cg&ep4=7542-10
Nov 02 17:05:21.201662 check[5350]: [ 4] thrill.cloudmark.com << 25
Nov 02 17:05:21.201866 check[5350]: [ 6] cn=razor-agents&cv=2.61
Nov 02 17:05:21.202402 check[5350]: [ 6] thrill.cloudmark.com is a
Catalogue Server srl 5048; computed min_cf=6, Server se: C8
Nov 02 17:05:21.202885 check[5350]: [ 8] Computed supported_engines: 4 8
Nov 02 17:05:21.203244 check[5350]: [ 8] mail 1.0 e4 sig:
xFaZIZUVHk90OQfARnenjx5BZTMA
Nov 02 17:05:21.203552 check[5350]: [ 5] mail 1.0 e8 got no sig
Nov 02 17:05:21.203815 check[5350]: [ 8] preparing 1 queries
Nov 02 17:05:21.204244 check[5350]: [ 8] sending 1 batches
Nov 02 17:05:21.204597 check[5350]: [ 4] thrill.cloudmark.com << 52
Nov 02 17:05:21.204768 check[5350]: [ 6]
a=c&e=4&ep4=7542-10&s=xFaZIZUVHk90OQfARnenjx5BZTMA
Nov 02 17:05:21.614653 check[5350]: [ 4] thrill.cloudmark.com >> 5
Nov 02 17:05:21.614883 check[5350]: [ 6] response to sent.2
p=0
Nov 02 17:05:21.615771 check[5350]: [ 6] mail 1.0 e=4
sig=xFaZIZUVHk90OQfARnenjx5BZTMA: sig not found.
Nov 02 17:05:21.616053 check[5350]: [ 7] method 4: mail 1.0:
no-contention part, spam=0
Nov 02 17:05:21.616228 check[5350]: [ 7] method 4: mail 1: all
non-contention parts not spam, mail not spam
Nov 02 17:05:21.616395 check[5350]: [ 3] mail 1 is not known spam.
Nov 02 17:05:21.616630 check[5350]: [ 5] disconnecting from server
thrill.cloudmark.com
Nov 02 17:05:21.616981 check[5350]: [ 4] thrill.cloudmark.com << 5
Nov 02 17:05:21.617150 check[5350]: [ 6] a=q
debug: Using results from Razor v2.61
debug: Found Razor2 part: part=0 engine=4 ct=0 cf=0
debug: leaving helper-app run mode
debug: Razor2 results: spam? 0  highest cf score: 0
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
implements 'check_tick'
debug: running raw-body-text per-line regexp tests; score so far=-2.623
debug: running full-text regexp tests; score so far=-2.623
debug: Razor2 is available
debug: Current PATH is:
/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin
debug: executable for pyzor was found at /usr/bin/pyzor
debug: Pyzor is available: /usr/bin/pyzor
debug: entering helper-app run mode
debug: setuid: helper proc 5351: ruid=0 euid=0
debug: Pyzor: got response: 217.160.253.84:24441    (200, 'OK')    0    0
debug: leaving helper-app run mode
debug: DCCifd is not available: no r/w dccifd socket found.
debug: executable for dccproc was found at /usr/local/bin/dccproc
debug: DCC is available: /usr/local/bin/dccproc
debug: entering helper-app run mode
debug: setuid: helper proc 5352: ruid=0 euid=0
debug: DCC: got response: X-DCC-SPAMCHECK.NET-Metrics: scanmail.nexis.be
1168; Body=6874 Fuz1=495456 Fuz2=494447
debug: leaving helper-app run mode
debug: Running tests for priority: 500
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x866abb4)
implements 'check_post_dnsbl'
debug: running meta tests; score so far=-2.623
debug: running header regexp tests; score so far=-1.053
debug: running body-text per-line regexp tests; score so far=-1.053
debug: running uri tests; score so far=-1.053
debug: running raw-body-text per-line regexp tests; score so far=-1.053
debug: running full-text regexp tests; score so far=-1.053
debug: Running tests for priority: 1000
debug: running meta tests; score so far=-1.053
debug: running header regexp tests; score so far=-1.053
debug: using "/root/.spamassassin" for user state dir
debug: lock: 5350 created
/root/.spamassassin/auto-whitelist.lock.scanmail.nexis.be.5350
debug: lock: 5350 trying to get lock on
/root/.spamassassin/auto-whitelist with 0 retries
debug: lock: 5350 link to /root/.spamassassin/auto-whitelist.lock: link ok
debug: Tie-ing to DB file R/W in /root/.spamassassin/auto-whitelist
debug: auto-whitelist (db-based):
ignore@compiling.spamassassin.taint.org|ip=none scores 0/0
debug: AWL active, pre-score: -1.053, autolearn score: -1.053, mean:
undef, IP: undef
debug: DB addr list: untie-ing and unlocking.
debug: DB addr list: file locked, breaking lock.
debug: unlock: 5350 unlink /root/.spamassassin/auto-whitelist.lock
debug: Post AWL score: -1.053
debug: running body-text per-line regexp tests; score so far=-1.053
debug: running uri tests; score so far=-1.053
debug: running raw-body-text per-line regexp tests; score so far=-1.053
debug: running full-text regexp tests; score so far=-1.053
debug: is spam? score=-1.053 required=5
debug: tests=ALL_TRUSTED,MISSING_DATE,MISSING_SUBJECT,NO_REAL_NAME
debug:
subtests=__HAS_MSGID,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__SANE_MSGID,__UNUSABLE_MSGID

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From michele at BLACKNIGHTSOLUTIONS.COM  Tue Nov  2 16:05:04 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:27 2006
Subject: request: minimum attachment size?
Message-ID: <mailman.4225.1137101247.24926.mailscanner@lists.mailscanner.info>

> Sounds like a good idea, and it's pretty simple to add. By
> default it will be switched off.

What would a "sane" minimum be?



Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
Proud sponsors of MM04 {http://www.mm04.net}

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Tue Nov  2 16:20:17 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:27 2006
Subject: request: minimum attachment size?
Message-ID: <mailman.4226.1137101247.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

In my view, 1.

Michele Neylon :: Blacknight Solutions wrote:

>>Sounds like a good idea, and it's pretty simple to add. By
>>default it will be switched off.
>>
>>
>
>What would a "sane" minimum be?
>
>
>
>

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Tue Nov  2 16:00:22 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:27 2006
Subject: 4.35.9: phishing fraud syslogs
Message-ID: <mailman.4227.1137101247.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Unfortunately when I am processing this, I don't have access to any of
the message properties :-(

Jeff A. Earickson wrote:

> Julian,
>
> Please tweak the syslog message for phishing fraud to include
> the message ID, something like:
>
> Found phishing fraud attack in iA25FnB7002189 from http://(etc)
>
> The message ID is always important when grepping the syslog.
> Thanks.
>
--

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Tue Nov  2 16:02:38 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:27 2006
Subject: 4.35.9: phishing fraud syslogs
Message-ID: <mailman.4228.1137101247.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Done.

Jeff A. Earickson wrote:

> Julian,
>
> Also, please remove the word "attack" from this line when you
> tweak it, eg:
>
> Found phishing fraud in iA25FnB7002189 from http://(etc)
>
> My syslog summarizer (logcheck,
> http://www.smittyware.com/contrib/psionic.php/) generates lots
> of compliants when it sees the word "attack" in the syslog.
> Thanks.
>
> Jeff
>

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Tue Nov  2 15:57:05 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:27 2006
Subject: ANNOUNCE: MailScanner 4.35.9 stable released
Message-ID: <mailman.4229.1137101247.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Did you remember to re-install MailScanner like Steve's 2nd posting said
you should?

Mike Zanker wrote:

> Julian Field wrote:
>
>> - Fixed problems with MIME::Base64 dependencies.
>
>
> Unfortunately this doesn't seem to be the case for me :(
>
> I installed on RHEL 3 AS and everything seemed to go to plan, except
> that when running "uptodate -u" I started getting package conflict
> errors with the main perl RPM again. Followed Steve Swaney's advice and
> removed then reinstalled the main perl RPM and then started getting
>
> Can't locate object method "init" via package
> "MIME::Decoder::QuotedPrint"
>
> errors in the logs. Re-installed latest Base64 from the RPM that
> MailScanner built and then started getting perl package conflicts with
> up2date again.
>
> I'm just going round in circles with this - is there a definitive
> solution?


--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mkettler at EVI-INC.COM  Tue Nov  2 16:52:54 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:27 2006
Subject: {Scanned} Spamassassin test
Message-ID: <mailman.4230.1137101247.24926.mailscanner@lists.mailscanner.info>

At 11:09 AM 11/2/2004, Koen Teugels wrote:
>I see that some modules are not loaded or installeddebug: bayes: DB_File
>module not installed, cannot use Bayes
>How can you do this just compiled spamasssin on TAO linux.

install the perl-DB_File RPM for your version of TAO linux.... It's part of
their standard distribution as best I can tell, just not installed by default.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Jan-Peter.Koopmann at SECEIDOS.DE  Tue Nov  2 16:24:25 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:28 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.4231.1137101247.24926.mailscanner@lists.mailscanner.info>

On Tuesday, November 02, 2004 4:44 PM MailScanner mailing list wrote:

> As I tested this a week or so ago and confirmed that the
> 'NO_DNS_FOR_FROM' test will not work unless the recognized
> Envelope_From header is at the top, you will really need to convince
> me that the location does not matter. 

That's not what I said. I said: If you specify envelope_sender_header
then this header will be used regardless of its position. Let me show
you the relevant part of the code:

---snipp---
      
  # Use the 'envelope-sender-header' header that the user has specified.
  # We assume this is correct, *even* if the fetchmail/X-Sender screwup
  # appears.
  $envf = $self->{conf}->{envelope_sender_header};
  if ((defined $envf) && ($envf = $self->get($envf)) && ($envf =~ /\@/))
{
    goto ok;
  }

... stuff removed ...

  # procmailrc notes this, amavisd are adding it, we recommend it
  # (although we now recommend adding to Received instead)
  if ($envf = $self->get ("X-Envelope-From")) {
    # heuristic: this could have been relayed via a list which then used
    # a *new* Envelope-from.  check
    if ($self->get ("ALL") =~
/(?:^|\n)Received:\s.*\nX-Envelope-From:\s/s) {
      dbg ("X-Envelope-From header found after 1 or more Received lines,
cannot trust envelope-from");
    } else {
      goto ok;
    }
  }

---snapp---

> When MS placed the Envelope From header at the bottom, SA refused to
> 'trust' it and would therefore skip the 'NO_DNS_FOR_FROM' test.
> 
> Here is the log entry that proves that:
>> "debug: X-Envelope-From header found after 1 or more Received lines,
>> cannot trust envelope-from"

Because no option was set it used X-Envelope-From and since that one was
below the received lines it did not work.

> To cast my vote to Julian's poll, I prefer option 'A' to
> change MS's entry to "X-Envelope-From:" for the shallow but
> simple reason that its what SA expects by default, hence a
> pseudo-standard. 

What happens if you have several MailScanners involved in a mail
transfer and all of them use "X-Envelope-From". Then count fetchmail in
and here the trouble starts... Personally I so not think of this as a
clean solution. There is a reason all (?) MailScanner headers have
%org-name% in it...

You will achieve the same thing if you put a suitable line in
spam.assassin.prefs.conf. I agree though that the user still would have
to change the file at least once. On the other hand: He/She should do
that anyways to set the appropriate bayes_ignore_header.


Kind regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From isp-list at TULSACONNECT.COM  Tue Nov  2 17:15:11 2004
From: isp-list at TULSACONNECT.COM (Mike Bacher)
Date: Thu Jan 12 21:27:28 2006
Subject: Fortress Systems / SMGateway?
Message-ID: <mailman.4232.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Steve Swaney wrote:

> Let's take this off-list but I can definitely state that we'd obviously like
> to be able to support the maximum number of platforms practical :)
>

Hi Steve,

I've sent you a few messages off-list and haven't seen a reply, so I'm wondering if you
are getting them or not.  In any case, if you could whitelist my mail domain
(tulsaconnect.com) I will resend my messages.

Thanks.

--

-----------------------------------------
Mike Bacher / isp-list@tulsaconnect.com
TCIS - TulsaConnect Internet Services
Phone: 918-584-1100x110 Fax: 918-582-5776
-----------------------------------------

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From rc at ITSS.NERC.AC.UK  Tue Nov  2 16:52:07 2004
From: rc at ITSS.NERC.AC.UK (Ron Campbell)
Date: Thu Jan 12 21:27:28 2006
Subject: {Scanned} ProcessClamAVOutput: unrecognised line ...   
    contact the authors
Message-ID: <mailman.4233.1137101248.24926.mailscanner@lists.mailscanner.info>

Yes. That is it. Well spotted. The messages appear in the log
with a .tgz file as an attachment.

   Cheers ...  Ron


Koen Teugels wrote:
> Sorry typo. I'm in the latest version of mailscanner
> (MailScanner-4.35.9-1.rpm.tar.gz) en and rpm version of clamav 0.80.1
> (and the compiled version)
> It looks that Mailscanner has a problem when you have an attachment like
> copfilter-0.0.95.tgz. Does anyone experience the same problem.
>
>
> grtz Koen
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Tue Nov  2 18:05:42 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:28 2006
Subject: SuSE with 4.35.9 and MIME::Base64
Message-ID: <mailman.4234.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

There seems to be something *really* weird going on with SuSE 9.1 and
MailScanner-4.35.9. For some reason installing MIME::Base64 removes perl
completely. Fortunately you have to try very very hard to install
MIME::Base64 before it goes and actually does it. Running my
./install.sh isn't enough, so you can safely run that.

To get round this problem, you need to manually install the
perl-MIME-Base64 code. Don't install it from CPAN as it will get
installed in the wrong place.

Do this instead:

cd MailScanner-4.35.9-1
rpm -Uvh perl-MIME-Base64-3.05-2.src.rpm
pushd /usr/src/packages/SPECS
rpmbuild -bp perl-MIME-Base64.spec
cd ../BUILD
cd perl-MIME-Base64-3.05
perl Makefile.PL
make
make test
make install
popd
./install.sh fast

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From VBoulytchev at COINFOTECH.COM  Tue Nov  2 18:09:22 2004
From: VBoulytchev at COINFOTECH.COM (Vasiliy Boulytchev)
Date: Thu Jan 12 21:27:28 2006
Subject: Failed to link message body between queues error
Message-ID: <mailman.4235.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Ladies and Gents,
        Often, we get the below error in the log, whats up?

Nov  2 11:05:15 arizona MailScanner[8052]: Failed to link message body between queues (/usr/local/mailscanner/mailscanner.out/df18723 --> /usr/local/mailscanner/mailscanner.in/df18723)

        Now, we do not see this on non-NFS shared queues.  What happens to those files?  Do they just get reprocessed when the file is finally there...  What does this error mean, and where does it come from?

Thanks,
Vasiliy Boulytchev
Colorado Information Technologies Inc.
http://www.coinfotech.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From wright at CYBERVALE.COM  Tue Nov  2 17:38:39 2004
From: wright at CYBERVALE.COM (Terran Wright)
Date: Thu Jan 12 21:27:28 2006
Subject: Bayes dir permissions
Message-ID: <mailman.4236.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> Terran Wright wrote:
> > Guy's
> >
> > running Postfix+MS+SA3
> >
> > what are the correct permissions for the bayes dir and files
> >
> > I get the following error when I try to update rules_dujour:
> >
> > Lint output: Cannot open bayes databases /etc/MailScanner/bayes/bayes_*
R/O: tie failed:
> > Cannot open bayes databases /etc/MailScanner/bayes/bayes_* R/O: tie
failed:

I took care of the bayes error, but something else is obviously wrong as I'm
still getting this part:

> > Failed to run DNS_FROM_AHBL_RHSBL RBL SpamAssassin test, skipping:
> >         (Can't call method "bgsend" on an undefined value at
/usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/Dns.pm line 112.
> > )


Any ideas?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ssilva at SGVWATER.COM  Tue Nov  2 18:46:25 2004
From: ssilva at SGVWATER.COM (Scott Silva)
Date: Thu Jan 12 21:27:28 2006
Subject: dspam!
Message-ID: <mailman.4237.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Julian Field wrote:
| John Rudd wrote:
|
|> I think something like the generic external virus scanner option that
|> was set up would be a useful thing to have for spam scanners as well.
|> Have a program group that can be set up to give a "it's not spam",
|> "it's spam" or "it's high spam" result (perhaps with a report string
|> that gets put in the 2nd part of the spamcheck report) after
|> mailscanner sends that program the message.  It's probably not
|> efficient, but it gives people options.
|
|
| That sounds like a good idea. I'll put it on the list of things to do at
| some point. Don't hold your breath though!
I hope for your sake. Julian, it is somewhat below ;
"Put your feet up and relax" and
"Go have a pint with some friends"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD4DBQFBh9YBRADw9lziUqQRAj9GAJdHDIW0QbrcQTeGIUj3l71fb1NoAJ9g/bjq
u4+hwddgIuc/ICcMlClRLA==
=vsq6
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ssilva at SGVWATER.COM  Tue Nov  2 19:11:02 2004
From: ssilva at SGVWATER.COM (Scott Silva)
Date: Thu Jan 12 21:27:28 2006
Subject: ANNOUNCE: MailScanner 4.35.9 stable released
Message-ID: <mailman.4238.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mike Zanker wrote:
| Julian Field wrote:
|
|> - Fixed problems with MIME::Base64 dependencies.
|
|
| Unfortunately this doesn't seem to be the case for me :(
|
| I installed on RHEL 3 AS and everything seemed to go to plan, except
| that when running "uptodate -u" I started getting package conflict
| errors with the main perl RPM again. Followed Steve Swaney's advice and
| removed then reinstalled the main perl RPM and then started getting
|
| Can't locate object method "init" via package "MIME::Decoder::QuotedPrint"
|
| errors in the logs. Re-installed latest Base64 from the RPM that
| MailScanner built and then started getting perl package conflicts with
| up2date again.
|
| I'm just going round in circles with this - is there a definitive
solution?
I used what I did in the past;
Removed perl-MIME-Base64.rpm
cpan MIME::Base64
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBh9vFRADw9lziUqQRAi3BAJ9JzT8ecgMHPeJpv0jE0icKU0vWGwCfUWSn
zTax7mMASYlfOfkjLLKCq6k=
=09vb
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Tue Nov  2 20:03:10 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:28 2006
Subject: Bug in ClamAV 0.80
Message-ID: <mailman.4239.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Can someone confirm this for me please?
I have a copy of the F-Prot distribution, which includes a copy of EICAR
inside their docs so that you have a test file.
ClamAV finds this file when it is checking individual elements of the
tgz file, but then reports the tgz file itself as being clean.

I get this output from
/usr/lib/MailScanner/clamav-wrapper /usr/local -r --disable-summary
--stdout .
---SNIP---
/tmp/clamav.17357/clamav-ed6a79aa30cd343a/f-prot/doc_ws/screenshot.jpg: OK
/tmp/clamav.17357/clamav-ed6a79aa30cd343a/f-prot/doc_ws/sys_req.html: OK
/tmp/clamav.17357/clamav-ed6a79aa30cd343a/f-prot/doc_ws/test_eicar.html:
Eicar-Test-Signature FOUND
/tmp/clamav.17357/clamav-ed6a79aa30cd343a/f-prot/doc_ws/test_inst.html: OK
/tmp/clamav.17357/clamav-ed6a79aa30cd343a/f-prot/doc_ws/tip.jpg: OK
---SNIP---
(raw) /tmp/clamav.17357/clamav-fcf5882c8ea0c1ad/fp-linux-ws-4.0.0.tgz: OK
---SNIP---

As you can see, it reports the EICAR but then says the tgz is clean. I
can find no way of reliably pulling out all this /tmp stuff so that I
can deduce the real name of the archive.

Why did the ClamAV guys break their nice tidy output format?

For now, do *not* use the "clamav" scanner. The "clamavmodule" scanner
should still work okay.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mike at ZANKER.ORG  Tue Nov  2 20:04:25 2004
From: mike at ZANKER.ORG (Mike Zanker)
Date: Thu Jan 12 21:27:28 2006
Subject: ANNOUNCE: MailScanner 4.35.9 stable released
Message-ID: <mailman.4240.1137101248.24926.mailscanner@lists.mailscanner.info>

On Tue, 2 Nov 2004 10:57:05 -0500, Julian Field
<mailscanner@ECS.SOTON.AC.UK> wrote:

>Did you remember to re-install MailScanner like Steve's 2nd posting said
>you should?

Yes - that fixes MailScanner but breaks the main perl RPM again.

Mike.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From kairaven at ARCOR.DE  Tue Nov  2 19:58:03 2004
From: kairaven at ARCOR.DE (Kai Raven)
Date: Thu Jan 12 21:27:28 2006
Subject: perl-MIME-tools-5415 with FC2
Message-ID: <mailman.4241.1137101248.24926.mailscanner@lists.mailscanner.info>

Hi,

today i wanted to update MailScanner to 4.35.9. I always update all
modules and mailscanner manually. All went fine, but the rebuild
of perl-MIME-tools failed always with
Warning: prerequisite MIME::Base64 3.03 not found. We have 2.21.

After i had overwritten the files in
/usr/lib/perl5/5.8.3/i386-linux-thread-multi/MIME/* and
/usr/lib/perl5/5.8.3/i386-linux-thread-multi/auto/MIME/Base64/*
with the updated MIME::Base64 package 3.05 in
/usr/lib/perl5/site_perl/5.8.3/i386-linux-thread-multi/MIME/
.pm/usr/lib/perl5/site_perl/5.8.3/i386-linux-thread-multi/auto/MIME/Bas
e64/
the rebuild of perl-MIME-tools worked and MailScanner is running fine
again under FC2 :)

--
Ciao
Kai

WWW: http://kai.iks-jena.de/
Blog: http://rabenhorst.blogg.de/
GnuPG-Key: 0xD6E995A0
Jabber: kraven@jabber.ccc.de

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/PGP-SIGNATURE  999bytes. ]
    [ Unable to print this part. ]


From mike at ZANKER.ORG  Tue Nov  2 20:18:51 2004
From: mike at ZANKER.ORG (Mike Zanker)
Date: Thu Jan 12 21:27:28 2006
Subject: SuSE with 4.35.9 and MIME::Base64
Message-ID: <mailman.4242.1137101248.24926.mailscanner@lists.mailscanner.info>

On Tue, 2 Nov 2004 13:05:42 -0500, Julian Field
<mailscanner@ECS.SOTON.AC.UK> wrote:

>cd MailScanner-4.35.9-1
>rpm -Uvh perl-MIME-Base64-3.05-2.src.rpm
>pushd /usr/src/packages/SPECS
>rpmbuild -bp perl-MIME-Base64.spec
>cd ../BUILD
>cd perl-MIME-Base64-3.05
>perl Makefile.PL
>make
>make test
>make install
>popd
>./install.sh fast

Tried this to see if it would solve the problems with RHEL, but the final
line (./install.sh fast) just forces the installtion of the MIME-Base64
RPM again and we're back to square one.

I can see that it might work without running ./install.sh again...

Mike.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at MANGO.ZW  Tue Nov  2 20:44:14 2004
From: mailscanner at MANGO.ZW (Jim Holland)
Date: Thu Jan 12 21:27:28 2006
Subject: Messages with blocked filenames/filetypes not being delivered
Message-ID: <mailman.4243.1137101248.24926.mailscanner@lists.mailscanner.info>

Hi all

I have been using MailScanner since February this year, and have found it
an extraordinarily valuable package - thanks again, Julian.

I consider myself reasonably smart with its configuration, but must admit
to still having problems with really understanding the process flow (of
course one day I really must read the source!).  I find it difficult to be
able to determine in advance whether a particular message with problem
contents will be:

        (a) Bounced back to sender (desirable with non-forging viruses,
        MS Office macros viruses etc), and if so what message is
        being sent back to sender.

        (b) Delivered to the recipient after removal of blacklisted
        content (desirable with above non-forging viruses/MS Office
        macros viruses etc, with disarmed HTML, with unacceptable
        filenames/filetypes which are not detected as being actual
        viruses, with attachments or messages that are too large
        with password-protected zip files etc etc)

        (c) Quarantined and sent to no one.

With viruses it is reasonably clear what will happen, although the
definition of "All-Viruses" as used in the "Silent Viruses" definition
does not seem to be clearly spelt out - I assume that it means anything
that is found by the virus scanner (virus/worm/trojan/script/exploit etc)
plus password-protected zip files that are not detected as viruses.
The Silent Viruses option controls bounces to sender and the Still Deliver
Silent Viruses settings controls whether or not the messages are delivered
after removal of the problem attachment.  This behaviour is also modified
by the Non-Forging Viruses option.

The above settings can also be used to determine the response to HTML
exploits that are discovered.

However it is not immediately clear what happens when other problems are
found, eg messages with:

        Unacceptable filenames
        Unacceptable filetypes
        Password-protected zip files
        Messages that are too large
        Attachments that are too large

If the above are blocked, then is there a notification to the sender and/or
recipient?  How is that controlled?

What about messages where the html has been converted to text?  Is the
recipient notified?  I presume not.

I wonder if it is not time to think of a more unified system of rules, eg
a single "notification.conf" configuration file to specify actions to be
taken and warning messages to be used for different problem categories
classifed as "deny" in current config files.  Rulesets could be used if
required.  Sample lines might read:

# category              sender warning                  recipient warning
#
denied_filename:        sender.filename.report.txt      stored.filename.message.txt
silent_virus:           -                               -
%rules-dir%/messagesize.rules:  -                       messagesize.report.txt
spam:                   -                               -

If there was no warning listed then no notice would be sent.  Perhaps
additional fields could be added, eg for logging requirements.

There would also need to be a master ruleset to determine what to do if a
message contained one attachment to be silently quarantined and another to
be delivered to the recipient, and so on.  This approach would clearly
break some of the other configuration and rules files, but could be the
basis of a simpler system to understand and configure.  Is this of any
interest for further pursuit?

Now the reason for the above musings is that I have a problem that I can't
resolve!  I want to ensure that messages that are being saved to
quarantine because of banned filenames/filetypes/Password-protected zip
files but which are not found to contain any actual virus are delivered
without the offending files.  For some reason, since updating to
MailScanner-4.35.9-1 and removing the references to "Joke" in Non-Forging
Viruses and still_deliver_silent_viruses.rules, the system is not
delivering any notifications to recipients about any of the following:

        {Blocked Content}
        {Filename?}
        {Virus?}

The removal of the "Joke" entry has stopped all the virus warnings about
Worm.Bagle.AU etc, so that is fine.  (It was sending Joke.xxx files.)

The Blocked Content warnings have probably stopped because I changed the
settings for allowing HTML tags from "no" to "disarm", which is also fine.

However I am puzzled by the fact that a harmless .tmp file is now silently
quarantined instead of the message being delivered without the attachment
but with a warning.  Any suggestions as to where to look?

In MailScanner.conf I have set:

        Filename Rules = %rules-dir%/filename.rules

and filename.rules has the tab-delimited line:

        FromOrTo:       default      %etc-dir%/filename.rules.conf

and filename.rules.conf has the new defaults including:

        deny    \.tmp$          Dangerous Temporary File (according to \
Microsoft)      Dangerous attachment according to Microsoft Q883260

So I would expect the attachment to be removed and a warning message added.

Regards

Jim Holland
System Administrator
MANGO - Zimbabwe's non-profit e-mail service

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From roger at RUDNICK.COM.BR  Tue Nov  2 20:49:28 2004
From: roger at RUDNICK.COM.BR (Roger Jochem)
Date: Thu Jan 12 21:27:28 2006
Subject: Same FROM and TO
Message-ID: <mailman.4244.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

How could I block SPAM where the FROM is equal the TO, and the people receiving the
message are at BCC. I receive a lot of that. Is like the from was my company, but it
isn't, and another people in the company are receiving it...

Example:
---------------------
From: abc@xyz.com.br
To: abc@xyz.com.br
{bcc: me}

Buy this stuff...
---------------------

I hope I was clear explaining myself. Any ideas of how I could stop this stuff?

Regards

Roger Jochem

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From michele at BLACKNIGHTSOLUTIONS.COM  Tue Nov  2 20:52:55 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon : Blacknight Solutions)
Date: Thu Jan 12 21:27:28 2006
Subject: Same FROM and TO
Message-ID: <mailman.4245.1137101248.24926.mailscanner@lists.mailscanner.info>

On Tue, 2004-11-02 at 17:49 -0300, Roger Jochem wrote:
> How could I block SPAM where the FROM is equal the TO, and the people receiving the
> message are at BCC. I receive a lot of that. Is like the from was my company, but it
> isn't, and another people in the company are receiving it...
>
> Example:
> ---------------------
> From: abc@xyz.com.br
> To: abc@xyz.com.br
> {bcc: me}
>
> Buy this stuff...
> ---------------------
>
> I hope I was clear explaining myself. Any ideas of how I could stop this stuff?
>
You might want to look at SPF
>
--
Mr Michele Neylon
Blacknight Solutions
http://www.blacknight.ie
059 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mkettler at EVI-INC.COM  Tue Nov  2 21:06:17 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:28 2006
Subject: Same FROM and TO
Message-ID: <mailman.4246.1137101248.24926.mailscanner@lists.mailscanner.info>

At 03:52 PM 11/2/2004, Michele Neylon : Blacknight Solutions wrote:
> > ---------------------
> > From: abc@xyz.com.br
> > To: abc@xyz.com.br
> > {bcc: me}
> >
> > Buy this stuff...
> > ---------------------
> >
> > I hope I was clear explaining myself. Any ideas of how I could stop
> this stuff?
> >
>You might want to look at SPF

SPF is a good start, although that only happens to be true if you run
xyz.com.br.

Another option is one of the spamassassin rules: FROM_AND_TO_SAME. Just
jack it up with a score statement.

However, be aware that it's incredibly common for nonpsam messages to hit
this rule.. Especially logwatch and other cronjob type system reports which
tend to be from and to root@example.com.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Jan-Peter.Koopmann at SECEIDOS.DE  Tue Nov  2 20:47:14 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:28 2006
Subject: Bug in ClamAV 0.80
Message-ID: <mailman.4247.1137101248.24926.mailscanner@lists.mailscanner.info>

> For now, do *not* use the "clamav" scanner. 

As long as we use additional scanners this is not breaking anything, is
it?

> The "clamavmodule" scanner should still work okay.

I will give that a try on Thursday.

Regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From michele at BLACKNIGHTSOLUTIONS.COM  Tue Nov  2 21:16:07 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon : Blacknight Solutions)
Date: Thu Jan 12 21:27:28 2006
Subject: Same FROM and TO
Message-ID: <mailman.4248.1137101248.24926.mailscanner@lists.mailscanner.info>

On Tue, 2004-11-02 at 16:06 -0500, Matt Kettler wrote:

> > >
> >You might want to look at SPF
>
> SPF is a good start, although that only happens to be true if you run
> xyz.com.br.

Which I thought was the case :)

>
> Another option is one of the spamassassin rules: FROM_AND_TO_SAME. Just
> jack it up with a score statement.
>
> However, be aware that it's incredibly common for nonpsam messages to hit
> this rule.. Especially logwatch and other cronjob type system reports which
> tend to be from and to root@example.com.

Which is why whitelisting root@someserveronyournetwork is not a bad idea

Of course there are downsides to that as well .....

--
Mr Michele Neylon
Blacknight Solutions
http://www.blacknight.ie
059 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From alaslavic at HAVERTYS.COM  Tue Nov  2 20:50:03 2004
From: alaslavic at HAVERTYS.COM (Alex Laslavic)
Date: Thu Jan 12 21:27:28 2006
Subject: Bug in ClamAV 0.80
Message-ID: <mailman.4249.1137101248.24926.mailscanner@lists.mailscanner.info>

MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK> wrote on 11/02/2004
03:03:10 PM:

> Can someone confirm this for me please?
> I have a copy of the F-Prot distribution, which includes a copy of EICAR
> inside their docs so that you have a test file.
> ClamAV finds this file when it is checking individual elements of the
> tgz file, but then reports the tgz file itself as being clean.
>
> I get this output from
> /usr/lib/MailScanner/clamav-wrapper /usr/local -r --disable-summary
> --stdout .
> ---SNIP---
> /tmp/clamav.17357/clamav-ed6a79aa30cd343a/f-prot/doc_ws/screenshot.jpg:
OK
> /tmp/clamav.17357/clamav-ed6a79aa30cd343a/f-prot/doc_ws/sys_req.html: OK
> /tmp/clamav.17357/clamav-ed6a79aa30cd343a/f-prot/doc_ws/test_eicar.html:
> Eicar-Test-Signature FOUND
> /tmp/clamav.17357/clamav-ed6a79aa30cd343a/f-prot/doc_ws/test_inst.html:
OK
> /tmp/clamav.17357/clamav-ed6a79aa30cd343a/f-prot/doc_ws/tip.jpg: OK
> ---SNIP---
> (raw) /tmp/clamav.17357/clamav-fcf5882c8ea0c1ad/fp-linux-ws-4.0.0.tgz: OK
> ---SNIP---
>
> As you can see, it reports the EICAR but then says the tgz is clean. I
> can find no way of reliably pulling out all this /tmp stuff so that I
> can deduce the real name of the archive.
>
> Why did the ClamAV guys break their nice tidy output format?
>
> For now, do *not* use the "clamav" scanner. The "clamavmodule" scanner
> should still work okay.
>
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Julian,
I get something slightly different, running:
ClamAV .80-1
mailscanner-4.33.3-1

I get the tmp madness too, but the tgz file itself is seen as FOUND,
although the path is mangled.  This was ClamAV-Test-Signature, not Eicar,
but I wouldn't think that would make a difference.

-----------------------------------------------
/home/alex/test/test1: ClamAV-Test-Signature FOUND
/home/alex/test/README: OK
/home/alex/test/test1.bz2: ClamAV-Test-Signature FOUND
/home/alex/test/test1.exe: ClamAV-Test-Signature FOUND
test1.exe
/tmp/clamav.22782/clamav-aa8d47299cf568cb/test1.exe: ClamAV-Test-Signature
FOUND
/tmp/clamav.22782/clamav-02f7a97706784945/test1.tgz: Infected Archive FOUND
(Real infected archive: /home/alex/test/test1.tgz)
/home/alex/test/test2.zip: ClamAV-Test-Signature FOUND
/home/alex/test/test3.rar: ClamAV-Test-Signature FOUND
/home/alex/test/test2.badext: ClamAV-Test-Signature FOUND
-------------------------------------------------

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From nmeverde at NP.K12.MN.US  Tue Nov  2 21:22:14 2004
From: nmeverde at NP.K12.MN.US (Nick Meverden)
Date: Thu Jan 12 21:27:28 2006
Subject: bayes stopped working
Message-ID: <mailman.4250.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

MailScanner stopped using bayes today with no errors, the database is no
longer auto-learning (ntokens do not increase) and the BAYES_ score rules
are no longer being used.  Has anyone seen this before?  Using
spamassassin -D --lint returns no bayes errors and if I run mail through
it it'll use bayes.  MailScanner.conf and spam.assassin.prefs.conf both
are pointing to the correct db path.  And bayes is enabled in
spam.assassin.prefs.conf.  Journal sync is setup in MailScanner.conf for
daily.  And I setup auto_expire to 0 in spam.assassin.prefs.conf and run a
cron job that shuts down MailScanner and manually expires the db and
removes any bayes_expire* files if they exist.  The bayes db was not
upgrade from 2.6X it was created using SA 3.0.0.  I would like to be able
to save the database with out clearing it out.

 thanks,

     - Nick

Here is the version info, output from sa-learn --dump magic, and a lock
file that always exist in /tmp, and the contents of my bayes db.

Spamassassin 3.0.0
MailScanner Version Number = 4.34.8
Perl 5.8.5
Linux 2.4.26

0.000          0          3          0  non-token data: bayes db version
0.000          0       2141          0  non-token data: nspam
0.000          0       1389          0  non-token data: nham
0.000          0     116161          0  non-token data: ntokens
0.000          0 1098405034          0  non-token data: oldest atime
0.000          0 1099095787          0  non-token data: newest atime
0.000          0          0          0  non-token data: last journal sync
atime
0.000          0 1099355126          0  non-token data: last expiry atime
0.000          0     691200          0  non-token data: last expire atime
delta
0.000          0      20945          0  non-token data: last expire
reduction count

/tmp/MS.bayes.rebuild.lock
SpamAssassin Bayes database locked for use by MailScanner 2022

/var/spool/MailScanner/spamassassin

2592 auto-whitelist           4 bayes.mutex            328 bayes_seen
   4 auto-whitelist.mutex     4 bayes_journal         2604 bayes_toks

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From jaearick at COLBY.EDU  Tue Nov  2 21:27:02 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:28 2006
Subject: 4.35.9: phishers of phools pheature questions
Message-ID: <mailman.4251.1137101248.24926.mailscanner@lists.mailscanner.info>

Dear Julian Phield,

I've turned on the phishing phraud pheature in 4.3.59, and I've noticed
a couple of strange things in some emails.  One had empty quotes in
the warning:

I invite you to visit the Citizen Advocate=s for=20
Private Philanthropy website&nbsp;<A href=3D""><font color=3D"red"><b>MailS=
canner has detected a possible fraud attempt from "" claiming to be</b></fo=
nt> http://www.capp.info</A>

and another had a quoted URL that agreed with the real URL:

   Do you Yahoo!?<BR>Check out the new Yahoo! Front Page. <A=20
   href=3D"http://www.yahoo.com"><font color=3D"red"><b>MailScanner has dete=
cted a possible fraud attempt from "www.yahoo.com" claiming to be</b></font=
> www.yahoo.com&lt;/a</A></BLOCKQUOTE><FONT SIZE=3D3><BR>

Whats going on here?  Does DNS play a role in this, whereby a dig for
www.yahoo.com produces:

www.yahoo.com.          298     IN      CNAME   www.yahoo.akadns.net.
www.yahoo.akadns.net.   6       IN      A       68.142.226.32
(etc)

ie, yahoo.com does not match akadns.net, so the phishing pheature barks?
Some advice please, before the phone starts ringing...

Jephph (Jeff) Earickson
Colby College

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From dhawal at NETMAGICSOLUTIONS.COM  Tue Nov  2 21:30:53 2004
From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy)
Date: Thu Jan 12 21:27:28 2006
Subject: Bug in ClamAV 0.80
Message-ID: <mailman.4252.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "utf-8" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian Field writes:

> Can someone confirm this for me please?
> I have a copy of the F-Prot distribution, which includes a copy of EICAR
> inside their docs so that you have a test file.
> ClamAV finds this file when it is checking individual elements of the
> tgz file, but then reports the tgz file itself as being clean.
>
> I get this output from
> /usr/lib/MailScanner/clamav-wrapper /usr/local -r --disable-summary
> --stdout .
> ---SNIP---
> /tmp/clamav.17357/clamav-ed6a79aa30cd343a/f-prot/doc_ws/screenshot.jpg: OK
> /tmp/clamav.17357/clamav-ed6a79aa30cd343a/f-prot/doc_ws/sys_req.html: OK
> /tmp/clamav.17357/clamav-ed6a79aa30cd343a/f-prot/doc_ws/test_eicar.html:
> Eicar-Test-Signature FOUND
> /tmp/clamav.17357/clamav-ed6a79aa30cd343a/f-prot/doc_ws/test_inst.html: OK
> /tmp/clamav.17357/clamav-ed6a79aa30cd343a/f-prot/doc_ws/tip.jpg: OK
> ---SNIP---
> (raw) /tmp/clamav.17357/clamav-fcf5882c8ea0c1ad/fp-linux-ws-4.0.0.tgz: OK
> ---SNIP---
>
> As you can see, it reports the EICAR but then says the tgz is clean. I
> can find no way of reliably pulling out all this /tmp stuff so that I
> can deduce the real name of the archive.
>
> Why did the ClamAV guys break their nice tidy output format?
>
> For now, do *not* use the "clamav" scanner. The "clamavmodule" scanner
> should still work okay.
>
> --
> Julian Field

I seem to be getting the same result.. am using 0.80-1 from dag-weers

[root@mx2 root]# clamscan --tgz -r --disable-summary --stdout /tmp/eicar
a/
a/b/
a/b/eicar.com
c/
c/d/
c/d/eicarcom2.zip
e/
e/f/
e/f/eicar_com.zip
g/
g/h/
g/h/eicar.com.txt
/tmp/clamav-e70f103d15271d45/a/b/eicar.com: Eicar-Test-Signature FOUND
/tmp/clamav-e70f103d15271d45/c/d/eicarcom2.zip: Eicar-Test-Signature FOUND
/tmp/clamav-e70f103d15271d45/e/f/eicar_com.zip: Eicar-Test-Signature FOUND
/tmp/clamav-e70f103d15271d45/g/h/eicar.com.txt: Eicar-Test-Signature FOUND
(raw) /tmp/eicar/eicar.tgz: OK
 ---snip---

 - dhawal

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Tue Nov  2 21:39:47 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:28 2006
Subject: 4.35.9: phishers of phools pheature questions
Message-ID: <mailman.4253.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Jeff A. Earickson wrote:

> Dear Julian Phield,
>
> I've turned on the phishing phraud pheature in 4.3.59, and I've noticed
> a couple of strange things in some emails.  One had empty quotes in
> the warning:
>
> I invite you to visit the Citizen Advocate=s for=20
> Private Philanthropy website&nbsp;<A href=3D""><font
> color=3D"red"><b>MailS=
> canner has detected a possible fraud attempt from "" claiming to
> be</b></fo=
> nt> http://www.capp.info</A>

Known bug. It's a tiny fix, but I didn't want to change the code just
before I released it.

>
> and another had a quoted URL that agreed with the real URL:
>
>   Do you Yahoo!?<BR>Check out the new Yahoo! Front Page. <A=20
>   href=3D"http://www.yahoo.com"><font color=3D"red"><b>MailScanner has
> dete=
> cted a possible fraud attempt from "www.yahoo.com" claiming to
> be</b></font=
>
>> www.yahoo.com&lt;/a</A></BLOCKQUOTE><FONT SIZE=3D3><BR>
>
It's comparing www.yahoo.com with www.yahoo.com&lt;
which are of course different.

>
> Whats going on here?  Does DNS play a role in this,

No.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From phil at ICSERV.NET  Wed Nov  3 05:59:11 2004
From: phil at ICSERV.NET (Philip Waters)
Date: Thu Jan 12 21:27:28 2006
Subject: Same FROM and TO
Message-ID: <mailman.4254.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I send email to myself all of the time because a lot of mail clients don't
have a convenient way for me to file away notes in a box where i can find
them later. I send them to myself so I can filter it with my mail rules
> How could I block SPAM where the FROM is equal the TO, and the people
> receiving the
> message are at BCC. I receive a lot of that. Is like the from was my
> company, but it
> isn't, and another people in the company are receiving it...



-----------------------------------------
This email was sent using EZOnlineMail.
http://www.ezonlinemail.com/

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at MANGO.ZW  Wed Nov  3 06:05:24 2004
From: mailscanner at MANGO.ZW (Jim Holland)
Date: Thu Jan 12 21:27:28 2006
Subject: Messages with blocked filenames/filetypes not being delivered
Message-ID: <mailman.4255.1137101248.24926.mailscanner@lists.mailscanner.info>

Hi

On Tue, 2 Nov 2004, Jim Holland wrote:

> However I am puzzled by the fact that a harmless .tmp file is now silently
> quarantined instead of the message being delivered without the attachment
> but with a warning.  Any suggestions as to where to look?

Now I can see what is happening:

MailScanner[32587]: Viruses marked as silent: MailScanner: Dangerous
attachment according to Microsoft Q883260 (x.tmp),

(I hadn't picked this up before as I had just grepped the log for the
message id - could I suggest this always be included in lines that are
logged?)

I don't remember seeing banned filenames and filetypes being classified as
silent in the previous version of MailScanner.  This will obviously lead
to problems with legitimate attachments being blocked.  Is there any way
to control this?  Could this be because with the latest version of
MailScanner I have reverted from:

Silent Viruses = HTML-IFrame HTML-Codebase HTML-Form All-Viruses Exploit.HTML.Bagle

to the default:

Silent Viruses = All-Viruses

Regards

Jim Holland
System Administrator
MANGO - Zimbabwe's non-profit e-mail service

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From john at TRADOC.FR  Wed Nov  3 08:05:11 2004
From: john at TRADOC.FR (John Wilcock)
Date: Thu Jan 12 21:27:28 2006
Subject: 4.35.9: phishing fraud syslogs
Message-ID: <mailman.4256.1137101248.24926.mailscanner@lists.mailscanner.info>

On Tue, 2 Nov 2004 11:00:22 -0500, Julian Field wrote:
> Unfortunately when I am processing this, I don't have access to any of
> the message properties :-(

How about including both the URLs (claimed and actual) in the syslog
message then, so that we can decide more easily whether it is worth
going to the trouble of searching for the message...

John.

-- 
-- Over 2500 webcams from ski resorts around the world - www.snoweye.com
-- Translate your technical documents and web pages    - www.tradoc.fr

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From roger at RUDNICK.COM.BR  Wed Nov  3 07:32:47 2004
From: roger at RUDNICK.COM.BR (Roger Jochem)
Date: Thu Jan 12 21:27:28 2006
Subject: request: minimum attachment size?
Message-ID: <mailman.4257.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

This would be a great feature! I certainly would use it!!

Roger Jochem

----- Original Message -----
From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, November 02, 2004 2:20 PM
Subject: Re: request: minimum attachment size?


> In my view, 1.
>
> Michele Neylon :: Blacknight Solutions wrote:
>
> >>Sounds like a good idea, and it's pretty simple to add. By
> >>default it will be switched off.
> >>
> >>
> >
> >What would a "sane" minimum be?
> >
> >
> >
> >
>
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From roger at RUDNICK.COM.BR  Wed Nov  3 07:33:47 2004
From: roger at RUDNICK.COM.BR (Roger Jochem)
Date: Thu Jan 12 21:27:28 2006
Subject: Same FROM and TO
Message-ID: <mailman.4258.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Thanks!

That would do the trick!

----- Original Message -----
From: "Matt Kettler" <mkettler@EVI-INC.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, November 02, 2004 7:06 PM
Subject: Re: Same FROM and TO


> At 03:52 PM 11/2/2004, Michele Neylon : Blacknight Solutions wrote:
> > > ---------------------
> > > From: abc@xyz.com.br
> > > To: abc@xyz.com.br
> > > {bcc: me}
> > >
> > > Buy this stuff...
> > > ---------------------
> > >
> > > I hope I was clear explaining myself. Any ideas of how I could stop
> > this stuff?
> > >
> >You might want to look at SPF
>
> SPF is a good start, although that only happens to be true if you run
> xyz.com.br.
>
> Another option is one of the spamassassin rules: FROM_AND_TO_SAME. Just
> jack it up with a score statement.
>
> However, be aware that it's incredibly common for nonpsam messages to hit
> this rule.. Especially logwatch and other cronjob type system reports
which
> tend to be from and to root@example.com.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From martinh at SOLID-STATE-LOGIC.COM  Wed Nov  3 08:45:08 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:28 2006
Subject: bayes stopped working
Message-ID: <mailman.4259.1137101248.24926.mailscanner@lists.mailscanner.info>

Nick

had somehting similar a couple of weeks ago. The bayes side of SA seemed
to have got corrupted somehow. Everything reported OK, but doing
anything on the bayes (sa-learn etc) just timed out.

I restored from the previous days backup and everything was fine after
that....

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Nick Meverden wrote:
> MailScanner stopped using bayes today with no errors, the database is no
> longer auto-learning (ntokens do not increase) and the BAYES_ score rules
> are no longer being used.  Has anyone seen this before?  Using
> spamassassin -D --lint returns no bayes errors and if I run mail through
> it it'll use bayes.  MailScanner.conf and spam.assassin.prefs.conf both
> are pointing to the correct db path.  And bayes is enabled in
> spam.assassin.prefs.conf.  Journal sync is setup in MailScanner.conf for
> daily.  And I setup auto_expire to 0 in spam.assassin.prefs.conf and run a
> cron job that shuts down MailScanner and manually expires the db and
> removes any bayes_expire* files if they exist.  The bayes db was not
> upgrade from 2.6X it was created using SA 3.0.0.  I would like to be able
> to save the database with out clearing it out.
>
>  thanks,
>
>      - Nick
>
> Here is the version info, output from sa-learn --dump magic, and a lock
> file that always exist in /tmp, and the contents of my bayes db.
>
> Spamassassin 3.0.0
> MailScanner Version Number = 4.34.8
> Perl 5.8.5
> Linux 2.4.26
>
> 0.000          0          3          0  non-token data: bayes db version
> 0.000          0       2141          0  non-token data: nspam
> 0.000          0       1389          0  non-token data: nham
> 0.000          0     116161          0  non-token data: ntokens
> 0.000          0 1098405034          0  non-token data: oldest atime
> 0.000          0 1099095787          0  non-token data: newest atime
> 0.000          0          0          0  non-token data: last journal sync
> atime
> 0.000          0 1099355126          0  non-token data: last expiry atime
> 0.000          0     691200          0  non-token data: last expire atime
> delta
> 0.000          0      20945          0  non-token data: last expire
> reduction count
>
> /tmp/MS.bayes.rebuild.lock
> SpamAssassin Bayes database locked for use by MailScanner 2022
>
> /var/spool/MailScanner/spamassassin
>
> 2592 auto-whitelist           4 bayes.mutex            328 bayes_seen
>    4 auto-whitelist.mutex     4 bayes_journal         2604 bayes_toks
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ckowarzik at EMAIL.DE  Wed Nov  3 10:57:03 2004
From: ckowarzik at EMAIL.DE (Christian Kowarzik)
Date: Thu Jan 12 21:27:28 2006
Subject: {Scanned} bitdefender updates
Message-ID: <mailman.4260.1137101248.24926.mailscanner@lists.mailscanner.info>

I have the same problem.
I called the script /usr/lib/MailScanner/bitdefender-autoupdate manually and it dies with the error:
Can't call method "getlines" on an undefined value at /usr/lib/MailScanner/bitdefender-autoupdate
line 352.

I think, this is because the 'sub countViruses($file)' is missing the file '$file' and then dies
rather than logging the error and then continuing.

Here is the code:

---
sub countViruses
{
         # apro il file e conto il numero dei virus protetti
         $fh = new IO::File  "< $_[0]" || &updateLog( "no input file found!");
         @lines = $fh->getlines; # here is line 352
         $fh->close;
         my $lines = @lines - $ignoreLines;
         &updateLog ("*** You're now protected against $lines viruses ...");
}
---

I found out, that the commands which should create the $file before are out-commented:
#JKF system  "$bitDCmd > $origFile ";
#JKF system  "$bitDCmd > $destFile ";

I removed the '#JKF ' and everything is working fine...

My configuration:
RedHat Enterprise Linux ES 3
perl-5.8.0-88.7
MailScanner-4.35.9-1

My apologies to the list, if i did stupid things - i am a perl beginner...

Chris



Koen Teugels wrote:
> I don't think that the wapper scripts update bitdefender.
> Because the date of the virusdatabase doesn't change. Ans when I do a
> manual update I can see some changes. Any idee?
> thanks Koen
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From nmeverde at NP.K12.MN.US  Wed Nov  3 13:54:31 2004
From: nmeverde at NP.K12.MN.US (Nick Meverden)
Date: Thu Jan 12 21:27:28 2006
Subject: bayes stopped working (now working)
Message-ID: <mailman.4261.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> Nick
>
> had somehting similar a couple of weeks ago. The bayes side of SA seemed
> to have got corrupted somehow. Everything reported OK, but doing
> anything on the bayes (sa-learn etc) just timed out.
>
> I restored from the previous days backup and everything was fine after
> that....

I noticed I was no longer getting autolearn=not spam in the email headers
so I removed auto-whitelist and auto-whitelist.mutex and restarted
MailScanner and bayes started working again.  Was this a corrupt
auto-whitelist db?


>
> Nick Meverden wrote:
>> MailScanner stopped using bayes today with no errors, the database is no
>> longer auto-learning (ntokens do not increase) and the BAYES_ score
>> rules
>> are no longer being used.  Has anyone seen this before?  Using
>> spamassassin -D --lint returns no bayes errors and if I run mail through
>> it it'll use bayes.  MailScanner.conf and spam.assassin.prefs.conf both
>> are pointing to the correct db path.  And bayes is enabled in
>> spam.assassin.prefs.conf.  Journal sync is setup in MailScanner.conf for
>> daily.  And I setup auto_expire to 0 in spam.assassin.prefs.conf and run
>> a
>> cron job that shuts down MailScanner and manually expires the db and
>> removes any bayes_expire* files if they exist.  The bayes db was not
>> upgrade from 2.6X it was created using SA 3.0.0.  I would like to be
>> able
>> to save the database with out clearing it out.
>>
>>  thanks,
>>
>>      - Nick
>>
>> Here is the version info, output from sa-learn --dump magic, and a lock
>> file that always exist in /tmp, and the contents of my bayes db.
>>
>> Spamassassin 3.0.0
>> MailScanner Version Number = 4.34.8
>> Perl 5.8.5
>> Linux 2.4.26
>>
>> 0.000          0          3          0  non-token data: bayes db version
>> 0.000          0       2141          0  non-token data: nspam
>> 0.000          0       1389          0  non-token data: nham
>> 0.000          0     116161          0  non-token data: ntokens
>> 0.000          0 1098405034          0  non-token data: oldest atime
>> 0.000          0 1099095787          0  non-token data: newest atime
>> 0.000          0          0          0  non-token data: last journal
>> sync
>> atime
>> 0.000          0 1099355126          0  non-token data: last expiry
>> atime
>> 0.000          0     691200          0  non-token data: last expire
>> atime
>> delta
>> 0.000          0      20945          0  non-token data: last expire
>> reduction count
>>
>> /tmp/MS.bayes.rebuild.lock
>> SpamAssassin Bayes database locked for use by MailScanner 2022
>>
>> /var/spool/MailScanner/spamassassin
>>
>> 2592 auto-whitelist           4 bayes.mutex            328 bayes_seen
>>    4 auto-whitelist.mutex     4 bayes_journal         2604 bayes_toks
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From nmeverde at NP.K12.MN.US  Wed Nov  3 13:33:21 2004
From: nmeverde at NP.K12.MN.US (Nick Meverden)
Date: Thu Jan 12 21:27:28 2006
Subject: bayes stopped working
Message-ID: <mailman.4262.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> had somehting similar a couple of weeks ago. The bayes side of SA seemed
> to have got corrupted somehow. Everything reported OK, but doing
> anything on the bayes (sa-learn etc) just timed out.
>
> I restored from the previous days backup and everything was fine after
> that....
>

I was thinking it was possible bayes database corruption at first too, but
I can still run any of the SA tools on the database.  I can still manaully
"learn" the database with no errors.  spamassassin -D --lint reports
everything is fine.  And if I use something like spamassassin -D --lint
--mbox to processes some mail spamassassin will use the bayes db and
score.  The only other time I've seen something like this is if you
upgrade from SA2.6X to SA3.0.0 and run a --sync on the bayes db,
MailScanner will stop using bayes.  There is an option in MailScanner.conf
to use debugging for spmassassin, I assume that this will report the
messages to stderr.  Do you also need to run MailScanner in debug mode
inorder to see the errors?  "tail /dev/stderr" didnt work.  Has anyone
tried to run MailScanner in debug before?  I'll upgrade to SA 3.0.1 today
to see if it'll clear up any problems...

 - Nick
>
> Nick Meverden wrote:
>> MailScanner stopped using bayes today with no errors, the database is no
>> longer auto-learning (ntokens do not increase) and the BAYES_ score
>> rules
>> are no longer being used.  Has anyone seen this before?  Using
>> spamassassin -D --lint returns no bayes errors and if I run mail through
>> it it'll use bayes.  MailScanner.conf and spam.assassin.prefs.conf both
>> are pointing to the correct db path.  And bayes is enabled in
>> spam.assassin.prefs.conf.  Journal sync is setup in MailScanner.conf for
>> daily.  And I setup auto_expire to 0 in spam.assassin.prefs.conf and run
>> a
>> cron job that shuts down MailScanner and manually expires the db and
>> removes any bayes_expire* files if they exist.  The bayes db was not
>> upgrade from 2.6X it was created using SA 3.0.0.  I would like to be
>> able
>> to save the database with out clearing it out.
>>
>>  thanks,
>>
>>      - Nick
>>
>> Here is the version info, output from sa-learn --dump magic, and a lock
>> file that always exist in /tmp, and the contents of my bayes db.
>>
>> Spamassassin 3.0.0
>> MailScanner Version Number = 4.34.8
>> Perl 5.8.5
>> Linux 2.4.26
>>
>> 0.000          0          3          0  non-token data: bayes db version
>> 0.000          0       2141          0  non-token data: nspam
>> 0.000          0       1389          0  non-token data: nham
>> 0.000          0     116161          0  non-token data: ntokens
>> 0.000          0 1098405034          0  non-token data: oldest atime
>> 0.000          0 1099095787          0  non-token data: newest atime
>> 0.000          0          0          0  non-token data: last journal
>> sync
>> atime
>> 0.000          0 1099355126          0  non-token data: last expiry
>> atime
>> 0.000          0     691200          0  non-token data: last expire
>> atime
>> delta
>> 0.000          0      20945          0  non-token data: last expire
>> reduction count
>>
>> /tmp/MS.bayes.rebuild.lock
>> SpamAssassin Bayes database locked for use by MailScanner 2022
>>
>> /var/spool/MailScanner/spamassassin
>>
>> 2592 auto-whitelist           4 bayes.mutex            328 bayes_seen
>>    4 auto-whitelist.mutex     4 bayes_journal         2604 bayes_toks
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From martinh at SOLID-STATE-LOGIC.COM  Wed Nov  3 14:00:53 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:28 2006
Subject: bayes stopped working (now working)
Message-ID: <mailman.4263.1137101248.24926.mailscanner@lists.mailscanner.info>

Nick

there some syntax differences in the way SA handles AWL's in 3.x. From
memory someone posted about this last week and the 'fix' was to turn off
the option in local.cf rather than MailScanner.conf. I wonder is that
was causing you problems as well???

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Nick Meverden wrote:
>>Nick
>>
>>had somehting similar a couple of weeks ago. The bayes side of SA seemed
>>to have got corrupted somehow. Everything reported OK, but doing
>>anything on the bayes (sa-learn etc) just timed out.
>>
>>I restored from the previous days backup and everything was fine after
>>that....
>
>
> I noticed I was no longer getting autolearn=not spam in the email headers
> so I removed auto-whitelist and auto-whitelist.mutex and restarted
> MailScanner and bayes started working again.  Was this a corrupt
> auto-whitelist db?
>
>
>
>>Nick Meverden wrote:
>>
>>>MailScanner stopped using bayes today with no errors, the database is no
>>>longer auto-learning (ntokens do not increase) and the BAYES_ score
>>>rules
>>>are no longer being used.  Has anyone seen this before?  Using
>>>spamassassin -D --lint returns no bayes errors and if I run mail through
>>>it it'll use bayes.  MailScanner.conf and spam.assassin.prefs.conf both
>>>are pointing to the correct db path.  And bayes is enabled in
>>>spam.assassin.prefs.conf.  Journal sync is setup in MailScanner.conf for
>>>daily.  And I setup auto_expire to 0 in spam.assassin.prefs.conf and run
>>>a
>>>cron job that shuts down MailScanner and manually expires the db and
>>>removes any bayes_expire* files if they exist.  The bayes db was not
>>>upgrade from 2.6X it was created using SA 3.0.0.  I would like to be
>>>able
>>>to save the database with out clearing it out.
>>>
>>> thanks,
>>>
>>>     - Nick
>>>
>>>Here is the version info, output from sa-learn --dump magic, and a lock
>>>file that always exist in /tmp, and the contents of my bayes db.
>>>
>>>Spamassassin 3.0.0
>>>MailScanner Version Number = 4.34.8
>>>Perl 5.8.5
>>>Linux 2.4.26
>>>
>>>0.000          0          3          0  non-token data: bayes db version
>>>0.000          0       2141          0  non-token data: nspam
>>>0.000          0       1389          0  non-token data: nham
>>>0.000          0     116161          0  non-token data: ntokens
>>>0.000          0 1098405034          0  non-token data: oldest atime
>>>0.000          0 1099095787          0  non-token data: newest atime
>>>0.000          0          0          0  non-token data: last journal
>>>sync
>>>atime
>>>0.000          0 1099355126          0  non-token data: last expiry
>>>atime
>>>0.000          0     691200          0  non-token data: last expire
>>>atime
>>>delta
>>>0.000          0      20945          0  non-token data: last expire
>>>reduction count
>>>
>>>/tmp/MS.bayes.rebuild.lock
>>>SpamAssassin Bayes database locked for use by MailScanner 2022
>>>
>>>/var/spool/MailScanner/spamassassin
>>>
>>>2592 auto-whitelist           4 bayes.mutex            328 bayes_seen
>>>   4 auto-whitelist.mutex     4 bayes_journal         2604 bayes_toks
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>**********************************************************************
>>
>>This email and any files transmitted with it are confidential and
>>intended solely for the use of the individual or entity to whom they
>>are addressed. If you have received this email in error please notify
>>the system manager.
>>
>>This footnote confirms that this email message has been swept
>>for the presence of computer viruses and is believed to be clean.
>>
>>**********************************************************************
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From nmeverde at NP.K12.MN.US  Wed Nov  3 14:36:08 2004
From: nmeverde at NP.K12.MN.US (Nick Meverden)
Date: Thu Jan 12 21:27:28 2006
Subject: bayes stopped working (now working)
Message-ID: <mailman.4264.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> Nick
>
> there some syntax differences in the way SA handles AWL's in 3.x. From
> memory someone posted about this last week and the 'fix' was to turn off
> the option in local.cf rather than MailScanner.conf. I wonder is that
> was causing you problems as well???
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>

found the thread, I'll disable awl from spam.assassin.prefs.conf should
prevent this from happening again.





>
> Nick Meverden wrote:
>>>Nick
>>>
>>>had somehting similar a couple of weeks ago. The bayes side of SA seemed
>>>to have got corrupted somehow. Everything reported OK, but doing
>>>anything on the bayes (sa-learn etc) just timed out.
>>>
>>>I restored from the previous days backup and everything was fine after
>>>that....
>>
>>
>> I noticed I was no longer getting autolearn=not spam in the email
>> headers
>> so I removed auto-whitelist and auto-whitelist.mutex and restarted
>> MailScanner and bayes started working again.  Was this a corrupt
>> auto-whitelist db?
>>
>>
>>
>>>Nick Meverden wrote:
>>>
>>>>MailScanner stopped using bayes today with no errors, the database is
>>>> no
>>>>longer auto-learning (ntokens do not increase) and the BAYES_ score
>>>>rules
>>>>are no longer being used.  Has anyone seen this before?  Using
>>>>spamassassin -D --lint returns no bayes errors and if I run mail
>>>> through
>>>>it it'll use bayes.  MailScanner.conf and spam.assassin.prefs.conf both
>>>>are pointing to the correct db path.  And bayes is enabled in
>>>>spam.assassin.prefs.conf.  Journal sync is setup in MailScanner.conf
>>>> for
>>>>daily.  And I setup auto_expire to 0 in spam.assassin.prefs.conf and
>>>> run
>>>>a
>>>>cron job that shuts down MailScanner and manually expires the db and
>>>>removes any bayes_expire* files if they exist.  The bayes db was not
>>>>upgrade from 2.6X it was created using SA 3.0.0.  I would like to be
>>>>able
>>>>to save the database with out clearing it out.
>>>>
>>>> thanks,
>>>>
>>>>     - Nick
>>>>
>>>>Here is the version info, output from sa-learn --dump magic, and a lock
>>>>file that always exist in /tmp, and the contents of my bayes db.
>>>>
>>>>Spamassassin 3.0.0
>>>>MailScanner Version Number = 4.34.8
>>>>Perl 5.8.5
>>>>Linux 2.4.26
>>>>
>>>>0.000          0          3          0  non-token data: bayes db
>>>> version
>>>>0.000          0       2141          0  non-token data: nspam
>>>>0.000          0       1389          0  non-token data: nham
>>>>0.000          0     116161          0  non-token data: ntokens
>>>>0.000          0 1098405034          0  non-token data: oldest atime
>>>>0.000          0 1099095787          0  non-token data: newest atime
>>>>0.000          0          0          0  non-token data: last journal
>>>>sync
>>>>atime
>>>>0.000          0 1099355126          0  non-token data: last expiry
>>>>atime
>>>>0.000          0     691200          0  non-token data: last expire
>>>>atime
>>>>delta
>>>>0.000          0      20945          0  non-token data: last expire
>>>>reduction count
>>>>
>>>>/tmp/MS.bayes.rebuild.lock
>>>>SpamAssassin Bayes database locked for use by MailScanner 2022
>>>>
>>>>/var/spool/MailScanner/spamassassin
>>>>
>>>>2592 auto-whitelist           4 bayes.mutex            328 bayes_seen
>>>>   4 auto-whitelist.mutex     4 bayes_journal         2604 bayes_toks
>>>>
>>>>------------------------ MailScanner list ------------------------
>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>>'leave mailscanner' in the body of the email.
>>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>**********************************************************************
>>>
>>>This email and any files transmitted with it are confidential and
>>>intended solely for the use of the individual or entity to whom they
>>>are addressed. If you have received this email in error please notify
>>>the system manager.
>>>
>>>This footnote confirms that this email message has been swept
>>>for the presence of computer viruses and is believed to be clean.
>>>
>>>**********************************************************************
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mkettler at EVI-INC.COM  Wed Nov  3 15:44:12 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:28 2006
Subject: bayes stopped working (now working)
Message-ID: <mailman.4265.1137101248.24926.mailscanner@lists.mailscanner.info>

At 08:54 AM 11/3/2004, Nick Meverden wrote:
>I noticed I was no longer getting autolearn=not spam in the email headers
>so I removed auto-whitelist and auto-whitelist.mutex and restarted
>MailScanner and bayes started working again.  Was this a corrupt
>auto-whitelist db?

Not likely.. It's more likely that MS killed SA while it had the AWL db
locked, and this resulted in a lingering lockfile....

Check your mail logs for mailscanner messages indicating that "SpamAssassin
timed out and was killed".

And of course, there's also some validity in the approach of disabling the
AWL, but I'd still keep a close eye out for timeouts, they aren't a good
thing. (Disabling bayes_auto_expire helps here, but be sure to use MS's
rebuild feature so expiry can run.)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From leolists at SEIDKR.COM  Wed Nov  3 15:59:31 2004
From: leolists at SEIDKR.COM (Philip Leonard)
Date: Thu Jan 12 21:27:28 2006
Subject: Upgrade question
Message-ID: <mailman.4266.1137101248.24926.mailscanner@lists.mailscanner.info>

I am currently running MailScanner 4.29.7 with spamassassin 2.64 on a non-RPM box (sparc64 actually, running Gentoo Linux) and would like to upgrade to the latest version of MS.  This is probably a wide open question, but is there anything in particular I need to look out for?

Thanks, Philip

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From alden at ENGINENO9INC.COM  Wed Nov  3 16:21:21 2004
From: alden at ENGINENO9INC.COM (Alden Levy)
Date: Thu Jan 12 21:27:28 2006
Subject: SURBL not working properly in  MailScanner 4.35.9
Message-ID: <mailman.4267.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Last week, I upgraded my server to FC1 (from RH 7.3).  Sendmail, Ensim, and
perl also got upgraded (to 8.12.x, 4.02, 5.8.1, respectively).

Before the upgrade, everything worked well with SA 3.0.0 and MaliScanner
4.34.  Now, SURBL doesn't work unless I do some really strange things.  I've
reinstalled SA, MS, and ClamAV, but no joy. I've since upgraded to SA 3.0.1,
MS 4.35.9 and Mail::ClamAV 0.13. I already had ClamAV 0.80 installed.

spamassassin -D --lint works fine, and when I test spamassassin with a SURBL
URL, it gives the expected output. I don't get hits with MailScanner running
unless I put the contents of pre.init AND 25_uribl.cf into my
spam.assassin.prefs.conf (which has a link from local.cf).

And my mail logs look fine, i.e., no errors, no MS restarts, etc. Just no
SURBL unless I put init.pre and 25_uribl.cf inside spam.assassin.prefs. Has
anyone seen anything like this?

Any help would be appreciated.

Thanks,
Alden

Alden Levy
Engine No. 9, Inc.
130 W. 57th Street, Suite 12E
New York, NY 10019
(212) 981-1122
(212) 725-7202 fax

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From nmeverde at NP.K12.MN.US  Wed Nov  3 16:13:59 2004
From: nmeverde at NP.K12.MN.US (Nick Meverden)
Date: Thu Jan 12 21:27:28 2006
Subject: bayes stopped working (now working)
Message-ID: <mailman.4268.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> At 08:54 AM 11/3/2004, Nick Meverden wrote:
>>I noticed I was no longer getting autolearn=not spam in the email headers
>>so I removed auto-whitelist and auto-whitelist.mutex and restarted
>>MailScanner and bayes started working again.  Was this a corrupt
>>auto-whitelist db?
>
> Not likely.. It's more likely that MS killed SA while it had the AWL db
> locked, and this resulted in a lingering lockfile....
>
> Check your mail logs for mailscanner messages indicating that
> "SpamAssassin
> timed out and was killed".

>
> And of course, there's also some validity in the approach of disabling the
> AWL, but I'd still keep a close eye out for timeouts, they aren't a good
> thing. (Disabling bayes_auto_expire helps here, but be sure to use MS's
> rebuild feature so expiry can run.)

I thought that MailScanners rebuild feature just syned the journal file,
and SA ran the auto expire.  I have already disabled the auto expire in
spam.assassin.conf and have a script that runs in cron nightly that
expires it for me.  With the rebuild in MailScanner.conf set to daily
(which should snyc the journal,correct me if Im wrong)  Is anyone else
using AWL with MailScanner or has everyone just disabled it?

  thanks,

     - Nick


>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From jpabuyer at TECNOERA.COM  Wed Nov  3 16:26:34 2004
From: jpabuyer at TECNOERA.COM (Juan Pablo Abuyeres)
Date: Thu Jan 12 21:27:28 2006
Subject: ruleset problem
Message-ID: <mailman.4269.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "utf-8" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I have an antivirus ruleset like this:

To: test@domain2.cl no
To: default yes
From: test@domain1.cl no
From: default yes


The problem is when test@domain1.cl sends an email to himself. It doesn't
get scanned. I think it should get scanned since line 2 of the ruleset
commands MailScanner to do so. If I remove line 3 (From: test@domain1.cl
no) then the email is scanned, but the idea is not to remove line 3, of
course. What's the problem? is there another way to do something linke
this?.

Thank you.

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Wed Nov  3 16:45:48 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:28 2006
Subject: 4.35.9: phishing fraud syslogs
Message-ID: <mailman.4270.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

John Wilcock wrote:

>On Tue, 2 Nov 2004 11:00:22 -0500, Julian Field wrote:
>
>
>>Unfortunately when I am processing this, I don't have access to any of
>>the message properties :-(
>>
>>
>
>How about including both the URLs (claimed and actual) in the syslog
>message then, so that we can decide more easily whether it is worth
>going to the trouble of searching for the message...
>
>

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mike at CAMAROSS.NET  Wed Nov  3 16:54:53 2004
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:27:28 2006
Subject: ruleset problem
Message-ID: <mailman.4271.1137101248.24926.mailscanner@lists.mailscanner.info>

How about:

To:     test@domain2.cl         no
From: test@domain1.cl   no
FromTo: default                 yes


________________________________

From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Juan Pablo Abuyeres
Sent: Wednesday, November 03, 2004 10:27 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: ruleset problem


I have an antivirus ruleset like this:

To: test@domain2.cl no
To: default yes
From: test@domain1.cl no
From: default yes




The problem is when test@domain1.cl sends an email to himself. It doesn't
get scanned. I think it should get scanned since line 2 of the ruleset
commands MailScanner to do so. If I remove line 3 (From: test@domain1.cl no)
then the email is scanned, but the idea is not to remove line 3, of course.
What's the problem? is there another way to do something linke this?.

Thank you.

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From jaearick at COLBY.EDU  Wed Nov  3 16:40:41 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:28 2006
Subject: SURBL not working properly in  MailScanner 4.35.9
Message-ID: <mailman.4272.1137101248.24926.mailscanner@lists.mailscanner.info>

Several of us beat on heads on this one a couple of weeks ago, check
the list archives.  The quick answer is to track down the init.pre
file that SA 3.0 installs in some weird place (like /etc/opt) and
get it moved to /etc/mail/spamassassin.

Jeff Earickson
Colby College

On Wed, 3 Nov 2004, Alden Levy wrote:

> Date: Wed, 3 Nov 2004 11:21:21 -0500
> From: Alden Levy <alden@ENGINENO9INC.COM>
> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: SURBL not working properly in  MailScanner 4.35.9
>
> Last week, I upgraded my server to FC1 (from RH 7.3).  Sendmail, Ensim, and
> perl also got upgraded (to 8.12.x, 4.02, 5.8.1, respectively).
>
> Before the upgrade, everything worked well with SA 3.0.0 and MaliScanner
> 4.34.  Now, SURBL doesn't work unless I do some really strange things.  I've
> reinstalled SA, MS, and ClamAV, but no joy. I've since upgraded to SA 3.0.1,
> MS 4.35.9 and Mail::ClamAV 0.13. I already had ClamAV 0.80 installed.
>
> spamassassin -D --lint works fine, and when I test spamassassin with a SURBL
> URL, it gives the expected output. I don't get hits with MailScanner running
> unless I put the contents of pre.init AND 25_uribl.cf into my
> spam.assassin.prefs.conf (which has a link from local.cf).
>
> And my mail logs look fine, i.e., no errors, no MS restarts, etc. Just no
> SURBL unless I put init.pre and 25_uribl.cf inside spam.assassin.prefs. Has
> anyone seen anything like this?
>
> Any help would be appreciated.
>
> Thanks,
> Alden
>
> Alden Levy
> Engine No. 9, Inc.
> 130 W. 57th Street, Suite 12E
> New York, NY 10019
> (212) 981-1122
> (212) 725-7202 fax
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Wed Nov  3 17:23:10 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:28 2006
Subject: 4.35.9: phishing fraud syslogs
Message-ID: <mailman.4273.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian Field wrote:

> John Wilcock wrote:
>
>> On Tue, 2 Nov 2004 11:00:22 -0500, Julian Field wrote:
>>
>>
>>> Unfortunately when I am processing this, I don't have access to any of
>>> the message properties :-(
>>>
>>>
>>
>> How about including both the URLs (claimed and actual) in the syslog
>> message then, so that we can decide more easily whether it is worth
>> going to the trouble of searching for the message...
>>
>>
>
Oops, sorry, deleted my comment by mistake.
Sounds like a very good idea, will be in the next release.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mwobaid at gmail.com  Wed Nov  3 17:06:16 2004
From: mwobaid at gmail.com (Marco Obaid)
Date: Thu Jan 12 21:27:28 2006
Subject: FW: RPM package conflict error
Message-ID: <mailman.4274.1137101248.24926.mailscanner@lists.mailscanner.info>

Hi,

I managed to fix the perl RPM package conflict error on RHEL. This is
caused after installing 4.35.9-1. Here is what I did:

1) rpm -e --nodeps perl
2) up2date -u
3) MailScanner -V (notice that MIME::QuotedPrint has been downgraded to 2.03)
4) Stop MailScanner  (not sure if necessary)
5) Follow these instructions to re-install perl-MIME-Base64:

    cd MailScanner-4.35.9-1
    rpm -Uvh perl-MIME-Base64-3.05-2.src.rpm
    pushd /usr/src/redhat/SPECS
    rpmbuild -bp perl-MIME-Base64.spec
    cd ../BUILD
    cd perl-MIME-Base64-3.05
    perl Makefile.PL
    make
    make test
    make install
    popd
6) MailScanner -V  (notice that MIME::QuotedPrint has been upgraded to 3.05)
7) service MailScanner start
8) up2date -u (should report that all packages are up-to-date)

Now monitor your logs for any decoe error. I have done this on two
busy production servers and for the past couple of hours I have not
seen any problems. Mail is flowing nicely!

Thanks to Steve and Julian for their tips!

Hope this helps someone
Marco

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Wed Nov  3 17:43:52 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:28 2006
Subject: MailScanner 4.35.10
Message-ID: <mailman.4275.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I have just put up 4.35.10. This is intended as an installation bug-fix
on 4.35.9.
We have upgraded to this version on several RedHat, CentOS and SuSE
systems, and have only seen the up2date problem once (and that problem
disappeared when we went through the same hoops again).

I have also added the other little changes people have requested, but
they are very minor.

You can get it from

RedHat/Mandrake/Other RPM:
http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.35.10-1.rpm.tar.gz

SuSE:
http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/suse/MailScanner-4.35.10-1.suse.tar.gz

Solaris/Other Unix:
http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/tar/MailScanner-install-4.35.10-1.tar.gz

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From jpabuyer at TECNOERA.COM  Wed Nov  3 17:49:16 2004
From: jpabuyer at TECNOERA.COM (Juan Pablo Abuyeres)
Date: Thu Jan 12 21:27:28 2006
Subject: ruleset problem
Message-ID: <mailman.4276.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "utf-8" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Then emails from test@domain1.cl to test2@domain2.cl will not be scanned
because of line2, and they should be scanned.
The policy is something like this:
1.- Scan incoming emails for everyone, except for those who don't want
their incoming mails scanned.
2.- Scan outgoing emails for everyone, except for those who don't want
their outgoing mails scanned (like test@domain1.cl) _unless_ the
destination is a user who does want his incoming email scanned (like
test2@domain2.cl), in which case it should be scanned anyway.


On Wed, 2004-11-03 at 10:54 -0600, Mike Kercher wrote:

 How about:

To:     test@domain2.cl         no
From: test@domain1.cl   no
FromTo: default                 yes


________________________________

From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Juan Pablo Abuyeres
Sent: Wednesday, November 03, 2004 10:27 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: ruleset problem


I have an antivirus ruleset like this:

To: test@domain2.cl no
To: default yes
From: test@domain1.cl no
From: default yes




The problem is when test@domain1.cl sends an email to himself. It doesn't
get scanned. I think it should get scanned since line 2 of the ruleset
commands MailScanner to do so. If I remove line 3 (From: test@domain1.cl no)
then the email is scanned, but the idea is not to remove line 3, of course.
What's the problem? is there another way to do something linke this?.

Thank you.

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From martinh at SOLID-STATE-LOGIC.COM  Wed Nov  3 16:28:22 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:28 2006
Subject: SURBL not working properly in  MailScanner 4.35.9
Message-ID: <mailman.4277.1137101248.24926.mailscanner@lists.mailscanner.info>

Alden

the surbl stuff is built-in to SA 3.0 (and turned on by default if you
have networks tests on and a valid DNS perl module). Have a check on the
SA or surbl.org web sites to check for correct syntax/module versions etc.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Alden Levy wrote:
> Last week, I upgraded my server to FC1 (from RH 7.3).  Sendmail, Ensim, and
> perl also got upgraded (to 8.12.x, 4.02, 5.8.1, respectively).
>
> Before the upgrade, everything worked well with SA 3.0.0 and MaliScanner
> 4.34.  Now, SURBL doesn't work unless I do some really strange things.  I've
> reinstalled SA, MS, and ClamAV, but no joy. I've since upgraded to SA 3.0.1,
> MS 4.35.9 and Mail::ClamAV 0.13. I already had ClamAV 0.80 installed.
>
> spamassassin -D --lint works fine, and when I test spamassassin with a SURBL
> URL, it gives the expected output. I don't get hits with MailScanner running
> unless I put the contents of pre.init AND 25_uribl.cf into my
> spam.assassin.prefs.conf (which has a link from local.cf).
>
> And my mail logs look fine, i.e., no errors, no MS restarts, etc. Just no
> SURBL unless I put init.pre and 25_uribl.cf inside spam.assassin.prefs. Has
> anyone seen anything like this?
>
> Any help would be appreciated.
>
> Thanks,
> Alden
>
> Alden Levy
> Engine No. 9, Inc.
> 130 W. 57th Street, Suite 12E
> New York, NY 10019
> (212) 981-1122
> (212) 725-7202 fax
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From roger at RUDNICK.COM.BR  Wed Nov  3 18:13:35 2004
From: roger at RUDNICK.COM.BR (Roger Jochem)
Date: Thu Jan 12 21:27:28 2006
Subject: MailScanner 4.35.10
Message-ID: <mailman.4278.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

What little changes are included? Would be intersting to upgrade from
4.35.9? Is the change about MIN attachment file size included?

----- Original Message -----
From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Wednesday, November 03, 2004 3:43 PM
Subject: MailScanner 4.35.10


> I have just put up 4.35.10. This is intended as an installation bug-fix
> on 4.35.9.
> We have upgraded to this version on several RedHat, CentOS and SuSE
> systems, and have only seen the up2date problem once (and that problem
> disappeared when we went through the same hoops again).
>
> I have also added the other little changes people have requested, but
> they are very minor.
>
> You can get it from
>
> RedHat/Mandrake/Other RPM:
>
http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.35.10-1.rpm.tar.gz
>
> SuSE:
>
http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/suse/MailScanner-4.35.10-1.suse.tar.gz
>
> Solaris/Other Unix:
>
http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/tar/MailScanner-install-4.35.10-1.tar.gz
>
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From admin at thenamegame.com  Wed Nov  3 18:19:01 2004
From: admin at thenamegame.com (Michael Freeman)
Date: Thu Jan 12 21:27:28 2006
Subject: MailScanner + Razor
Message-ID: <mailman.4279.1137101248.24926.mailscanner@lists.mailscanner.info>


Anyone using Razor with MS + SA?

 

I&#8217;m a little baffled with what Razor is supposed to be doing. I see
it connecting to a bunch of server then reports back that the msg is
spam. Ok, so big deal, spamassassin also reports the message as spam but
at least they assign scores. The only score I ever see in any msg header
from Razor is;

 

 RAZOR2_CF_RANGE_51_100 0.06, RAZOR2_CHECK 1.51

 

 and I don&#8217;t see any other checks. So when Razor determines that
the message is spam it adds a score of 0.06 + 1.51 for a total score of
1.57? What other checks should I be seeing? I&#8217;v never seen anything
else other than those two in the header. Am I missing something? I though
Razor would be adding scores in the header just like SA does.

 

Can somebody clarify?

 

Thanks

 

 

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Wed Nov  3 18:25:56 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:28 2006
Subject: MailScanner 4.35.10
Message-ID: <mailman.4280.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

The min attachment size is there, as is the phishing logging improvement
that John suggested. The phishing net code is a little bit cleverer too,
should give less false positives.

Roger Jochem wrote:

>What little changes are included? Would be intersting to upgrade from
>4.35.9? Is the change about MIN attachment file size included?
>
>----- Original Message -----
>From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
>To: <MAILSCANNER@JISCMAIL.AC.UK>
>Sent: Wednesday, November 03, 2004 3:43 PM
>Subject: MailScanner 4.35.10
>
>
>
>
>>I have just put up 4.35.10. This is intended as an installation bug-fix
>>on 4.35.9.
>>We have upgraded to this version on several RedHat, CentOS and SuSE
>>systems, and have only seen the up2date problem once (and that problem
>>disappeared when we went through the same hoops again).
>>
>>I have also added the other little changes people have requested, but
>>they are very minor.
>>
>>You can get it from
>>
>>RedHat/Mandrake/Other RPM:
>>
>>
>>
>http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.35.10-1.rpm.tar.gz
>
>
>>SuSE:
>>
>>
>>
>http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/suse/MailScanner-4.35.10-1.suse.tar.gz
>
>
>>Solaris/Other Unix:
>>
>>
>>
>http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/tar/MailScanner-install-4.35.10-1.tar.gz
>
>
>>--
>>

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at MANGO.ZW  Wed Nov  3 18:42:00 2004
From: mailscanner at MANGO.ZW (Jim Holland)
Date: Thu Jan 12 21:27:28 2006
Subject: Messages with blocked filenames/filetypes not being delivered
Message-ID: <mailman.4281.1137101248.24926.mailscanner@lists.mailscanner.info>

Hi

Further to:

> I don't remember seeing banned filenames and filetypes being classified as
> silent in the previous version of MailScanner.  This will obviously lead
> to problems with legitimate attachments being blocked.  Is there any way
> to control this?  Could this be because with the latest version of
> MailScanner I have reverted from:
>
> Silent Viruses = HTML-IFrame HTML-Codebase HTML-Form All-Viruses Exploit.HTML.Bagle
>
> to the default:
>
> Silent Viruses = All-Viruses

I now see that messages that have a file with a long filename are silently
quarantined as well.  The report states:

MailScanner: Very long filenames are good signs of attacks against
Microsoft e-mail packages (trpix.gif%3F%26rdm.dat)

The actual filename turned out to be:

trpix.gif?&rdm=81382383&dlv=631,17573,112457,79531,476931&kid=79531&chw=979531-&tcs=&bls3=111000A&bls4=010004111147&uid=1&dmn=.dyn.iinet.net.au&scx=800&scy=600&scc=32&jav=1&sta=,,,1,,,,,,,0,0,0,8672,8648,8647,66,0&iid=112457&bid=476931

However there was nothing wrong with the rest of the message, so it was
something that should have been delivered without the suspicious file.

Should this now be explicitly listed in the still_deliver_silent_viruses.rules
file?  This then starts to make the rules rather more complex, as the file
will have to list specific viruses first as not to be delivered, then list
the specific filename and filetype warnings that should be delivered, and
then the default not to deliver.  I am sure that the earlier versions of
MailScanner did not require this.

Regards

Jim Holland
System Administrator
MANGO - Zimbabwe's non-profit e-mail service

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From roger at RUDNICK.COM.BR  Wed Nov  3 18:26:20 2004
From: roger at RUDNICK.COM.BR (Roger Jochem)
Date: Thu Jan 12 21:27:28 2006
Subject: MailScanner 4.35.10
Message-ID: <mailman.4282.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Thanks!

I guess I will be doing the upgrade then...

----- Original Message -----
From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Wednesday, November 03, 2004 4:25 PM
Subject: Re: MailScanner 4.35.10


> The min attachment size is there, as is the phishing logging improvement
> that John suggested. The phishing net code is a little bit cleverer too,
> should give less false positives.
>
> Roger Jochem wrote:
>
> >What little changes are included? Would be intersting to upgrade from
> >4.35.9? Is the change about MIN attachment file size included?
> >
> >----- Original Message -----
> >From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
> >To: <MAILSCANNER@JISCMAIL.AC.UK>
> >Sent: Wednesday, November 03, 2004 3:43 PM
> >Subject: MailScanner 4.35.10
> >
> >
> >
> >
> >>I have just put up 4.35.10. This is intended as an installation bug-fix
> >>on 4.35.9.
> >>We have upgraded to this version on several RedHat, CentOS and SuSE
> >>systems, and have only seen the up2date problem once (and that problem
> >>disappeared when we went through the same hoops again).
> >>
> >>I have also added the other little changes people have requested, but
> >>they are very minor.
> >>
> >>You can get it from
> >>
> >>RedHat/Mandrake/Other RPM:
> >>
> >>
> >>
>
>http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.35.10-
1.rpm.tar.gz
> >
> >
> >>SuSE:
> >>
> >>
> >>
>
>http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/suse/MailScanner-4.35.10
-1.suse.tar.gz
> >
> >
> >>Solaris/Other Unix:
> >>
> >>
> >>
>
>http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/tar/MailScanner-install-
4.35.10-1.tar.gz
> >
> >
> >>--
> >>
>
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mkettler at EVI-INC.COM  Wed Nov  3 18:48:41 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:28 2006
Subject: MailScanner + Razor
Message-ID: <mailman.4283.1137101248.24926.mailscanner@lists.mailscanner.info>

At 01:19 PM 11/3/2004, Michael Freeman wrote:
>Anyone using Razor with MS + SA?
>
>I'm a little baffled with what Razor is supposed to be doing. I see it
>connecting to a bunch of server then reports back that the msg is spam.
>Ok, so big deal, spamassassin also reports the message as spam but at
>least they assign scores. The only score I ever see in any msg header from
>Razor is;
>
>  RAZOR2_CF_RANGE_51_100 0.06, RAZOR2_CHECK 1.51
>
>  and I don't see any other checks. So when Razor determines that the
> message is spam it adds a score of 0.06 + 1.51 for a total score of 1.57?

Well, when Razor determines a message is spam, SA trusts it far enough to
assign 1.57 points.. But the score is a spamassassin decision.

Razor is occasionally prone to false positives, which has limited it's
score. The last SA mass-check RAZOR2_CHECK had 97.6 to 98.2 percent
spam-hits, meaning 2.4% to 1.8% of RAZOR2_CHECK hits are nonspam. Not bad,
but it's not outstanding either.

Why would you expect it to be higher? Have you been using razor long enough
to see how often it hits email newsletters of the legitimate sort? It hits
most of my Juniper networks firewall security patch announcement emails,
which are available to registered product owners with paid support
contracts only. It also hits some from my 401k provider, compiler toolchain
providers, etc.

(ie: 8/9/2004: "Juniper Networks NetScreen Advisory 59147" hit RAZOR2_CHECK
and RAZOR2_CF_RANGE_11_50.)

Sorry, but the reality seems to be that razor is being fed by a lot of ill
maintained spamtraps that are not monitored for legitimate mail, and the
revoke system isn't keeping up.

>What other checks should I be seeing?

None, although there are some possible lower ranges for the CF_RANGE rules.
(11_50, although it's pretty rare to see it hit with less than 0.3% of
email in the last mass-check hitting this rule at all)

>  I'v never seen anything else other than those two in the header. Am I
> missing something? I though Razor would be adding scores in the header
> just like SA does.

No. SA is using razor in this case, and razor is not a top-level tool
called directly by MailScanner.

SA calls razor, gathers razor's answers, and integrates the results.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ugob at CAMO-ROUTE.COM  Wed Nov  3 18:51:01 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:28 2006
Subject: MailScanner + Razor
Message-ID: <mailman.4284.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "windows-1252" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Michael Freeman wrote:
> Anyone using Razor with MS + SA?
> 
>  
> 
> I^Ňm a little baffled with what Razor is supposed to be doing. I see it 
> connecting to a bunch of server then reports back that the msg is spam. 
> Ok, so big deal, spamassassin also reports the message as spam but at 
> least they assign scores. The only score I ever see in any msg header 
> from Razor is;
> 
>  
> 
>  RAZOR2_CF_RANGE_51_100 0.06, RAZOR2_CHECK 1.51
> 
>  
> 
>  and I don^Ňt see any other checks. So when Razor determines that the 
> message is spam it adds a score of 0.06 + 1.51 for a total score of 
> 1.57? What other checks should I be seeing? I^Ňv never seen anything else 
> other than those two in the header. Am I missing something? I though 
> Razor would be adding scores in the header just like SA does.
> 
>  
> 
> Can somebody clarify?

Razor works with checksums, it is just a plugin to SA.  Similar to Pyzor 
and DCC.  To see all the scores razor can trigger, check the tests 
sections of spamassassin.org.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mkettler at EVI-INC.COM  Wed Nov  3 20:10:43 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:28 2006
Subject: bayes stopped working (now working)
Message-ID: <mailman.4285.1137101248.24926.mailscanner@lists.mailscanner.info>

At 11:13 AM 11/3/2004, Nick Meverden wrote:
>I thought that MailScanners rebuild feature just syned the journal file,
>and SA ran the auto expire.  I have already disabled the auto expire in
>spam.assassin.conf and have a script that runs in cron nightly that
>expires it for me.  With the rebuild in MailScanner.conf set to daily
>(which should snyc the journal,correct me if Im wrong)

Well, rebuild forces a journal sync, but if you look in the SA code, it
appears to check if expiry is needed, and if needed it runs that at the
same time.

So while it does not force expiry, it does provide a point when expiry can run.

I'd still do the force-expire cronjob, but I ran for several weeks without
it and my expires seemed to run OK, with my expiry atime changing every few
days when my bayes got large enough to warrant another expire.

>Is anyone else
>using AWL with MailScanner or has everyone just disabled it?

I'm an AWL non-fan.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From alden at ENGINENO9INC.COM  Wed Nov  3 20:23:45 2004
From: alden at ENGINENO9INC.COM (Alden Levy)
Date: Thu Jan 12 21:27:28 2006
Subject: SURBL not working properly in MailScanner 4.35.9
Message-ID: <mailman.4286.1137101248.24926.mailscanner@lists.mailscanner.info>

I've got the proper syntax, because it works when I load up my
/etc/MailScanner/spam.assassin.prefs.conf with the contents of init.pre and
25_uribl.cf, and the same files worked before my recent software upgrade.
My init.pre is already in /etc/mail/spamassassin as I was one of the
beneficiaries (if not one of the posters) or the thread Jeff referred to.

I've already tried the SURBL list; they suggested I try the SA list.  I
decided to try this list first, as SA seems to work without MS.

In any event, it's working now (with init.pre and 25_uribl.cf in my
spam.assassin.prefs.conf file), but I wonder if something more is broken.

Thanks,
Alden

On Wed, 3 Nov 2004 16:28:22 +0000, Martin Hepworth
<martinh@SOLID-STATE-LOGIC.COM> wrote:

>Alden
>
>the surbl stuff is built-in to SA 3.0 (and turned on by default if you
>have networks tests on and a valid DNS perl module). Have a check on the
>SA or surbl.org web sites to check for correct syntax/module versions etc.
>
>--
>Martin Hepworth
>Snr Systems Administrator
>Solid State Logic
>Tel: +44 (0)1865 842300
>
>Jeff Earickson wrote:
>Several of us beat on heads on this one a couple of weeks ago, check
>the list archives.  The quick answer is to track down the init.pre
>file that SA 3.0 installs in some weird place (like /etc/opt) and
>get it moved to /etc/mail/spamassassin.
>
>Jeff Earickson
>Colby College
>
>Alden Levy wrote:
>> Last week, I upgraded my server to FC1 (from RH 7.3).  Sendmail, Ensim, and
>> perl also got upgraded (to 8.12.x, 4.02, 5.8.1, respectively).
>>
>> Before the upgrade, everything worked well with SA 3.0.0 and MaliScanner
>> 4.34.  Now, SURBL doesn't work unless I do some really strange things.  I've
>> reinstalled SA, MS, and ClamAV, but no joy. I've since upgraded to SA 3.0.1,
>> MS 4.35.9 and Mail::ClamAV 0.13. I already had ClamAV 0.80 installed.
>>
>> spamassassin -D --lint works fine, and when I test spamassassin with a SURBL
>> URL, it gives the expected output. I don't get hits with MailScanner running
>> unless I put the contents of pre.init AND 25_uribl.cf into my
>> spam.assassin.prefs.conf (which has a link from local.cf).
>>
>> And my mail logs look fine, i.e., no errors, no MS restarts, etc. Just no
>> SURBL unless I put init.pre and 25_uribl.cf inside spam.assassin.prefs. Has
>> anyone seen anything like this?
>>
>> Any help would be appreciated.
>>
>> Thanks,
>> Alden
>>
>> Alden Levy
>> Engine No. 9, Inc.
>> 130 W. 57th Street, Suite 12E
>> New York, NY 10019
>> (212) 981-1122
>> (212) 725-7202 fax
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>**********************************************************************
>
>This email and any files transmitted with it are confidential and
>intended solely for the use of the individual or entity to whom they
>are addressed. If you have received this email in error please notify
>the system manager.
>
>This footnote confirms that this email message has been swept
>for the presence of computer viruses and is believed to be clean.
>
>**********************************************************************
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From jaearick at COLBY.EDU  Wed Nov  3 20:39:41 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:28 2006
Subject: 4.35.10: more $id syslog tweaks
Message-ID: <mailman.4287.1137101248.24926.mailscanner@lists.mailscanner.info>

Julian,

Upgraded to 4.35.10.  I hate to be a PITA, but how about the
email message ID in some of the attachment size checks?
Looking at CheckAttachmentSizes(), isn't $id the email message ID?
Could the syslogging be changed to:

    MailScanner::Log::InfoLog("Attachment size check: %s < %s (%s) in %s",
                              $attachsize, $minsize, $unsafename,$id);

and likewise for the > check?  Please, please, anytime you syslog
info have the email msg id there if you can (or appropriate).  This is
something I grep for a lot when chasing problems.  Thanks.

Jeff Earickson
Colby College

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From gregg at GBCOMPUTERS.COM  Wed Nov  3 13:41:39 2004
From: gregg at GBCOMPUTERS.COM (Gregg Berkholtz)
Date: Thu Jan 12 21:27:28 2006
Subject: 4.35.9: phishing fraud syslogs
Message-ID: <mailman.4288.1137101248.24926.mailscanner@lists.mailscanner.info>

Don't entries like "Filename Checks: Possible MS-Dos program
shortcut attack" also get flagged by logcheck too? How have you
addressed that issue, do you just remove the word "attack" from the
etc/filename.rules.conf entries?

Gregg

On Tue, Nov 02, 2004 at 09:23:08AM -0500, Jeff A. Earickson wrote:
> Julian,
>
> Also, please remove the word "attack" from this line when you
> tweak it, eg:
>
> Found phishing fraud in iA25FnB7002189 from http://(etc)
>
> My syslog summarizer (logcheck,
> http://www.smittyware.com/contrib/psionic.php/) generates lots
> of compliants when it sees the word "attack" in the syslog.
> Thanks.
>
> Jeff
>
> On Tue, 2 Nov 2004, Jeff A. Earickson wrote:
>
> >Date: Tue, 2 Nov 2004 07:15:34 -0500
> >From: Jeff A. Earickson <jaearick@colby.edu>
> >Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> >To: MAILSCANNER@JISCMAIL.AC.UK
> >Subject: 4.35.9: phishing fraud syslogs
> >
> >Julian,
> >
> >Please tweak the syslog message for phishing fraud to include
> >the message ID, something like:
> >
> >Found phishing fraud attack in iA25FnB7002189 from http://(etc)
> >
> >The message ID is always important when grepping the syslog.
> >Thanks.
> >
> >Jeff Earickson
> >Colby College
> >
> >------------------------ MailScanner list ------------------------
> >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> >'leave mailscanner' in the body of the email.
> >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

--
Confidentiality Notice (updated May 8, 2001):  This message is transmitted
across public networks outside the security and control of the sender who
therefore cannot be responsible in any way for delays, loss, damages or
claims resulting from destruction, alteration, theft, misappropriation,
misuse, or discovery of this message, even though it may be confidential
and exempt from disclosure under the law.  If you are neither an intended
reader of this message nor an agent responsible for delivering this message
to an intended reader, you are hereby notified that distribution of any
kind or copying of this communication is strictly prohibited.  If you have
received this message in error, please destroy it immediately.  If you wish
that in the future we did not send you information on public systems,
please notify us immediately.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From jaearick at COLBY.EDU  Wed Nov  3 21:24:08 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:28 2006
Subject: 4.35.9: phishing fraud syslogs
Message-ID: <mailman.4289.1137101248.24926.mailscanner@lists.mailscanner.info>

Yes, these complaints get flagged too.  I just went and edited
filename.rules.conf and globally changed "attack" to "hack" to
shut up logcheck.  I've been meaning to do this...  Thanks.

Jeff

On Wed, 3 Nov 2004, Gregg Berkholtz wrote:

> Date: Wed, 3 Nov 2004 05:41:39 -0800
> From: Gregg Berkholtz <gregg@GBCOMPUTERS.COM>
> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: 4.35.9: phishing fraud syslogs
>
> Don't entries like "Filename Checks: Possible MS-Dos program
> shortcut attack" also get flagged by logcheck too? How have you
> addressed that issue, do you just remove the word "attack" from the
> etc/filename.rules.conf entries?
>
> Gregg
>
> On Tue, Nov 02, 2004 at 09:23:08AM -0500, Jeff A. Earickson wrote:
>> Julian,
>>
>> Also, please remove the word "attack" from this line when you
>> tweak it, eg:
>>
>> Found phishing fraud in iA25FnB7002189 from http://(etc)
>>
>> My syslog summarizer (logcheck,
>> http://www.smittyware.com/contrib/psionic.php/) generates lots
>> of compliants when it sees the word "attack" in the syslog.
>> Thanks.
>>
>> Jeff
>>
>> On Tue, 2 Nov 2004, Jeff A. Earickson wrote:
>>
>>> Date: Tue, 2 Nov 2004 07:15:34 -0500
>>> From: Jeff A. Earickson <jaearick@colby.edu>
>>> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>> To: MAILSCANNER@JISCMAIL.AC.UK
>>> Subject: 4.35.9: phishing fraud syslogs
>>>
>>> Julian,
>>>
>>> Please tweak the syslog message for phishing fraud to include
>>> the message ID, something like:
>>>
>>> Found phishing fraud attack in iA25FnB7002189 from http://(etc)
>>>
>>> The message ID is always important when grepping the syslog.
>>> Thanks.
>>>
>>> Jeff Earickson
>>> Colby College
>>>
>>> ------------------------ MailScanner list ------------------------
>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>> 'leave mailscanner' in the body of the email.
>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>
> --
> Confidentiality Notice (updated May 8, 2001):  This message is transmitted
> across public networks outside the security and control of the sender who
> therefore cannot be responsible in any way for delays, loss, damages or
> claims resulting from destruction, alteration, theft, misappropriation,
> misuse, or discovery of this message, even though it may be confidential
> and exempt from disclosure under the law.  If you are neither an intended
> reader of this message nor an agent responsible for delivering this message
> to an intended reader, you are hereby notified that distribution of any
> kind or copying of this communication is strictly prohibited.  If you have
> received this message in error, please destroy it immediately.  If you wish
> that in the future we did not send you information on public systems,
> please notify us immediately.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Wed Nov  3 21:46:36 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:28 2006
Subject: 4.35.10: more $id syslog tweaks
Message-ID: <mailman.4290.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Jeff A. Earickson wrote:

> Julian,
>
> Upgraded to 4.35.10.  I hate to be a PITA, but how about the
> email message ID in some of the attachment size checks?
> Looking at CheckAttachmentSizes(), isn't $id the email message ID?
> Could the syslogging be changed to:
>
>    MailScanner::Log::InfoLog("Attachment size check: %s < %s (%s) in %s",
>                              $attachsize, $minsize, $unsafename,$id);
>
> and likewise for the > check?

Done.

>   Please, please, anytime you syslog
> info have the email msg id there if you can (or appropriate).  This is
> something I grep for a lot when chasing problems.  Thanks.

Noted.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mike at ZANKER.ORG  Wed Nov  3 22:05:06 2004
From: mike at ZANKER.ORG (Mike Zanker)
Date: Thu Jan 12 21:27:28 2006
Subject: FW: RPM package conflict error
Message-ID: <mailman.4291.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Marco Obaid wrote:

> I managed to fix the perl RPM package conflict error on RHEL. This is
> caused after installing 4.35.9-1. Here is what I did:

Yes - we fixed ours the same way. Note that the pushd/popd aren't
necessary though - you can just cd to /usr/src/redhat/SPECS. Also, the
directory under build is just MIME-Base64-3.05 without perl- at the front.

Mike.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From SJCJonker at SJC.NL  Wed Nov  3 22:15:43 2004
From: SJCJonker at SJC.NL (Stijn Jonker)
Date: Thu Jan 12 21:27:28 2006
Subject: MailScanner 4.35.10
Message-ID: <mailman.4292.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hello all,

Julian Field said the following on 03-Nov-04 18:43:
> I have just put up 4.35.10. This is intended as an installation bug-fix
> on 4.35.9.
> We have upgraded to this version on several RedHat, CentOS and SuSE
> systems, and have only seen the up2date problem once (and that problem
> disappeared when we went through the same hoops again).
>
> I have also added the other little changes people have requested, but
> they are very minor.

In the RPM version an src.rpm is included:
MailScanner-perl-MIME-Base64-3.05-3.i386.rpm

Is this required or option, i don't have any issues with up2date/yum
etc. Is this only to fix those issues or is this for decoding Base64
strings in general as the rpm -qip command suggests?

Thank in advance,
Stijn



--
Met Vriendelijke groet/Yours Sincerely
Stijn Jonker <SJCJonker@sjc.nl>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Wed Nov  3 22:23:54 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:28 2006
Subject: MailScanner 4.35.10
Message-ID: <mailman.4293.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Stijn Jonker wrote:

> Hello all,
>
> Julian Field said the following on 03-Nov-04 18:43:
>
>> I have just put up 4.35.10. This is intended as an installation bug-fix
>> on 4.35.9.
>> We have upgraded to this version on several RedHat, CentOS and SuSE
>> systems, and have only seen the up2date problem once (and that problem
>> disappeared when we went through the same hoops again).
>>
>> I have also added the other little changes people have requested, but
>> they are very minor.
>
>
> In the RPM version an src.rpm is included:
> MailScanner-perl-MIME-Base64-3.05-3.i386.rpm
>
> Is this required or option, i don't have any issues with up2date/yum
> etc. Is this only to fix those issues or is this for decoding Base64
> strings in general as the rpm -qip command suggests?

I would do the upgrade anyway, as otherwise you well might end up with
errors in your syslog about it not being able to decode attachments. The
messages will get a "could not be analysed" error and will be quarantined.

But if you install the MIME::Base64 module through CPAN, this isn't
essential. You need to either
a) have MIME::Base64 installed by CPAN
or
b) Do the 4.35.10 upgrade "properly" using my script.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mike at ZANKER.ORG  Wed Nov  3 22:28:50 2004
From: mike at ZANKER.ORG (Mike Zanker)
Date: Thu Jan 12 21:27:28 2006
Subject: MailScanner 4.35.10
Message-ID: <mailman.4294.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian Field wrote:

> I have just put up 4.35.10. This is intended as an installation bug-fix
> on 4.35.9.
> We have upgraded to this version on several RedHat, CentOS and SuSE
> systems, and have only seen the up2date problem once (and that problem
> disappeared when we went through the same hoops again).

Yes! This finally seems to have fixed it - no up2date problems and
MailScanner working fine!

Thanks,

Mike.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From marco at XSSNET.COM  Thu Nov  4 00:11:56 2004
From: marco at XSSNET.COM (Marco Benton)
Date: Thu Jan 12 21:27:28 2006
Subject: 4.35.10: more $id syslog tweaks
Message-ID: <mailman.4295.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian Field wrote:

> Jeff A. Earickson wrote:
>
>
>
>>   Please, please, anytime you syslog
>> info have the email msg id there if you can (or appropriate).  This is
>> something I grep for a lot when chasing problems.  Thanks.
>
>
> Noted.


i am begging for that feature as well.

--

Marco Benton - BOFH, BSMFH
Network Consultant

BOFH excuse #236: The cause of the problem is: Plate voltage too low on demodulator tube

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From gdoris at ROGERS.COM  Thu Nov  4 00:19:34 2004
From: gdoris at ROGERS.COM (Gerry Doris)
Date: Thu Jan 12 21:27:28 2006
Subject: MailScanner 4.35.10
Message-ID: <mailman.4296.1137101248.24926.mailscanner@lists.mailscanner.info>

On Wed, 3 Nov 2004, Julian Field wrote:

> I have just put up 4.35.10. This is intended as an installation bug-fix
> on 4.35.9.
> We have upgraded to this version on several RedHat, CentOS and SuSE
> systems, and have only seen the up2date problem once (and that problem
> disappeared when we went through the same hoops again).
>
> I have also added the other little changes people have requested, but
> they are very minor.
>
> You can get it from
>
> RedHat/Mandrake/Other RPM:
> http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.35.10-1.rpm.tar.gz
>
> SuSE:
> http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/suse/MailScanner-4.35.10-1.suse.tar.gz
>
> Solaris/Other Unix:
> http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/tar/MailScanner-install-4.35.10-1.tar.gz
>
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>

I'm running MailScanner on Fedora Core 2.  I notice on all the latest
installs that MIME::Base64 has to be forced.  Everything seems to work ok
but I'm wondering if this is the way it is supposed to work?

--
Gerry

"The lyfe so short, the craft so long to learne"  Chaucer

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From maillists at CONACTIVE.COM  Thu Nov  4 00:31:28 2004
From: maillists at CONACTIVE.COM (Kai Schaetzl)
Date: Thu Jan 12 21:27:28 2006
Subject: HTML conversion leaves CSS intact
Message-ID: <mailman.4297.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

MailScanner 4.32.5 on Linux. I have set to strip HTML which 
results f.i. in the following CSS being at the start of each 
ThreatFocus newsletter (don't ask me why these guys send it out 
in HTML :-(

BODY {font-family="Arial"} TT {font-family="Courier New"} 
BLOCKQUOTE.CITE 
{padding-left:0.5em; margin-left:0; margin-right:0; 
margin-top:0; margin-bottom:0; 
border-left:"solid 2";} 

Julian, this fixed in a newer version or don't you strip it 
because it's not HTML, strictly speaking? I would prefer having 
any CSS on top of a message stripped as well.

Kai

-- 

Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services: 
http://www.conactive.com
IE-Center: http://ie5.de & http://msie.winware.org

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From tmoore at LUKINS.COM  Thu Nov  4 00:14:42 2004
From: tmoore at LUKINS.COM (Terry Moore-Read)
Date: Thu Jan 12 21:27:28 2006
Subject: Spamassassin 3 / AWL
Message-ID: <mailman.4298.1137101248.24926.mailscanner@lists.mailscanner.info>

Is there a way to have mailscanner pass the recipients email address to
spamassassin as the user name ?  i ask because right now the auto
whitelist function in spamassassin is using the username root for all
awl entries.

Thanks

Terry Moore-Read

--
This message has been scanned for viruses
and dangerous content by Lukins & Annis, P.S.

NOTICE: This email may contain confidential or
privileged material, and is intended solely
for use by the above referenced recipient. Any
review, copying, printing, disclosure, distri-
bution, or any other use, is strictly prohibited.

If you are not the recipient, and believe that
you have received this in error, please notify
the sender and delete the copy you received.

Thank You!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Thu Nov  4 01:34:25 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:28 2006
Subject: MailScanner 4.35.10
Message-ID: <mailman.4299.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Gerry Doris wrote:

>On Wed, 3 Nov 2004, Julian Field wrote:
>
>
>
>>I have just put up 4.35.10. This is intended as an installation bug-fix
>>on 4.35.9.
>>We have upgraded to this version on several RedHat, CentOS and SuSE
>>systems, and have only seen the up2date problem once (and that problem
>>disappeared when we went through the same hoops again).
>>
>>I have also added the other little changes people have requested, but
>>they are very minor.
>>
>>You can get it from
>>
>>RedHat/Mandrake/Other RPM:
>>http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.35.10-1.rpm.tar.gz
>>
>>SuSE:
>>http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/suse/MailScanner-4.35.10-1.suse.tar.gz
>>
>>Solaris/Other Unix:
>>http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/tar/MailScanner-install-4.35.10-1.tar.gz
>>
>>--
>>Julian Field
>>www.MailScanner.info
>>Professional Support Services at www.MailScanner.biz
>>MailScanner thanks transtec Computers for their support
>>Buy the MailScanner book at www.MailScanner.info/store
>>
>>
>>
>
>I'm running MailScanner on Fedora Core 2.  I notice on all the latest
>installs that MIME::Base64 has to be forced.  Everything seems to work ok
>but I'm wondering if this is the way it is supposed to work?
>
>
Currently, yes. I may be able to remove the --force but it doesn't do
any harm at the moment.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Thu Nov  4 01:38:36 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:28 2006
Subject: HTML conversion leaves CSS intact
Message-ID: <mailman.4300.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Kai Schaetzl wrote:

>MailScanner 4.32.5 on Linux. I have set to strip HTML which
>results f.i. in the following CSS being at the start of each
>ThreatFocus newsletter (don't ask me why these guys send it out
>in HTML :-(
>
>BODY {font-family="Arial"} TT {font-family="Courier New"}
>BLOCKQUOTE.CITE
>{padding-left:0.5em; margin-left:0; margin-right:0;
>margin-top:0; margin-bottom:0;
>border-left:"solid 2";}
>
>Julian, this fixed in a newer version or don't you strip it
>because it's not HTML, strictly speaking? I would prefer having
>any CSS on top of a message stripped as well.
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From martelm at QUARK.VSC.EDU  Thu Nov  4 08:58:08 2004
From: martelm at QUARK.VSC.EDU (Michael H. Martel)
Date: Thu Jan 12 21:27:28 2006
Subject: MailScanner 4.35.10
Message-ID: <mailman.4301.1137101248.24926.mailscanner@lists.mailscanner.info>

--On Wednesday, November 3, 2004 5:23 PM -0500 Julian Field
<mailscanner@ECS.SOTON.AC.UK> wrote:

> But if you install the MIME::Base64 module through CPAN, this isn't
> essential. You need to either
> a) have MIME::Base64 installed by CPAN
> or
> b) Do the 4.35.10 upgrade "properly" using my script.

I missed the beginning of this thread, so I'll jump in on this section
here.  Are you saying that it's no longer a good idea to do the install
manually (perl Makefile.PL, make, etc) for each of the modules and then
copy the MailScanner install into /opt ?

Or am I just reading that wrong ?


Michael

--

  --------------------------------o---------------------------------
   Michael H. Martel              | Systems Administrator
   martelm@quark.vsc.edu          | Vermont State Colleges
   http://probe.vsc.edu/~michael  | PH:802-241-2544 FX:802-241-3363

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From roger at RUDNICK.COM.BR  Thu Nov  4 11:11:17 2004
From: roger at RUDNICK.COM.BR (Roger Jochem)
Date: Thu Jan 12 21:27:29 2006
Subject: minimum attachment size?
Message-ID: <mailman.4302.1137101248.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-2" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

There is some problem using the minimum attachment size parameter. I changed
it to "1", and if in Outlook Express I forward the message as an attachment
the message is blocked with attachmenttoosmall. The message I was testing
had about 700 Kb.

Roger Jochem

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From jaearick at COLBY.EDU  Thu Nov  4 12:23:36 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:29 2006
Subject: minimum attachment size?
Message-ID: <mailman.4303.1137101249.24926.mailscanner@lists.mailscanner.info>

My morning summary of bad emails, as reported by MailScanner, showed a
pile of "attachment too small" rejections of local users.  I had set the
value to zero.  While we discourage Outlook on our campus (we support
Eudora), we have Outlook users anyway.  I have asked our helpdesk to
correlate complaints about "attachment too small" rejections to Outlook
usage.  Something is going on here with 4.35.10.  I have turned this feature
off for the moment.

Jeff Earickson
Colby College

On Thu, 4 Nov 2004, Roger Jochem wrote:

> Date: Thu, 4 Nov 2004 09:11:17 -0200
> From: Roger Jochem <roger@RUDNICK.COM.BR>
> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: minimum attachment size?
>
> There is some problem using the minimum attachment size parameter. I changed
> it to "1", and if in Outlook Express I forward the message as an attachment
> the message is blocked with attachmenttoosmall. The message I was testing
> had about 700 Kb.
>
> Roger Jochem
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at MANGO.ZW  Thu Nov  4 13:20:19 2004
From: mailscanner at MANGO.ZW (Jim Holland)
Date: Thu Jan 12 21:27:29 2006
Subject: LibClamAV Warning: Broken PE header detected.
Message-ID: <mailman.4304.1137101249.24926.mailscanner@lists.mailscanner.info>

Hi all

For information.

I could not find any reference to this issue in the archives, so contacted
the ClamAV list.  A message that looked as if it was infected with Klez
had a message.pif attachment.  When scanned, ClamAV reported:

LibClamAV Warning: Broken PE header detected.
message.pif: OK

----------- SCAN SUMMARY -----------
Known viruses: 26187
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 0.01 MB
I/O buffer size: 131072 bytes
Time: 28.546 sec (0 m 28 s)

The above is treated by MailScanner as uninfected by a virus, although
fortunately it was blocked because of filename and filetype rules.

It is possible for ClamAV to be forced to report such files as
Broken.Executable, by using the following option in clamav-wrapper:

        ScanOptions="--detect-broken"

That then allows more control over how to treat such messages.

Regards

Jim Holland
System Administrator
MANGO - Zimbabwe's non-profit e-mail service

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From marcin.rozek at IOS.EDU.PL  Thu Nov  4 13:55:03 2004
From: marcin.rozek at IOS.EDU.PL ([ISO-8859-2] Marcin Rożek)
Date: Thu Jan 12 21:27:29 2006
Subject: minimum attachment size?
Message-ID: <mailman.4305.1137101249.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-2" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Jeff A. Earickson wrote:
> My morning summary of bad emails, as reported by MailScanner, showed a
> pile of "attachment too small" rejections of local users.  I had set the
> value to zero.  While we discourage Outlook on our campus (we support

> On Thu, 4 Nov 2004, Roger Jochem wrote:
>> There is some problem using the minimum attachment size parameter. I
>> changed
>> it to "1", and if in Outlook Express I forward the message as an
>> attachment
>> the message is blocked with attachmenttoosmall. The message I was testing
>> had about 700 Kb.
I've just tested this on Outlook Express V6.00.2800.1165. E-mail forwarded as
attachment wasn't blocked... Most of our users use Thunderbird although there's
still some outlook-ers but none of them did report this problem...

Maybe you could process such e-mail using MS in debug mode?

Regards,
Marcin

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From marcin.rozek at IOS.EDU.PL  Thu Nov  4 14:15:51 2004
From: marcin.rozek at IOS.EDU.PL ([ISO-8859-2] Marcin Rożek)
Date: Thu Jan 12 21:27:29 2006
Subject: minimum attachment size?
Message-ID: <mailman.4306.1137101249.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-2" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> Jeff A. Earickson wrote:
>
>> My morning summary of bad emails, as reported by MailScanner, showed a
>> pile of "attachment too small" rejections of local users.  I had set the
>> value to zero.  While we discourage Outlook on our campus (we support
>
>
>> On Thu, 4 Nov 2004, Roger Jochem wrote:
>>
>>> There is some problem using the minimum attachment size parameter. I
>>> changed
>>> it to "1", and if in Outlook Express I forward the message as an
>>> attachment
>>> the message is blocked with attachmenttoosmall. The message I was
>>> testing
>>> had about 700 Kb.
>
> I've just tested this on Outlook Express V6.00.2800.1165. E-mail
> forwarded as
> attachment wasn't blocked... Most of our users use Thunderbird although
> there's
> still some outlook-ers but none of them did report this problem...
>
> Maybe you could process such e-mail using MS in debug mode?
ouch... I did double check "Minimum Attachment Size" i MailScanner.conf and it
looks like it was turned off...(I forgot to rename MailScanner.conf.new to
MailScanner.conf after upgrade) When i set it to "1" then indeed MS blocks
e-mails from Outlook Express...
Mea culpa. I'm sorry.

Marcin

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From marcin.rozek at IOS.EDU.PL  Thu Nov  4 14:43:40 2004
From: marcin.rozek at IOS.EDU.PL ([ISO-8859-2] Marcin Rożek)
Date: Thu Jan 12 21:27:29 2006
Subject: minimum attachment size?
Message-ID: <mailman.4307.1137101249.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-2" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

This is the source of blocked e-mail:

(start)

(...)
Subject:
Date: Thu, 4 Nov 2004 15:10:52 +0100
MIME-Version: 1.0
Content-Type: multipart/mixed;
        boundary="----=_NextPart_000_0005_01C4C280.795A4CE0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1437
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441
Status:

This is a multi-part message in MIME format.

------=_NextPart_000_0005_01C4C280.795A4CE0
Content-Type: multipart/alternative;
        boundary="----=_NextPart_001_0006_01C4C280.795A4CE0"


------=_NextPart_001_0006_01C4C280.795A4CE0
Content-Type: text/plain;
        charset="iso-8859-2"
Content-Transfer-Encoding: quoted-printable


------=_NextPart_001_0006_01C4C280.795A4CE0
Content-Type: text/html;
        charset="iso-8859-2"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-2">
<META content=3D"MSHTML 6.00.2800.1476" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D2>1</FONT></DIV></BODY></HTML>

------=_NextPart_001_0006_01C4C280.795A4CE0--

------=_NextPart_000_0005_01C4C280.795A4CE0
Content-Type: application/vnd.ms-excel;
        name="aa.xls"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
        filename="aa.xls"

0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAABAAAAAQAAAAAAAAAA
(attachment)
AAAAAAAAAAAAAAAAAAAAAAAA

------=_NextPart_000_0005_01C4C280.795A4CE0--


(end)


Regards,
Marcin

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From martinh at SOLID-STATE-LOGIC.COM  Thu Nov  4 14:48:46 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:29 2006
Subject: minimum attachment size?
Message-ID: <mailman.4308.1137101249.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-2" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian

Also tried it here as well - blocked a valid 'bounce' email from a 
mailing list

It was in Italian, so I'm just guessing the email was valid in the firt 
place, unless someone would like a copy off list to verify this...

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Marcin Rożek wrote:
>> Jeff A. Earickson wrote:
>>
>>> My morning summary of bad emails, as reported by MailScanner, showed a
>>> pile of "attachment too small" rejections of local users.  I had set the
>>> value to zero.  While we discourage Outlook on our campus (we support
>>
>>
>>
>>> On Thu, 4 Nov 2004, Roger Jochem wrote:
>>>
>>>> There is some problem using the minimum attachment size parameter. I
>>>> changed
>>>> it to "1", and if in Outlook Express I forward the message as an
>>>> attachment
>>>> the message is blocked with attachmenttoosmall. The message I was
>>>> testing
>>>> had about 700 Kb.
>>
>>
>> I've just tested this on Outlook Express V6.00.2800.1165. E-mail
>> forwarded as
>> attachment wasn't blocked... Most of our users use Thunderbird although
>> there's
>> still some outlook-ers but none of them did report this problem...
>>
>> Maybe you could process such e-mail using MS in debug mode?
> 
> ouch... I did double check "Minimum Attachment Size" i MailScanner.conf 
> and it
> looks like it was turned off...(I forgot to rename MailScanner.conf.new to
> MailScanner.conf after upgrade) When i set it to "1" then indeed MS blocks
> e-mails from Outlook Express...
> Mea culpa. I'm sorry.
> 
> Marcin
> 
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Thu Nov  4 14:55:52 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:29 2006
Subject: minimum attachment size?
Message-ID: <mailman.4309.1137101249.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-2" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Thanks for that. I was checking all files involved in the mail, 
including the body, where I should only have been checking the 
attachments. Fixed in 4.35.11 which I have just released.

Marcin Rożek wrote:

> This is the source of blocked e-mail:
>
> (start)
>
> (...)
> Subject:
> Date: Thu, 4 Nov 2004 15:10:52 +0100
> MIME-Version: 1.0
> Content-Type: multipart/mixed;
>        boundary="----=_NextPart_000_0005_01C4C280.795A4CE0"
> X-Priority: 3
> X-MSMail-Priority: Normal
> X-Mailer: Microsoft Outlook Express 6.00.2800.1437
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441
> Status:
>
> This is a multi-part message in MIME format.
>
> ------=_NextPart_000_0005_01C4C280.795A4CE0
> Content-Type: multipart/alternative;
>        boundary="----=_NextPart_001_0006_01C4C280.795A4CE0"
>
>
> ------=_NextPart_001_0006_01C4C280.795A4CE0
> Content-Type: text/plain;
>        charset="iso-8859-2"
> Content-Transfer-Encoding: quoted-printable
>
>
> ------=_NextPart_001_0006_01C4C280.795A4CE0
> Content-Type: text/html;
>        charset="iso-8859-2"
> Content-Transfer-Encoding: quoted-printable
>
> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
> <HTML><HEAD>
> <META http-equiv=3DContent-Type content=3D"text/html; =
> charset=3Diso-8859-2">
> <META content=3D"MSHTML 6.00.2800.1476" name=3DGENERATOR>
> <STYLE></STYLE>
> </HEAD>
> <BODY bgColor=3D#ffffff>
> <DIV><FONT face=3DArial size=3D2>1</FONT></DIV></BODY></HTML>
>
> ------=_NextPart_001_0006_01C4C280.795A4CE0--
>
> ------=_NextPart_000_0005_01C4C280.795A4CE0
> Content-Type: application/vnd.ms-excel;
>        name="aa.xls"
> Content-Transfer-Encoding: base64
> Content-Disposition: attachment;
>        filename="aa.xls"
>
> 0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAABAAAAAQAAAAAAAAAA 
>
> (attachment)
> AAAAAAAAAAAAAAAAAAAAAAAA
>
> ------=_NextPart_000_0005_01C4C280.795A4CE0--
>
>
> (end)
>
>
> Regards,
> Marcin
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

-- 
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From sanjay.patel at REXWIRE.COM  Thu Nov  4 14:23:54 2004
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:27:29 2006
Subject: Logging MailScanner and MailWatch to Mysql
Message-ID: <mailman.4310.1137101249.24926.mailscanner@lists.mailscanner.info>

Is it possible to log both MailScanner and MailWatch to mysql? I can only
get it to log one or the other.

-SKP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Thu Nov  4 14:02:22 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:29 2006
Subject: MailScanner 4.35.10
Message-ID: <mailman.4311.1137101249.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Michael H. Martel wrote:

> --On Wednesday, November 3, 2004 5:23 PM -0500 Julian Field
> <mailscanner@ECS.SOTON.AC.UK> wrote:
>
>> But if you install the MIME::Base64 module through CPAN, this isn't
>> essential. You need to either
>> a) have MIME::Base64 installed by CPAN
>> or
>> b) Do the 4.35.10 upgrade "properly" using my script.
>
>
> I missed the beginning of this thread, so I'll jump in on this section
> here.  Are you saying that it's no longer a good idea to do the install
> manually (perl Makefile.PL, make, etc) for each of the modules and then
> copy the MailScanner install into /opt ?

If you are using the Solaris/Other Unix distribution, I would still
recommend using my install.sh script. But you can do it by hand if you
want to. If you are using the RPM distributions, then you really do need
to run the install.sh script, but it's not essential for the
Solaris/Other Unix distribution.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Q.G.Campbell at NEWCASTLE.AC.UK  Thu Nov  4 15:15:01 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:29 2006
Subject: minimum attachment size?
Message-ID: <mailman.4312.1137101249.24926.mailscanner@lists.mailscanner.info>

>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>Sent: 04 November 2004 14:56
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: minimum attachment size?
>
>Thanks for that. I was checking all files involved in the mail, 
>including the body, where I should only have been checking the 
>attachments. Fixed in 4.35.11 which I have just released.
>
[snip]

Julain

Sigh! Just finished upgrading 8 machines to 4.35.10. Wanted to use that
feature.

Any chance of a patch file? If not, which Perl program changed so I can
upgrade just one system and copy the changed file to the others?

Thanks

Quentin

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From shrek-m at GMX.DE  Thu Nov  4 15:23:25 2004
From: shrek-m at GMX.DE (shrek-m@gmx.de)
Date: Thu Jan 12 21:27:29 2006
Subject: 4.35.11-1 sig not found
Message-ID: <mailman.4313.1137101249.24926.mailscanner@lists.mailscanner.info>

hi,


http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.35.11-1.rpm.tar.gz
is ok


http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.35.11-1.rpm.tar.gz.sig
<snip>


  Not Found

The requested URL
/mailscanner/files/4/rpm/MailScanner-4.35.11-1.rpm.tar.gz.sig was not
found on this server.

------------------------------------------------------------------------
Apache/2.0.46 (Red Hat) Server at www.sng.ecs.soton.ac.uk Port 80
</snip>


--
shrek-m

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From john at TRADOC.FR  Thu Nov  4 15:06:43 2004
From: john at TRADOC.FR (John Wilcock)
Date: Thu Jan 12 21:27:29 2006
Subject: Phishing phailure
Message-ID: <mailman.4314.1137101249.24926.mailscanner@lists.mailscanner.info>

On Thu, 4 Nov 2004 14:53:49 +0000, Martin Sapsed wrote:
> I put 4.35.9 up yesterday with
> 
> Find Phishing Fraud = yes
> 
> and yet the attached message got through without being detected (or
> picked up by the Clam definitions). 

Huh? It *was* detected:

| <a href=3D"http://3duser.co.kr/b.html"><font color=3D"red"><b>MailScanner
|  has detected a possible fraud attempt from "3duser.co.kr" claiming to be
| </b></font> https://ibank.barclays.co.uk/fp/1_2x/online/1,,logon,00.html<
| /a>

John.

-- 
-- Over 2500 webcams from ski resorts around the world - www.snoweye.com
-- Translate your technical documents and web pages    - www.tradoc.fr

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From quinting at HSD.CA  Thu Nov  4 15:42:38 2004
From: quinting at HSD.CA (Quintin Giesbrecht)
Date: Thu Jan 12 21:27:29 2006
Subject: MailScanner: mremap moved 280 cows
Message-ID: <mailman.4315.1137101249.24926.mailscanner@lists.mailscanner.info>

 
I found this on my console screen this morning...

Anyone know what it means?

MailScanner: mremap moved 280 cows
 
 
________________________________________

Quintin S. Giesbrecht
I.T. Professional
Hanover School Division
(204)346-6469
q@hsd.ca
________________________________________   

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From m.sapsed at BANGOR.AC.UK  Thu Nov  4 16:44:42 2004
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:27:29 2006
Subject: Phishing phailure
Message-ID: <mailman.4316.1137101249.24926.mailscanner@lists.mailscanner.info>

John Wilcock wrote:
> On Thu, 4 Nov 2004 14:53:49 +0000, Martin Sapsed wrote:
>
>>I put 4.35.9 up yesterday with
>>
>>Find Phishing Fraud = yes
>>
>>and yet the attached message got through without being detected (or
>>picked up by the Clam definitions).
>
> Huh? It *was* detected:
>
> | <a href=3D"http://3duser.co.kr/b.html"><font color=3D"red"><b>MailScanner
> |  has detected a possible fraud attempt from "3duser.co.kr" claiming to be
> | </b></font> https://ibank.barclays.co.uk/fp/1_2x/online/1,,logon,00.html<
> | /a>

By your system and by Julian's, yes, but not by mine! Those red bits
weren't in the message I sent. There's obviously something amiss on my
installation - question is, what? I used install.sh in the tar
installation, HTML::Parser is up to scratch. Phishing detector is
apparently on in MailScanner.conf.

Cheers,

Martin

--
Martin Sapsed            "I've got 8 little fingers and only 2 thumbs,
Microcomputer Support                      won't you leave me in peace
Information Services                        while I get the job done?"
University of Wales, Bangor             Chris Rea, "I'm working on it"

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Thu Nov  4 16:51:53 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:29 2006
Subject: Phishing phailure
Message-ID: <mailman.4317.1137101249.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Martin Sapsed wrote:

> John Wilcock wrote:
>
>> On Thu, 4 Nov 2004 14:53:49 +0000, Martin Sapsed wrote:
>>
>>> I put 4.35.9 up yesterday with
>>>
>>> Find Phishing Fraud = yes
>>>
>>> and yet the attached message got through without being detected (or
>>> picked up by the Clam definitions).
>>
>>
>> Huh? It *was* detected:
>>
>> | <a href=3D"http://3duser.co.kr/b.html"><font
>> color=3D"red"><b>MailScanner
>> |  has detected a possible fraud attempt from "3duser.co.kr" claiming
>> to be
>> | </b></font>
>> https://ibank.barclays.co.uk/fp/1_2x/online/1,,logon,00.html<
>> | /a>
>
>
> By your system and by Julian's, yes, but not by mine! Those red bits
> weren't in the message I sent. There's obviously something amiss on my
> installation - question is, what? I used install.sh in the tar
> installation, HTML::Parser is up to scratch. Phishing detector is
> apparently on in MailScanner.conf.

Did you upgrade the languagues.conf file?

cd /etc/MailScanner/reports/en
upgrade_MailScanner_conf languages.conf languages.conf.rpmnew >
languages.new
mv languages.new languages.conf

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From lists at DVD-GOETSCH.DE  Thu Nov  4 15:24:04 2004
From: lists at DVD-GOETSCH.DE (sebastian ruchti)
Date: Thu Jan 12 21:27:29 2006
Subject: Phishing phailure
Message-ID: <mailman.4318.1137101249.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "KOI8-R" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]


Hi there,

 quite interesting ... it seems that my MS installation (also 4.35.9)
detected  the Phishing fraud with your attached E-Mail and marked it as
intended (in German):
-------------------
will block it to protect your money. Thank you.
MailScanner hat einen moeglichen Taeuschungsversuch durch "3duser.co.kr"
festgestellt.
https://ibank.barclays.co.uk/fp/1_2x/online/1,,logon,00.html
------------------------
.sebastian

> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER@JISCMAIL.AC.UK]On Behalf Of Martin Sapsed
> Sent: Thursday, November 04, 2004 3:54 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Phishing phailure
>
>
> Hi Julian et al,
>
> I put 4.35.9 up yesterday with
>
> Find Phishing Fraud = yes
>
> and yet the attached message got through without being detected (or
> picked up by the Clam definitions). Is there something about it which
> means it skipped your detection methods, or is there a problem with my
> installation? I did use install.sh.
>
> Cheers,
>
> Martin
>
> --
> Martin Sapsed            "I've got 8 little fingers and only 2 thumbs,
> Microcomputer Support                      won't you leave me in peace
> Information Services                        while I get the job done?"
> University of Wales, Bangor             Chris Rea, "I'm working on it"
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Thu Nov  4 15:35:02 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:29 2006
Subject: 4.35.11-1 sig not found
Message-ID: <mailman.4319.1137101249.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

You beat me to it, they are all there now.

shrek-m@gmx.de wrote:

> hi,
>
>
> http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.35.11-1.rpm.tar.gz
>
> is ok
>
>
> http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.35.11-1.rpm.tar.gz.sig
>
> <snip>
>
>
>  Not Found
>
> The requested URL
> /mailscanner/files/4/rpm/MailScanner-4.35.11-1.rpm.tar.gz.sig was not
> found on this server.
>
> ------------------------------------------------------------------------
> Apache/2.0.46 (Red Hat) Server at www.sng.ecs.soton.ac.uk Port 80
> </snip>
>
>
> --
> shrek-m
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ugob at CAMO-ROUTE.COM  Thu Nov  4 15:13:40 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:29 2006
Subject: Logging MailScanner and MailWatch to Mysql
Message-ID: <mailman.4320.1137101249.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Sanjay K. Patel wrote:
> Is it possible to log both MailScanner and MailWatch to mysql? I can only
> get it to log one or the other.

MailWatch doesn't generate logs.  MailScanner generates logs that can be
logged to MySQL, then can be viewed in MailWatch.

>
> -SKP
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ugob at CAMO-ROUTE.COM  Thu Nov  4 17:06:02 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:29 2006
Subject: Phishing phailure
Message-ID: <mailman.4321.1137101249.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Martin Sapsed wrote:
> John Wilcock wrote:
>
>> On Thu, 4 Nov 2004 14:53:49 +0000, Martin Sapsed wrote:
>>
>>> I put 4.35.9 up yesterday with
>>>
>>> Find Phishing Fraud = yes
>>>
>>> and yet the attached message got through without being detected (or
>>> picked up by the Clam definitions).
>>
>>
>> Huh? It *was* detected:
>>
>> | <a href=3D"http://3duser.co.kr/b.html"><font
>> color=3D"red"><b>MailScanner
>> |  has detected a possible fraud attempt from "3duser.co.kr" claiming
>> to be
>> | </b></font>
>> https://ibank.barclays.co.uk/fp/1_2x/online/1,,logon,00.html<
>> | /a>
>
>
> By your system and by Julian's, yes, but not by mine! Those red bits
> weren't in the message I sent. There's obviously something amiss on my
> installation - question is, what? I used install.sh in the tar
> installation, HTML::Parser is up to scratch. Phishing detector is
> apparently on in MailScanner.conf.
>

Anything weird in your logs?

> Cheers,
>
> Martin
>
> --
> Martin Sapsed            "I've got 8 little fingers and only 2 thumbs,
> Microcomputer Support                      won't you leave me in peace
> Information Services                        while I get the job done?"
> University of Wales, Bangor             Chris Rea, "I'm working on it"
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From 20020401 at DUH.NET  Thu Nov  4 17:11:49 2004
From: 20020401 at DUH.NET (Travis Taylor)
Date: Thu Jan 12 21:27:29 2006
Subject: Too many attachments
Message-ID: <mailman.4322.1137101249.24926.mailscanner@lists.mailscanner.info>

Julian or anyone else,

What is suppose to happen with messages that are found to have "Too
many attachments" as defined by the "Maximum Attachments Per
Message =" setting?

In our case the messages are delivered to the recipient with only
the subject modify as we have defined with "Content Subject Text ="
and the attachments as originally sent.

Also the notification messages sent to System Administrators about
these does not have any report information, as one normally get
with viruses, blocked extensions, etc.

--
Travis Taylor
Newton Unified School District #373

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mkettler at EVI-INC.COM  Thu Nov  4 16:40:48 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:29 2006
Subject: MailScanner: mremap moved 280 cows
Message-ID: <mailman.4323.1137101249.24926.mailscanner@lists.mailscanner.info>

At 10:42 AM 11/4/2004, Quintin Giesbrecht wrote:
>I found this on my console screen this morning...
>
>Anyone know what it means?
>
>MailScanner: mremap moved 280 cows
>

cows: copy-on-write pages.  That message is a warning generated by the
2.6.x linux kernel, indicating it's having to do some rather non-optimal
behaviors to work around what mremap is doing. I believe 2.6.6 and higher
have this fixed with a better handling of CoW pages in mremap.c

Some related discussion:
http://www.kernel.org/pub/linux/kernel/people/akpm/patches/2.6/2.6.6-rc3/2.6.6-rc3-mm1/broken-out/rmap-11-mremap-moves.patch

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From john at TRADOC.FR  Thu Nov  4 16:55:34 2004
From: john at TRADOC.FR (John Wilcock)
Date: Thu Jan 12 21:27:29 2006
Subject: Phishing phailure
Message-ID: <mailman.4324.1137101249.24926.mailscanner@lists.mailscanner.info>

On Thu, 4 Nov 2004 16:44:42 +0000, Martin Sapsed wrote:
> John Wilcock wrote:
> > Huh? It *was* detected:
...
> By your system and by Julian's, yes, but not by mine! 

Duh! Never thought of that, just blithely assumed I was looking at the
exact message you'd forwarded. I'm running 4.35.10 on a RH9 box, FWIW,
though the phishing detection worked fine for me with 4.35.9 too. 

John.

-- 
-- Over 2500 webcams from ski resorts around the world - www.snoweye.com
-- Translate your technical documents and web pages    - www.tradoc.fr

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From m.sapsed at BANGOR.AC.UK  Thu Nov  4 17:40:33 2004
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:27:29 2006
Subject: Phishing phailure
Message-ID: <mailman.4325.1137101249.24926.mailscanner@lists.mailscanner.info>

Julian Field wrote:
> Martin Sapsed wrote:
>> By your system and by Julian's, yes, but not by mine! Those red bits
>> weren't in the message I sent. There's obviously something amiss on my
>> installation - question is, what? I used install.sh in the tar
>> installation, HTML::Parser is up to scratch. Phishing detector is
>> apparently on in MailScanner.conf.
>
> Did you upgrade the languagues.conf file?
>
> cd /etc/MailScanner/reports/en
> upgrade_MailScanner_conf languages.conf languages.conf.rpmnew >
> languages.new
> mv languages.new languages.conf

Not an rpm installation. Just used the supplied cy+en version of
languages.conf which appears to have the bilingual messages we agreed.

Ugo Bellavance wrote:
 >
 > Anything weird in your logs?

Nothing noteworthy that I can see.

In my MailScanner.conf I have
Dangerous Content Scanning = yes
Find Phishing Fraud = yes

anything else that this depends on?

Cheers,

Martin

--
Martin Sapsed            "I've got 8 little fingers and only 2 thumbs,
Microcomputer Support                      won't you leave me in peace
Information Services                        while I get the job done?"
University of Wales, Bangor             Chris Rea, "I'm working on it"

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Thu Nov  4 15:29:43 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:29 2006
Subject: minimum attachment size?
Message-ID: <mailman.4326.1137101249.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]



Quentin Campbell wrote:

>>-----Original Message-----
>>From: MailScanner mailing list
>>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>>Sent: 04 November 2004 14:56
>>To: MAILSCANNER@JISCMAIL.AC.UK
>>Subject: Re: minimum attachment size?
>>
>>Thanks for that. I was checking all files involved in the mail,
>>including the body, where I should only have been checking the
>>attachments. Fixed in 4.35.11 which I have just released.
>>
>>
>>
>[snip]
>
>Julain
>
>Sigh! Just finished upgrading 8 machines to 4.35.10. Wanted to use that
>feature.
>
>Any chance of a patch file? If not, which Perl program changed so I can
>upgrade just one system and copy the changed file to the others?
>
>
Only SweepContent.pm changed. I have attached a patch to take that code
from 4.35.10 to 4.35.11.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2: "Attached Text" ]

--- ../../../MailScanner-4.35.10/lib/MailScanner/SweepContent.pm        Wed Nov  3 13:21:33 2004
+++ SweepContent.pm     Thu Nov  4 13:47:03 2004
@@ -294,20 +294,25 @@

     # "Safe" attachment filename is in $safename, this is what we stat
     $attachsize = -s "$BaseDir/$safename";
-    if ($maxsize>=0 && $attachsize > $maxsize) {
+    #print STDERR "\nSafename = $safename\n";
+    #print STDERR "Attachsize=$attachsize\nMin=$minsize\nMax=$maxsize\n";
+    if ($maxsize>=0 && $attachsize > $maxsize &&
+        $safename !~ /^msg[-\d]+\.(txt|html)$/) {
       $unsafename = $message->{safefile2file}{$safename} || $tnefname;
-      MailScanner::Log::InfoLog("Attachment size check: %s > %s (%s)",
-                                $attachsize, $maxsize, $unsafename);
+      MailScanner::Log::InfoLog("Attachment size check: %s > %s (%s) in %s",
+                                $attachsize, $maxsize, $unsafename, $id);
       $message->{otherreports}{$safename} .=
        MailScanner::Config::LanguageValue($message,'attachmenttoolarge') . "\n";
       $message->{othertypes}{$safename}   .= "e";
       $counter++;
       $message->{otherinfected}++;
     }
-    if ($attachsize < $minsize) {
+    if ($minsize>=0 && $attachsize < $minsize &&
+        $safename !~ /^msg[-\d]+\.(txt|html)$/) {
+      #print STDERR "Attachment is too small\n";
       $unsafename = $message->{safefile2file}{$safename} || $tnefname;
-      MailScanner::Log::InfoLog("Attachment size check: %s < %s (%s)",
-                                $attachsize, $minsize, $unsafename);
+      MailScanner::Log::InfoLog("Attachment size check: %s < %s (%s) in %s",
+                                $attachsize, $minsize, $unsafename, $id);
       $message->{otherreports}{$safename} .=
        MailScanner::Config::LanguageValue($message,'attachmenttoosmall') . "\n";
       $message->{othertypes}{$safename}   .= "e";

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From martinh at SOLID-STATE-LOGIC.COM  Thu Nov  4 15:03:21 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:29 2006
Subject: minimum attachment size?
Message-ID: <mailman.4327.1137101249.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-2" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian


aaaaaarrggghhhhh, I just installed 4.35.10.

I thought I'd delay 4.35 till things had settled down. But no, the god 
of heck has got me again -    arrggghhhh :-)

Oh well at least it's easy to upgrade.....


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Julian Field wrote:
> Thanks for that. I was checking all files involved in the mail, 
> including the body, where I should only have been checking the 
> attachments. Fixed in 4.35.11 which I have just released.
> 
> Marcin Rożek wrote:
> 
>> This is the source of blocked e-mail:
>>
>> (start)
>>
>> (...)
>> Subject:
>> Date: Thu, 4 Nov 2004 15:10:52 +0100
>> MIME-Version: 1.0
>> Content-Type: multipart/mixed;
>>        boundary="----=_NextPart_000_0005_01C4C280.795A4CE0"
>> X-Priority: 3
>> X-MSMail-Priority: Normal
>> X-Mailer: Microsoft Outlook Express 6.00.2800.1437
>> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441
>> Status:
>>
>> This is a multi-part message in MIME format.
>>
>> ------=_NextPart_000_0005_01C4C280.795A4CE0
>> Content-Type: multipart/alternative;
>>        boundary="----=_NextPart_001_0006_01C4C280.795A4CE0"
>>
>>
>> ------=_NextPart_001_0006_01C4C280.795A4CE0
>> Content-Type: text/plain;
>>        charset="iso-8859-2"
>> Content-Transfer-Encoding: quoted-printable
>>
>>
>> ------=_NextPart_001_0006_01C4C280.795A4CE0
>> Content-Type: text/html;
>>        charset="iso-8859-2"
>> Content-Transfer-Encoding: quoted-printable
>>
>> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
>> <HTML><HEAD>
>> <META http-equiv=3DContent-Type content=3D"text/html; =
>> charset=3Diso-8859-2">
>> <META content=3D"MSHTML 6.00.2800.1476" name=3DGENERATOR>
>> <STYLE></STYLE>
>> </HEAD>
>> <BODY bgColor=3D#ffffff>
>> <DIV><FONT face=3DArial size=3D2>1</FONT></DIV></BODY></HTML>
>>
>> ------=_NextPart_001_0006_01C4C280.795A4CE0--
>>
>> ------=_NextPart_000_0005_01C4C280.795A4CE0
>> Content-Type: application/vnd.ms-excel;
>>        name="aa.xls"
>> Content-Transfer-Encoding: base64
>> Content-Disposition: attachment;
>>        filename="aa.xls"
>>
>> 0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAABAAAAAQAAAAAAAAAA 
>>
>> (attachment)
>> AAAAAAAAAAAAAAAAAAAAAAAA
>>
>> ------=_NextPart_000_0005_01C4C280.795A4CE0--
>>
>>
>> (end)
>>
>>
>> Regards,
>> Marcin
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
> 

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From martinh at SOLID-STATE-LOGIC.COM  Thu Nov  4 15:00:09 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:29 2006
Subject: Phishing phailure
Message-ID: <mailman.4328.1137101249.24926.mailscanner@lists.mailscanner.info>

Martin

just installed 4.35.10 and your email triggered the phishing system -
see message adjusted by MS below...


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Martin Sapsed wrote:
> Hi Julian et al,
>
> I put 4.35.9 up yesterday with
>
> Find Phishing Fraud = yes
>
> and yet the attached message got through without being detected (or
> picked up by the Clam definitions). Is there something about it which
> means it skipped your detection methods, or is there a problem with my
> installation? I did use install.sh.
>
> Cheers,
>
> Martin
>
> --
> Martin Sapsed            "I've got 8 little fingers and only 2 thumbs,
> Microcomputer Support                      won't you leave me in peace
> Information Services                        while I get the job done?"
> University of Wales, Bangor             Chris Rea, "I'm working on it"
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> ------------------------------------------------------------------------
>
> Subject:
> Official security information from Barclays IBank
> From:
> Barclays IBank service <service@ibank.barclays.co.uk>
> Date:
> Thu, 04 Nov 2004 14:08:59 +0000
> To:
> Martin <martin@bangor.ac.uk>
>
> To:
> Martin <martin@bangor.ac.uk>
>
>
> Dear customer!
>
> Please read this important message about
> security. We are working very hard to protect
> our customers against fraud. Your account has
> been randomly chosen for verification. This is
> requested to us to verify that you are the real
> owner of this account. All you need to do is to
> click on the link below. You will see a verification
> page. Please complete all fields that you will see
> and submit the form. You will be redirected to Barclays
> IBank home page after verification. Please note that if
> you don't verify your ownership of account in 24 hours we
> will block it to protect your money. Thank you.
> *MailScanner has detected a possible fraud attempt from "3duser.co.kr"
> claiming to be*
> https://ibank.barclays.co.uk/fp/1_2x/online/1,,logon,00.html
> <http://3duser.co.kr/b.html> ------------------------ MailScanner list
> ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk
> with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From danielk at AVALONPUB.COM  Thu Nov  4 18:45:42 2004
From: danielk at AVALONPUB.COM (Daniel Kleinsinger)
Date: Thu Jan 12 21:27:29 2006
Subject: Phishing PPs
Message-ID: <mailman.4329.1137101249.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I'm getting phalse positives (maybe the joke is getting a little old)
from the phishing code that I think could be fixed easily.  I get some
logged that look like:
Found phishing fraud from www.avalonpub.com claiming to be
www.avalonpub.com<br><br>

Could the fraud detection code be changed to ignore html tags like
these?  Is there any danger from stripping extra html tags from the <a></a>?

Daniel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Leonard.Hermens at POTLATCHCORP.COM  Thu Nov  4 18:56:04 2004
From: Leonard.Hermens at POTLATCHCORP.COM (Leonard Hermens)
Date: Thu Jan 12 21:27:29 2006
Subject: Phishing PPs
Message-ID: <mailman.4330.1137101249.24926.mailscanner@lists.mailscanner.info>

Julian has a report from me similar to this one and I know that he is
working on a modification to accomodate this.

Use of "ph" is just phine with me. :)

-- Leonard

At 10:45 AM 11/4/2004, Daniel Kleinsinger wrote:
>I'm getting phalse positives (maybe the joke is getting a little old)
>from the phishing code that I think could be fixed easily.  I get some
>logged that look like:
>Found phishing fraud from www.avalonpub.com claiming to be
>www.avalonpub.com<br><br>
>
>Could the fraud detection code be changed to ignore html tags like
>these?  Is there any danger from stripping extra html tags from the <a></a>?
>
>Daniel
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From sconway at WLNET.COM  Thu Nov  4 23:32:23 2004
From: sconway at WLNET.COM (Stephen Conway)
Date: Thu Jan 12 21:27:29 2006
Subject: FW: MailScanner Multiple Recipients from Perl Scripts
Message-ID: <mailman.4331.1137101249.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hello:

Sorry, meant to send this to the list.

Thanks,

Steve
-----Original Message-----
From: Stephen Conway [mailto:sconway@wlnet.com]
Sent: Thursday, November 04, 2004 6:27 PM
To: 'Julian Field'
Subject: MailScanner Multiple Recipients from Perl Scripts

Hello:

We have a lot of custom perl scripts that do various things, among them is
to send reports / emails to 1 or more recipients.  I have noticed that when
running MailScanner, if you try to send an SMTP message from within an
external perl script where you send to multiple recipients , ex:

    $mailhost='domain.com';
    $recipient="recip1@domain.com,recip2@domain2.com,recip3@domain3.com";
    $sender='sender@domain.com';
    $smtp = Net::SMTP->new("$mailhost", Timeout => 30,debug =>1,);
if ($smtp) {print PLOG "SMTP session START ok\n";} else{print PLOG "SMTP
session START failed\n"; close();exit}
    $smtp->mail($sender);
    $smtp->recipient($recipient);
    $smtp->data();
    $smtp->datasend("From: $sender\n");
    $smtp->datasend("To: $recipient\n");
    $smtp->datasend("Subject: $msg_sub\n");
    $smtp->datasend("\n");
    $smtp->datasend("$msg");
    $smtp->dataend();
    $smtp->quit;

When sending as above, with multiple recipients via a MailScanner system,
there are problems, i.e. local configuration errors , and problems where the
receiving servers reply with errors , even if both recipients exist and are
OK.

Can you please let me know what might be causing the above?

Thanks,

Steve

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From natedog550 at HOTMAIL.COM  Fri Nov  5 00:19:12 2004
From: natedog550 at HOTMAIL.COM (Nathan P.)
Date: Thu Jan 12 21:27:29 2006
Subject: New Fresh Install Problems SuSE 9.1
Message-ID: <mailman.4332.1137101249.24926.mailscanner@lists.mailscanner.info>

Ok here's the quick and dirty of what has happened.

We had power surge.  I'm a retard and forgot I didn't have it plugged into
the UPS.

Well, killed my friggin' hard drive!

Nehoot.

Before all this I was running SuSE 9.0 x86_64 and running mail scanner
perfectly with no probs.

I put in 2 new SATA drives using RAID mirroring and installed SuSE 9.1
x86_64 with 2.6 kernel.

Installing this version: MailScanner-4.35.9-1

Install goes fine until the very very end.  Read further and you'll see the
logged install error.


I'm getting notice emails that have this:
Report: MailScanner: Could not analyze message

But it always seems to be coming from Outlook Express or Outlook email
programs that get the error.  It doesn't do this on every email.  I could be
wrong on the Outlook thing.  But I've even tried messing with tnef.  Turning
it off or using /usr/bin/tnef and /usr/bin/file instead of internal.  But
still same thing.

Looking through the logs it's giving this error:
MailScanner[16056]: Cannot parse
/var/spool/MailScanner/incoming/16056/iA4MbdOj016065.header and , Can't
locate object method "init" via package "MIME::Decoder::QuotedPrint" at
/usr/lib/perl5/site_perl/5.8.3/MIME/Decoder.pm line 179.


I've tried all sorts of things - anything and everything I could think of
related to MIME tools and decoder and tnef and all sorts of junk.  I would
uninstall all rpms then I tried installing the perl mods by hand through:
perl -MCPAN -e shell

But still when I run install.sh I get this error:

Attempting to build and install perl-MIME-tools-5.415-1
Installing perl-MIME-tools-5.415-1.src.rpm
Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.9467
+ umask 022
+ cd /usr/src/packages/BUILD
+ cd /usr/src/packages/BUILD
+ rm -rf MIME-tools-5.415
+ /usr/bin/gzip -dc /usr/src/packages/SOURCES/MIME-tools-5.415.tar.gz
+ tar -xf -
+ STATUS=0
+ '[' 0 -ne 0 ']'
+ cd MIME-tools-5.415
++ /usr/bin/id -u
+ '[' 0 = 0 ']'
+ /bin/chown -Rhf root .
++ /usr/bin/id -u
+ '[' 0 = 0 ']'
+ /bin/chgrp -Rhf root .
+ /bin/chmod -Rf a+rX,g-w,o-w .
+ echo 'Patch #0 (mime-tools-5.415-patch1.txt):'
Patch #0 (mime-tools-5.415-patch1.txt):
+ patch -p1 -s
+ exit 0
Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.9467
+ umask 022
+ cd /usr/src/packages/BUILD
+ /bin/rm -rf /var/tmp/perl-MIME-tools-root
++ dirname /var/tmp/perl-MIME-tools-root
+ /bin/mkdir -p /var/tmp
+ /bin/mkdir /var/tmp/perl-MIME-tools-root
+ cd MIME-tools-5.415
+ CFLAGS=-O2 -g
+ perl Makefile.PL PREFIX=/var/tmp/perl-MIME-tools-root/usr
Checking if your kit is complete...
Looks good
Warning: prerequisite MIME::Base64 3.03 not found. We have 2.12.
Writing Makefile for MIME-tools
+ make
cp lib/MIME/Body.pm blib/lib/MIME/Body.pm
cp lib/MIME/Decoder/Gzip64.pm blib/lib/MIME/Decoder/Gzip64.pm
cp lib/MIME/Field/ContDisp.pm blib/lib/MIME/Field/ContDisp.pm
cp set-version.pl blib/lib/set-version.pl
cp lib/MIME/Parser/Results.pm blib/lib/MIME/Parser/Results.pm
cp lib/MIME/Field/ContType.pm blib/lib/MIME/Field/ContType.pm
cp lib/MIME/Decoder/NBit.pm blib/lib/MIME/Decoder/NBit.pm
cp lib/MIME/Entity.pm blib/lib/MIME/Entity.pm
cp lib/MIME/Head.pm blib/lib/MIME/Head.pm
cp lib/MIME/Parser/Filer.pm blib/lib/MIME/Parser/Filer.pm
cp lib/MIME/Words.pm blib/lib/MIME/Words.pm
cp lib/MIME/Field/ParamVal.pm blib/lib/MIME/Field/ParamVal.pm
cp lib/MIME/Decoder/BinHex.pm blib/lib/MIME/Decoder/BinHex.pm
cp lib/MIME/Tools.pm blib/lib/MIME/Tools.pm
cp lib/MIME/Field/ConTraEnc.pm blib/lib/MIME/Field/ConTraEnc.pm
cp lib/MIME/Decoder/Binary.pm blib/lib/MIME/Decoder/Binary.pm
cp lib/MIME/Decoder.pm blib/lib/MIME/Decoder.pm
cp lib/MIME/Decoder/UU.pm blib/lib/MIME/Decoder/UU.pm
cp lib/MIME/Decoder/Base64.pm blib/lib/MIME/Decoder/Base64.pm
cp lib/MIME/Decoder/QuotedPrint.pm blib/lib/MIME/Decoder/QuotedPrint.pm
cp lib/MIME/WordDecoder.pm blib/lib/MIME/WordDecoder.pm
cp lib/MIME/Parser/Reader.pm blib/lib/MIME/Parser/Reader.pm
cp lib/MIME/Parser.pm blib/lib/MIME/Parser.pm
Manifying blib/man3/MIME::Decoder::Gzip64.3pm
Manifying blib/man3/MIME::Body.3pm
Manifying blib/man3/MIME::Field::ContDisp.3pm
Manifying blib/man3/MIME::Parser::Results.3pm
Manifying blib/man3/MIME::Field::ContType.3pm
Manifying blib/man3/MIME::Decoder::NBit.3pm
Manifying blib/man3/MIME::Entity.3pm
Manifying blib/man3/MIME::Parser::Filer.3pm
Manifying blib/man3/MIME::Head.3pm
Manifying blib/man3/MIME::Words.3pm
Manifying blib/man3/MIME::Field::ParamVal.3pm
Manifying blib/man3/MIME::Decoder::BinHex.3pm
Manifying blib/man3/MIME::Tools.3pm
Manifying blib/man3/MIME::Field::ConTraEnc.3pm
Manifying blib/man3/MIME::Decoder::Binary.3pm
Manifying blib/man3/MIME::Decoder.3pm
Manifying blib/man3/MIME::Decoder::UU.3pm
Manifying blib/man3/MIME::Decoder::QuotedPrint.3pm
Manifying blib/man3/MIME::Decoder::Base64.3pm
Manifying blib/man3/MIME::WordDecoder.3pm
Manifying blib/man3/MIME::Parser.3pm
Manifying blib/man3/MIME::Parser::Reader.3pm
+ make test
PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e"
"test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
t/Body...........ok
t/Decoder........ok
t/Entity.........Can't locate object method "init" via package
"MIME::Decoder::QuotedPrint" at
/usr/src/packages/BUILD/MIME-tools-5.415/blib/lib/MIME/Decoder.pm line 179.
t/Entity.........dubious
        Test returned status 9 (wstat 2304, 0x900)
Scalar found where operator expected at (eval 155) line 1, near "'int'
$__val"
        (Missing operator before   $__val?)
DIED. FAILED tests 16-29
        Failed 14/29 tests, 51.72% okay
t/Gauntlet.......ok
t/Head...........ok
t/Misc...........Too many arguments for MIME::QuotedPrint::encode_qp at
/usr/src/packages/BUILD/MIME-tools-5.415/blib/lib/MIME/Decoder/QuotedPrint.p
m line 74, near "shift)"
Compilation failed in require at t/Misc.t line 73.
BEGIN failed--compilation aborted at t/Misc.t line 73.
t/Misc...........dubious
        Test returned status 255 (wstat 65280, 0xff00)
t/Parser.........Can't locate object method "init" via package
"MIME::Decoder::QuotedPrint" at
/usr/src/packages/BUILD/MIME-tools-5.415/blib/lib/MIME/Decoder.pm line 179.
t/Parser.........dubious
        Test returned status 25 (wstat 6400, 0x1900)
DIED. FAILED tests 8-12
        Failed 5/12 tests, 58.33% okay
t/Ref............FAILED tests 5, 9, 13, 15, 21, 37
        Failed 6/50 tests, 88.00% okay
t/WordDecoder....ok
t/Words..........ok
Failed Test Stat Wstat Total Fail  Failed  List of Failed
----------------------------------------------------------------------------
---
t/Entity.t     9  2304    29   28  96.55%  16-29
t/Misc.t     255 65280    ??   ??       %  ??
t/Parser.t    25  6400    12   10  83.33%  8-12
t/Ref.t                   50    6  12.00%  5 9 13 15 21 37
Failed 4/10 test scripts, 60.00% okay. 25/217 subtests failed, 88.48% okay.
make: *** [test_dynamic] Error 255
error: Bad exit status from /var/tmp/rpm-tmp.9467 (%build)



If you notice in that error you see:

t/Entity.........Can't locate object method "init" via package
"MIME::Decoder::QuotedPrint" at
/usr/src/packages/BUILD/MIME-tools-5.415/blib/lib/MIME/Decoder.pm line 179.

That's the same error in the mail log.


And also I'm sure this has something to do with it too haha:

Warning: prerequisite MIME::Base64 3.03 not found. We have 2.12.


So I know I'm close.  I may have screwed this up installing all the perl
mods by hand but I did that because I was already getting this error so I
thought that would help.  I tried clean "name of mod" but I don't think that
deletes them.


If anyone can just help me figure this out I'd appreciate it greatly!!!


PS: Haven't tried installing all perl mods by hand then doing ./install.sh
nodeps or whatever.  That may not work neways.

Thanks.


--
NateDog

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mike at CAMAROSS.NET  Fri Nov  5 00:33:34 2004
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:27:29 2006
Subject: New Fresh Install Problems SuSE 9.1
Message-ID: <mailman.4333.1137101249.24926.mailscanner@lists.mailscanner.info>

Nathan P. wrote:
> Ok here's the quick and dirty of what has happened.
>
> We had power surge.  I'm a retard and forgot I didn't have it plugged
> into the UPS.
>
> Well, killed my friggin' hard drive!
>
> Nehoot.
>
> Before all this I was running SuSE 9.0 x86_64 and running mail
> scanner perfectly with no probs.
>
> I put in 2 new SATA drives using RAID mirroring and installed SuSE 9.1
> x86_64 with 2.6 kernel.
>
> Installing this version: MailScanner-4.35.9-1
>
> Install goes fine until the very very end.  Read further and you'll
> see the logged install error.
>
>
> I'm getting notice emails that have this:
> Report: MailScanner: Could not analyze message
>
> But it always seems to be coming from Outlook Express or Outlook
> email programs that get the error.  It doesn't do this on every
> email.  I could be wrong on the Outlook thing.  But I've even tried
> messing with tnef.  Turning it off or using /usr/bin/tnef and
> /usr/bin/file instead of internal.  But still same thing.
>
> Looking through the logs it's giving this error:
> MailScanner[16056]: Cannot parse
> /var/spool/MailScanner/incoming/16056/iA4MbdOj016065.header and ,
> Can't locate object method "init" via package
> "MIME::Decoder::QuotedPrint" at
> /usr/lib/perl5/site_perl/5.8.3/MIME/Decoder.pm line 179.
>
>
> I've tried all sorts of things - anything and everything I could
> think of related to MIME tools and decoder and tnef and all sorts of
> junk.  I would uninstall all rpms then I tried installing the perl
> mods by hand through:
> perl -MCPAN -e shell
>
> But still when I run install.sh I get this error:
>
> Attempting to build and install perl-MIME-tools-5.415-1 Installing
> perl-MIME-tools-5.415-1.src.rpm
> Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.9467
> + umask 022
> + cd /usr/src/packages/BUILD
> + cd /usr/src/packages/BUILD
> + rm -rf MIME-tools-5.415
> + /usr/bin/gzip -dc /usr/src/packages/SOURCES/MIME-tools-5.415.tar.gz
> + tar -xf -
> + STATUS=0
> + '[' 0 -ne 0 ']'
> + cd MIME-tools-5.415
> ++ /usr/bin/id -u
> + '[' 0 = 0 ']'
> + /bin/chown -Rhf root .
> ++ /usr/bin/id -u
> + '[' 0 = 0 ']'
> + /bin/chgrp -Rhf root .
> + /bin/chmod -Rf a+rX,g-w,o-w .
> + echo 'Patch #0 (mime-tools-5.415-patch1.txt):'
> Patch #0 (mime-tools-5.415-patch1.txt):
> + patch -p1 -s
> + exit 0
> Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.9467
> + umask 022
> + cd /usr/src/packages/BUILD
> + /bin/rm -rf /var/tmp/perl-MIME-tools-root
> ++ dirname /var/tmp/perl-MIME-tools-root
> + /bin/mkdir -p /var/tmp
> + /bin/mkdir /var/tmp/perl-MIME-tools-root cd MIME-tools-5.415
> + CFLAGS=-O2 -g
> + perl Makefile.PL PREFIX=/var/tmp/perl-MIME-tools-root/usr
> Checking if your kit is complete...
> Looks good
> Warning: prerequisite MIME::Base64 3.03 not found. We have 2.12.
> Writing Makefile for MIME-tools
> + make
> cp lib/MIME/Body.pm blib/lib/MIME/Body.pm cp
> lib/MIME/Decoder/Gzip64.pm blib/lib/MIME/Decoder/Gzip64.pm cp
> lib/MIME/Field/ContDisp.pm blib/lib/MIME/Field/ContDisp.pm cp
> set-version.pl blib/lib/set-version.pl cp lib/MIME/Parser/Results.pm
> blib/lib/MIME/Parser/Results.pm cp lib/MIME/Field/ContType.pm
> blib/lib/MIME/Field/ContType.pm cp lib/MIME/Decoder/NBit.pm
> blib/lib/MIME/Decoder/NBit.pm cp lib/MIME/Entity.pm
> blib/lib/MIME/Entity.pm cp lib/MIME/Head.pm blib/lib/MIME/Head.pm cp
> lib/MIME/Parser/Filer.pm blib/lib/MIME/Parser/Filer.pm cp
> lib/MIME/Words.pm blib/lib/MIME/Words.pm cp
> lib/MIME/Field/ParamVal.pm blib/lib/MIME/Field/ParamVal.pm cp
> lib/MIME/Decoder/BinHex.pm blib/lib/MIME/Decoder/BinHex.pm cp
> lib/MIME/Tools.pm blib/lib/MIME/Tools.pm cp
> lib/MIME/Field/ConTraEnc.pm blib/lib/MIME/Field/ConTraEnc.pm cp
> lib/MIME/Decoder/Binary.pm blib/lib/MIME/Decoder/Binary.pm cp
> lib/MIME/Decoder.pm blib/lib/MIME/Decoder.pm cp
> lib/MIME/Decoder/UU.pm blib/lib/MIME/Decoder/UU.pm cp
> lib/MIME/Decoder/Base64.pm blib/lib/MIME/Decoder/Base64.pm cp
> lib/MIME/Decoder/QuotedPrint.pm blib/lib/MIME/Decoder/QuotedPrint.pm
> cp lib/MIME/WordDecoder.pm blib/lib/MIME/WordDecoder.pm cp
> lib/MIME/Parser/Reader.pm blib/lib/MIME/Parser/Reader.pm cp
> lib/MIME/Parser.pm blib/lib/MIME/Parser.pm Manifying
> blib/man3/MIME::Decoder::Gzip64.3pm
> Manifying blib/man3/MIME::Body.3pm
> Manifying blib/man3/MIME::Field::ContDisp.3pm
> Manifying blib/man3/MIME::Parser::Results.3pm
> Manifying blib/man3/MIME::Field::ContType.3pm
> Manifying blib/man3/MIME::Decoder::NBit.3pm Manifying
> blib/man3/MIME::Entity.3pm Manifying
> blib/man3/MIME::Parser::Filer.3pm Manifying blib/man3/MIME::Head.3pm
> Manifying blib/man3/MIME::Words.3pm Manifying
> blib/man3/MIME::Field::ParamVal.3pm
> Manifying blib/man3/MIME::Decoder::BinHex.3pm
> Manifying blib/man3/MIME::Tools.3pm
> Manifying blib/man3/MIME::Field::ConTraEnc.3pm
> Manifying blib/man3/MIME::Decoder::Binary.3pm
> Manifying blib/man3/MIME::Decoder.3pm
> Manifying blib/man3/MIME::Decoder::UU.3pm Manifying
> blib/man3/MIME::Decoder::QuotedPrint.3pm
> Manifying blib/man3/MIME::Decoder::Base64.3pm
> Manifying blib/man3/MIME::WordDecoder.3pm Manifying
> blib/man3/MIME::Parser.3pm Manifying
> blib/man3/MIME::Parser::Reader.3pm + make test
> PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e"
> "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t t/Body...........ok
> t/Decoder........ok t/Entity.........Can't locate object method
> "init" via package "MIME::Decoder::QuotedPrint" at
> /usr/src/packages/BUILD/MIME-tools-5.415/blib/lib/MIME/Decoder.pm
> line 179.
> t/Entity.........dubious
>         Test returned status 9 (wstat 2304, 0x900) Scalar found where
> operator expected at (eval 155) line 1, near "'int' $__val"
>         (Missing operator before   $__val?)
> DIED. FAILED tests 16-29
>         Failed 14/29 tests, 51.72% okay
> t/Gauntlet.......ok
> t/Head...........ok
> t/Misc...........Too many arguments for MIME::QuotedPrint::encode_qp
> at
>
/usr/src/packages/BUILD/MIME-tools-5.415/blib/lib/MIME/Decoder/QuotedPrint.p
> m line 74, near "shift)"
> Compilation failed in require at t/Misc.t line 73.
> BEGIN failed--compilation aborted at t/Misc.t line 73.
> t/Misc...........dubious
>         Test returned status 255 (wstat 65280, 0xff00)
> t/Parser.........Can't locate object method "init" via package
> "MIME::Decoder::QuotedPrint" at
> /usr/src/packages/BUILD/MIME-tools-5.415/blib/lib/MIME/Decoder.pm
> line 179.
> t/Parser.........dubious
>         Test returned status 25 (wstat 6400, 0x1900) DIED. FAILED
>         tests 8-12 Failed 5/12 tests, 58.33% okay
> t/Ref............FAILED tests 5, 9, 13, 15, 21, 37
>         Failed 6/50 tests, 88.00% okay
> t/WordDecoder....ok
> t/Words..........ok
> Failed Test Stat Wstat Total Fail  Failed  List of Failed
>
----------------------------------------------------------------------------
> ---
> t/Entity.t     9  2304    29   28  96.55%  16-29
> t/Misc.t     255 65280    ??   ??       %  ??
> t/Parser.t    25  6400    12   10  83.33%  8-12
> t/Ref.t                   50    6  12.00%  5 9 13 15 21 37
> Failed 4/10 test scripts, 60.00% okay. 25/217 subtests failed, 88.48%
> okay.
> make: *** [test_dynamic] Error 255
> error: Bad exit status from /var/tmp/rpm-tmp.9467 (%build)
>
>
>
> If you notice in that error you see:
>
> t/Entity.........Can't locate object method "init" via package
> "MIME::Decoder::QuotedPrint" at
> /usr/src/packages/BUILD/MIME-tools-5.415/blib/lib/MIME/Decoder.pm
> line 179.
>
> That's the same error in the mail log.
>
>
> And also I'm sure this has something to do with it too haha:
>
> Warning: prerequisite MIME::Base64 3.03 not found. We have 2.12.
>
>
> So I know I'm close.  I may have screwed this up installing all the
> perl mods by hand but I did that because I was already getting this
> error so I thought that would help.  I tried clean "name of mod" but
> I don't think that deletes them.
>
>
> If anyone can just help me figure this out I'd appreciate it
> greatly!!!
>
>
> PS: Haven't tried installing all perl mods by hand then doing
> ./install.sh nodeps or whatever.  That may not work neways.
>
> Thanks.

Can you rebuild the MIME::Base64 src.rpm and install it manually?

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From natedog550 at HOTMAIL.COM  Fri Nov  5 01:50:33 2004
From: natedog550 at HOTMAIL.COM (Nathan P.)
Date: Thu Jan 12 21:27:29 2006
Subject: New Fresh Install Problems SuSE 9.1
Message-ID: <mailman.4334.1137101249.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

----- Original Message -----
From: "Mike Kercher" <mike@CAMAROSS.NET>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Thursday, November 04, 2004 6:33 PM
Subject: Re: New Fresh Install Problems SuSE 9.1


> Nathan P. wrote:
> > Ok here's the quick and dirty of what has happened.
> >
> > We had power surge.  I'm a retard and forgot I didn't have it plugged
> > into the UPS.
> >
> > Well, killed my friggin' hard drive!
> >
> > Nehoot.
> >
> > Before all this I was running SuSE 9.0 x86_64 and running mail
> > scanner perfectly with no probs.
> >
> > I put in 2 new SATA drives using RAID mirroring and installed SuSE 9.1
> > x86_64 with 2.6 kernel.
> >
> > Installing this version: MailScanner-4.35.9-1
> >
> > Install goes fine until the very very end.  Read further and you'll
> > see the logged install error.
> >
> >
> > I'm getting notice emails that have this:
> > Report: MailScanner: Could not analyze message
> >
> > But it always seems to be coming from Outlook Express or Outlook
> > email programs that get the error.  It doesn't do this on every
> > email.  I could be wrong on the Outlook thing.  But I've even tried
> > messing with tnef.  Turning it off or using /usr/bin/tnef and
> > /usr/bin/file instead of internal.  But still same thing.
> >
> > Looking through the logs it's giving this error:
> > MailScanner[16056]: Cannot parse
> > /var/spool/MailScanner/incoming/16056/iA4MbdOj016065.header and ,
> > Can't locate object method "init" via package
> > "MIME::Decoder::QuotedPrint" at
> > /usr/lib/perl5/site_perl/5.8.3/MIME/Decoder.pm line 179.
> >
> >
> > I've tried all sorts of things - anything and everything I could
> > think of related to MIME tools and decoder and tnef and all sorts of
> > junk.  I would uninstall all rpms then I tried installing the perl
> > mods by hand through:
> > perl -MCPAN -e shell
> >
> > But still when I run install.sh I get this error:
> >
> > Attempting to build and install perl-MIME-tools-5.415-1 Installing
> > perl-MIME-tools-5.415-1.src.rpm
> > Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.9467
> > + umask 022
> > + cd /usr/src/packages/BUILD
> > + cd /usr/src/packages/BUILD
> > + rm -rf MIME-tools-5.415
> > + /usr/bin/gzip -dc /usr/src/packages/SOURCES/MIME-tools-5.415.tar.gz
> > + tar -xf -
> > + STATUS=0
> > + '[' 0 -ne 0 ']'
> > + cd MIME-tools-5.415
> > ++ /usr/bin/id -u
> > + '[' 0 = 0 ']'
> > + /bin/chown -Rhf root .
> > ++ /usr/bin/id -u
> > + '[' 0 = 0 ']'
> > + /bin/chgrp -Rhf root .
> > + /bin/chmod -Rf a+rX,g-w,o-w .
> > + echo 'Patch #0 (mime-tools-5.415-patch1.txt):'
> > Patch #0 (mime-tools-5.415-patch1.txt):
> > + patch -p1 -s
> > + exit 0
> > Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.9467
> > + umask 022
> > + cd /usr/src/packages/BUILD
> > + /bin/rm -rf /var/tmp/perl-MIME-tools-root
> > ++ dirname /var/tmp/perl-MIME-tools-root
> > + /bin/mkdir -p /var/tmp
> > + /bin/mkdir /var/tmp/perl-MIME-tools-root cd MIME-tools-5.415
> > + CFLAGS=-O2 -g
> > + perl Makefile.PL PREFIX=/var/tmp/perl-MIME-tools-root/usr
> > Checking if your kit is complete...
> > Looks good
> > Warning: prerequisite MIME::Base64 3.03 not found. We have 2.12.
> > Writing Makefile for MIME-tools
> > + make
> > cp lib/MIME/Body.pm blib/lib/MIME/Body.pm cp
> > lib/MIME/Decoder/Gzip64.pm blib/lib/MIME/Decoder/Gzip64.pm cp
> > lib/MIME/Field/ContDisp.pm blib/lib/MIME/Field/ContDisp.pm cp
> > set-version.pl blib/lib/set-version.pl cp lib/MIME/Parser/Results.pm
> > blib/lib/MIME/Parser/Results.pm cp lib/MIME/Field/ContType.pm
> > blib/lib/MIME/Field/ContType.pm cp lib/MIME/Decoder/NBit.pm
> > blib/lib/MIME/Decoder/NBit.pm cp lib/MIME/Entity.pm
> > blib/lib/MIME/Entity.pm cp lib/MIME/Head.pm blib/lib/MIME/Head.pm cp
> > lib/MIME/Parser/Filer.pm blib/lib/MIME/Parser/Filer.pm cp
> > lib/MIME/Words.pm blib/lib/MIME/Words.pm cp
> > lib/MIME/Field/ParamVal.pm blib/lib/MIME/Field/ParamVal.pm cp
> > lib/MIME/Decoder/BinHex.pm blib/lib/MIME/Decoder/BinHex.pm cp
> > lib/MIME/Tools.pm blib/lib/MIME/Tools.pm cp
> > lib/MIME/Field/ConTraEnc.pm blib/lib/MIME/Field/ConTraEnc.pm cp
> > lib/MIME/Decoder/Binary.pm blib/lib/MIME/Decoder/Binary.pm cp
> > lib/MIME/Decoder.pm blib/lib/MIME/Decoder.pm cp
> > lib/MIME/Decoder/UU.pm blib/lib/MIME/Decoder/UU.pm cp
> > lib/MIME/Decoder/Base64.pm blib/lib/MIME/Decoder/Base64.pm cp
> > lib/MIME/Decoder/QuotedPrint.pm blib/lib/MIME/Decoder/QuotedPrint.pm
> > cp lib/MIME/WordDecoder.pm blib/lib/MIME/WordDecoder.pm cp
> > lib/MIME/Parser/Reader.pm blib/lib/MIME/Parser/Reader.pm cp
> > lib/MIME/Parser.pm blib/lib/MIME/Parser.pm Manifying
> > blib/man3/MIME::Decoder::Gzip64.3pm
> > Manifying blib/man3/MIME::Body.3pm
> > Manifying blib/man3/MIME::Field::ContDisp.3pm
> > Manifying blib/man3/MIME::Parser::Results.3pm
> > Manifying blib/man3/MIME::Field::ContType.3pm
> > Manifying blib/man3/MIME::Decoder::NBit.3pm Manifying
> > blib/man3/MIME::Entity.3pm Manifying
> > blib/man3/MIME::Parser::Filer.3pm Manifying blib/man3/MIME::Head.3pm
> > Manifying blib/man3/MIME::Words.3pm Manifying
> > blib/man3/MIME::Field::ParamVal.3pm
> > Manifying blib/man3/MIME::Decoder::BinHex.3pm
> > Manifying blib/man3/MIME::Tools.3pm
> > Manifying blib/man3/MIME::Field::ConTraEnc.3pm
> > Manifying blib/man3/MIME::Decoder::Binary.3pm
> > Manifying blib/man3/MIME::Decoder.3pm
> > Manifying blib/man3/MIME::Decoder::UU.3pm Manifying
> > blib/man3/MIME::Decoder::QuotedPrint.3pm
> > Manifying blib/man3/MIME::Decoder::Base64.3pm
> > Manifying blib/man3/MIME::WordDecoder.3pm Manifying
> > blib/man3/MIME::Parser.3pm Manifying
> > blib/man3/MIME::Parser::Reader.3pm + make test
> > PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e"
> > "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t t/Body...........ok
> > t/Decoder........ok t/Entity.........Can't locate object method
> > "init" via package "MIME::Decoder::QuotedPrint" at
> > /usr/src/packages/BUILD/MIME-tools-5.415/blib/lib/MIME/Decoder.pm
> > line 179.
> > t/Entity.........dubious
> >         Test returned status 9 (wstat 2304, 0x900) Scalar found where
> > operator expected at (eval 155) line 1, near "'int' $__val"
> >         (Missing operator before   $__val?)
> > DIED. FAILED tests 16-29
> >         Failed 14/29 tests, 51.72% okay
> > t/Gauntlet.......ok
> > t/Head...........ok
> > t/Misc...........Too many arguments for MIME::QuotedPrint::encode_qp
> > at
> >
>
/usr/src/packages/BUILD/MIME-tools-5.415/blib/lib/MIME/Decoder/QuotedPrint.p
> > m line 74, near "shift)"
> > Compilation failed in require at t/Misc.t line 73.
> > BEGIN failed--compilation aborted at t/Misc.t line 73.
> > t/Misc...........dubious
> >         Test returned status 255 (wstat 65280, 0xff00)
> > t/Parser.........Can't locate object method "init" via package
> > "MIME::Decoder::QuotedPrint" at
> > /usr/src/packages/BUILD/MIME-tools-5.415/blib/lib/MIME/Decoder.pm
> > line 179.
> > t/Parser.........dubious
> >         Test returned status 25 (wstat 6400, 0x1900) DIED. FAILED
> >         tests 8-12 Failed 5/12 tests, 58.33% okay
> > t/Ref............FAILED tests 5, 9, 13, 15, 21, 37
> >         Failed 6/50 tests, 88.00% okay
> > t/WordDecoder....ok
> > t/Words..........ok
> > Failed Test Stat Wstat Total Fail  Failed  List of Failed
> >
> --------------------------------------------------------------------------
--
> > ---
> > t/Entity.t     9  2304    29   28  96.55%  16-29
> > t/Misc.t     255 65280    ??   ??       %  ??
> > t/Parser.t    25  6400    12   10  83.33%  8-12
> > t/Ref.t                   50    6  12.00%  5 9 13 15 21 37
> > Failed 4/10 test scripts, 60.00% okay. 25/217 subtests failed, 88.48%
> > okay.
> > make: *** [test_dynamic] Error 255
> > error: Bad exit status from /var/tmp/rpm-tmp.9467 (%build)
> >
> >
> >
> > If you notice in that error you see:
> >
> > t/Entity.........Can't locate object method "init" via package
> > "MIME::Decoder::QuotedPrint" at
> > /usr/src/packages/BUILD/MIME-tools-5.415/blib/lib/MIME/Decoder.pm
> > line 179.
> >
> > That's the same error in the mail log.
> >
> >
> > And also I'm sure this has something to do with it too haha:
> >
> > Warning: prerequisite MIME::Base64 3.03 not found. We have 2.12.
> >
> >
> > So I know I'm close.  I may have screwed this up installing all the
> > perl mods by hand but I did that because I was already getting this
> > error so I thought that would help.  I tried clean "name of mod" but
> > I don't think that deletes them.
> >
> >
> > If anyone can just help me figure this out I'd appreciate it
> > greatly!!!
> >
> >
> > PS: Haven't tried installing all perl mods by hand then doing
> > ./install.sh nodeps or whatever.  That may not work neways.
> >
> > Thanks.
>
> Can you rebuild the MIME::Base64 src.rpm and install it manually?
>
> Mike


You wouldn't happen to know the "correct" way to do it on SuSE would you?
I've rebuilt src rpms once before a long time ago but I foget how to do it.

Before I do some googling does anyone know the way to do it in SuSE?

Thanks a lot for your reply.

--
NateDog

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mike at CAMAROSS.NET  Fri Nov  5 02:21:21 2004
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:27:29 2006
Subject: New Fresh Install Problems SuSE 9.1
Message-ID: <mailman.4335.1137101249.24926.mailscanner@lists.mailscanner.info>

Nathan P. wrote:
> ----- Original Message -----
> From: "Mike Kercher" <mike@CAMAROSS.NET>
> To: <MAILSCANNER@JISCMAIL.AC.UK>
> Sent: Thursday, November 04, 2004 6:33 PM
> Subject: Re: New Fresh Install Problems SuSE 9.1
>
>
>> Nathan P. wrote:
>>> Ok here's the quick and dirty of what has happened.
>>>
>>> We had power surge.  I'm a retard and forgot I didn't have it
>>> plugged into the UPS.
>>>
>>> Well, killed my friggin' hard drive!
>>>
>>> Nehoot.
>>>
>>> Before all this I was running SuSE 9.0 x86_64 and running mail
>>> scanner perfectly with no probs.
>>>
>>> I put in 2 new SATA drives using RAID mirroring and installed SuSE
>>> 9.1
>>> x86_64 with 2.6 kernel.
>>>
>>> Installing this version: MailScanner-4.35.9-1
>>>
>>> Install goes fine until the very very end.  Read further and you'll
>>> see the logged install error.
>>>
>>>
>>> I'm getting notice emails that have this:
>>> Report: MailScanner: Could not analyze message
>>>
>>> But it always seems to be coming from Outlook Express or Outlook
>>> email programs that get the error.  It doesn't do this on every
>>> email.  I could be wrong on the Outlook thing.  But I've even tried
>>> messing with tnef.  Turning it off or using /usr/bin/tnef and
>>> /usr/bin/file instead of internal.  But still same thing.
>>>
>>> Looking through the logs it's giving this error:
>>> MailScanner[16056]: Cannot parse
>>> /var/spool/MailScanner/incoming/16056/iA4MbdOj016065.header and ,
>>> Can't locate object method "init" via package
>>> "MIME::Decoder::QuotedPrint" at
>>> /usr/lib/perl5/site_perl/5.8.3/MIME/Decoder.pm line 179.
>>>
>>>
>>> I've tried all sorts of things - anything and everything I could
>>> think of related to MIME tools and decoder and tnef and all sorts of
>>> junk.  I would uninstall all rpms then I tried installing the perl
>>> mods by hand through: perl -MCPAN -e shell
>>>
>>> But still when I run install.sh I get this error:
>>>
>>> Attempting to build and install perl-MIME-tools-5.415-1 Installing
>>> perl-MIME-tools-5.415-1.src.rpm
>>> Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.9467
>>> + umask 022
>>> + cd /usr/src/packages/BUILD
>>> + cd /usr/src/packages/BUILD
>>> + rm -rf MIME-tools-5.415
>>> + /usr/bin/gzip -dc
>>> + /usr/src/packages/SOURCES/MIME-tools-5.415.tar.gz + tar -xf -
>>> + STATUS=0
>>> + '[' 0 -ne 0 ']'
>>> + cd MIME-tools-5.415
>>> ++ /usr/bin/id -u
>>> + '[' 0 = 0 ']'
>>> + /bin/chown -Rhf root .
>>> ++ /usr/bin/id -u
>>> + '[' 0 = 0 ']'
>>> + /bin/chgrp -Rhf root .
>>> + /bin/chmod -Rf a+rX,g-w,o-w .
>>> + echo 'Patch #0 (mime-tools-5.415-patch1.txt):'
>>> Patch #0 (mime-tools-5.415-patch1.txt):
>>> + patch -p1 -s
>>> + exit 0
>>> Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.9467 + umask 022
>>> + cd /usr/src/packages/BUILD
>>> + /bin/rm -rf /var/tmp/perl-MIME-tools-root
>>> ++ dirname /var/tmp/perl-MIME-tools-root
>>> + /bin/mkdir -p /var/tmp
>>> + /bin/mkdir /var/tmp/perl-MIME-tools-root cd MIME-tools-5.415 +
>>> CFLAGS=-O2 -g + perl Makefile.PL
>>> PREFIX=/var/tmp/perl-MIME-tools-root/usr Checking if your kit is
>>> complete...
>>> Looks good
>>> Warning: prerequisite MIME::Base64 3.03 not found. We have 2.12.
>>> Writing Makefile for MIME-tools
>>> + make
>>> cp lib/MIME/Body.pm blib/lib/MIME/Body.pm cp
>>> lib/MIME/Decoder/Gzip64.pm blib/lib/MIME/Decoder/Gzip64.pm cp
>>> lib/MIME/Field/ContDisp.pm blib/lib/MIME/Field/ContDisp.pm cp
>>> set-version.pl blib/lib/set-version.pl cp lib/MIME/Parser/Results.pm
>>> blib/lib/MIME/Parser/Results.pm cp lib/MIME/Field/ContType.pm
>>> blib/lib/MIME/Field/ContType.pm cp lib/MIME/Decoder/NBit.pm
>>> blib/lib/MIME/Decoder/NBit.pm cp lib/MIME/Entity.pm
>>> blib/lib/MIME/Entity.pm cp lib/MIME/Head.pm blib/lib/MIME/Head.pm cp
>>> lib/MIME/Parser/Filer.pm blib/lib/MIME/Parser/Filer.pm cp
>>> lib/MIME/Words.pm blib/lib/MIME/Words.pm cp
>>> lib/MIME/Field/ParamVal.pm blib/lib/MIME/Field/ParamVal.pm cp
>>> lib/MIME/Decoder/BinHex.pm blib/lib/MIME/Decoder/BinHex.pm cp
>>> lib/MIME/Tools.pm blib/lib/MIME/Tools.pm cp
>>> lib/MIME/Field/ConTraEnc.pm blib/lib/MIME/Field/ConTraEnc.pm cp
>>> lib/MIME/Decoder/Binary.pm blib/lib/MIME/Decoder/Binary.pm cp
>>> lib/MIME/Decoder.pm blib/lib/MIME/Decoder.pm cp
>>> lib/MIME/Decoder/UU.pm blib/lib/MIME/Decoder/UU.pm cp
>>> lib/MIME/Decoder/Base64.pm blib/lib/MIME/Decoder/Base64.pm cp
>>> lib/MIME/Decoder/QuotedPrint.pm blib/lib/MIME/Decoder/QuotedPrint.pm
>>> cp lib/MIME/WordDecoder.pm blib/lib/MIME/WordDecoder.pm cp
>>> lib/MIME/Parser/Reader.pm blib/lib/MIME/Parser/Reader.pm cp
>>> lib/MIME/Parser.pm blib/lib/MIME/Parser.pm Manifying
>>> blib/man3/MIME::Decoder::Gzip64.3pm
>>> Manifying blib/man3/MIME::Body.3pm
>>> Manifying blib/man3/MIME::Field::ContDisp.3pm
>>> Manifying blib/man3/MIME::Parser::Results.3pm
>>> Manifying blib/man3/MIME::Field::ContType.3pm
>>> Manifying blib/man3/MIME::Decoder::NBit.3pm Manifying
>>> blib/man3/MIME::Entity.3pm Manifying
>>> blib/man3/MIME::Parser::Filer.3pm Manifying blib/man3/MIME::Head.3pm
>>> Manifying blib/man3/MIME::Words.3pm Manifying
>>> blib/man3/MIME::Field::ParamVal.3pm
>>> Manifying blib/man3/MIME::Decoder::BinHex.3pm
>>> Manifying blib/man3/MIME::Tools.3pm
>>> Manifying blib/man3/MIME::Field::ConTraEnc.3pm
>>> Manifying blib/man3/MIME::Decoder::Binary.3pm
>>> Manifying blib/man3/MIME::Decoder.3pm Manifying
>>> blib/man3/MIME::Decoder::UU.3pm Manifying
>>> blib/man3/MIME::Decoder::QuotedPrint.3pm
>>> Manifying blib/man3/MIME::Decoder::Base64.3pm
>>> Manifying blib/man3/MIME::WordDecoder.3pm Manifying
>>> blib/man3/MIME::Parser.3pm Manifying
>>> blib/man3/MIME::Parser::Reader.3pm + make test
>>> PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e"
>>> "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t t/Body...........ok
>>> t/Decoder........ok t/Entity.........Can't locate object method
>>> "init" via package "MIME::Decoder::QuotedPrint" at
>>> /usr/src/packages/BUILD/MIME-tools-5.415/blib/lib/MIME/Decoder.pm
>>> line 179. t/Entity.........dubious
>>>         Test returned status 9 (wstat 2304, 0x900) Scalar found
>>> where operator expected at (eval 155) line 1, near "'int' $__val"
>>>         (Missing operator before   $__val?)
>>> DIED. FAILED tests 16-29
>>>         Failed 14/29 tests, 51.72% okay t/Gauntlet.......ok
>>> t/Head...........ok t/Misc...........Too many arguments for
>>> MIME::QuotedPrint::encode_qp at
>>>
>>
>
/usr/src/packages/BUILD/MIME-tools-5.415/blib/lib/MIME/Decoder/QuotedPrint.p
>>> m line 74, near "shift)"
>>> Compilation failed in require at t/Misc.t line 73.
>>> BEGIN failed--compilation aborted at t/Misc.t line 73.
>>>         t/Misc...........dubious Test returned status 255 (wstat
>>> 65280, 0xff00) t/Parser.........Can't locate object method "init"
>>> via package "MIME::Decoder::QuotedPrint" at
>>> /usr/src/packages/BUILD/MIME-tools-5.415/blib/lib/MIME/Decoder.pm
>>> line 179. t/Parser.........dubious
>>>         Test returned status 25 (wstat 6400, 0x1900) DIED. FAILED
>>>         tests 8-12 Failed 5/12 tests, 58.33% okay
>>> t/Ref............FAILED tests 5, 9, 13, 15, 21, 37
>>>         Failed 6/50 tests, 88.00% okay t/WordDecoder....ok
>>> t/Words..........ok Failed Test Stat Wstat Total Fail  Failed  List
>>> of Failed
>>>
>> ----------------------------------------------------------------------
>> ----
> --
>>> ---
>>> t/Entity.t     9  2304    29   28  96.55%  16-29
>>> t/Misc.t     255 65280    ??   ??       %  ??
>>> t/Parser.t    25  6400    12   10  83.33%  8-12
>>> t/Ref.t                   50    6  12.00%  5 9 13 15 21 37
>>> Failed 4/10 test scripts, 60.00% okay. 25/217 subtests failed,
>>> 88.48% okay.
>>> make: *** [test_dynamic] Error 255
>>> error: Bad exit status from /var/tmp/rpm-tmp.9467 (%build)
>>>
>>>
>>>
>>> If you notice in that error you see:
>>>
>>> t/Entity.........Can't locate object method "init" via package
>>> "MIME::Decoder::QuotedPrint" at
>>> /usr/src/packages/BUILD/MIME-tools-5.415/blib/lib/MIME/Decoder.pm
>>> line 179.
>>>
>>> That's the same error in the mail log.
>>>
>>>
>>> And also I'm sure this has something to do with it too haha:
>>>
>>> Warning: prerequisite MIME::Base64 3.03 not found. We have 2.12.
>>>
>>>
>>> So I know I'm close.  I may have screwed this up installing all the
>>> perl mods by hand but I did that because I was already getting this
>>> error so I thought that would help.  I tried clean "name of mod" but
>>> I don't think that deletes them.
>>>
>>>
>>> If anyone can just help me figure this out I'd appreciate it
>>> greatly!!!
>>>
>>>
>>> PS: Haven't tried installing all perl mods by hand then doing
>>> ./install.sh nodeps or whatever.  That may not work neways.
>>>
>>> Thanks.
>>
>> Can you rebuild the MIME::Base64 src.rpm and install it manually?
>>
>> Mike
>
>
> You wouldn't happen to know the "correct" way to do it on SuSE would
> you? I've rebuilt src rpms once before a long time ago but I foget
> how to do it.
>
> Before I do some googling does anyone know the way to do it in SuSE?
>
> Thanks a lot for your reply.


I run Redhat EL and variants thereof.  On these boxen, you'd run something
like:

rpmbuild --rebuild filename.src.rpm

Older versions of Redhat were:

rpm --rebuild xxx.src.rpm

The only SuSE box I have is OpenExchange and I don't tinker with it too
much...rather fragile :)

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mike at ZANKER.ORG  Fri Nov  5 06:37:43 2004
From: mike at ZANKER.ORG (Mike Zanker)
Date: Thu Jan 12 21:27:29 2006
Subject: New Fresh Install Problems SuSE 9.1
Message-ID: <mailman.4336.1137101249.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Nathan P. wrote:

> You wouldn't happen to know the "correct" way to do it on SuSE would you?
> I've rebuilt src rpms once before a long time ago but I foget how to do it.
>
> Before I do some googling does anyone know the way to do it in SuSE?

 From Julian's post of two days ago:

cd MailScanner-4.35.9-1
rpm -Uvh perl-MIME-Base64-3.05-2.src.rpm
pushd /usr/src/packages/SPECS
rpmbuild -bp perl-MIME-Base64.spec
cd ../BUILD
cd perl-MIME-Base64-3.05
perl Makefile.PL
make
make test
make install
popd
./install.sh fast

Also, can people *please* trim their quoting? Having to wade through
pages of previous message for *one* line is ridiculous :(

Mike.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at BARENDSE.TO  Fri Nov  5 08:11:43 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:29 2006
Subject: SURBL not working properly in MailScanner 4.35.9
Message-ID: <mailman.4337.1137101249.24926.mailscanner@lists.mailscanner.info>

On Wed, 3 Nov 2004, Alden Levy wrote:

> I've got the proper syntax, because it works when I load up my
> /etc/MailScanner/spam.assassin.prefs.conf with the contents of init.pre and
> 25_uribl.cf, and the same files worked before my recent software upgrade.
> My init.pre is already in /etc/mail/spamassassin as I was one of the
> beneficiaries (if not one of the posters) or the thread Jeff referred to.
>
> I've already tried the SURBL list; they suggested I try the SA list.  I
> decided to try this list first, as SA seems to work without MS.
>
> In any event, it's working now (with init.pre and 25_uribl.cf in my
> spam.assassin.prefs.conf file), but I wonder if something more is broken.

Interesting, I have the same problem on one box, no matter what I do it's
not working. The files that were discussed earlier on this klist are all
in the correct place (Funny enough I installed 2 boxes right after each
other using the same set of installation cd's and tarballs. One box is
working flawlessly, the other one isn't).

Would you mind sharing how to put init.pre and 25_uribl.c in
spam.assassin.prefs.conf file ?

Thanks!


>
> Thanks,
> Alden
>
> On Wed, 3 Nov 2004 16:28:22 +0000, Martin Hepworth
> <martinh@SOLID-STATE-LOGIC.COM> wrote:
>
>> Alden
>>
>> the surbl stuff is built-in to SA 3.0 (and turned on by default if you
>> have networks tests on and a valid DNS perl module). Have a check on the
>> SA or surbl.org web sites to check for correct syntax/module versions etc.
>>
>> --
>> Martin Hepworth
>> Snr Systems Administrator
>> Solid State Logic
>> Tel: +44 (0)1865 842300
>>
>> Jeff Earickson wrote:
>> Several of us beat on heads on this one a couple of weeks ago, check
>> the list archives.  The quick answer is to track down the init.pre
>> file that SA 3.0 installs in some weird place (like /etc/opt) and
>> get it moved to /etc/mail/spamassassin.
>>
>> Jeff Earickson
>> Colby College
>>
>> Alden Levy wrote:
>>> Last week, I upgraded my server to FC1 (from RH 7.3).  Sendmail, Ensim, and
>>> perl also got upgraded (to 8.12.x, 4.02, 5.8.1, respectively).
>>>
>>> Before the upgrade, everything worked well with SA 3.0.0 and MaliScanner
>>> 4.34.  Now, SURBL doesn't work unless I do some really strange things.  I've
>>> reinstalled SA, MS, and ClamAV, but no joy. I've since upgraded to SA 3.0.1,
>>> MS 4.35.9 and Mail::ClamAV 0.13. I already had ClamAV 0.80 installed.
>>>
>>> spamassassin -D --lint works fine, and when I test spamassassin with a SURBL
>>> URL, it gives the expected output. I don't get hits with MailScanner running
>>> unless I put the contents of pre.init AND 25_uribl.cf into my
>>> spam.assassin.prefs.conf (which has a link from local.cf).
>>>
>>> And my mail logs look fine, i.e., no errors, no MS restarts, etc. Just no
>>> SURBL unless I put init.pre and 25_uribl.cf inside spam.assassin.prefs. Has
>>> anyone seen anything like this?
>>>
>>> Any help would be appreciated.
>>>
>>> Thanks,
>>> Alden
>>>
>>> Alden Levy
>>> Engine No. 9, Inc.
>>> 130 W. 57th Street, Suite 12E
>>> New York, NY 10019
>>> (212) 981-1122
>>> (212) 725-7202 fax
>>>
>>> ------------------------ MailScanner list ------------------------
>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>> 'leave mailscanner' in the body of the email.
>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>> **********************************************************************
>>
>> This email and any files transmitted with it are confidential and
>> intended solely for the use of the individual or entity to whom they
>> are addressed. If you have received this email in error please notify
>> the system manager.
>>
>> This footnote confirms that this email message has been swept
>> for the presence of computer viruses and is believed to be clean.
>>
>> **********************************************************************
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From p.g.m.peters at utwente.nl  Fri Nov  5 08:27:39 2004
From: p.g.m.peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:27:29 2006
Subject: Too many attachments
Message-ID: <mailman.4338.1137101249.24926.mailscanner@lists.mailscanner.info>

On Thu, 4 Nov 2004 11:11:49 -0600, you wrote:

>What is suppose to happen with messages that are found to have "Too
>many attachments" as defined by the "Maximum Attachments Per
>Message =" setting?

As far as I can remember (I have had a few of those) they are put in
quarantaine (if you configure quarantaine). At least I remember sending
that message onwards from quarantaine when it happened.

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/itbe

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Kevin.Spicer at BMRB.CO.UK  Fri Nov  5 08:57:36 2004
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin (MBLEA it))
Date: Thu Jan 12 21:27:29 2006
Subject: MailScanner Multiple Recipients from Perl Scripts
Message-ID: <mailman.4339.1137101249.24926.mailscanner@lists.mailscanner.info>

-----Original Message-----
From: Stephen Conway [mailto:sconway@wlnet.com]

>I have noticed that when running MailScanner, if you try to send an
SMTP message from 
>within an external perl script where you send to multiple recipients ,
ex:


>
$recipient="recip1@domain.com,recip2@domain2.com,recip3@domain3.com";
>    $smtp->recipient($recipient);
 
That is wrong, as its like doing
$smtp->recipient("recip1@domain.com,recip2@domain2.com,recip3@domain3.co
m");

Which is 'BAD' (reference
http://search.cpan.org/~gbarr/libnet-1.19/Net/SMTP.pm"

Instead do...
@recipients=(qw(recip1@domain.com recip2@domain2.com
recip3@domain3.com));
$smtp->recipient(@recipients);



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From martinh at SOLID-STATE-LOGIC.COM  Fri Nov  5 09:17:14 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:29 2006
Subject: Minimum attachment size...
Message-ID: <mailman.4340.1137101249.24926.mailscanner@lists.mailscanner.info>

Julian

Just to let you know it seems to be working here now (4.35.11). Trapped
a few empty attachments from our ERP which got me worried, but on
investigation it was correct, the ERP had produced a null file attached
it and emailed it anyway.

So a little side effect is our suppliers won't be getting spammed by us
when there is nothing to order!

Thanks for all your hard work. One day we'll meet and I'll buy you that
pint of fizzy coke I keep promising :-)
--
Martin Hepworth
Senior Systems Administrator
Solid State Logic Ltd
tel: +44 (0)1865 842300



**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Jan-Peter.Koopmann at SECEIDOS.DE  Fri Nov  5 09:26:56 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:29 2006
Subject: SURBL not working properly in MailScanner 4.35.9
Message-ID: <mailman.4341.1137101249.24926.mailscanner@lists.mailscanner.info>

On Friday, November 05, 2004 9:12 AM MailScanner mailing list wrote:

> Would you mind sharing how to put init.pre and 25_uribl.c in
> spam.assassin.prefs.conf file ?

There is no need for putting anything in spam.assassin.prefs.conf as far
as I know. If you have 

loadplugin Mail::SpamAssassin::Plugin::URIDNSBL

in your init.pre that should be sufficient. Please run a testmessage
through spamassassin with the debugging option

spamassassin -D < testmessage

and analyze the output. It did not work here at first until I figured
out that Net::DNS was either not installed or the wrong version (can't
remember). The debug log should show you though.

Kind regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From maillists at CONACTIVE.COM  Fri Nov  5 13:31:25 2004
From: maillists at CONACTIVE.COM (Kai Schaetzl)
Date: Thu Jan 12 21:27:29 2006
Subject: Phishing phailure
Message-ID: <mailman.4342.1137101249.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Martin Sapsed wrote on         Thu, 4 Nov 2004 16:44:42 +0000:

> By your system and by Julian's, yes, but not by mine! Those red bits 
> weren't in the message I sent.
>


I looked in your attachment and it doesn't contain any HTML here. Could 
be that our MailScanner stripped that (as I have ordered it to do) or 
that your MailScanner does the same thing? I assume that the check is 
done *before* any stripping, but if not, then detection may fail in 
such a case. I agree the possibility is small, but I wanted to mention 
it.


Kai

-- 

Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com
IE-Center: http://ie5.de & http://msie.winware.org

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From BBerglund at TECHPRO.COM  Fri Nov  5 14:43:30 2004
From: BBerglund at TECHPRO.COM (Brian Berglund)
Date: Thu Jan 12 21:27:29 2006
Subject: Error starting lastest version of Mailscanner
Message-ID: <mailman.4343.1137101249.24926.mailscanner@lists.mailscanner.info>

I upgraded Mailscanner from 4.34.8 - 4.35.11
When I try to start Mailscanner service, I get
Starting MailScanner daemons:
         incoming postfix:                                 [  OK  ]
         outgoing postfix:                                 [  OK  ]
         MailScanner:       Can't locate MIME/Parser.pm in @INC (@INC
contains: /usr/lib/MailScanner/5.8.3/i386-linux-thread-multi
/usr/lib/MailScanner/5.8.3 /usr/lib/MailScanner/i386-linux-thread-multi
/usr/lib/MailScanner/5.8.2 /usr/lib/MailScanner/5.8.1
/usr/lib/MailScanner/5.8.0 /usr/lib/MailScanner
/usr/lib/perl5/5.8.3/i386-linux-thread-multi /usr/lib/perl5/5.8.3
/usr/lib/perl5/site_perl/5.8.3/i386-linux-thread-multi
/usr/lib/perl5/site_perl/5.8.2/i386-linux-thread-multi
/usr/lib/perl5/site_perl/5.8.1/i386-linux-thread-multi
/usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi
/usr/lib/perl5/site_perl/5.8.3 /usr/lib/perl5/site_perl/5.8.2
/usr/lib/perl5/site_perl/5.8.1 /usr/lib/perl5/site_perl/5.8.0
/usr/lib/perl5/site_perl
/usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi
/usr/lib/perl5/vendor_perl/5.8.2/i386-linux-thread-multi
/usr/lib/perl5/vendor_perl/5.8.1/i386-linux-thread-multi
/usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi
/usr/lib/perl5/vendor_perl/5.8.3 /usr/lib/perl5/vendor_perl/5.8.2
/usr/lib/perl5/vendor_perl/5.8.1 /usr/lib/perl5/vendor_perl/5.8.0
/usr/lib/perl5/vendor_perl .
/usr/lib/MailScanner/5.8.3/i386-linux-thread-multi
/usr/lib/MailScanner/5.8.3 /usr/lib/MailScanner/i386-linux-thread-multi
/usr/lib/MailScanner/5.8.2 /usr/lib/MailScanner/5.8.1
/usr/lib/MailScanner/5.8.0 /usr/lib/MailScanner) at
/usr/lib/MailScanner/MailScanner/MCPMessage.pm line 40.
BEGIN failed--compilation aborted at
/usr/lib/MailScanner/MailScanner/MCPMessage.pm line 40.
Compilation failed in require at /usr/sbin/MailScanner line 73.
BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 73.
                                                           [  OK  ]
I think the reason is because I have version 5.8.5 for Perl installed. 
Where do you change the lib paths that Mailscanner checks on?
 
 
Brian Berglund
Engineer
bberglund@techpro.com
----------------------------------------------------------
[IMAGE] Direct Line: 630 .938 .5303
Direct Fax: 630 .845 .4603
Toll Free: 800 .262 .0537 ext.103
318 Anderson Boulevard
Geneva, IL 60134
----------------------------------------------------------
w w w . t e c h p r o . c o m


TechPro E-Mail Disclaimer
The information contained in this e-mail and any accompanying documents
is confidential, may be privileged, and is intended solely for the person
and/or entity to whom it is addressed (i.e. those identified in the "To"
and "Cc" box). They are the property of TechPro, Inc. Unauthorized
review, use, disclosure, or copying of this communication, or any part
thereof, is strictly prohibited and may be unlawful. If you have received
this e-mail in error, please return the e-mail and attachments to the
sender and delete the e-mail and attachments and any copy from your
system. TechPro, Inc. Thank you for your cooperation.
 
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, "techpro_email_logo.gif"  Image/GIF  5.8KB. ]
    [ Unable to print this part. ]


From paul at 4FRONTMEDIA.NET  Fri Nov  5 14:46:35 2004
From: paul at 4FRONTMEDIA.NET (Paul Houselander)
Date: Thu Jan 12 21:27:29 2006
Subject: Spam stored in wrong quarantine folder
Message-ID: <mailman.4344.1137101249.24926.mailscanner@lists.mailscanner.info>

Hi

Have found some unusual behaviour I just wanted to run by the list.

I have 2 domains (abc.co.uk and xyz.com) whose mail accounts reside on
the same server. Both domains are scanned for Spam, but only on
incomming mail i.e. my Use Spamassasin ruleset looks like

To: *@abc.co.uk yes
To: *@xyz.com yes
FromTo: default no

I have a ruleset for quarantine as well

FromTo: *@abc.co.uk     /quarantine/abc.co.uk
FromTo: *@xyz.com       /quarantine/xyz.com

and my Spam Actions ruleset looks like

To: *@abc.co.uk         store forward spam@abc.co.uk
To: *@xyz.com           store forward spam@xyz.com

If user1@abc.co.uk sends a message to user2@xyz.com that gets tagged as
spam it gets quarantined in /quarantine/abc.co.uk, I would have expected
it to be quarantined in /quarantine/xyz.com

I have a web application that allows people to release there own spam,
and am finding in the scenorio outlined above they cannot as the message
is not in there own domains quarantine directory.

Is this expected behaviour/config error on my part/or possible bug

Any help appreciated.

Thanks

Paul Houselander



This message has been scanned for unacceptable content by 'VITANIUM'
the industry leading email virus and content management service from
Vitanium Systems. Contact details are available at www.vitanium.com.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Fri Nov  5 15:21:20 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:29 2006
Subject: Spam stored in wrong quarantine folder
Message-ID: <mailman.4345.1137101249.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Paul Houselander wrote:

>Hi
>
>Have found some unusual behaviour I just wanted to run by the list.
>
>I have 2 domains (abc.co.uk and xyz.com) whose mail accounts reside on
>the same server. Both domains are scanned for Spam, but only on
>incomming mail i.e. my Use Spamassasin ruleset looks like
>
>To: *@abc.co.uk yes
>To: *@xyz.com yes
>FromTo: default no
>
>I have a ruleset for quarantine as well
>
>FromTo: *@abc.co.uk     /quarantine/abc.co.uk
>FromTo: *@xyz.com       /quarantine/xyz.com
>
>and my Spam Actions ruleset looks like
>
>To: *@abc.co.uk         store forward spam@abc.co.uk
>To: *@xyz.com           store forward spam@xyz.com
>
>If user1@abc.co.uk sends a message to user2@xyz.com that gets tagged as
>spam it gets quarantined in /quarantine/abc.co.uk, I would have expected
>it to be quarantined in /quarantine/xyz.com
>
>
Why? The first quarantine rule that matches is
FromTo: *@abc.co.uk.....
so that is the rule that is used.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Fri Nov  5 15:17:18 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:29 2006
Subject: New Fresh Install Problems SuSE 9.1
Message-ID: <mailman.4346.1137101249.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Mike Zanker wrote:

> Nathan P. wrote:
>
>> You wouldn't happen to know the "correct" way to do it on SuSE would
>> you?
>> I've rebuilt src rpms once before a long time ago but I foget how to
>> do it.
>>
>> Before I do some googling does anyone know the way to do it in SuSE?
>
>
> From Julian's post of two days ago:
>
> cd MailScanner-4.35.9-1
> rpm -Uvh perl-MIME-Base64-3.05-2.src.rpm
> pushd /usr/src/packages/SPECS
> rpmbuild -bp perl-MIME-Base64.spec
> cd ../BUILD
> cd perl-MIME-Base64-3.05
> perl Makefile.PL
> make
> make test
> make install
> popd
> ./install.sh fast

Why not just install 4.35.11 instead? I have fixed these problems already.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Fri Nov  5 15:19:57 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:29 2006
Subject: Error starting lastest version of Mailscanner
Message-ID: <mailman.4347.1137101249.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I don't think it's running 5.8.5. If it is, then why is there no mention
of 5.8.5 in the @INC search path? Check you are using the version of
perl you think you are using. What does
    which perl
and
    /usr/bin/perl -V
say?

Brian Berglund wrote:

> I upgraded Mailscanner from 4.34.8 - 4.35.11
> When I try to start Mailscanner service, I get
> Starting MailScanner daemons:
>          incoming postfix:                                 [  OK  ]
>          outgoing postfix:                                 [  OK  ]
>          MailScanner:       Can't locate MIME/Parser.pm in @INC (@INC
> contains: /usr/lib/MailScanner/5.8.3/i386-linux-thread-multi
> /usr/lib/MailScanner/5.8.3
> /usr/lib/MailScanner/i386-linux-thread-multi
> /usr/lib/MailScanner/5.8.2 /usr/lib/MailScanner/5.8.1
> /usr/lib/MailScanner/5.8.0 /usr/lib/MailScanner
> /usr/lib/perl5/5.8.3/i386-linux-thread-multi /usr/lib/perl5/5.8.3
> /usr/lib/perl5/site_perl/5.8.3/i386-linux-thread-multi
> /usr/lib/perl5/site_perl/5.8.2/i386-linux-thread-multi
> /usr/lib/perl5/site_perl/5.8.1/i386-linux-thread-multi
> /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi
> /usr/lib/perl5/site_perl/5.8.3 /usr/lib/perl5/site_perl/5.8.2
> /usr/lib/perl5/site_perl/5.8.1 /usr/lib/perl5/site_perl/5.8.0
> /usr/lib/perl5/site_perl
> /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi
> /usr/lib/perl5/vendor_perl/5.8.2/i386-linux-thread-multi
> /usr/lib/perl5/vendor_perl/5.8.1/i386-linux-thread-multi
> /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi
> /usr/lib/perl5/vendor_perl/5.8.3 /usr/lib/perl5/vendor_perl/5.8.2
> /usr/lib/perl5/vendor_perl/5.8.1 /usr/lib/perl5/vendor_perl/5.8.0
> /usr/lib/perl5/vendor_perl .
> /usr/lib/MailScanner/5.8.3/i386-linux-thread-multi
> /usr/lib/MailScanner/5.8.3
> /usr/lib/MailScanner/i386-linux-thread-multi
> /usr/lib/MailScanner/5.8.2 /usr/lib/MailScanner/5.8.1
> /usr/lib/MailScanner/5.8.0 /usr/lib/MailScanner) at
> /usr/lib/MailScanner/MailScanner/MCPMessage.pm line 40.
> BEGIN failed--compilation aborted at
> /usr/lib/MailScanner/MailScanner/MCPMessage.pm line 40.
> Compilation failed in require at /usr/sbin/MailScanner line 73.
> BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 73.
>                                                            [  OK  ]
> I think the reason is because I have version 5.8.5 for Perl
> installed.  Where do you change the lib paths that Mailscanner checks on?
>
>
> Brian Berglund
>
> Engineer
>       *bberglund@techpro.com* <mailto:bberglund@techpro.com>*
> *
>
> ----------------------------------------------------------
> <http://www.techpro.com/>     Direct Line:* 630 .938 .5303*
> Direct Fax: 630 .845 .4603
> Toll Free: 800 .262 .0537 ext.103
> 318 Anderson Boulevard
> Geneva, IL 60134
>
>
> ----------------------------------------------------------
> w w w . t e c h p r o . c o m <http://www.techpro.com/>
>
>
>
> TechPro E-Mail Disclaimer
> The information contained in this e-mail and any accompanying
> documents is confidential, may be privileged, and is intended solely
> for the person and/or entity to whom it is addressed (i.e. those
> identified in the "To" and "Cc" box). They are the property of
> TechPro, Inc. Unauthorized review, use, disclosure, or copying of this
> communication, or any part thereof, is strictly prohibited and may be
> unlawful. If you have received this e-mail in error, please return the
> e-mail and attachments to the sender and delete the e-mail and
> attachments and any copy from your system. TechPro, Inc. Thank you for
> your cooperation.
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From dustin.baer at IHS.COM  Fri Nov  5 15:24:09 2004
From: dustin.baer at IHS.COM (Dustin Baer)
Date: Thu Jan 12 21:27:29 2006
Subject: Spam stored in wrong quarantine folder
Message-ID: <mailman.4348.1137101249.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Paul Houselander wrote:

>I have a ruleset for quarantine as well
>
>FromTo: *@abc.co.uk     /quarantine/abc.co.uk
>FromTo: *@xyz.com       /quarantine/xyz.com
>
>and my Spam Actions ruleset looks like
>
>To: *@abc.co.uk         store forward spam@abc.co.uk
>To: *@xyz.com           store forward spam@xyz.com
>
>If user1@abc.co.uk sends a message to user2@xyz.com that gets tagged as
>spam it gets quarantined in /quarantine/abc.co.uk, I would have expected
>it to be quarantined in /quarantine/xyz.com
>
>
"From: user1@abc.co.uk" matches your first quarantine rule, so is
quarantined in abc.co.uk

Dustin
--
Dustin Baer
Transport Extranet Network Services
Information Handling Services
15 Inverness Way East
Englewood, CO 80112
303-397-2836

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From m.sapsed at BANGOR.AC.UK  Fri Nov  5 15:36:49 2004
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:27:29 2006
Subject: Phishing phailure
Message-ID: <mailman.4349.1137101249.24926.mailscanner@lists.mailscanner.info>

Kai Schaetzl wrote:
> I looked in your attachment and it doesn't contain any HTML here. Could
> be that our MailScanner stripped that (as I have ordered it to do) or
> that your MailScanner does the same thing? I assume that the check is
> done *before* any stripping, but if not, then detection may fail in
> such a case. I agree the possibility is small, but I wanted to mention
> it.

Certainly the original message was quite minimal but the link/label
combination were valid html.

The whole message was type text/html and the body was just a body rather
than text and html versions. I wondered whether maybe the message was
formed in such a way that Julian's checks didn't get triggered?

Cheers,

Martin

--
Martin Sapsed            "I've got 8 little fingers and only 2 thumbs,
Microcomputer Support                      won't you leave me in peace
Information Services                        while I get the job done?"
University of Wales, Bangor             Chris Rea, "I'm working on it"

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Jan-Peter.Koopmann at SECEIDOS.DE  Fri Nov  5 14:46:39 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:29 2006
Subject: Error starting lastest version of Mailscanner
Message-ID: <mailman.4350.1137101249.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]


On Freitag, 5. November 2004 3:43 Brian Berglund wrote:

> I upgraded Mailscanner from 4.34.8 - 4.35.11
>
> When I try to start Mailscanner service, I get
>
>          MailScanner:       Can't locate MIME/Parser.pm in @INC (@INC

Did you install via the RPM?

Anyways: _Please_ do not write HTML mails and if you have to then by all
means: Get rid of that funky graphic footer...

Regards,
  JP

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, "techpro_email_logo.gif"  Image/GIF  5.8KB. ]
    [ Unable to print this part. ]


From jaearick at COLBY.EDU  Fri Nov  5 16:21:24 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:29 2006
Subject: SA 3.0.1 and Bayes poisoning issue?
Message-ID: <mailman.4351.1137101249.24926.mailscanner@lists.mailscanner.info>

Gang,

I have in my spam.assassin.prefs.conf file the following:

#---tweaks to combat neg bayes poisoning
score BAYES_00 0 0 -0.05 -0.05
score BAYES_01 0 0 -0.04 -0.04
score BAYES_10 0 0 -0.03 -0.03
score BAYES_20 0 0 -0.02 -0.02
score BAYES_30 0 0 -0.01 -0.01

left over from the SA 2.64 era.  I'm wondering if I should remove
this now that I'm running SA 3.0.1.  Comments anybody?

Jeff Earickson
Colby College

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From BBerglund at TECHPRO.COM  Fri Nov  5 16:27:39 2004
From: BBerglund at TECHPRO.COM (Brian Berglund)
Date: Thu Jan 12 21:27:29 2006
Subject: Error starting lastest version of Mailscanner
Message-ID: <mailman.4352.1137101249.24926.mailscanner@lists.mailscanner.info>

So I guess I am not running .5, however there is a folder for .5 under
the perl directory. 

What do you think the problem is?

[root@linux-relay1 mailscanner]# which perl
/usr/bin/perl
[root@linux-relay1 mailscanner]# /usr/bin/perl -V
Summary of my perl5 (revision 5.0 version 8 subversion 3) configuration:
  Platform:
    osname=linux, osvers=2.4.21-4.elsmp,
archname=i386-linux-thread-multi
    uname='linux tweety.devel.redhat.com 2.4.21-4.elsmp #1 smp fri oct 3
17:52:56 edt 2003 i686 i686 i386 gnulinux '
    config_args='-des -Doptimize=-O2 -g -pipe -march=i386 -mcpu=i686
-Dversion=5.8.3 -Dmyhostname=localhost -Dperladmin=root@localhost
-Dcc=gcc -Dcf_by=Red Hat, Inc. -Dinstallprefix=/usr -Dprefix=/usr
-Darchname=i386-linux -Dvendorprefix=/usr -Dsiteprefix=/usr -Duseshrplib
-Dusethreads -Duseithreads -Duselargefiles -Dd_dosuid -Dd_semctl_semun
-Di_db -Ui_ndbm -Di_gdbm -Di_shadow -Di_syslog -Dman3ext=3pm -Duseperlio
-Dinstallusrbinperl -Ubincompat5005 -Uversiononly -Dpager=/usr/bin/less
-isr -Dinc_version_list=5.8.2 5.8.1 5.8.0'
    hint=recommended, useposix=true, d_sigaction=define
    usethreads=define use5005threads=undef useithreads=define
usemultiplicity=define
    useperlio=define d_sfio=undef uselargefiles=define usesocks=undef
    use64bitint=undef use64bitall=undef uselongdouble=undef
    usemymalloc=n, bincompat5005=undef
  Compiler:
    cc='gcc', ccflags ='-D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS
-DDEBUGGING -fno-strict-aliasing -I/usr/local/include
-D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm',
    optimize='-O2 -g -pipe -march=i386 -mcpu=i686',
    cppflags='-D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING
-fno-strict-aliasing -I/usr/local/include -I/usr/include/gdbm'
    ccversion='', gccversion='3.3.3 20040412 (Red Hat Linux 3.3.3-7)',
gccosandvers=''
    intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=1234
    d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12
    ivtype='long', ivsize=4, nvtype='double', nvsize=8, Off_t='off_t',
lseeksize=8
    alignbytes=4, prototype=define
  Linker and Libraries:
    ld='gcc', ldflags =' -L/usr/local/lib'
    libpth=/usr/local/lib /lib /usr/lib
    libs=-lnsl -lgdbm -ldb -ldl -lm -lcrypt -lutil -lpthread -lc
    perllibs=-lnsl -ldl -lm -lcrypt -lutil -lpthread -lc
    libc=/lib/libc-2.3.3.so, so=so, useshrplib=true, libperl=libperl.so
    gnulibc_version='2.3.3'
  Dynamic Linking:
    dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-rdynamic
-Wl,-rpath,/usr/lib/perl5/5.8.3/i386-linux-thread-multi/CORE'
    cccdlflags='-fPIC', lddlflags='-shared -L/usr/local/lib'


Characteristics of this binary (from libperl):
  Compile-time options: DEBUGGING MULTIPLICITY USE_ITHREADS
USE_LARGE_FILES PERL_IMPLICIT_CONTEXT
  Built under linux
  Compiled at Apr 15 2004 13:09:17
  %ENV:
 
PERL5LIB="/usr/lib/perl5/site_perl/5.8.3/i386-linux-thread-multi:/usr/li
b/perl5/site_perl/5.8.3"
  @INC:
 
/usr/lib/perl5/site_perl/5.8.3/i386-linux-thread-multi/5.8.3/i386-linux-
thread-multi
    /usr/lib/perl5/site_perl/5.8.3/i386-linux-thread-multi/5.8.3
 
/usr/lib/perl5/site_perl/5.8.3/i386-linux-thread-multi/i386-linux-thread
-multi
    /usr/lib/perl5/site_perl/5.8.3/i386-linux-thread-multi/5.8.2
    /usr/lib/perl5/site_perl/5.8.3/i386-linux-thread-multi/5.8.1
    /usr/lib/perl5/site_perl/5.8.3/i386-linux-thread-multi/5.8.0
    /usr/lib/perl5/site_perl/5.8.3/i386-linux-thread-multi
    /usr/lib/perl5/site_perl/5.8.3/5.8.3/i386-linux-thread-multi
    /usr/lib/perl5/site_perl/5.8.3/5.8.3
    /usr/lib/perl5/site_perl/5.8.3/i386-linux-thread-multi
    /usr/lib/perl5/site_perl/5.8.3/5.8.2
    /usr/lib/perl5/site_perl/5.8.3/5.8.1
    /usr/lib/perl5/site_perl/5.8.3/5.8.0
    /usr/lib/perl5/site_perl/5.8.3
    /usr/lib/perl5/5.8.3/i386-linux-thread-multi
    /usr/lib/perl5/5.8.3
    /usr/lib/perl5/site_perl/5.8.3/i386-linux-thread-multi
    /usr/lib/perl5/site_perl/5.8.2/i386-linux-thread-multi
    /usr/lib/perl5/site_perl/5.8.1/i386-linux-thread-multi
    /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi
    /usr/lib/perl5/site_perl/5.8.3
    /usr/lib/perl5/site_perl/5.8.2
    /usr/lib/perl5/site_perl/5.8.1
    /usr/lib/perl5/site_perl/5.8.0
    /usr/lib/perl5/site_perl
    /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi
    /usr/lib/perl5/vendor_perl/5.8.2/i386-linux-thread-multi
    /usr/lib/perl5/vendor_perl/5.8.1/i386-linux-thread-multi
    /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi
    /usr/lib/perl5/vendor_perl/5.8.3
    /usr/lib/perl5/vendor_perl/5.8.2
    /usr/lib/perl5/vendor_perl/5.8.1
    /usr/lib/perl5/vendor_perl/5.8.0
    /usr/lib/perl5/vendor_perl
    . 

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Julian Field
Sent: Friday, November 05, 2004 9:20 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Error starting lastest version of Mailscanner

I don't think it's running 5.8.5. If it is, then why is there no mention
of 5.8.5 in the @INC search path? Check you are using the version of
perl you think you are using. What does
    which perl
and
    /usr/bin/perl -V
say?

Brian Berglund wrote:

> I upgraded Mailscanner from 4.34.8 - 4.35.11 When I try to start 
> Mailscanner service, I get Starting MailScanner daemons:
>          incoming postfix:                                 [  OK  ]
>          outgoing postfix:                                 [  OK  ]
>          MailScanner:       Can't locate MIME/Parser.pm in @INC (@INC
> contains: /usr/lib/MailScanner/5.8.3/i386-linux-thread-multi
> /usr/lib/MailScanner/5.8.3
> /usr/lib/MailScanner/i386-linux-thread-multi
> /usr/lib/MailScanner/5.8.2 /usr/lib/MailScanner/5.8.1 
> /usr/lib/MailScanner/5.8.0 /usr/lib/MailScanner 
> /usr/lib/perl5/5.8.3/i386-linux-thread-multi /usr/lib/perl5/5.8.3 
> /usr/lib/perl5/site_perl/5.8.3/i386-linux-thread-multi
> /usr/lib/perl5/site_perl/5.8.2/i386-linux-thread-multi
> /usr/lib/perl5/site_perl/5.8.1/i386-linux-thread-multi
> /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi
> /usr/lib/perl5/site_perl/5.8.3 /usr/lib/perl5/site_perl/5.8.2
> /usr/lib/perl5/site_perl/5.8.1 /usr/lib/perl5/site_perl/5.8.0 
> /usr/lib/perl5/site_perl 
> /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi
> /usr/lib/perl5/vendor_perl/5.8.2/i386-linux-thread-multi
> /usr/lib/perl5/vendor_perl/5.8.1/i386-linux-thread-multi
> /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi
> /usr/lib/perl5/vendor_perl/5.8.3 /usr/lib/perl5/vendor_perl/5.8.2
> /usr/lib/perl5/vendor_perl/5.8.1 /usr/lib/perl5/vendor_perl/5.8.0 
> /usr/lib/perl5/vendor_perl .
> /usr/lib/MailScanner/5.8.3/i386-linux-thread-multi
> /usr/lib/MailScanner/5.8.3
> /usr/lib/MailScanner/i386-linux-thread-multi
> /usr/lib/MailScanner/5.8.2 /usr/lib/MailScanner/5.8.1 
> /usr/lib/MailScanner/5.8.0 /usr/lib/MailScanner) at 
> /usr/lib/MailScanner/MailScanner/MCPMessage.pm line 40.
> BEGIN failed--compilation aborted at
> /usr/lib/MailScanner/MailScanner/MCPMessage.pm line 40.
> Compilation failed in require at /usr/sbin/MailScanner line 73.
> BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 73.
>                                                            [  OK  ] I 
> think the reason is because I have version 5.8.5 for Perl installed.  
> Where do you change the lib paths that Mailscanner checks on?
>
>
> Brian Berglund
>
> Engineer
>       *bberglund@techpro.com* <mailto:bberglund@techpro.com>*
> *
>
> ----------------------------------------------------------
> <http://www.techpro.com/>     Direct Line:* 630 .938 .5303*
> Direct Fax: 630 .845 .4603
> Toll Free: 800 .262 .0537 ext.103
> 318 Anderson Boulevard
> Geneva, IL 60134
>
>
> ----------------------------------------------------------
> w w w . t e c h p r o . c o m <http://www.techpro.com/>
>
>
>
> TechPro E-Mail Disclaimer
> The information contained in this e-mail and any accompanying 
> documents is confidential, may be privileged, and is intended solely 
> for the person and/or entity to whom it is addressed (i.e. those 
> identified in the "To" and "Cc" box). They are the property of 
> TechPro, Inc. Unauthorized review, use, disclosure, or copying of this

> communication, or any part thereof, is strictly prohibited and may be 
> unlawful. If you have received this e-mail in error, please return the

> e-mail and attachments to the sender and delete the e-mail and 
> attachments and any copy from your system. TechPro, Inc. Thank you for

> your cooperation.
>
> ------------------------ MailScanner list ------------------------ To 
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the

> archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store Professional
Support Services at www.MailScanner.biz MailScanner thanks transtec
Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From BBerglund at TECHPRO.COM  Fri Nov  5 16:28:40 2004
From: BBerglund at TECHPRO.COM (Brian Berglund)
Date: Thu Jan 12 21:27:29 2006
Subject: Error starting lastest version of Mailscanner
Message-ID: <mailman.4353.1137101249.24926.mailscanner@lists.mailscanner.info>

I downloaded the Mailscanner from the website.
Then I ran ./install.sh
 
it finishes, then I tried to start the program and got the error.

________________________________________________________________________________
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Jan-Peter Koopmann
Sent: Friday, November 05, 2004 8:47 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Error starting lastest version of Mailscanner

On Freitag, 5. November 2004 3:43 Brian Berglund wrote:

> I upgraded Mailscanner from 4.34.8 - 4.35.11
>
> When I try to start Mailscanner service, I get
>
>          MailScanner:       Can't locate MIME/Parser.pm in @INC (@INC

Did you install via the RPM?

Anyways: _Please_ do not write HTML mails and if you have to then by all
means: Get rid of that funky graphic footer...

Regards,
  JP

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From BBerglund at TECHPRO.COM  Fri Nov  5 16:29:28 2004
From: BBerglund at TECHPRO.COM (Brian Berglund)
Date: Thu Jan 12 21:27:29 2006
Subject: Error starting lastest version of Mailscanner
Message-ID: <mailman.4354.1137101249.24926.mailscanner@lists.mailscanner.info>


[root@linux-relay1 Mailscanner]# ls
MailScanner-4.34.8-4             MailScanner-4.35.11-1            
webmin-module-0.9.wbm
MailScanner-4.34.8-4.rpm.tar.gz  MailScanner-4.35.11-1.rpm.tar.gz  Webmin
module notes.txt
[root@linux-relay1 Mailscanner]# cd MailScanner-4.35.11-1
[root@linux-relay1 MailScanner-4.35.11-1]# ls
CheckModuleVersion                          
perl-HTML-Parser-3.26-2.src.rpm
install.sh                                  
perl-HTML-Tagset-3.03-1.src.rpm
mailscanner-4.35.11-1.noarch.rpm            
perl-IO-stringy-2.108-1.src.rpm
MailScanner-perl-MIME-Base64-3.05-4.src.rpm 
perl-MailTools-1.50-1.src.rpm
perl-Archive-Zip-1.14-1.src.rpm             
perl-MIME-tools-5.415-2.src.rpm
perl-Compress-Zlib-1.33-2.src.rpm            perl-Net-CIDR-0.09-3.src.rpm
perl-Convert-BinHex-1.119-2.src.rpm         
perl-TimeDate-1.1301-3.src.rpm
perl-Convert-TNEF-0.17-1.src.rpm             QuickInstall.txt
perl-ExtUtils-MakeMaker-6.05-1.src.rpm       README
perl-File-Spec-0.82-1.src.rpm                tnef-1.2.3.1-1.i386.rpm
perl-File-Temp-0.12-1.src.rpm

________________________________________________________________________________
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Jan-Peter Koopmann
Sent: Friday, November 05, 2004 8:47 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Error starting lastest version of Mailscanner

On Freitag, 5. November 2004 3:43 Brian Berglund wrote:

> I upgraded Mailscanner from 4.34.8 - 4.35.11
>
> When I try to start Mailscanner service, I get
>
>          MailScanner:       Can't locate MIME/Parser.pm in @INC (@INC

Did you install via the RPM?

Anyways: _Please_ do not write HTML mails and if you have to then by all
means: Get rid of that funky graphic footer...

Regards,
  JP

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From p.g.m.peters at utwente.nl  Fri Nov  5 15:17:32 2004
From: p.g.m.peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:27:29 2006
Subject: Spam stored in wrong quarantine folder
Message-ID: <mailman.4355.1137101249.24926.mailscanner@lists.mailscanner.info>

On Fri, 5 Nov 2004 14:46:35 +0000, you wrote:

>To: *@abc.co.uk yes
>To: *@xyz.com yes
>FromTo: default no
>
>I have a ruleset for quarantine as well
>
>FromTo: *@abc.co.uk     /quarantine/abc.co.uk
>FromTo: *@xyz.com       /quarantine/xyz.com
>
>and my Spam Actions ruleset looks like
>
>To: *@abc.co.uk         store forward spam@abc.co.uk
>To: *@xyz.com           store forward spam@xyz.com
>
>If user1@abc.co.uk sends a message to user2@xyz.com that gets tagged as
>spam it gets quarantined in /quarantine/abc.co.uk, I would have expected
>it to be quarantined in /quarantine/xyz.com

No because you use FromTo in the quarantaine ruleset. And in that
ruleset *@abc.co.uk comes first when a message comes From
user1@abc.co.uk. Change the FromTo to To and it should work.

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/itbe

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Steve.Swaney at FSL.COM  Fri Nov  5 16:47:37 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:29 2006
Subject: SA 3.0.1 and Bayes poisoning issue?
Message-ID: <mailman.4356.1137101249.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Jeff A. Earickson
> Sent: Friday, November 05, 2004 11:21 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: SA 3.0.1 and Bayes poisoning issue?
>
> Gang,
>
> I have in my spam.assassin.prefs.conf file the following:
>
> #---tweaks to combat neg bayes poisoning
> score BAYES_00 0 0 -0.05 -0.05
> score BAYES_01 0 0 -0.04 -0.04
> score BAYES_10 0 0 -0.03 -0.03
> score BAYES_20 0 0 -0.02 -0.02
> score BAYES_30 0 0 -0.01 -0.01
>
> left over from the SA 2.64 era.  I'm wondering if I should remove
> this now that I'm running SA 3.0.1.  Comments anybody?
>

I'd delete.

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com




--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ELKNET.NET  Fri Nov  5 16:27:29 2004
From: mailscanner at ELKNET.NET (Alan)
Date: Thu Jan 12 21:27:29 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.4357.1137101249.24926.mailscanner@lists.mailscanner.info>

JP,

I want to make sure I'm correctly understanding your reply...

1) If a custom from header is set in MailScanner.conf, and that header is
also defined in spam.assassin.prefs.conf via 'envelope-sender-header', then
the placement of that header in the email does not matter. Since SA knows
it has been specifically told to watch for that custom header, then it will
accept it as valid since a spoofer would not know what name to use to forge
the header.

2) If however the standard 'X-Envelope-From' header is used, it must be
placed at the top of the headers, or SA will not 'trust' its validity.

Thanks for your time!

-Alan

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From martinh at SOLID-STATE-LOGIC.COM  Fri Nov  5 16:57:55 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:29 2006
Subject: OT - JISCmail listserv oddity
Message-ID: <mailman.4358.1137101249.24926.mailscanner@lists.mailscanner.info>

Martin

nope, was definitely to the mailscanner list

had another funny yesterday when it accused me of sending the same
message twice.

maybe they should move off this M$ and listserve stuff to mailman and
*nix :-0

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Martin Sapsed wrote:
> Martin Hepworth wrote:
>
>> All
>>
>> I just sent and email to the list where the first line was 'OK' and only
>> that word on the frst line.
>>
>> The  listserv software on jiscmail treated this as a listserv command,
>> and rejected it....
>>
>> Could someone (Julian?) have a word with the nice admins at jiscmail and
>> see if they can sort out this little 'feature'
>
>
> Are you sure you sent the message to mailscanner@jiscmail and not
> jiscmail@jiscmail? I can't see why the listserv would try to interpret
> commands in a message to a list - I would have thought it would have
> thrown up more errors by now?
>
> Julian - have you enquired about this?
>
> Cheers,
>
> Martin
>

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ELKNET.NET  Fri Nov  5 16:54:36 2004
From: mailscanner at ELKNET.NET (Alan)
Date: Thu Jan 12 21:27:29 2006
Subject: MS performance as a gateway comments
Message-ID: <mailman.4359.1137101249.24926.mailscanner@lists.mailscanner.info>

This is just some of the things I have experienced over the last year
related to performance. FWIW, maybe it will help someone down the line...

I have been running MS/SA for about a year now, and have been struggling
with performance issues since day one. Over this time, many of you have
greatly helped me in my tweaking, including:

tempfs for working dir
seperate scsi drive for queue partition
reiserfs for queue fs
dual pent 4 with 2 gig ram
minimal logging
smaller batch size (20)

In my configuration, I have 4 smtp servers receiving email from the outside
world. Each of these 4 servers route the mail they accept directly to my
MS/SA server for spam/virus/exploit filtering. Everything that is passed by
MS/SA is then finally sent on to a final smtp server where the inboxes
reside. So you can see that my MS/SA server acts as a gateway; it accepts
no email directly from the outside world, and it has no inboxes on it.
About 300,000 emails per day enter the MS/SA server, and its filtering out
about 72% of that volume, passing the rest on to my users.

In my original install, I was using sendmail as the MTA. During much of the
day, so many MTAs were running that server load would hover around 14-20.
During quieter times, it would drop to maybe 5-7, never below. If I
configured sendmail to limit MTAs, I would have backups on the 4 incoming
smtp servers as they could not deliver their queues to the MS/SA server
fast enough, and/or there would be backups in the delivery queue of the
MS/SA server itself as there were not enough MTAs available for final
delivery to the inbox server. If I ran enough MTAs to handle incoming and
outgoing traffic, load would be so high that MS became the bottle neck.

Bayes tests were out of the question due to load, and various network tests
(razor2, surbl etc.) often had to be disabled when back logs were bad. It
was not uncommon each day to have 20,000 messages waiting to be processed.
During daily heavy load, the time from when an email hit my first server
until it was dropped into the user's inbox would be 4-7 hours.

A couple of months ago I replaced sendmail as the MTA with exim. I really
liked exim's configuration flexability and features, and was quickly able
to get some neat tweaks running. I found that each exim MTA seemed to use
less resources than each sendmail MTA had used, and I was able to keep
network tests running much more often. It was an improvement, but loads
were still usually above 8 and total delivery time was still poor,
sometimes as high as 2 hours during the day.

Now I have replaced exim with zmailer, and all I can say is WOW! First,
zmailer reuses the same tcp/ip connection to my final inbox server for as
long as there are messages in the delivery queue to be delivered. This
means there is never more than a single MTA running to deliver messages.
Secondly, the zmailer smtpserver process that receives incoming messages
from my 4 smtp servers, along with the zmailer smtp process that delivers
filtered messages to my inbox server all use minimal system resources.

Since switching to zmailer as my MTA, system load is averaging under 4, and
very few peaks above 5, and they are very short. Pre-filtered queue size
has yet to go over 100 during peak hours, as opposed to previous queue
sizes of over 10,000. Delivery queue size is likewise low, typically under
50. Delivery time from initial reception to user inbox is now down to 3
minutes or so.

So, if you are struggling with system load and bottlenecks as I have been,
and have made all the hardware tweaks you can think of, I HIGHLY recommend
you try zmailer as your MTA.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From BBerglund at TECHPRO.COM  Fri Nov  5 16:41:26 2004
From: BBerglund at TECHPRO.COM (Brian Berglund)
Date: Thu Jan 12 21:27:29 2006
Subject: Error starting lastest version of Mailscanner
Message-ID: <mailman.4360.1137101249.24926.mailscanner@lists.mailscanner.info>

[root@linux-relay1 perl5]# ls
5.8.0  5.8.1  5.8.2  5.8.3  perl-5.8.5  site_perl  vendor_perl
 
Can someone help me get this going?  I am stuck and want to get this asap

________________________________________________________________________________
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Brian Berglund
Sent: Friday, November 05, 2004 10:29 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Error starting lastest version of Mailscanner


[root@linux-relay1 Mailscanner]# ls
MailScanner-4.34.8-4             MailScanner-4.35.11-1            
webmin-module-0.9.wbm
MailScanner-4.34.8-4.rpm.tar.gz  MailScanner-4.35.11-1.rpm.tar.gz  Webmin
module notes.txt
[root@linux-relay1 Mailscanner]# cd MailScanner-4.35.11-1
[root@linux-relay1 MailScanner-4.35.11-1]# ls
CheckModuleVersion                          
perl-HTML-Parser-3.26-2.src.rpm
install.sh                                  
perl-HTML-Tagset-3.03-1.src.rpm
mailscanner-4.35.11-1.noarch.rpm            
perl-IO-stringy-2.108-1.src.rpm
MailScanner-perl-MIME-Base64-3.05-4.src.rpm 
perl-MailTools-1.50-1.src.rpm
perl-Archive-Zip-1.14-1.src.rpm             
perl-MIME-tools-5.415-2.src.rpm
perl-Compress-Zlib-1.33-2.src.rpm            perl-Net-CIDR-0.09-3.src.rpm
perl-Convert-BinHex-1.119-2.src.rpm         
perl-TimeDate-1.1301-3.src.rpm
perl-Convert-TNEF-0.17-1.src.rpm             QuickInstall.txt
perl-ExtUtils-MakeMaker-6.05-1.src.rpm       README
perl-File-Spec-0.82-1.src.rpm                tnef-1.2.3.1-1.i386.rpm
perl-File-Temp-0.12-1.src.rpm

________________________________________________________________________________
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Jan-Peter Koopmann
Sent: Friday, November 05, 2004 8:47 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Error starting lastest version of Mailscanner

On Freitag, 5. November 2004 3:43 Brian Berglund wrote:

> I upgraded Mailscanner from 4.34.8 - 4.35.11
>
> When I try to start Mailscanner service, I get
>
>          MailScanner:       Can't locate MIME/Parser.pm in @INC (@INC

Did you install via the RPM?

Anyways: _Please_ do not write HTML mails and if you have to then by all
means: Get rid of that funky graphic footer...

Regards,
  JP

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Jan-Peter.Koopmann at SECEIDOS.DE  Fri Nov  5 16:59:46 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:29 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.4361.1137101249.24926.mailscanner@lists.mailscanner.info>

Hi Alan,

> 1) If a custom from header is set in MailScanner.conf, and
> that header is also defined in spam.assassin.prefs.conf via
> 'envelope-sender-header', then the placement of that header
> in the email does not matter. Since SA knows it has been
> specifically told to watch for that custom header, then it
> will accept it as valid since a spoofer would not know what
> name to use to forge the header.

Correct.

> 2) If however the standard 'X-Envelope-From' header is used,
> it must be placed at the top of the headers, or SA will not 'trust'
> its validity. 

Correct as well.

> Thanks for your time!

Your welcome. I was already working on a bug report for them and was
just looking at that piece of code a few minutes earlier. Therefore: No
trouble at all.

Regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From martinh at SOLID-STATE-LOGIC.COM  Fri Nov  5 17:23:01 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:29 2006
Subject: OT - JISCmail listserv oddity
Message-ID: <mailman.4362.1137101249.24926.mailscanner@lists.mailscanner.info>

Martin Sapsed wrote:
> Martin Hepworth wrote:
>
>> nope, was definitely to the mailscanner list
>
>
> OK - apparently Julian's seen it before - the listserv tries to spot
> messages which should have been sent to listserv@ but were actually sent
> to the list.
>
>> had another funny yesterday when it accused me of sending the same
>> message twice.
>
>
> I got the same this afternoon - someone's mail server is looping -
> they've been notified and their delivery disabled.
>
>  > maybe they should move off this M$ and listserve stuff to mailman and
>  > *nix :-0
>
> It's quite a large operation. I'm fairly sure they looked at the
> alternatives before deciding on listserv.
>
> Cheers,
>
> Martin
>

yeah - guess they wanted 'support' from M$ and listserv (this freeware
stuff is definitely not worth installing in a large production
environment (cough:-)

mind you given the recent 'mirror.ac.uk' change I guess it's consistent
I guess.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From martinh at SOLID-STATE-LOGIC.COM  Fri Nov  5 17:31:51 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:29 2006
Subject: MS performance as a gateway comments
Message-ID: <mailman.4363.1137101249.24926.mailscanner@lists.mailscanner.info>

Alan

your specs and message flow don't seem to match the other high end boxes
(ie you system should be able to handle well over a million messages aday).

what extra SA rules are you running? I wonder if some of the larger ones
are causing problems (not to mention the RBLs - are you running a local
caching nameserver on t he box0?


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Alan wrote:
> This is just some of the things I have experienced over the last year
> related to performance. FWIW, maybe it will help someone down the line...
>
> I have been running MS/SA for about a year now, and have been struggling
> with performance issues since day one. Over this time, many of you have
> greatly helped me in my tweaking, including:
>
> tempfs for working dir
> seperate scsi drive for queue partition
> reiserfs for queue fs
> dual pent 4 with 2 gig ram
> minimal logging
> smaller batch size (20)
>
> In my configuration, I have 4 smtp servers receiving email from the outside
> world. Each of these 4 servers route the mail they accept directly to my
> MS/SA server for spam/virus/exploit filtering. Everything that is passed by
> MS/SA is then finally sent on to a final smtp server where the inboxes
> reside. So you can see that my MS/SA server acts as a gateway; it accepts
> no email directly from the outside world, and it has no inboxes on it.
> About 300,000 emails per day enter the MS/SA server, and its filtering out
> about 72% of that volume, passing the rest on to my users.
>
> In my original install, I was using sendmail as the MTA. During much of the
> day, so many MTAs were running that server load would hover around 14-20.
> During quieter times, it would drop to maybe 5-7, never below. If I
> configured sendmail to limit MTAs, I would have backups on the 4 incoming
> smtp servers as they could not deliver their queues to the MS/SA server
> fast enough, and/or there would be backups in the delivery queue of the
> MS/SA server itself as there were not enough MTAs available for final
> delivery to the inbox server. If I ran enough MTAs to handle incoming and
> outgoing traffic, load would be so high that MS became the bottle neck.
>
> Bayes tests were out of the question due to load, and various network tests
> (razor2, surbl etc.) often had to be disabled when back logs were bad. It
> was not uncommon each day to have 20,000 messages waiting to be processed.
> During daily heavy load, the time from when an email hit my first server
> until it was dropped into the user's inbox would be 4-7 hours.
>
> A couple of months ago I replaced sendmail as the MTA with exim. I really
> liked exim's configuration flexability and features, and was quickly able
> to get some neat tweaks running. I found that each exim MTA seemed to use
> less resources than each sendmail MTA had used, and I was able to keep
> network tests running much more often. It was an improvement, but loads
> were still usually above 8 and total delivery time was still poor,
> sometimes as high as 2 hours during the day.
>
> Now I have replaced exim with zmailer, and all I can say is WOW! First,
> zmailer reuses the same tcp/ip connection to my final inbox server for as
> long as there are messages in the delivery queue to be delivered. This
> means there is never more than a single MTA running to deliver messages.
> Secondly, the zmailer smtpserver process that receives incoming messages
> from my 4 smtp servers, along with the zmailer smtp process that delivers
> filtered messages to my inbox server all use minimal system resources.
>
> Since switching to zmailer as my MTA, system load is averaging under 4, and
> very few peaks above 5, and they are very short. Pre-filtered queue size
> has yet to go over 100 during peak hours, as opposed to previous queue
> sizes of over 10,000. Delivery queue size is likewise low, typically under
> 50. Delivery time from initial reception to user inbox is now down to 3
> minutes or so.
>
> So, if you are struggling with system load and bottlenecks as I have been,
> and have made all the hardware tweaks you can think of, I HIGHLY recommend
> you try zmailer as your MTA.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From paul at 4FRONTMEDIA.NET  Fri Nov  5 16:28:18 2004
From: paul at 4FRONTMEDIA.NET (Paul Houselander)
Date: Thu Jan 12 21:27:29 2006
Subject: Spam stored in wrong quarantine folder {Scanned by VITANIUM}
Message-ID: <mailman.4364.1137101249.24926.mailscanner@lists.mailscanner.info>

On Fri, 2004-11-05 at 15:21, Julian Field wrote:
> Paul Houselander wrote:
>
> >Hi
> >
> >Have found some unusual behaviour I just wanted to run by the list.
> >
> >I have 2 domains (abc.co.uk and xyz.com) whose mail accounts reside on
> >the same server. Both domains are scanned for Spam, but only on
> >incomming mail i.e. my Use Spamassasin ruleset looks like
> >
> >To: *@abc.co.uk yes
> >To: *@xyz.com yes
> >FromTo: default no
> >
> >I have a ruleset for quarantine as well
> >
> >FromTo: *@abc.co.uk     /quarantine/abc.co.uk
> >FromTo: *@xyz.com       /quarantine/xyz.com
> >
> >and my Spam Actions ruleset looks like
> >
> >To: *@abc.co.uk         store forward spam@abc.co.uk
> >To: *@xyz.com           store forward spam@xyz.com
> >
> >If user1@abc.co.uk sends a message to user2@xyz.com that gets tagged as
> >spam it gets quarantined in /quarantine/abc.co.uk, I would have expected
> >it to be quarantined in /quarantine/xyz.com
> >
> >
> Why? The first quarantine rule that matches is
> FromTo: *@abc.co.uk.....
> so that is the rule that is used.
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support

The reason I was thinking this was wrong is I set the SpamAssasin
rule-set to only scan incoming mail, but it was quarantining it based on
the sending domain not the receiving domain.

If the mail was sent from a domain not hosted on my box the spam would
have been quarantined in /quarantine/xyz.com

Ive just set the quarantine rules to only To: and I agree its now
placing the spam in the correct quarantine directory.

The reason I had FromTo: set was I wanted to quarantine any viruses sent
out From the domains. So my setup is virus scan incoming and outgoing
mail but only check for spam on incoming mail.

In this setup spam sent from one domain to another domain hosted on my
box would be quarantined (IMO) based on sending domain (even though I
don't want outgoing mail spam checked).

Feel free to shout me down, its Friday and been a long week so maybe my
brains not functioning correctly :)

Cheers

Paul



This message has been scanned for unacceptable content by 'VITANIUM'
the industry leading email virus and content management service from
Vitanium Systems. Contact details are available at www.vitanium.com.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From pz at CHRIST-NET.SK  Fri Nov  5 18:23:41 2004
From: pz at CHRIST-NET.SK (Peter Zimen)
Date: Thu Jan 12 21:27:29 2006
Subject: Sophos antivirus
Message-ID: <mailman.4365.1137101249.24926.mailscanner@lists.mailscanner.info>

I want to install virus scanner Sophos to cooperation with MailScanner
on my Linux server.

I dont know which version of Sophos i must have:

Sophos antivirus (SAVI) or SAVI interface?

Please little help :))
.
__

S pozdravom

Peter Zimen

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From m.sapsed at BANGOR.AC.UK  Fri Nov  5 17:03:43 2004
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:27:29 2006
Subject: OT - JISCmail listserv oddity
Message-ID: <mailman.4366.1137101249.24926.mailscanner@lists.mailscanner.info>

Martin Hepworth wrote:
> nope, was definitely to the mailscanner list

OK - apparently Julian's seen it before - the listserv tries to spot
messages which should have been sent to listserv@ but were actually sent
to the list.

> had another funny yesterday when it accused me of sending the same
> message twice.

I got the same this afternoon - someone's mail server is looping -
they've been notified and their delivery disabled.

 > maybe they should move off this M$ and listserve stuff to mailman and
 > *nix :-0

It's quite a large operation. I'm fairly sure they looked at the
alternatives before deciding on listserv.

Cheers,

Martin

--
Martin Sapsed            "I've got 8 little fingers and only 2 thumbs,
Microcomputer Support                      won't you leave me in peace
Information Services                        while I get the job done?"
University of Wales, Bangor             Chris Rea, "I'm working on it"

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From jase at SENSIS.COM  Fri Nov  5 19:08:06 2004
From: jase at SENSIS.COM (Desai, Jason)
Date: Thu Jan 12 21:27:30 2006
Subject: Spam stored in wrong quarantine folder {Scanned by VITANIUM}
Message-ID: <mailman.4367.1137101249.24926.mailscanner@lists.mailscanner.info>

Paul Houselander wrote:
> On Fri, 2004-11-05 at 15:21, Julian Field wrote:
>> Paul Houselander wrote:
>>
>>> Hi
>>>
>>> Have found some unusual behaviour I just wanted to run by the list.
>>>
>>> I have 2 domains (abc.co.uk and xyz.com) whose mail accounts reside
>>> on the same server. Both domains are scanned for Spam, but only on
>>> incomming mail i.e. my Use Spamassasin ruleset looks like
>>>
>>> To: *@abc.co.uk yes
>>> To: *@xyz.com yes
>>> FromTo: default no
>>>
>>> I have a ruleset for quarantine as well
>>>
>>> FromTo: *@abc.co.uk     /quarantine/abc.co.uk
>>> FromTo: *@xyz.com       /quarantine/xyz.com
>>>
>>> and my Spam Actions ruleset looks like
>>>
>>> To: *@abc.co.uk         store forward spam@abc.co.uk
>>> To: *@xyz.com           store forward spam@xyz.com
>>>
>>> If user1@abc.co.uk sends a message to user2@xyz.com that gets
>>> tagged as spam it gets quarantined in /quarantine/abc.co.uk, I
>>> would have expected it to be quarantined in /quarantine/xyz.com
>>>
>>>
>> Why? The first quarantine rule that matches is
>> FromTo: *@abc.co.uk.....
>> so that is the rule that is used.
>>
>> --
>> Julian Field
>> www.MailScanner.info
>> Buy the MailScanner book at www.MailScanner.info/store
>> Professional Support Services at www.MailScanner.biz
>> MailScanner thanks transtec Computers for their support
>
> The reason I was thinking this was wrong is I set the SpamAssasin
> rule-set to only scan incoming mail, but it was quarantining it based
> on the sending domain not the receiving domain.
>
> If the mail was sent from a domain not hosted on my box the spam would
> have been quarantined in /quarantine/xyz.com
>
> Ive just set the quarantine rules to only To: and I agree its now
> placing the spam in the correct quarantine directory.
>
> The reason I had FromTo: set was I wanted to quarantine any viruses
> sent out From the domains. So my setup is virus scan incoming and
> outgoing mail but only check for spam on incoming mail.
>
> In this setup spam sent from one domain to another domain hosted on my
> box would be quarantined (IMO) based on sending domain (even though I
> don't want outgoing mail spam checked).
>
> Feel free to shout me down, its Friday and been a long week so maybe
> my brains not functioning correctly :)

If you wanted to quarantine based on the recipient, but still be able to
quarantine viruses from your domains, you could change your quarantine rules
to

To: *@abc.co.uk     /quarantine/abc.co.uk
To: *@xyz.com       /quarantine/xyz.com
From: *@abc.co.uk     /quarantine/abc.co.uk
From: *@xyz.com       /quarantine/xyz.com

But then of course, if someone sends a virus from xyz.com to abc.co.uk, it
will be quarantined in /quarantine/abc.co.cu, and not /quarantine/xyz.com.

Jase

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From georgelist at CONPOINT.COM  Fri Nov  5 19:05:37 2004
From: georgelist at CONPOINT.COM (George)
Date: Thu Jan 12 21:27:30 2006
Subject: %rules-dir% quick question.
Message-ID: <mailman.4368.1137101250.24926.mailscanner@lists.mailscanner.info>

Can someone tell me if the files that are in the %rules-dir% are read
into memory when MS is started or if each message is checked against the
file when scanned.

Thanks
George

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From BBerglund at TECHPRO.COM  Fri Nov  5 19:24:53 2004
From: BBerglund at TECHPRO.COM (Brian Berglund)
Date: Thu Jan 12 21:27:30 2006
Subject: New errors in maillog
Message-ID: <mailman.4369.1137101250.24926.mailscanner@lists.mailscanner.info>

I cannot seem to get this progam to start correctly.
 
I am trying to use MailWatch with it and I get
Nov  5 13:16:54 linux-relay1 MailScanner[2309]: Could not use Custom
Function code MailScanner::CustomConfig::InitMailWatchLogging, it could
not be "eval"ed\
. Make sure the module is correct with perl -wc
Then for postfix I keep getting.
 
Nov  5 13:17:05 linux-relay1 MailScanner[2771]: Messages found but no
hashed queue directories. Please enable hashed queues for incoming and
deferred with a\
 depth of 1 or 2. See the Postfix documentation for hash_queue_names and
hash_queue_depth
I have those two parameters set.
hash_queue_depth = 2
hash_queue_names = defer incoming deffered
 
Can anyone help out?????
 
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mkettler at EVI-INC.COM  Fri Nov  5 20:42:31 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:30 2006
Subject: SA 3.0.1 and Bayes poisoning issue?
Message-ID: <mailman.4370.1137101250.24926.mailscanner@lists.mailscanner.info>

At 11:21 AM 11/5/2004, Jeff A. Earickson wrote:
>I have in my spam.assassin.prefs.conf file the following:
>
>#---tweaks to combat neg bayes poisoning
>score BAYES_00 0 0 -0.05 -0.05
>score BAYES_01 0 0 -0.04 -0.04
>score BAYES_10 0 0 -0.03 -0.03
>score BAYES_20 0 0 -0.02 -0.02
>score BAYES_30 0 0 -0.01 -0.01
>
>left over from the SA 2.64 era.  I'm wondering if I should remove
>this now that I'm running SA 3.0.1.  Comments anybody?

If you had bayes poisoning problems serious enough for you to have to do
that, upgrading spamassassin will definitely NOT fix the problem.

If you've got more than 0.01% of your spam matching BAYES_00 that's a
serious mis-training problem, and there's nothing a SA upgrade can do to
fix that. AFAIK no version of SA has ever had bayes poisoning problems if
properly trained, and mine certainly never has (I've been using bayes since
2.53 came out)

Bad training is bad training. Code can't fix bad training. Wipe out your
database and start over.

And beware.. Never rely on autolearning alone. You've got a good chance of
the bayes DB starting off on the wrong foot and getting stuck there. At the
very least hand-seed a handful of emails into sa-learn when you start off.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From jaearick at COLBY.EDU  Fri Nov  5 21:02:44 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:30 2006
Subject: 4.35.11: more phony phishing phailures
Message-ID: <mailman.4371.1137101250.24926.mailscanner@lists.mailscanner.info>

Julian,

I just got a complaint about this from in-house, where the guy
has our URL in his signature, and he uses HTML email.  The snippet
from his HTML email is:

</font><font size=3><a href="http://www.colby.edu/" eudora="autourl"><font color="red"><b>MailScanner has detected a possible fraud attempt from "www.colby.edu" claiming to be</b></font> www.colby.edu<br><br>

The syslog from MailScanner said:

MailScanner[7142]: Found phishing fraud from www.colby.edu claiming to be www.colby.edu<br><br>

I suppose the extra br's at the end fouled things up.  Or maybe the
trailing slash at the end of the URL?  Something to contemplate.
Boy, I sure wish the msg id could appear in syslog output...

BTW, I just discovered that the default for Eudora 6.1 is both plain and
html text (they call it "styled text").  Yuck, I hate HTML email.

Jeff Earickson
Colby College

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From michele at BLACKNIGHTSOLUTIONS.COM  Fri Nov  5 21:48:51 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:30 2006
Subject: Report Feature Request - was RE: [MAILSCANNER] FW: Warning: E-mail
    viruses detected
Message-ID: <mailman.4372.1137101250.24926.mailscanner@lists.mailscanner.info>

>--
>MailScanner
>Email Virus Scanner
>www.mailscanner.info
>Mailscanner thanks transtec Computers for their support


I was thinking about this over the last few days.

Would it be possible to define a global variable to pass to all the reports
instead of the standard mailscanner.info link?

How many emails does Julian get about emails on other systems?


Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
Proud sponsors of MM04 {http://www.mm04.net}

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ugob at CAMO-ROUTE.COM  Fri Nov  5 21:47:46 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:30 2006
Subject: 4.35.11: more phony phishing phailures
Message-ID: <mailman.4373.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Jeff A. Earickson wrote:
> Julian,
>
> I just got a complaint about this from in-house, where the guy
> has our URL in his signature, and he uses HTML email.  The snippet
> from his HTML email is:
>
> </font><font size=3><a href="http://www.colby.edu/"
> eudora="autourl"><font color="red"><b>MailScanner has detected a
> possible fraud attempt from "www.colby.edu" claiming to be</b></font>
> www.colby.edu<br><br>
>
> The syslog from MailScanner said:
>
> MailScanner[7142]: Found phishing fraud from www.colby.edu claiming to
> be www.colby.edu<br><br>
>
> I suppose the extra br's at the end fouled things up.  Or maybe the
> trailing slash at the end of the URL?  Something to contemplate.
> Boy, I sure wish the msg id could appear in syslog output...
>
> BTW, I just discovered that the default for Eudora 6.1 is both plain and
> html text (they call it "styled text").  Yuck, I hate HTML email.
>

What version of MailScanner are you running?

> Jeff Earickson
> Colby College
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Kevin_Miller at CI.JUNEAU.AK.US  Fri Nov  5 22:44:36 2004
From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller)
Date: Thu Jan 12 21:27:30 2006
Subject: Report Feature Request - was RE: [MAILSCANNER] FW: Warning: E
    -mail viruses detected
Message-ID: <mailman.4374.1137101250.24926.mailscanner@lists.mailscanner.info>

Michele Neylon :: Blacknight Solutions wrote:
>
> I was thinking about this over the last few days.
>
> Would it be possible to define a global variable to pass to all the
> reports instead of the standard mailscanner.info link?
>
> How many emails does Julian get about emails on other systems?

I'd love to see that too - I brought it up a year or more ago, but didn't
want to push it given the tremendous work Julian puts into MS already.  We
sure can't complain that we're being neglected by the vendor!

I used to edit the reports when I upgraded but finally gave up! <g>

S'later...

...Kevin
--
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Admin., Mail Admin.
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ELKNET.NET  Fri Nov  5 23:09:25 2004
From: mailscanner at ELKNET.NET (Alan)
Date: Thu Jan 12 21:27:30 2006
Subject: MS performance as a gateway comments
Message-ID: <mailman.4375.1137101250.24926.mailscanner@lists.mailscanner.info>

On Fri, 5 Nov 2004 17:31:51 +0000, Martin Hepworth
<martinh@SOLID-STATE-LOGIC.COM> wrote:

>Alan
>
>your specs and message flow don't seem to match the other high end boxes
>(ie you system should be able to handle well over a million messages aday).

Agreed, but no one has ever been able to pinpoint why.

>what extra SA rules are you running? I wonder if some of the larger ones
>are causing problems (not to mention the RBLs - are you running a local
>caching nameserver on t he box0?

I'm running:
70_sare_adult.cf      70_sare_unsub.cf               evilnumbers.cf
70_sare_genlsubj0.cf  70_sare_uri.cf                 local.cf
70_sare_header0.cf    70_sc_top200.cf                mangled.cf
70_sare_html0.cf      72_sare_redirect_post3.0.0.cf  weeds.cf
70_sare_oem.cf        99_FVGT_Tripwire.cf
70_sare_specific.cf   chickenpox.cf

But again, please note that my throughput and server load have NEVER been
due to MS/SA. Whenever I had a large backlog in the incoming queue, if I
shut down all the MTA processes, then MS/SA would scream through the queue
just fine. The load has always been due to the resources taken by the MTAs.

In any case, my point was simply that out of the available MTAs, I have seen
a drastic performance improvement when using zmailer vs sendmail and exim.

-Alan

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From natedog550 at HOTMAIL.COM  Sat Nov  6 00:41:42 2004
From: natedog550 at HOTMAIL.COM (Nathan P.)
Date: Thu Jan 12 21:27:30 2006
Subject: New Fresh Install Problems SuSE 9.1
Message-ID: <mailman.4376.1137101250.24926.mailscanner@lists.mailscanner.info>

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Julian Field
Sent: Friday, November 05, 2004 9:17 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: New Fresh Install Problems SuSE 9.1
>
> Mike Zanker wrote:
>
> > Nathan P. wrote:
> >
> >> You wouldn't happen to know the "correct" way to do it on SuSE would
> >> you?
> >> I've rebuilt src rpms once before a long time ago but I foget how to
> >> do it.
> >>
> >> Before I do some googling does anyone know the way to do it in SuSE?
> >
> >
> > From Julian's post of two days ago:
> >
> > cd MailScanner-4.35.9-1
> > rpm -Uvh perl-MIME-Base64-3.05-2.src.rpm
> > pushd /usr/src/packages/SPECS
> > rpmbuild -bp perl-MIME-Base64.spec
> > cd ../BUILD
> > cd perl-MIME-Base64-3.05
> > perl Makefile.PL
> > make
> > make test
> > make install
> > popd
> > ./install.sh fast
>
> Why not just install 4.35.11 instead? I have fixed these problems already.
>
> --
> Julian Field
> www.MailScanner.info


Yeah Julian that worked.  I was not aware there was a .11 version out.  I
didn't get the announce email for some odd reason.  Neways, that fixed it.
Much thanks Julian!!!

--
NateDog

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ugob at CAMO-ROUTE.COM  Sat Nov  6 03:53:25 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:30 2006
Subject: New errors in maillog
Message-ID: <mailman.4377.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Brian Berglund wrote:
> I cannot seem to get this progam to start correctly.
>
> I am trying to use MailWatch with it and I get
> Nov  5 13:16:54 linux-relay1 MailScanner[2309]: Could not use Custom
> Function code MailScanner::CustomConfig::InitMailWatchLogging, it could
> not be "eval"ed\
> . Make sure the module is correct with perl -wc
> Then for postfix I keep getting.
>
> Nov  5 13:17:05 linux-relay1 MailScanner[2771]: Messages found but no
> hashed queue directories. Please enable hashed queues for incoming and
> deferred with a\
>  depth of 1 or 2. See the Postfix documentation for hash_queue_names and
> hash_queue_depth
> I have those two parameters set.
> hash_queue_depth = 2
> hash_queue_names = defer incoming deffered
>
> Can anyone help out?????

is that a new install?  an upgrade? what version? what os?

>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From alden at engineno9inc.com  Sat Nov  6 04:33:39 2004
From: alden at engineno9inc.com (Alden Levy)
Date: Thu Jan 12 21:27:30 2006
Subject: SURBL not working properly in MailScanner 4.35.9
Message-ID: <mailman.4378.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> Date:    Fri, 5 Nov 2004 10:26:56 +0100
> From:    Jan-Peter Koopmann <Jan-Peter.Koopmann@SECEIDOS.DE>
> Subject: Re: SURBL not working properly in MailScanner 4.35.9
>
> On Friday, November 05, 2004 9:12 AM MailScanner mailing list wrote:
>
>> Would you mind sharing how to put init.pre and 25_uribl.c in
>> spam.assassin.prefs.conf file ?
>
> There is no need for putting anything in spam.assassin.prefs.conf as far
> as I know. If you have=20
>
> loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
>
> in your init.pre that should be sufficient. Please run a testmessage
> through spamassassin with the debugging option
>
> spamassassin -D < testmessage
>
> and analyze the output. It did not work here at first until I figured
> out that Net::DNS was either not installed or the wrong version (can't
> remember). The debug log should show you though.
>
> Kind regards,
>   JP
>
JP,
You may be on to something with Net::DNS, although it *seems* to work.
The output of spamassassin -D < testmessage (with a SURBL URL in it) is
correct with a standard setup.

My Net::DNS is 0.48, but when I try to force install (with cpan), I get a
few errors when I enable the Internet tests:
t/00-load..................ok
t/00-pod...................ok
t/00-version...............ok
t/01-resolver-env..........ok
t/01-resolver-file.........ok
        7/8 skipped: Could not read configuration file
t/01-resolver-opt..........ok
t/01-resolver..............ok
t/02-header................ok
t/03-question..............ok
t/04-packet-unique-push....ok
t/04-packet................ok
t/05-rr-sshfp..............skipped
        all skipped: Digest::BubbleBabble not installed.
t/05-rr-txt................ok
t/05-rr-unknown............ok
t/05-rr....................ok
t/06-update................ok
t/07-misc..................ok
t/08-online................ok
t/09-tkey..................ok
t/10-recurse...............ok 2/12Server [198.41.0.4] did not give answers
at /root/.cpan/build/Net-DNS-0.48/blib/lib/Net/DNS/Resolver/Recurse.pm
line 73.
t/10-recurse...............NOK 4
#     Failed test (t/10-recurse.t at line 30)
t/10-recurse...............NOK 5
#     Failed test (t/10-recurse.t at line 36)
Can't call method "answer" on an undefined value at t/10-recurse.t line 37.
# Looks like you planned 12 tests but only ran 5.
# Looks like your test died just after 5.
t/10-recurse...............dubious
        Test returned status 255 (wstat 65280, 0xff00)
Scalar found where operator expected at (eval 154) line 1, near "'int'
$__val"
        (Missing operator before   $__val?)
DIED. FAILED tests 4-12
        Failed 9/12 tests, 25.00% okay
Failed Test    Stat Wstat Total Fail  Failed  List of Failed
-------------------------------------------------------------------------------
t/10-recurse.t  255 65280    12   16 133.33%  4-12
1 test and 7 subtests skipped.
Failed 1/20 test scripts, 95.00% okay. 9/872 subtests failed, 98.97% okay.
make: *** [test_dynamic] Error 2
  /usr/bin/make test -- NOT OK
Running make install
cpan> force install Net::DNSRunning Mkbootstrap for Net::DNS ()
chmod 644 DNS.bs
rm -f blib/arch/auto/Net/DNS/DNS.so
LD_RUN_PATH="/lib" gcc  -shared -L/usr/local/lib DNS.o  -o
blib/arch/auto/Net/DNS/DNS.so   -lresolv
chmod 755 blib/arch/auto/Net/DNS/DNS.so
cp DNS.bs blib/arch/auto/Net/DNS/DNS.bs
chmod 644 blib/arch/auto/Net/DNS/DNS.bs
Files found in blib/arch: installing files in blib/lib into architecture
dependent library tree
Writing
/usr/lib/perl5/site_perl/5.8.1/i386-linux-thread-multi/auto/Net/DNS/.packlist
Appending installation info to
/usr/lib/perl5/5.8.1/i386-linux-thread-multi/perllocal.pod
  /usr/bin/make install  -- OK

I'd love to go back to using SURBL the "normal" way, so any advice is
appreciated.

I've attached my s.a.prefs.conf for others to use (e.g., Remco) until we
fix this problem.

Thanks,
Alden

Alden Levy
Engine No. 9, Inc.
130 West 57th Street, Suite 12E
New York, NY 10019
(212) 981-1122
(212) 725-7202 (fax)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/OCTET-STREAM (Name: ]
    [ "spam.assassin.prefs.uribl.11-03-04")  17KB. ]
    [ Unable to print this part. ]


From marco at XSSNET.COM  Sat Nov  6 04:41:11 2004
From: marco at XSSNET.COM (Marco Benton)
Date: Thu Jan 12 21:27:30 2006
Subject: MS performance as a gateway comments
Message-ID: <mailman.4379.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Alan wrote:

>I'm running:
>70_sare_adult.cf      70_sare_unsub.cf               evilnumbers.cf
>70_sare_genlsubj0.cf  70_sare_uri.cf                 local.cf
>70_sare_header0.cf    70_sc_top200.cf                mangled.cf
>70_sare_html0.cf      72_sare_redirect_post3.0.0.cf  weeds.cf
>70_sare_oem.cf        99_FVGT_Tripwire.cf
>70_sare_specific.cf   chickenpox.cf
>
>But again, please note that my throughput and server load have NEVER been
>due to MS/SA. Whenever I had a large backlog in the incoming queue, if I
>shut down all the MTA processes, then MS/SA would scream through the queue
>just fine. The load has always been due to the resources taken by the MTAs.
>
>In any case, my point was simply that out of the available MTAs, I have seen
>a drastic performance improvement when using zmailer vs sendmail and exim.
>
>-Alan
>
>

have you tried configuring Sendmail to not fork off a process for each
message?  might slow sendmail down a bit but you wont use up all your
resources.

i think the sc_top200.cf is redundant if you are using spamcop RBL's.

--

Marco Benton - BOFH, BSMFH
Network Consultant
Phone: (774) 808-4051
Fax  : (508) 519-6033

BOFH excuse #257: The cause of the problem is: That's easy to fix, but I can't be bothered.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From marco at XSSNET.COM  Sat Nov  6 04:47:29 2004
From: marco at XSSNET.COM (Marco Benton)
Date: Thu Jan 12 21:27:30 2006
Subject: SA 3.0.1 and Bayes poisoning issue?
Message-ID: <mailman.4380.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Matt Kettler wrote:

> At 11:21 AM 11/5/2004, Jeff A. Earickson wrote:
>
>> I have in my spam.assassin.prefs.conf file the following:
>>
>> #---tweaks to combat neg bayes poisoning
>> score BAYES_00 0 0 -0.05 -0.05
>> score BAYES_01 0 0 -0.04 -0.04
>> score BAYES_10 0 0 -0.03 -0.03
>> score BAYES_20 0 0 -0.02 -0.02
>> score BAYES_30 0 0 -0.01 -0.01
>>
>> left over from the SA 2.64 era.  I'm wondering if I should remove
>> this now that I'm running SA 3.0.1.  Comments anybody?
>
>
> If you had bayes poisoning problems serious enough for you to have to do
> that, upgrading spamassassin will definitely NOT fix the problem.
>
> If you've got more than 0.01% of your spam matching BAYES_00 that's a
> serious mis-training problem, and there's nothing a SA upgrade can do to
> fix that. AFAIK no version of SA has ever had bayes poisoning problems if
> properly trained, and mine certainly never has (I've been using bayes
> since
> 2.53 came out)
>
> Bad training is bad training. Code can't fix bad training. Wipe out your
> database and start over.
>
> And beware.. Never rely on autolearning alone. You've got a good
> chance of
> the bayes DB starting off on the wrong foot and getting stuck there.
> At the
> very least hand-seed a handful of emails into sa-learn when you start
> off.


probably might be a good idea to have SA only learn on certain score
thresholds.

adjust these params:
bayes_auto_learn_threshold_spam
bayes_auto_learn_threshold_nonspam


--

Marco Benton - BOFH, BSMFH
Network Consultant
Phone: (774) 808-4051
Fax  : (508) 519-6033

BOFH excuse #371: The cause of the problem is: Forced to support NT servers; sysadmins quit.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From marco at XSSNET.COM  Sat Nov  6 04:52:35 2004
From: marco at XSSNET.COM (Marco Benton)
Date: Thu Jan 12 21:27:30 2006
Subject: Error starting lastest version of Mailscanner
Message-ID: <mailman.4381.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Brian Berglund wrote:
[root@linux-relay1 perl5]# ls
5.8.0  5.8.1  5.8.2  5.8.3  perl-5.8.5  site_perl  vendor_perl
 
Can someone help me get this going?  I am stuck and want to get
this asap


where does your /usr/bin/perl or /usr/local/bin/perl link to?  sounds
like it's linked to /usr/bin/perl5.8.3.

 --

Marco Benton - BOFH, BSMFH
Network Consultant
Phone: (774) 808-4051
Fax  : (508) 519-6033

BOFH excuse #393: The cause of the problem is: Jupiter is aligned with Mars.

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From hostmaster at AGIMSA.COM.MX  Sat Nov  6 07:06:37 2004
From: hostmaster at AGIMSA.COM.MX (Cecilia [iso-8859-1] Martínez)
Date: Thu Jan 12 21:27:30 2006
Subject: allow *.exe files
Message-ID: <mailman.4382.1137101250.24926.mailscanner@lists.mailscanner.info>

Fedora C1 / Ensim Pro 4.01 / MailScanner / Sendmail / ClamAV / SpamAssassin


Hello
I am new to MailScanner and I am trying to set it up so it allows *.exe
files FromOrTo a couple of domains. I followed instructions on the FAQ
document found on
http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/209.html

So, I have a rules file for my two special domains allowing *.exe files and
the default rules denying *.exe files for the rest.

I sent several test message to make sure the configuration is ok attaching
an EXE file but I never get them, nor I get any message reports saying the
file was detected, quarantined or deleted. Looking on domain's procmaillog
I found this:

  From hostmaster@firstdomain.com   Fri   Nov  5   22:05:48   2004
Subject: probando
Folder:   /dev/null

Mail was sent FROM hostmaster@firstdomain.com TO  test@seconddomain.com.
Both email accounts have unlimited quota, the server's size limit for
sending email messages is set to 30 MB (the attached file was 8 MB). The
file is not infected, that I am positive.

I am trying to find out why the test message was sent to the server's black
hole (/dev/null) but I can't find a clue!!

If I set my configuration to it's original state, EXE files are detected,
quarantined and users are advised.

Please help this troubled newbe!

Cecilia Martinez









--
Mensaje escaneado por el servicio Anti-Virus de correo de CEGIMSA

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From michele at BLACKNIGHTSOLUTIONS.COM  Sat Nov  6 12:02:07 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:30 2006
Subject: allow *.exe files
Message-ID: <mailman.4383.1137101250.24926.mailscanner@lists.mailscanner.info>

If you don't show us what you have put in your ruleset we cannot help you.



Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
Proud sponsors of MM04 {http://www.mm04.net}

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Sat Nov  6 15:56:07 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:30 2006
Subject: %rules-dir% quick question.
Message-ID: <mailman.4384.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

They are read when each child process starts. So if you do a "reload"
they will be re-read, and if you just wait a few hours then they will be
re-read too.

George wrote:

> Can someone tell me if the files that are in the %rules-dir% are read
> into memory when MS is started or if each message is checked against the
> file when scanned.
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Sat Nov  6 15:57:15 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:30 2006
Subject: Sophos antivirus
Message-ID: <mailman.4385.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

You just want the command-line sweep command, or else you can install
that then add the SAVI Perl module to it to call the library directly.

Peter Zimen wrote:

> I want to install virus scanner Sophos to cooperation with MailScanner
> on my Linux server.
>
> I dont know which version of Sophos i must have:
>
> Sophos antivirus (SAVI) or SAVI interface?
>
> Please little help :))


--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From hostmaster at AGIMSA.COM.MX  Sat Nov  6 16:02:27 2004
From: hostmaster at AGIMSA.COM.MX (Cecilia [iso-8859-1] Martínez)
Date: Thu Jan 12 21:27:30 2006
Subject: allow *.exe files
Message-ID: <mailman.4386.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

True, sorry!

Fedora C1 / Ensim Pro 4.01 / MailScanner / Sendmail / ClamAV / SpamAssassin

--------
MailScanner.conf
..
%rules-dir% = /etc/MailScanner/rules
..
Filename Rules = %etc-dir%/rules/filename.rules
..
Filetype Rules = %etc-dir%/rules/filetype.rules
--------

------
/rules/filename.rules

FromOrTo:       *@agimsa.com.mx %etc-dir%/filename.cegimsa.rules.conf
FromOrTo:       *@commsa.com    %etc-dir%/filename.cegimsa.rules.conf
FromOrTo:       *@pemex.com.mx  %etc-dir%/filename.cegimsa.rules.conf
FromOrTo:       *@pemex.com     %etc-dir%/filename.cegimsa.rules.conf
FromOrTo:       default %etc-dir%/filename.rules.conf
--------

-------
/rules/filetype.rules

FromOrTo:       *@agimsa.com.mx %etc-dir%/filetype.cegimsa.rules.conf
FromOrTo:       *@commsa.com    %etc-dir%/filetype.cegimsa.rules.conf
FromOrTo:       *@pemex.com.mx  %etc-dir%/filetype.cegimsa.rules.conf
FromOrTo:       *@pemex.com     %etc-dir%/filetype.cegimsa.rules.conf
FromOrTo:       default %etc-dir%/filetype.rules.conf
--------

-----
filename.cegimsa.rules.conf
everything the same as default exept (tab separeted):

allow   \.exe$  Windows/DOS Executable  Executable DOS/Windows programs are 
dangerous in email
----------

-------
filetype.cegimsa.rules.conf
everything the same as defult exept (tab separeted):

allow   executable      No executables  Por seguridad, no se permiten 
archivos ejecutables
-----------

filename.rules.conf > default
filetype.rules.conf > default

Hope my question makes sense now, sorry!


Cecilia Martínez



At 06:02 a.m. 06/11/2004, you wrote:
>If you don't show us what you have put in your ruleset we cannot help you.
>
>
>
>Mr Michele Neylon



-- 
Mensaje escaneado por el servicio Anti-Virus de correo de CEGIMSA

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Sat Nov  6 16:08:29 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:30 2006
Subject: 4.35.11: more phony phishing phailures
Message-ID: <mailman.4387.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Try the attached patch. It improves the URL chopping quite a bit. It's
only a 1-line change.

Jeff A. Earickson wrote:

> Julian,
>
> I just got a complaint about this from in-house, where the guy
> has our URL in his signature, and he uses HTML email.  The snippet
> from his HTML email is:
>
> </font><font size=3><a href="http://www.colby.edu/"
> eudora="autourl"><font color="red"><b>MailScanner has detected a
> possible fraud attempt from "www.colby.edu" claiming to be</b></font>
> www.colby.edu<br><br>
>
> The syslog from MailScanner said:
>
> MailScanner[7142]: Found phishing fraud from www.colby.edu claiming to
> be www.colby.edu<br><br>
>
> I suppose the extra br's at the end fouled things up.  Or maybe the
> trailing slash at the end of the URL?  Something to contemplate.
> Boy, I sure wish the msg id could appear in syslog output...
>
> BTW, I just discovered that the default for Eudora 6.1 is both plain and
> html text (they call it "styled text").  Yuck, I hate HTML email.
>
> Jeff Earickson
> Colby College
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2: "Attached Text" ]

--- Message.pm.old      2004-11-03 17:37:11.000000000 +0000
+++ Message.pm  2004-11-06 16:05:53.000000000 +0000
@@ -4057,7 +4057,7 @@
       $linkurl =~ s/\s+//; # Remove any whitespace
       $linkurl =~ s/^(https?|ftp):\/\///;
       $linkurl =~ s/\/.*$//; # Only compare up to the first '/' (hostname only)
-      $linkurl =~ s/\<\/?(br|p)\>$//i; # Remove trailing <br> and <p> tags
+      $linkurl =~ s/(\<\/?(br|p)\>)*$//ig; # Remove trailing <br> and <p> tags
       $linkurl =~ s/\/$//; # LinkURL is trimmed -- note
       #print STDERR "2SquashedText = \"$squashedtext\"\n";
       #print STDERR "2LinkURL      = \"$linkurl\"\n";

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Jan-Peter.Koopmann at SECEIDOS.DE  Sat Nov  6 17:02:32 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:30 2006
Subject: SpamAssassin auto_report_threshold
Message-ID: <mailman.4388.1137101250.24926.mailscanner@lists.mailscanner.info>

Hi guys,

I know "auto_report_threshol"d is not supported in SA3 anymore. Is there
a substitute? Can I teach SA to auto_report high scoring spam? If not:
Any easy way to use MailScanner to do this?

Thanks,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Jan-Peter.Koopmann at SECEIDOS.DE  Sun Nov  7 11:29:12 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:30 2006
Subject: SA / DCC checks / MS
Message-ID: <mailman.4389.1137101250.24926.mailscanner@lists.mailscanner.info>

Hi,

I just configured DCC checks on my gateway. When I run spamassassin -D <
message I can clearly see DCC checks and it is working. However, when a
message is processed by MailScanner, DCC checks are not performed and I
cannot figure out why. 

I am using the same local.cf/spamassassin.prefs.conf for MailScanner and
the manual test. I tried running it as the MailScanner user: Everything
ok as well. Only mails from MailScanner are not checked. Pyzor/Razor is
fine, just DCC is making trouble.

Any ideas?

Kind regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Jan-Peter.Koopmann at SECEIDOS.DE  Sun Nov  7 12:05:46 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:30 2006
Subject: SA / DCC checks / MS
Message-ID: <mailman.4390.1137101250.24926.mailscanner@lists.mailscanner.info>

> Any ideas?

Forget it. I found it. Obviously the path is different when spamassassin
is called from MailScanner. It was not able to find dccproc. After I
told it in spam.assassin.prefs.conf everything seems to work.

Regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From michele at BLACKNIGHTSOLUTIONS.COM  Sun Nov  7 12:35:20 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:30 2006
Subject: SA / DCC checks / MS
Message-ID: <mailman.4391.1137101250.24926.mailscanner@lists.mailscanner.info>

Jan

You'll find that DCC can make a very nice difference to your scores. It's
even better if you can share your DCC with another ISP or spam filtering
company, as you get to share their scores

M

Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
Proud sponsors of MM04 {http://www.mm04.net}

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Jan-Peter.Koopmann at SECEIDOS.DE  Sun Nov  7 12:43:16 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:30 2006
Subject: SA / DCC checks / MS
Message-ID: <mailman.4392.1137101250.24926.mailscanner@lists.mailscanner.info>

> You'll find that DCC can make a very nice difference to your scores.
> It's even better if you can share your DCC with another ISP or spam
> filtering company, as you get to share their scores  

I am currently using the anon DCC servers. What would make this even
better? Setting up my own DCC server and sync it with another? Any
hints?

Regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From michele at BLACKNIGHTSOLUTIONS.COM  Sun Nov  7 12:49:31 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:30 2006
Subject: SA / DCC checks / MS
Message-ID: <mailman.4393.1137101250.24926.mailscanner@lists.mailscanner.info>

> I am currently using the anon DCC servers. What would make
> this even better? Setting up my own DCC server and sync it with
> another? Any hints?

We struck a deal with another company that runs their own DCC server, so all
our checksums go to them and vice versa.
If you could do something similar with a company "close" to you it would
help. By "close" I mean ping-wise. Using any anonymous public DCC is going
to add some degree of latency into the entire thing.. Or at least that's my
understanding of it :)

If you want to contact me offlist to discuss it...

M


Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
Proud sponsors of MM04 {http://www.mm04.net}

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mgt at STELLARCORE.NET  Sun Nov  7 16:50:32 2004
From: mgt at STELLARCORE.NET (Mike Tremaine)
Date: Thu Jan 12 21:27:30 2006
Subject: Mail server backlogging - seems like a Bayes problem
Message-ID: <mailman.4394.1137101250.24926.mailscanner@lists.mailscanner.info>

On Thu, 2004-10-21 at 12:20, Matt Kettler wrote:
> If this is the case, Re-quoting myself from a post to the SA user's list:
> --------------------------------
> In the short term, you can help by running a sa-learn --force-expire on
> your bayes DB.
>
> In the longer term, here's some suggestions I use on my own MailScanner
> server: (I use all of these together)
>
> 1) Increase the spamassassin timeout in MailScanner.conf. Bring it to 60
> seconds at least, I have mine set to 120.
>
> 2) Set the "Rebuild Bayes Every" parameter in MailScanner.conf. 86400
> seconds is a good start. This makes MailScanner invoke SA's bayes
> housekeeping directly, rather than during a scan of a message.
>
> 3) in /etc/mail/spamassassin/local.cf set: bayes_auto_expire 0. This will
> keep SA from trying to run bayes expires (long and slow) during message
> handling, but relies on #2 above to allow expiry to occur.
>
> 4) I also have a sa-learn --force-expire running as a daily cronjob. I have
> tested the setup without this measure, and #2 is sufficient to cause expiry
> to occur. Really this is just a fail-safe to allow expiry to occur even if
> MailScanner's calls fail to run it properly for some reason.

Have you tested this setup under SA 3.0.1? The reason I ask is I used
this advise to configure a MailScanner Gateway that I was having a lot
of timeouts with [200-300] and it worked great. [Dropped to 1 timeout
per day]. This week I migrated this server to a new box and started with
the all new installs [MS  4.35-9, SA 3.0.1, ClamAV .80, etc...]
Everything is working fine except I'm back up to 40 timeouts. Just
wondering if anyone else has seen this. [It could very well be that I
get that many email during the rebuild, not sure, I should really look
at the logs.]

 MailScanner Status:
        22566 messages Scanned by MailScanner
        190.3 Total MB
        19661 Spam messages detected by MailScanner
        129 Messages forwarded unscanned by MailScanner
        125 Viruses found by MailScanner
        119 Banned attachments found by MailScanner
        3 Content Problems found by MailScanner
        3748 Messages delivered by MailScanner

        40 SpamAssassin timeout(s)

--
Mike Tremaine
mgt@stellarcore.net
http://www.stellarcore.net

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From dfilchak at sympatico.ca  Mon Nov  8 03:30:18 2004
From: dfilchak at sympatico.ca (Dave Filchak)
Date: Thu Jan 12 21:27:30 2006
Subject: Vacation Messages
Message-ID: <mailman.4395.1137101250.24926.mailscanner@lists.mailscanner.info>

At the risk of getting lectures about not using the vacation program, I need
to ask a question about it because I do have a few clients who insist on it.


The program has been working, or at least I have not had any complaints
about it. However, after a number of updates of MailScanner, it appears not
to be working. I get no errors in the maillog and in fact, it appears to be
working i.e.

Nov  7 22:19:56 rosewood sendmail[24176]: iA83JuxH024176:
from=<someguy@sympatico.ca>, size=916, class=0, nrcpts=1,
msgid=<20041108030405.GFQU2542.tomts22-srv.somenet.net@willow>, proto=ESMTP,
daemon=MTA, relay=tomts22.somenet.net [209.226.175.184]
Nov  7 22:19:56 rosewood MailScanner[21519]: New Batch: Scanning 1 messages,
1437 bytes
Nov  7 22:19:56 rosewood MailScanner[21519]: Spam Checks: Starting
Nov  7 22:19:59 rosewood MailScanner[21519]: Virus and Content Scanning:
Starting
Nov  7 22:19:59 rosewood MailScanner[21519]: Uninfected: Delivered 1
messages
Nov  7 22:19:59 rosewood sendmail[24186]: iA83JuxH024176: to=\\zu-022-mail,
delay=00:00:03, xdelay=00:00:00, mailer=local, pri=120916, dsn=2.0.0,
stat=Sent
Nov  7 22:19:59 rosewood sendmail[24186]: iA83JuxH024176:
to="|/usr/bin/vacation -a -t zu-022-mail", ctladdr=<someguy@net.net>
(535/12), delay=00:00:03, xdelay=00:00:00, mailer=prog, pri=120916,
dsn=2.0.0, stat=Sent

I am not sure if this has anything to do with MailScanner, however, I was
wondering if anyone had any experience with this and might offer some
insight.

Thanks

Dave

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From pat713ou at PACIFIC.NET.SG  Mon Nov  8 06:46:41 2004
From: pat713ou at PACIFIC.NET.SG (Patrick Ou Yong)
Date: Thu Jan 12 21:27:30 2006
Subject: Help needed.
Message-ID: <mailman.4396.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi,

I seem to have encountered this problem with my server running mailscanner.

In the exim logs I see this.

Mails can be sent to the address but its not going anyway. Any help would be
appreciated. Thank you!

Patrick

2004-11-08 14:39:42 1CR19x-0004Vk-Uw == patrick@eonserve.com routing defer
(-51): retry time not reached
2004-11-08 14:39:42 1CR3Ax-0005Ev-D8 == siewching@frontier-wealth.com
routing defer (-51): retry time not reached
2004-11-08 14:39:42 1CQyqQ-0006Hg-Pn == vinod@thejewelbox.com routing defer
(-51): retry time not reached
2004-11-08 14:39:42 1CQx8Q-0004IM-Q6 == info@thejewelbox.com routing defer
(-51): retry time not reached
2004-11-08 14:39:42 1CQzVQ-0005Em-Oq == markyang@frontier-wealth.com routing
defer (-51): retry time not reached
2004-11-08 14:39:42 1CR2xN-0005MQ-Qh == cindy@tep.com.sg routing defer
(-51): retry time not reached
2004-11-08 14:39:42 1CR0rq-0002aO-Vv == charlie@borneoadventure.com
R=defer_router defer (-1): All deliveries are handled by MailScanner
2004-11-08 14:39:42 1CR05q-00009j-89 == casey@avi.com.sg R=defer_router
defer (-1): All deliveries are handled by MailScanner
2004-11-08 14:39:42 1CR1oU-0003hh-8p == siewching@frontier-wealth.com
routing defer (-51): retry time not reached
2004-11-08 14:39:42 1CR1oU-0003hh-8p == csching@singnet.com.sg routing defer
(-51): retry time not reached
2004-11-08 14:39:42 1CR15U-0000xt-BN == vinod@thejewelbox.com routing defer
(-51): retry time not reached
2004-11-08 14:39:42 1CR1uU-0007Jw-AF == willcai@frontier-wealth.com routing
defer (-51): retry time not reached
2004-11-08 14:39:42 1CR2xG-0005HE-Tk == samantha@frontier-wealth.com routing
defer (-51): retry time not reached
2004-11-08 14:39:42 1CR19G-0001ii-Lt == sheldon@tpp.com.sg routing defer
(-51): retry time not reached
2004-11-08 14:39:42 1CR19G-0001ii-Lt == wan@tpp.com.sg routing defer (-51):
retry time not reached
2004-11-08 14:39:42 1CR1eR-0005xC-TR == sheldon@tpp.com.sg routing defer
(-51): retry time not reached
2004-11-08 14:39:42 1CQzdR-0003DE-Bs == michaelwee@frontier-wealth.com
routing defer (-51): retry time not reached

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Jan-Peter.Koopmann at SECEIDOS.DE  Mon Nov  8 07:02:26 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:30 2006
Subject: Help needed.
Message-ID: <mailman.4397.1137101250.24926.mailscanner@lists.mailscanner.info>

Hi Patrick,

> Mails can be sent to the address but its not going anyway.

Search your logs. Exim at the moment is not trying to deliver the
messages. It was trying and kept failing. Maybe your internet connection
was down or something similar. Since it could not deliver the mail it is
obeying its retry rules. And those rules tell it to try again in such
and such time (retry time) which is not reached yet.

You should try to 

a) figure out when this happened and why
b) maybe tweak your retry settings
c) flush the queue with exim -qf (don't forget to specify your outgoing
configuration file with -C as well)

Regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From pat713ou at PACIFIC.NET.SG  Mon Nov  8 07:40:30 2004
From: pat713ou at PACIFIC.NET.SG (Patrick Ou Yong)
Date: Thu Jan 12 21:27:30 2006
Subject: Help needed.
Message-ID: <mailman.4398.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Thank you for much for your kind assistance.

it turns out that the Cpanel server I am on, upgraded and the patch really
screwed the mail queues.

Just for reference sake, for those who wish to know more , may refer to
these posting.


http://forums.cpanel.net/showthread.php?t=31800
http://forums.cpanel.net/showthread.php?t=28186

Regards

Patrick

----- Original Message -----
From: "Jan-Peter Koopmann" <Jan-Peter.Koopmann@SECEIDOS.DE>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Monday, November 08, 2004 3:02 PM
Subject: Re: Help needed.


Hi Patrick,

> Mails can be sent to the address but its not going anyway.

Search your logs. Exim at the moment is not trying to deliver the
messages. It was trying and kept failing. Maybe your internet connection
was down or something similar. Since it could not deliver the mail it is
obeying its retry rules. And those rules tell it to try again in such
and such time (retry time) which is not reached yet.

You should try to

a) figure out when this happened and why
b) maybe tweak your retry settings
c) flush the queue with exim -qf (don't forget to specify your outgoing
configuration file with -C as well)

Regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ELKNET.NET  Sun Nov  7 23:45:00 2004
From: mailscanner at ELKNET.NET (Alan)
Date: Thu Jan 12 21:27:30 2006
Subject: MS performance as a gateway comments
Message-ID: <mailman.4399.1137101250.24926.mailscanner@lists.mailscanner.info>

On Fri, 5 Nov 2004 23:41:11 -0500, Marco Benton <marco@XSSNET.COM> wrote:

>have you tried configuring Sendmail to not fork off a process for each
>message?  might slow sendmail down a bit but you wont use up all your
>resources.

Nope, don't know how to do it, never found any threads or FAQ on the site
related to doing so.

But I DO know that zmailer does that without taking any special steps, and
by doing so it speeds up processing, not slow it down as suspected would be
the case with sendmail.

>i think the sc_top200.cf is redundant if you are using spamcop RBL's.

sc_top200 is checking URIs found in the body of the message, not the ip
source of the sending smtp server, which is what RBL's do. The only
redundancy I could see would be between sc_top200 and one of the SURBLs, not
RBLs. If that is the case, I'll sure drop using sc_top200, but I have not
seen any mention that any of the SURBLs duplicate top200.

Thanks,
-Alan

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From raymond at PROLOCATION.NET  Sun Nov  7 23:53:20 2004
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:27:30 2006
Subject: MS performance as a gateway comments
Message-ID: <mailman.4400.1137101250.24926.mailscanner@lists.mailscanner.info>

Hi!

> sc_top200 is checking URIs found in the body of the message, not the ip
> source of the sending smtp server, which is what RBL's do. The only
> redundancy I could see would be between sc_top200 and one of the SURBLs, not
> RBLs. If that is the case, I'll sure drop using sc_top200, but I have not
> seen any mention that any of the SURBLs duplicate top200.

One of the lists is compiled out of SC data, but thats a smaller one. The
other SURBL lists most likely will also get those other URLs. Would be
interesting to see if you get hits on sc_top200 thats not caught bu other
SURBLs. My guess, you wont find any... ;) But let me know.

Bye,
Raymond.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From marco at XSSNET.COM  Mon Nov  8 00:12:20 2004
From: marco at XSSNET.COM (Marco Benton)
Date: Thu Jan 12 21:27:30 2006
Subject: MS performance as a gateway comments
Message-ID: <mailman.4401.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Alan wrote:

 On Fri, 5 Nov 2004 23:41:11 -0500, Marco Benton <marco@XSSNET.COM> wrote:

  

 have you tried configuring Sendmail to not fork off a process for each
message?  might slow sendmail down a bit but you wont use up all your
resources.
    

 Nope, don't know how to do it, never found any threads or FAQ on the site
related to doing so.

But I DO know that zmailer does that without taking any special steps, and
by doing so it speeds up processing, not slow it down as suspected would be
the case with sendmail.
  


here are some examples:

define(`confSEPARATE_PROC',`false')
define(`confMAX_DAEMON_CHILDREN',160)
define(`confSINGLE_THREAD_DELIVERY')
define(`confMAX_QUEUE_CHILDREN',2)

all this is dependant on how much mail or system resources you have, and
how fast you want actual mail to be delivered...  before the days of spam
mail was instantaneous...  now most companies just accept a delay due to
virus and spam checking...  so a few minute wait is no big deal.  but i
never seen a resource problem and i get 50,000-100,000+ emails a day, SA
is ususally the bottleneck.

 --

Marco Benton - BOFH, BSMFH
Network Consultant
Phone: (774) 808-4051
Fax  : (508) 519-6033

BOFH excuse #107: The cause of the problem is: The air conditioning water supply pipe ruptured over the machine room

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From andersjk at SOL-INVICTUS.ORG  Mon Nov  8 09:01:46 2004
From: andersjk at SOL-INVICTUS.ORG (Kevin Anderson)
Date: Thu Jan 12 21:27:30 2006
Subject: mail1.internet.net
Message-ID: <mailman.4402.1137101250.24926.mailscanner@lists.mailscanner.info>

Was wondering if anyone is having the same issue receiving spam from a las
vegas host, lots of domains ending with *internet.net but the mx pointing
to a non operating smtp server? So vacation replies get bounced and are
filling up the queue...

thanks,
kevin

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From martinh at SOLID-STATE-LOGIC.COM  Mon Nov  8 09:39:03 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:30 2006
Subject: MS performance as a gateway comments
Message-ID: <mailman.4403.1137101250.24926.mailscanner@lists.mailscanner.info>

Alan

very odd indeed.....

What linux dist and kernel are you running? Are you running a local
(caching) name server? It's nice to know you've got around the issue,
but I gues it'd be nice to know why...

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Alan wrote:
> On Fri, 5 Nov 2004 17:31:51 +0000, Martin Hepworth
> <martinh@SOLID-STATE-LOGIC.COM> wrote:
>
>
>>Alan
>>
>>your specs and message flow don't seem to match the other high end boxes
>>(ie you system should be able to handle well over a million messages aday).
>
>
> Agreed, but no one has ever been able to pinpoint why.
>
>
>>what extra SA rules are you running? I wonder if some of the larger ones
>>are causing problems (not to mention the RBLs - are you running a local
>>caching nameserver on t he box0?
>
>
> I'm running:
> 70_sare_adult.cf      70_sare_unsub.cf               evilnumbers.cf
> 70_sare_genlsubj0.cf  70_sare_uri.cf                 local.cf
> 70_sare_header0.cf    70_sc_top200.cf                mangled.cf
> 70_sare_html0.cf      72_sare_redirect_post3.0.0.cf  weeds.cf
> 70_sare_oem.cf        99_FVGT_Tripwire.cf
> 70_sare_specific.cf   chickenpox.cf
>
> But again, please note that my throughput and server load have NEVER been
> due to MS/SA. Whenever I had a large backlog in the incoming queue, if I
> shut down all the MTA processes, then MS/SA would scream through the queue
> just fine. The load has always been due to the resources taken by the MTAs.
>
> In any case, my point was simply that out of the available MTAs, I have seen
> a drastic performance improvement when using zmailer vs sendmail and exim.
>
> -Alan
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at BARENDSE.TO  Mon Nov  8 10:04:17 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:30 2006
Subject: SURBL not working properly in MailScanner 4.35.9
Message-ID: <mailman.4404.1137101250.24926.mailscanner@lists.mailscanner.info>

On Fri, 5 Nov 2004, Alden Levy wrote:

>> Date:    Fri, 5 Nov 2004 10:26:56 +0100
>> From:    Jan-Peter Koopmann <Jan-Peter.Koopmann@SECEIDOS.DE>
>> Subject: Re: SURBL not working properly in MailScanner 4.35.9
>>
>> On Friday, November 05, 2004 9:12 AM MailScanner mailing list wrote:
>>
>>> Would you mind sharing how to put init.pre and 25_uribl.c in
>>> spam.assassin.prefs.conf file ?
>>
>> There is no need for putting anything in spam.assassin.prefs.conf as far
>> as I know. If you have=20
>>
>> loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
>>
>> in your init.pre that should be sufficient. Please run a testmessage
>> through spamassassin with the debugging option
>>
>> spamassassin -D < testmessage
>>
>> and analyze the output. It did not work here at first until I figured
>> out that Net::DNS was either not installed or the wrong version (can't
>> remember). The debug log should show you though.
>>
>> Kind regards,
>>   JP
>>
> JP,
> You may be on to something with Net::DNS, although it *seems* to work.
> The output of spamassassin -D < testmessage (with a SURBL URL in it) is
> correct with a standard setup.

You are probably right. I just downloaded the latest tarball
install-clamav-spamass and tried to rebuild the SRPM.

It did not build because it needed Win32::Registry

Trying to install that module through perl from CPAN failed with some
other dependencies (I *hate* perl)

I will nuke the box entirely and do a full reinstall. Hopefully it will
solve my problems.

Thanks for the help and tips and will post the result!


>
> My Net::DNS is 0.48, but when I try to force install (with cpan), I get a
> few errors when I enable the Internet tests:
> t/00-load..................ok
> t/00-pod...................ok
> t/00-version...............ok
> t/01-resolver-env..........ok
> t/01-resolver-file.........ok
>        7/8 skipped: Could not read configuration file
> t/01-resolver-opt..........ok
> t/01-resolver..............ok
> t/02-header................ok
> t/03-question..............ok
> t/04-packet-unique-push....ok
> t/04-packet................ok
> t/05-rr-sshfp..............skipped
>        all skipped: Digest::BubbleBabble not installed.
> t/05-rr-txt................ok
> t/05-rr-unknown............ok
> t/05-rr....................ok
> t/06-update................ok
> t/07-misc..................ok
> t/08-online................ok
> t/09-tkey..................ok
> t/10-recurse...............ok 2/12Server [198.41.0.4] did not give answers
> at /root/.cpan/build/Net-DNS-0.48/blib/lib/Net/DNS/Resolver/Recurse.pm
> line 73.
> t/10-recurse...............NOK 4
> #     Failed test (t/10-recurse.t at line 30)
> t/10-recurse...............NOK 5
> #     Failed test (t/10-recurse.t at line 36)
> Can't call method "answer" on an undefined value at t/10-recurse.t line 37.
> # Looks like you planned 12 tests but only ran 5.
> # Looks like your test died just after 5.
> t/10-recurse...............dubious
>        Test returned status 255 (wstat 65280, 0xff00)
> Scalar found where operator expected at (eval 154) line 1, near "'int'
> $__val"
>        (Missing operator before   $__val?)
> DIED. FAILED tests 4-12
>        Failed 9/12 tests, 25.00% okay
> Failed Test    Stat Wstat Total Fail  Failed  List of Failed
> -------------------------------------------------------------------------------
> t/10-recurse.t  255 65280    12   16 133.33%  4-12
> 1 test and 7 subtests skipped.
> Failed 1/20 test scripts, 95.00% okay. 9/872 subtests failed, 98.97% okay.
> make: *** [test_dynamic] Error 2
>  /usr/bin/make test -- NOT OK
> Running make install
> cpan> force install Net::DNSRunning Mkbootstrap for Net::DNS ()
> chmod 644 DNS.bs
> rm -f blib/arch/auto/Net/DNS/DNS.so
> LD_RUN_PATH="/lib" gcc  -shared -L/usr/local/lib DNS.o  -o
> blib/arch/auto/Net/DNS/DNS.so   -lresolv
> chmod 755 blib/arch/auto/Net/DNS/DNS.so
> cp DNS.bs blib/arch/auto/Net/DNS/DNS.bs
> chmod 644 blib/arch/auto/Net/DNS/DNS.bs
> Files found in blib/arch: installing files in blib/lib into architecture
> dependent library tree
> Writing
> /usr/lib/perl5/site_perl/5.8.1/i386-linux-thread-multi/auto/Net/DNS/.packlist
> Appending installation info to
> /usr/lib/perl5/5.8.1/i386-linux-thread-multi/perllocal.pod
>  /usr/bin/make install  -- OK
>
> I'd love to go back to using SURBL the "normal" way, so any advice is
> appreciated.
>
> I've attached my s.a.prefs.conf for others to use (e.g., Remco) until we
> fix this problem.
>
> Thanks,
> Alden
>
> Alden Levy
> Engine No. 9, Inc.
> 130 West 57th Street, Suite 12E
> New York, NY 10019
> (212) 981-1122
> (212) 725-7202 (fax)
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at BARENDSE.TO  Mon Nov  8 10:29:18 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:30 2006
Subject: SURBL not working properly in MailScanner 4.35.9
Message-ID: <mailman.4405.1137101250.24926.mailscanner@lists.mailscanner.info>

Some people give me hell for top posting but the list rejects a
message if you don't. I didn't like bottom posting anyways :)

The comments are still below :)

Cheers!

---------- Forwarded message ----------
Date: Mon, 8 Nov 2004 11:04:17 +0100 (CET)
From: Remco Barendse <mailscanner@barendse.to>
To: Alden Levy <alden@ENGINENO9INC.COM>
Cc: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
Subject: Re: SURBL not working properly in MailScanner 4.35.9

On Fri, 5 Nov 2004, Alden Levy wrote:

>> Date:    Fri, 5 Nov 2004 10:26:56 +0100
>> From:    Jan-Peter Koopmann <Jan-Peter.Koopmann@SECEIDOS.DE>
>> Subject: Re: SURBL not working properly in MailScanner 4.35.9
>>
>> On Friday, November 05, 2004 9:12 AM MailScanner mailing list wrote:
>>
>>> Would you mind sharing how to put init.pre and 25_uribl.c in
>>> spam.assassin.prefs.conf file ?
>>
>> There is no need for putting anything in spam.assassin.prefs.conf as far
>> as I know. If you have=20
>>
>> loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
>>
>> in your init.pre that should be sufficient. Please run a testmessage
>> through spamassassin with the debugging option
>>
>> spamassassin -D < testmessage
>>
>> and analyze the output. It did not work here at first until I figured
>> out that Net::DNS was either not installed or the wrong version (can't
>> remember). The debug log should show you though.
>>
>> Kind regards,
>> JP
>>
> JP,
> You may be on to something with Net::DNS, although it *seems* to work.
> The output of spamassassin -D < testmessage (with a SURBL URL in it) is
> correct with a standard setup.

You are probably right. I just downloaded the latest tarball
install-clamav-spamass and tried to rebuild the SRPM.

It did not build because it needed Win32::Registry

Trying to install that module through perl from CPAN failed with some other
dependencies (I *hate* perl)

I will nuke the box entirely and do a full reinstall. Hopefully it will solve
my problems.

Thanks for the help and tips and will post the result!


>
> My Net::DNS is 0.48, but when I try to force install (with cpan), I get a
> few errors when I enable the Internet tests:
> t/00-load..................ok
> t/00-pod...................ok
> t/00-version...............ok
> t/01-resolver-env..........ok
> t/01-resolver-file.........ok
>       7/8 skipped: Could not read configuration file
> t/01-resolver-opt..........ok
> t/01-resolver..............ok
> t/02-header................ok
> t/03-question..............ok
> t/04-packet-unique-push....ok
> t/04-packet................ok
> t/05-rr-sshfp..............skipped
>       all skipped: Digest::BubbleBabble not installed.
> t/05-rr-txt................ok
> t/05-rr-unknown............ok
> t/05-rr....................ok
> t/06-update................ok
> t/07-misc..................ok
> t/08-online................ok
> t/09-tkey..................ok
> t/10-recurse...............ok 2/12Server [198.41.0.4] did not give answers
> at /root/.cpan/build/Net-DNS-0.48/blib/lib/Net/DNS/Resolver/Recurse.pm
> line 73.
> t/10-recurse...............NOK 4
> #     Failed test (t/10-recurse.t at line 30)
> t/10-recurse...............NOK 5
> #     Failed test (t/10-recurse.t at line 36)
> Can't call method "answer" on an undefined value at t/10-recurse.t line 37.
>#  Looks like you planned 12 tests but only ran 5.
>#  Looks like your test died just after 5.
> t/10-recurse...............dubious
>       Test returned status 255 (wstat 65280, 0xff00)
> Scalar found where operator expected at (eval 154) line 1, near "'int'
> $__val"
>       (Missing operator before   $__val?)
> DIED. FAILED tests 4-12
>       Failed 9/12 tests, 25.00% okay
> Failed Test    Stat Wstat Total Fail  Failed  List of Failed
> -------------------------------------------------------------------------------
> t/10-recurse.t  255 65280    12   16 133.33%  4-12
> 1 test and 7 subtests skipped.
> Failed 1/20 test scripts, 95.00% okay. 9/872 subtests failed, 98.97% okay.
> make: *** [test_dynamic] Error 2
> /usr/bin/make test -- NOT OK
> Running make install
> cpan> force install Net::DNSRunning Mkbootstrap for Net::DNS ()
> chmod 644 DNS.bs
> rm -f blib/arch/auto/Net/DNS/DNS.so
> LD_RUN_PATH="/lib" gcc  -shared -L/usr/local/lib DNS.o  -o
> blib/arch/auto/Net/DNS/DNS.so   -lresolv
> chmod 755 blib/arch/auto/Net/DNS/DNS.so
> cp DNS.bs blib/arch/auto/Net/DNS/DNS.bs
> chmod 644 blib/arch/auto/Net/DNS/DNS.bs
> Files found in blib/arch: installing files in blib/lib into architecture
> dependent library tree
> Writing
> /usr/lib/perl5/site_perl/5.8.1/i386-linux-thread-multi/auto/Net/DNS/.packlist
> Appending installation info to
> /usr/lib/perl5/5.8.1/i386-linux-thread-multi/perllocal.pod
> /usr/bin/make install  -- OK
>
> I'd love to go back to using SURBL the "normal" way, so any advice is
> appreciated.
>
> I've attached my s.a.prefs.conf for others to use (e.g., Remco) until we
> fix this problem.
>
> Thanks,
> Alden
>
> Alden Levy
> Engine No. 9, Inc.
> 130 West 57th Street, Suite 12E
> New York, NY 10019
> (212) 981-1122
> (212) 725-7202 (fax)
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at BARENDSE.TO  Mon Nov  8 10:46:54 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:30 2006
Subject: SURBL not working properly in MailScanner 4.35.9
Message-ID: <mailman.4406.1137101250.24926.mailscanner@lists.mailscanner.info>

aaaargggghhh 3rd try

On Mon, 8 Nov 2004, Remco Barendse wrote:

> Some people give me hell for top posting but the list rejects a message if
> you don't. I didn't like bottom posting anyways :)
>
> The comments are still below :)
>
> Cheers!
>
>> You may be on to something with Net::DNS, although it *seems* to work.
>> The output of spamassassin -D < testmessage (with a SURBL URL in it) is
>> correct with a standard setup.
>
> You are probably right. I just downloaded the latest tarball
> install-clamav-spamass and tried to rebuild the SRPM.
>
> It did not build because it needed Win32::Registry
>
> Trying to install that module through perl from CPAN failed with some other
> dependencies (I *hate* perl)
>
> I will nuke the box entirely and do a full reinstall. Hopefully it will solve
> my problems.
>
> Thanks for the help and tips and will post the result!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Jan-Peter.Koopmann at SECEIDOS.DE  Mon Nov  8 10:57:11 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:30 2006
Subject: SURBL not working properly in MailScanner 4.35.9
Message-ID: <mailman.4407.1137101250.24926.mailscanner@lists.mailscanner.info>

> aaaargggghhh 3rd try

All three made it to the list. Where is the problem?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at BARENDSE.TO  Mon Nov  8 11:03:35 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:30 2006
Subject: SURBL not working properly in MailScanner 4.35.9
Message-ID: <mailman.4408.1137101250.24926.mailscanner@lists.mailscanner.info>

Really??

Subject: Rejected posting to MAILSCANNER@JISCMAIL.AC.UK
Parts/Attachments:
    1   Shown     11 lines  Text
    2   Shown    9.2 KB     Message, "Re: SURBL not working properly in
MailScanner 4.35.9"
    2.1 Shown    160 lines  Text
----------------------------------------

Your message  is being returned to  you unprocessed because it  appears to
have
already  been distributed  to the  MAILSCANNER list.  That is,  a message
with
identical text  (but possibly with different  mail headers) has been
posted to
the list recently, either by you or by  someone else. If you have a good
reason
to resend this message to the list (for instance because you have been
notified
of a hardware failure with loss of  data), please alter the text of the
message
in some way and  resend it to the list. Note that  altering the "Subject:"
line
or adding blank  lines at the top  or bottom of the message  is not
sufficient;
you should  instead add a  sentence or  two at the  top explaining why
you are
resending the  message, so that the  other subscribers understand why
they are
getting two copies of the same message.



On Mon, 8 Nov 2004, Jan-Peter Koopmann wrote:

>> aaaargggghhh 3rd try
>
> All three made it to the list. Where is the problem?
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From raymond at PROLOCATION.NET  Mon Nov  8 11:10:45 2004
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:27:30 2006
Subject: SURBL not working properly in MailScanner 4.35.9
Message-ID: <mailman.4409.1137101250.24926.mailscanner@lists.mailscanner.info>

Hi!

> Really??

> Your message  is being returned to  you unprocessed because it  appears to
> already  been distributed  to the  MAILSCANNER list.  That is,  a message
> identical text  (but possibly with different  mail headers) has been

Someone seems to bounce messages, i got the same yesterday, had that
issue before. Most likely a broken client somewhere ? (again).

Bye,
Raymond.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From martinh at SOLID-STATE-LOGIC.COM  Mon Nov  8 11:10:44 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:30 2006
Subject: list serve problems
Message-ID: <mailman.4410.1137101250.24926.mailscanner@lists.mailscanner.info>

Remco

yeah I got one these as well - silly listserve is sending the bounce
message about duplicate message and posting it as well.

Julian (or someone one .ac.uk) can you nudge the listserve admins about
this - looks like I'm not the only one affected now..

Ta


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Remco Barendse wrote:
> Really??
>
> Subject: Rejected posting to MAILSCANNER@JISCMAIL.AC.UK
> Parts/Attachments:
>    1   Shown     11 lines  Text
>    2   Shown    9.2 KB     Message, "Re: SURBL not working properly in
> MailScanner 4.35.9"
>    2.1 Shown    160 lines  Text
> ----------------------------------------
>
> Your message  is being returned to  you unprocessed because it  appears to
> have
> already  been distributed  to the  MAILSCANNER list.  That is,  a message
> with
> identical text  (but possibly with different  mail headers) has been
> posted to
> the list recently, either by you or by  someone else. If you have a good
> reason
> to resend this message to the list (for instance because you have been
> notified
> of a hardware failure with loss of  data), please alter the text of the
> message
> in some way and  resend it to the list. Note that  altering the "Subject:"
> line
> or adding blank  lines at the top  or bottom of the message  is not
> sufficient;
> you should  instead add a  sentence or  two at the  top explaining why
> you are
> resending the  message, so that the  other subscribers understand why
> they are
> getting two copies of the same message.
>
>
>
> On Mon, 8 Nov 2004, Jan-Peter Koopmann wrote:
>
>>> aaaargggghhh 3rd try
>>
>>
>> All three made it to the list. Where is the problem?
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From drew at THEMARSHALLS.CO.UK  Mon Nov  8 11:06:58 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:30 2006
Subject: SURBL not working properly in MailScanner 4.35.9
Message-ID: <mailman.4411.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Mon, November 8, 2004 11:03, Remco Barendse said:
> Really??

Yup, definitely!
>
> Subject: Rejected posting to MAILSCANNER@JISCMAIL.AC.UK
> Parts/Attachments:
>     1   Shown     11 lines  Text
>     2   Shown    9.2 KB     Message, "Re: SURBL not working properly in
> MailScanner 4.35.9"
>     2.1 Shown    160 lines  Text
> ----------------------------------------

Looks like someone on the list has a 'broken' set up and is relaying/
forwarding to the list.

Drew


--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From dot at DOTAT.AT  Mon Nov  8 11:02:18 2004
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:27:30 2006
Subject: mail1.internet.net
Message-ID: <mailman.4412.1137101250.24926.mailscanner@lists.mailscanner.info>

Kevin Anderson <andersjk@SOL-INVICTUS.ORG> wrote:
>
>Was wondering if anyone is having the same issue receiving spam from a las
>vegas host, lots of domains ending with *internet.net but the mx pointing
>to a non operating smtp server? So vacation replies get bounced and are
>filling up the queue...

I think you mean saveinternet.net. We do sender address callback verification
which stops these messages from being accepted, because they aren't running
and MTA. Another technique which would work for Postfix users is to use
check_helo_mx_access to disallow domains whos MX hosts are in sbl.spamhaus.org.

Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
FAEROES SOUTHEAST ICELAND: SOUTH OR SOUTHWEST 4 OR 5, INCREASING 6 OR 7 LATER.
RAIN LATER. MODERATE OR GOOD.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From prandal at HEREFORDSHIRE.GOV.UK  Mon Nov  8 11:24:15 2004
From: prandal at HEREFORDSHIRE.GOV.UK (Randal, Phil)
Date: Thu Jan 12 21:27:30 2006
Subject: New McAfee Unix/Linux Virus Scanners out
Message-ID: <mailman.4413.1137101250.24926.mailscanner@lists.mailscanner.info>

McAfee's Linux/Unix Commanline scanners have just been updated to
incorporate McAfee's 4400 scan engine (
http://www.mcafeesecurity.com/us/downloads/updates/engine.asp ).

Available from the usual place (
https://secure.nai.com/us/forms/downloads/upgrades/login.asp ).  Needs
your NAI grant number, then drill down to "Virusscan Command Line
Scanners".

Installed, testing, and working on Fedora Core 1 here.

Cheers,

Phil
----
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Jan-Peter.Koopmann at SECEIDOS.DE  Mon Nov  8 11:40:35 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:30 2006
Subject: SURBL not working properly in MailScanner 4.35.9
Message-ID: <mailman.4414.1137101250.24926.mailscanner@lists.mailscanner.info>

> Looks like someone on the list has a 'broken' set up and is
> relaying/ forwarding to the list.

Any chance figuring out who/why?

Regards,
  JP

PS: I am glad I did not change my config... So it should not be me...
:-)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From drew at THEMARSHALLS.CO.UK  Mon Nov  8 12:38:46 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:30 2006
Subject: SURBL not working properly in MailScanner 4.35.9
Message-ID: <mailman.4415.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Mon, November 8, 2004 11:40, Jan-Peter Koopmann said:

> Any chance figuring out who/why?


Not from here, looks like a job for the list owner (Julian?) or admin at
Jiscmail. The reject notices are unhelpful and contain no information as
to what they have rejected (Other than the subject, wonder how many
messages there have been with 'SURBL not working properly in MailScanner
4.35.9' in the subject...) and from where. Headers would be handy.

> Regards,
>   JP
>
> PS: I am glad I did not change my config... So it should not be me...
> :-)

Always makes you wonder (He says quickly rechecking his own settings) ;-)

Drew



--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Mon Nov  8 11:48:29 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:30 2006
Subject: Phishing net improvement
Message-ID: <mailman.4416.1137101250.24926.mailscanner@lists.mailscanner.info>

Here is an improvement to the phishing fraud detector code. It improves the
handling of html tags buried in the link, which has been used in a new
Paypal phish this morning.
--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/OCTET-STREAM (Name: ]
    [ "Message.pm.phishing.patch")  1.8KB. ]
    [ Unable to print this part. ]


From roger at RUDNICK.COM.BR  Mon Nov  8 12:59:17 2004
From: roger at RUDNICK.COM.BR (Roger Jochem)
Date: Thu Jan 12 21:27:30 2006
Subject: Phishing net improvement
Message-ID: <mailman.4417.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

We had a problem here, because a software we use here generates some faulty
html code, like the sample:

<td align="left" bgcolor="#A2C8E8" style="color: #000080; font-family=
: verdana; font-size: 10; font-style: normal; font-weight: normal; ">&nbsp;=
Jun/2004</a></td>

As you can see, there is the </a> there, but there is no <a ...> tag...
MailScanner replace this </a> with some random code (some times other people
e-mails, some times parts of another e-mails... Very strange... Is there any
way to fix that in MailScanner?

Regards

Roger Jochem

----- Original Message -----
From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Monday, November 08, 2004 9:48 AM
Subject: Phishing net improvement


> Here is an improvement to the phishing fraud detector code. It improves
the
> handling of html tags buried in the link, which has been used in a new
> Paypal phish this morning.
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From raymond at PROLOCATION.NET  Mon Nov  8 13:17:43 2004
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:27:30 2006
Subject: Phishing net improvement
Message-ID: <mailman.4418.1137101250.24926.mailscanner@lists.mailscanner.info>

Hi!

> Here is an improvement to the phishing fraud detector code. It improves the
> handling of html tags buried in the link, which has been used in a new
> Paypal phish this morning.

The nice thing is however that all of those were also caught up by SURBL.

Bye,
Raymond.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at BARENDSE.TO  Mon Nov  8 14:04:48 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:30 2006
Subject: rpm install on a fresh box
Message-ID: <mailman.4419.1137101250.24926.mailscanner@lists.mailscanner.info>

Just a small remark:

I nuked my box this morning and did a re-install. For some reason the
install.sh script for the rpm installer did not succeed in building and
installing perl-Compress-Zlib therefore perl-Archive-Zip failed too.

rebuilding by hand and installing fixed it, unfortunately i did not keep a
logh (maybe it would be a nice feature to have the install script log all
the output to a log file in the standard install dir too)?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at BARENDSE.TO  Mon Nov  8 14:19:56 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:30 2006
Subject: SURBL not working properly in MailScanner 4.35.9
Message-ID: <mailman.4420.1137101250.24926.mailscanner@lists.mailscanner.info>

My perl-URI fails to build completely:

PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e"
"test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
t/abs............ok
t/clone..........ok
t/data...........ok
t/escape.........ok
t/file...........ok
t/ftp............ok
t/generic........ok
t/heuristic......FAILED test 7
         Failed 1/15 tests, 93.33% okay
t/http...........ok
t/ldap...........ok
t/mailto.........ok
t/mix............ok
t/mms............ok
t/news...........ok
t/old-absconf....ok
t/old-base.......ok
t/old-relbase....ok
t/pop............ok
t/query-param....ok
t/query..........ok
t/rel............ok
t/rfc2732........ok
t/roy-test.......ok
t/rsync..........ok
t/rtsp...........ok
t/sip............ok
t/split..........ok
t/storable.......ok
t/urn-isbn.......ok
t/urn-oid........ok
Failed Test   Stat Wstat Total Fail  Failed  List of Failed
-------------------------------------------------------------------------------
t/heuristic.t               15    1   6.67%  7
Failed 1/30 test scripts, 96.67% okay. 1/467 subtests failed, 99.79% okay.
make: *** [test_dynamic] Error 29
error: Bad exit status from /var/tmp/rpm-tmp.53495 (%build)


Haven't got a clue what that error is supposed to be telling me :)


On Fri, 5 Nov 2004, Alden Levy wrote:

>> Date:    Fri, 5 Nov 2004 10:26:56 +0100
>> From:    Jan-Peter Koopmann <Jan-Peter.Koopmann@SECEIDOS.DE>
>> Subject: Re: SURBL not working properly in MailScanner 4.35.9
>>
>> On Friday, November 05, 2004 9:12 AM MailScanner mailing list wrote:
>>
>>> Would you mind sharing how to put init.pre and 25_uribl.c in
>>> spam.assassin.prefs.conf file ?
>>
>> There is no need for putting anything in spam.assassin.prefs.conf as far
>> as I know. If you have=20
>>
>> loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
>>
>> in your init.pre that should be sufficient. Please run a testmessage
>> through spamassassin with the debugging option
>>
>> spamassassin -D < testmessage
>>
>> and analyze the output. It did not work here at first until I figured
>> out that Net::DNS was either not installed or the wrong version (can't
>> remember). The debug log should show you though.
>>
>> Kind regards,
>>   JP
>>
> JP,
> You may be on to something with Net::DNS, although it *seems* to work.
> The output of spamassassin -D < testmessage (with a SURBL URL in it) is
> correct with a standard setup.
>
> My Net::DNS is 0.48, but when I try to force install (with cpan), I get a
> few errors when I enable the Internet tests:
> t/00-load..................ok
> t/00-pod...................ok
> t/00-version...............ok
> t/01-resolver-env..........ok
> t/01-resolver-file.........ok
>        7/8 skipped: Could not read configuration file
> t/01-resolver-opt..........ok
> t/01-resolver..............ok
> t/02-header................ok
> t/03-question..............ok
> t/04-packet-unique-push....ok
> t/04-packet................ok
> t/05-rr-sshfp..............skipped
>        all skipped: Digest::BubbleBabble not installed.
> t/05-rr-txt................ok
> t/05-rr-unknown............ok
> t/05-rr....................ok
> t/06-update................ok
> t/07-misc..................ok
> t/08-online................ok
> t/09-tkey..................ok
> t/10-recurse...............ok 2/12Server [198.41.0.4] did not give answers
> at /root/.cpan/build/Net-DNS-0.48/blib/lib/Net/DNS/Resolver/Recurse.pm
> line 73.
> t/10-recurse...............NOK 4
> #     Failed test (t/10-recurse.t at line 30)
> t/10-recurse...............NOK 5
> #     Failed test (t/10-recurse.t at line 36)
> Can't call method "answer" on an undefined value at t/10-recurse.t line 37.
> # Looks like you planned 12 tests but only ran 5.
> # Looks like your test died just after 5.
> t/10-recurse...............dubious
>        Test returned status 255 (wstat 65280, 0xff00)
> Scalar found where operator expected at (eval 154) line 1, near "'int'
> $__val"
>        (Missing operator before   $__val?)
> DIED. FAILED tests 4-12
>        Failed 9/12 tests, 25.00% okay
> Failed Test    Stat Wstat Total Fail  Failed  List of Failed
> -------------------------------------------------------------------------------
> t/10-recurse.t  255 65280    12   16 133.33%  4-12
> 1 test and 7 subtests skipped.
> Failed 1/20 test scripts, 95.00% okay. 9/872 subtests failed, 98.97% okay.
> make: *** [test_dynamic] Error 2
>  /usr/bin/make test -- NOT OK
> Running make install
> cpan> force install Net::DNSRunning Mkbootstrap for Net::DNS ()
> chmod 644 DNS.bs
> rm -f blib/arch/auto/Net/DNS/DNS.so
> LD_RUN_PATH="/lib" gcc  -shared -L/usr/local/lib DNS.o  -o
> blib/arch/auto/Net/DNS/DNS.so   -lresolv
> chmod 755 blib/arch/auto/Net/DNS/DNS.so
> cp DNS.bs blib/arch/auto/Net/DNS/DNS.bs
> chmod 644 blib/arch/auto/Net/DNS/DNS.bs
> Files found in blib/arch: installing files in blib/lib into architecture
> dependent library tree
> Writing
> /usr/lib/perl5/site_perl/5.8.1/i386-linux-thread-multi/auto/Net/DNS/.packlist
> Appending installation info to
> /usr/lib/perl5/5.8.1/i386-linux-thread-multi/perllocal.pod
>  /usr/bin/make install  -- OK
>
> I'd love to go back to using SURBL the "normal" way, so any advice is
> appreciated.
>
> I've attached my s.a.prefs.conf for others to use (e.g., Remco) until we
> fix this problem.
>
> Thanks,
> Alden
>
> Alden Levy
> Engine No. 9, Inc.
> 130 West 57th Street, Suite 12E
> New York, NY 10019
> (212) 981-1122
> (212) 725-7202 (fax)
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From hostmaster at AGIMSA.COM.MX  Mon Nov  8 14:07:10 2004
From: hostmaster at AGIMSA.COM.MX (Cecilia [iso-8859-1] Martínez)
Date: Thu Jan 12 21:27:30 2006
Subject: EXE files (reposting)
Message-ID: <mailman.4421.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi, sorry for the repost, but it seams my last message did not get through.

The problem I have is that when allowing EXE files for certain domains, 
they are sent to /dev/null instead of the user's mailbox. Anyone has a 
clue? I got the configuration to allow exe files from MailScanner's FAQ at 
http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/209.html

This is my configuration:

Fedora C1 / Ensim Pro 4.01 / MailScanner / Sendmail / ClamAV / SpamAssassin

--------
MailScanner.conf
..
%rules-dir% = /etc/MailScanner/rules
..
Filename Rules = %etc-dir%/rules/filename.rules
..
Filetype Rules = %etc-dir%/rules/filetype.rules
--------

------
/rules/filename.rules

FromOrTo:       *@agimsa.com.mx %etc-dir%/filename.cegimsa.rules.conf
FromOrTo:       *@commsa.com    %etc-dir%/filename.cegimsa.rules.conf
FromOrTo:       *@pemex.com.mx  %etc-dir%/filename.cegimsa.rules.conf
FromOrTo:       *@pemex.com     %etc-dir%/filename.cegimsa.rules.conf
FromOrTo:       default %etc-dir%/filename.rules.conf
--------

-------
/rules/filetype.rules

FromOrTo:       *@agimsa.com.mx %etc-dir%/filetype.cegimsa.rules.conf
FromOrTo:       *@commsa.com    %etc-dir%/filetype.cegimsa.rules.conf
FromOrTo:       *@pemex.com.mx  %etc-dir%/filetype.cegimsa.rules.conf
FromOrTo:       *@pemex.com     %etc-dir%/filetype.cegimsa.rules.conf
FromOrTo:       default %etc-dir%/filetype.rules.conf
--------

-----
filename.cegimsa.rules.conf
everything the same as default exept (tab separeted):

allow   \.exe$  Windows/DOS Executable  Executable DOS/Windows programs are 
dangerous in email
----------

-------
filetype.cegimsa.rules.conf
everything the same as defult exept (tab separeted):

allow   executable      -  -
-----------

filename.rules.conf > default
filetype.rules.conf > default

Thanks in advance!


Cecilia Martínez




-- 
Mensaje escaneado por el servicio Anti-Virus de correo de CEGIMSA

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at BARENDSE.TO  Mon Nov  8 14:38:55 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:30 2006
Subject: Net::LDAP missing in install-Clam-SA
Message-ID: <mailman.4422.1137101250.24926.mailscanner@lists.mailscanner.info>

Just installed install-Clam-SA but MailScanner reports that Net::LDAP is
not installed.

I looked in the tarball but could not locate any module by that name?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From dhawal at NETMAGICSOLUTIONS.COM  Mon Nov  8 14:31:17 2004
From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy)
Date: Thu Jan 12 21:27:30 2006
Subject: SURBL not working properly in MailScanner 4.35.9
Message-ID: <mailman.4423.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Remco Barendse wrote:
> My perl-URI fails to build completely:
>
> PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e"
> "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
> t/abs............ok
> t/clone..........ok
> t/data...........ok
> t/escape.........ok
> t/file...........ok
> t/ftp............ok
> t/generic........ok
> t/heuristic......FAILED test 7
>         Failed 1/15 tests, 93.33% okay

In t/heuristic.t change on line 50 (or somewhere around it)
www.perl.co.uk to www.perl.org.uk, this time 'make test' should be fine.

- dhawal

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From anders.andersson at LTKALMAR.SE  Mon Nov  8 14:51:21 2004
From: anders.andersson at LTKALMAR.SE (Anders Andersson, IT)
Date: Thu Jan 12 21:27:30 2006
Subject: New McAfee Unix/Linux Virus Scanners out
Message-ID: <mailman.4424.1137101250.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> McAfee's Linux/Unix Commanline scanners have just been 
> updated to incorporate McAfee's 4400 scan engine ( 
> http://www.mcafeesecurity.com/us/downloads/updates/engine.asp ).
> 
> Available from the usual place (
> https://secure.nai.com/us/forms/downloads/upgrades/login.asp 
> ).  Needs your NAI grant number, then drill down to 
> "Virusscan Command Line Scanners".
> 
> Installed, testing, and working on Fedora Core 1 here.

Tested and verified on Fedora Core 2, np so far  :)

> 
> Cheers,
> 
> Phil
> ----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at BARENDSE.TO  Mon Nov  8 15:17:36 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:30 2006
Subject: SURBL not working properly in MailScanner 4.35.9
Message-ID: <mailman.4425.1137101250.24926.mailscanner@lists.mailscanner.info>

Great, that fixed it!

Maybe it would be better to fix this mistake in the tarball too

Cheers!
Remco

On Mon, 8 Nov 2004, Dhawal Doshy wrote:

> Remco Barendse wrote:
>> My perl-URI fails to build completely:
>>
>> PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e"
>> "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
>> t/abs............ok
>> t/clone..........ok
>> t/data...........ok
>> t/escape.........ok
>> t/file...........ok
>> t/ftp............ok
>> t/generic........ok
>> t/heuristic......FAILED test 7
>> Failed 1/15 tests, 93.33% okay
>
> In t/heuristic.t change on line 50 (or somewhere around it)
> www.perl.co.uk to www.perl.org.uk, this time 'make test' should be fine.
>
> - dhawal
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From drew at THEMARSHALLS.CO.UK  Mon Nov  8 15:38:05 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:30 2006
Subject: SURBL not working properly in MailScanner 4.35.9
Message-ID: <mailman.4426.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Mon, November 8, 2004 11:40, Jan-Peter Koopmann said:
>> Looks like someone on the list has a 'broken' set up and is
>> relaying/ forwarding to the list.
>
> Any chance figuring out who/why?
>
My mistake, this damn webmail...

OK found the attached message that bounced and have grabbed the headers.
I'll mail the offender direct

Drew


--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mkettler at EVI-INC.COM  Mon Nov  8 16:06:12 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:30 2006
Subject: Mail server backlogging - seems like a Bayes problem
Message-ID: <mailman.4427.1137101250.24926.mailscanner@lists.mailscanner.info>

At 11:50 AM 11/7/2004, Mike Tremaine wrote:
> > --------------------------------
> > In the short term, you can help by running a sa-learn --force-expire on
> > your bayes DB.
> >
> > In the longer term, here's some suggestions I use on my own MailScanner
> > server: (I use all of these together)
> >
> > 1) Increase the spamassassin timeout in MailScanner.conf. Bring it to 60
> > seconds at least, I have mine set to 120.
> >
> > 2) Set the "Rebuild Bayes Every" parameter in MailScanner.conf. 86400
> > seconds is a good start. This makes MailScanner invoke SA's bayes
> > housekeeping directly, rather than during a scan of a message.
> >
> > 3) in /etc/mail/spamassassin/local.cf set: bayes_auto_expire 0. This will
> > keep SA from trying to run bayes expires (long and slow) during message
> > handling, but relies on #2 above to allow expiry to occur.
> >
> > 4) I also have a sa-learn --force-expire running as a daily cronjob. I have
> > tested the setup without this measure, and #2 is sufficient to cause expiry
> > to occur. Really this is just a fail-safe to allow expiry to occur even if
> > MailScanner's calls fail to run it properly for some reason.
>
>Have you tested this setup under SA 3.0.1? The reason I ask is I used
>this advise to configure a MailScanner Gateway that I was having a lot
>of timeouts with [200-300] and it worked great.


No, i have not tested under SA 3.0.1, I'm still currently on 2.64 but will
probably upgrade to the 3.x family once 3.0.2 is out.

However, I can tell you you're going to have to manually disable the AWL in
your local.cf or spam.assassin.prefs.conf if you don't want to use it with
SA 3.x. The MailScanner.conf option doesn't seem to work for 3.0 yet, and
Julian is aware of it and working on it.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Mon Nov  8 16:32:58 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:30 2006
Subject: Net::LDAP missing in install-Clam-SA
Message-ID: <mailman.4428.1137101250.24926.mailscanner@lists.mailscanner.info>

Net::LDAP is not required by MailScanner, so it is in the "optional" list.
You don't need it.


On 8/11/04 2:38 pm, "Remco Barendse" <mailscanner@BARENDSE.TO> wrote:

> Just installed install-Clam-SA but MailScanner reports that Net::LDAP is
> not installed.
>
> I looked in the tarball but could not locate any module by that name?
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From hburbano at NOVADEVICES.COM  Mon Nov  8 16:39:21 2004
From: hburbano at NOVADEVICES.COM (Henry Burbano)
Date: Thu Jan 12 21:27:30 2006
Subject: Filetype question
Message-ID: <mailman.4429.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Filter filetype not working

I have installed:
MailScanner version 4.35.10

My configuration files are:

Mailscanner.conf:

File Command = /usr/bin/file
File Timeout = 20
Filetype Rules = %etc-dir%/filetype.rules.conf

filetype.rules.conf:

allow text - -
allow script - -
allow archive - -
deny self-extract No self-extracting archives No self-extracting archives
deny ELF No executables No executables
deny executable No executables No executables
deny MPEG No MPEG movies No MPEG movies
deny AVI No AVI movies No AVI movies
deny MNG No MNG/PNG movies No MNG/PNG movies
deny QuickTime No QuickTime movies No QuickTime movies
deny Registry No Windows Registry entries No Windows Registry entries

All with tab separates

I am sending an executable file

The log file:

Nov  8 09:55:00 MailScanner[26884]: New Batch: Scanning 1 messages, 3658374
bytes
Nov  8 09:55:00 MailScanner[26884]: MCP Checks: Starting
Nov  8 09:55:00 MailScanner[26884]: Spam Checks: Starting
Nov  8 09:55:07 MailScanner[26884]: Virus and Content Scanning: Starting
Nov  8 09:55:12 MailScanner[26884]: Uninfected: Delivered 1 messages

And the message is normally delivered .

Any suggestion??

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From kte at NEXIS.BE  Mon Nov  8 17:02:10 2004
From: kte at NEXIS.BE (Koen Teugels)
Date: Thu Jan 12 21:27:30 2006
Subject: ProcessClamAVOutput: unrecognised line ...    contact the authors
Message-ID: <mailman.4430.1137101250.24926.mailscanner@lists.mailscanner.info>

I'm in the latest version of mailscanner
(MailScanner-4.35.11-1.rpm.tar.gz) en and rpm version of clamav 0.80.1
(and the compiled version)
Could it be when there are som perl packages (NET::DNS) in the
attachment that it crashes on the :: in the filename.? And it lets the
mail with the virus through.

It looks that Mailscanner has a problem when you have an attachment like
copfilter-0.0.95.tgz. Does anyone experience the same problem.


grtz Koen

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From VBoulytchev at COINFOTECH.COM  Mon Nov  8 17:06:54 2004
From: VBoulytchev at COINFOTECH.COM (Vasiliy Boulytchev)
Date: Thu Jan 12 21:27:30 2006
Subject: Sophos antivirus
Message-ID: <mailman.4431.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Both :)

Sophos is pretty expensive, try running ClamAV instead.

Thanks,
Vasiliy Boulytchev
Colorado Information Technologies Inc.
http://www.coinfotech.com


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Peter Zimen
Sent: Friday, November 05, 2004 11:24 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Sophos antivirus



I want to install virus scanner Sophos to cooperation with MailScanner on my Linux server.

I dont know which version of Sophos i must have:

Sophos antivirus (SAVI) or SAVI interface?

Please little help :))
.
__

S pozdravom

Peter Zimen

------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From VBoulytchev at COINFOTECH.COM  Mon Nov  8 17:13:03 2004
From: VBoulytchev at COINFOTECH.COM (Vasiliy Boulytchev)
Date: Thu Jan 12 21:27:30 2006
Subject: McAfee virus scanner compatibility
Message-ID: <mailman.4432.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Gents, I have installed McAfee Linux Shield.  It is running fine as far as I can tell.  However, your interface looks for /usr/bin/uvscan, which is not the interface of this scanner, here is the link to the product:

http://www.networkassociates.com/us/products/mcafee/antivirus/fileserver/linuxshield.htm

Does Mailsacnner support the virus scanner above?

Thanks,
Vasiliy Boulytchev
Colorado Information Technologies Inc.
http://www.coinfotech.com


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
Sent: Tuesday, November 02, 2004 11:06 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: SuSE with 4.35.9 and MIME::Base64



There seems to be something *really* weird going on with SuSE 9.1 and MailScanner-4.35.9. For some reason installing MIME::Base64 removes perl completely. Fortunately you have to try very very hard to install MIME::Base64 before it goes and actually does it. Running my ./install.sh isn't enough, so you can safely run that.

To get round this problem, you need to manually install the perl-MIME-Base64 code. Don't install it from CPAN as it will get installed in the wrong place.

Do this instead:

cd MailScanner-4.35.9-1
rpm -Uvh perl-MIME-Base64-3.05-2.src.rpm
pushd /usr/src/packages/SPECS
rpmbuild -bp perl-MIME-Base64.spec
cd ../BUILD
cd perl-MIME-Base64-3.05
perl Makefile.PL
make
make test
make install
popd
./install.sh fast

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From dhawal at NETMAGICSOLUTIONS.COM  Mon Nov  8 15:53:37 2004
From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy)
Date: Thu Jan 12 21:27:30 2006
Subject: SURBL not working properly in MailScanner 4.35.9
Message-ID: <mailman.4433.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Remco Barendse wrote:
> Great, that fixed it!
>
> Maybe it would be better to fix this mistake in the tarball too
>
> Cheers!
> Remco
>

Hmm,

Gisle Aas (the perl URI maintainer) has recently (19-09-2004) fixed the
problem.. so Julian doesn't have to.
http://search.cpan.org/src/GAAS/URI-1.35/t/heuristic.t

- dhawal

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From chris at scorpion.nl  Mon Nov  8 17:11:17 2004
From: chris at scorpion.nl (Christiaan den Besten)
Date: Thu Jan 12 21:27:30 2006
Subject: ProcessClamAVOutput: unrecognised line ...    contact the
    authors
Message-ID: <mailman.4434.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

You mean like:

----
Nov  5 08:08:03 hannibal MailScanner[27118]: ProcessClamAVOutput:
unrecognised line "domain/View.ipt/uu.nl". Please contact the authors!
Nov  5 08:08:03 hannibal MailScanner[27118]: ProcessClamAVOutput:
unrecognised line "domain/View.ipt/net-131.211". Please contact the authors!
Nov  5 08:08:04 hannibal MailScanner[27118]: ProcessClamAVOutput:
unrecognised line "domain/View.ipt/net-131.211.099". Please contact the
authors!
Nov  5 08:08:04 hannibal MailScanner[27118]: ProcessClamAVOutput:
unrecognised line "domain/View.ipt/phones.uu.nl". Please contact the
authors!
Nov  5 08:08:04 hannibal MailScanner[27118]: ProcessClamAVOutput:
unrecognised line "domain/View.ipt/ipt.uu.nl". Please contact the authors!
Nov  5 08:08:04 hannibal MailScanner[27118]: ProcessClamAVOutput:
unrecognised line "domain/View.ipt/view". Please contact the authors!
---

Sure .. every .tgz and/or .tar.gz I receive :) I have not taken the time to
upgrade to latest versions of both. But this issue has been around on my
home mailer for some time now.

(Debian Sarge / Mailscanner upto 4.31.6 / ClamAV 0.75)

bye,
Chris

----- Original Message -----
From: "Koen Teugels" <kte@NEXIS.BE>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Monday, November 08, 2004 6:02 PM
Subject: ProcessClamAVOutput: unrecognised line ... contact the authors


> I'm in the latest version of mailscanner
> (MailScanner-4.35.11-1.rpm.tar.gz) en and rpm version of clamav 0.80.1
> (and the compiled version)
> Could it be when there are som perl packages (NET::DNS) in the
> attachment that it crashes on the :: in the filename.? And it lets the
> mail with the virus through.
>
> It looks that Mailscanner has a problem when you have an attachment like
> copfilter-0.0.95.tgz. Does anyone experience the same problem.
>
>
> grtz Koen
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From j.bagshaw at BRADFORD.AC.UK  Mon Nov  8 16:33:01 2004
From: j.bagshaw at BRADFORD.AC.UK (Jon Bagshaw)
Date: Thu Jan 12 21:27:30 2006
Subject: New McAfee Unix/Linux Virus Scanners out
Message-ID: <mailman.4435.1137101250.24926.mailscanner@lists.mailscanner.info>

Randal, Phil wrote:

> https://secure.nai.com/us/forms/downloads/upgrades/login.asp ).  Needs
> your NAI grant number, then drill down to "Virusscan Command Line
> Scanners".
>
> Installed, testing, and working on Fedora Core 1 here.

Seems to work OK on Solaris 8 on Sparc.

Jon
--
Jon Bagshaw, Senior Computer Officer
Computer Centre, University of Bradford

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Mon Nov  8 17:47:05 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:30 2006
Subject: ProcessClamAVOutput: unrecognised line ...    contact the
    authors
Message-ID: <mailman.4436.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Can you try this with the latest CVS version of ClamAV please. I raised
a bug report about a similar problem last week, and it is fixed in the
latest CVS.

Christiaan den Besten wrote:

> You mean like:
>
> ----
> Nov  5 08:08:03 hannibal MailScanner[27118]: ProcessClamAVOutput:
> unrecognised line "domain/View.ipt/uu.nl". Please contact the authors!
> Nov  5 08:08:03 hannibal MailScanner[27118]: ProcessClamAVOutput:
> unrecognised line "domain/View.ipt/net-131.211". Please contact the
> authors!
> Nov  5 08:08:04 hannibal MailScanner[27118]: ProcessClamAVOutput:
> unrecognised line "domain/View.ipt/net-131.211.099". Please contact the
> authors!
> Nov  5 08:08:04 hannibal MailScanner[27118]: ProcessClamAVOutput:
> unrecognised line "domain/View.ipt/phones.uu.nl". Please contact the
> authors!
> Nov  5 08:08:04 hannibal MailScanner[27118]: ProcessClamAVOutput:
> unrecognised line "domain/View.ipt/ipt.uu.nl". Please contact the
> authors!
> Nov  5 08:08:04 hannibal MailScanner[27118]: ProcessClamAVOutput:
> unrecognised line "domain/View.ipt/view". Please contact the authors!
> ---
>
> Sure .. every .tgz and/or .tar.gz I receive :) I have not taken the
> time to
> upgrade to latest versions of both. But this issue has been around on my
> home mailer for some time now.
>
> (Debian Sarge / Mailscanner upto 4.31.6 / ClamAV 0.75)
>
> bye,
> Chris
>
> ----- Original Message -----
> From: "Koen Teugels" <kte@NEXIS.BE>
> To: <MAILSCANNER@JISCMAIL.AC.UK>
> Sent: Monday, November 08, 2004 6:02 PM
> Subject: ProcessClamAVOutput: unrecognised line ... contact the authors
>
>
>> I'm in the latest version of mailscanner
>> (MailScanner-4.35.11-1.rpm.tar.gz) en and rpm version of clamav 0.80.1
>> (and the compiled version)
>> Could it be when there are som perl packages (NET::DNS) in the
>> attachment that it crashes on the :: in the filename.? And it lets the
>> mail with the virus through.
>>
>> It looks that Mailscanner has a problem when you have an attachment like
>> copfilter-0.0.95.tgz. Does anyone experience the same problem.
>>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Mon Nov  8 17:51:49 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:30 2006
Subject: ProcessClamAVOutput: unrecognised line ...    contact the
    authors
Message-ID: <mailman.4437.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Can you give me more details of this please. What "Virus Scanners ="
setting do you have. What version of what scanner. What are the
symptoms, please give a real example.

Koen Teugels wrote:

> I'm in the latest version of mailscanner
> (MailScanner-4.35.11-1.rpm.tar.gz) en and rpm version of clamav 0.80.1
> (and the compiled version)
> Could it be when there are som perl packages (NET::DNS) in the
> attachment that it crashes on the :: in the filename.? And it lets the
> mail with the virus through.
>
> It looks that Mailscanner has a problem when you have an attachment like
> copfilter-0.0.95.tgz. Does anyone experience the same problem.
>
>
> grtz Koen
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From suporte at SETINET.COM.BR  Mon Nov  8 17:52:41 2004
From: suporte at SETINET.COM.BR (Dennis Robert Kelbert)
Date: Thu Jan 12 21:27:30 2006
Subject: Subject and Body filter
Message-ID: <mailman.4438.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Where in Mailscanner.conf i can configure to block subject?
or i need directly configure spanassassin to do that???
 
 
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From dustin.baer at IHS.COM  Mon Nov  8 18:24:00 2004
From: dustin.baer at IHS.COM (Dustin Baer)
Date: Thu Jan 12 21:27:30 2006
Subject: Subject and Body filter
Message-ID: <mailman.4439.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Dennis Robert Kelbert wrote:

> Where in Mailscanner.conf i can configure to block subject?

Not in MailScanner.conf

> or i need directly configure spanassassin to do that???

You can create your own rules in spam.assassin.prefs.conf

Dustin

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From suporte at SETINET.COM.BR  Mon Nov  8 18:32:56 2004
From: suporte at SETINET.COM.BR (Dennis Robert Kelbert)
Date: Thu Jan 12 21:27:30 2006
Subject: Subject and Body filter
Message-ID: <mailman.4440.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

per users?


----- Original Message -----
From: "Dustin Baer" <dustin.baer@IHS.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Monday, November 08, 2004 4:24 PM
Subject: Re: Subject and Body filter


> Dennis Robert Kelbert wrote:
>
>> Where in Mailscanner.conf i can configure to block subject?
>
> Not in MailScanner.conf
>
>> or i need directly configure spanassassin to do that???
>
> You can create your own rules in spam.assassin.prefs.conf
>
> Dustin
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From peter at UCGBOOK.COM  Mon Nov  8 18:48:21 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:31 2006
Subject: Subject and Body filter
Message-ID: <mailman.4441.1137101250.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Dennis Robert Kelbert wrote:
> per users?

Try this:

http://mywebpages.comcast.net/mkettler/sa/SA-rules-howto.txt

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From suporte at SETINET.COM.BR  Mon Nov  8 19:35:22 2004
From: suporte at SETINET.COM.BR (Dennis Robert Kelbert)
Date: Thu Jan 12 21:27:31 2006
Subject: Subject and Body filter
Message-ID: <mailman.4442.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

but i can make a ruleset for this in MailScanner?



----- Original Message -----
From: "Peter Bonivart" <peter@UCGBOOK.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Monday, November 08, 2004 4:48 PM
Subject: Re: Subject and Body filter


> Dennis Robert Kelbert wrote:
>> per users?
>
> Try this:
>
> http://mywebpages.comcast.net/mkettler/sa/SA-rules-howto.txt
>
> --
> /Peter Bonivart
>
> --Unix lovers do it in the Sun
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From jaearick at COLBY.EDU  Mon Nov  8 19:58:11 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:31 2006
Subject: SURBL not working properly in MailScanner 4.35.9
Message-ID: <mailman.4443.1137101251.24926.mailscanner@lists.mailscanner.info>

I just applied this to my setup (MS 4.35.11).  Things continue to work
fine...

Jeff Earickson
Colby College

On Mon, 8 Nov 2004, Dhawal Doshy wrote:

> Date: Mon, 8 Nov 2004 21:23:37 +0530
> From: Dhawal Doshy <dhawal@NETMAGICSOLUTIONS.COM>
> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: SURBL not working properly in MailScanner 4.35.9
>
> Remco Barendse wrote:
>> Great, that fixed it!
>>
>> Maybe it would be better to fix this mistake in the tarball too
>>
>> Cheers!
>> Remco
>>
>
> Hmm,
>
> Gisle Aas (the perl URI maintainer) has recently (19-09-2004) fixed the
> problem.. so Julian doesn't have to.
> http://search.cpan.org/src/GAAS/URI-1.35/t/heuristic.t
>
> - dhawal
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From kte at NEXIS.BE  Mon Nov  8 19:02:40 2004
From: kte at NEXIS.BE (Koen Teugels)
Date: Thu Jan 12 21:27:31 2006
Subject: ProcessClamAVOutput: unrecognised line ...    contact the
    authors
Message-ID: <mailman.4444.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Virus Scanners = clamav bitdefender
clamav is at version 0.80.1 and bitdefender
BitDefender-Console-Antivirus-7.0.1-3.linux-gcc3x.i586.rpm
Bt they let pass the attachment copfilter-0.0.95.tgz with the eicar test
virus in it with status clean.
I use a  RHEL clone with the latest yum updates.
version MailScanner-4.35.11-1.rpm.tar.gz with spamassassin 3.0.1 and
plugins DCC, razor and ...
Just a standard install no custom rules yet.

Thanks Koen

Julian Field wrote:

> Can you give me more details of this please. What "Virus Scanners ="
> setting do you have. What version of what scanner. What are the
> symptoms, please give a real example.
>
> Koen Teugels wrote:
>
>> I'm in the latest version of mailscanner
>> (MailScanner-4.35.11-1.rpm.tar.gz) en and rpm version of clamav 0.80.1
>> (and the compiled version)
>> Could it be when there are som perl packages (NET::DNS) in the
>> attachment that it crashes on the :: in the filename.? And it lets the
>> mail with the virus through.
>>
>> It looks that Mailscanner has a problem when you have an attachment like
>> copfilter-0.0.95.tgz. Does anyone experience the same problem.
>>
>>
>> grtz Koen
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Mon Nov  8 20:14:02 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:31 2006
Subject: ProcessClamAVOutput: unrecognised line ...    contact the
    authors
Message-ID: <mailman.4445.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Please try this with the latest CVS build of ClamAV.

Koen Teugels wrote:

> Virus Scanners = clamav bitdefender
> clamav is at version 0.80.1 and bitdefender
> BitDefender-Console-Antivirus-7.0.1-3.linux-gcc3x.i586.rpm
> Bt they let pass the attachment copfilter-0.0.95.tgz with the eicar test
> virus in it with status clean.
> I use a  RHEL clone with the latest yum updates.
> version MailScanner-4.35.11-1.rpm.tar.gz with spamassassin 3.0.1 and
> plugins DCC, razor and ...
> Just a standard install no custom rules yet.
>
> Thanks Koen
>
> Julian Field wrote:
>
>> Can you give me more details of this please. What "Virus Scanners ="
>> setting do you have. What version of what scanner. What are the
>> symptoms, please give a real example.
>>
>> Koen Teugels wrote:
>>
>>> I'm in the latest version of mailscanner
>>> (MailScanner-4.35.11-1.rpm.tar.gz) en and rpm version of clamav 0.80.1
>>> (and the compiled version)
>>> Could it be when there are som perl packages (NET::DNS) in the
>>> attachment that it crashes on the :: in the filename.? And it lets the
>>> mail with the virus through.
>>>
>>> It looks that Mailscanner has a problem when you have an attachment
>>> like
>>> copfilter-0.0.95.tgz. Does anyone experience the same problem.
>>>
>>>
>>> grtz Koen
>>>
>>> ------------------------ MailScanner list ------------------------
>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>> 'leave mailscanner' in the body of the email.
>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>
>> --
>> Julian Field
>> www.MailScanner.info
>> Buy the MailScanner book at www.MailScanner.info/store
>> Professional Support Services at www.MailScanner.biz
>> MailScanner thanks transtec Computers for their support
>>
>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From VBoulytchev at COINFOTECH.COM  Mon Nov  8 20:25:13 2004
From: VBoulytchev at COINFOTECH.COM (Vasiliy Boulytchev)
Date: Thu Jan 12 21:27:31 2006
Subject: mail scanner help
Message-ID: <mailman.4446.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Gents, I have installed McAfee Linux Shield.  It is running fine as far as I can tell.  However, your interface looks for /usr/bin/uvscan, which is not the interface of this scanner, here is the link to the product:

http://www.networkassociates.com/us/products/mcafee/antivirus/fileserver/linuxshield.htm

Does Mailsacnner support the virus scanner above?

I see that you guys need the /usr/local/uvscan/ which this thing does not come with.  Is anyone else running this?  This product is cheap, and it looks like we should be able to run this.

Thanks,
Vasiliy Boulytchev
Colorado Information Technologies Inc.
http://www.coinfotech.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Mon Nov  8 20:38:07 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:31 2006
Subject: SURBL not working properly in MailScanner 4.35.9
Message-ID: <mailman.4447.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I have just updated
http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/install-Clam-SA.tar.gz
to contain URI-1.35.

Jeff A. Earickson wrote:

> I just applied this to my setup (MS 4.35.11).  Things continue to work
> fine...
>
> Jeff Earickson
> Colby College
>
> On Mon, 8 Nov 2004, Dhawal Doshy wrote:
>
>> Date: Mon, 8 Nov 2004 21:23:37 +0530
>> From: Dhawal Doshy <dhawal@NETMAGICSOLUTIONS.COM>
>> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>> To: MAILSCANNER@JISCMAIL.AC.UK
>> Subject: Re: SURBL not working properly in MailScanner 4.35.9
>>
>> Remco Barendse wrote:
>>
>>> Great, that fixed it!
>>>
>>> Maybe it would be better to fix this mistake in the tarball too
>>>
>>> Cheers!
>>> Remco
>>>
>>
>> Hmm,
>>
>> Gisle Aas (the perl URI maintainer) has recently (19-09-2004) fixed the
>> problem.. so Julian doesn't have to.
>> http://search.cpan.org/src/GAAS/URI-1.35/t/heuristic.t
>>
>> - dhawal
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From vachanta at GMAIL.COM  Mon Nov  8 20:52:14 2004
From: vachanta at GMAIL.COM (Venkata Achanta)
Date: Thu Jan 12 21:27:31 2006
Subject: Clam AV not detecting EML Phish-BankFraud.eml
Message-ID: <mailman.4448.1137101251.24926.mailscanner@lists.mailscanner.info>

Hello,

 I am running MailScanner with clamAV and the following viruses are making
thru the Mailscanner but they are getting tagged as spam because of the
invalid file name rules and some are even getting to the end user mail
client.

versions i am on:
mailscanner-4.30.3-r2

some of the viruses that go undetected are

W32/Bagle!eml.gen
Phish-BankFraud.eml
clamav-0.75


some subject line with viruses:

 {Invalid Filename} Re%3A-5.EML
 {Invalid Filename} Re%3A Thank you!.EML
 {Invalid Filename} Re%3A-6.EML
 {Invalid Filename} Re%3A Thank you!-3.EML



Any suggestions on avoiding this except from moving to commercial AVs

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From hburbano at NOVADEVICES.COM  Mon Nov  8 20:59:19 2004
From: hburbano at NOVADEVICES.COM (Henry Burbano)
Date: Thu Jan 12 21:27:31 2006
Subject: Filter filetype not working
Message-ID: <mailman.4449.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hello,

Filter filetype not working

I have installed:
MailScanner version 4.35.10

My configuration files are:

Mailscanner.conf:

File Command = /usr/bin/file
File Timeout = 20
Filetype Rules = %etc-dir%/filetype.rules.conf

filetype.rules.conf:

allow text - -
allow script - -
allow archive - -
deny self-extract No self-extracting archives No self-extracting archives
deny ELF No executables No executables
deny executable No executables No executables
deny MPEG No MPEG movies No MPEG movies
deny AVI No AVI movies No AVI movies
deny MNG No MNG/PNG movies No MNG/PNG movies
deny QuickTime No QuickTime movies No QuickTime movies
deny Registry No Windows Registry entries No Windows Registry entries

All with tab separates

I am sending an executable file

The log file:

Nov  8 09:55:00 MailScanner[26884]: New Batch: Scanning 1 messages, 3658374
bytes
Nov  8 09:55:00 MailScanner[26884]: MCP Checks: Starting
Nov  8 09:55:00 MailScanner[26884]: Spam Checks: Starting
Nov  8 09:55:07 MailScanner[26884]: Virus and Content Scanning: Starting
Nov  8 09:55:12 MailScanner[26884]: Uninfected: Delivered 1 messages

And the message is normally delivered .

Any suggestion??




Saludos,

_________________________________

Ing. Henry Burbano
Web: www.novadevices.com
E-Mail: hburbano@novadevices.com
Telefono: (593-2) 225-7711
Av. Brasil N44-08 y Condor,
Quito-Ecuador
_________________________________

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From jaearick at COLBY.EDU  Mon Nov  8 21:01:03 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:31 2006
Subject: Clam AV not detecting EML Phish-BankFraud.eml
Message-ID: <mailman.4450.1137101251.24926.mailscanner@lists.mailscanner.info>

upgrade, upgrade.  You need clamav 0.80 for anti-phishing.  Also,
how about running a current version of MailScanner?

On Mon, 8 Nov 2004, Venkata Achanta wrote:

> Date: Mon, 8 Nov 2004 20:52:14 +0000
> From: Venkata Achanta <vachanta@GMAIL.COM>
> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Clam AV not detecting EML Phish-BankFraud.eml
>
> Hello,
>
> I am running MailScanner with clamAV and the following viruses are making
> thru the Mailscanner but they are getting tagged as spam because of the
> invalid file name rules and some are even getting to the end user mail
> client.
>
> versions i am on:
> mailscanner-4.30.3-r2
>
> some of the viruses that go undetected are
>
> W32/Bagle!eml.gen
> Phish-BankFraud.eml
> clamav-0.75
>
>
> some subject line with viruses:
>
> {Invalid Filename} Re%3A-5.EML
> {Invalid Filename} Re%3A Thank you!.EML
> {Invalid Filename} Re%3A-6.EML
> {Invalid Filename} Re%3A Thank you!-3.EML
>
>
>
> Any suggestions on avoiding this except from moving to commercial AVs
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Steve.Swaney at FSL.COM  Mon Nov  8 21:00:00 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:31 2006
Subject: Clam AV not detecting EML Phish-BankFraud.eml
Message-ID: <mailman.4451.1137101251.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Venkata Achanta
> Sent: Monday, November 08, 2004 3:52 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Clam AV not detecting EML Phish-BankFraud.eml
>
> Hello,
>
>  I am running MailScanner with clamAV and the following viruses are making
> thru the Mailscanner but they are getting tagged as spam because of the
> invalid file name rules and some are even getting to the end user mail
> client.
>
> versions i am on:
> mailscanner-4.30.3-r2
>
> some of the viruses that go undetected are
>
> W32/Bagle!eml.gen
> Phish-BankFraud.eml
> clamav-0.75
>
> Any suggestions on avoiding this except from moving to commercial AVs

Your version of ClamAV is a bit old. Update to the latest version of ClamAV
0.80 and call ClamAV in MailScanner.conf using

Virus Scanners = clamavmodule

You'll first need to install the Mail::ClamAV module to do this.

Update MailScanner to the latest version bedore updating ClamAV and
installing Mail::CLamAV as Julian's added some Phishing detection and
support for ClamAV with the latest version of Mail::ClamAV in version
4.35.11-1

Also Bitdefender has a free Linux Esition available:

        http://www.bitdefender.com/bd/site/downloads.php?menu_id=21

Steve
Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From hburbano at NOVADEVICES.COM  Mon Nov  8 21:12:29 2004
From: hburbano at NOVADEVICES.COM (Henry Burbano)
Date: Thu Jan 12 21:27:31 2006
Subject: Please help me with Filtetype
Message-ID: <mailman.4452.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hello,

Is the third time that I send it message because I am getting a reject
message.
The filetype don't work, maybe is a missconfiguration

I have installed:
MailScanner version 4.35.10

My configuration files are:

Mailscanner.conf:

File Command = /usr/bin/file
File Timeout = 20
Filetype Rules = %etc-dir%/filetype.rules.conf

filetype.rules.conf:

allow text - -
allow script - -
allow archive - -
deny self-extract No self-extracting archives No self-extracting archives
deny ELF No executables No executables
deny executable No executables No executables
deny MPEG No MPEG movies No MPEG movies
deny AVI No AVI movies No AVI movies
deny MNG No MNG/PNG movies No MNG/PNG movies
deny QuickTime No QuickTime movies No QuickTime movies
deny Registry No Windows Registry entries No Windows Registry entries

All with tab separates

I am sending an executable file

The log file:

Nov  8 09:55:00 MailScanner[26884]: New Batch: Scanning 1 messages, 3658374
bytes
Nov  8 09:55:00 MailScanner[26884]: MCP Checks: Starting
Nov  8 09:55:00 MailScanner[26884]: Spam Checks: Starting
Nov  8 09:55:07 MailScanner[26884]: Virus and Content Scanning: Starting
Nov  8 09:55:12 MailScanner[26884]: Uninfected: Delivered 1 messages

And the message is normally delivered .

Any suggestion??




Saludos,

_________________________________

Ing. Henry Burbano
Web: www.novadevices.com
E-Mail: hburbano@novadevices.com
Telefono: (593-2) 225-7711
Av. Brasil N44-08 y Condor,
Quito-Ecuador
_________________________________

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From hburbano at NOVADEVICES.COM  Mon Nov  8 21:26:55 2004
From: hburbano at NOVADEVICES.COM (Henry Burbano)
Date: Thu Jan 12 21:27:31 2006
Subject: problems with filetype
Message-ID: <mailman.4453.1137101251.24926.mailscanner@lists.mailscanner.info>

Hello,

Is the third time that I send it message because I am getting a reject
message.
The filetype don't work, maybe is a missconfiguration

I have installed:
MailScanner version 4.35.10

My configuration files are:

Mailscanner.conf:

File Command = /usr/bin/file
File Timeout = 20
Filetype Rules = %etc-dir%/filetype.rules.conf

filetype.rules.conf:

allow text - -
allow script - -
allow archive - -
deny self-extract No self-extracting archives No self-extracting archives
deny ELF No executables No executables
deny executable No executables No executables
deny MPEG No MPEG movies No MPEG movies
deny AVI No AVI movies No AVI movies
deny MNG No MNG/PNG movies No MNG/PNG movies
deny QuickTime No QuickTime movies No QuickTime movies
deny Registry No Windows Registry entries No Windows Registry entries

All with tab separates

I am sending an executable file

The log file:

Nov  8 09:55:00 MailScanner[26884]: New Batch: Scanning 1 messages, 3658374
bytes
Nov  8 09:55:00 MailScanner[26884]: MCP Checks: Starting
Nov  8 09:55:00 MailScanner[26884]: Spam Checks: Starting
Nov  8 09:55:07 MailScanner[26884]: Virus and Content Scanning: Starting
Nov  8 09:55:12 MailScanner[26884]: Uninfected: Delivered 1 messages

And the message is normally delivered .

Any suggestion??

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From sanjay.patel at REXWIRE.COM  Mon Nov  8 21:37:15 2004
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:27:31 2006
Subject: Increase bayes score
Message-ID: <mailman.4454.1137101251.24926.mailscanner@lists.mailscanner.info>

How can I increase bayes_99 score from 1.89 to something higher?

-SKP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From sanjay.patel at REXWIRE.COM  Mon Nov  8 21:39:09 2004
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:27:31 2006
Subject: No message collected error
Message-ID: <mailman.4455.1137101251.24926.mailscanner@lists.mailscanner.info>

We randomly get e-mails that say <<< No Message Collected >

Than the e-mail comes through on second try.

What can be causing this?

-SKP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mkettler at EVI-INC.COM  Mon Nov  8 21:44:21 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:31 2006
Subject: Increase bayes score
Message-ID: <mailman.4456.1137101251.24926.mailscanner@lists.mailscanner.info>

At 04:37 PM 11/8/2004, Sanjay K. Patel wrote:
>How can I increase bayes_99 score from 1.89 to something higher?


Just change the score in your local.cf or spam.assassin.prefs.conf:

         score BAYES_99 2.0

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From dustin.baer at IHS.COM  Mon Nov  8 21:43:10 2004
From: dustin.baer at IHS.COM (Dustin Baer)
Date: Thu Jan 12 21:27:31 2006
Subject: Increase bayes score
Message-ID: <mailman.4457.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Sanjay K. Patel wrote:

>How can I increase bayes_99 score from 1.89 to something higher?
>
>-SKP
>
>
.
In your spam.assassin.prefs.conf:

    score BAYES_99 10

Dustin

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ELKNET.NET  Mon Nov  8 21:45:35 2004
From: mailscanner at ELKNET.NET (Alan)
Date: Thu Jan 12 21:27:31 2006
Subject: MS performance as a gateway comments
Message-ID: <mailman.4458.1137101251.24926.mailscanner@lists.mailscanner.info>

On Sun, 7 Nov 2004 19:12:20 -0500, Marco Benton <marco@XSSNET.COM> wrote:


>all this is dependant on how much mail or system resources you have, and
>how fast you want actual mail to be delivered...  before the days of
>spam mail was instantaneous...  now most companies just accept a delay
>due to virus and spam checking...  so a few minute wait is no big deal.
>but i never seen a resource problem and i get 50,000-100,000+ emails a
>day, SA is ususally the bottleneck.

Perhaps, but just to reiterate, now that I've switched to zmailer, I no
longer have any bottle necks nor delays. SA was NOT my bottle neck, I
proved that by seeing it scream through a large backlog just by shutting
down my MTAs back when I was using sendmail or exim. Now that I use
zmailer, SA again screams through my queue WITHOUT having to shut down the
MTAs. And for comparison, I get between 300,00 and 400,000 emails per day.

I'm not on any kind of soapbox here, all I'm doing is posting my
obeservations related to my experience with three different MTAs and their
resource usage in a gateway envirronment. Perhaps it might help someone
else.

-Cheers!
Alan

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ssilva at SGVWATER.COM  Mon Nov  8 21:43:58 2004
From: ssilva at SGVWATER.COM (Scott Silva)
Date: Thu Jan 12 21:27:31 2006
Subject: Filter filetype not working
Message-ID: <mailman.4459.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Henry Burbano wrote:
| Hello,
|
| Filter filetype not working
|
| I have installed:
| MailScanner version 4.35.10
|
| My configuration files are:
|
| Mailscanner.conf:
|
| File Command = /usr/bin/file
| File Timeout = 20
| Filetype Rules = %etc-dir%/filetype.rules.conf
|
| filetype.rules.conf:
|
does /usr/bin/file exist?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBj+ieRADw9lziUqQRAgTaAJ9PfBu5vFDQX8LI6FutSbjmOPAgbACfS46K
qBbCFq3XiGqs6ppIeW35qyY=
=tGu/
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mkettler at EVI-INC.COM  Mon Nov  8 21:58:15 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:31 2006
Subject: mailsvc.com reposting messages: Re: Rejected posting to
    MAILSCANNER@JISCMAIL.AC.UK
Message-ID: <mailman.4460.1137101251.24926.mailscanner@lists.mailscanner.info>

It would appear that mail.mailsvc.com is reposting messages back to the
list, presumably due to some broken script which is deciding to deliver
messages to the To: address in the message headers instead of the envelope
RCPT address(es).

This has been going on since Friday. Can we drop the offending subscriber
until it can be fixed? It's really quite annoying getting these back for
every post sent to the list.

Rather than post the full address publicly, possibly causing undue spam to
the user, check your own rejection message for the user in COINFOTECH.COM.
It will be in the quoted Received: header as jiscmail.ac.uk drops the
message off to mailsvc.com. I've replaced it with *MUNGED_USERID* in the
headers below.


At 04:45 PM 11/8/2004, L-Soft list server at JISCMAIL (1.8e) wrote:
>Your message  is being returned to  you unprocessed because it  appears to
>have
>already  been distributed  to the  MAILSCANNER list.

<snip>

>Return-Path: <MAILSCANNER@JISCMAIL.AC.UK>
>Received: from 130.246.192.53 by JISCMAIL.AC.UK (SMTPL release 1.0i) with
>TCP; Mon, 8 Nov 2004 21:45:34 +0100
>Received: from mailsvc.com (mail.mailsvc.com [63.247.192.101])
>         by fili.jiscmail.ac.uk (8.12.8/8.12.8) with ESMTP id iA8LjTCM023467
>         for <MAILSCANNER@jiscmail.ac.uk>; Mon, 8 Nov 2004 21:45:30 GMT
>Received: by mailsvc.com (CommuniGate Pro PIPE 4.2)
>   with PIPE id 102745746; Mon, 08 Nov 2004 14:45:22 -0700
>Received: from smtp.jiscmail.ac.uk ([130.246.192.55] verified)
>   by mailsvc.com (CommuniGate Pro SMTP 4.2)
>   with ESMTP id 102745704 for *MUNGED_USERID*@COINFOTECH.COM; Mon, 08 Nov
> 2004 14:45:13 -0700
>Received: from LISTSERV.JISCMAIL.AC.UK (jiscmail.ac.uk) by
>smtp.jiscmail.ac.uk (LSMTP for Windows NT v1.1b) with SMTP id
><6.00182C8C@smtp.jiscmail.ac.uk>; Mon, 8 Nov 2004 21:44:42 +0000
>Received: from JISCMAIL.AC.UK by JISCMAIL.AC.UK (LISTSERV-TCP/IP release 1.8e)
>           with spool id 46851549 for MAILSCANNER@JISCMAIL.AC.UK; Mon, 8 Nov
>           2004 21:44:42 +0000
>Received: from 130.246.192.52 by JISCMAIL.AC.UK (SMTPL release 1.0i) with TCP;
>           Mon, 8 Nov 2004 21:44:42 +0100
>X-RAL-MFrom: <mkettler@evi-inc.com>
>X-RAL-Connect: <xan.evitechnology.com [208.39.141.86]>
>Received: from xanadu.evi-inc.com (xan.evitechnology.com [208.39.141.86]) by
>           kili.jiscmail.ac.uk (8.12.8/8.12.8) with ESMTP id
> iA8LiVuR022022 for
>           <MAILSCANNER@JISCMAIL.AC.UK>; Mon, 8 Nov 2004 21:44:36 GMT

<snip>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Mon Nov  8 22:04:49 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:31 2006
Subject: No message collected error
Message-ID: <mailman.4461.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

What operating system, MTA and version of the MTA are you using. What is
your "Lock Type" setting in MailScanner.conf.
If you are using Linux and sendmail 8.13, then you need "Lock Type =
posix" in MailScanner.conf.

Sanjay K. Patel wrote:

>We randomly get e-mails that say <<< No Message Collected >
>
>Than the e-mail comes through on second try.
>
>What can be causing this?
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Mon Nov  8 22:08:08 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:31 2006
Subject: mailsvc.com reposting messages: Re: Rejected posting to
    MAILSCANNER@JISCMAIL.AC.UK
Message-ID: <mailman.4462.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Many thanks for tracking down the offender for me. I have suspended
their list subscription until they get their mailer fixed.

Matt Kettler wrote:

> It would appear that mail.mailsvc.com is reposting messages back to the
> list, presumably due to some broken script which is deciding to deliver
> messages to the To: address in the message headers instead of the
> envelope
> RCPT address(es).
>
> This has been going on since Friday. Can we drop the offending subscriber
> until it can be fixed? It's really quite annoying getting these back for
> every post sent to the list.
>
> Rather than post the full address publicly, possibly causing undue
> spam to
> the user, check your own rejection message for the user in
> COINFOTECH.COM.
> It will be in the quoted Received: header as jiscmail.ac.uk drops the
> message off to mailsvc.com. I've replaced it with *MUNGED_USERID* in the
> headers below.


--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Jan-Peter.Koopmann at SECEIDOS.DE  Tue Nov  9 07:18:46 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:31 2006
Subject: Subject and Body filter
Message-ID: <mailman.4463.1137101251.24926.mailscanner@lists.mailscanner.info>

> but i can make a ruleset for this in MailScanner?

AFAIK: No you cannot.

Out of curiosity: What exactly do you try to achieve?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Jan-Peter.Koopmann at SECEIDOS.DE  Tue Nov  9 07:24:47 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:31 2006
Subject: MS performance as a gateway comments
Message-ID: <mailman.4464.1137101251.24926.mailscanner@lists.mailscanner.info>

Alan,

> I'm not on any kind of soapbox here, all I'm doing is posting
> my obeservations related to my experience with three
> different MTAs and their resource usage in a gateway
> envirronment. Perhaps it might help someone else.

And all some other guys are doing is contributing in that they are say
they never had these kinds of problems with the other MTAs you
mentioned. I suspect zmailer is a great MTA (never tried it myself) so I
am surely not argueing there. It's just that your observation is not
similar to the experience of some others here. And curious as those
people are they are trying to figure out why something that did not pose
a problem for them did for you. :-)

Thanks for sharing your observation. I learned of a new high performance
mailer and should I ever have to administer a box with so many mails
(and performance problems) I now have an alternative to PostFix...

Regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From sanjay.patel at REXWIRE.COM  Mon Nov  8 22:53:09 2004
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:27:31 2006
Subject: No message collected error
Message-ID: <mailman.4465.1137101251.24926.mailscanner@lists.mailscanner.info>

When do you sleep.

BTW thanks that was it. It worked

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Monday, November 08, 2004 5:05 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: No message collected error

What operating system, MTA and version of the MTA are you using. What is
your "Lock Type" setting in MailScanner.conf.
If you are using Linux and sendmail 8.13, then you need "Lock Type = posix"
in MailScanner.conf.

Sanjay K. Patel wrote:

>We randomly get e-mails that say <<< No Message Collected >
>
>Than the e-mail comes through on second try.
>
>What can be causing this?
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store Professional Support
Services at www.MailScanner.biz MailScanner thanks transtec Computers for
their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From hburbano at NOVADEVICES.COM  Mon Nov  8 23:00:55 2004
From: hburbano at NOVADEVICES.COM (Henry Burbano)
Date: Thu Jan 12 21:27:31 2006
Subject: Filter filetype not working
Message-ID: <mailman.4466.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

yes,

when I run

/usr/bin/file MailScanner.conf

I get:

/home/etc/MailScanner/MailScanner.conf: ASCII English text






Saludos,

_________________________________

Ing. Henry Burbano
Web: www.novadevices.com
E-Mail: hburbano@novadevices.com
Telefono: (593-2) 225-7711
Av. Brasil N44-08 y Condor,
Quito-Ecuador
_________________________________
----- Original Message -----
From: "Scott Silva" <ssilva@SGVWATER.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Monday, November 08, 2004 4:43 PM
Subject: Re: Filter filetype not working


> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Henry Burbano wrote:
> | Hello,
> |
> | Filter filetype not working
> |
> | I have installed:
> | MailScanner version 4.35.10
> |
> | My configuration files are:
> |
> | Mailscanner.conf:
> |
> | File Command = /usr/bin/file
> | File Timeout = 20
> | Filetype Rules = %etc-dir%/filetype.rules.conf
> |
> | filetype.rules.conf:
> |
> does /usr/bin/file exist?
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.1 (MingW32)
> Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
>
> iD8DBQFBj+ieRADw9lziUqQRAgTaAJ9PfBu5vFDQX8LI6FutSbjmOPAgbACfS46K
> qBbCFq3XiGqs6ppIeW35qyY=
> =tGu/
> -----END PGP SIGNATURE-----
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mike at CAMAROSS.NET  Mon Nov  8 23:02:22 2004
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:27:31 2006
Subject: Filter filetype not working
Message-ID: <mailman.4467.1137101251.24926.mailscanner@lists.mailscanner.info>

Henry Burbano wrote:
> yes,
>
> when I run
>
> /usr/bin/file MailScanner.conf
>
> I get:
>
> /home/etc/MailScanner/MailScanner.conf: ASCII English text
>
>

Can you attach your filetype.rules.conf so we can see it?

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From marco at XSSNET.COM  Mon Nov  8 23:38:41 2004
From: marco at XSSNET.COM (Marco Benton)
Date: Thu Jan 12 21:27:31 2006
Subject: MS performance as a gateway comments
Message-ID: <mailman.4468.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Alan wrote:

>Perhaps, but just to reiterate, now that I've switched to zmailer, I no
>longer have any bottle necks nor delays. SA was NOT my bottle neck, I
>proved that by seeing it scream through a large backlog just by shutting
>down my MTAs back when I was using sendmail or exim. Now that I use
>zmailer, SA again screams through my queue WITHOUT having to shut down the
>MTAs. And for comparison, I get between 300,00 and 400,000 emails per day.
>
>I'm not on any kind of soapbox here, all I'm doing is posting my
>obeservations related to my experience with three different MTAs and their
>resource usage in a gateway envirronment. Perhaps it might help someone
>else.
>
>
>

hey...  i'm not arguing...  i might try zmailer just to see a lower
utilization.  maybe i'm wrong about SA.  and if it works for me i'll be
a convert to zmailer!!!  :-)

--

Marco Benton - BOFH, BSMFH
Network Consultant
Phone: (774) 808-4051
Fax  : (508) 519-6033

BOFH excuse #420: The cause of the problem is: Domain controller not responding

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at BARENDSE.TO  Tue Nov  9 09:15:31 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:31 2006
Subject: quoted print?
Message-ID: <mailman.4469.1137101251.24926.mailscanner@lists.mailscanner.info>

Nov  9 10:12:41 gw MailScanner[2845]: Cannot parse  /var/spool/MailScanner/incoming/2845/iA99CGNG004120.header and , Can't
locate object method "init" via package "MIME::Decoder::QuotedPrint" at  /usr/lib/perl5/site_perl/5.8.0/MIME/Decoder.pm line 179.

Why am I getting this message? Quoted Print seems to be installed?

This is MailScanner version 4.35.11
Module versions are:
1.00    AnyDBM_File
1.14    Archive::Zip
1.01    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.04    Fcntl
2.71    File::Basename
2.05    File::Copy
2.01    FileHandle
1.05    File::Path
0.13    File::Temp
1.23    HTML::Entities
3.26    HTML::Parser
2.24    HTML::TokeParser
1.20    IO
1.09    IO::File
1.122   IO::Pipe
2.12    MIME::Base64
5.415   MIME::Decoder
5.415   MIME::Decoder::UU
5.415   MIME::Head
5.415   MIME::Parser
2.03    MIME::QuotedPrint
5.415   MIME::Tools
0.09    Net::CIDR
1.05    POSIX
1.75    Socket
0.03    Sys::Syslog
1.02    Time::localtime

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Tue Nov  9 09:22:05 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:31 2006
Subject: quoted print?
Message-ID: <mailman.4470.1137101251.24926.mailscanner@lists.mailscanner.info>

Did you install the MIME::Base64 package I ship? Which distribution/OS are
you using?
Please don't trim the output of MailScanner -v. The output info is there for
a reason :-)


On 9/11/04 9:15 am, "Remco Barendse" <mailscanner@BARENDSE.TO> wrote:

> Nov  9 10:12:41 gw MailScanner[2845]: Cannot parse
> /var/spool/MailScanner/incoming/2845/iA99CGNG004120.header and , Can't
> locate object method "init" via package "MIME::Decoder::QuotedPrint" at
> /usr/lib/perl5/site_perl/5.8.0/MIME/Decoder.pm line 179.
>
> Why am I getting this message? Quoted Print seems to be installed?
>
> This is MailScanner version 4.35.11
> Module versions are:
> 1.00    AnyDBM_File
> 1.14    Archive::Zip
> 1.01    Carp
> 1.119   Convert::BinHex
> 1.00    DirHandle
> 1.04    Fcntl
> 2.71    File::Basename
> 2.05    File::Copy
> 2.01    FileHandle
> 1.05    File::Path
> 0.13    File::Temp
> 1.23    HTML::Entities
> 3.26    HTML::Parser
> 2.24    HTML::TokeParser
> 1.20    IO
> 1.09    IO::File
> 1.122   IO::Pipe
> 2.12    MIME::Base64
> 5.415   MIME::Decoder
> 5.415   MIME::Decoder::UU
> 5.415   MIME::Head
> 5.415   MIME::Parser
> 2.03    MIME::QuotedPrint
> 5.415   MIME::Tools
> 0.09    Net::CIDR
> 1.05    POSIX
> 1.75    Socket
> 0.03    Sys::Syslog
> 1.02    Time::localtime
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From drew at THEMARSHALLS.CO.UK  Tue Nov  9 09:28:06 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:31 2006
Subject: MS performance as a gateway comments
Message-ID: <mailman.4471.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Tue, November 9, 2004 7:24, Jan-Peter Koopmann said:
> Alan,
>
>> I'm not on any kind of soapbox here, all I'm doing is posting
>> my obeservations related to my experience with three
>> different MTAs and their resource usage in a gateway
>> envirronment. Perhaps it might help someone else.
>
> Thanks for sharing your observation. I learned of a new high performance
> mailer and should I ever have to administer a box with so many mails
> (and performance problems) I now have an alternative to PostFix...
>
I would have loved you to have had a chance to try Postfix as well so
there was a complete MS supported MTA comparison (I'm not suggesting you
should break what you have just to complete the report ;-) ). I too have
never used zMailer preferring Postfix (As I'm stupid and find it much
easier to setup :-) ) but I'm always interested and on the lookout for
different ideas and options.

Drew


--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at BARENDSE.TO  Tue Nov  9 09:33:45 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:31 2006
Subject: quoted print?
Message-ID: <mailman.4472.1137101251.24926.mailscanner@lists.mailscanner.info>

Sorry, the top bit didn't fit on my screen (crappy 17" :) TFT)

Running on
Linux gw 2.4.21-20.1TL #1 Wed Sep 8 13:13:54 CEST 2004 i686 athlon i386
GNU/Linux
This is Tao Linux release 1 (Mooch Update 3)
This is Perl version 5.008000 (5.8.0)

I nuked the box yesterday and did a re-install. For some reason indeed
Base64 was not updated. Rebuilding the SRPM and installing seems to fix
it.

Weird that it did not build from the install script.

Would it be possible to have the install scripts of both MailScanner and
install-clam-spamass do logging in the current directory by default. Would
have been usefull to check why it did not build the first time. I guess
people won't mind the 30 kb extra log in their install dir?

Cheers!

On Tue, 9 Nov 2004, Julian Field wrote:

> Did you install the MIME::Base64 package I ship? Which distribution/OS are
> you using?
> Please don't trim the output of MailScanner -v. The output info is there for
> a reason :-)
>
>
> On 9/11/04 9:15 am, "Remco Barendse" <mailscanner@BARENDSE.TO> wrote:
>
>> Nov  9 10:12:41 gw MailScanner[2845]: Cannot parse
>> /var/spool/MailScanner/incoming/2845/iA99CGNG004120.header and , Can't
>> locate object method "init" via package "MIME::Decoder::QuotedPrint" at
>> /usr/lib/perl5/site_perl/5.8.0/MIME/Decoder.pm line 179.
>>
>> Why am I getting this message? Quoted Print seems to be installed?
>>
>> This is MailScanner version 4.35.11
>> Module versions are:
>> 1.00    AnyDBM_File
>> 1.14    Archive::Zip
>> 1.01    Carp
>> 1.119   Convert::BinHex
>> 1.00    DirHandle
>> 1.04    Fcntl
>> 2.71    File::Basename
>> 2.05    File::Copy
>> 2.01    FileHandle
>> 1.05    File::Path
>> 0.13    File::Temp
>> 1.23    HTML::Entities
>> 3.26    HTML::Parser
>> 2.24    HTML::TokeParser
>> 1.20    IO
>> 1.09    IO::File
>> 1.122   IO::Pipe
>> 2.12    MIME::Base64
>> 5.415   MIME::Decoder
>> 5.415   MIME::Decoder::UU
>> 5.415   MIME::Head
>> 5.415   MIME::Parser
>> 2.03    MIME::QuotedPrint
>> 5.415   MIME::Tools
>> 0.09    Net::CIDR
>> 1.05    POSIX
>> 1.75    Socket
>> 0.03    Sys::Syslog
>> 1.02    Time::localtime
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Tue Nov  9 10:21:45 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:31 2006
Subject: quoted print?
Message-ID: <mailman.4473.1137101251.24926.mailscanner@lists.mailscanner.info>

Any idea how to do this? My sh isn't good enough. I can redirect the stderr
of the script to its stdout with "exec 2>&1", but how do I redirect the
stdout through "tee" which is presumably what I need to do to get the output
into a file as well as on the terminal. "exec |tee file.out" is obviously
not right.

> Would it be possible to have the install scripts of both MailScanner and
> install-clam-spamass do logging in the current directory by default. Would
> have been usefull to check why it did not build the first time. I guess
> people won't mind the 30 kb extra log in their install dir?

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From carinus.carelse at MRC.AC.ZA  Tue Nov  9 10:24:54 2004
From: carinus.carelse at MRC.AC.ZA (Carinus Carelse)
Date: Thu Jan 12 21:27:31 2006
Subject: Phishing net improvement
Message-ID: <mailman.4474.1137101251.24926.mailscanner@lists.mailscanner.info>

Can someone direct me to how do install this patch please.

Carinus

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Tue Nov  9 10:37:28 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:31 2006
Subject: Phishing net improvement
Message-ID: <mailman.4475.1137101251.24926.mailscanner@lists.mailscanner.info>

Save the patch file into /tmp then do this:

cd /usr/lib/MailScanner/MailScanner
patch < /tmp/Message.pm.phishing.patch
service MailScanner restart


On 9/11/04 10:24 am, "Carinus Carelse" <carinus.carelse@MRC.AC.ZA> wrote:

> Can someone direct me to how do install this patch please.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From rcooper at DWFORD.COM  Tue Nov  9 11:11:05 2004
From: rcooper at DWFORD.COM (Rick Cooper)
Date: Thu Jan 12 21:27:31 2006
Subject: quoted print?
Message-ID: <mailman.4476.1137101251.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> Behalf Of Julian Field
> Sent: Tuesday, November 09, 2004 5:22 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: quoted print?
>
>
> Any idea how to do this? My sh isn't good enough. I can redirect
> the stderr
> of the script to its stdout with "exec 2>&1", but how do I redirect the
> stdout through "tee" which is presumably what I need to do to get
> the output
> into a file as well as on the terminal. "exec |tee file.out" is obviously
> not right.
>
<snip>

Actually, "exec 2>&1 | tee -a file.out" should work fine. try "ls sdngfds
2>&1 | tee -a file.out" and you should see the error on your screen as well
as in file.out. (the "-a" would be best for appending to the log btw)

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mynamewasgone at gmail.com  Tue Nov  9 11:18:26 2004
From: mynamewasgone at gmail.com (Richard Brown)
Date: Thu Jan 12 21:27:31 2006
Subject: quoted print?
Message-ID: <mailman.4477.1137101251.24926.mailscanner@lists.mailscanner.info>

On Tue, 9 Nov 2004 10:21:45 +0000, Julian Field
<mailscanner@ecs.soton.ac.uk> wrote:
> Any idea how to do this? My sh isn't good enough. I can redirect the stderr
> of the script to its stdout with "exec 2>&1", but how do I redirect the
> stdout through "tee" which is presumably what I need to do to get the output
> into a file as well as on the terminal. "exec |tee file.out" is obviously
> not right.

Put them together

exec 2>&1 | tee file.out

2>&1 redirects stderr to stdout, then the pipe redirects stdout, which
now also includes stderr

Regards,

Richard

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Tue Nov  9 11:33:31 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:31 2006
Subject: quoted print?
Message-ID: <mailman.4478.1137101251.24926.mailscanner@lists.mailscanner.info>

I've tried that. Zero-length file.

#!/bin/sh

echo This is a script

exec 2>&1 | tee script.out

echo This is line 1
ls
ypmatch wibble ecsinfo # This will produce stderr output
echo This is the end.


On 9/11/04 11:18 am, "Richard Brown" <mynamewasgone@gmail.com> wrote:

> On Tue, 9 Nov 2004 10:21:45 +0000, Julian Field
> <mailscanner@ecs.soton.ac.uk> wrote:
>> Any idea how to do this? My sh isn't good enough. I can redirect the stderr
>> of the script to its stdout with "exec 2>&1", but how do I redirect the
>> stdout through "tee" which is presumably what I need to do to get the output
>> into a file as well as on the terminal. "exec |tee file.out" is obviously
>> not right.
>
> Put them together
>
> exec 2>&1 | tee file.out
>
> 2>&1 redirects stderr to stdout, then the pipe redirects stdout, which
> now also includes stderr

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mk at quadstone.com  Tue Nov  9 12:04:39 2004
From: mk at quadstone.com (Michael Keightley)
Date: Thu Jan 12 21:27:31 2006
Subject: MailScanner not working after Perl upgrade to 5.8.5
Message-ID: <mailman.4479.1137101251.24926.mailscanner@lists.mailscanner.info>

We run MailScanner-4.34.4 on Solaris 9 with SpamAssassin-3.0.1.
Our Perl installation (5.6.1) was a bit of a mess here, so I decided to start
again from fresh with 5.8.5.  This came as a Solaris package from
Sunfreeware.com.
I installed all the modules listed below that seemed to be relevant to
MailScanner, then swapped over the version of Perl from 5.6.1 to 5.8.5.
MailScanner started up OK, but it didn't seem to actually process any of the
mail.  I got of these messages in the maillog:
MailScanner[16017]: MailScanner E-Mail Virus Scanner version 4.34.4 starting...

but that was it.  I tried disabling SpamAssassin, but still no joy.
I had to change back to Perl 5.6.1.  #

Anyone one got any ideas?  How do I go about debugging this?

Modules installed:

Archive-Zip-1.14
Compress-Zlib-1.33
Convert-TNEF-0.17
ExtUtils-MakeMaker-6.05
File-Spec-0.90
File-Temp-0.14
HTML-Parser-3.36
HTML-Tagset-3.03
IO-stringy-2.109
MIME-Base64-3.05
MIME-tools-5.415
Net-CIDR-0.10
TimeDate-1.16

Digest-MD5-2.33
Digest-SHA1-2.10
Mail-ClamAV-0.12
Mail-SpamAssassin-3.0.1


Thanks,
Michael
--
Michael Keightley <Michael.Keightley@quadstone.com>    Tel: +44 131 240 3137
Systems Manager, Quadstone Limited,                    Fax: +44 131 220 4492
16 Chester Street, Edinburgh EH3 7RA, Scotland         http://www.quadstone.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From rcooper at DWFORD.COM  Tue Nov  9 12:15:27 2004
From: rcooper at DWFORD.COM (Rick Cooper)
Date: Thu Jan 12 21:27:31 2006
Subject: quoted print?
Message-ID: <mailman.4480.1137101251.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> Behalf Of Julian Field
> Sent: Tuesday, November 09, 2004 6:34 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: quoted print?
>
>
> I've tried that. Zero-length file.
>
> #!/bin/sh
>
> echo This is a script
>
> exec 2>&1 | tee script.out
>
> echo This is line 1
> ls
> ypmatch wibble ecsinfo # This will produce stderr output
> echo This is the end.
>
>
<snip>

This won't work, this will

#!/bin/sh
cat /dev/null > script.out

echo This is a script 2>&1 | tee -a script.out


echo This is line 1  2>&1 | tee -a script.out
ls  2>&1 | tee -a script.out
# This will produce stderr output
ypmatch wibble ecsinfo 2>&1 | tee -a script.out
echo This is the end. 2>&1 | tee -a script.out

I see what you are trying to do so this would probably be your best answer:

#!/bin/sh
# clear the out file, and/or create it
cat /dev/null > script.out

# Set done to NO at the top of the script so the following loop
# will execute. Wrap your entire script in this loop

DONE=NO
until [ "$DONE" = "YES" ]
do

echo This is a script
echo This is line 1
ls script.out
# This will produce stderr output
ypmatch wibble ecsinfo
echo This is the end.

# now at the bottom of the loop set DONE to YES so the loop won't execute
# again

DONE=YES
# This wraps the entire loop output so stderr goes to stdin then pipes to
tee
# which in turn appends all output to script.out
done 2>&1 | tee -a script.out



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Tue Nov  9 12:20:57 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:31 2006
Subject: MailScanner not working after Perl upgrade to 5.8.5
Message-ID: <mailman.4481.1137101251.24926.mailscanner@lists.mailscanner.info>

On 9/11/04 12:04 pm, "Michael Keightley" <mk@quadstone.com> wrote:

> We run MailScanner-4.34.4 on Solaris 9 with SpamAssassin-3.0.1.
> Our Perl installation (5.6.1) was a bit of a mess here, so I decided to start
> again from fresh with 5.8.5.  This came as a Solaris package from
> Sunfreeware.com.
> I installed all the modules listed below that seemed to be relevant to
> MailScanner, then swapped over the version of Perl from 5.6.1 to 5.8.5.

You surely need to be running Perl 5.8.5 when you do the installation of all
the modules?


--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
--
Julian Field
jkf@ecs.soton.ac.uk
Teaching Systems Manager
Electronics & Computer Science
University of Southampton
SO17 1BJ, UK

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mike at CAMAROSS.NET  Tue Nov  9 12:49:07 2004
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:27:31 2006
Subject: MailScanner not working after Perl upgrade to 5.8.5
Message-ID: <mailman.4482.1137101251.24926.mailscanner@lists.mailscanner.info>

Michael Keightley wrote:
> We run MailScanner-4.34.4 on Solaris 9 with SpamAssassin-3.0.1.
> Our Perl installation (5.6.1) was a bit of a mess here, so I decided
> to start again from fresh with 5.8.5.  This came as a Solaris package
> from Sunfreeware.com. I installed all the modules listed below that
> seemed to be relevant to MailScanner, then swapped over the version
> of Perl from 5.6.1 to 5.8.5.
> MailScanner started up OK, but it didn't seem to actually process any
> of the mail.  I got of these messages in the maillog:
> MailScanner[16017]: MailScanner E-Mail Virus Scanner version 4.34.4
> starting...
>
> but that was it.  I tried disabling SpamAssassin, but still no joy.
> I had to change back to Perl 5.6.1.  #
>
> Anyone one got any ideas?  How do I go about debugging this?
>
> Modules installed:
>


I had a similar issue the other day when I upgrade a box from Redhat 7.3 to
RH 8 to RH 9 to Centos 3.3  This upgraded perl to 5.8.x from 5.6.x.  I ended
up having to reinstall all of my perl modules so that they existed in the
NEW perl installation.  It wasn't fun, but it works like a champ now.

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From hburbano at NOVADEVICES.COM  Tue Nov  9 13:01:44 2004
From: hburbano at NOVADEVICES.COM (Henry Burbano)
Date: Thu Jan 12 21:27:31 2006
Subject: Filter filetype not working
Message-ID: <mailman.4483.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

it file has tab separates
 filetype.rules.conf

allow text - -
allow script - -
allow archive - -
deny self-extract No self-extracting archives No self-extracting archives
deny ELF No executables No executables
deny executable No executables No executables
deny MPEG No MPEG movies No MPEG movies
deny AVI No AVI movies No AVI movies
deny MNG No MNG/PNG movies No MNG/PNG movies
deny QuickTime No QuickTime movies No QuickTime movies
deny Registry No Windows Registry entries No Windows Registry entries





----- Original Message -----
From: "Mike Kercher" <mike@CAMAROSS.NET>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Monday, November 08, 2004 6:02 PM
Subject: Re: Filter filetype not working


> Henry Burbano wrote:
> > yes,
> >
> > when I run
> >
> > /usr/bin/file MailScanner.conf
> >
> > I get:
> >
> > /home/etc/MailScanner/MailScanner.conf: ASCII English text
> >
> >
>
> Can you attach your filetype.rules.conf so we can see it?
>
> Mike
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mike at CAMAROSS.NET  Tue Nov  9 13:16:45 2004
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:27:31 2006
Subject: Filter filetype not working
Message-ID: <mailman.4484.1137101251.24926.mailscanner@lists.mailscanner.info>

Henry Burbano wrote:
> it file has tab separates
>  filetype.rules.conf
>
> allow text - -
> allow script - -
> allow archive - -
> deny self-extract No self-extracting archives No self-extracting
> archives deny ELF No executables No executables deny executable No
> executables No executables deny MPEG No MPEG movies No MPEG movies
> deny AVI No AVI movies No AVI movies deny MNG No MNG/PNG movies No
> MNG/PNG movies deny QuickTime No QuickTime movies No QuickTime movies
> deny Registry No Windows Registry entries No Windows Registry entries
>
>
>
>
>
> ----- Original Message -----
> From: "Mike Kercher" <mike@CAMAROSS.NET>
> To: <MAILSCANNER@JISCMAIL.AC.UK>
> Sent: Monday, November 08, 2004 6:02 PM
> Subject: Re: Filter filetype not working
>
>
>> Henry Burbano wrote:
>>> yes,
>>>
>>> when I run
>>>
>>> /usr/bin/file MailScanner.conf
>>>
>>> I get:
>>>
>>> /home/etc/MailScanner/MailScanner.conf: ASCII English text
>>>
>>>
>>
>> Can you attach your filetype.rules.conf so we can see it?
>>
>> Mike


What about your filename.rules.conf?  Have you changed anything in there?
Are you bypassing scanning (via ruleset) for any users?

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From dhawal at NETMAGICSOLUTIONS.COM  Tue Nov  9 13:23:38 2004
From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy)
Date: Thu Jan 12 21:27:31 2006
Subject: SQL database for bayes
Message-ID: <mailman.4485.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hello all,

Is anyone using the SQL features in SA 3+ for storing the bayesian
information in a SQL database? We have multiple MS servers and would
prefer this over NFS / Samba sharing though currently we maintain native
disk based bayesian databases. (/etc/MailScanner/bayes)

How are you sharing the bayesian information?
What would be the advantages / disadvantages of doing it in SQL?
Can anyone comment on the performance after the change?

regards,
- dhawal

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at LISTS.COM.AR  Tue Nov  9 13:09:10 2004
From: mailscanner at LISTS.COM.AR (Leonardo Helman)
Date: Thu Jan 12 21:27:31 2006
Subject: quoted print?
Message-ID: <mailman.4486.1137101251.24926.mailscanner@lists.mailscanner.info>

Probably you want something like:

#!/bin/sh

(echo This is a script

exec 2>&1

echo This is line 1
ls
ypmatch wibble ecsinfo # This will produce stderr output
echo This is the end.
) | tee file.log


No spaces between first parenthesys and next char.

--
Leonardo Helman
Pert Consultores
Argentina


On Tue, Nov 09, 2004 at 11:33:09AM +0000, Julian Field wrote:
> I've tried that. Zero-length file.
>
> #!/bin/sh
>
> echo This is a script
>
> exec 2>&1 | tee script.out
>
> echo This is line 1
> ls
> ypmatch wibble ecsinfo # This will produce stderr output
> echo This is the end.
>
>
> On 9/11/04 11:18 am, "Richard Brown" <mynamewasgone@gmail.com> wrote:
>
> > On Tue, 9 Nov 2004 10:21:45 +0000, Julian Field
> > <mailscanner@ecs.soton.ac.uk> wrote:
> >> Any idea how to do this? My sh isn't good enough. I can redirect the stderr
> >> of the script to its stdout with "exec 2>&1", but how do I redirect the
> >> stdout through "tee" which is presumably what I need to do to get the output
> >> into a file as well as on the terminal. "exec |tee file.out" is obviously
> >> not right.
> >
> > Put them together
> >
> > exec 2>&1 | tee file.out
> >
> > 2>&1 redirects stderr to stdout, then the pipe redirects stdout, which
> > now also includes stderr
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From hburbano at NOVADEVICES.COM  Tue Nov  9 14:24:58 2004
From: hburbano at NOVADEVICES.COM (Henry Burbano)
Date: Thu Jan 12 21:27:31 2006
Subject: Filter filetype not working
Message-ID: <mailman.4487.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I am allowing all attachments,  is it right?, or I need to set something
else,


I have it:

filename.rules.conf:

deny .{150,} Filename too long Filename too long
deny \s{10,} Filename with lots of white spaces Filename with lots of white
spaces
deny \{[a-hA-H0-9-]{25,}\}$ Filename with hide extension Filename with hide
extension
deny (\.[a-z0-9]{3})\1$ File with same double extension File with same
double extension
deny \.[a-z][a-z0-9]{2,3}\s*\.[a-z0-9]{3}$ File with different double
extension File with different double extension
deny pretty\s+park\.exe$ Virus Pretty Park Virus Pretty Park
deny happy99.exe$ Virus Happy Virus Happy
allow (\.[a-zA-Z0-9]{2,})$ File attached is allow File attached is allow



----- Original Message -----
From: "Mike Kercher" <mike@CAMAROSS.NET>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, November 09, 2004 8:16 AM
Subject: Re: Filter filetype not working


> Henry Burbano wrote:
> > it file has tab separates
> >  filetype.rules.conf
> >
> > allow text - -
> > allow script - -
> > allow archive - -
> > deny self-extract No self-extracting archives No self-extracting
> > archives deny ELF No executables No executables deny executable No
> > executables No executables deny MPEG No MPEG movies No MPEG movies
> > deny AVI No AVI movies No AVI movies deny MNG No MNG/PNG movies No
> > MNG/PNG movies deny QuickTime No QuickTime movies No QuickTime movies
> > deny Registry No Windows Registry entries No Windows Registry entries
> >
> >
> >
> >
> >
> > ----- Original Message -----
> > From: "Mike Kercher" <mike@CAMAROSS.NET>
> > To: <MAILSCANNER@JISCMAIL.AC.UK>
> > Sent: Monday, November 08, 2004 6:02 PM
> > Subject: Re: Filter filetype not working
> >
> >
> >> Henry Burbano wrote:
> >>> yes,
> >>>
> >>> when I run
> >>>
> >>> /usr/bin/file MailScanner.conf
> >>>
> >>> I get:
> >>>
> >>> /home/etc/MailScanner/MailScanner.conf: ASCII English text
> >>>
> >>>
> >>
> >> Can you attach your filetype.rules.conf so we can see it?
> >>
> >> Mike
>
>
> What about your filename.rules.conf?  Have you changed anything in there?
> Are you bypassing scanning (via ruleset) for any users?
>
> Mike
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From jaearick at COLBY.EDU  Tue Nov  9 14:52:15 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:31 2006
Subject: 4.35.11: new to DCC, did I do it right?
Message-ID: <mailman.4488.1137101251.24926.mailscanner@lists.mailscanner.info>

Gang,

I'm a newbie to using DCC, my setup is: MS 4.35.11, SA 3.0.1, perl 5.8.5.
I've been using razor for a while.  I'm wondering if I did DCC correctly.

I built dcc with:

./configure --homedir=/opt/dcc --bindir=/opt/dcc/bin --disable-dccm --with-uid=26

where uid 26 is "mailnull" on my system, and installed it.  I opened up port
6277 udp and tcp in my firewall, just like dns (port 53). I took a look
thru the various files in the dcc homedir, and made minor changes to dcc_conf
and whiteclnt.  Then I stopped mailscanner, set the correct path to dccproc
in etc/spam.assassin.prefs.conf.  Restarted MS, and watched the syslog.
I see "DCC_CHECK 2.17" in syslogging of SpamAssassin information.

Uhhh, is that all there is to using DCC?  Things to look out for?  Gotchas?
Did I miss something, or is it really that simple?

Jeff Earickson
Colby College

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ugob at CAMO-ROUTE.COM  Tue Nov  9 15:01:08 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:31 2006
Subject: 4.35.11: new to DCC, did I do it right?
Message-ID: <mailman.4489.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Jeff A. Earickson wrote:
> Gang,
>
> I'm a newbie to using DCC, my setup is: MS 4.35.11, SA 3.0.1, perl 5.8.5.
> I've been using razor for a while.  I'm wondering if I did DCC correctly.
>
> I built dcc with:
>
> ./configure --homedir=/opt/dcc --bindir=/opt/dcc/bin --disable-dccm
> --with-uid=26
>
> where uid 26 is "mailnull" on my system, and installed it.  I opened up
> port
> 6277 udp and tcp in my firewall, just like dns (port 53). I took a look
> thru the various files in the dcc homedir, and made minor changes to
> dcc_conf
> and whiteclnt.  Then I stopped mailscanner, set the correct path to dccproc
> in etc/spam.assassin.prefs.conf.  Restarted MS, and watched the syslog.
> I see "DCC_CHECK 2.17" in syslogging of SpamAssassin information.
>
> Uhhh, is that all there is to using DCC?  Things to look out for?  Gotchas?
> Did I miss something, or is it really that simple?

Most of the people don't tweak anything.  I just do a ./configure and
then the usual make commands.

Best way to see if it works is using the spamassassin -D --lint -p
/prefs/file/path or MailScanner in debug mode.

If you get DCC_CHECK scores, you seem to be fine.

>
> Jeff Earickson
> Colby College
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From sde at HNT.HELLER-MACHINES.COM  Tue Nov  9 15:11:36 2004
From: sde at HNT.HELLER-MACHINES.COM (Schneck Dennis ITS1 SDE)
Date: Thu Jan 12 21:27:31 2006
Subject: unrar 3.40 with mailscanner - ProcessClamAVOutput: unrecognised l
    ine
Message-ID: <mailman.4490.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

hello


/usr/lib/MailScanner/clamav-wrapper

# LESS COMMON unpackers, which probably aren't installed by default
# (hence disabled)
# Uncomment ONE of the following lines if you have unrar installed
ExtraScanOptions="$ExtraScanOptions --unrar"
ExtraScanOptions="$ExtraScanOptions --unrar=/usr/bin/unrar"

# Uncomment ONE of the following lines if you have unarj installed
ExtraScanOptions="$ExtraScanOptions --unarj"
ExtraScanOptions="$ExtraScanOptions --unarj=/usr/bin/unarj"

# Uncomment ONE of the following lines if you have unace installed
ExtraScanOptions="$ExtraScanOptions --unace"
ExtraScanOptions="$ExtraScanOptions --unace=/usr/bin/unace"



/var/log/messages


Nov  9 13:58:19 elwmrs MailScanner[28308]: UNRAR 3.40 beta 4 freeware
Copyright (c) 1993-2004 Alexander Roshal
Nov  9 13:58:19 elwmrs MailScanner[28308]: ProcessClamAVOutput: unrecognised
line "UNRAR 3.40 beta 4 freeware      Copyright (c) 1993-2004 Alexander
Roshal". Please contact the authors!
Nov  9 16:08:12 elwmrs MailScanner[1813]: UNRAR 3.40 beta 4 freeware
Copyright (c) 1993-2004 Alexander Roshal
Nov  9 16:08:12 elwmrs MailScanner[1813]: ProcessClamAVOutput: unrecognised
line "UNRAR 3.40 beta 4 freeware      Copyright (c) 1993-2004 Alexander
Roshal". P




what did i wrong !

thanks

dennis

The information contained in this email is intended solely for the addressee. If you are not the intended recipient or his representative, any form of disclosure, reproduction, distribution or any action taken or refrained from in reliance on it, is prohibited and may be unlawful. Please notify the sender immediately. All statements of opinion or advice directed via this email to the addressee are subject to the regulations expressed in the quotation or order and, in particular, in the general order terms and conditions and in the individual liability agreement. The content of this email is not legally binding unless confirmed by letter. The sending of emails to us will not constitute compliance with any time limits or deadlines. We also like to inform you that communication via email over the internet is insecure because third parties may have the possibility to access and manipulate emails. For this reason we will not send any confidential information via email over the in!
ternet.
----------------------------------------------------------------------
This message has been checked for all known viruses by e:)scan.
For further information please contact the postmaster:
mailto:postmaster@heller-machines.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From carinus.carelse at MRC.AC.ZA  Tue Nov  9 16:14:42 2004
From: carinus.carelse at MRC.AC.ZA (Carinus Carelse)
Date: Thu Jan 12 21:27:31 2006
Subject: Phishing net improvement I get an error when I try to run the patch
Message-ID: <mailman.4491.1137101251.24926.mailscanner@lists.mailscanner.info>

I am installing the patch on MailScanner-4.31.6.  On Solaris 9.

Carinus

Error Message

Looks like a unified context diff.
Hunk #1 failed at line 4043.
Hunk #2 failed at line 4055.
2 out of 2 hunks failed: saving rejects to ./Message.pm.rej
done

Message.pm.rej file
**************
*** 4043,4048 ****
      $squashedtext =~ s#%([0-9a-f][0-9a-f])#chr(hex('0x' . $1))#gei; #
Unescape
      $squashedtext =~ s/\s+//g; # Remove any whitespace
      $squashedtext =~ s/\\/\//g;
      #print STDERR "Text = \"$text\"\n";
      #print STDERR "1SquashedText = \"$squashedtext\"\n";
      #print STDERR "1LinkURL      = \"$DisarmLinkURL\"\n";
--- 4043,4050 ----
      $squashedtext =~ s#%([0-9a-f][0-9a-f])#chr(hex('0x' . $1))#gei; #
Unescape
      $squashedtext =~ s/\s+//g; # Remove any whitespace
      $squashedtext =~ s/\\/\//g;
+     $squashedtext =~ s/(\<\/?[^>]*\>)*//ig; # Remove tags
+     #$squashedtext =~ s/^(\<\/?(br|p|ul)\>)*//ig; # Remove leading br,
p, ul tags
      #print STDERR "Text = \"$text\"\n";
      #print STDERR "1SquashedText = \"$squashedtext\"\n";
      #print STDERR "1LinkURL      = \"$DisarmLinkURL\"\n";
***************
*** 4055,4063 ****
        $linkurl =~ s/\%a0//g;
        $linkurl =~ s#%([0-9a-f][0-9a-f])#chr(hex('0x' . $1))#gei; #
Unescape
        $linkurl =~ s/\s+//; # Remove any whitespace
        $linkurl =~ s/^(https?|ftp):\/\///;
        $linkurl =~ s/\/.*$//; # Only compare up to the first '/'
(hostname only)
-       $linkurl =~ s/\<\/?(br|p)\>$//i; # Remove trailing <br> and <p>
tags
        $linkurl =~ s/\/$//; # LinkURL is trimmed -- note
        #print STDERR "2SquashedText = \"$squashedtext\"\n";
        #print STDERR "2LinkURL      = \"$linkurl\"\n";
--- 4057,4067 ----
        $linkurl =~ s/\%a0//g;
        $linkurl =~ s#%([0-9a-f][0-9a-f])#chr(hex('0x' . $1))#gei; #
Unescape
        $linkurl =~ s/\s+//; # Remove any whitespace
+       #$linkurl =~ s/(\<\/?[^>]*\>)*//ig; # Remove tags
+       #$linkurl =~ s/^(\<\/?(br|p|ul)\>)*//ig; # Remove leading br, p,
ul tags
        $linkurl =~ s/^(https?|ftp):\/\///;
        $linkurl =~ s/\/.*$//; # Only compare up to the first '/'
(hostname only)
+       $linkurl =~ s/(\<\/?(br|p|ul)\>)*$//ig; # Remove trailing br, p,
ul tags
        $linkurl =~ s/\/$//; # LinkURL is trimmed -- note
        #print STDERR "2SquashedText = \"$squashedtext\"\n";
        #print STDERR "2LinkURL      = \"$linkurl\"\n";
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Jan-Peter.Koopmann at SECEIDOS.DE  Tue Nov  9 16:21:35 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:31 2006
Subject: Phishing net improvement I get an error when I try to run the
    patch
Message-ID: <mailman.4492.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Dienstag, 9. November 2004 5:14 Carinus Carelse wrote:

> I am installing the patch on MailScanner-4.31.6.  On Solaris 9.

Interesting.

> Hunk #1 failed at line 4043.
> Hunk #2 failed at line 4055.
> 2 out of 2 hunks failed: saving rejects to ./Message.pm.rej

Considering the current version is 4.35.10 and phishing detection was introduced in 4.35 (I think), it is not really that surprising.

Please upgrade to the current version and _then_ apply the patch.

Regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Tue Nov  9 16:24:55 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:31 2006
Subject: Phishing net improvement I get an error when I try to run the
    patch
Message-ID: <mailman.4493.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

You&#8217;ll have a hard time applying this patch to 4.31 as I
hadn&#8217;t even written the phishing net then.
Sorry, but you&#8217;ll have to upgrade to the latest version in order to
get the phishing net.


On 9/11/04 4:14 pm, "Carinus Carelse" <carinus.carelse@MRC.AC.ZA> wrote:

      I am installing the patch on MailScanner-4.31.6.  On Solaris
      9.

      Carinus

      Error Message

      Looks like a unified context diff.
      Hunk #1 failed at line 4043.
      Hunk #2 failed at line 4055.
      2 out of 2 hunks failed: saving rejects to ./Message.pm.rej
      done

      Message.pm.rej file
      **************
      *** 4043,4048 ****
            $squashedtext =~ s#%([0-9a-f][0-9a-f])#chr(hex('0x' .
      $1))#gei; # Unescape
            $squashedtext =~ s/\s+//g; # Remove any whitespace
            $squashedtext =~ s/\\/\//g;
            #print STDERR "Text = \"$text\"\n";
            #print STDERR "1SquashedText = \"$squashedtext\"\n";
            #print STDERR "1LinkURL     = \"$DisarmLinkURL\"\n";
      --- 4043,4050 ----
            $squashedtext =~ s#%([0-9a-f][0-9a-f])#chr(hex('0x' .
      $1))#gei; # Unescape
            $squashedtext =~ s/\s+//g; # Remove any whitespace
            $squashedtext =~ s/\\/\//g;
      +     $squashedtext =~ s/(\<\/?[^>]*\>)*//ig; # Remove tags
      +     #$squashedtext =~ s/^(\<\/?(br|p|ul)\>)*//ig; # Remove
      leading br, p, ul tags
            #print STDERR "Text = \"$text\"\n";
            #print STDERR "1SquashedText = \"$squashedtext\"\n";
            #print STDERR "1LinkURL     = \"$DisarmLinkURL\"\n";
      ***************
      *** 4055,4063 ****
              $linkurl =~ s/\%a0//g;
              $linkurl =~ s#%([0-9a-f][0-9a-f])#chr(hex('0x' .
      $1))#gei; # Unescape
              $linkurl =~ s/\s+//; # Remove any whitespace
              $linkurl =~ s/^(https?|ftp):\/\///;
              $linkurl =~ s/\/.*$//; # Only compare up to the first
      '/' (hostname only)
      -       $linkurl =~ s/\<\/?(br|p)\>$//i; # Remove trailing
      <br> and <p> tags
              $linkurl =~ s/\/$//; # LinkURL is trimmed -- note
              #print STDERR "2SquashedText = \"$squashedtext\"\n";
              #print STDERR "2LinkURL     = \"$linkurl\"\n";
      --- 4057,4067 ----
              $linkurl =~ s/\%a0//g;
              $linkurl =~ s#%([0-9a-f][0-9a-f])#chr(hex('0x' .
      $1))#gei; # Unescape
              $linkurl =~ s/\s+//; # Remove any whitespace
      +       #$linkurl =~ s/(\<\/?[^>]*\>)*//ig; # Remove tags
      +       #$linkurl =~ s/^(\<\/?(br|p|ul)\>)*//ig; # Remove
      leading br, p, ul tags
              $linkurl =~ s/^(https?|ftp):\/\///;
              $linkurl =~ s/\/.*$//; # Only compare up to the first
      '/' (hostname only)
      +       $linkurl =~ s/(\<\/?(br|p|ul)\>)*$//ig; # Remove
      trailing br, p, ul tags
              $linkurl =~ s/\/$//; # LinkURL is trimmed -- note
              #print STDERR "2SquashedText = \"$squashedtext\"\n";
              #print STDERR "2LinkURL     = \"$linkurl\"\n";
      ------------------------ MailScanner list
      ------------------------ To unsubscribe, email
      jiscmail@jiscmail.ac.uk with the words:
      'leave mailscanner' in the body of the email.
      Before posting, read the MAQ
      (http://www.mailscanner.biz/maq/)
      and the archives
      (http://www.jiscmail.ac.uk/lists/mailscanner.html).



--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Douglas.Hall at PROQUEST.CO.UK  Tue Nov  9 16:20:34 2004
From: Douglas.Hall at PROQUEST.CO.UK (Hall, Douglas)
Date: Thu Jan 12 21:27:31 2006
Subject: SURBL not working properly in MailScanner 4.35.9 - A FIX?
Message-ID: <mailman.4494.1137101251.24926.mailscanner@lists.mailscanner.info>

I may be jumping into this a little late, but I also had a problem with
the init.pre file not being found, and therefore the URIBL and SPF rules
not working.

What fixed it for me was to put the init.pre file into
/opt/MailScanner/etc/mail/spamassassin, as this is defined as the
"SpamAssassin Local Rules Dir" in the mailscanner.conf.

A look at the SpamAssassin.pm module indicates (at least to my Perl
illiterate brain) that it checks this directory, if defined, before
/etc/mail/spamassassin, and if it exists, never bothers to check
/etc/mail/spamassassin for init.pre

Anyway, it all works for me now

-Douglas
-- 
Cambridge, UK

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From karnaugh at KARNAUGH.ZA.NET  Tue Nov  9 17:53:16 2004
From: karnaugh at KARNAUGH.ZA.NET (Colin Alston)
Date: Thu Jan 12 21:27:31 2006
Subject: Spamassissin compleatly ballsed - what to do?
Message-ID: <mailman.4495.1137101251.24926.mailscanner@lists.mailscanner.info>

My spamassissin is compleatly stuffed.

I dont really know when or how it happend, possibly someone did a
package upgrade without informing me - these things happens.

Now however I get some very strange behaviour in Mailscanner.

Either this

X-Slipgate-MailScanner: Found to be clean
X-Slipgate-MailScanner-SpamCheck: spam, SpamAssassin (score=9.881,

Why on earth is it marked "Found to be clean" with a SA score that is way over the mark limit?

My High Scoring spam is set to 10.0 and Spam is set to 5.0, this should be marked as spam surely?

Or in the worst case I get this.

X-Slipgate-MailScanner: Found to be clean
X-Slipgate-MailScanner-SpamCheck: not spam, SpamAssassin (timed out)

This system used to work great and I loved it till a few weeks ago! No config changes have been made to MailScanner, what could be causing this?

Thanks

--
Colin Alston <karnaugh@karnaugh.za.net>

About the use of language:
  "It is impossible to sharpen a pencil with a blunt axe.  It is
  equally vain to try to do it with ten blunt axes instead."
   -- E.W.Dijkstra, 18th June 1975. (Perl did not exist at the time.)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Jan-Peter.Koopmann at SECEIDOS.DE  Tue Nov  9 18:09:22 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:31 2006
Subject: Spamassissin compleatly ballsed - what to do?
Message-ID: <mailman.4496.1137101251.24926.mailscanner@lists.mailscanner.info>

> X-Slipgate-MailScanner: Found to be clean
> 
> Why on earth is it marked "Found to be clean" with a SA score
> that is way over the mark limit?
Because "Found to be clean" means --> no viruses. 

> X-Slipgate-MailScanner-SpamCheck: spam, SpamAssassin (score=9.881,

It is detected as spam. Where is the problem?

Regards, 
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From VBoulytchev at COINFOTECH.COM  Tue Nov  9 18:22:33 2004
From: VBoulytchev at COINFOTECH.COM (Vasiliy Boulytchev)
Date: Thu Jan 12 21:27:31 2006
Subject: IRC Support channel
Message-ID: <mailman.4497.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Gents,
        I know many many many people receive great support via IRC channels.  Freenode seems to be one of the best IRC servers for our community.  Already on Freenode there are channels such as #clamav and #spamassassin.  I would think it will not hurt to start a irc channel on Freenode.  I have joined the #mailscanner channel.  Please come in and ask questions/idle.  I think this could definitely be great help for people.  Maybe Julian will post this on mailscanner.info.  Bring your bots.

Thanks,
Vasiliy Boulytchev
Colorado Information Technologies Inc.
http://www.coinfotech.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ugob at CAMO-ROUTE.COM  Tue Nov  9 18:12:15 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:31 2006
Subject: Spamassissin compleatly ballsed - what to do?
Message-ID: <mailman.4498.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Colin Alston wrote:
> My spamassissin is compleatly stuffed.
>
> I dont really know when or how it happend, possibly someone did a
> package upgrade without informing me - these things happens.
>
> Now however I get some very strange behaviour in Mailscanner.
>
> Either this
>
> X-Slipgate-MailScanner: Found to be clean
> X-Slipgate-MailScanner-SpamCheck: spam, SpamAssassin (score=9.881,
>
> Why on earth is it marked "Found to be clean" with a SA score that is
> way over the mark limit?

clean = virus free, so this is correct.

>
> My High Scoring spam is set to 10.0 and Spam is set to 5.0, this should
> be marked as spam surely?

It is, on the SpamCheck line.  ...: spam, SpamAsssassin...

>
> Or in the worst case I get this.
>
> X-Slipgate-MailScanner: Found to be clean
> X-Slipgate-MailScanner-SpamCheck: not spam, SpamAssassin (timed out)
>
> This system used to work great and I loved it till a few weeks ago! No
> config changes have been made to MailScanner, what could be causing this?

You should check the MAQ page (see url in the footer of this message)
for optimizations.

>
> Thanks
>
> --
> Colin Alston <karnaugh@karnaugh.za.net>
>
> About the use of language:
>  "It is impossible to sharpen a pencil with a blunt axe.  It is
>  equally vain to try to do it with ten blunt axes instead."
>   -- E.W.Dijkstra, 18th June 1975. (Perl did not exist at the time.)
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From dnsadmin at 1BIGTHINK.COM  Tue Nov  9 18:39:21 2004
From: dnsadmin at 1BIGTHINK.COM (DNSAdmin)
Date: Thu Jan 12 21:27:31 2006
Subject: Spamassissin compleatly ballsed - what to do?
Message-ID: <mailman.4499.1137101251.24926.mailscanner@lists.mailscanner.info>

At 12:53 PM 11/9/2004, you wrote:

>My spamassissin is compleatly stuffed.
>
>I dont really know when or how it happend, possibly someone did a
>package upgrade without informing me - these things happens.
>
>Now however I get some very strange behaviour in Mailscanner.
>
>Either this
>
>X-Slipgate-MailScanner: Found to be clean
>X-Slipgate-MailScanner-SpamCheck: spam, SpamAssassin (score=9.881,
>
>Why on earth is it marked "Found to be clean" with a SA score that is way
>over the mark limit?
>
>My High Scoring spam is set to 10.0 and Spam is set to 5.0, this should be
>marked as spam surely?
>
>Or in the worst case I get this.
>
>X-Slipgate-MailScanner: Found to be clean
>X-Slipgate-MailScanner-SpamCheck: not spam, SpamAssassin (timed out)
>
>This system used to work great and I loved it till a few weeks ago! No
>config changes have been made to MailScanner, what could be causing this?

Colin,

Is it possible you are overlooking something or expecting to find a problem
that isn't there? It appears you received an email that was "clean" of
virus content and was tagged as spam.

As for the timeout condition at the end of your message, you could be
experiencing heavy traffic during that period and be timing out due to RBL
spam checks?

If you're certain of a problem, you sure have not demonstrated it.

Cheers,
Glenn

--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
http://www.sng.ecs.soton.ac.uk/mailscanner/
Configuration by Glenn Parsons dnsadmin-at-1bigthink.com


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2: "Attached Text" ]


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.788 / Virus Database: 533 - Release Date: 11/1/2004

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From karnaugh at KARNAUGH.ZA.NET  Tue Nov  9 19:12:21 2004
From: karnaugh at KARNAUGH.ZA.NET (Colin Alston)
Date: Thu Jan 12 21:27:31 2006
Subject: Spamassissin compleatly ballsed - what to do?
Message-ID: <mailman.4500.1137101251.24926.mailscanner@lists.mailscanner.info>

Colin Alston wrote:

> My spamassissin is compleatly stuffed.
>
> I dont really know when or how it happend, possibly someone did a
> package upgrade without informing me - these things happens.
>
> X-Slipgate-MailScanner: Found to be clean
> X-Slipgate-MailScanner-SpamCheck: not spam, SpamAssassin (timed out)
>
Seems people got compleatly hung up by a mistake in my message and to be
honest I'm not all that impressed with the attitude I recived. I'll try
to clear things up.

Nothing changed in the load of the machine - infact its gone down quite
significantly (probably since the checking is failing). Even dropped
MailWatch to see if that would help - to no avail.

I am not using RBL's.

As for the MAQ on optimizing SA the only thing that is not accounted for
already (most by Debian defaults) is DCC and I'm rather hesitant on that.

To give an idea on the machine I'll copy the template from the MAQ

*Hardware*: Celeron 1.8 Ghz , 512MB RAM, one 80GB IDE drive
*Software*: Debian SID (2.4.26 Kernel), Postfix, Spamassasin, MailWatch
*RBLs*: none
*Virus Scanners*: ClamAV.
*Volume*: 250 to 500 messages/day (through MailScanner, relayed messages
diverted)
*Average Load: *0 to 1

Things more along the lines of what I was thinking was that Spamassassin
got upgraded because I heve been told that the new versions are "a mess".

--
Colin Alston <karnaugh@karnaugh.za.net>

About the use of language:
  "It is impossible to sharpen a pencil with a blunt axe.  It is
  equally vain to try to do it with ten blunt axes instead."
   -- E.W.Dijkstra, 18th June 1975. (Perl did not exist at the time.)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ugob at CAMO-ROUTE.COM  Tue Nov  9 19:29:05 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:31 2006
Subject: Spamassissin compleatly ballsed - what to do?
Message-ID: <mailman.4501.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Colin Alston wrote:
> Colin Alston wrote:
>
>> My spamassissin is compleatly stuffed.
>>
>> I dont really know when or how it happend, possibly someone did a
>> package upgrade without informing me - these things happens.
>>
>> X-Slipgate-MailScanner: Found to be clean
>> X-Slipgate-MailScanner-SpamCheck: not spam, SpamAssassin (timed out)
>>
> Seems people got compleatly hung up by a mistake in my message and to be
> honest I'm not all that impressed with the attitude I recived. I'll try
> to clear things up.

We can only work with the information you gave us.

>
> Nothing changed in the load of the machine - infact its gone down quite
> significantly (probably since the checking is failing). Even dropped
> MailWatch to see if that would help - to no avail.
>
> I am not using RBL's.
>
> As for the MAQ on optimizing SA the only thing that is not accounted for
> already (most by Debian defaults) is DCC and I'm rather hesitant on that.
>
> To give an idea on the machine I'll copy the template from the MAQ
>
> *Hardware*: Celeron 1.8 Ghz , 512MB RAM, one 80GB IDE drive
> *Software*: Debian SID (2.4.26 Kernel), Postfix, Spamassasin, MailWatch
> *RBLs*: none
> *Virus Scanners*: ClamAV.
> *Volume*: 250 to 500 messages/day (through MailScanner, relayed messages
> diverted)
> *Average Load: *0 to 1
>
> Things more along the lines of what I was thinking was that Spamassassin
> got upgraded because I heve been told that the new versions are "a mess".

Did you disable network tests in Spamassin? (RBLS, DCC, pyzor, razor).
if you didn't, they're enabled by default, so you might get an
occasionnal SpamAssassin timeout.

What is the frequency of your timeout?

You should do the debugging procedure to find out:

- kill MailScanner processes, to leave only your MTA working, let
messages come in.
- Enable debug in MailScanner.conf, enable Spamassassin debug as well
- use the "check_MailScanner" command to start MailSCanner again and
check the output to diagnose.

hth

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ELKNET.NET  Tue Nov  9 19:42:25 2004
From: mailscanner at ELKNET.NET (Alan)
Date: Thu Jan 12 21:27:31 2006
Subject: MS performance as a gateway comments
Message-ID: <mailman.4502.1137101251.24926.mailscanner@lists.mailscanner.info>

On Tue, 9 Nov 2004 08:24:47 +0100, Jan-Peter Koopmann
<Jan-Peter.Koopmann@SECEIDOS.DE> wrote:

>And all some other guys are doing is contributing in that they are say
>they never had these kinds of problems with the other MTAs you
>mentioned.

And I appreciate that. Some of the feedback though led me to think that
perhaps some of you believed I was trying to convince the listmembers to all
switch to zmailer, as it appeared sendmail was being defended. All I was
trying to do was assure everyone that I was not trying to sway anyone
towards zmailer, but that I was simply posting my obeservations. I didn't
want to come across as 'preachy'. :)

I realize that few if anyone else has seen the performance problems that I
have, and perhaps that is because I am running MS/SA in a gateway
environment. The manner in which I run MS/SA increases the MTA load due to
the fact that my server has no local mailboxes; every message that is
accepted must be sent on to another smtp server, so there are double the MTA
transactions; one in and one out.

Drew,
Sorry about not being able to report on postfix. It would indeed have been
nice to have been able to provide a comparison across all MTAs. After I
tried exim, I next went to zmailer for the simple reason that it is
advertised as being focused on high volumn sites.

-Alan

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Kevin_Miller at CI.JUNEAU.AK.US  Tue Nov  9 19:46:07 2004
From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller)
Date: Thu Jan 12 21:27:31 2006
Subject: Spamassissin compleatly ballsed - what to do?
Message-ID: <mailman.4503.1137101251.24926.mailscanner@lists.mailscanner.info>

Colin Alston wrote:
> Colin Alston wrote:
>
>> My spamassissin is compleatly stuffed.
>>
>> I dont really know when or how it happend, possibly someone did a
>> package upgrade without informing me - these things happens.
>>
>> X-Slipgate-MailScanner: Found to be clean
>> X-Slipgate-MailScanner-SpamCheck: not spam, SpamAssassin (timed out)
>>
> Seems people got compleatly hung up by a mistake in my message and to
> be honest I'm not all that impressed with the attitude I recived.
> I'll try to clear things up.

Well, hey, you get what you pay for! ;-)

But I guess most of us are lost as to why you think SA is stuffed.  As noted
the "Found to be clean" line is indicative of viruses, not spam.  The 9.x
score is spam, so SA is doing right.  Unless that was a false positive.
X-Slipgate-MailScanner-SpamCheck: spam, SpamAssassin (score=9.881,
----------------------------------^^^^

SA timeouts have been discussed a lot in this list.  Without more info it's
hard to say what your trouble is but a search through the archives might be
helpful.  Causes range from DNS issues to Bayes, etc. if memory serves.

Sorry not to be more directly helpful; a bit more detail in the symptoms
would be good.

S'later...

...Kevin
--
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Admin., Mail Admin.
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mikes at HARTWELLCORP.COM  Tue Nov  9 19:26:06 2004
From: mikes at HARTWELLCORP.COM (Michael St. Laurent)
Date: Thu Jan 12 21:27:31 2006
Subject: Whines about ClamAV version after upgrade
Message-ID: <mailman.4504.1137101251.24926.mailscanner@lists.mailscanner.info>

Howdy,

I just upgraded ClamAV to version 0.80 and MailScanner to version 4.35.11.
Now I'm seeing messages in the maillog that read: "ClamAV Perl module must
be at least version 0.12 and you only have version 0.08, and ClamAV must be
at least version  0.80"

I take this to mean that I need to upgrade the ClamAV module for Perl.  I'm
trying to do this but the server it's trying to access (carroll.cac.psu.edu)
appears to be restricting the number of connections and I can't get on.  Is
there some way to tell it to use another server for the module source?

--
Michael St. Laurent
Hartwell Corporation

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mikes at HARTWELLCORP.COM  Tue Nov  9 19:44:27 2004
From: mikes at HARTWELLCORP.COM (Michael St. Laurent)
Date: Thu Jan 12 21:27:31 2006
Subject: FW: Whines about ClamAV version after upgrade
Message-ID: <mailman.4505.1137101251.24926.mailscanner@lists.mailscanner.info>

Michael St. Laurent <> wrote:
> Howdy,
>
> I just upgraded ClamAV to version 0.80 and MailScanner to version
> 4.35.11.  Now I'm seeing messages in the maillog that read: "ClamAV
> Perl module must be at least version 0.12 and you only have version
> 0.08, and ClamAV must be at least version  0.80"
>
> I take this to mean that I need to upgrade the ClamAV module for
> Perl.  I'm trying to do this but the server it's trying to access
> (carroll.cac.psu.edu) appears to be restricting the number of
> connections and I can't get on.  Is there some way to tell it to use
> another server for the module source?

Answering my own post here... It finally got through but then it informed me
that the version I already have installed (0.08) is current.  Aparently I
need to do something special to get 0.12 installed?

--
Michael St. Laurent
Hartwell Corporation

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From peter at UCGBOOK.COM  Tue Nov  9 20:06:47 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:31 2006
Subject: 4.35.11: new to DCC, did I do it right?
Message-ID: <mailman.4506.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Jeff A. Earickson wrote:
> where uid 26 is "mailnull" on my system, and installed it.  I opened up
> port
> 6277 udp and tcp in my firewall, just like dns (port 53). I took a look
> thru the various files in the dcc homedir, and made minor changes to
> dcc_conf
> and whiteclnt.  Then I stopped mailscanner, set the correct path to dccproc
> in etc/spam.assassin.prefs.conf.  Restarted MS, and watched the syslog.
> I see "DCC_CHECK 2.17" in syslogging of SpamAssassin information.
>
> Uhhh, is that all there is to using DCC?  Things to look out for?  Gotchas?
> Did I miss something, or is it really that simple?

It's that simple! And even simpler if you didn't care about the
configure options, then MS would have found it by default.
Configure/make/make install works with no changes.

I don't think you need 6277/TCP open, UDP should do it.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From peter at UCGBOOK.COM  Tue Nov  9 20:10:12 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:31 2006
Subject: Whines about ClamAV version after upgrade
Message-ID: <mailman.4507.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Michael St. Laurent wrote:
> I take this to mean that I need to upgrade the ClamAV module for Perl.  I'm
> trying to do this but the server it's trying to access (carroll.cac.psu.edu)
> appears to be restricting the number of connections and I can't get on.  Is
> there some way to tell it to use another server for the module source?

Try this, it's all there:

http://search.cpan.org/~sabeck/

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mikes at HARTWELLCORP.COM  Tue Nov  9 20:37:54 2004
From: mikes at HARTWELLCORP.COM (Michael St. Laurent)
Date: Thu Jan 12 21:27:31 2006
Subject: Whines about ClamAV version after upgrade
Message-ID: <mailman.4508.1137101251.24926.mailscanner@lists.mailscanner.info>

Peter Bonivart <> wrote:
> Michael St. Laurent wrote:
>> I take this to mean that I need to upgrade the ClamAV module for
>> Perl.  I'm trying to do this but the server it's trying to access
>> (carroll.cac.psu.edu) appears to be restricting the number of
>> connections and I can't get on.  Is there some way to tell it to use
>> another server for the module source?
>
> Try this, it's all there:
>
> http://search.cpan.org/~sabeck/

Thanks, that did the trick!  ;-D

--
Michael St. Laurent
Hartwell Corporation

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From karnaugh at KARNAUGH.ZA.NET  Tue Nov  9 20:34:59 2004
From: karnaugh at KARNAUGH.ZA.NET (Colin Alston)
Date: Thu Jan 12 21:27:31 2006
Subject: Spamassissin compleatly ballsed - what to do?
Message-ID: <mailman.4509.1137101251.24926.mailscanner@lists.mailscanner.info>

Kevin Miller wrote:

>Causes range from DNS issues to Bayes, etc. if memory serves.
>
>
Thank you, disabling the RBL's properly seems to have fixed it up.

>Sorry not to be more directly helpful; a bit more detail in the symptoms
>would be good.
>
Hard because I was not sure on the symptoms - it was a problem that
appeared out of no where on a perfectly working system (as I said initialy)

Ugo Bellavance wrote:

> We can only work with the information you gave us.

No problem - but I'm not 16 and this isn't school ;) - Worse questions
have seen better answers on alt.linux.

--
Colin Alston <karnaugh@karnaugh.za.net>

About the use of language:
  "It is impossible to sharpen a pencil with a blunt axe.  It is
  equally vain to try to do it with ten blunt axes instead."
   -- E.W.Dijkstra, 18th June 1975. (Perl did not exist at the time.)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From michele at BLACKNIGHTSOLUTIONS.COM  Tue Nov  9 21:25:47 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:31 2006
Subject: IRC Support channel
Message-ID: <mailman.4510.1137101251.24926.mailscanner@lists.mailscanner.info>

> Gents,
>         I know many many many people receive great support
> via IRC channels.  Freenode seems to be one of the best IRC
> servers for our community.  Already on Freenode there are
> channels such as #clamav and #spamassassin.  I would think it
> will not hurt to start a irc channel on Freenode.  I have
> joined the #mailscanner channel.  Please come in and ask
> questions/idle.  I think this could definitely be great help
> for people.  Maybe Julian will post this on mailscanner.info.  Bring
> your bots.

I'll be putting one of my bnc in there when I get a chance :)

One of the nice things about freenode is that it is ipv6 enabled:

ipv4: irc.freenode.net
ipv6: irc.ipv6.freenode.net



Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
http://www.blacknight.ie/specialoffers.html

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From kte at NEXIS.BE  Tue Nov  9 22:06:29 2004
From: kte at NEXIS.BE (Koen Teugels)
Date: Thu Jan 12 21:27:31 2006
Subject: ProcessClamAVOutput: unrecognised line ... contact the authors
Message-ID: <mailman.4511.1137101251.24926.mailscanner@lists.mailscanner.info>

Virus Scanners = clamav bitdefender
clamav is at version 0.80.1 and bitdefender
BitDefender-Console-Antivirus-7.0.1-3.linux-gcc3x.i586.rpm
Bt they let pass the attachment copfilter-0.0.95.tgz with the eicar test
virus in it with status clean.
I use a  RHEL clone with the latest yum updates.
version MailScanner-4.35.11-1.rpm.tar.gz with spamassassin 3.0.1 and
plugins DCC, razor and ...
Just a standard install no custom rules yet.

Thanks Koen

Julian Field wrote:

> Can you give me more details of this please. What "Virus Scanners ="
> setting do you have. What version of what scanner. What are the
> symptoms, please give a real example.
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Tue Nov  9 22:11:02 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:31 2006
Subject: ProcessClamAVOutput: unrecognised line ... contact the authors
Message-ID: <mailman.4512.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Please upgrade your clamav to the latest CVS version available from
www.clamav.net and try the test again.

Koen Teugels wrote:

> Virus Scanners = clamav bitdefender
> clamav is at version 0.80.1 and bitdefender
> BitDefender-Console-Antivirus-7.0.1-3.linux-gcc3x.i586.rpm
> Bt they let pass the attachment copfilter-0.0.95.tgz with the eicar test
> virus in it with status clean.
> I use a  RHEL clone with the latest yum updates.
> version MailScanner-4.35.11-1.rpm.tar.gz with spamassassin 3.0.1 and
> plugins DCC, razor and ...
> Just a standard install no custom rules yet.
>
> Thanks Koen
>
> Julian Field wrote:
>
>> Can you give me more details of this please. What "Virus Scanners ="
>> setting do you have. What version of what scanner. What are the
>> symptoms, please give a real example.
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mkettler at EVI-INC.COM  Tue Nov  9 22:37:30 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:31 2006
Subject: Spamassissin compleatly ballsed - what to do?
Message-ID: <mailman.4513.1137101251.24926.mailscanner@lists.mailscanner.info>

At 12:53 PM 11/9/2004, Colin Alston wrote:
>My spamassissin is compleatly stuffed.
>
>I dont really know when or how it happend, possibly someone did a
>package upgrade without informing me - these things happens.
>
>Now however I get some very strange behaviour in Mailscanner.
>
>Either this
>
>X-Slipgate-MailScanner: Found to be clean
>X-Slipgate-MailScanner-SpamCheck: spam, SpamAssassin (score=9.881,
>
>Why on earth is it marked "Found to be clean" with a SA score that is way
>over the mark limit?


because "Found to be clean" only means it has passed your virus tests, and
has nothing to do with the SpamAssassin.

Did you ever have all your spam declared as something other than "Found to
be clean"?

I've never seen MailScanner do that unless the message was infected AND
detected as spam.

>My High Scoring spam is set to 10.0 and Spam is set to 5.0, this should be
>marked as spam surely?

Yes, it should, and it is marked as spam.

"Found to be clean" has nothing to do with this. What's the nature of your
real problem?

The marking for spam is  "X-Slipgate-MailScanner-SpamCheck: spam," and any
subject tags you have. X-Slipgate-MailScanner: is not a spam indicating header.

>Or in the worst case I get this.
>
>X-Slipgate-MailScanner: Found to be clean
>X-Slipgate-MailScanner-SpamCheck: not spam, SpamAssassin (timed out)
>
>This system used to work great and I loved it till a few weeks ago! No
>config changes have been made to MailScanner, what could be causing this?

Timeouts are probably due to bayes automatic expiry.

  Check the archives for my posts on this, you'll want to set
"bayes_auto_expire 0" in your /etc/mail/spamassassin/local.cf and tell
MailScanner.conf to "Rebuild Bayes Every=86400". You might also want a
daily cron to run sa-learn --sync (SA 3.x) or sa-learn --force-expire (SA
2.x) as a safety net for expiry to run.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mikes at HARTWELLCORP.COM  Tue Nov  9 22:50:40 2004
From: mikes at HARTWELLCORP.COM (Michael St. Laurent)
Date: Thu Jan 12 21:27:31 2006
Subject: Phishing attack test?
Message-ID: <mailman.4514.1137101251.24926.mailscanner@lists.mailscanner.info>

Is there a site that will send a test phishing attack email?

--
Michael St. Laurent
Hartwell Corporation

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From rzewnickie at RFA.ORG  Tue Nov  9 22:58:09 2004
From: rzewnickie at RFA.ORG (Eric Dantan Rzewnicki)
Date: Thu Jan 12 21:27:31 2006
Subject: quoted print?
Message-ID: <mailman.4515.1137101251.24926.mailscanner@lists.mailscanner.info>

On Tue, Nov 09, 2004 at 10:09:10AM -0300, Leonardo Helman wrote:
> Probably you want something like:
>
> #!/bin/sh
>
> (echo This is a script
>
> exec 2>&1
>
> echo This is line 1
> ls
> ypmatch wibble ecsinfo # This will produce stderr output
> echo This is the end.
> ) | tee file.log
>
>
> No spaces between first parenthesys and next char.

This executes the contents of the () in a subshell, correct?

from man bash:
   (list) list is executed in a subshell. Variable assignments and
          builtin commands that affect the shell's environment do not
          remain in effect after the command completes. The return
          status is the exit status of list.

So everything but the pipe to tee goes inside the ()? I'm not trying to
be pedantic here, just hoping to clarify my own understanding.

Thanks,
Eric Rz.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From dfilchak at sympatico.ca  Tue Nov  9 23:12:04 2004
From: dfilchak at sympatico.ca (Dave Filchak)
Date: Thu Jan 12 21:27:31 2006
Subject: Need Help Please
Message-ID: <mailman.4516.1137101251.24926.mailscanner@lists.mailscanner.info>

This is the second time I have put this question to the list. I don't want
to annoy everyone so I won't ask this again but I really could use some
input here. And, I know that most people do not like the vacation program
for obvious reasons but I need to implement this for a good client who is
away in Europe and for whatever reason I can no longer get vacation to work.
It was working but it seems to have stopped working since that last time I
used it. So, my question for anyone willing to pipe up with some input: does
the vacation program work with MailScanner | ClamAV | SpamAssassin? I see no
errors in my logs and mail is delivered to the mailbox but no auto response
is sent, at least as far as I can tell. Someone? Please ...

Dave

I run:
This is Red Hat Linux release 9 (Shrike)
This is Perl version 5.008000 (5.8.0)

This is MailScanner version 4.35.8
Module versions are:
1.00    AnyDBM_File
1.14    Archive::Zip
1.01    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.04    Fcntl
2.71    File::Basename
2.05    File::Copy
2.01    FileHandle
1.05    File::Path
0.13    File::Temp
1.23    HTML::Entities
3.26    HTML::Parser
2.24    HTML::TokeParser
1.20    IO
1.09    IO::File
1.122   IO::Pipe
3.05    MIME::Base64
5.415   MIME::Decoder
5.415   MIME::Decoder::UU
5.415   MIME::Head
5.415   MIME::Parser
3.03    MIME::QuotedPrint
5.415   MIME::Tools
0.09    Net::CIDR
1.05    POSIX
1.75    Socket
0.03    Sys::Syslog
1.02    Time::localtime

Optional module versions are:
1.806   DB_File
1.00    Digest
1.01    Digest::HMAC
2.20    Digest::MD5
2.01    Digest::SHA1
0.44    Inline
0.13    Mail::ClamAV
3.000000        Mail::SpamAssassin
missing Mail::SPF::Query
missing Net::CIDR::Lite
0.31    Net::DNS
missing Net::LDAP
1.94    Parse::RecDescent
missing SAVI
missing Sys::Hostname::Long
2.26    Test::Harness
0.47    Test::Simple
1.89    Text::Balanced
1.21    URI

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From peter at UCGBOOK.COM  Tue Nov  9 23:12:08 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:31 2006
Subject: Spamassissin compleatly ballsed - what to do?
Message-ID: <mailman.4517.1137101251.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Matt Kettler wrote:
>  Check the archives for my posts on this, you'll want to set
> "bayes_auto_expire 0" in your /etc/mail/spamassassin/local.cf and tell
> MailScanner.conf to "Rebuild Bayes Every=86400". You might also want a
> daily cron to run sa-learn --sync (SA 3.x) or sa-learn --force-expire (SA
> 2.x) as a safety net for expiry to run.

It's still --force-expire but --rebuild has been replaced by --sync and
as before it's included in the --force-expire.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Steve.Swaney at FSL.COM  Tue Nov  9 23:10:37 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:32 2006
Subject: Phishing attack test?
Message-ID: <mailman.4518.1137101252.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Michael St. Laurent
> Sent: Tuesday, November 09, 2004 5:51 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Phishing attack test?
>
> Is there a site that will send a test phishing attack email?
>
> --

Just wait a minute or two and watch you logs. I'm getting hundreds a day :(

But we're stopping or disarming them thanks to Julian and ClamAV :)

Steve

Steve Swaney
President
www.fsl.com
Fortress Systems Ltd.
steve.swaney@fsl.com




--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From michele at BLACKNIGHTSOLUTIONS.COM  Tue Nov  9 23:15:41 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:32 2006
Subject: Need Help Please
Message-ID: <mailman.4519.1137101252.24926.mailscanner@lists.mailscanner.info>

> This is the second time I have put this question to the list.
> I don't want to annoy everyone so I won't ask this again but
> I really could use some input here. And, I know that most
> people do not like the vacation program for obvious reasons
> but I need to implement this for a good client who is away in
> Europe and for whatever reason I can no longer get vacation to work.
> It was working but it seems to have stopped working since
> that last time I used it. So, my question for anyone willing
> to pipe up with some input: does the vacation program work
> with MailScanner | ClamAV | SpamAssassin? I see no errors in
> my logs and mail is delivered to the mailbox but no auto
> response is sent, at least as far as I can tell. Someone? Please ...
>

I don't understand your question. What are you having issues with exactly?

Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
http://www.blacknight.ie/specialoffers.html

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Steve.Swaney at FSL.COM  Tue Nov  9 23:16:59 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:32 2006
Subject: Need Help Please
Message-ID: <mailman.4520.1137101252.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Dave Filchak
> Sent: Tuesday, November 09, 2004 6:12 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Need Help Please
>
> This is the second time I have put this question to the list. I don't want
> to annoy everyone so I won't ask this again but I really could use some
> input here. And, I know that most people do not like the vacation program
> for obvious reasons but I need to implement this for a good client who is
> away in Europe and for whatever reason I can no longer get vacation to
> work.
> It was working but it seems to have stopped working since that last time I
> used it. So, my question for anyone willing to pipe up with some input:
> does
> the vacation program work with MailScanner | ClamAV | SpamAssassin? I see
> no
> errors in my logs and mail is delivered to the mailbox but no auto
> response
> is sent, at least as far as I can tell. Someone? Please ...
>
> Dave

MailScanner should not affect how the vacation program deals with email. It
simply delivers the mail. Look at

http://www.akadia.com/services/automatic_email_answering.html

and google for vacation problems.

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mikes at HARTWELLCORP.COM  Tue Nov  9 23:26:10 2004
From: mikes at HARTWELLCORP.COM (Michael St. Laurent)
Date: Thu Jan 12 21:27:32 2006
Subject: Phishing attack test?
Message-ID: <mailman.4521.1137101252.24926.mailscanner@lists.mailscanner.info>

Steve Swaney <> wrote:
>> Is there a site that will send a test phishing attack email?
>
> Just wait a minute or two and watch you logs. I'm getting hundreds a
> day :(

<grin>  We have lower mail volume than you I think.

--
Michael St. Laurent
Hartwell Corporation

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From michele at BLACKNIGHTSOLUTIONS.COM  Tue Nov  9 23:26:00 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:32 2006
Subject: Phishing attack test?
Message-ID: <mailman.4522.1137101252.24926.mailscanner@lists.mailscanner.info>

> Steve Swaney <> wrote:>>> Is there a site that will send a test phishing
attack email?
>>
>> Just wait a minute or two and watch you logs. I'm getting hundreds a
>> day :(
>
> <grin>  We have lower mail volume than you I think.
>
You can have some of ours :)

/me changes MX records for somespammeddomain.com



Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
http://www.blacknight.ie/specialoffers.html

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Jeff.Mills at POCOLD.COM.AU  Tue Nov  9 23:30:34 2004
From: Jeff.Mills at POCOLD.COM.AU (Jeff Mills)
Date: Thu Jan 12 21:27:32 2006
Subject: Phishing attack test?
Message-ID: <mailman.4523.1137101252.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Heres an example that doent seem to be being picked up by my MailScanner (4.35.5).




> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> Behalf Of Michele Neylon :: Blacknight Solutions
> Sent: Wednesday, 10 November 2004 10:26 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Phishing attack test?
> 
> 
> > Steve Swaney <> wrote:>>> Is there a site that will send a 
> test phishing
> attack email?
> >>
> >> Just wait a minute or two and watch you logs. I'm getting 
> hundreds a
> >> day :(
> >
> > <grin>  We have lower mail volume than you I think.
> >
> You can have some of ours :)
> 
> /me changes MX records for somespammeddomain.com
> 
> 
> 
> Mr Michele Neylon
> Blacknight Internet Solutions Ltd
> Hosting, co-location & domains
> http://www.blacknight.ie/
> Tel. +353 59 9137101
> http://www.blacknight.ie/specialoffers.html
> 
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2: "Included Message" ]

Date: Tue, 9 Nov 2004 15:32:55 +1100
From: Mike Grimes <Mike.Grimes@pocold.com.au>
To: Jeff Mills <Jeff.Mills@pocold.com.au>
Subject: FW: Confirmation

    [ The following text is in the "iso-8859-2" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

He is now becoming a pain in the ****
-----Original Message-----
From: exchange-robot@paypal.com [mailto:exchange-robot@paypal.com]
Sent: Tuesday, 9 November 2004 3:29 PM
To: Mike Grimes
Subject: Confirmation



Congratulations! PayPal has successfully charged $175 to your credit card. Your order tracking number is A866DEC0, and your item will be shipped within three business days. 

To see details please click this  <http://169.254.68.227:1639/index.htm> link. 

DO NOT REPLY TO THIS MESSAGE VIA EMAIL! This email is being sent by an automated message system and the reply will not be received. 

Thank you for using PayPal.


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From raymond at PROLOCATION.NET  Tue Nov  9 23:35:46 2004
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:27:32 2006
Subject: Phishing attack test?
Message-ID: <mailman.4524.1137101252.24926.mailscanner@lists.mailscanner.info>

Hi!

> Just wait a minute or two and watch you logs. I'm getting hundreds a day :(
>
> But we're stopping or disarming them thanks to Julian and ClamAV :)

Most of the ones we bust are due to SURBL listings .. ;)

Bye,
Raymond.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From rcooper at DWFORD.COM  Tue Nov  9 23:44:50 2004
From: rcooper at DWFORD.COM (Rick Cooper)
Date: Thu Jan 12 21:27:32 2006
Subject: unrar 3.40 with mailscanner - ProcessClamAVOutput:
    unrecognised l ine
Message-ID: <mailman.4525.1137101252.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> Behalf Of Schneck Dennis ITS1 SDE
> Sent: Tuesday, November 09, 2004 10:12 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: unrar 3.40 with mailscanner - ProcessClamAVOutput: unrecognised
> l ine
>
>
> hello
>
>
<snip>
>
> Nov  9 13:58:19 elwmrs MailScanner[28308]: UNRAR 3.40 beta 4 freeware
> Copyright (c) 1993-2004 Alexander Roshal
> Nov  9 13:58:19 elwmrs MailScanner[28308]: ProcessClamAVOutput:
> unrecognised
> line "UNRAR 3.40 beta 4 freeware      Copyright (c) 1993-2004 Alexander
> Roshal". Please contact the authors!
> Nov  9 16:08:12 elwmrs MailScanner[1813]: UNRAR 3.40 beta 4 freeware
> Copyright (c) 1993-2004 Alexander Roshal
> Nov  9 16:08:12 elwmrs MailScanner[1813]: ProcessClamAVOutput:
> unrecognised
> line "UNRAR 3.40 beta 4 freeware      Copyright (c) 1993-2004 Alexander
> Roshal". P
>
>
>
>
> what did i wrong !
>

Nothing. No harm clamavmodule just doesn't recognize the output from the
exteranl RAR program, shouldn't hurt anything at all.

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From alden at engineno9inc.com  Wed Nov 10 01:29:49 2004
From: alden at engineno9inc.com (Alden Levy)
Date: Thu Jan 12 21:27:32 2006
Subject: SURBL not working properly in MailScanner 4.35.9 - A FIX?
Message-ID: <mailman.4526.1137101252.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> Hall, Douglas wrote:
>> I may be jumping into this a little late, but I also had a problem with
>> the init.pre file not being found, and therefore the URIBL and SPF rules
>> not working.
>>
>> What fixed it for me was to put the init.pre file into
>> /opt/MailScanner/etc/mail/spamassassin, as this is defined as the
>> "SpamAssassin Local Rules Dir" in the mailscanner.conf.
>>
>> A look at the SpamAssassin.pm module indicates (at least to my Perl
>> illiterate brain) that it checks this directory, if defined, before
>> /etc/mail/spamassassin, and if it exists, never bothers to check
>> /etc/mail/spamassassin for init.pre
>>
>> Anyway, it all works for me now
>>
>> -Douglas

Doshy, Dhawal wrote:
> By Toutatis, you are right..
>
> cd /usr/share/spamassassin/
> ln -s /etc/mail/spamassassin/init.pre .
> service MailScanner restart
>
> it works for me too..
>
> - dhawal
>
Brilliant!  Thank you!!!!! It solved my problem, as well.  Thanks for the
step by step, Dhawal.

--Alden

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From dfilchak at sympatico.ca  Wed Nov 10 05:04:31 2004
From: dfilchak at sympatico.ca (Dave Filchak)
Date: Thu Jan 12 21:27:32 2006
Subject: Need Help Please
Message-ID: <mailman.4527.1137101252.24926.mailscanner@lists.mailscanner.info>

My question really was whether or not MailScanner might be stopping the auto
response from being sent to the original sender from the vacation program.
Or maybe not MailScanner but perhaps ClamAV. Vacation is not complicated to
set up and it was working fine. However, I have upgraded MailScanner and
associated programs a number of times over the last little while and now I
cannot seem to get the program to send out an auto response so I thought
there was a possibility of trouble with Clam or something. However, there is
no indication in the logs as to what might be happening so I was wondering
if anyone experienced issues with vacation and the MailScanner suite of
programs. I am just fishing here trying to figure out what the hell is going
on.

Thanks for the response

Dave

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Michele Neylon :: Blacknight Solutions
Sent: Tuesday, November 09, 2004 6:16 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: [MAILSCANNER] Need Help Please

> This is the second time I have put this question to the list.
> I don't want to annoy everyone so I won't ask this again but I really
> could use some input here. And, I know that most people do not like
> the vacation program for obvious reasons but I need to implement this
> for a good client who is away in Europe and for whatever reason I can
> no longer get vacation to work.
> It was working but it seems to have stopped working since that last
> time I used it. So, my question for anyone willing to pipe up with
> some input: does the vacation program work with MailScanner | ClamAV |
> SpamAssassin? I see no errors in my logs and mail is delivered to the
> mailbox but no auto response is sent, at least as far as I can tell.
> Someone? Please ...
>

I don't understand your question. What are you having issues with exactly?

Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
http://www.blacknight.ie/specialoffers.html

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From BBerglund at TECHPRO.COM  Wed Nov 10 05:12:47 2004
From: BBerglund at TECHPRO.COM (Brian Berglund)
Date: Thu Jan 12 21:27:32 2006
Subject: Newbie help please
Message-ID: <mailman.4528.1137101252.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

If anyone out there can help.
I am having issues with MailWatch/MailScanner.
 
I am attaching the configs in a zip file.
 
I am getting some messages logged and some that are not to the
mailscanner database.
 
Also, some messages are not being delivered at all or even in the maillog
file.
 
Can you look over my configs and let me know.
 
System:
Fedora Core 2
Mysql - latest 4.1
PHP
Apache
Postfix
Mailscanner
MailWatch
ClamAV
 
--- Tid bits:
 
When mail comes in, it is checked against a mysql database for user
verification, then it is checked against a relay domain table that will
allow or not allow that domain to relay through.
Then it should be scanned by Mailscanner, logged to Mailwatch, then
checked against the database to see where it should be delivered to. 
Another internal box or an external exchange server.
 
 
Any help would be greatly appreciated.
 
Thanks,
Brian
 
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, "MailScanner.zip"  Application/X-ZIP-COMPRESSED  75KB. ]
    [ Unable to print this part. ]


From mike at CAMAROSS.NET  Wed Nov 10 05:18:32 2004
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:27:32 2006
Subject: Newbie help please
Message-ID: <mailman.4529.1137101252.24926.mailscanner@lists.mailscanner.info>

________________________________

From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Brian Berglund
Sent: Tuesday, November 09, 2004 11:13 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Newbie help please


If anyone out there can help.
I am having issues with MailWatch/MailScanner.

I am attaching the configs in a zip file.

I am getting some messages logged and some that are not to the mailscanner
database.

Also, some messages are not being delivered at all or even in the maillog
file.

Can you look over my configs and let me know.

System:
Fedora Core 2
Mysql - latest 4.1
PHP
Apache
Postfix
Mailscanner
MailWatch
ClamAV

--- Tid bits:

When mail comes in, it is checked against a mysql database for user
verification, then it is checked against a relay domain table that will
allow or not allow that domain to relay through.
Then it should be scanned by Mailscanner, logged to Mailwatch, then checked
against the database to see where it should be delivered to.  Another
internal box or an external exchange server.


Any help would be greatly appreciated.




Relevant log entries might be helpful.

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Jan-Peter.Koopmann at SECEIDOS.DE  Wed Nov 10 07:13:15 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:32 2006
Subject: Spamassissin compleatly ballsed - what to do?
Message-ID: <mailman.4530.1137101252.24926.mailscanner@lists.mailscanner.info>

On Tuesday, November 09, 2004 8:12 PM Colin Alston wrote: 

> Seems people got compleatly hung up by a mistake in my message and to
> be honest I'm not all that impressed with the attitude I recived.

Excuse me? I surely must have missed something here... After re-reading
your message I still do not see how/why we could have reacted in a
different way. All you said was:

- Your SpamAssassin is stuffed --> This could mean it is not working,
the bayes database is stuffed with "wrong" tokens, timeouts,
false-positives, false-negatives and so on. Not very clear

- You are seeing "X-Slipgate-MailScanner: Found to be clean" and
woundering why it says so since the message is spam --> "Found to be
clean" only refers to viruses not spam

- Your low score is set to 5 and high score set to 15 and the message is
not detected as spam --> It was with a score of 9 and tagged as spam

- Worst case: You are getting SpamAssassin timeouts

We pointed exactly this out not knowing your pain is somewhere else and
now you are "unimpressed" with the attitude? Frankly: What attitude did
you expect? Mindreading? :-) This mailing-list has a very high attitude
when it comes to helping others. Agreed: Some of us - including myself -
are annoyed by people asking the same questions over and over again
without even bothering looking through the archives, FAQ, MAQ. But this
was not the case here so I fail to see why you are complaining (if you
are).

> I'll try to clear things up.  

Thanks.

> I am not using RBL's.

Are you sure? Because in a later message you say:

> Thank you, disabling the RBL's properly seems to have fixed it up.

> As for the MAQ on optimizing SA the only thing that is not accounted
> for already (most by Debian defaults) is DCC and I'm rather hesitant
> on that.  

Why?

> To give an idea on the machine I'll copy the template from the MAQ
> 
> *Hardware*: Celeron 1.8 Ghz , 512MB RAM, one 80GB IDE drive
> *Software*: Debian SID (2.4.26 Kernel), Postfix, Spamassasin,
> MailWatch 
> *RBLs*: none
> *Virus Scanners*: ClamAV.
> *Volume*: 250 to 500 messages/day (through MailScanner, relayed
> messages 
> diverted)
> *Average Load: *0 to 1

This machine should be very sufficient for your load. Moreover if the
load is down then the size of the box probably is not the problem. My
guess would have been DNS problems as well. Are you running your own dns
cache?

> No problem - but I'm not 16 and this isn't school ;) - 

And no one would suggest. Personally I saw a question that led me to
believe your system is actually working more or less as expected but you
were simply misinterpreting its results. Not knowing of any other
problems and not having any more information (as to that there is a
problem at all), I - and others - did not try to help you more. 

> Worse questions have seen better answers on alt.linux.

Well then: Those guys are mindreaders. Good for them.

Do not misunderstand me: I am not trying to rant at you at all. I just
want to understand, why you were "not impressed" which means
"disappointed" I suppose. People here really do try to help especially
the ones that answered your question. 

Regards,
 JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From dhawal at NETMAGICSOLUTIONS.COM  Wed Nov 10 08:04:30 2004
From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy)
Date: Thu Jan 12 21:27:32 2006
Subject: Newbie help please
Message-ID: <mailman.4531.1137101252.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Brian Berglund wrote:
> If anyone out there can help.
> I am having issues with MailWatch/MailScanner.
>
brian,

multi / cross posting is not going to help you much, what I suggest is
that you take one part at a time and see if it working as per your
satisfaction..

take postfix see if you are able to accept mails and relay them to the
right place using the transport mechanism.

now add the mysql part to postfix and see if postfix can read your
recipients table and continue to accept / deliver mails properly.

now add the others (spamassassin, razor, pyzor, dcc, clamav etc..) and
check if spamassassin recognizes every other component (except clamav).

now install mailscanner, integrate it with postfix and check again if
mailscanner can read your spamassassin prefs and detect clamav.

Finally add mailwatch to complete your setup..

if at any point you face problems most of us will suggest you read the
maqs / faqs and search the mailing lists first before you post here.. in
the event you need to post here, follow the instructions from here..
http://www.mailscanner.biz/maq/#rulespost

most important check your logs (all maillog, apache, OS messages and
mysql), you'll be amazed at your own troubleshooting skils if you can
read the logs properly (and maybe help other newbies).

- dhawal

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From kte at NEXIS.BE  Wed Nov 10 09:32:20 2004
From: kte at NEXIS.BE (Koen Teugels)
Date: Thu Jan 12 21:27:32 2006
Subject: ProcessClamAVOutput: unrecognised line ... contact the authors
Message-ID: <mailman.4532.1137101252.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Why does the bitdefender doesn't find the virus?

Julian Field wrote:

> Please upgrade your clamav to the latest CVS version available from
> www.clamav.net and try the test again.
>
> Koen Teugels wrote:
>
>> Virus Scanners = clamav bitdefender
>> clamav is at version 0.80.1 and bitdefender
>> BitDefender-Console-Antivirus-7.0.1-3.linux-gcc3x.i586.rpm
>> Bt they let pass the attachment copfilter-0.0.95.tgz with the eicar test
>> virus in it with status clean.
>> I use a  RHEL clone with the latest yum updates.
>> version MailScanner-4.35.11-1.rpm.tar.gz with spamassassin 3.0.1 and
>> plugins DCC, razor and ...
>> Just a standard install no custom rules yet.
>>
>> Thanks Koen
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Wed Nov 10 09:40:34 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:32 2006
Subject: Phishing attack test?
Message-ID: <mailman.4533.1137101252.24926.mailscanner@lists.mailscanner.info>

That's because it isn't trying to hide the URL at all. Numeric IP addresses
in links should get caught by SpamAssassin, I think/hope.


On 9/11/04 11:30 pm, "Jeff Mills" <Jeff.Mills@POCOLD.COM.AU> wrote:

> Heres an example that doent seem to be being picked up by my MailScanner
> (4.35.5).
>
>
>
>
>> -----Original Message-----
>> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
>> Behalf Of Michele Neylon :: Blacknight Solutions
>> Sent: Wednesday, 10 November 2004 10:26 AM
>> To: MAILSCANNER@JISCMAIL.AC.UK
>> Subject: Re: Phishing attack test?
>>
>>
>>> Steve Swaney <> wrote:>>> Is there a site that will send a
>> test phishing
>> attack email?
>>>>
>>>> Just wait a minute or two and watch you logs. I'm getting
>> hundreds a
>>>> day :(
>>>
>>> <grin>  We have lower mail volume than you I think.
>>>
>> You can have some of ours :)
>>
>> /me changes MX records for somespammeddomain.com
>>
>>
>>
>> Mr Michele Neylon
>> Blacknight Internet Solutions Ltd
>> Hosting, co-location & domains
>> http://www.blacknight.ie/
>> Tel. +353 59 9137101
>> http://www.blacknight.ie/specialoffers.html
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From kte at NEXIS.BE  Wed Nov 10 09:42:04 2004
From: kte at NEXIS.BE (Koen Teugels)
Date: Thu Jan 12 21:27:32 2006
Subject: {Scanned} Re: ProcessClamAVOutput: unrecognised line ... contact
    the authors
Message-ID: <mailman.4534.1137101252.24926.mailscanner@lists.mailscanner.info>

Yust updated clamav to the latest CVS didn't change a thing.

Julian Field wrote:

> Please upgrade your clamav to the latest CVS version available from
> www.clamav.net and try the test again.
>
> Koen Teugels wrote:
>
>> Virus Scanners = clamav bitdefender
>> clamav is at version 0.80.1 and bitdefender
>> BitDefender-Console-Antivirus-7.0.1-3.linux-gcc3x.i586.rpm
>> Bt they let pass the attachment copfilter-0.0.95.tgz with the eicar test
>> virus in it with status clean.
>> I use a  RHEL clone with the latest yum updates.
>> version MailScanner-4.35.11-1.rpm.tar.gz with spamassassin 3.0.1 and
>> plugins DCC, razor and ...
>> Just a standard install no custom rules yet.
>>
>> Thanks Koen
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at LISTS.COM.AR  Wed Nov 10 11:41:36 2004
From: mailscanner at LISTS.COM.AR (Leonardo Helman)
Date: Thu Jan 12 21:27:32 2006
Subject: quoted print?
Message-ID: <mailman.4535.1137101252.24926.mailscanner@lists.mailscanner.info>

On Tue, Nov 09, 2004 at 05:57:47PM -0500, Eric Dantan Rzewnicki wrote:
> On Tue, Nov 09, 2004 at 10:09:10AM -0300, Leonardo Helman wrote:
> > Probably you want something like:
> >
> > #!/bin/sh
> >
> > (echo This is a script
> >
> > exec 2>&1
> >
> > echo This is line 1
> > ls
> > ypmatch wibble ecsinfo # This will produce stderr output
> > echo This is the end.
> > ) | tee file.log
> >
> >
> > No spaces between first parenthesys and next char.
>
> This executes the contents of the () in a subshell, correct?
yes
nice feature to group commands

>
> from man bash:
>    (list) list is executed in a subshell. Variable assignments and
>           builtin commands that affect the shell's environment do not
>           remain in effect after the command completes. The return
>           status is the exit status of list.
>
> So everything but the pipe to tee goes inside the ()? I'm not trying to
> be pedantic here, just hoping to clarify my own understanding.
all but | inside (), you could do "(xx) 2>&1 | tee also"


>
> Thanks,
> Eric Rz.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From joakim at CEFALK.COM  Wed Nov 10 13:18:51 2004
From: joakim at CEFALK.COM (Joakim Cefalk)
Date: Thu Jan 12 21:27:32 2006
Subject: Make ruleset
Message-ID: <mailman.4536.1137101252.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I'm trying to write my own ruleset for SA.

This ruleset are setting points if there are any swedish signs but i 
want it too set points if there are not any swedish signs becuse 99% of 
my emails are swedish (execpt this list..).

body SWEDISH_SIGN                  /\b(?:ĺ|ä|ö)/i

Any ideas?

Joakim

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Kevin.Spicer at BMRB.CO.UK  Wed Nov 10 13:26:24 2004
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin (MBLEA it))
Date: Thu Jan 12 21:27:32 2006
Subject: Make ruleset
Message-ID: <mailman.4537.1137101252.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

From: Joakim Cefalk [mailto:joakim@CEFALK.COM] 

>I'm trying to write my own ruleset for SA.

>This ruleset are setting points if there are any swedish signs but i want it too set 
>points if there are not any swedish signs becuse 99% of my emails are swedish (execpt
>this list..).

>body SWEDISH_SIGN                  /\b(?:ĺ|ä|ö)/i

>Any ideas?

Instead of matching emails _not_ containing swedish signs just assign a negative score to SWEDISH_SIGN

I do a similar thing myself, I added SA rules matching the names of our 'products' with negative scores - so that any email mentioning our products is less likely to be marked as spam.



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ugob at CAMO-ROUTE.COM  Wed Nov 10 14:24:43 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:32 2006
Subject: Need Help Please
Message-ID: <mailman.4538.1137101252.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Dave Filchak wrote:
> My question really was whether or not MailScanner might be stopping the auto
> response from being sent to the original sender from the vacation program.
> Or maybe not MailScanner but perhaps ClamAV. Vacation is not complicated to
> set up and it was working fine. However, I have upgraded MailScanner and
> associated programs a number of times over the last little while and now I
> cannot seem to get the program to send out an auto response so I thought
> there was a possibility of trouble with Clam or something. However, there is
> no indication in the logs as to what might be happening so I was wondering
> if anyone experienced issues with vacation and the MailScanner suite of
> programs. I am just fishing here trying to figure out what the hell is going
> on.

What you can do is make a ruleset that bypasses Spam tests for messages
coming from the server, 127.0.0.1.  You could whitelist it instead.

As long as auto-replies don't contain attachments or HTML it shouldn't
be caught the security checks of MailScanner.

Hope this answers your question, but for sure you should test it before
putting it in production, like anything.

Ugo

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From alex at nkpanama.com  Wed Nov 10 15:16:54 2004
From: alex at nkpanama.com (Alex Neuman van der Hans)
Date: Thu Jan 12 21:27:32 2006
Subject: Need Help Please
Message-ID: <mailman.4539.1137101252.24926.mailscanner@lists.mailscanner.info>

You might also want to check things that you usually take for granted, like
file permissions, the fact that the vacation program has to have a link to
it in /etc/smrsh if you're using sendmail, that vacation is ./configure'd
with the proper uid/gid, etc. - you'd be surprised how much those little
details (which are mentioned in the vacation manual) matter.

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Ugo Bellavance
Sent: Wednesday, November 10, 2004 9:25 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Need Help Please

Dave Filchak wrote:
> My question really was whether or not MailScanner might be stopping
> the auto response from being sent to the original sender from the vacation
program.
> Or maybe not MailScanner but perhaps ClamAV. Vacation is not
> complicated to set up and it was working fine. However, I have
> upgraded MailScanner and associated programs a number of times over
> the last little while and now I cannot seem to get the program to send
> out an auto response so I thought there was a possibility of trouble
> with Clam or something. However, there is no indication in the logs as
> to what might be happening so I was wondering if anyone experienced
> issues with vacation and the MailScanner suite of programs. I am just
> fishing here trying to figure out what the hell is going on.

What you can do is make a ruleset that bypasses Spam tests for messages
coming from the server, 127.0.0.1.  You could whitelist it instead.

As long as auto-replies don't contain attachments or HTML it shouldn't be
caught the security checks of MailScanner.

Hope this answers your question, but for sure you should test it before
putting it in production, like anything.

Ugo

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From chris at TRUDEAU.ORG  Wed Nov 10 15:32:05 2004
From: chris at TRUDEAU.ORG (Chris Trudeau)
Date: Thu Jan 12 21:27:32 2006
Subject: Bofra-32-Sophos getting through
Message-ID: <mailman.4540.1137101252.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hello list,
 
I am concerned that several of the Bofra bugs have gotten through my
mailscanner/sophossavi implementation.
 
Sophos has released and I have confirmed Bofra IDE files in the libs for
Sophos, but they continue to get through.
 
Any ideas?
 
Temprorarily I have jacked up the SPAM score for the
"SARE_FORGED_PAYPAL_C" check which is catching those and causing them to
be held as SPAM, but I'm not sure why these messages are getting through.
 
Any help is appreciated.
 
CT
 
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From llasad1 at YAHOO.COM  Wed Nov 10 15:47:01 2004
From: llasad1 at YAHOO.COM (lester lasad)
Date: Thu Jan 12 21:27:32 2006
Subject: off topic:  email forwarding assistance/guidance needed
Message-ID: <mailman.4541.1137101252.24926.mailscanner@lists.mailscanner.info>

My MailScanner/Sendmail server is relaying email to 2
seperate domains.  A majority of my users (3000) have
email accounts in the "abc.com" domain, but we have
roughly 40 users that have an account in both the
abc.com and xyz.com domains.

The 40 isers in the abc.com and xyz.com domain use
both addresses at this point but, I would like to
deliver emails for both addresses to one domain.
example:  if lester@xyz.com receives an email I would
like sendmail to route the email to lester@abc.com
(instead of the xyz.com address).  The xyz.com domain
will be obsolete in the future but I can't get rid of
it yet but I would like to eliminate the xyz.com host
that sendmail is relaying to.

Hopefully what I said makes sense, if not, please ask
for additional info.  Thanks in advance for your
assistance.







__________________________________
Do you Yahoo!?
Check out the new Yahoo! Front Page.
www.yahoo.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Wed Nov 10 15:33:37 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:32 2006
Subject: Need Help Please
Message-ID: <mailman.4542.1137101252.24926.mailscanner@lists.mailscanner.info>

Not knowing how much you know about "vacation", I thought I better just
mention that it is designed to only reply to each sender address once a week
at most. So if you keep trying to call it from the same address, don't be
surprised that you get no response. Check the datestamps on the .dir/.pag
files to see if they are being read or written.


On 10/11/04 3:16 pm, "Alex Neuman van der Hans" <alex@nkpanama.com> wrote:

> You might also want to check things that you usually take for granted, like
> file permissions, the fact that the vacation program has to have a link to
> it in /etc/smrsh if you're using sendmail, that vacation is ./configure'd
> with the proper uid/gid, etc. - you'd be surprised how much those little
> details (which are mentioned in the vacation manual) matter.
>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
> Of Ugo Bellavance
> Sent: Wednesday, November 10, 2004 9:25 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Need Help Please
>
> Dave Filchak wrote:
>> My question really was whether or not MailScanner might be stopping
>> the auto response from being sent to the original sender from the vacation
> program.
>> Or maybe not MailScanner but perhaps ClamAV. Vacation is not
>> complicated to set up and it was working fine. However, I have
>> upgraded MailScanner and associated programs a number of times over
>> the last little while and now I cannot seem to get the program to send
>> out an auto response so I thought there was a possibility of trouble
>> with Clam or something. However, there is no indication in the logs as
>> to what might be happening so I was wondering if anyone experienced
>> issues with vacation and the MailScanner suite of programs. I am just
>> fishing here trying to figure out what the hell is going on.
>
> What you can do is make a ruleset that bypasses Spam tests for messages
> coming from the server, 127.0.0.1.  You could whitelist it instead.
>
> As long as auto-replies don't contain attachments or HTML it shouldn't be
> caught the security checks of MailScanner.
>
> Hope this answers your question, but for sure you should test it before
> putting it in production, like anything.
>
> Ugo
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
> archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Steve.Swaney at FSL.COM  Wed Nov 10 15:52:49 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:32 2006
Subject: Bofra-32-Sophos getting through
Message-ID: <mailman.4543.1137101252.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

________________________________________
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On 
> Behalf Of Chris Trudeau
> Sent: Wednesday, November 10, 2004 10:32 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Bofra-32-Sophos getting through

> Hello list,
 
> I am concerned that several of the Bofra bugs have gotten through my 
> mailscanner/sophossavi implementation.
 
> Sophos has released and I have confirmed Bofra IDE files in the libs for
> Sophos, but they continue to get through.
 
> Any ideas?
 
What do the logs say about one of the messages that got through?

I'd immediately install ClamAV and / or BitDefender to stop additional
viruses from getting through.

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com 


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From bno at SALVAGEBV.NL  Wed Nov 10 15:54:07 2004
From: bno at SALVAGEBV.NL (H.P. Noordam)
Date: Thu Jan 12 21:27:32 2006
Subject: off topic:  email forwarding assistance/guidance needed
Message-ID: <mailman.4544.1137101252.24926.mailscanner@lists.mailscanner.info>



MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK> wrote on 10/11/2004
16:47:01:

> My MailScanner/Sendmail server is relaying email to 2
> seperate domains.  A majority of my users (3000) have
> email accounts in the "abc.com" domain, but we have
> roughly 40 users that have an account in both the
> abc.com and xyz.com domains.
>
> The 40 isers in the abc.com and xyz.com domain use
> both addresses at this point but, I would like to
> deliver emails for both addresses to one domain.
> example:  if lester@xyz.com receives an email I would
> like sendmail to route the email to lester@abc.com
> (instead of the xyz.com address).  The xyz.com domain
> will be obsolete in the future but I can't get rid of
> it yet but I would like to eliminate the xyz.com host
> that sendmail is relaying to.
>
> Hopefully what I said makes sense, if not, please ask
> for additional info.  Thanks in advance for your
> assistance.
>
>
>


the virtusertable (/etc/mail/virtusertable) enables you to map single
users or complete domains to other recipients, so thats is the place to
map *@xyz to *@abc.

Bob. ------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From VBoulytchev at COINFOTECH.COM  Wed Nov 10 16:39:15 2004
From: VBoulytchev at COINFOTECH.COM (Vasiliy Boulytchev)
Date: Thu Jan 12 21:27:32 2006
Subject: Newbie help please
Message-ID: <mailman.4545.1137101252.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Mike,
        Have you tried getting on IRC, server is FreeNode, chan is #mailscanner.  On freenode they have #clamav and #spamassassin, among other great support groups.

Thanks,
Vasiliy Boulytchev
Colorado Information Technologies Inc.
http://www.coinfotech.com


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Mike Kercher
Sent: Tuesday, November 09, 2004 10:19 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Newbie help please



________________________________

From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Brian Berglund
Sent: Tuesday, November 09, 2004 11:13 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Newbie help please


If anyone out there can help.
I am having issues with MailWatch/MailScanner.

I am attaching the configs in a zip file.

I am getting some messages logged and some that are not to the mailscanner database.

Also, some messages are not being delivered at all or even in the maillog file.

Can you look over my configs and let me know.

System:
Fedora Core 2
Mysql - latest 4.1
PHP
Apache
Postfix
Mailscanner
MailWatch
ClamAV

--- Tid bits:

When mail comes in, it is checked against a mysql database for user verification, then it is checked against a relay domain table that will allow or not allow that domain to relay through. Then it should be scanned by Mailscanner, logged to Mailwatch, then checked against the database to see where it should be delivered to.  Another internal box or an external exchange server.


Any help would be greatly appreciated.




Relevant log entries might be helpful.

Mike

------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From martinh at SOLID-STATE-LOGIC.COM  Wed Nov 10 15:52:01 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:32 2006
Subject: Bofra-32-Sophos getting through
Message-ID: <mailman.4546.1137101252.24926.mailscanner@lists.mailscanner.info>

Chris

have you tried using 'sweep' on the message file?

Sophos have this annoying habit of not find certain malware till it's
hits the users desktops, esp when the file contains multiple
viruses/trojans etc.

You could also drop the file (passwd protected zip file) to
support@sophos.com and let them look at it..


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Chris Trudeau wrote:
> Hello list,
>
> I am concerned that several of the Bofra bugs have gotten through my
> mailscanner/sophossavi implementation.
>
> Sophos has released and I have confirmed Bofra IDE files in the libs for
> Sophos, but they continue to get through.
>
> Any ideas?
>
> Temprorarily I have jacked up the SPAM score for the
> "SARE_FORGED_PAYPAL_C" check which is catching those and causing them to
> be held as SPAM, but I'm not sure why these messages are getting through.
>
> Any help is appreciated.
>
> CT
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mkettler at EVI-INC.COM  Wed Nov 10 16:15:57 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:32 2006
Subject: Make ruleset
Message-ID: <mailman.4547.1137101252.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

At 08:18 AM 11/10/2004, Joakim Cefalk wrote:
>This ruleset are setting points if there are any swedish signs but i want 
>it too set points if there are not any swedish signs becuse 99% of my 
>emails are swedish (execpt this list..).
>
>body SWEDISH_SIGN                  /\b(?:ĺ|ä|ö)/i

You'll want to do it with hex codes, instead of the literal values, it 
works much better in SA rules.

My second suggestion is to character ranges if you're looking for 
characters instead of strings. MUCH more efficient regex code.

Here's a quick example, which should cover both upper and lower case.
body    SWEDISH_SIGN /[\xC5\xC4\xD6]/i

If it fails to catch lower case, as those are upper-case codes, then 
apparently /i doesn't work on high-ascii codes. You can use the table here:

http://www.math.harvard.edu/computing/html/chars.html

To build the rest, just convert the number to hex (windows calc can do this 
for you) and prefix them with \x.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From alex at nkpanama.com  Wed Nov 10 17:12:13 2004
From: alex at nkpanama.com (Alex Neuman van der Hans)
Date: Thu Jan 12 21:27:32 2006
Subject: Need Help Please
Message-ID: <mailman.4548.1137101252.24926.mailscanner@lists.mailscanner.info>

True. When troubleshooting, I also verify the vacation database files and
try it from local-only catchall addresses by telnetting to port 25.

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Wednesday, November 10, 2004 10:34 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Need Help Please

Not knowing how much you know about "vacation", I thought I better just
mention that it is designed to only reply to each sender address once a week
at most. So if you keep trying to call it from the same address, don't be
surprised that you get no response. Check the datestamps on the .dir/.pag
files to see if they are being read or written.


On 10/11/04 3:16 pm, "Alex Neuman van der Hans" <alex@nkpanama.com> wrote:

> You might also want to check things that you usually take for granted,
> like file permissions, the fact that the vacation program has to have
> a link to it in /etc/smrsh if you're using sendmail, that vacation is
> ./configure'd with the proper uid/gid, etc. - you'd be surprised how
> much those little details (which are mentioned in the vacation manual)
matter.
>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Ugo Bellavance
> Sent: Wednesday, November 10, 2004 9:25 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Need Help Please
>
> Dave Filchak wrote:
>> My question really was whether or not MailScanner might be stopping
>> the auto response from being sent to the original sender from the
>> vacation
> program.
>> Or maybe not MailScanner but perhaps ClamAV. Vacation is not
>> complicated to set up and it was working fine. However, I have
>> upgraded MailScanner and associated programs a number of times over
>> the last little while and now I cannot seem to get the program to
>> send out an auto response so I thought there was a possibility of
>> trouble with Clam or something. However, there is no indication in
>> the logs as to what might be happening so I was wondering if anyone
>> experienced issues with vacation and the MailScanner suite of
>> programs. I am just fishing here trying to figure out what the hell is
going on.
>
> What you can do is make a ruleset that bypasses Spam tests for
> messages coming from the server, 127.0.0.1.  You could whitelist it
instead.
>
> As long as auto-replies don't contain attachments or HTML it shouldn't
> be caught the security checks of MailScanner.
>
> Hope this answers your question, but for sure you should test it
> before putting it in production, like anything.
>
> Ugo
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
> archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
> archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From nathan at TCPNETWORKS.NET  Wed Nov 10 17:38:59 2004
From: nathan at TCPNETWORKS.NET (Nathan Johanson)
Date: Thu Jan 12 21:27:32 2006
Subject: FW: ClamAV abusers to be blacklisted
Message-ID: <mailman.4549.1137101252.24926.mailscanner@lists.mailscanner.info>

Thought I would attach a post from the SA mailing list. Just curious if
MailScanner's autoupdate script for ClamAV takes this into
consideration? 

-Nathan

<==SNIP==>

Just a heads-up for the ClamAV users on the list:

<http://sourceforge.net/forum/forum.php?thread_id=1174326&forum_id=42049
2>

People who are hammering the database servers too frequently risk being 
blacklisted. The latest freshclam supports a DNS-based check that's much

nicer to the servers, so use that if you can.

Posted By: nervoso
Date: 2004-11-05 12:25
Summary: Fix your freshclam setup or get blacklisted 
We are seeing a lot of useless traffic on our mirror servers.  
It looks like there are many broken freshclam clients still running.  
 
Once again, we urge you to upgrade to ClamAV 0.80 and take advantage of
the new DNSDatabaseInfo option, which allows to check for a new version
of the database with a single DNS query. Verify that your freshclam.conf
contains: 
 
DNSDatabaseInfo current.cvd.clamav.net 
 
Check out the doc for more info. 
 
Unless you are using DNSDatabaseInfo, please keep the check frequency
below once per hour.  
 
1) if you run freshclam from crontab, check that you have an entry like
the following:  
 
N * * * * /usr/local/bin/freshclam --quiet  
 
where N is a random integer between 3 and 57 and is not a multiple of
10.  
 
Do NOT use anything like this:  
 
* * * * * /usr/local/bin/freshclam --quiet  
*/N * * * * /usr/local/bin/freshclam --quiet  
 
2) if you run freshclam from crontab, make sure that you are  
_not_ using the -d flag (see the manpage for more info).  
 
Abusing clients will be added to a black list and won't be able to  
download our database anymore.  

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Wed Nov 10 18:05:27 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:32 2006
Subject: FW: ClamAV abusers to be blacklisted
Message-ID: <mailman.4550.1137101252.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

The cron job that runs the autoupdate scripts starts by waiting for a
random number of minutes, in order to skew the update requests around
the hour a bit. And then in order to do the clamav update, the
clamav-autoupdate script uses freshclam, so you just need to configure
your freshclam correctly.

Nathan Johanson wrote:

>Thought I would attach a post from the SA mailing list. Just curious if
>MailScanner's autoupdate script for ClamAV takes this into
>consideration?
>
>-Nathan
>
><==SNIP==>
>
>Just a heads-up for the ClamAV users on the list:
>
><http://sourceforge.net/forum/forum.php?thread_id=1174326&forum_id=42049
>2>
>
>People who are hammering the database servers too frequently risk being
>blacklisted. The latest freshclam supports a DNS-based check that's much
>
>nicer to the servers, so use that if you can.
>
>Posted By: nervoso
>Date: 2004-11-05 12:25
>Summary: Fix your freshclam setup or get blacklisted
>We are seeing a lot of useless traffic on our mirror servers.
>It looks like there are many broken freshclam clients still running.
>
>Once again, we urge you to upgrade to ClamAV 0.80 and take advantage of
>the new DNSDatabaseInfo option, which allows to check for a new version
>of the database with a single DNS query. Verify that your freshclam.conf
>contains:
>
>DNSDatabaseInfo current.cvd.clamav.net
>
>Check out the doc for more info.
>
>Unless you are using DNSDatabaseInfo, please keep the check frequency
>below once per hour.
>
>1) if you run freshclam from crontab, check that you have an entry like
>the following:
>
>N * * * * /usr/local/bin/freshclam --quiet
>
>where N is a random integer between 3 and 57 and is not a multiple of
>10.
>
>Do NOT use anything like this:
>
>* * * * * /usr/local/bin/freshclam --quiet
>*/N * * * * /usr/local/bin/freshclam --quiet
>
>2) if you run freshclam from crontab, make sure that you are
>_not_ using the -d flag (see the manpage for more info).
>
>Abusing clients will be added to a black list and won't be able to
>download our database anymore.
>
>
--

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From llasad1 at YAHOO.COM  Wed Nov 10 18:39:03 2004
From: llasad1 at YAHOO.COM (lester lasad)
Date: Thu Jan 12 21:27:32 2006
Subject: off topic:  email forwarding assistance/guidance needed
Message-ID: <mailman.4551.1137101252.24926.mailscanner@lists.mailscanner.info>

--- "H.P. Noordam" <bno@SALVAGEBV.NL> wrote:

> MailScanner mailing list
> <MAILSCANNER@JISCMAIL.AC.UK> wrote on 10/11/2004
> 16:47:01:
>
> > My MailScanner/Sendmail server is relaying email
> to 2
> > seperate domains.  A majority of my users (3000)
> have
> > email accounts in the "abc.com" domain, but we
> have
> > roughly 40 users that have an account in both the
> > abc.com and xyz.com domains.
> >
> > The 40 isers in the abc.com and xyz.com domain use
> > both addresses at this point but, I would like to
> > deliver emails for both addresses to one domain.
> > example:  if lester@xyz.com receives an email I
> would
> > like sendmail to route the email to lester@abc.com
> > (instead of the xyz.com address).  The xyz.com
> domain
> > will be obsolete in the future but I can't get rid
> of
> > it yet but I would like to eliminate the xyz.com
> host
> > that sendmail is relaying to.
> >
> > Hopefully what I said makes sense, if not, please
> ask
> > for additional info.  Thanks in advance for your
> > assistance.
> >
> >
> >
>
>
> the virtusertable (/etc/mail/virtusertable) enables
> you to map single
> users or complete domains to other recipients, so
> thats is the place to
> map *@xyz to *@abc.
>
> Bob.
>
Thanks for the info.  I did try to forward one
particular users email unsuccessfully and  wanted to
give you more specifics on my setup.

my mailertable says the following:
abc.com    esmtp:abcmailsvr.abc.com
xyz.com    esmtp:xyzmailsvr.xyz.com

I added the following to the /etc/mail/virtusertable:
lester@xyz.com      lester@abc.com  (which should send
the email to lester@abc.com)

I then tried to send an email to lester@xyz.com and
received the following:
----- The following addresses had permanent fatal
errors -----
<lester@xyz.com>
    (reason: 553 5.3.5 system config error)

   ----- Transcript of session follows -----
553 5.3.5 xyzmailsvr.xyz.com. config error: mail loops
back to me (MX
problem?)
554 5.3.5 Local configuration error

I must be missing something.  thanks.



__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From m.sapsed at BANGOR.AC.UK  Wed Nov 10 18:58:04 2004
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:27:32 2006
Subject: Phishing attack test?
Message-ID: <mailman.4552.1137101252.24926.mailscanner@lists.mailscanner.info>

Michael St. Laurent wrote:
> Is there a site that will send a test phishing attack email?

just send yourself an html e-mail where the link and its description are
both URLs but different ones.

Cheers,

Martin

--
Martin Sapsed            "I've got 8 little fingers and only 2 thumbs,
Microcomputer Support                      won't you leave me in peace
Information Services                        while I get the job done?"
University of Wales, Bangor             Chris Rea, "I'm working on it"

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mike at CAMAROSS.NET  Wed Nov 10 18:58:17 2004
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:27:32 2006
Subject: off topic:  email forwarding assistance/guidance needed
Message-ID: <mailman.4553.1137101252.24926.mailscanner@lists.mailscanner.info>

lester lasad wrote:
> --- "H.P. Noordam" <bno@SALVAGEBV.NL> wrote:
>
>> MailScanner mailing list
>> <MAILSCANNER@JISCMAIL.AC.UK> wrote on 10/11/2004
>> 16:47:01:
>>
>>> My MailScanner/Sendmail server is relaying email to 2
>>> seperate domains.  A majority of my users (3000) have
>>> email accounts in the "abc.com" domain, but we have
>>> roughly 40 users that have an account in both the abc.com and
>>> xyz.com domains.
>>>
>>> The 40 isers in the abc.com and xyz.com domain use both addresses at
>>> this point but, I would like to deliver emails for both addresses
>>> to one domain. example:  if lester@xyz.com receives an email I would
>>> like sendmail to route the email to lester@abc.com (instead of the
>>> xyz.com address).  The xyz.com
>> domain
>>> will be obsolete in the future but I can't get rid of
>>> it yet but I would like to eliminate the xyz.com host
>>> that sendmail is relaying to.
>>>
>>> Hopefully what I said makes sense, if not, please ask
>>> for additional info.  Thanks in advance for your assistance.
>>>
>>>
>>>
>>
>>
>> the virtusertable (/etc/mail/virtusertable) enables you to map single
>> users or complete domains to other recipients, so
>> thats is the place to
>> map *@xyz to *@abc.
>>
>> Bob.
>>
> Thanks for the info.  I did try to forward one
> particular users email unsuccessfully and  wanted to
> give you more specifics on my setup.
>
> my mailertable says the following:
> abc.com    esmtp:abcmailsvr.abc.com
> xyz.com    esmtp:xyzmailsvr.xyz.com
>
> I added the following to the /etc/mail/virtusertable:
> lester@xyz.com      lester@abc.com  (which should send
> the email to lester@abc.com)
>
> I then tried to send an email to lester@xyz.com and
> received the following:
> ----- The following addresses had permanent fatal
> errors -----
> <lester@xyz.com>
>     (reason: 553 5.3.5 system config error)
>
>    ----- Transcript of session follows -----
> 553 5.3.5 xyzmailsvr.xyz.com. config error: mail loops
> back to me (MX
> problem?)
> 554 5.3.5 Local configuration error
>
> I must be missing something.  thanks.
>

Do you have abc.com and xyz.com in your /etc/mail/local-host-names or
/etc/mail/relay-domains?  They should be in relay-domains.  Also, make sure
you hashed your virtusertable to db.

You will need to restart sendmail to read the relay-domains after
modification.

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mkettler at EVI-INC.COM  Wed Nov 10 18:59:19 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:32 2006
Subject: FW: ClamAV abusers to be blacklisted
Message-ID: <mailman.4554.1137101252.24926.mailscanner@lists.mailscanner.info>

At 01:05 PM 11/10/2004, Julian Field wrote:
>The cron job that runs the autoupdate scripts starts by waiting for a
>random number of minutes, in order to skew the update requests around
>the hour a bit. And then in order to do the clamav update, the
>clamav-autoupdate script uses freshclam, so you just need to configure
>your freshclam correctly.

Also of further note, the clamav guys are only particularly concerned with
people requesting more than once an hour. MailScanner only checks once an
hour, so that's not a problem anyway. The "non-multiple of 10" is a big
nicety, but I don't think they are going to blacklist people for it, and
mailscanner already handles that part too (Way to go Julian!)

That said, even doing it once an hour, it's a lot less load on your system
as well as theirs if you use the DNS query method. So it's probably a good
idea for everyone involved if you check your freshclam.conf for the DNS
setting. (Default for a clean 0.80 install, but an upgrade from 0.7x will
probably have to manually add it)

         DNSDatabaseInfo current.cvd.clamav.net

Really from the sound of it, they've apparently got some people with
unbelievably stupid configurations that are doing full connections faster
than once a minute. Quite frankly, I'm surprised they are being nice enough
to even mention it. I'd have just blacklisted them as hopelessly broken or
as DoS attempts and not bothered to say anything.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From dnsadmin at 1BIGTHINK.COM  Wed Nov 10 19:24:40 2004
From: dnsadmin at 1BIGTHINK.COM (DNSAdmin)
Date: Thu Jan 12 21:27:32 2006
Subject: FW: ClamAV abusers to be blacklisted
Message-ID: <mailman.4555.1137101252.24926.mailscanner@lists.mailscanner.info>

Hello All,

Thanks for the info AND the EXPLANATION. I might have skipped setting this
without the explanation and the background.

Cheers,
Glenn

At 01:59 PM 11/10/2004, you wrote:

>At 01:05 PM 11/10/2004, Julian Field wrote:
>>The cron job that runs the autoupdate scripts starts by waiting for a
>>random number of minutes, in order to skew the update requests around
>>the hour a bit. And then in order to do the clamav update, the
>>clamav-autoupdate script uses freshclam, so you just need to configure
>>your freshclam correctly.
>
>Also of further note, the clamav guys are only particularly concerned with
>people requesting more than once an hour. MailScanner only checks once an
>hour, so that's not a problem anyway. The "non-multiple of 10" is a big
>nicety, but I don't think they are going to blacklist people for it, and
>mailscanner already handles that part too (Way to go Julian!)
>
>That said, even doing it once an hour, it's a lot less load on your system
>as well as theirs if you use the DNS query method. So it's probably a good
>idea for everyone involved if you check your freshclam.conf for the DNS
>setting. (Default for a clean 0.80 install, but an upgrade from 0.7x will
>probably have to manually add it)
>
>         DNSDatabaseInfo current.cvd.clamav.net
>
>Really from the sound of it, they've apparently got some people with
>unbelievably stupid configurations that are doing full connections faster
>than once a minute. Quite frankly, I'm surprised they are being nice enough
>to even mention it. I'd have just blacklisted them as hopelessly broken or
>as DoS attempts and not bothered to say anything.

--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
http://www.sng.ecs.soton.ac.uk/mailscanner/
Configuration by Glenn Parsons dnsadmin-at-1bigthink.com


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2: "Attached Text" ]


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.788 / Virus Database: 533 - Release Date: 11/1/2004

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From bno at SALVAGEBV.NL  Wed Nov 10 19:30:54 2004
From: bno at SALVAGEBV.NL (Bob Noordam)
Date: Thu Jan 12 21:27:32 2006
Subject: off topic:  email forwarding assistance/guidance needed
Message-ID: <mailman.4556.1137101252.24926.mailscanner@lists.mailscanner.info>

> >
> Thanks for the info.  I did try to forward one
> particular users email unsuccessfully and  wanted to
> give you more specifics on my setup.
>
> my mailertable says the following:
> abc.com    esmtp:abcmailsvr.abc.com
> xyz.com    esmtp:xyzmailsvr.xyz.com
>
> I added the following to the /etc/mail/virtusertable:
> lester@xyz.com      lester@abc.com  (which should send
> the email to lester@abc.com)
>
> I then tried to send an email to lester@xyz.com and
> received the following:
> ----- The following addresses had permanent fatal
> errors -----
> <lester@xyz.com>
>     (reason: 553 5.3.5 system config error)
>
>    ----- Transcript of session follows -----
> 553 5.3.5 xyzmailsvr.xyz.com. config error: mail loops
> back to me (MX
> problem?)
> 554 5.3.5 Local configuration error
>
> I must be missing something.  thanks.
>
>
>


Mail loops back to me indicates that the domain is not configured as local,
the system attempts to forward the mail, and then discovers that the mx
record points to itsself. This usualy indicates that the domain is not
configured in /etc/mail/local-host-names on the box.

- if 'this' machine *should* receive the mail for abc then your
local-host-names is incorrect
- if 'this' machine should *not* receive mail for abc and just offload it,
then it somehow accesses incorrect dns data, which in turn indicates itsself
as the mailserver for abc.com

Bob.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ryanb at aacrao.org  Wed Nov 10 19:56:04 2004
From: ryanb at aacrao.org (Ryan Bingham)
Date: Thu Jan 12 21:27:32 2006
Subject: Bofra-32-Sophos getting through
Message-ID: <mailman.4557.1137101252.24926.mailscanner@lists.mailscanner.info>

I'm also seeing these slip past Sophos...

On Wed, 2004-11-10 at 10:52 -0500, Steve Swaney wrote:
> ________________________________________
> > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> > Behalf Of Chris Trudeau
> > Sent: Wednesday, November 10, 2004 10:32 AM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Bofra-32-Sophos getting through
>
> > Hello list,
>
> > I am concerned that several of the Bofra bugs have gotten through my
> > mailscanner/sophossavi implementation.
>
> > Sophos has released and I have confirmed Bofra IDE files in the libs for
> > Sophos, but they continue to get through.
>
> > Any ideas?
>
> What do the logs say about one of the messages that got through?
>
> I'd immediately install ClamAV and / or BitDefender to stop additional
> viruses from getting through.
>
> Steve
>
> Steve Swaney
> President
> Fortress Systems Ltd.
> www.fsl.com
> steve.swaney@fsl.com
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From andy at TIRESWING.NET  Wed Nov 10 19:50:31 2004
From: andy at TIRESWING.NET (Andy Norris)
Date: Thu Jan 12 21:27:32 2006
Subject: Newbie! Whitelisting Newsletter
Message-ID: <mailman.4558.1137101252.24926.mailscanner@lists.mailscanner.info>

Hi,

Apologies if this is old hat, but could not get much in searching the
archives for "virus whitelist newsletter".

I am running MailScanner on a RedHat server running SpamAssassin. I have
users who have subscribed to HTML newsletters, and I am needing to
whitelist these newsletters from being flagged as viruses. Am using ClamAV...

Where is the whitelist file, and how to get MailScanner to honor the
entries in said file?

Thanks very much in advance,

Andy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Wed Nov 10 20:13:44 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:32 2006
Subject: Newbie! Whitelisting Newsletter
Message-ID: <mailman.4559.1137101252.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

You first need to work out which check(s) you want to disable for these
newsletters. What does the warning attachment actually say for one of
these newsletters? That should give you the answer to that one.

Then you should go and read about rulesets. Almost all of the
configuration options can be given the filename of a ruleset instead of
just a simple value. The rules in the ruleset file describe what value
should be used for that configuration option depending on where the
message came from or is going to (or both, or a few other things too).
You can have different rulesets for every configuration option, which
can be used to build extremely complex configurations for large and
diverse sites.

There is no such thing as a simple global "whitelist", the configuration
system is far more flexible than that.

There is documentation in /etc/MailScanner/rules, and in the MAQ
(location at the bottom of every list posting), and in the FAQ (on
www.mailscanner.info) and in the book (which you can purchase directly
from www.mailscanner.info). There have also been numerous discussions
and examples of rulesets posted to this list in the past.

Hopefully that's enough to get you going.

Andy Norris wrote:

> Hi,
>
> Apologies if this is old hat, but could not get much in searching the
> archives for "virus whitelist newsletter".
>
> I am running MailScanner on a RedHat server running SpamAssassin. I have
> users who have subscribed to HTML newsletters, and I am needing to
> whitelist these newsletters from being flagged as viruses. Am using
> ClamAV...
>
> Where is the whitelist file, and how to get MailScanner to honor the
> entries in said file?
>
> Thanks very much in advance,
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mike.lang at UCONN.EDU  Wed Nov 10 20:33:16 2004
From: mike.lang at UCONN.EDU (Lang, Michael)
Date: Thu Jan 12 21:27:32 2006
Subject: Bofra-32-Sophos getting through
Message-ID: <mailman.4560.1137101252.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I am also seeing this problem...

noob question, does MailScanner with Sweep scan the message body?  Is there an option to set for that?

I'm trying to figure out if MailScanner or Sophos is to blame?  And whethter I need to set a different option?

We are running version 4.22-5  --  I know that's an old version but our mail admin hasn't had time to upgrade :(

- Mike

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
Behalf Of Ryan Bingham
Sent: Wednesday, November 10, 2004 2:56 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Bofra-32-Sophos getting through


I'm also seeing these slip past Sophos...

On Wed, 2004-11-10 at 10:52 -0500, Steve Swaney wrote:
> ________________________________________
> > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> > Behalf Of Chris Trudeau
> > Sent: Wednesday, November 10, 2004 10:32 AM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Bofra-32-Sophos getting through
>
> > Hello list,
>
> > I am concerned that several of the Bofra bugs have gotten through my
> > mailscanner/sophossavi implementation.
>
> > Sophos has released and I have confirmed Bofra IDE files in the libs for
> > Sophos, but they continue to get through.
>
> > Any ideas?
>
> What do the logs say about one of the messages that got through?
>
> I'd immediately install ClamAV and / or BitDefender to stop additional
> viruses from getting through.
>
> Steve
>
> Steve Swaney
> President
> Fortress Systems Ltd.
> www.fsl.com
> steve.swaney@fsl.com
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From andy at TIRESWING.NET  Wed Nov 10 20:33:36 2004
From: andy at TIRESWING.NET (Andy Norris)
Date: Thu Jan 12 21:27:32 2006
Subject: Newbie! Whitelisting Newsletter
Message-ID: <mailman.4561.1137101252.24926.mailscanner@lists.mailscanner.info>

Thanks Julian,

The warning attachment says:

----------------------------------------------------------------------
The original e-mail message contained potentially dangerous content,
which has been removed for your safety.

The content is dangerous as it is often used to spread viruses or to gain
personal or confidential information from you, such as passwords or credit
card numbers.

At Wed Nov 10 13:00:56 2004 the content filters said:
    Found a form in HTML message
----------------------------------------------------------------------

The book covers this topic in depth? I'll buy it straightaway.

Thanks Julian,

Andy



At 02:13 pm 2004-11-10, you wrote:
>You first need to work out which check(s) you want to disable for these
>newsletters. What does the warning attachment actually say for one of
>these newsletters? That should give you the answer to that one.
>
>Then you should go and read about rulesets. Almost all of the
>configuration options can be given the filename of a ruleset instead of
>just a simple value. The rules in the ruleset file describe what value
>should be used for that configuration option depending on where the
>message came from or is going to (or both, or a few other things too).
>You can have different rulesets for every configuration option, which
>can be used to build extremely complex configurations for large and
>diverse sites.
>
>There is no such thing as a simple global "whitelist", the configuration
>system is far more flexible than that.
>
>There is documentation in /etc/MailScanner/rules, and in the MAQ
>(location at the bottom of every list posting), and in the FAQ (on
>www.mailscanner.info) and in the book (which you can purchase directly
>from www.mailscanner.info). There have also been numerous discussions
>and examples of rulesets posted to this list in the past.
>
>Hopefully that's enough to get you going.
>
>Andy Norris wrote:
>
>>Hi,
>>
>>Apologies if this is old hat, but could not get much in searching the
>>archives for "virus whitelist newsletter".
>>
>>I am running MailScanner on a RedHat server running SpamAssassin. I have
>>users who have subscribed to HTML newsletters, and I am needing to
>>whitelist these newsletters from being flagged as viruses. Am using
>>ClamAV...
>>
>>Where is the whitelist file, and how to get MailScanner to honor the
>>entries in said file?
>>
>>Thanks very much in advance,
>
>--
>Julian Field
>www.MailScanner.info
>Buy the MailScanner book at www.MailScanner.info/store
>Professional Support Services at www.MailScanner.biz
>MailScanner thanks transtec Computers for their support
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ryanb at aacrao.org  Wed Nov 10 20:35:57 2004
From: ryanb at aacrao.org (Ryan Bingham)
Date: Thu Jan 12 21:27:32 2006
Subject: Bofra-32-Sophos getting through
Message-ID: <mailman.4562.1137101252.24926.mailscanner@lists.mailscanner.info>

I just talked to Sophos about this and they said that because the email
doesn't actually contain a virus (only a link to a virus), they have no
way of filtering it and recommended doing it through a gateway spam
content filter.

I've taken Chris' advice and bumped up the SARE_FORGED_PAYPAL_C score,
and that seems to be catching the Paypal ones.  Does anyone have any
other ideas on how to block these?  Are other engines actually catching
these viruses?

Thanks,

Ryan

On Wed, 2004-11-10 at 14:56 -0500, Ryan Bingham wrote:
> I'm also seeing these slip past Sophos...
>
> On Wed, 2004-11-10 at 10:52 -0500, Steve Swaney wrote:
> > ________________________________________
> > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> > > Behalf Of Chris Trudeau
> > > Sent: Wednesday, November 10, 2004 10:32 AM
> > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > Subject: Bofra-32-Sophos getting through
> >
> > > Hello list,
> >
> > > I am concerned that several of the Bofra bugs have gotten through my
> > > mailscanner/sophossavi implementation.
> >
> > > Sophos has released and I have confirmed Bofra IDE files in the libs for
> > > Sophos, but they continue to get through.
> >
> > > Any ideas?
> >
> > What do the logs say about one of the messages that got through?
> >
> > I'd immediately install ClamAV and / or BitDefender to stop additional
> > viruses from getting through.
> >
> > Steve
> >
> > Steve Swaney
> > President
> > Fortress Systems Ltd.
> > www.fsl.com
> > steve.swaney@fsl.com
> >
> >
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From peter at UCGBOOK.COM  Wed Nov 10 20:41:00 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:32 2006
Subject: Newbie! Whitelisting Newsletter
Message-ID: <mailman.4563.1137101252.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Andy Norris wrote:
> Thanks Julian,
>
> The warning attachment says:
>
> ----------------------------------------------------------------------
> The original e-mail message contained potentially dangerous content,
> which has been removed for your safety.
>
> The content is dangerous as it is often used to spread viruses or to gain
> personal or confidential information from you, such as passwords or credit
> card numbers.
>
> At Wed Nov 10 13:00:56 2004 the content filters said:
>    Found a form in HTML message
> ----------------------------------------------------------------------

I would recommend using a simple "disarm" instead of a ruleset for
"Allow Form Tags" (which caused the above) and a couple of others. It
lets mail through but they are not dangerous any more.

Look at the section in Mailscanner.conf named "Removing/Logging
dangerous or potentially offensive content".

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Wed Nov 10 20:59:32 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:32 2006
Subject: Newbie! Whitelisting Newsletter
Message-ID: <mailman.4564.1137101252.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Andy Norris wrote:

> Thanks Julian,
>
> The warning attachment says:
>
> ----------------------------------------------------------------------
> The original e-mail message contained potentially dangerous content,
> which has been removed for your safety.
>
> The content is dangerous as it is often used to spread viruses or to gain
> personal or confidential information from you, such as passwords or
> credit
> card numbers.
>
> At Wed Nov 10 13:00:56 2004 the content filters said:
>    Found a form in HTML message

In which case, as others have already suggested, I would set
Allow Form Tags = disarm
This is very simple and just breaks the form so it doesn't work any
more. "disarm" isn't a bad idea for any of those settings (the ones that
say you can use "disarm") as it still lets the message through, just
with the nasty bits broken.

> The book covers this topic in depth? I'll buy it straightaway.

It gives a very good description of all the configuration options and
talks about rulesets. I have posted the contents list here before, it
will be in the archive somewhere.

> At 02:13 pm 2004-11-10, you wrote:
>
>> You first need to work out which check(s) you want to disable for these
>> newsletters. What does the warning attachment actually say for one of
>> these newsletters? That should give you the answer to that one.
>>
>> Then you should go and read about rulesets. Almost all of the
>> configuration options can be given the filename of a ruleset instead of
>> just a simple value. The rules in the ruleset file describe what value
>> should be used for that configuration option depending on where the
>> message came from or is going to (or both, or a few other things too).
>> You can have different rulesets for every configuration option, which
>> can be used to build extremely complex configurations for large and
>> diverse sites.
>>
>> There is no such thing as a simple global "whitelist", the configuration
>> system is far more flexible than that.
>>
>> There is documentation in /etc/MailScanner/rules, and in the MAQ
>> (location at the bottom of every list posting), and in the FAQ (on
>> www.mailscanner.info) and in the book (which you can purchase directly
>> from www.mailscanner.info). There have also been numerous discussions
>> and examples of rulesets posted to this list in the past.
>>
>> Hopefully that's enough to get you going.
>>
>> Andy Norris wrote:
>>
>>> Hi,
>>>
>>> Apologies if this is old hat, but could not get much in searching the
>>> archives for "virus whitelist newsletter".
>>>
>>> I am running MailScanner on a RedHat server running SpamAssassin. I
>>> have
>>> users who have subscribed to HTML newsletters, and I am needing to
>>> whitelist these newsletters from being flagged as viruses. Am using
>>> ClamAV...
>>>
>>> Where is the whitelist file, and how to get MailScanner to honor the
>>> entries in said file?
>>>
>>> Thanks very much in advance,
>>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From andy at TIRESWING.NET  Wed Nov 10 21:53:47 2004
From: andy at TIRESWING.NET (Andy Norris)
Date: Thu Jan 12 21:27:32 2006
Subject: Newbie! Whitelisting Newsletter
Message-ID: <mailman.4565.1137101252.24926.mailscanner@lists.mailscanner.info>

Thanks again. I should have the book within "1-5 business days". :-)

Andy

At 02:59 pm 2004-11-10, you wrote:
>Andy Norris wrote:
>
>>Thanks Julian,
>>
>>The warning attachment says:
>>
>>----------------------------------------------------------------------
>>The original e-mail message contained potentially dangerous content,
>>which has been removed for your safety.
>>
>>The content is dangerous as it is often used to spread viruses or to gain
>>personal or confidential information from you, such as passwords or
>>credit
>>card numbers.
>>
>>At Wed Nov 10 13:00:56 2004 the content filters said:
>>    Found a form in HTML message
>
>In which case, as others have already suggested, I would set
>Allow Form Tags = disarm
>This is very simple and just breaks the form so it doesn't work any
>more. "disarm" isn't a bad idea for any of those settings (the ones that
>say you can use "disarm") as it still lets the message through, just
>with the nasty bits broken.
>
>>The book covers this topic in depth? I'll buy it straightaway.
>
>It gives a very good description of all the configuration options and
>talks about rulesets. I have posted the contents list here before, it
>will be in the archive somewhere.
>
>>At 02:13 pm 2004-11-10, you wrote:
>>
>>>You first need to work out which check(s) you want to disable for these
>>>newsletters. What does the warning attachment actually say for one of
>>>these newsletters? That should give you the answer to that one.
>>>
>>>Then you should go and read about rulesets. Almost all of the
>>>configuration options can be given the filename of a ruleset instead of
>>>just a simple value. The rules in the ruleset file describe what value
>>>should be used for that configuration option depending on where the
>>>message came from or is going to (or both, or a few other things too).
>>>You can have different rulesets for every configuration option, which
>>>can be used to build extremely complex configurations for large and
>>>diverse sites.
>>>
>>>There is no such thing as a simple global "whitelist", the configuration
>>>system is far more flexible than that.
>>>
>>>There is documentation in /etc/MailScanner/rules, and in the MAQ
>>>(location at the bottom of every list posting), and in the FAQ (on
>>>www.mailscanner.info) and in the book (which you can purchase directly
>>>from www.mailscanner.info). There have also been numerous discussions
>>>and examples of rulesets posted to this list in the past.
>>>
>>>Hopefully that's enough to get you going.
>>>
>>>Andy Norris wrote:
>>>
>>>>Hi,
>>>>
>>>>Apologies if this is old hat, but could not get much in searching the
>>>>archives for "virus whitelist newsletter".
>>>>
>>>>I am running MailScanner on a RedHat server running SpamAssassin. I
>>>>have
>>>>users who have subscribed to HTML newsletters, and I am needing to
>>>>whitelist these newsletters from being flagged as viruses. Am using
>>>>ClamAV...
>>>>
>>>>Where is the whitelist file, and how to get MailScanner to honor the
>>>>entries in said file?
>>>>
>>>>Thanks very much in advance,
>
>--
>Julian Field
>www.MailScanner.info
>Buy the MailScanner book at www.MailScanner.info/store
>Professional Support Services at www.MailScanner.biz
>MailScanner thanks transtec Computers for their support
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From dfilchak at sympatico.ca  Thu Nov 11 04:15:14 2004
From: dfilchak at sympatico.ca (Dave Filchak)
Date: Thu Jan 12 21:27:32 2006
Subject: Issue Resolved
Message-ID: <mailman.4566.1137101252.24926.mailscanner@lists.mailscanner.info>

Just in case anyone else deals with the vacation program and thinks there
might be an issue with MailScanner:

As the people that replied said, "MailScanner" will not stop the auto
response message from being sent".

After Googling and not really clarifying much and searching the archives, I
finally got a tip (link) from Steve Swaney (thanks Steve). The instructions
were a bit clearer for my overworked brain and this got me going in the
right direction.

What my problem was, I misunderstood, how the vacation forward rules should
work.  For some of my email clients, we have a log in name and then an alias
in virtusertable to the log in name. So the rules I tried that did not work
and gave me an "unknown mailer" error were:

 \login_name, "|/usr/bin/vacation login_name"
\login_name, "|/usr/bin/vacation -a login_name"
\login_name, "|/usr/bin/vacation -a alias_name@domainname" (not sure why
this one did not work)

These all gave me an error. What worked was:

\login_name, "|/usr/bin/vacation -a alias_name@domainname login_name" Again,
this rule applies to a situation where you have usernames and then entries
in the virtusertable in Sendmail that point to these users.

I could have written it this way to set a different time interval between
responses to the same sender:

\login_name, "|/usr/bin/vacation -a alias_name@domainname -r 3 login_name"
which would set the time interval to three days (default is 1 week).

Hopefully, if any other "relatively inexperienced" person on this list
thinks he or she has an issue with MailScanner and the dreaded vacation
program, hopefully this will help. Thanks to all who replied to me.

Dave

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From martinh at SOLID-STATE-LOGIC.COM  Thu Nov 11 09:06:27 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:32 2006
Subject: Bofra-32-Sophos getting through
Message-ID: <mailman.4567.1137101252.24926.mailscanner@lists.mailscanner.info>

MS scans the entire message - send the infected emails to sophos support
for them to analyse..


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Lang, Michael wrote:
> I am also seeing this problem...
>
> noob question, does MailScanner with Sweep scan the message body?  Is there an option to set for that?
>
> I'm trying to figure out if MailScanner or Sophos is to blame?  And whethter I need to set a different option?
>
> We are running version 4.22-5  --  I know that's an old version but our mail admin hasn't had time to upgrade :(
>
> - Mike
>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> Behalf Of Ryan Bingham
> Sent: Wednesday, November 10, 2004 2:56 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Bofra-32-Sophos getting through
>
>
> I'm also seeing these slip past Sophos...
>
> On Wed, 2004-11-10 at 10:52 -0500, Steve Swaney wrote:
>
>>________________________________________
>>
>>>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>>>Behalf Of Chris Trudeau
>>>Sent: Wednesday, November 10, 2004 10:32 AM
>>>To: MAILSCANNER@JISCMAIL.AC.UK
>>>Subject: Bofra-32-Sophos getting through
>>
>>>Hello list,
>>
>>>I am concerned that several of the Bofra bugs have gotten through my
>>>mailscanner/sophossavi implementation.
>>
>>>Sophos has released and I have confirmed Bofra IDE files in the libs for
>>>Sophos, but they continue to get through.
>>
>>>Any ideas?
>>
>>What do the logs say about one of the messages that got through?
>>
>>I'd immediately install ClamAV and / or BitDefender to stop additional
>>viruses from getting through.
>>
>>Steve
>>
>>Steve Swaney
>>President
>>Fortress Systems Ltd.
>>www.fsl.com
>>steve.swaney@fsl.com
>>
>>
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From lindsay at pa.net  Thu Nov 11 01:32:09 2004
From: lindsay at pa.net (Lindsay Snider)
Date: Thu Jan 12 21:27:32 2006
Subject: local relay patch
Message-ID: <mailman.4568.1137101252.24926.mailscanner@lists.mailscanner.info>

Hello,

For those of you using the local relay patch, I've updated it to patch cleanly
against MailScanner 4.35.11.

For those of you whom do not use it, the local relay patch allows you to
specify mail relays which are internal to your network.  Thus, when
MailScanner searches for an offending ip for spam and viruses, ip netblocks
you consider internal are skipped.

ASCII Art Example:

evil ip            mx server         mailscanner server
1.2.3.4 ------> 10.0.0.2 --------> 10.0.0.6 -------------->


With the patch, when server 10.0.0.6 sees the message from 10.0.0.2, he'll
know he can trust 10.0.0.2's mail headers and blame 1.2.3.4 for evil doings.
In mailscanner.conf, a line similar to the following is added:

Local Relay = 10.0.0.0/16 10.233.0.232/32 192.168.5.0/24


**Note**
This patch has only been coded for postfix.  If interest in other MTAs exist,
we could consider writing it for those MTAs as well.

-Lindsay

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Text/X-DIFF (Name: "local_relay_mailscanner.patch")  57 ]
    [ lines. ]
    [ Unable to print this part. ]


From dfilchak at sympatico.ca  Wed Nov 10 23:55:28 2004
From: dfilchak at sympatico.ca (Dave Filchak)
Date: Thu Jan 12 21:27:32 2006
Subject: Need Help Please
Message-ID: <mailman.4569.1137101252.24926.mailscanner@lists.mailscanner.info>

Hey Julian,

Yeah I know that but I was setting it with the flag -r 0 which I believe
makes it respond to every email (just for testing purposes though).

 Thanks

Dave

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Wednesday, November 10, 2004 10:34 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: [MAILSCANNER] Need Help Please

Not knowing how much you know about "vacation", I thought I better just
mention that it is designed to only reply to each sender address once a week
at most. So if you keep trying to call it from the same address, don't be
surprised that you get no response. Check the datestamps on the .dir/.pag
files to see if they are being read or written.


On 10/11/04 3:16 pm, "Alex Neuman van der Hans" <alex@nkpanama.com> wrote:

> You might also want to check things that you usually take for granted,
> like file permissions, the fact that the vacation program has to have
> a link to it in /etc/smrsh if you're using sendmail, that vacation is
> ./configure'd with the proper uid/gid, etc. - you'd be surprised how
> much those little details (which are mentioned in the vacation manual)
matter.
>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Ugo Bellavance
> Sent: Wednesday, November 10, 2004 9:25 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Need Help Please
>
> Dave Filchak wrote:
>> My question really was whether or not MailScanner might be stopping
>> the auto response from being sent to the original sender from the
>> vacation
> program.
>> Or maybe not MailScanner but perhaps ClamAV. Vacation is not
>> complicated to set up and it was working fine. However, I have
>> upgraded MailScanner and associated programs a number of times over
>> the last little while and now I cannot seem to get the program to
>> send out an auto response so I thought there was a possibility of
>> trouble with Clam or something. However, there is no indication in
>> the logs as to what might be happening so I was wondering if anyone
>> experienced issues with vacation and the MailScanner suite of
>> programs. I am just fishing here trying to figure out what the hell is
going on.
>
> What you can do is make a ruleset that bypasses Spam tests for
> messages coming from the server, 127.0.0.1.  You could whitelist it
instead.
>
> As long as auto-replies don't contain attachments or HTML it shouldn't
> be caught the security checks of MailScanner.
>
> Hope this answers your question, but for sure you should test it
> before putting it in production, like anything.
>
> Ugo
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
> archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
> archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ELIQUID.COM  Thu Nov 11 14:11:50 2004
From: mailscanner at ELIQUID.COM (Wess)
Date: Thu Jan 12 21:27:32 2006
Subject: Issue Resolved
Message-ID: <mailman.4570.1137101252.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "utf-8" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Thankfully I have only needed the vacation program once since I moved to
MailScanner.  Unfortunately for me, it was very difficult to use, and to
implement in the future if I need it.

My configuration is:
MailScanner 4.32.5
MySQL 4.0.22
Postfix 2.1.5
SpamAssassin 3.0.1
ClamAV 0.80

I have all user accounts managed virtually through mysql.

Here is how I got vacation to work last time:

1.  Create new user account for the person on vacation (Mail users are
hosted virtually, so they do not have user accounts...)
2.  Set their email address to forward to their old inbox, and the
vacation program via alias.  ("| /usr/bin/vacation -a username")
3.  Configure the vacation settings in their temporary home directory.
4.  Extensive testing/smashing head on wall.
5.  Finally worked after tweaking.


Now that you know what I did, with SQL based virtual hosting, is there an
easier way to use a vacation program or script with this type of
Mailscanner virtual hosting?  if you can help me out, see me on the
Unofficial IRC support channel or simply respond here.  Vacation scripts
are requested quite often here, and a quick way of dealing with them
would be quite ideal.

MailScanner on IRC
Community Support
irc.freenode.net
#mailscanner

Thanks guys!

On Wed, 2004-11-10 at 23:15, Dave Filchak wrote:

 Just in case anyone else deals with the vacation program and thinks there
might be an issue with MailScanner:

As the people that replied said, "MailScanner" will not stop the auto
response message from being sent".

After Googling and not really clarifying much and searching the archives, I
finally got a tip (link) from Steve Swaney (thanks Steve). The instructions
were a bit clearer for my overworked brain and this got me going in the
right direction.

What my problem was, I misunderstood, how the vacation forward rules should
work.  For some of my email clients, we have a log in name and then an alias
in virtusertable to the log in name. So the rules I tried that did not work
and gave me an "unknown mailer" error were:

 \login_name, "|/usr/bin/vacation login_name"
\login_name, "|/usr/bin/vacation -a login_name"
\login_name, "|/usr/bin/vacation -a alias_name@domainname" (not sure why
this one did not work)

These all gave me an error. What worked was:

\login_name, "|/usr/bin/vacation -a alias_name@domainname login_name" Again,
this rule applies to a situation where you have usernames and then entries
in the virtusertable in Sendmail that point to these users.

I could have written it this way to set a different time interval between
responses to the same sender:

\login_name, "|/usr/bin/vacation -a alias_name@domainname -r 3 login_name"
which would set the time interval to three days (default is 1 week).

Hopefully, if any other "relatively inexperienced" person on this list
thinks he or she has an issue with MailScanner and the dreaded vacation
program, hopefully this will help. Thanks to all who replied to me.

Dave

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


 MailScanner on IRC

Community Support

irc.freenode.net

#mailscanner



------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From ugob at CAMO-ROUTE.COM  Thu Nov 11 14:19:58 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:32 2006
Subject: Newbie! Whitelisting Newsletter
Message-ID: <mailman.4571.1137101252.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Andy Norris wrote:
> Thanks again. I should have the book within "1-5 business days". :-)
>

Wow, this is the kind of attitude I like.  You'll be glad of your
decision :).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at BARENDSE.TO  Thu Nov 11 15:58:46 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:32 2006
Subject: Adding phishing to silent virii?
Message-ID: <mailman.4572.1137101252.24926.mailscanner@lists.mailscanner.info>

I'm getting swamped with 'virus' messages of all those stupid Phishing
e-mails that clamav so neatly catches.

How would I add this to the silent virii whitelist (so far i only had
single word virii in them)?

This is the clamav output:
ClamAV: msg-1827-136.html contains HTML.Phishing.Bank-1

Thanks!
Remco

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Peter.Bates at LSHTM.AC.UK  Thu Nov 11 16:13:25 2004
From: Peter.Bates at LSHTM.AC.UK (Peter Bates)
Date: Thu Jan 12 21:27:33 2006
Subject: Weirdness with 'Install-Clam-SA'...
Message-ID: <mailman.4573.1137101252.24926.mailscanner@lists.mailscanner.info>

Hello all...

Keen as I am on nicely packaged software, I'm a big fan of the
'Install-Clam-SA' combo...

I'd previously used it on a box running RH AS 3 after installing
MailScanner 4.32...

Today I thought I'd swiftly upgrade to MS 4.35, and also use
'Install-Clam-SA' as I'm using Clam... and also thought I could enable
SpamAssassin after that.

A few things I observed, which I just thought I'd pass on as they might
just be logic errors in the RPM install shell-script...

Clam moved from 0.75 to 0.80 happily. However, Perl-Inline was not
rebuilt (I'm guessing I installed it via CPAN, so there was no RPM to
test for), so Mail-ClamAV was not installed (or updated in this case),
so MS coughed on restarting.
Manually doing a 'rpmbuild --rebuild' for Perl-Inline was okay, but
this was a bit odd.

Similarly, perl-Mail-SpamAssassin-3.0 was there, so a test to install
3.0.1 failed...

And finally perl-Net-DNS 0.48 (which SA 3.x prefers) wasn't built at
all, so again I had to fall back to 'rpmbuild'.

As I said, just thought I'd pass this on, if anything it demonstrates
what a Frankenstein system you can end up with if some things have been
installed via CPAN (or hand), and others exist as tidy RPM packages...



--------------------------------------------------------------------------------------------------->
Peter Bates, Systems Support Officer, IT Services.
London School of Hygiene & Tropical Medicine.
Telephone:0207-958 8353 / Fax: 0207- 636 9838

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Thu Nov 11 16:15:39 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:33 2006
Subject: Adding phishing to silent virii?
Message-ID: <mailman.4574.1137101253.24926.mailscanner@lists.mailscanner.info>

The word Phishing should be enough.


On 11/11/04 3:58 pm, "Remco Barendse" <mailscanner@BARENDSE.TO> wrote:

> I'm getting swamped with 'virus' messages of all those stupid Phishing
> e-mails that clamav so neatly catches.
>
> How would I add this to the silent virii whitelist (so far i only had
> single word virii in them)?
>
> This is the clamav output:
> ClamAV: msg-1827-136.html contains HTML.Phishing.Bank-1

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From campbell at cnpapers.com  Thu Nov 11 16:42:48 2004
From: campbell at cnpapers.com (Steve Campbell)
Date: Thu Jan 12 21:27:33 2006
Subject: OT - Real OT - Firewall suggestion
Message-ID: <mailman.4575.1137101253.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

This is real OT, so I'll understand if no one even reads this.

Apparently, someone or something has decided to pick on us here over the
last two days. We have gateways defined as our MX records which relay to our
mail server boxes. Someone/thing has decided to circumvent the MX records
and try the sendmail boxes directly.

My firewall blocks all of this, so there is no worries there, but it sure is
wasting a lot of bandwidth. I would like to hear any suggestions on what may
have been done to slow this down, or any other nifty things that may help. I
use IPTABLES as a firewall.

Unfortunately, the gateways are outside the firewall, so they are being beat
up pretty bad. I can't move these inside (not my decision). I also don't
manage the gateways, so....

Sorry for the OT, just wanting to find some little tricks to make these
people pay a little for their efforts.
Thanks, as always.

Steve Campbell
campbell@cnpapers.com
Charleston Newspapers

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From BBerglund at TECHPRO.COM  Fri Nov 12 03:57:02 2004
From: BBerglund at TECHPRO.COM (Brian Berglund)
Date: Thu Jan 12 21:27:33 2006
Subject: Newbie help please
Message-ID: <mailman.4576.1137101253.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Here are the maillog and dbi trace log..
 
any others ?

________________________________

From: MailScanner mailing list on behalf of Mike Kercher
Sent: Tue 11/9/2004 11:18 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Newbie help please



________________________________

From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Brian Berglund
Sent: Tuesday, November 09, 2004 11:13 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Newbie help please


If anyone out there can help.
I am having issues with MailWatch/MailScanner.

I am attaching the configs in a zip file.

I am getting some messages logged and some that are not to the mailscanner
database.

Also, some messages are not being delivered at all or even in the maillog
file.

Can you look over my configs and let me know.

System:
Fedora Core 2
Mysql - latest 4.1
PHP
Apache
Postfix
Mailscanner
MailWatch
ClamAV

--- Tid bits:

When mail comes in, it is checked against a mysql database for user
verification, then it is checked against a relay domain table that will
allow or not allow that domain to relay through.
Then it should be scanned by Mailscanner, logged to Mailwatch, then checked
against the database to see where it should be delivered to.  Another
internal box or an external exchange server.


Any help would be greatly appreciated.




Relevant log entries might be helpful.

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).



------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From BBerglund at TECHPRO.COM  Fri Nov 12 04:00:46 2004
From: BBerglund at TECHPRO.COM (Brian Berglund)
Date: Thu Jan 12 21:27:33 2006
Subject: Newbie help please
Message-ID: <mailman.4577.1137101253.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

The thing is, is that I have been watching the maillog and trace log. 
I can see the message come in, then be handed off to the recipient with just postfix. 
the postfix mysql connection for relay, email address works great for just relaying. 
So I added clam and it works just fine. 
Then I thought I was suppose to put spam assassin and mailscanner on together according to the install files of mailscanner. 
With just those
Mailscanner, Clam, SpamAssass.... and postfix it seemed to work just fine. 
I can send a message, see it scanned and then pass it on. 
My problem is that some messages are logged to MailWatch, some are not. 
I am thinking that my problem is in the mailwatch, it seems that I miss messages when mailwatch is logging the message before it...
So i think it is a mysql problem. 
But I am really really new to linux, so this is hard to do.  It is hard to find what I am looking for on this system. 
 
I guess the hardest is that I haven't been able to compare it to anything. 

Others have to have it setup this way.  Why are there no examples of configs?
Once I got my system working 100% I would have no issue throwing out my configs so that others can set it up similar.

________________________________

From: MailScanner mailing list on behalf of Dhawal Doshy
Sent: Wed 11/10/2004 2:04 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Newbie help please



Brian Berglund wrote:
> If anyone out there can help.
> I am having issues with MailWatch/MailScanner.
>
brian,

multi / cross posting is not going to help you much, what I suggest is
that you take one part at a time and see if it working as per your
satisfaction..

take postfix see if you are able to accept mails and relay them to the
right place using the transport mechanism.

now add the mysql part to postfix and see if postfix can read your
recipients table and continue to accept / deliver mails properly.

now add the others (spamassassin, razor, pyzor, dcc, clamav etc..) and
check if spamassassin recognizes every other component (except clamav).

now install mailscanner, integrate it with postfix and check again if
mailscanner can read your spamassassin prefs and detect clamav.

Finally add mailwatch to complete your setup..

if at any point you face problems most of us will suggest you read the
maqs / faqs and search the mailing lists first before you post here.. in
the event you need to post here, follow the instructions from here..
http://www.mailscanner.biz/maq/#rulespost

most important check your logs (all maillog, apache, OS messages and
mysql), you'll be amazed at your own troubleshooting skils if you can
read the logs properly (and maybe help other newbies).

- dhawal

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).



------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From dfilchak at sympatico.ca  Fri Nov 12 06:09:02 2004
From: dfilchak at sympatico.ca (Dave Filchak)
Date: Thu Jan 12 21:27:33 2006
Subject: MAX message size - MAX attachment size
Message-ID: <mailman.4578.1137101253.24926.mailscanner@lists.mailscanner.info>

Quick question around message size and attachment size. When you set Maximum
Message Size in MS, does that size include any attachments or must the
Maximum Attachment Size be set as well?

Dave

David Filchak
President - Zuka Inc.
Toronto, On Canada M5V2J1
www.zuka.net | www.screamingmedia.ca

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From jcain at CSPACEINTERACTIVE.COM  Thu Nov 11 22:25:17 2004
From: jcain at CSPACEINTERACTIVE.COM (Justin Cain)
Date: Thu Jan 12 21:27:33 2006
Subject: Issue with outlook messages decode
Message-ID: <mailman.4579.1137101253.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

All,
 
Having a problem with mailscanner decoding of messages sent form
microsoft clients sending rich text or HTML. I have tried turning off the
TNEF expander and also setting mailscanner to deliver the unparsable
TNEF. I have also tried both the internal perl module and the external
executable. After a little more digging I'm thinking that the problem
occurs before the TNEF even gets kicked off.   It appears that the MIME
Decoder module is having a problem initializing the QuotedPrint object
when and HTML or Rich text email is recieved from a MS client (plain text
are fine) also HTML/richtext from evolution is fine. The following error
appears in the maillog. 
 
Cannot parse /var/spool/MailScanner/incoming/7895/4636B211F42.header and
, Can't locate object method "init" v\
ia package "MIME::Decoder::QuotedPrint" at
/usr/lib/perl5/site_perl/5.8.5/MIME/Decoder.pm line 179.
 
I have noticed that there is more than one QuotedPrint perl module on the
box, I not really a perl guy so I not sure how all this effects things
 
 locate QuotedPrint
/usr/share/man/man3/PerlIO::via::QuotedPrint.3pm.gz
/usr/share/man/man3/MIME::QuotedPrint.3pm.gz
/usr/share/man/man3/MIME::Decoder::QuotedPrint.3pm.gz
/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/MIME/QuotedPrint.pm
/usr/lib/perl5/5.8.5/PerlIO/via/QuotedPrint.pm
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/MIME/QuotedPrint.pm
/usr/lib/perl5/site_perl/5.8.5/MIME/Decoder/QuotedPrint.pm
 
 
System info
 
SMP x86_64 running fedora core 3
perl 5.8.5
mailscanner-4.35.11-1 (rpm install)
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From SmartD at VMCMAIL.COM  Thu Nov 11 23:03:05 2004
From: SmartD at VMCMAIL.COM (Smart,Dan)
Date: Thu Jan 12 21:27:33 2006
Subject: OT - Firewall suggestion
Message-ID: <mailman.4580.1137101253.24926.mailscanner@lists.mailscanner.info>

I suggest you run a Labrea, a sticky honeypot that slows down all scans with
it tarpitting tricks.  It will automatically find all unused IP addresses in
the local subnet, and answer for all these Ips, tarpitting all callers.

http://labrea.sourceforge.net/labrea-info.html

<<Dan>>




>  -----Original Message-----
>  From: MailScanner mailing list
>  [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Steve Campbell
>  Sent: Thursday, November 11, 2004 3:50 PM
>  To: MAILSCANNER@JISCMAIL.AC.UK
>  Subject: Re: [MAILSCANNER] OT - Firewall suggestion
>
>  OK, so maybe I'm overly excited about a little of nothing.
>  For the most part, the no-logging takes care of most of
>  this. The DROP will happen next when I need it. Based on my
>  log files, it seemed a lot bigger than 11/sec, and it may
>  have been originally.
>
>  Anyways, thanks for all the great suggestions and help.
>
>  END OF THREAD
>
>  Steve Campbell
>
>
>  ----- Original Message -----
>  From: "Ugo Bellavance" <ugob@CAMO-ROUTE.COM>
>  To: <MAILSCANNER@JISCMAIL.AC.UK>
>  Sent: Thursday, November 11, 2004 4:08 PM
>  Subject: Re: OT - Firewall suggestion
>
>
>  > Steve Campbell wrote:
>  > > I agree. This  is what I was hoping the ISP could do,
>  and also maybe
>  > > do
>  a
>  > > little legal prompting/investigative work.
>  >
>  > For 11 packets/sec?  I doubt it, especially since it is
>  not all the
>  > same the same IP.  I think your best bet is DROP packets.
>  >
>
>  ------------------------ MailScanner list
>  ------------------------ To unsubscribe, email
>  jiscmail@jiscmail.ac.uk with the words:
>  'leave mailscanner' in the body of the email.
>  Before posting, read the MAQ
>  (http://www.mailscanner.biz/maq/) and the archives
>  (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From smlists at SHAW.CA  Thu Nov 11 18:49:20 2004
From: smlists at SHAW.CA (Steve Mason)
Date: Thu Jan 12 21:27:33 2006
Subject: OT - Firewall suggestion
Message-ID: <mailman.4581.1137101253.24926.mailscanner@lists.mailscanner.info>

> Someone/thing has decided to circumvent the MX records
>and try the sendmail boxes directly.

>My firewall blocks all of this, so there is no worries there, but it sure is
>wasting a lot of bandwidth. I would like to hear any suggestions on what may
>have been done to slow this down, or any other nifty things that may help. I
>use IPTABLES as a firewall.

>Unfortunately, the gateways are outside the firewall, so they are being beat
>up pretty bad. I can't move these inside (not my decision). I also don't
>manage the gateways, so....

Unless I'm missing something, how would connection requests on port 25, being blocked by the firewall waste bandwidth?

One thing you can do to slow down the perpetrators, is use DROP instead of DENY or REJECT in your iptables for port 25, this will cause the system attempting the connection to wait for a timeout.


Steve

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From campbell at cnpapers.com  Thu Nov 11 19:20:53 2004
From: campbell at cnpapers.com (Steve Campbell)
Date: Thu Jan 12 21:27:33 2006
Subject: OT - Firewall suggestion
Message-ID: <mailman.4582.1137101253.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Traffic in or out is still traffic, and the firewall still has to DROP, DENY
whatever. I have considered the DROP, but for now, I just quit logging these
packets until the ISP returns my call. As each one is from a different IP,
I'm hoping they will carry the ball and determine the real offender. The
packets seem to average about 11 per second. Although this is nothing
astronomical, it is a problem.

Thanks for the suggestions, though.

Steve Campbell

----- Original Message -----
From: "Steve Mason" <smlists@SHAW.CA>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Thursday, November 11, 2004 1:49 PM
Subject: Re: OT - Firewall suggestion


> > Someone/thing has decided to circumvent the MX records
> >and try the sendmail boxes directly.
>
> >My firewall blocks all of this, so there is no worries there, but it sure
is
> >wasting a lot of bandwidth. I would like to hear any suggestions on what
may
> >have been done to slow this down, or any other nifty things that may
help. I
> >use IPTABLES as a firewall.
>
> >Unfortunately, the gateways are outside the firewall, so they are being
beat
> >up pretty bad. I can't move these inside (not my decision). I also don't
> >manage the gateways, so....
>
> Unless I'm missing something, how would connection requests on port 25,
being blocked by the firewall waste bandwidth?
>
> One thing you can do to slow down the perpetrators, is use DROP instead of
DENY or REJECT in your iptables for port 25, this will cause the system
attempting the connection to wait for a timeout.
>
>
> Steve
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ugob at CAMO-ROUTE.COM  Thu Nov 11 20:30:01 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:33 2006
Subject: OT - Firewall suggestion
Message-ID: <mailman.4583.1137101253.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Steve Campbell wrote:
> Traffic in or out is still traffic, and the firewall still has to DROP, DENY
> whatever. I have considered the DROP, but for now, I just quit logging these
> packets until the ISP returns my call. As each one is from a different IP,
> I'm hoping they will carry the ball and determine the real offender. The
> packets seem to average about 11 per second. Although this is nothing
> astronomical, it is a problem.
>

If you've got a firewall that is connected to the internet, there is
nothing you can do to prevent anyone sending packets to it.  The only
thing you can do is block them at an upstream level...

> Thanks for the suggestions, though.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From campbell at cnpapers.com  Thu Nov 11 20:56:13 2004
From: campbell at cnpapers.com (Steve Campbell)
Date: Thu Jan 12 21:27:33 2006
Subject: OT - Firewall suggestion
Message-ID: <mailman.4584.1137101253.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I agree. This  is what I was hoping the ISP could do, and also maybe do a
little legal prompting/investigative work.

Steve.
----- Original Message -----
From: "Ugo Bellavance" <ugob@CAMO-ROUTE.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Thursday, November 11, 2004 3:30 PM
Subject: Re: OT - Firewall suggestion


> Steve Campbell wrote:
> > Traffic in or out is still traffic, and the firewall still has to DROP,
DENY
> > whatever. I have considered the DROP, but for now, I just quit logging
these
> > packets until the ISP returns my call. As each one is from a different
IP,
> > I'm hoping they will carry the ball and determine the real offender. The
> > packets seem to average about 11 per second. Although this is nothing
> > astronomical, it is a problem.
> >
>
> If you've got a firewall that is connected to the internet, there is
> nothing you can do to prevent anyone sending packets to it.  The only
> thing you can do is block them at an upstream level...
>
> > Thanks for the suggestions, though.
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ugob at CAMO-ROUTE.COM  Thu Nov 11 21:08:12 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:33 2006
Subject: OT - Firewall suggestion
Message-ID: <mailman.4585.1137101253.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Steve Campbell wrote:
> I agree. This  is what I was hoping the ISP could do, and also maybe do a
> little legal prompting/investigative work.

For 11 packets/sec?  I doubt it, especially since it is not all the same
the same IP.  I think your best bet is DROP packets.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From llasad1 at YAHOO.COM  Thu Nov 11 21:49:12 2004
From: llasad1 at YAHOO.COM (lester lasad)
Date: Thu Jan 12 21:27:33 2006
Subject: off topic:  email forwarding assistance/guidance needed
Message-ID: <mailman.4586.1137101253.24926.mailscanner@lists.mailscanner.info>

--- Mike Kercher <mike@CAMAROSS.NET> wrote:

> lester lasad wrote:
> > --- "H.P. Noordam" <bno@SALVAGEBV.NL> wrote:
> >
> >> MailScanner mailing list
> >> <MAILSCANNER@JISCMAIL.AC.UK> wrote on 10/11/2004
> >> 16:47:01:
> >>
> >>> My MailScanner/Sendmail server is relaying email
> to 2
> >>> seperate domains.  A majority of my users (3000)
> have
> >>> email accounts in the "abc.com" domain, but we
> have
> >>> roughly 40 users that have an account in both
> the abc.com and
> >>> xyz.com domains.
> >>>
> >>> The 40 isers in the abc.com and xyz.com domain
> use both addresses at
> >>> this point but, I would like to deliver emails
> for both addresses
> >>> to one domain. example:  if lester@xyz.com
> receives an email I would
> >>> like sendmail to route the email to
> lester@abc.com (instead of the
> >>> xyz.com address).  The xyz.com
> >> domain
> >>> will be obsolete in the future but I can't get
> rid of
> >>> it yet but I would like to eliminate the xyz.com
> host
> >>> that sendmail is relaying to.
> >>>
> >>> Hopefully what I said makes sense, if not,
> please ask
> >>> for additional info.  Thanks in advance for your
> assistance.
> >>>
> >>>
> >>>
> >>
> >>
> >> the virtusertable (/etc/mail/virtusertable)
> enables you to map single
> >> users or complete domains to other recipients, so
> >> thats is the place to
> >> map *@xyz to *@abc.
> >>
> >> Bob.
> >>
> > Thanks for the info.  I did try to forward one
> > particular users email unsuccessfully and  wanted
> to
> > give you more specifics on my setup.
> >
> > my mailertable says the following:
> > abc.com    esmtp:abcmailsvr.abc.com
> > xyz.com    esmtp:xyzmailsvr.xyz.com
> >
> > I added the following to the
> /etc/mail/virtusertable:
> > lester@xyz.com      lester@abc.com  (which should
> send
> > the email to lester@abc.com)
> >
> > I then tried to send an email to lester@xyz.com
> and
> > received the following:
> > ----- The following addresses had permanent fatal
> > errors -----
> > <lester@xyz.com>
> >     (reason: 553 5.3.5 system config error)
> >
> >    ----- Transcript of session follows -----
> > 553 5.3.5 xyzmailsvr.xyz.com. config error: mail
> loops
> > back to me (MX
> > problem?)
> > 554 5.3.5 Local configuration error
> >
> > I must be missing something.  thanks.
> >
>
> Do you have abc.com and xyz.com in your
> /etc/mail/local-host-names or
> /etc/mail/relay-domains?  They should be in
> relay-domains.  Also, make sure
> you hashed your virtusertable to db.
>
> You will need to restart sendmail to read the
> relay-domains after
> modification.
>
> Mike
>
abc.com and xyz.com are not in
/etc/mail/local-host-names.  But, they are in
/etc/mail/relay-domains

forgive me, but I'm not sure what you mean by "make
sure you hashed your virtusertable to db"

I have restarted sendmail as well.  When I send the
email it is still routing to the xyz.com host and not
the abc.com host.  I want to take the xyz.com host out
of the picture.  Should I remove it from my
mailertable and see what happens?

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From campbell at cnpapers.com  Thu Nov 11 21:50:24 2004
From: campbell at cnpapers.com (Steve Campbell)
Date: Thu Jan 12 21:27:33 2006
Subject: OT - Firewall suggestion
Message-ID: <mailman.4587.1137101253.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

OK, so maybe I'm overly excited about a little of nothing. For the most
part, the no-logging takes care of most of this. The DROP will happen next
when I need it. Based on my log files, it seemed a lot bigger than 11/sec,
and it may have been originally.

Anyways, thanks for all the great suggestions and help.

END OF THREAD

Steve Campbell


----- Original Message -----
From: "Ugo Bellavance" <ugob@CAMO-ROUTE.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Thursday, November 11, 2004 4:08 PM
Subject: Re: OT - Firewall suggestion


> Steve Campbell wrote:
> > I agree. This  is what I was hoping the ISP could do, and also maybe do
a
> > little legal prompting/investigative work.
>
> For 11 packets/sec?  I doubt it, especially since it is not all the same
> the same IP.  I think your best bet is DROP packets.
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From kte at NEXIS.BE  Fri Nov 12 09:57:48 2004
From: kte at NEXIS.BE (Koen Teugels)
Date: Thu Jan 12 21:27:33 2006
Subject: {Scanned} Re: ProcessClamAVOutput: unrecognised line ... contact
    the authors
Message-ID: <mailman.4588.1137101253.24926.mailscanner@lists.mailscanner.info>

just test the copfilter-0.0.95.tgz with bitdefender only and he lets the
eicar virus pass. When I put the virus direct or in a simple zip files
he doesn't pass.
But the copfilter-0.0.95.tgz virusscan gives as output in maillog
viruses found. But doesn't do anything with it.

tanks Koen


Julian Field wrote:

> Please upgrade your clamav to the latest CVS version available from
> www.clamav.net and try the test again.
>
> Koen Teugels wrote:
>
>> Virus Scanners = clamav bitdefender
>> clamav is at version 0.80.1 and bitdefender
>> BitDefender-Console-Antivirus-7.0.1-3.linux-gcc3x.i586.rpm
>> Bt they let pass the attachment copfilter-0.0.95.tgz with the eicar test
>> virus in it with status clean.
>> I use a  RHEL clone with the latest yum updates.
>> version MailScanner-4.35.11-1.rpm.tar.gz with spamassassin 3.0.1 and
>> plugins DCC, razor and ...
>> Just a standard install no custom rules yet.
>>
>> Thanks Koen
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From kte at NEXIS.BE  Fri Nov 12 09:59:25 2004
From: kte at NEXIS.BE (Koen Teugels)
Date: Thu Jan 12 21:27:33 2006
Subject: {Scanned} bitdefender doesn't update
Message-ID: <mailman.4589.1137101253.24926.mailscanner@lists.mailscanner.info>

I don't think the bitdefender updates. Plugins dates stay at the time of
install. And when i do an bdc --update there are changes.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From viers at UNILIM.FR  Fri Nov 12 10:06:33 2004
From: viers at UNILIM.FR (Nicolas Viers - SCI Limoges)
Date: Thu Jan 12 21:27:33 2006
Subject: mailq
Message-ID: <mailman.4590.1137101253.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi,
is there a command equivalent to mailq with sendmail to visualize 
mqueue.in ?
Thanks

-- 

____________________________________________________________

Nicolas Viers               |  Service Commun Informatique
Mél: viers@unilim.fr        |  123, avenue Albert Thomas
                            |     87060 Limoges cedex
Tel: 05-55-45-77-09         |  Fax: 05-55-45-75-95
                  http://www.unilim.fr/sci  
____________________________________________________________

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Fri Nov 12 10:21:42 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:33 2006
Subject: Issue with outlook messages decode
Message-ID: <mailman.4591.1137101253.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

You have not installed the new MIME::Base64 and QuotedPrint modules. This
error message has been posted to this list many times before, along with
the explanation :-)

You will find that &#8220;MailScanner &#8211;v&#8221; will report version
2.something for MIME::Base64 and MIME::QuotedPrint. It should report
version 3.something.

Either use CPAN to upgrade MIME::Base64 (which will automatically do the
QuotedPrint bit as well), or run my ./install.sh script and make sure it
successfully built and installed the modules.

Did you install using my ./install.sh script?

On 11/11/04 10:25 pm, "Justin Cain" <jcain@CSPACEINTERACTIVE.COM> wrote:

      All,

      Having a problem with mailscanner decoding of messages sent
      form microsoft clients sending rich text or HTML. I have
      tried turning off the TNEF expander and also setting
      mailscanner to deliver the unparsable TNEF. I have also tried
      both the internal perl module and the external executable.
      After a little more digging I'm thinking that the problem
      occurs before the TNEF even gets kicked off.   It appears
      that the MIME Decoder module is having a problem initializing
      the QuotedPrint object when and HTML or Rich text email is
      recieved from a MS client (plain text are fine) also
      HTML/richtext from evolution is fine. The following error
      appears in the maillog.  

      Cannot parse
      /var/spool/MailScanner/incoming/7895/4636B211F42.header and ,
      Can't locate object method "init" v\
      ia package "MIME::Decoder::QuotedPrint" at
      /usr/lib/perl5/site_perl/5.8.5/MIME/Decoder.pm line 179.

      I have noticed that there is more than one QuotedPrint perl
      module on the box, I not really a perl guy so I not sure how
      all this effects things

      locate QuotedPrint
      /usr/share/man/man3/PerlIO::via::QuotedPrint.3pm.gz
      /usr/share/man/man3/MIME::QuotedPrint.3pm.gz
      /usr/share/man/man3/MIME::Decoder::QuotedPrint.3pm.gz
      /usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/MIME/QuotedPrint.pm
      /usr/lib/perl5/5.8.5/PerlIO/via/QuotedPrint.pm
      /usr/lib/perl5/5.8.5/i386-linux-thread-multi/MIME/QuotedPrint.pm
      /usr/lib/perl5/site_perl/5.8.5/MIME/Decoder/QuotedPrint.pm

       
      System info

      SMP x86_64 running fedora core 3
      perl 5.8.5
      mailscanner-4.35.11-1 (rpm install)
      ------------------------ MailScanner list
      ------------------------ To unsubscribe, email
      jiscmail@jiscmail.ac.uk with the words:
      'leave mailscanner' in the body of the email.
      Before posting, read the MAQ
      (http://www.mailscanner.biz/maq/)
      and the archives
      (http://www.jiscmail.ac.uk/lists/mailscanner.html).



--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Fri Nov 12 10:23:20 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:33 2006
Subject: MAX message size - MAX attachment size
Message-ID: <mailman.4592.1137101253.24926.mailscanner@lists.mailscanner.info>

That size does include all attachments.


On 12/11/04 6:09 am, "Dave Filchak" <dfilchak@sympatico.ca> wrote:

> Quick question around message size and attachment size. When you set Maximum
> Message Size in MS, does that size include any attachments or must the
> Maximum Attachment Size be set as well?
>
> Dave
>
> David Filchak
> President - Zuka Inc.
> Toronto, On Canada M5V2J1
> www.zuka.net | www.screamingmedia.ca
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Fri Nov 12 10:24:38 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:33 2006
Subject: {Scanned} bitdefender doesn't update
Message-ID: <mailman.4593.1137101253.24926.mailscanner@lists.mailscanner.info>

Check to ensure that the bitdefender line in
/etc/MailScanner/virus.scanners.conf is pointing to where you have installed
bd.

On 12/11/04 9:59 am, "Koen Teugels" <kte@NEXIS.BE> wrote:
> I don't think the bitdefender updates. Plugins dates stay at the time of
> install. And when i do an bdc --update there are changes.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Fri Nov 12 10:25:51 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:33 2006
Subject: mailq
Message-ID: <mailman.4594.1137101253.24926.mailscanner@lists.mailscanner.info>

On 12/11/04 10:06 am, "Nicolas Viers - SCI Limoges" <viers@UNILIM.FR> wrote:

> Hi,
> is there a command equivalent to mailq with sendmail to visualize
> mqueue.in ?
> Thanks

mailq -OQueueDirectory=/var/spool/mqueue.in

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From kte at NEXIS.BE  Fri Nov 12 10:34:46 2004
From: kte at NEXIS.BE (Koen Teugels)
Date: Thu Jan 12 21:27:33 2006
Subject: {Scanned} Re: {Scanned} bitdefender doesn't update
Message-ID: <mailman.4595.1137101253.24926.mailscanner@lists.mailscanner.info>

bitdefender is installed in /opt/bdc so that is the standard config. I
can see in maillog bitdefender found and updating. But never bitdefender
updated or no updates needed as with clamav.
So I checked the installation and there are no files that have been
updated. Only when I do bdc --update I see some change. So I think there
is a problem with the bitdefender-wrapper.

thanks koen

Julian Field wrote:

 Check to ensure that the bitdefender line in
/etc/MailScanner/virus.scanners.conf is pointing to where you have installed
bd.

On 12/11/04 9:59 am, "Koen Teugels" <kte@NEXIS.BE> wrote:
  

 I don't think the bitdefender updates. Plugins dates stay at the time of
install. And when i do an bdc --update there are changes.
    

 --
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
  

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From john at OMEGADATA.NO  Fri Nov 12 10:42:54 2004
From: john at OMEGADATA.NO (John Berntsen)
Date: Thu Jan 12 21:27:33 2006
Subject: SV: {Scanned} Re: {Scanned} bitdefender doesn't update
Message-ID: <mailman.4596.1137101253.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I can confirm this, at first there were a problem where the script would
hang up
causing a lot of them to take up memory and cpu, that became fixed, but
still it does not upgrade bitdefender.
 

Med vennlig hilsen / Regards
John Berntsen


________________________________________________________________________________
Fra: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] Pĺ
vegne av Koen Teugels
Sendt: 12. november 2004 11:35
Til: MAILSCANNER@JISCMAIL.AC.UK
Emne: {Scanned} Re: {Scanned} bitdefender doesn't update

bitdefender is installed in /opt/bdc so that is the standard config. I
can see in maillog bitdefender found and updating. But never bitdefender
updated or no updates needed as with clamav.
So I checked the installation and there are no files that have been
updated. Only when I do bdc --update I see some change. So I think there
is a problem with the bitdefender-wrapper.

thanks koen

Julian Field wrote:

 Check to ensure that the bitdefender line in
/etc/MailScanner/virus.scanners.conf is pointing to where you have installed
bd.

On 12/11/04 9:59 am, "Koen Teugels" <kte@NEXIS.BE> wrote:
  

 I don't think the bitdefender updates. Plugins dates stay at the time of
install. And when i do an bdc --update there are changes.
    

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
  

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From martinh at SOLID-STATE-LOGIC.COM  Fri Nov 12 10:50:50 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:33 2006
Subject: Phishing detection - FYI
Message-ID: <mailman.4597.1137101253.24926.mailscanner@lists.mailscanner.info>

Julian

We've noticed that lots of HTML based email newsletters, esp from
electronics part manufacturers, have broken phishing style URL's in them.

I'm updating a ruleset to cope with this, but it is a problem with FP's
for people to watch out for.

IE people get used to the MailScanner warning message and ignore it as
white noise when an actual phishing style scam gets though.

I guess I could update to SA 3.01 and usethe Multi Surbl list's phishing
secton as well as the CLAMAV dectecton I currently use which seems to be
trapping the phishing stuff quite well anyway.



--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From david.hooton at gmail.com  Fri Nov 12 11:38:08 2004
From: david.hooton at gmail.com (David Hooton)
Date: Thu Jan 12 21:27:33 2006
Subject: Deliver Cleaned Messages = yes
Message-ID: <mailman.4598.1137101253.24926.mailscanner@lists.mailscanner.info>

Hi All,

We've recently turned on the deliver cleaned messages option so that
when an attachment (non virus) is blocked the recipient is alerted.
The unfortunate side effect of this is that virus stripped messages
are now also being delivered.

I can't see any option in MailScanner.conf that will allow us to not
deliver stripped viruses but to still deliver messages which have had
attachments stripped.

If the feature doesn't currently exist, is it possible to make these 2
classes of messages separate so I can control which of the 2 are
delivered to users?

Thanks for your hard work Julian, it's greatly appreciated!
--
Regards,

David Hooton

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From jkf at ecs.soton.ac.uk  Fri Nov 12 11:47:49 2004
From: jkf at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:33 2006
Subject: Deliver Cleaned Messages = yes
Message-ID: <mailman.4599.1137101253.24926.mailscanner@lists.mailscanner.info>

On 12/11/04 11:38 am, "David Hooton" <david.hooton@gmail.com> wrote:
> Hi All,
>
> We've recently turned on the deliver cleaned messages option so that
> when an attachment (non virus) is blocked the recipient is alerted.
> The unfortunate side effect of this is that virus stripped messages
> are now also being delivered.
>
> I can't see any option in MailScanner.conf that will allow us to not
> deliver stripped viruses but to still deliver messages which have had
> attachments stripped.

You are looking for
Still Deliver Silent Viruses = no

> If the feature doesn't currently exist, is it possible to make these 2
> classes of messages separate so I can control which of the 2 are
> delivered to users?
>
> Thanks for your hard work Julian, it's greatly appreciated!

Thanks!
--
Julian Field
jkf@ecs.soton.ac.uk
Teaching Systems Manager
Electronics & Computer Science
University of Southampton
SO17 1BJ, UK

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From sylvain.phaneuf at IMSU.OXFORD.AC.UK  Fri Nov 12 11:57:43 2004
From: sylvain.phaneuf at IMSU.OXFORD.AC.UK (Sylvain Phaneuf)
Date: Thu Jan 12 21:27:33 2006
Subject: Phishing net improvement
Message-ID: <mailman.4600.1137101253.24926.mailscanner@lists.mailscanner.info>

Hi,

I am trying to patch my MS (4.35.9) with the patch and I can't make it
to work. I have followed the instructions below, but I get an error
message. I have patched Message.pm before as per Julian's instructions,
and it was always successful.

First of all the Message.pm file on my system is
/opt/MailScanner/lib/MailScanner
If I run that patch command
patch < /tmp/Message.pm.phishing.patch
I get the following error:

patching file Message.pm
Hunk #2 FAILED at 4057.
1 out of 2 hunks FAILED -- saving rejects to file Message.pm.rej

here is the content of Message.pm.rej:

***************
*** 4055,4063 ****
        $linkurl =~ s/\%a0//g;
        $linkurl =~ s#%([0-9a-f][0-9a-f])#chr(hex('0x' . $1))#gei; #
Unescape
        $linkurl =~ s/\s+//; # Remove any whitespace
        $linkurl =~ s/^(https?|ftp):\/\///;
        $linkurl =~ s/\/.*$//; # Only compare up to the first '/'
(hostname only)
-       $linkurl =~ s/\<\/?(br|p)\>$//i; # Remove trailing <br> and <p>
tags
        $linkurl =~ s/\/$//; # LinkURL is trimmed -- note
        #print STDERR "2SquashedText = \"$squashedtext\"\n";
        #print STDERR "2LinkURL      = \"$linkurl\"\n";
--- 4057,4067 ----
        $linkurl =~ s/\%a0//g;
        $linkurl =~ s#%([0-9a-f][0-9a-f])#chr(hex('0x' . $1))#gei; #
Unescape
        $linkurl =~ s/\s+//; # Remove any whitespace
+       #$linkurl =~ s/(\<\/?[^>]*\>)*//ig; # Remove tags
+       #$linkurl =~ s/^(\<\/?(br|p|ul)\>)*//ig; # Remove leading br,
p, ul tags
        $linkurl =~ s/^(https?|ftp):\/\///;
        $linkurl =~ s/\/.*$//; # Only compare up to the first '/'
(hostname only)
+       $linkurl =~ s/(\<\/?(br|p|ul)\>)*$//ig; # Remove trailing br,
p, ul tags
        $linkurl =~ s/\/$//; # LinkURL is trimmed -- note
        #print STDERR "2SquashedText = \"$squashedtext\"\n";
        #print STDERR "2LinkURL      = \"$linkurl\"\n";


Can someone help please?

Regards,

Sylvain



===========================================================
Sylvain Phaneuf --- Systems Manager   | phone : +44 (0)1865 221323
Clinical School Information Management Services Unit  (IMSU)
Medical Sciences Division
University of Oxford                                  |   email :
sylvain.phaneuf@imsu.ox.ac.uk
Room 3A25B John Radcliffe Hospital      |   fax :  +44 (0) 1865 221322
Oxford   OX3 9DU   England
===========================================================

>>> mailscanner@ECS.SOTON.AC.UK 09/11/2004 10:37:28 >>>
Save the patch file into /tmp then do this:

cd /usr/lib/MailScanner/MailScanner
patch < /tmp/Message.pm.phishing.patch
service MailScanner restart


On 9/11/04 10:24 am, "Carinus Carelse" <carinus.carelse@MRC.AC.ZA>
wrote:

> Can someone direct me to how do install this patch please.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Fri Nov 12 12:08:12 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:33 2006
Subject: Never getting URIBL_PH_SURBL hits
Message-ID: <mailman.4601.1137101253.24926.mailscanner@lists.mailscanner.info>

Just to prove I am in fact mortal after all, here's a weird one for you.

Running SA3.0.1 within MS on a couple of Solaris boxes.

I get plenty of SURBL hits, as you would expect, like this:
URIBL_OB_SURBL 3.21, URIBL_SBL 1.00, URIBL_SC_SURBL 4.26, URIBL_WS_SURBL
1.46

So the SURBL stuff is basically working very happily.

But I never get a hit on URIBL_PH_SURBL (the anti-phishing list).

I am using an rsync-ed local copy of the BIND zone files for the SURBL
zones, including multi.surbl.org. These are correctly being updated
regularly, and are being read by BIND (it thumps the "accessed" datestamp
correctly). No errors reported by BIND, and the multi zone file does indeed
contain many domains for the PH list.

And yes, I've run MS in debug mode with SA in debug mode as well, and it
reports all the correct directories and files as it reads them, doesn't
complain about any errors in them at all.

Everything seems absolutely fine and hunky-dory, all the other SURBLs work
as expected, but I never get a URIBL_PH_SURBL hit.

Anyone got any ideas on this one?
--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Fri Nov 12 12:11:53 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:33 2006
Subject: Phishing net improvement
Message-ID: <mailman.4602.1137101253.24926.mailscanner@lists.mailscanner.info>

The code there changed quite a bit between 4.35.9 and 4.35.11 if I remember
correctly.

<hack type="nasty">Unpack the 4.35.11 distribution and start from the
Message.pm file in there. Backup your 4.35.9 Message.pm first, but you
should be able to copy the 4.35.11(+patch) Message.pm file over the top of
your 4.35.9 file.</hack>

The "correct" solution of course is to just upgrade from 4.35.9 to 4.35.11,
then apply the patch.


On 12/11/04 11:57 am, "Sylvain Phaneuf" <sylvain.phaneuf@IMSU.OXFORD.AC.UK>
wrote:

> Hi,
>
> I am trying to patch my MS (4.35.9) with the patch and I can't make it
> to work. I have followed the instructions below, but I get an error
> message. I have patched Message.pm before as per Julian's instructions,
> and it was always successful.
>
> First of all the Message.pm file on my system is
> /opt/MailScanner/lib/MailScanner
> If I run that patch command
> patch < /tmp/Message.pm.phishing.patch
> I get the following error:
>
> patching file Message.pm
> Hunk #2 FAILED at 4057.
> 1 out of 2 hunks FAILED -- saving rejects to file Message.pm.rej
>
> here is the content of Message.pm.rej:
>
> ***************
> *** 4055,4063 ****
>         $linkurl =~ s/\%a0//g;
>         $linkurl =~ s#%([0-9a-f][0-9a-f])#chr(hex('0x' . $1))#gei; #
> Unescape
>         $linkurl =~ s/\s+//; # Remove any whitespace
>         $linkurl =~ s/^(https?|ftp):\/\///;
>         $linkurl =~ s/\/.*$//; # Only compare up to the first '/'
> (hostname only)
> -       $linkurl =~ s/\<\/?(br|p)\>$//i; # Remove trailing <br> and <p>
> tags
>         $linkurl =~ s/\/$//; # LinkURL is trimmed -- note
>         #print STDERR "2SquashedText = \"$squashedtext\"\n";
>         #print STDERR "2LinkURL      = \"$linkurl\"\n";
> --- 4057,4067 ----
>         $linkurl =~ s/\%a0//g;
>         $linkurl =~ s#%([0-9a-f][0-9a-f])#chr(hex('0x' . $1))#gei; #
> Unescape
>         $linkurl =~ s/\s+//; # Remove any whitespace
> +       #$linkurl =~ s/(\<\/?[^>]*\>)*//ig; # Remove tags
> +       #$linkurl =~ s/^(\<\/?(br|p|ul)\>)*//ig; # Remove leading br,
> p, ul tags
>         $linkurl =~ s/^(https?|ftp):\/\///;
>         $linkurl =~ s/\/.*$//; # Only compare up to the first '/'
> (hostname only)
> +       $linkurl =~ s/(\<\/?(br|p|ul)\>)*$//ig; # Remove trailing br,
> p, ul tags
>         $linkurl =~ s/\/$//; # LinkURL is trimmed -- note
>         #print STDERR "2SquashedText = \"$squashedtext\"\n";
>         #print STDERR "2LinkURL      = \"$linkurl\"\n";
>
>
> Can someone help please?

>>>> mailscanner@ECS.SOTON.AC.UK 09/11/2004 10:37:28 >>>
> Save the patch file into /tmp then do this:
>
> cd /usr/lib/MailScanner/MailScanner
> patch < /tmp/Message.pm.phishing.patch
> service MailScanner restart
>
>
> On 9/11/04 10:24 am, "Carinus Carelse" <carinus.carelse@MRC.AC.ZA>
> wrote:
>
>> Can someone direct me to how do install this patch please.


--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From raymond at PROLOCATION.NET  Fri Nov 12 12:18:11 2004
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:27:33 2006
Subject: Never getting URIBL_PH_SURBL hits
Message-ID: <mailman.4603.1137101253.24926.mailscanner@lists.mailscanner.info>

Julian,

> And yes, I've run MS in debug mode with SA in debug mode as well, and it
> reports all the correct directories and files as it reads them, doesn't
> complain about any errors in them at all.
>
> Everything seems absolutely fine and hunky-dory, all the other SURBLs work
> as expected, but I never get a URIBL_PH_SURBL hit.
>
> Anyone got any ideas on this one?

The PH list is relatively small, so the number of hits also i guess. The
list is recently merged so its somehow bigger since today. My experience
however is that JP also picks them out. Sites like ebayupgrade. org are
listed in JP also. You would expect them inside PH, but the point is they
are getting out anyway ;)

Today Jeff wrote on the SURBL list:

'Thanks for your feedback David.  Based on your feedback and
others, I went ahead and merged the fraud.rhs.mailpolice.com data
in with your mailsecurity.net.au phishing list into ph.surbl.org.

Overlap between these two lists was only 36 records, and combining
the lists has approximately doubled the size of the ph.surbl.org
to about 1000 records.'

So perhaps you get some hits now.

Bye,
Raymond.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From sylvain.phaneuf at IMSU.OXFORD.AC.UK  Fri Nov 12 12:28:24 2004
From: sylvain.phaneuf at IMSU.OXFORD.AC.UK (Sylvain Phaneuf)
Date: Thu Jan 12 21:27:33 2006
Subject: Phishing net improvement
Message-ID: <mailman.4604.1137101253.24926.mailscanner@lists.mailscanner.info>

Thanks Julian, I will upgrade to 4.35.11 and try the patch.

Sylvain


>>> mailscanner@ECS.SOTON.AC.UK 12/11/2004 12:11:53 >>>
The code there changed quite a bit between 4.35.9 and 4.35.11 if I
remember
correctly.

<hack type="nasty">Unpack the 4.35.11 distribution and start from the
Message.pm file in there. Backup your 4.35.9 Message.pm first, but you
should be able to copy the 4.35.11(+patch) Message.pm file over the top
of
your 4.35.9 file.</hack>

The "correct" solution of course is to just upgrade from 4.35.9 to
4.35.11,
then apply the patch.


On 12/11/04 11:57 am, "Sylvain Phaneuf"
<sylvain.phaneuf@IMSU.OXFORD.AC.UK>
wrote:

> Hi,
>
> I am trying to patch my MS (4.35.9) with the patch and I can't make
it
> to work. I have followed the instructions below, but I get an error
> message. I have patched Message.pm before as per Julian's
instructions,
> and it was always successful.
>
> First of all the Message.pm file on my system is
> /opt/MailScanner/lib/MailScanner
> If I run that patch command
> patch < /tmp/Message.pm.phishing.patch
> I get the following error:
>
> patching file Message.pm
> Hunk #2 FAILED at 4057.
> 1 out of 2 hunks FAILED -- saving rejects to file Message.pm.rej
>
> here is the content of Message.pm.rej:
>
> ***************
> *** 4055,4063 ****
>         $linkurl =~ s/\%a0//g;
>         $linkurl =~ s#%([0-9a-f][0-9a-f])#chr(hex('0x' . $1))#gei; #
> Unescape
>         $linkurl =~ s/\s+//; # Remove any whitespace
>         $linkurl =~ s/^(https?|ftp):\/\///;
>         $linkurl =~ s/\/.*$//; # Only compare up to the first '/'
> (hostname only)
> -       $linkurl =~ s/\<\/?(br|p)\>$//i; # Remove trailing <br> and
<p>
> tags
>         $linkurl =~ s/\/$//; # LinkURL is trimmed -- note
>         #print STDERR "2SquashedText = \"$squashedtext\"\n";
>         #print STDERR "2LinkURL      = \"$linkurl\"\n";
> --- 4057,4067 ----
>         $linkurl =~ s/\%a0//g;
>         $linkurl =~ s#%([0-9a-f][0-9a-f])#chr(hex('0x' . $1))#gei; #
> Unescape
>         $linkurl =~ s/\s+//; # Remove any whitespace
> +       #$linkurl =~ s/(\<\/?[^>]*\>)*//ig; # Remove tags
> +       #$linkurl =~ s/^(\<\/?(br|p|ul)\>)*//ig; # Remove leading
br,
> p, ul tags
>         $linkurl =~ s/^(https?|ftp):\/\///;
>         $linkurl =~ s/\/.*$//; # Only compare up to the first '/'
> (hostname only)
> +       $linkurl =~ s/(\<\/?(br|p|ul)\>)*$//ig; # Remove trailing
br,
> p, ul tags
>         $linkurl =~ s/\/$//; # LinkURL is trimmed -- note
>         #print STDERR "2SquashedText = \"$squashedtext\"\n";
>         #print STDERR "2LinkURL      = \"$linkurl\"\n";
>
>
> Can someone help please?

>>>> mailscanner@ECS.SOTON.AC.UK 09/11/2004 10:37:28 >>>
> Save the patch file into /tmp then do this:
>
> cd /usr/lib/MailScanner/MailScanner
> patch < /tmp/Message.pm.phishing.patch
> service MailScanner restart
>
>
> On 9/11/04 10:24 am, "Carinus Carelse" <carinus.carelse@MRC.AC.ZA>
> wrote:
>
>> Can someone direct me to how do install this patch please.


--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From david.hooton at gmail.com  Fri Nov 12 12:39:52 2004
From: david.hooton at gmail.com (David Hooton)
Date: Thu Jan 12 21:27:33 2006
Subject: Never getting URIBL_PH_SURBL hits
Message-ID: <mailman.4605.1137101253.24926.mailscanner@lists.mailscanner.info>

On Fri, 12 Nov 2004 12:08:12 +0000, Julian Field
<mailscanner@ecs.soton.ac.uk> wrote:
>
> But I never get a hit on URIBL_PH_SURBL (the anti-phishing list).
>
> Everything seems absolutely fine and hunky-dory, all the other SURBLs work
> as expected, but I never get a URIBL_PH_SURBL hit.
>
> Anyone got any ideas on this one?

Strangely enough, I may be of assistance here :)

Phishing is one of the more geographically specific versions of
spam/virii that I've ever seen.  Phishes are becoming increasingly
better geographically targeted as time goes by, so to be effective in
blocking them you need as large of a catchment area as you can
possibly get your hands on.

The PH list is currently relying on submitted and intercepted messages
from only a few locations in the world.  We're trying to develop a
wider catchment for this data, however some of the better collection
sources are proving quite difficult to gain data feeds from.

The PH list has been fairly heavily tilted toward an Australian view
of the Internet because that's where we have our main collection
points.  We are very keen however to gain a more holistic view of the
internet.

If anyone is willing to contribute, please either forward your
messages to postmaster @ corp.mailsecurity.net.au or contact me
directly so we can discuss how you can help.
--
Kind Regards,

David Hooton

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ckowarzik at EMAIL.DE  Fri Nov 12 12:56:42 2004
From: ckowarzik at EMAIL.DE (Christian Kowarzik)
Date: Thu Jan 12 21:27:33 2006
Subject: {Scanned} bitdefender doesn't update
Message-ID: <mailman.4606.1137101253.24926.mailscanner@lists.mailscanner.info>

Koen Teugels wrote:
> I don't think the bitdefender updates. Plugins dates stay at the time of
> install. And when i do an bdc --update there are changes.

In the script /usr/lib/MailScanner/bitdefender-autoupdate it's function countViruses($file) is
missing the input file and then it dies rather than logging the error and then continuing.

I found out, that the commands which should create the input files for countViruses($file) are
out-commented:
#JKF system  "$bitDCmd > $origFile ";
#JKF system  "$bitDCmd > $destFile ";

I removed the '#JKF ' at the beginning of these two lines and everything is working fine...

My configuration:
RedHat Enterprise Linux ES 3
perl-5.8.0-88.7
MailScanner-4.35.9-1

Chris

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From kte at NEXIS.BE  Fri Nov 12 13:30:33 2004
From: kte at NEXIS.BE (Koen Teugels)
Date: Thu Jan 12 21:27:33 2006
Subject: {Scanned} Re: ProcessClamAVOutput: unrecognised line ... contact
    the authors
Message-ID: <mailman.4607.1137101253.24926.mailscanner@lists.mailscanner.info>

Could it be that mailscanner has problems with .tgz extensions??


just test the copfilter-0.0.95.tgz with bitdefender only and he lets the
eicar virus pass. When I put the virus direct or in a simple zip files
he doesn't pass.
But the copfilter-0.0.95.tgz virusscan gives as output in maillog
viruses found. But doesn't do anything with it.

thanks Koen


Julian Field wrote:

> Please upgrade your clamav to the latest CVS version available from
> www.clamav.net and try the test again.
>
> Koen Teugels wrote:
>
>> Virus Scanners = clamav bitdefender
>> clamav is at version 0.80.1 and bitdefender
>> BitDefender-Console-Antivirus-7.0.1-3.linux-gcc3x.i586.rpm
>> Bt they let pass the attachment copfilter-0.0.95.tgz with the eicar test
>> virus in it with status clean.
>> I use a  RHEL clone with the latest yum updates.
>> version MailScanner-4.35.11-1.rpm.tar.gz with spamassassin 3.0.1 and
>> plugins DCC, razor and ...
>> Just a standard install no custom rules yet.
>>
>> Thanks Koen
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Fri Nov 12 13:33:52 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:33 2006
Subject: {Scanned} bitdefender doesn't update
Message-ID: <mailman.4608.1137101253.24926.mailscanner@lists.mailscanner.info>

Can other people confirm this please? I didn't write the original script and
it's horribly complicated, and the comments are all in Italian :-(


On 12/11/04 12:56 pm, "Christian Kowarzik" <ckowarzik@EMAIL.DE> wrote:

> Koen Teugels wrote:
>> I don't think the bitdefender updates. Plugins dates stay at the time of
>> install. And when i do an bdc --update there are changes.
>
> In the script /usr/lib/MailScanner/bitdefender-autoupdate it's function
> countViruses($file) is
> missing the input file and then it dies rather than logging the error and then
> continuing.
>
> I found out, that the commands which should create the input files for
> countViruses($file) are
> out-commented:
> #JKF system  "$bitDCmd > $origFile ";
> #JKF system  "$bitDCmd > $destFile ";
>
> I removed the '#JKF ' at the beginning of these two lines and everything is
> working fine...
>
> My configuration:
> RedHat Enterprise Linux ES 3
> perl-5.8.0-88.7
> MailScanner-4.35.9-1
>
> Chris
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From kte at NEXIS.BE  Fri Nov 12 13:38:53 2004
From: kte at NEXIS.BE (Koen Teugels)
Date: Thu Jan 12 21:27:33 2006
Subject: {Scanned} Re: {Scanned} bitdefender doesn't update
Message-ID: <mailman.4609.1137101253.24926.mailscanner@lists.mailscanner.info>

I tested it and changed this and it looks likes it updates now.

thanks for this

Julian Field wrote:

 Can other people confirm this please? I didn't write the original script and
it's horribly complicated, and the comments are all in Italian :-(


On 12/11/04 12:56 pm, "Christian Kowarzik" <ckowarzik@EMAIL.DE> wrote:

  

 Koen Teugels wrote:
    

 I don't think the bitdefender updates. Plugins dates stay at the time of
install. And when i do an bdc --update there are changes.
      

 In the script /usr/lib/MailScanner/bitdefender-autoupdate it's function
countViruses($file) is
missing the input file and then it dies rather than logging the error and then
continuing.

I found out, that the commands which should create the input files for
countViruses($file) are
out-commented:
#JKF system  "$bitDCmd > $origFile ";
#JKF system  "$bitDCmd > $destFile ";

I removed the '#JKF ' at the beginning of these two lines and everything is
working fine...

My configuration:
RedHat Enterprise Linux ES 3
perl-5.8.0-88.7
MailScanner-4.35.9-1

Chris

    

 --
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!
  



--
                                  Koen Teugels
                                n.v. NEXIS s.a.
                            Leuvensesteenweg 542 b.6
                                 1930 Zaventem
                                    BELGIUM

Visit us at http://www.nexis.be
                             e-mail : kte@nexis.be
                            tel.: +32 (0)2 720.51.51
                            fax: +32 (0)2 720.22.42
                       visit us at : http://www.nexis.be



------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Image/JPEG  13KB. ]
    [ Unable to print this part. ]


From alex at nkpanama.com  Fri Nov 12 13:44:05 2004
From: alex at nkpanama.com (Alex Neuman van der Hans)
Date: Thu Jan 12 21:27:33 2006
Subject: {Scanned} Re: {Scanned} bitdefender doesn't update
Message-ID: <mailman.4610.1137101253.24926.mailscanner@lists.mailscanner.info>

It didn't work for me (plus it gave me problems a few weeks ago) so I
remember I disabled it and chose to use "bdc --update" from cron.

________________________________________________________________________________
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Koen Teugels
Sent: Friday, November 12, 2004 8:39 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: {Scanned} Re: {Scanned} bitdefender doesn't update

I tested it and changed this and it looks likes it updates now.

thanks for this

Julian Field wrote:

 Can other people confirm this please? I didn't write the original script and
it's horribly complicated, and the comments are all in Italian :-(


On 12/11/04 12:56 pm, "Christian Kowarzik" <ckowarzik@EMAIL.DE> wrote:

  

 Koen Teugels wrote:
    

 I don't think the bitdefender updates. Plugins dates stay at the time of
install. And when i do an bdc --update there are changes.
      

In the script /usr/lib/MailScanner/bitdefender-autoupdate it's function
countViruses($file) is
missing the input file and then it dies rather than logging the error and then
continuing.

I found out, that the commands which should create the input files for
countViruses($file) are
out-commented:
#JKF system  "$bitDCmd > $origFile ";
#JKF system  "$bitDCmd > $destFile ";

I removed the '#JKF ' at the beginning of these two lines and everything is
working fine...

My configuration:
RedHat Enterprise Linux ES 3
perl-5.8.0-88.7
MailScanner-4.35.9-1

Chris

    

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!
  



--
                                  Koen Teugels
                                n.v. NEXIS s.a.
                            Leuvensesteenweg 542 b.6
                                 1930 Zaventem
                                    BELGIUM

Visit us at http://www.nexis.be
                             e-mail : kte@nexis.be
                            tel.: +32 (0)2 720.51.51
                            fax: +32 (0)2 720.22.42
                       visit us at : http://www.nexis.be



------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Image/JPEG  13KB. ]
    [ Unable to print this part. ]


From kte at NEXIS.BE  Fri Nov 12 13:46:20 2004
From: kte at NEXIS.BE (Koen Teugels)
Date: Thu Jan 12 21:27:33 2006
Subject: {Scanned} Re: {Scanned} Re: ProcessClamAVOutput: unrecognised line
    ... contact the authors
Message-ID: <mailman.4611.1137101253.24926.mailscanner@lists.mailscanner.info>

Just did some more testing. And I don't think it is the virus scanner.
Because I tried another one and the virus still passes. So i think it
must be the unzip / tar that has a problem. all tgz have this problem.

Koen

Koen Teugels wrote:
      Could it be that mailscanner has problems with .tgz
      extensions??


      just test the copfilter-0.0.95.tgz with bitdefender only and
      he lets the
      eicar virus pass. When I put the virus direct or in a simple
      zip files
      he doesn't pass.
      But the copfilter-0.0.95.tgz virusscan gives as output in
      maillog
      viruses found. But doesn't do anything with it.

      thanks Koen


      Julian Field wrote:

            Please upgrade your clamav to the latest CVS
            version available from
            www.clamav.net and try the test again.

            Koen Teugels wrote:

                  Virus Scanners = clamav bitdefender
                  clamav is at version 0.80.1 and
                  bitdefender
                  BitDefender-Console-Antivirus-7.0.1-3.linux-gcc3x.i586.rpm
                  Bt they let pass the attachment
                  copfilter-0.0.95.tgz with the eicar
                  test
                  virus in it with status clean.
                  I use a  RHEL clone with the latest
                  yum updates.
                  version
                  MailScanner-4.35.11-1.rpm.tar.gz with
                  spamassassin 3.0.1 and
                  plugins DCC, razor and ...
                  Just a standard install no custom
                  rules yet.

                  Thanks Koen



      ------------------------ MailScanner list
      ------------------------
      To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
      'leave mailscanner' in the body of the email.
      Before posting, read the MAQ
      (http://www.mailscanner.biz/maq/) and
      the archives
      (http://www.jiscmail.ac.uk/lists/mailscanner.html).

      ------------------------ MailScanner list
      ------------------------
      To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
      'leave mailscanner' in the body of the email.
      Before posting, read the MAQ
      (http://www.mailscanner.biz/maq/) and
      the archives
      (http://www.jiscmail.ac.uk/lists/mailscanner.html).

      Support MailScanner development - buy the book off the
      website!



--
                                  Koen Teugels
                                n.v. NEXIS s.a.
                            Leuvensesteenweg 542 b.6
                                 1930 Zaventem
                                    BELGIUM

Visit us at http://www.nexis.be
                             e-mail : kte@nexis.be
                            tel.: +32 (0)2 720.51.51
                            fax: +32 (0)2 720.22.42
                       visit us at : http://www.nexis.be



------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Image/JPEG  13KB. ]
    [ Unable to print this part. ]


From mailscanner at ecs.soton.ac.uk  Fri Nov 12 13:48:39 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:33 2006
Subject: {Scanned} bitdefender doesn't update
Message-ID: <mailman.4612.1137101253.24926.mailscanner@lists.mailscanner.info>

I have just checked on my own system, and the /opt/bdc/Plugins/update.txt
says
# cat update.txt
Update time: Fri Nov 12 11:07:51 2004
Signature number: 94254
Update time GMT: 1100243271
Version: 7.00280

So the updates are happening okay. And I'm running the same autoupdate
script that I distribute to you all.

On 12/11/04 1:33 pm, "Julian Field" <mailscanner@ecs.soton.ac.uk> wrote:

> Can other people confirm this please? I didn't write the original script and
> it's horribly complicated, and the comments are all in Italian :-(
>
>
> On 12/11/04 12:56 pm, "Christian Kowarzik" <ckowarzik@EMAIL.DE> wrote:
>
>> Koen Teugels wrote:
>>> I don't think the bitdefender updates. Plugins dates stay at the time of
>>> install. And when i do an bdc --update there are changes.
>>
>> In the script /usr/lib/MailScanner/bitdefender-autoupdate it's function
>> countViruses($file) is
>> missing the input file and then it dies rather than logging the error and
>> then
>> continuing.
>>
>> I found out, that the commands which should create the input files for
>> countViruses($file) are
>> out-commented:
>> #JKF system  "$bitDCmd > $origFile ";
>> #JKF system  "$bitDCmd > $destFile ";
>>
>> I removed the '#JKF ' at the beginning of these two lines and everything is
>> working fine...
>>
>> My configuration:
>> RedHat Enterprise Linux ES 3
>> perl-5.8.0-88.7
>> MailScanner-4.35.9-1
>>
>> Chris
>>
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From David.While at UCE.AC.UK  Fri Nov 12 13:51:18 2004
From: David.While at UCE.AC.UK (David While)
Date: Thu Jan 12 21:27:33 2006
Subject: {Scanned} Re: {Scanned} bitdefender doesn't update
Message-ID: <mailman.4613.1137101253.24926.mailscanner@lists.mailscanner.info>

I could never get it to work :( so I rewrote the update script based on
the Clam update script.

--------------------------------------------
David While BSc CEng MBCS CITP
Technical Development Manager
School of Computing & Information
University of Central England
Tel: 0121 331 6211
--------------------------------------------


________________________________________________________________________________
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Alex Neuman van der Hans
Sent: 12 November 2004 13:44
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: {Scanned} Re: {Scanned} bitdefender doesn't update

It didn't work for me (plus it gave me problems a few weeks ago) so I
remember I disabled it and chose to use "bdc --update" from cron.

________________________________________________________________________________
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Koen Teugels
Sent: Friday, November 12, 2004 8:39 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: {Scanned} Re: {Scanned} bitdefender doesn't update

I tested it and changed this and it looks likes it updates now.

thanks for this

Julian Field wrote:

 Can other people confirm this please? I didn't write the original script and
it's horribly complicated, and the comments are all in Italian :-(


On 12/11/04 12:56 pm, "Christian Kowarzik" <ckowarzik@EMAIL.DE> wrote:

  

 Koen Teugels wrote:
    

 I don't think the bitdefender updates. Plugins dates stay at the time of
install. And when i do an bdc --update there are changes.
      

In the script /usr/lib/MailScanner/bitdefender-autoupdate it's function
countViruses($file) is
missing the input file and then it dies rather than logging the error and then
continuing.

I found out, that the commands which should create the input files for
countViruses($file) are
out-commented:
#JKF system  "$bitDCmd > $origFile ";
#JKF system  "$bitDCmd > $destFile ";

I removed the '#JKF ' at the beginning of these two lines and everything is
working fine...

My configuration:
RedHat Enterprise Linux ES 3
perl-5.8.0-88.7
MailScanner-4.35.9-1

Chris

    

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!
  



--
                                  Koen Teugels
                                n.v. NEXIS s.a.
                            Leuvensesteenweg 542 b.6
                                 1930 Zaventem
                                    BELGIUM

Visit us at http://www.nexis.be
                             e-mail : kte@nexis.be
                            tel.: +32 (0)2 720.51.51
                            fax: +32 (0)2 720.22.42
                       visit us at : http://www.nexis.be



------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, "nexis_logo.jpg"  Image/JPEG  13KB. ]
    [ Unable to print this part. ]


From jaearick at COLBY.EDU  Fri Nov 12 13:59:56 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:33 2006
Subject: Never getting URIBL_PH_SURBL hits
Message-ID: <mailman.4614.1137101253.24926.mailscanner@lists.mailscanner.info>

Julian,

I'm running 4.35.11, SA 3.0.1 on our mail server (Solaris 9).  You are
right...  I grepped my syslogs and there are gobs of URIBL hits but zero
URIBL_PH_SURBL entries in my logs over the last two weeks.  Nada.  If
this is geographic thing, both sides of the Atlantic are getting left
out.  Do you (or anybody else) see URIBL_PH_SURBL hits on non-Solaris
systems?

Jeff Earickson
Colby College, Waterville Maine, USA

On Fri, 12 Nov 2004, Julian Field wrote:

> Date: Fri, 12 Nov 2004 12:08:12 +0000
> From: Julian Field <mailscanner@ECS.SOTON.AC.UK>
> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Never getting URIBL_PH_SURBL hits
>
> Just to prove I am in fact mortal after all, here's a weird one for you.
                              ^^^^^^
We hope not!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ELIQUID.COM  Fri Nov 12 14:09:20 2004
From: mailscanner at ELIQUID.COM (Wess)
Date: Thu Jan 12 21:27:33 2006
Subject: Issue Resolved
Message-ID: <mailman.4615.1137101253.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "utf-8" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Dave,

I do believe that I am going to have a difficult time getting a vacation
script to work.  I do not create physical accounts for the users on our
servers, as they all use the same home directory. (/home/mail)

I may have found a solution.  If I use the Postfix virtual_alias_maps
directive, I can forward specific users email to a PHP script, and their
Inbox.  I will write the PHP app to check the vacation table in the mail
DB for and email address, full name, vacation duration, and the message
they wish to display.  The PHP app will then compose an email to the
sender, as the vacation user, and email them back with the details of the
vacation.

I am implementing this setup as a test on my local box, and if all goes
well, I will post full instructions for the MySQL virtual mail users out
there.  If you wish to discuss this idea/theory, feel free to find me on
irc. (Everyone is invited :) )

MailScanner on IRC
Community Support
irc.freenode.net
#mailscanner

On Thu, 2004-11-11 at 21:01, Dave Filchak wrote:
      Not sure what to tell you. So I take it then that because
      your user accounts are created in MySQL, they have no home
      directories?
       
      I use Usermin/Webmin to handle the vacation side of things
      (with Usermin, the user can set their own vacation messages
      and turn it on/off). All non essential user accounts are
      created with a /sbin/nologin shell. And that is about it.
      Usermin initiates the vacation.db and creates the .forward
      file in the home directory when it is enabled. My issue was
      around writing the rule to work with log in names and
      virtusertable entries. Once I figured that out everything
      worked fine.
       
      HTH
       
      Dave

________________________________________________________________________________
            From: Wess [mailto:mailscanner@eliquid.com]
            Sent: Thursday, November 11, 2004 9:12 AM
            To: dfilchak@sympatico.ca
            Cc: MAILSCANNER@JISCMAIL.AC.UK
            Subject: Re: Issue Resolved


            Thankfully I have only needed the vacation
            program once since I moved to MailScanner. 
            Unfortunately for me, it was very difficult to
            use, and to implement in the future if I need it.

            My configuration is:
            MailScanner 4.32.5
            MySQL 4.0.22
            Postfix 2.1.5
            SpamAssassin 3.0.1
            ClamAV 0.80

            I have all user accounts managed virtually
            through mysql.

            Here is how I got vacation to work last time:

            1.  Create new user account for the person on
            vacation (Mail users are hosted virtually, so
            they do not have user accounts...)
            2.  Set their email address to forward to their
            old inbox, and the vacation program via alias. 
            ("| /usr/bin/vacation -a username")
            3.  Configure the vacation settings in their
            temporary home directory.
            4.  Extensive testing/smashing head on wall.
            5.  Finally worked after tweaking.


            Now that you know what I did, with SQL based
            virtual hosting, is there an easier way to use a
            vacation program or script with this type of
            Mailscanner virtual hosting?  if you can help me
            out, see me on the Unofficial IRC support channel
            or simply respond here.  Vacation scripts are
            requested quite often here, and a quick way of
            dealing with them would be quite ideal.

            MailScanner on IRC
            Community Support
            irc.freenode.net
            #mailscanner

            Thanks guys!

            On Wed, 2004-11-10 at 23:15, Dave Filchak wrote:

 Just in case anyone else deals with the vacation program and thinks there
might be an issue with MailScanner:

As the people that replied said, "MailScanner" will not stop the auto
response message from being sent".

After Googling and not really clarifying much and searching the archives, I
finally got a tip (link) from Steve Swaney (thanks Steve). The instructions
were a bit clearer for my overworked brain and this got me going in the
right direction.

What my problem was, I misunderstood, how the vacation forward rules should
work.  For some of my email clients, we have a log in name and then an alias
in virtusertable to the log in name. So the rules I tried that did not work
and gave me an "unknown mailer" error were:

 \login_name, "|/usr/bin/vacation login_name"
\login_name, "|/usr/bin/vacation -a login_name"
\login_name, "|/usr/bin/vacation -a alias_name@domainname" (not sure why
this one did not work)

These all gave me an error. What worked was:

\login_name, "|/usr/bin/vacation -a alias_name@domainname login_name" Again,
this rule applies to a situation where you have usernames and then entries
in the virtusertable in Sendmail that point to these users.

I could have written it this way to set a different time interval between
responses to the same sender:

\login_name, "|/usr/bin/vacation -a alias_name@domainname -r 3 login_name"
which would set the time interval to three days (default is 1 week).

Hopefully, if any other "relatively inexperienced" person on this list
thinks he or she has an issue with MailScanner and the dreaded vacation
program, hopefully this will help. Thanks to all who replied to me.

Dave

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


 MailScanner on IRC

Community Support

irc.freenode.net

#mailscanner



------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From campbell at cnpapers.com  Fri Nov 12 14:09:00 2004
From: campbell at cnpapers.com (Steve Campbell)
Date: Thu Jan 12 21:27:33 2006
Subject: {Scanned} bitdefender doesn't update
Message-ID: <mailman.4616.1137101253.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

My update.txt displays even newer than this one, and I don't run the latest
MS.

Steve Campbell

----- Original Message -----
From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Friday, November 12, 2004 8:48 AM
Subject: Re: {Scanned} bitdefender doesn't update


> I have just checked on my own system, and the /opt/bdc/Plugins/update.txt
> says
> # cat update.txt
> Update time: Fri Nov 12 11:07:51 2004
> Signature number: 94254
> Update time GMT: 1100243271
> Version: 7.00280
>
> So the updates are happening okay. And I'm running the same autoupdate
> script that I distribute to you all.
>
> On 12/11/04 1:33 pm, "Julian Field" <mailscanner@ecs.soton.ac.uk> wrote:
>
> > Can other people confirm this please? I didn't write the original script
and
> > it's horribly complicated, and the comments are all in Italian :-(
> >
> >
> > On 12/11/04 12:56 pm, "Christian Kowarzik" <ckowarzik@EMAIL.DE> wrote:
> >
> >> Koen Teugels wrote:
> >>> I don't think the bitdefender updates. Plugins dates stay at the time
of
> >>> install. And when i do an bdc --update there are changes.
> >>
> >> In the script /usr/lib/MailScanner/bitdefender-autoupdate it's function
> >> countViruses($file) is
> >> missing the input file and then it dies rather than logging the error
and
> >> then
> >> continuing.
> >>
> >> I found out, that the commands which should create the input files for
> >> countViruses($file) are
> >> out-commented:
> >> #JKF system  "$bitDCmd > $origFile ";
> >> #JKF system  "$bitDCmd > $destFile ";
> >>
> >> I removed the '#JKF ' at the beginning of these two lines and
everything is
> >> working fine...
> >>
> >> My configuration:
> >> RedHat Enterprise Linux ES 3
> >> perl-5.8.0-88.7
> >> MailScanner-4.35.9-1
> >>
> >> Chris
> >>
> >
> > --
> > Julian Field
> > www.MailScanner.info
> > Buy the MailScanner book at www.MailScanner.info/store
> >
> > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> >
> > ------------------------ MailScanner list ------------------------
> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> > Support MailScanner development - buy the book off the website!
> >
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Fri Nov 12 14:10:43 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:33 2006
Subject: Never getting URIBL_PH_SURBL hits
Message-ID: <mailman.4617.1137101253.24926.mailscanner@lists.mailscanner.info>

I've only got 1 non-Solaris MX and that doesn't handle huge amounts of mail.
But no URIBL_PH_SURBL on there either.

Maybe it is just a geographic thing. Sure glad I wrote my "phishing net"
code though!

On 12/11/04 1:59 pm, "Jeff A. Earickson" <jaearick@COLBY.EDU> wrote:
> I'm running 4.35.11, SA 3.0.1 on our mail server (Solaris 9).  You are
> right...  I grepped my syslogs and there are gobs of URIBL hits but zero
> URIBL_PH_SURBL entries in my logs over the last two weeks.  Nada.  If
> this is geographic thing, both sides of the Atlantic are getting left
> out.  Do you (or anybody else) see URIBL_PH_SURBL hits on non-Solaris
> systems?
>
> Jeff Earickson
> Colby College, Waterville Maine, USA
>
> On Fri, 12 Nov 2004, Julian Field wrote:
>
>> Date: Fri, 12 Nov 2004 12:08:12 +0000
>> From: Julian Field <mailscanner@ECS.SOTON.AC.UK>
>> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>> To: MAILSCANNER@JISCMAIL.AC.UK
>> Subject: Never getting URIBL_PH_SURBL hits
>>
>> Just to prove I am in fact mortal after all, here's a weird one for you.
>                               ^^^^^^
> We hope not!

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Steve.Swaney at FSL.COM  Fri Nov 12 14:08:58 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:33 2006
Subject: {Scanned} bitdefender doesn't update
Message-ID: <mailman.4618.1137101253.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Julian Field
> Sent: Friday, November 12, 2004 8:34 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: {Scanned} bitdefender doesn't update
>
> Can other people confirm this please? I didn't write the original script
> and
> it's horribly complicated, and the comments are all in Italian :-(
>
>
> On 12/11/04 12:56 pm, "Christian Kowarzik" <ckowarzik@EMAIL.DE> wrote:
>
> > Koen Teugels wrote:
> >> I don't think the bitdefender updates. Plugins dates stay at the time
> of
> >> install. And when i do an bdc --update there are changes.
> >
> > In the script /usr/lib/MailScanner/bitdefender-autoupdate it's function
> > countViruses($file) is
> > missing the input file and then it dies rather than logging the error
> and then
> > continuing.
> >
> > I found out, that the commands which should create the input files for
> > countViruses($file) are
> > out-commented:
> > #JKF system  "$bitDCmd > $origFile ";
> > #JKF system  "$bitDCmd > $destFile ";
> >
> > I removed the '#JKF ' at the beginning of these two lines and everything
> is
> > working fine...
> >

About a month+ back, the BitDefender site had a problem that caused the
BitDefender update to hang. Every hour another update would start and hang.
I saw one system with +450 hung bdc processes. Commenting out these two
lines appeared to fix the problem but you lost the logging of the updates.
The BitDefender site was fixed after a few days so I think it may now be
safe to take these comments out.

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From david.hooton at gmail.com  Fri Nov 12 14:15:55 2004
From: david.hooton at gmail.com (David Hooton)
Date: Thu Jan 12 21:27:33 2006
Subject: Never getting URIBL_PH_SURBL hits
Message-ID: <mailman.4619.1137101253.24926.mailscanner@lists.mailscanner.info>

On Fri, 12 Nov 2004 14:10:43 +0000, Julian Field
<mailscanner@ecs.soton.ac.uk> wrote:
> I've only got 1 non-Solaris MX and that doesn't handle huge amounts of mail.
> But no URIBL_PH_SURBL on there either.

Please all feel free to contribute any phishes that you intercept,
then maybe you will have some :)
--
Regards,

David Hooton

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dustin.baer at IHS.COM  Fri Nov 12 15:01:39 2004
From: dustin.baer at IHS.COM (Dustin Baer)
Date: Thu Jan 12 21:27:33 2006
Subject: off topic:  email forwarding assistance/guidance needed
Message-ID: <mailman.4620.1137101253.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

lester lasad wrote:

>forgive me, but I'm not sure what you mean by "make
>sure you hashed your virtusertable to db"
>
.
I haven't been following this thread, so can't off any other assitance
than what Mike meant by hashing the virtusertable:

    makemap hash /etc/mail/virtusertable < /etc/mail/virtusertable

Of course, /etc/mail/virtusertable is where mine is. You will need to
substitute your location.

Dustin

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jase at SENSIS.COM  Fri Nov 12 15:18:37 2004
From: jase at SENSIS.COM (Desai, Jason)
Date: Thu Jan 12 21:27:33 2006
Subject: {Scanned} Re: {Scanned} Re: ProcessClamAVOutput : unrecognised
    line ... contact the authors
Message-ID: <mailman.4621.1137101253.24926.mailscanner@lists.mailscanner.info>

Are you sure all of your paths in your MailScanner.conf file are absolute
paths and do not contain any symbolic links?
 
Jase
-----Original Message-----
From: Koen Teugels [mailto:kte@NEXIS.BE]
Sent: Friday, November 12, 2004 8:46 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: [MAILSCANNER] {Scanned} Re: {Scanned} Re:
ProcessClamAVOutput: unrecognised line ... contact the authors

Just did some more testing. And I don't think it is the virus
scanner. Because I tried another one and the virus still passes. So
i think it must be the unzip / tar that has a problem. all tgz have
this problem.

Koen

Koen Teugels wrote:
      Could it be that mailscanner has problems with .tgz
      extensions??


      just test the copfilter-0.0.95.tgz with bitdefender
      only and he lets the
      eicar virus pass. When I put the virus direct or in a
      simple zip files
      he doesn't pass.
      But the copfilter-0.0.95.tgz virusscan gives as output
      in maillog
      viruses found. But doesn't do anything with it.

      thanks Koen


      Julian Field wrote:

            Please upgrade your clamav to the latest
            CVS version available from
            www.clamav.net and try the test again.

            Koen Teugels wrote:

                  Virus Scanners = clamav
                  bitdefender
                  clamav is at version 0.80.1 and
                  bitdefender
                  BitDefender-Console-Antivirus-7.0.1-3.linux-gcc3x.i586.rpm
                  Bt they let pass the attachment
                  copfilter-0.0.95.tgz with the
                  eicar test
                  virus in it with status clean.
                  I use a  RHEL clone with the
                  latest yum updates.
                  version
                  MailScanner-4.35.11-1.rpm.tar.gz
                  with spamassassin 3.0.1 and
                  plugins DCC, razor and ...
                  Just a standard install no
                  custom rules yet.

                  Thanks Koen


------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From raymond at PROLOCATION.NET  Fri Nov 12 15:40:39 2004
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:27:33 2006
Subject: Never getting URIBL_PH_SURBL hits
Message-ID: <mailman.4622.1137101253.24926.mailscanner@lists.mailscanner.info>

Hi!

>> I've only got 1 non-Solaris MX and that doesn't handle huge amounts of mail.
>> But no URIBL_PH_SURBL on there either.
>
> Please all feel free to contribute any phishes that you intercept,
> then maybe you will have some :)

The one i mentioned earlier today is allready terminated by the current
hoster, but feel free to add it anyway ;)

Bye,
Raymond.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From samp at ARIAL-CONCEPT.COM  Fri Nov 12 15:37:48 2004
From: samp at ARIAL-CONCEPT.COM (Sam Przyswa)
Date: Thu Jan 12 21:27:33 2006
Subject: Filename checking by From and To address
Message-ID: <mailman.4623.1137101253.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-15" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi,

I have to accept *.exe attachment files only from some mail addresses or
domains and I don't find anything about this feature, is it possible to
that ?

Thanks in advance.

Sam Przyswa.

-- 

Sam Przyswa - Chef de projet
Arial Concept - Intégrateur Internet
36, rue de Turin - 75008 - Paris - France
Tel: 01 40 54 86 04 - Fax: 01 40 54 83 01
Web: http://www.arial-concept.com - Email: Info@arial-concept.com


-- 
Ce message a été vérifié par MailScanner
pour des virus ou des polluriels et rien de
suspect n'a été trouvé.
MailScanner remercie transtec pour son soutien.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From marcin.rozek at IOS.EDU.PL  Fri Nov 12 16:09:55 2004
From: marcin.rozek at IOS.EDU.PL ([ISO-8859-2] Marcin Rożek)
Date: Thu Jan 12 21:27:33 2006
Subject: Filename checking by From and To address
Message-ID: <mailman.4624.1137101253.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-2" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Sam Przyswa wrote:
> Hi,
>
> I have to accept *.exe attachment files only from some mail addresses or
> domains and I don't find anything about this feature, is it possible to
> that ?
http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/97.html

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From john at OMEGADATA.NO  Fri Nov 12 16:16:55 2004
From: john at OMEGADATA.NO (John Berntsen)
Date: Thu Jan 12 21:27:33 2006
Subject: SV: Filename checking by From and To address
Message-ID: <mailman.4625.1137101253.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Yes, you can and it is documented in the wiki i believe, anyhow here is how i do it:
 
in /etc/MailScanner/rules dir
create filename.rules and filetype.rules
 
example:
 
post:/etc/MailScanner/rules # cat filename.rules
FromOrTo:       john@doe.com <mailto:john@doe.com>       %etc-dir%/filename.doe.rules.conf
FromOrTo:       *@test.com                %etc-dir%/filename.test.rules.conf
FromOrTo:       default                 %etc-dir%/filename.rules.conf

post:/etc/MailScanner/rules # cat filetype.rules
FromOrTo:       john@doe.com <mailto:john@doe.com>       %etc-dir%/filetype.doe.rules.conf
FromOrTo:       *@test.com                %etc-dir%/filetype.test.rules.conf
FromOrTo:       default                 %etc-dir%/filetype.rules.conf

Then in your /etc/MailScanner directory
copy filetype.rules.conf to filetype.doe.rules.conf and filetype.test.rules.conf
and adjust to taste, do the same for filename.rules.conf.
 
Then in /etc/MailScanner/MailScanner.conf
edit these lines, the original has been commented out.
 
#Filename Rules = %etc-dir%/filename.rules.conf
Filename Rules = %rules-dir%/filename.rules
#Filetype Rules = %etc-dir%/filetype.rules.conf
Filetype Rules = %rules-dir%/filetype.rules

This example can also be applied to which domains etc. you want to scan viruses for etc.
 
Med vennlig hilsen / Regards
John Berntsen
 
Omegadata AS
Leangbukta 31
1392 Vettre
 
Mobil    99 43 07 79
Telefon  66 76 61 00
Faks     66 76 61 01
 

________________________________

Fra: MailScanner mailing list pĺ vegne av Sam Przyswa
Sendt: fr 12.11.2004 16:37
Til: MAILSCANNER@JISCMAIL.AC.UK
Emne: Filename checking by From and To address



Hi,

I have to accept *.exe attachment files only from some mail addresses or
domains and I don't find anything about this feature, is it possible to
that ?

Thanks in advance.

Sam Przyswa.

--

Sam Przyswa - Chef de projet
Arial Concept - Intégrateur Internet
36, rue de Turin - 75008 - Paris - France
Tel: 01 40 54 86 04 - Fax: 01 40 54 83 01
Web: http://www.arial-concept.com - Email: Info@arial-concept.com


--
Ce message a été vérifié par MailScanner
pour des virus ou des polluriels et rien de
suspect n'a été trouvé.
MailScanner remercie transtec pour son soutien.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!



------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From kte at NEXIS.BE  Fri Nov 12 16:17:00 2004
From: kte at NEXIS.BE (Koen Teugels)
Date: Thu Jan 12 21:27:33 2006
Subject: {Scanned} Re: {Scanned} Re: {Scanned} Re: ProcessClamAVOutput :
    unrecognised line ... contact the authors
Message-ID: <mailman.4626.1137101253.24926.mailscanner@lists.mailscanner.info>

yep , everything is on /etc/Mailscanner/

Desai, Jason wrote:
      Are you sure all of your paths in your MailScanner.conf file
      are absolute paths and do not contain any symbolic links?
 
Jase
-----Original Message-----
From: Koen Teugels [mailto:kte@NEXIS.BE]
Sent: Friday, November 12, 2004 8:46 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: [MAILSCANNER] {Scanned} Re: {Scanned} Re:
ProcessClamAVOutput: unrecognised line ... contact the
authors

      Just did some more testing. And I don't think it is the
      virus scanner. Because I tried another one and the
      virus still passes. So i think it must be the unzip /
      tar that has a problem. all tgz have this problem.

      Koen

      Koen Teugels wrote:
            Could it be that mailscanner has problems
            with .tgz extensions??


            just test the copfilter-0.0.95.tgz with
            bitdefender only and he lets the
            eicar virus pass. When I put the virus
            direct or in a simple zip files
            he doesn't pass.
            But the copfilter-0.0.95.tgz virusscan
            gives as output in maillog
            viruses found. But doesn't do anything with
            it.

            thanks Koen


            Julian Field wrote:

                  Please upgrade your clamav to
                  the latest CVS version
                  available from
                  www.clamav.net and try the test
                  again.

                  Koen Teugels wrote:

                        Virus Scanners =
                        clamav bitdefender
                        clamav is at
                        version 0.80.1 and
                        bitdefender
                        BitDefender-Console-Antivirus-7.0.1-3.linux-gcc3x.i586.rpm
                        Bt they let pass
                        the attachment
                        copfilter-0.0.95.tgz
                        with the eicar test
                        virus in it with
                        status clean.
                        I use a  RHEL clone
                        with the latest yum
                        updates.
                        version
                        MailScanner-4.35.11-1.rpm.tar.gz
                        with spamassassin
                        3.0.1 and
                        plugins DCC, razor
                        and ...
                        Just a standard
                        install no custom
                        rules yet.

                        Thanks Koen


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!



--
                                  Koen Teugels
                                n.v. NEXIS s.a.
                            Leuvensesteenweg 542 b.6
                                 1930 Zaventem
                                    BELGIUM

Visit us at http://www.nexis.be
                             e-mail : kte@nexis.be
                            tel.: +32 (0)2 720.51.51
                            fax: +32 (0)2 720.22.42
                       visit us at : http://www.nexis.be



------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Image/JPEG  13KB. ]
    [ Unable to print this part. ]


From ugob at CAMO-ROUTE.COM  Fri Nov 12 16:11:29 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:34 2006
Subject: Filename checking by From and To address
Message-ID: <mailman.4627.1137101253.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-15" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Sam Przyswa wrote:
> Hi,
>
> I have to accept *.exe attachment files only from some mail addresses or
> domains and I don't find anything about this feature, is it possible to
> that ?

I'm surprised you can't find anything about that, this is the most asked
question :).

Please the MAQ page, http://mailscanner.biz/maq/

It is at the beginning.

You could also get the mailscanner manual from www.fsl.com/support

Or buy the book from www.mailscanner.info/store/

hope this helps.
>
> Thanks in advance.
>
> Sam Przyswa.
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jase at SENSIS.COM  Fri Nov 12 16:26:37 2004
From: jase at SENSIS.COM (Desai, Jason)
Date: Thu Jan 12 21:27:34 2006
Subject: {Scanned} Re: {Scanned} Re: {Scanned} Re: Proce ssClamAVOutput
    : unrecognised line ... contact the authors
Message-ID: <mailman.4628.1137101254.24926.mailscanner@lists.mailscanner.info>

Just to be clear, I'm not talking about your path to MailScanner.conf. 
Rather I am talking about options in MailScanner.conf, specifically,
Incoming Work Dir.
 
Jase
-----Original Message-----
From: Koen Teugels [mailto:kte@NEXIS.BE]
Sent: Friday, November 12, 2004 11:17 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: [MAILSCANNER] {Scanned} Re: {Scanned} Re: {Scanned} Re:
ProcessClamAVOutput : unrecognised line ... contact the authors

yep , everything is on /etc/Mailscanner/

Desai, Jason wrote:
      Are you sure all of your paths in your MailScanner.conf
      file are absolute paths and do not contain any symbolic
      links?
 
Jase
-----Original Message-----
From: Koen Teugels [mailto:kte@NEXIS.BE]
Sent: Friday, November 12, 2004 8:46 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: [MAILSCANNER] {Scanned} Re: {Scanned} Re:
ProcessClamAVOutput: unrecognised line ... contact the
authors

      Just did some more testing. And I don't think it
      is the virus scanner. Because I tried another one
      and the virus still passes. So i think it must be
      the unzip / tar that has a problem. all tgz have
      this problem.

      Koen

      Koen Teugels wrote:
            Could it be that mailscanner has
            problems with .tgz extensions??


            just test the copfilter-0.0.95.tgz
            with bitdefender only and he lets the
            eicar virus pass. When I put the
            virus direct or in a simple zip files
            he doesn't pass.
            But the copfilter-0.0.95.tgz
            virusscan gives as output in maillog
            viruses found. But doesn't do
            anything with it.

            thanks Koen


            Julian Field wrote:

                  Please upgrade your
                  clamav to the latest CVS
                  version available from
                  www.clamav.net and try
                  the test again.

                  Koen Teugels wrote:

                        Virus
                        Scanners =
                        clamav
                        bitdefender
                        clamav is at
                        version
                        0.80.1 and
                        bitdefender
                        BitDefender-Console-Antivirus-7.0.1-3.linux-gcc3x.i586.rpm
                        Bt they let
                        pass the
                        attachment
                        copfilter-0.0.95.tgz
                        with the
                        eicar test
                        virus in it
                        with status
                        clean.
                        I use a  RHEL
                        clone with
                        the latest
                        yum updates.
                        version
                        MailScanner-4.35.11-1.rpm.tar.gz
                        with
                        spamassassin
                        3.0.1 and
                        plugins DCC,
                        razor and ...
                        Just a
                        standard
                        install no
                        custom rules
                        yet.

                        Thanks Koen


------------------------ MailScanner list
------------------------ To unsubscribe, email
jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ
(http://www.mailscanner.biz/maq/)
and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the
website!



--
                                  Koen Teugels
                                n.v. NEXIS s.a.
                            Leuvensesteenweg 542 b.6
                                 1930 Zaventem
                                    BELGIUM

Visit us at http://www.nexis.be
                             e-mail : kte@nexis.be
                            tel.: +32 (0)2 720.51.51
                            fax: +32 (0)2 720.22.42
                       visit us at : http://www.nexis.be



------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Image/JPEG  13KB. ]
    [ Unable to print this part. ]


From jcain at CSPACEINTERACTIVE.COM  Fri Nov 12 16:33:40 2004
From: jcain at CSPACEINTERACTIVE.COM (Justin Cain)
Date: Thu Jan 12 21:27:34 2006
Subject: Issue with outlook messages decode
Message-ID: <mailman.4629.1137101254.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Thanks for the reply,  I did use the install script and Base64 comes up
as 3.01. Any other ideas?
I have included the total output from MailScanner -v for reference. Any
help is appreciated.
 
Thanx
 
[root@vega ~]# MailScanner -v
Running on
Linux vega.cspaceinteractive.com 2.6.9-1.667smp #1 SMP Tue Nov 2 15:09:11
EST 20
04 x86_64 x86_64 x86_64 GNU/Linux
This is Fedora Core release 3 (Heidelberg)
This is Perl version 5.008005 (5.8.5)
 
This is MailScanner version 4.35.11
Module versions are:
1.00    AnyDBM_File
1.14    Archive::Zip
1.03    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.05    Fcntl
2.73    File::Basename
2.08    File::Copy
2.01    FileHandle
1.06    File::Path
0.14    File::Temp
1.27    HTML::Entities
3.35    HTML::Parser
2.28    HTML::TokeParser
1.21    IO
1.10    IO::File
1.123   IO::Pipe
3.01    MIME::Base64
5.415   MIME::Decoder
5.415   MIME::Decoder::UU
5.415   MIME::Head
5.415   MIME::Parser
3.01    MIME::QuotedPrint
5.415   MIME::Tools
0.09    Net::CIDR
1.08    POSIX
1.77    Socket
0.05    Sys::Syslog
1.02    Time::localtime
 
Optional module versions are:
1.809   DB_File
1.08    Digest
1.01    Digest::HMAC
2.33    Digest::MD5
2.07    Digest::SHA1
0.44    Inline
missing Mail::ClamAV
3.000000        Mail::SpamAssassin
missing Mail::SPF::Query
missing Net::CIDR::Lite
0.48    Net::DNS
0.31    Net::LDAP
1.94    Parse::RecDescent
missing SAVI
missing Sys::Hostname::Long
2.42    Test::Harness
0.47    Test::Simple
1.95    Text::Balanced
1.30    URI
 
 
 
      ----- Original Message -----
From: Julian Field
To: MAILSCANNER@JISCMAIL.AC.UK
Sent: Friday, November 12, 2004 3:21 AM
Subject: Re: Issue with outlook messages decode

You have not installed the new MIME::Base64 and QuotedPrint
modules. This error message has been posted to this list many times
before, along with the explanation :-)

You will find that ^ÓMailScanner ^Öv^Ô will report version
2.something for MIME::Base64 and MIME::QuotedPrint. It should
report version 3.something.

Either use CPAN to upgrade MIME::Base64 (which will automatically
do the QuotedPrint bit as well), or run my ./install.sh script and
make sure it successfully built and installed the modules.

Did you install using my ./install.sh script?

On 11/11/04 10:25 pm, "Justin Cain" <jcain@CSPACEINTERACTIVE.COM>
wrote:

      All,

      Having a problem with mailscanner decoding of messages
      sent form microsoft clients sending rich text or HTML.
      I have tried turning off the TNEF expander and also
      setting mailscanner to deliver the unparsable TNEF. I
      have also tried both the internal perl module and the
      external executable. After a little more digging I'm
      thinking that the problem occurs before the TNEF even
      gets kicked off.   It appears that the MIME Decoder
      module is having a problem initializing the QuotedPrint
      object when and HTML or Rich text email is recieved
      from a MS client (plain text are fine) also
      HTML/richtext from evolution is fine. The following
      error appears in the maillog.  

      Cannot parse
      /var/spool/MailScanner/incoming/7895/4636B211F42.header
      and , Can't locate object method "init" v\
      ia package "MIME::Decoder::QuotedPrint" at
      /usr/lib/perl5/site_perl/5.8.5/MIME/Decoder.pm line
      179.

      I have noticed that there is more than one QuotedPrint
      perl module on the box, I not really a perl guy so I
      not sure how all this effects things

      locate QuotedPrint
      /usr/share/man/man3/PerlIO::via::QuotedPrint.3pm.gz
      /usr/share/man/man3/MIME::QuotedPrint.3pm.gz
      /usr/share/man/man3/MIME::Decoder::QuotedPrint.3pm.gz
      /usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/MIME/QuotedPrint.pm
      /usr/lib/perl5/5.8.5/PerlIO/via/QuotedPrint.pm
      /usr/lib/perl5/5.8.5/i386-linux-thread-multi/MIME/QuotedPrint.pm
      /usr/lib/perl5/site_perl/5.8.5/MIME/Decoder/QuotedPrint.pm

       
      System info

      SMP x86_64 running fedora core 3
      perl 5.8.5
      mailscanner-4.35.11-1 (rpm install)
      ------------------------ MailScanner list
      ------------------------ To unsubscribe, email
      jiscmail@jiscmail.ac.uk with the words:
      'leave mailscanner' in the body of the email.
      Before posting, read the MAQ
      (http://www.mailscanner.biz/maq/)
      and the archives
      (http://www.jiscmail.ac.uk/lists/mailscanner.html).



--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From mailscanner at ecs.soton.ac.uk  Fri Nov 12 16:42:14 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:34 2006
Subject: Issue with outlook messages decode
Message-ID: <mailman.4630.1137101254.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

That&#8217;s interesting, I don&#8217;t think I ever shipped MIME::Base64
3.01 as part of MailScanner. You need to be using a newer version than
that. 3.03 at least.

On 12/11/04 4:33 pm, "Justin Cain" <jcain@CSPACEINTERACTIVE.COM> wrote:

      Thanks for the reply,  I did use the install script and
      Base64 comes up as 3.01. Any other ideas?
      I have included the total output from MailScanner -v for
      reference. Any help is appreciated.

      Thanx

      [root@vega ~]# MailScanner -v
      Running on
      Linux vega.cspaceinteractive.com 2.6.9-1.667smp #1 SMP Tue
      Nov 2 15:09:11 EST 20
      04 x86_64 x86_64 x86_64 GNU/Linux
      This is Fedora Core release 3 (Heidelberg)
      This is Perl version 5.008005 (5.8.5)

      This is MailScanner version 4.35.11
      Module versions are:
      1.00    AnyDBM_File
      1.14    Archive::Zip
      1.03    Carp
      1.119   Convert::BinHex
      1.00    DirHandle
      1.05    Fcntl
      2.73    File::Basename
      2.08    File::Copy
      2.01    FileHandle
      1.06    File::Path
      0.14    File::Temp
      1.27    HTML::Entities
      3.35    HTML::Parser
      2.28    HTML::TokeParser
      1.21    IO
      1.10    IO::File
      1.123   IO::Pipe
      3.01    MIME::Base64
      5.415   MIME::Decoder
      5.415   MIME::Decoder::UU
      5.415   MIME::Head
      5.415   MIME::Parser
      3.01    MIME::QuotedPrint
      5.415   MIME::Tools
      0.09    Net::CIDR
      1.08    POSIX
      1.77    Socket
      0.05    Sys::Syslog
      1.02    Time::localtime

      Optional module versions are:
      1.809   DB_File
      1.08    Digest
      1.01    Digest::HMAC
      2.33    Digest::MD5
      2.07    Digest::SHA1
      0.44    Inline
      missing Mail::ClamAV
      3.000000        Mail::SpamAssassin
      missing Mail::SPF::Query
      missing Net::CIDR::Lite
      0.48    Net::DNS
      0.31    Net::LDAP
      1.94    Parse::RecDescent
      missing SAVI
      missing Sys::Hostname::Long
      2.42    Test::Harness
      0.47    Test::Simple
      1.95    Text::Balanced
      1.30    URI


--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
--
Julian Field
jkf@ecs.soton.ac.uk
Teaching Systems Manager
Electronics & Computer Science
University of Southampton
SO17 1BJ, UK
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From samp at ARIAL-CONCEPT.COM  Fri Nov 12 16:51:51 2004
From: samp at ARIAL-CONCEPT.COM (Sam Przyswa)
Date: Thu Jan 12 21:27:34 2006
Subject: Filename checking by From and To address
Message-ID: <mailman.4631.1137101254.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-15" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Le ven 12/11/2004 ŕ 17:11, Ugo Bellavance a écrit :
> Sam Przyswa wrote:
> > Hi,
> >
> > I have to accept *.exe attachment files only from some mail addresses or
> > domains and I don't find anything about this feature, is it possible to
> > that ?
> 
> I'm surprised you can't find anything about that, this is the most asked
> question :).
> 
> Please the MAQ page, http://mailscanner.biz/maq/
> 
> It is at the beginning.

Where !?
 
I searched on http://www.jiscmail.ac.uk/cgi-bin/wa.exe?S1=mailscanner
mail archive with "filename check" but nothing point to that.

Sam.



-- 
Ce message a été vérifié par MailScanner
pour des virus ou des polluriels et rien de
suspect n'a été trouvé.
MailScanner remercie transtec pour son soutien.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From samp at ARIAL-CONCEPT.COM  Fri Nov 12 16:56:54 2004
From: samp at ARIAL-CONCEPT.COM (Sam Przyswa)
Date: Thu Jan 12 21:27:34 2006
Subject: Filename checking by From and To address
Message-ID: <mailman.4632.1137101254.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "UTF-8" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Le ven 12/11/2004 Ă  17:09, Marcin RoĹĽek a Ă©crit :
> Sam Przyswa wrote:
> > Hi,
> >
> > I have to accept *.exe attachment files only from some mail addresses or
> > domains and I don't find anything about this feature, is it possible to
> > that ?
> http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/97.html

I never heard about these FAQ, big thanks !

Sam.
 


-- 
Ce message a été vérifié par MailScanner
pour des virus ou des polluriels et rien de
suspect n'a été trouvé.
MailScanner remercie transtec pour son soutien.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From samp at ARIAL-CONCEPT.COM  Fri Nov 12 17:04:37 2004
From: samp at ARIAL-CONCEPT.COM (Sam Przyswa)
Date: Thu Jan 12 21:27:34 2006
Subject: SV: Filename checking by From and To address
Message-ID: <mailman.4633.1137101254.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-15" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Le ven 12/11/2004 ŕ 17:16, John Berntsen a écrit :
> Yes, you can and it is documented in the wiki i believe, anyhow here is how i do it:
>  
> in /etc/MailScanner/rules dir
> create filename.rules and filetype.rules
>  
> example:
>  
> post:/etc/MailScanner/rules # cat filename.rules
> FromOrTo:       john@doe.com <mailto:john@doe.com>       %etc-dir%/filename.doe.rules.conf
> FromOrTo:       *@test.com                %etc-dir%/filename.test.rules.conf
> FromOrTo:       default                 %etc-dir%/filename.rules.conf
> 
> post:/etc/MailScanner/rules # cat filetype.rules
> FromOrTo:       john@doe.com <mailto:john@doe.com>       %etc-dir%/filetype.doe.rules.conf
> FromOrTo:       *@test.com                %etc-dir%/filetype.test.rules.conf
> FromOrTo:       default                 %etc-dir%/filetype.rules.conf
> 
> Then in your /etc/MailScanner directory
> copy filetype.rules.conf to filetype.doe.rules.conf and filetype.test.rules.conf
> and adjust to taste, do the same for filename.rules.conf.
>  
> Then in /etc/MailScanner/MailScanner.conf
> edit these lines, the original has been commented out.
>  
> #Filename Rules = %etc-dir%/filename.rules.conf
> Filename Rules = %rules-dir%/filename.rules
> #Filetype Rules = %etc-dir%/filetype.rules.conf
> Filetype Rules = %rules-dir%/filetype.rules
> 
> This example can also be applied to which domains etc. you want to scan viruses for etc.
>  

Thanks a lot !

Sam.



-- 
Ce message a été vérifié par MailScanner
pour des virus ou des polluriels et rien de
suspect n'a été trouvé.
MailScanner remercie transtec pour son soutien.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jcain at CSPACEINTERACTIVE.COM  Fri Nov 12 17:30:14 2004
From: jcain at CSPACEINTERACTIVE.COM (Justin Cain)
Date: Thu Jan 12 21:27:34 2006
Subject: Issue with outlook messages decode
Message-ID: <mailman.4634.1137101254.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I upgraded MIME::Base64 with Cpan to 3.05 restarted MailScanner and it is
all working thanks for the help!! :-) 
 
Maybe this soemthing to do with either the x86_64 arch and/or FC3. 
Dunno, but thanks again :-)
 
-JC
 
----- Original Message -----
      From: Julian Field
To: MAILSCANNER@JISCMAIL.AC.UK
Sent: Friday, November 12, 2004 9:42 AM
Subject: Re: Issue with outlook messages decode

That^Ňs interesting, I don^Ňt think I ever shipped MIME::Base64
3.01 as part of MailScanner. You need to be using a newer version
than that. 3.03 at least.

On 12/11/04 4:33 pm, "Justin Cain" <jcain@CSPACEINTERACTIVE.COM>
wrote:

      Thanks for the reply,  I did use the install script and
      Base64 comes up as 3.01. Any other ideas?
      I have included the total output from MailScanner -v
      for reference. Any help is appreciated.

      Thanx

      [root@vega ~]# MailScanner -v
      Running on
      Linux vega.cspaceinteractive.com 2.6.9-1.667smp #1 SMP
      Tue Nov 2 15:09:11 EST 20
      04 x86_64 x86_64 x86_64 GNU/Linux
      This is Fedora Core release 3 (Heidelberg)
      This is Perl version 5.008005 (5.8.5)

      This is MailScanner version 4.35.11
      Module versions are:
      1.00    AnyDBM_File
      1.14    Archive::Zip
      1.03    Carp
      1.119   Convert::BinHex
      1.00    DirHandle
      1.05    Fcntl
      2.73    File::Basename
      2.08    File::Copy
      2.01    FileHandle
      1.06    File::Path
      0.14    File::Temp
      1.27    HTML::Entities
      3.35    HTML::Parser
      2.28    HTML::TokeParser
      1.21    IO
      1.10    IO::File
      1.123   IO::Pipe
      3.01    MIME::Base64
      5.415   MIME::Decoder
      5.415   MIME::Decoder::UU
      5.415   MIME::Head
      5.415   MIME::Parser
      3.01    MIME::QuotedPrint
      5.415   MIME::Tools
      0.09    Net::CIDR
      1.08    POSIX
      1.77    Socket
      0.05    Sys::Syslog
      1.02    Time::localtime

      Optional module versions are:
      1.809   DB_File
      1.08    Digest
      1.01    Digest::HMAC
      2.33    Digest::MD5
      2.07    Digest::SHA1
      0.44    Inline
      missing Mail::ClamAV
      3.000000        Mail::SpamAssassin
      missing Mail::SPF::Query
      missing Net::CIDR::Lite
      0.48    Net::DNS
      0.31    Net::LDAP
      1.94    Parse::RecDescent
      missing SAVI
      missing Sys::Hostname::Long
      2.42    Test::Harness
      0.47    Test::Simple
      1.95    Text::Balanced
      1.30    URI


--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
--
Julian Field
jkf@ecs.soton.ac.uk
Teaching Systems Manager
Electronics & Computer Science
University of Southampton
SO17 1BJ, UK
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From marco at XSSNET.COM  Fri Nov 12 17:33:48 2004
From: marco at XSSNET.COM (Marco Benton)
Date: Thu Jan 12 21:27:34 2006
Subject: {Scanned} bitdefender doesn't update
Message-ID: <mailman.4635.1137101254.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian Field wrote:

>Can other people confirm this please? I didn't write the original script and
>it's horribly complicated, and the comments are all in Italian :-(
>
>
>

yes, that seemed to fix it.

--

Marco Benton - BOFH, BSMFH
Network Consultant

BOFH excuse #250: The cause of the problem is: Processes running slowly due to weak power supply

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From peter at UCGBOOK.COM  Fri Nov 12 18:06:36 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:34 2006
Subject: Never getting URIBL_PH_SURBL hits
Message-ID: <mailman.4636.1137101254.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian Field wrote:
> Just to prove I am in fact mortal after all, here's a weird one for you.
>
> Running SA3.0.1 within MS on a couple of Solaris boxes.
>
> I get plenty of SURBL hits, as you would expect, like this:
> URIBL_OB_SURBL 3.21, URIBL_SBL 1.00, URIBL_SC_SURBL 4.26, URIBL_WS_SURBL
> 1.46
>
> So the SURBL stuff is basically working very happily.
>
> But I never get a hit on URIBL_PH_SURBL (the anti-phishing list).

These are my hits with SA2.64:

WS_URI_RBL|430924
OB_URI_RBL|372630
SC_URI_RBL|283991
AB_URI_RBL|252462
PH_URI_RBL|1073

The PH list doesn't hit much compared to the others, I upgraded to
SA3.0.1 a couple of days ago and there's no hits so far on the PH list.
Regardless of which list hits the most, together they help a lot.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ugob at CAMO-ROUTE.COM  Fri Nov 12 18:02:43 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:34 2006
Subject: Filename checking by From and To address
Message-ID: <mailman.4637.1137101254.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-15" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Sam Przyswa wrote:
> Le ven 12/11/2004 ŕ 17:11, Ugo Bellavance a écrit :
> 
>>Sam Przyswa wrote:
>>
>>>Hi,
>>>
>>>I have to accept *.exe attachment files only from some mail addresses or
>>>domains and I don't find anything about this feature, is it possible to
>>>that ?
>>
>>I'm surprised you can't find anything about that, this is the most asked
>>question :).
>>
>>Please the MAQ page, http://mailscanner.biz/maq/
>>
>>It is at the beginning.
> 
> 
> Where !?
>  
> I searched on http://www.jiscmail.ac.uk/cgi-bin/wa.exe?S1=mailscanner
> mail archive with "filename check" but nothing point to that.
> 
> Sam.
> 
> 
> 
http://www.mailscanner.biz/maq/#beforeanything

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From kte at NEXIS.BE  Fri Nov 12 18:17:15 2004
From: kte at NEXIS.BE (Koen Teugels)
Date: Thu Jan 12 21:27:34 2006
Subject: {Scanned} Re: {Scanned} Re: {Scanned} Re: Proce ssClamAVOutput
    : unrecognised line ... contact the authors
Message-ID: <mailman.4638.1137101254.24926.mailscanner@lists.mailscanner.info>

Normal mail and normal zips with eicar test virus are correctly detected.
Only tgz attachment give the problem. I'm in the latest stable versions
op mailscanner, spamassassin , clamav. And i'm using a redhat clone
linux.

thanks koen

Desai, Jason wrote:
      Just to be clear, I'm not talking about your path to
      MailScanner.conf.  Rather I am talking about options in
      MailScanner.conf, specifically, Incoming Work Dir.
 
Jase
-----Original Message-----
From: Koen Teugels [mailto:kte@NEXIS.BE]
Sent: Friday, November 12, 2004 11:17 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: [MAILSCANNER] {Scanned} Re: {Scanned} Re: {Scanned}
Re: ProcessClamAVOutput : unrecognised line ... contact the
authors

      yep , everything is on /etc/Mailscanner/

      Desai, Jason wrote:
            Are you sure all of your paths in your
            MailScanner.conf file are absolute paths
            and do not contain any symbolic links?
 
Jase
-----Original Message-----
From: Koen Teugels [mailto:kte@NEXIS.BE]
Sent: Friday, November 12, 2004 8:46 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: [MAILSCANNER] {Scanned} Re: {Scanned}
Re: ProcessClamAVOutput: unrecognised line ...
contact the authors

      Just did some more testing. And I don't
      think it is the virus scanner. Because I
      tried another one and the virus still
      passes. So i think it must be the unzip /
      tar that has a problem. all tgz have this
      problem.

      Koen

      Koen Teugels wrote:
            Could it be that mailscanner
            has problems with .tgz
            extensions??


            just test the
            copfilter-0.0.95.tgz with
            bitdefender only and he lets
            the
            eicar virus pass. When I put
            the virus direct or in a simple
            zip files
            he doesn't pass.
            But the copfilter-0.0.95.tgz
            virusscan gives as output in
            maillog
            viruses found. But doesn't do
            anything with it.

            thanks Koen


            Julian Field wrote:

                  Please upgrade your
                  clamav to the
                  latest CVS version
                  available from
                  www.clamav.net and
                  try the test again.

                  Koen Teugels wrote:

                        Virus
                        Scanners
                        =
                        clamav
                        bitdefender
                        clamav
                        is at
                        version
                        0.80.1
                        and
                        bitdefender
                        BitDefender-Console-Antivirus-7.0.1-3.linux-gcc3x.i586.rpm
                        Bt they
                        let
                        pass
                        the
                        attachment
                        copfilter-0.0.95.tgz
                        with
                        the
                        eicar
                        test
                        virus
                        in it
                        with
                        status
                        clean.
                        I use
                        a  RHEL
                        clone
                        with
                        the
                        latest
                        yum
                        updates.
                        version
                        MailScanner-4.35.11-1.rpm.tar.gz
                        with
                        spamassassin
                        3.0.1
                        and
                        plugins
                        DCC,
                        razor
                        and ...
                        Just a
                        standard
                        install
                        no
                        custom
                        rules
                        yet.

                        Thanks
                        Koen


------------------------ MailScanner list
------------------------ To unsubscribe, email
jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ
(http://www.mailscanner.biz/maq/)
and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the
website!


------------------------ MailScanner list
------------------------ To unsubscribe, email
jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ
(http://www.mailscanner.biz/maq/)
and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the
website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From kte at NEXIS.BE  Fri Nov 12 18:22:48 2004
From: kte at NEXIS.BE (Koen Teugels)
Date: Thu Jan 12 21:27:34 2006
Subject: {Scanned} Re: {Scanned} Re: {Scanned} Re: Proce ssClamAVOutput
    : unrecognised line ... contact the authors
Message-ID: <mailman.4639.1137101254.24926.mailscanner@lists.mailscanner.info>

this is my installlation

This is Tao Linux release 1 (Mooch Update 3)
This is Perl version 5.008000 (5.8.0)

This is MailScanner version 4.35.11
Module versions are:
1.00    AnyDBM_File
1.14    Archive::Zip
1.01    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.04    Fcntl
2.71    File::Basename
2.05    File::Copy
2.01    FileHandle
1.05    File::Path
0.13    File::Temp
1.23    HTML::Entities
3.26    HTML::Parser
2.24    HTML::TokeParser
1.20    IO
1.09    IO::File
1.122   IO::Pipe
3.05    MIME::Base64
5.415   MIME::Decoder
5.415   MIME::Decoder::UU
5.415   MIME::Head
5.415   MIME::Parser
3.03    MIME::QuotedPrint
5.415   MIME::Tools
0.09    Net::CIDR
1.05    POSIX
1.75    Socket
0.03    Sys::Syslog
1.02    Time::localtime

Optional module versions are:
1.806   DB_File
1.08    Digest
1.01    Digest::HMAC
2.33    Digest::MD5
2.01    Digest::SHA1
missing Inline
missing Mail::ClamAV
3.000001        Mail::SpamAssassin
missing Mail::SPF::Query
missing Net::CIDR::Lite
0.48    Net::DNS
0.31    Net::LDAP
missing Parse::RecDescent
missing SAVI
missing Sys::Hostname::Long
2.26    Test::Harness
0.47    Test::Simple
1.89    Text::Balanced
1.19    URI


Is there something missing ??

thanks Koen

Koen Teugels wrote:
      Normal mail and normal zips with eicar test virus are
      correctly detected. Only tgz attachment give the problem. I'm
      in the latest stable versions op mailscanner, spamassassin ,
      clamav. And i'm using a redhat clone linux.

      thanks koen

      Desai, Jason wrote:
            Just to be clear, I'm not talking about your path
            to MailScanner.conf.  Rather I am talking about
            options in MailScanner.conf, specifically,
            Incoming Work Dir.
 
Jase
-----Original Message-----
From: Koen Teugels [mailto:kte@NEXIS.BE]
Sent: Friday, November 12, 2004 11:17 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: [MAILSCANNER] {Scanned} Re: {Scanned} Re:
{Scanned} Re: ProcessClamAVOutput : unrecognised line
... contact the authors

      yep , everything is on /etc/Mailscanner/

      Desai, Jason wrote:
            Are you sure all of your paths in
            your MailScanner.conf file are
            absolute paths and do not contain any
            symbolic links?
 
Jase
-----Original Message-----
From: Koen Teugels [mailto:kte@NEXIS.BE]
Sent: Friday, November 12, 2004 8:46 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: [MAILSCANNER] {Scanned} Re:
{Scanned} Re: ProcessClamAVOutput:
unrecognised line ... contact the authors

      Just did some more testing. And I
      don't think it is the virus scanner.
      Because I tried another one and the
      virus still passes. So i think it
      must be the unzip / tar that has a
      problem. all tgz have this problem.

      Koen

      Koen Teugels wrote:
            Could it be that
            mailscanner has problems
            with .tgz extensions??


            just test the
            copfilter-0.0.95.tgz with
            bitdefender only and he
            lets the
            eicar virus pass. When I
            put the virus direct or
            in a simple zip files
            he doesn't pass.
            But the
            copfilter-0.0.95.tgz
            virusscan gives as output
            in maillog
            viruses found. But
            doesn't do anything with
            it.

            thanks Koen


            Julian Field wrote:

                  Please
                  upgrade your
                  clamav to the
                  latest CVS
                  version
                  available
                  from
                  www.clamav.net
                  and try the
                  test again.

                  Koen Teugels
                  wrote:

                        Virus
                        Scanners
                        =
                        clamav
                        bitdefender
                        clamav
                        is
                        at
                        version
                        0.80.1
                        and
                        bitdefender
                        BitDefender-Console-Antivirus-7.0.1-3.linux-gcc3x.i586.rpm
                        Bt
                        they
                        let
                        pass
                        the
                        attachment
                        copfilter-0.0.95.tgz
                        with
                        the
                        eicar
                        test
                        virus
                        in
                        it
                        with
                        status
                        clean.
                        I
                        use
                        a 
                        RHEL
                        clone
                        with
                        the
                        latest
                        yum
                        updates.
                        version
                        MailScanner-4.35.11-1.rpm.tar.gz
                        with
                        spamassassin
                        3.0.1
                        and
                        plugins
                        DCC,
                        razor
                        and
                        ...
                        Just
                        a
                        standard
                        install
                        no
                        custom
                        rules
                        yet.

                        Thanks
                        Koen


------------------------ MailScanner list
------------------------ To unsubscribe, email
jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ
(http://www.mailscanner.biz/maq/)
and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book
off the website!


------------------------ MailScanner list
------------------------ To unsubscribe, email
jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ
(http://www.mailscanner.biz/maq/)
and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the
website!

------------------------ MailScanner list
------------------------ To unsubscribe, email
jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ
(http://www.mailscanner.biz/maq/)
and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the
website!


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From bno at SALVAGEBV.NL  Fri Nov 12 18:53:50 2004
From: bno at SALVAGEBV.NL (Bob Noordam)
Date: Thu Jan 12 21:27:34 2006
Subject: off topic:  email forwarding assistance/guidance needed
Message-ID: <mailman.4640.1137101254.24926.mailscanner@lists.mailscanner.info>

> -----Oorspronkelijk bericht-----
> Van: MailScanner mailing list
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] Namens lester lasad
> Verzonden: donderdag 11 november 2004 22:49
> Aan: MAILSCANNER@JISCMAIL.AC.UK
> Onderwerp: Re: off topic: email forwarding assistance/guidance needed
>
> --- Mike Kercher <mike@CAMAROSS.NET> wrote:
>
> > lester lasad wrote:
> > > --- "H.P. Noordam" <bno@SALVAGEBV.NL> wrote:
> > >
> > >> MailScanner mailing list
> > >> <MAILSCANNER@JISCMAIL.AC.UK> wrote on 10/11/2004
> > >> 16:47:01:
> > >>
> > >>> My MailScanner/Sendmail server is relaying email
> > to 2
> > >>> seperate domains.  A majority of my users (3000)
> > have
> > >>> email accounts in the "abc.com" domain, but we
> > have
> > >>> roughly 40 users that have an account in both
> > the abc.com and
> > >>> xyz.com domains.
> > >>>
> > >>> The 40 isers in the abc.com and xyz.com domain
> > use both addresses at
> > >>> this point but, I would like to deliver emails
> > for both addresses
> > >>> to one domain. example:  if lester@xyz.com
> > receives an email I would
> > >>> like sendmail to route the email to
> > lester@abc.com (instead of the
> > >>> xyz.com address).  The xyz.com
> > >> domain
> > >>> will be obsolete in the future but I can't get
> > rid of
> > >>> it yet but I would like to eliminate the xyz.com
> > host
> > >>> that sendmail is relaying to.
> > >>>
> > >>> Hopefully what I said makes sense, if not,
> > please ask
> > >>> for additional info.  Thanks in advance for your
> > assistance.
> > >>>
> > >>>
> > >>>
> > >>
> > >>
> > >> the virtusertable (/etc/mail/virtusertable)
> > enables you to map single
> > >> users or complete domains to other recipients, so
> > >> thats is the place to
> > >> map *@xyz to *@abc.
> > >>
> > >> Bob.
> > >>
> > > Thanks for the info.  I did try to forward one
> > > particular users email unsuccessfully and  wanted
> > to
> > > give you more specifics on my setup.
> > >
> > > my mailertable says the following:
> > > abc.com    esmtp:abcmailsvr.abc.com
> > > xyz.com    esmtp:xyzmailsvr.xyz.com
> > >
> > > I added the following to the
> > /etc/mail/virtusertable:
> > > lester@xyz.com      lester@abc.com  (which should
> > send
> > > the email to lester@abc.com)
> > >
> > > I then tried to send an email to lester@xyz.com
> > and
> > > received the following:
> > > ----- The following addresses had permanent fatal
> > > errors -----
> > > <lester@xyz.com>
> > >     (reason: 553 5.3.5 system config error)
> > >
> > >    ----- Transcript of session follows -----
> > > 553 5.3.5 xyzmailsvr.xyz.com. config error: mail
> > loops
> > > back to me (MX
> > > problem?)
> > > 554 5.3.5 Local configuration error
> > >
> > > I must be missing something.  thanks.
> > >
> >
> > Do you have abc.com and xyz.com in your
> > /etc/mail/local-host-names or
> > /etc/mail/relay-domains?  They should be in
> > relay-domains.  Also, make sure
> > you hashed your virtusertable to db.
> >
> > You will need to restart sendmail to read the
> > relay-domains after
> > modification.
> >
> > Mike
> >
> abc.com and xyz.com are not in
> /etc/mail/local-host-names.  But, they are in
> /etc/mail/relay-domains
>
> forgive me, but I'm not sure what you mean by "make
> sure you hashed your virtusertable to db"
>

sendmail does not reed the textfiles directly, is uses a database file you
need to create from the textfiles.
If you alter any file, say virtusertable, you need to issue the command

makemap hash virtusertable.db < virtusertable

With that, you create the new file sendmail will use.
After that, restart sendmail and it will 'see' the modifications.

> I have restarted sendmail as well.  When I send the
> email it is still routing to the xyz.com host and not
> the abc.com host.  I want to take the xyz.com host out
> of the picture.  Should I remove it from my
> mailertable and see what happens?
>

thats worth a try, if xyz is mentioned nowhere, and it still resolves to its
own mx you should look further into possible dns issues.

Bob.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From marco at XSSNET.COM  Fri Nov 12 19:03:07 2004
From: marco at XSSNET.COM (Marco Benton)
Date: Thu Jan 12 21:27:34 2006
Subject: off topic:  email forwarding assistance/guidance needed
Message-ID: <mailman.4641.1137101254.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Bob Noordam wrote:

><....snip...>
>
>
>sendmail does not reed the textfiles directly, is uses a database file you
>need to create from the textfiles.
>If you alter any file, say virtusertable, you need to issue the command
>
>makemap hash virtusertable.db < virtusertable
>
>With that, you create the new file sendmail will use.
>After that, restart sendmail and it will 'see' the modifications.
>
>
>

you dont have to restart Sendmail after updating db.  a restart is only
needed if you change a .cf file or recreate a .cf file through m4.

and a user might get in trouble with that command above...  it should be
"makemap hash virtusertable < virtusertable".  but that also depends on
how it is defined in the sendmail.cf.

--

Marco Benton - BOFH, BSMFH
Network Consultant

BOFH excuse #385: The cause of the problem is: The Internet is being scanned for viruses.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mikes at HARTWELLCORP.COM  Fri Nov 12 19:37:52 2004
From: mikes at HARTWELLCORP.COM (Michael St. Laurent)
Date: Thu Jan 12 21:27:34 2006
Subject: Never getting URIBL_PH_SURBL hits
Message-ID: <mailman.4642.1137101254.24926.mailscanner@lists.mailscanner.info>

Julian Field <> wrote:
> Just to prove I am in fact mortal after all...
[snip]

Blasphemy!!!  ;-D

--
Michael St. Laurent
Hartwell Corporation

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jamey at teamlightning.com  Fri Nov 12 20:36:15 2004
From: jamey at teamlightning.com (Jamey Nelson)
Date: Thu Jan 12 21:27:34 2006
Subject: Disarm HTML in message will disarm / Blank Body
Message-ID: <mailman.4643.1137101254.24926.mailscanner@lists.mailscanner.info>

In my MailScanner.conf file, there is nothing set to disarm any HTML, however,
I'm getting this in my log files:

Nov 12 15:30:48 gandalf MailScanner[32548]: Content Checks: Detected and will
disarm HTML message in iACKUdCM032630

I believe this is also causing another problem I'm having. It seems that some
messages are getting through with the HTML bodies blank, however, the text
body portion is still in place.

Any ideas?



(Log Excerpt Below)

Nov 12 15:30:48 ccc MailScanner[32548]: Virus and Content Scanning: Starting
Nov 12 15:30:48 ccc MailScanner[32548]: Content Checks: Detected and will
disarm HTML message in iACKUdCM032630
Nov 12 15:30:48 ccc MailScanner[32548]: Uninfected: Delivered 1 messages
Nov 12 15:30:50 ccc MailScanner[32609]: New Batch: Scanning 1 messages, 13348
bytes
Nov 12 15:30:52 ccc MailScanner[32665]: Using locktype = flock
Nov 12 15:30:57 ccc MailScanner[32609]: Spam Checks: Found 1 spam messages
Nov 12 15:30:58 ccc MailScanner[32609]: Virus and Content Scanning: Starting
Nov 12 15:30:58 ccc MailScanner[32609]: Content Checks: Detected and will
disarm HTML message in iACKUUCM032587
Nov 12 15:30:58 ccc MailScanner[32609]: Uninfected: Delivered 1 messages

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jamey at teamlightning.com  Fri Nov 12 20:42:50 2004
From: jamey at teamlightning.com (Jamey Nelson)
Date: Thu Jan 12 21:27:34 2006
Subject: Disarm HTML in message will disarm / Blank Body
Message-ID: <mailman.4644.1137101254.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Update:

Disabling the phishing feature stopped this message from being displayed in
the logs, and I believe would stop the blank bodies, however, I would really
prefer to use the phishing feature.


Running on
Linux gandalf.teamlightning.com 2.4.20-31.9smp #1 SMP Tue Apr 13 17:40:10 EDT
2004 i686 i686 i386 GNU/Linux
This is Red Hat Linux release 9 (Shrike)
This is Perl version 5.008000 (5.8.0)

This is MailScanner version 4.35.11
Module versions are:
1.00    AnyDBM_File
1.14    Archive::Zip
1.01    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.04    Fcntl
2.71    File::Basename
2.05    File::Copy
2.01    FileHandle
1.05    File::Path
0.13    File::Temp
1.27    HTML::Entities
3.36    HTML::Parser
2.28    HTML::TokeParser
1.20    IO
1.09    IO::File
1.122   IO::Pipe
3.05    MIME::Base64
5.415   MIME::Decoder
5.415   MIME::Decoder::UU
5.415   MIME::Head
5.415   MIME::Parser
3.03    MIME::QuotedPrint
5.415   MIME::Tools
0.09    Net::CIDR
1.05    POSIX
1.75    Socket
0.03    Sys::Syslog
1.02    Time::localtime

Optional module versions are:
1.806   DB_File
1.05    Digest
1.01    Digest::HMAC
2.20    Digest::MD5
2.10    Digest::SHA1
0.44    Inline
0.13    Mail::ClamAV
2.64    Mail::SpamAssassin
1.997   Mail::SPF::Query
0.15    Net::CIDR::Lite
0.48    Net::DNS
missing Net::LDAP
1.94    Parse::RecDescent
missing SAVI
1.2     Sys::Hostname::Long
2.26    Test::Harness
0.47    Test::Simple
1.89    Text::Balanced
1.31    URI



On Friday 12 November 2004 15:36, Jamey Nelson wrote:
> In my MailScanner.conf file, there is nothing set to disarm any HTML,
> however, I'm getting this in my log files:
>
> Nov 12 15:30:48 gandalf MailScanner[32548]: Content Checks: Detected and
> will disarm HTML message in iACKUdCM032630
>
> I believe this is also causing another problem I'm having. It seems that
> some messages are getting through with the HTML bodies blank, however, the
> text body portion is still in place.
>
> Any ideas?
>
>
>
> (Log Excerpt Below)
>
> Nov 12 15:30:48 ccc MailScanner[32548]: Virus and Content Scanning:
> Starting Nov 12 15:30:48 ccc MailScanner[32548]: Content Checks: Detected
> and will disarm HTML message in iACKUdCM032630
> Nov 12 15:30:48 ccc MailScanner[32548]: Uninfected: Delivered 1 messages
> Nov 12 15:30:50 ccc MailScanner[32609]: New Batch: Scanning 1 messages,
> 13348 bytes
> Nov 12 15:30:52 ccc MailScanner[32665]: Using locktype = flock
> Nov 12 15:30:57 ccc MailScanner[32609]: Spam Checks: Found 1 spam messages
> Nov 12 15:30:58 ccc MailScanner[32609]: Virus and Content Scanning:
> Starting Nov 12 15:30:58 ccc MailScanner[32609]: Content Checks: Detected
> and will disarm HTML message in iACKUUCM032587
> Nov 12 15:30:58 ccc MailScanner[32609]: Uninfected: Delivered 1 messages
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From samp at ARIAL-CONCEPT.COM  Fri Nov 12 21:08:11 2004
From: samp at ARIAL-CONCEPT.COM (Sam Przyswa)
Date: Thu Jan 12 21:27:34 2006
Subject: Filename checking by From and To address
Message-ID: <mailman.4645.1137101254.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-15" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Le ven 12/11/2004 ŕ 19:02, Ugo Bellavance a écrit :
> Sam Przyswa wrote:
> > Le ven 12/11/2004 ŕ 17:11, Ugo Bellavance a écrit :
> > 
> >>Sam Przyswa wrote:
> >>
> >>>Hi,
> >>>
> >>>I have to accept *.exe attachment files only from some mail addresses or
> >>>domains and I don't find anything about this feature, is it possible to
> >>>that ?
> >>
> >>I'm surprised you can't find anything about that, this is the most asked
> >>question :).
> >>
> >>Please the MAQ page, http://mailscanner.biz/maq/
> >>
> >>It is at the beginning.
> > 
> > 
> > Where !?
> >  
> > I searched on http://www.jiscmail.ac.uk/cgi-bin/wa.exe?S1=mailscanner
> > mail archive with "filename check" but nothing point to that.
> > 
> > Sam.
> > 
> > 
> > 
> http://www.mailscanner.biz/maq/#beforeanything

Thanks to everybody on this list for your help !

Sam.



-- 
Ce message a été vérifié par MailScanner
pour des virus ou des polluriels et rien de
suspect n'a été trouvé.
MailScanner remercie transtec pour son soutien.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From kevins at BMRB.CO.UK  Fri Nov 12 21:56:22 2004
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:27:34 2006
Subject: {Scanned} bitdefender doesn't update
Message-ID: <mailman.4646.1137101254.24926.mailscanner@lists.mailscanner.info>

On Fri, 2004-11-12 at 13:33, Julian Field wrote:
> Can other people confirm this please? I didn't write the original script and
> it's horribly complicated, and the comments are all in Italian :-(
>
IIRC Those lines were commented out a while ago when a faulty plugin
from bitdefender caused the commented command to stop working and never
return.  Commenting those lines out allowed the updates to start working
again.  I suspect (haven't actually looked) that the script doesn't
clean up after itself so the temporary files it creates would still have
been present on the systems of users who commented those lines after
experiencing problems.  However... For any users who installed
bitdefender when those lines were already commented the temporary files
would not already be in existance, thus causing countViruses($file) to
fail.  Plausible?

In any event the problem with bitdefender that made the comments
necessary has now been fixed so the lines should probably be
uncommented.




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From kevins at BMRB.CO.UK  Fri Nov 12 22:05:19 2004
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:27:34 2006
Subject: {Scanned} Re: {Scanned} bitdefender doesn't update
Message-ID: <mailman.4647.1137101254.24926.mailscanner@lists.mailscanner.info>

On Fri, 2004-11-12 at 13:51, David While wrote:
> I could never get it to work :( so I rewrote the update script based
> on the Clam update script.

Maybe you should share, having looked at it in the past the bitdefender
autoupdate script as shipped is a nightmare to work with.  Perhaps
Julian would consider replacing the existing script with yours?




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From greg at BLASTZONE.COM  Sat Nov 13 05:28:35 2004
From: greg at BLASTZONE.COM (Greg Deputy)
Date: Thu Jan 12 21:27:34 2006
Subject: NASTY phishing attack!
Message-ID: <mailman.4648.1137101254.24926.mailscanner@lists.mailscanner.info>

Take a look at this NASTY phishing attack.  It managed to sneak past the
MailScanner phishing detector, but was caught as spam.  What makes it
especially nasty is the page uses some sort of IE client side scripting
functionality that puts a text box on TOP of the browser address bar, so
it covers the actual URL!  I noticed it because I have the google
toolbar installed and it came up on top of that instead.

Very scary, any non-techie sort of person could easily be fooled by
this.  Yuck!

In case the page goes down or if you don't have access to a machine
running IE, here's a screenshot:

http://greg.blastzone.com/nastyPhish.jpg

> -----Original Message-----
> From: Washington Mutual Bank [mailto:service@wamu.com]
> Sent: Friday, November 12, 2004 7:05 PM
> To: undisclosed-recipients:
> Subject: [spam] {Spam?} Security Measures !
>
>
> The Blastzone.com MailScanner believes that the attachment to
> this message sent to you
>
>     From: service@wamu.com
>  Subject: Security Measures !
>
> is Unsolicited Commercial Email (spam). Unless you are sure
> that this message is incorrectly thought to be spam, please
> delete this message without opening it. Opening spam messages
> might allow the spammer to verify your email address.
>
> If you believe that this message has been incorrectly marked
> as spam, please forward this email to ham@blastzone.com.
>
>  pts rule name              description
> ---- ----------------------
> --------------------------------------------------
>  1.3 UNDISC_RECIPS          Valid-looking To "undisclosed-recipients"
>  0.0 NORMAL_HTTP_TO_IP      URI: Uses a dotted-decimal IP
> address in URL
>  0.0 HTML_MESSAGE           BODY: HTML included in message
>  0.2 MIME_HTML_ONLY         BODY: Message only has text/html
> MIME parts
>  0.1 HTML_50_60             BODY: Message is 50% to 60% HTML
>  0.0 HTML_TITLE_EMPTY       BODY: HTML title contains no text
> -0.4 BAYES_05               BODY: Bayesian spam probability is 1 to 5%
>                             [score: 0.0204]
>  1.5 RAZOR2_CHECK           Listed in Razor2 (http://razor.sf.net/)
>  2.2 DCC_CHECK              Listed in DCC
> (http://rhyolite.com/anti-spam/dcc/)
>  0.1 DIGEST_MULTIPLE
>    Message hits more than one network digest check
>  0.6 FORGED_OUTLOOK_HTML    Outlook can't send HTML message only
>  0.1 FORGED_OUTLOOK_TAGS    Outlook can't send HTML in this format
>  0.0 FORGED_MUA_OUTLOOK     Forged mail pretending to be from
> MS Outlook
>
>
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Message/RFC822  10KB. ]
    [ Unable to print this part. ]


    [ Part 2.1.2: "Attached Text" ]

    [ The following text is in the "Windows-1251" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

[IMAGE]
 
Dear Washington Mutual customer,
 
We recently reviewed your account, and suspect that your Washington
Mutual Internet Banking accountmay have been
accessed by an unauthorized third party.
Protecting the security of your account and of the Washington Mutual
network is our primary concern. Therefore, as a
preventative measure, we have temporarily limited access to sensitive
account features.
 
To restore your account access, please take the following steps to ensure
that your account has not been compromised:
 
1. Login to your Washington Mutual Internet Banking account. In case you
are not enrolled for Internet Banking, you will
have to fill in all the required information, including your name and you
account number.
 
2. Review your recent account history for any unauthorized withdrawals or
deposits, and check you account profile to
make sure not changes have been made. If any unauthorized activity has
taken place on your account, report this to
Washington Mutual staff immediately.
 
To get started, please click the link below:
 
MailScanner has detected a possible fraud attempt from "66.226.68.25"
claiming to be https://login.personal.wamu.com/logon/logon.asp?dd=1
 
We apologize for any inconvenience this may cause, and appreciate your
assistance in helping us maintain the integrity of
the entire Washington Mutual system. Thank you for attention to this
matter.
 
 
 
Sincerely,
 
The Washington Mutual Team
 
Please do not reply to this e-mail. Mail sent to this address cannot be
answered. For assistance, log in to your
Washington Mutual account and choose the "Help" link in the header of any
page.
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2.2, Image/GIF  2.3KB. ]
    [ Unable to print this part. ]


From David.While at UCE.AC.UK  Sat Nov 13 09:26:19 2004
From: David.While at UCE.AC.UK (David While)
Date: Thu Jan 12 21:27:34 2006
Subject: {Scanned} Re: {Scanned} bitdefender doesn't update
Message-ID: <mailman.4649.1137101254.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "UTF-8" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

OK no problem
 
My bitdefender update script is attached. It simply calls bdc with the -update option and looks at the response it gets. If it gets "no updates available" then logs appropriately otherwise logs that it has updated.
 
David While

	-----Original Message----- 
	From: MailScanner mailing list on behalf of Kevin Spicer 
	Sent: Fri 12/11/2004 22:05 
	To: MAILSCANNER@JISCMAIL.AC.UK 
	Cc: 
	Subject: Re: {Scanned} Re: {Scanned} bitdefender doesn't update
	
	

	On Fri, 2004-11-12 at 13:51, David While wrote:
	> I could never get it to work :( so I rewrote the update script based
	> on the Clam update script.
	
	Maybe you should share, having looked at it in the past the bitdefender
	autoupdate script as shipped is a nightmare to work with.  Perhaps
	Julian would consider replacing the existing script with yours?
	
	
	
	
	BMRB International
	http://www.bmrb.co.uk
	+44 (0)20 8566 5000
	_________________________________________________________________
	This message (and any attachment) is intended only for the
	recipient and may contain confidential and/or privileged
	material.  If you have received this in error, please contact the
	sender and delete this message immediately.  Disclosure, copying
	or other action taken in respect of this email or in
	reliance on it is prohibited.  BMRB International Limited
	accepts no liability in relation to any personal emails, or
	content of any email which does not directly relate to our
	business.
	
	------------------------ MailScanner list ------------------------
	To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
	'leave mailscanner' in the body of the email.
	Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
	the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
	
	Support MailScanner development - buy the book off the website!
	
	


From alex at SKYNET-SRL.COM  Sat Nov 13 09:51:36 2004
From: alex at SKYNET-SRL.COM (Alessandro Bianchi)
Date: Thu Jan 12 21:27:34 2006
Subject: bitdefender update test
Message-ID: <mailman.4650.1137101254.24926.mailscanner@lists.mailscanner.info>

Hi everyone

I'm the author of the original bitdefender script.

I'm not using bdc at the moment since it is incompatible with kernels
higher than 2.6.5, so I cant' test the script.

Since I assume the reoubles the list is having come from bdc itself, I
enclose a simplified version of the script THAT ONLY WORKS WITH VERSION
7 (NOT OLDER).

It should be very simple even to fix just in case.

I've already asked a couple of users to test it but had not any answer
till now.

Hope this may help you all

Best regards

Alessandro




------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Application/TEXT  7.1KB. ]
    [ Unable to print this part. ]


    [ Part 3: "Attached Text" ]



------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From hywel at BURRIS.ORG.UK  Sat Nov 13 11:13:16 2004
From: hywel at BURRIS.ORG.UK (Hywel Burris)
Date: Thu Jan 12 21:27:34 2006
Subject: OT: Bitdefender issues
Message-ID: <mailman.4651.1137101254.24926.mailscanner@lists.mailscanner.info>

Hi All,

I am using Fedora Core 2 on my home system, bitdefender recently stopped
working. I haven't had much time to look at this so just disabled
bitdefender. I have now had a little time and found the problem

Bitdefender was erroring with:-
[root@mail kernel]#  bdc -all   /
BDC/Linux-Console v7.0 (build 2490) (i386) (Dec 10 2003 16:11:35)
Copyright (C) 1996-2003 SOFTWIN SRL. All rights reserved.

Segmentation fault


After running this through strace it fails with :-
open("/proc/11956/maps", O_RDONLY)      = 3
fstat64(3, {st_mode=S_IFREG|0400, st_size=0, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0xf6fde000
read(3, "00111000-0011e000 r-xp 00000000 "..., 1024) = 1024
close(3)                                = 0
munmap(0xf6fde000, 4096)                = 0
time(NULL)                              = 1100343494
mkdir("/tmp/tmp3d13cc0b", 0700)         = 0
lstat64("/opt/bdc/Plugins", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
open("/opt/bdc/Plugins/", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 3
fstat64(3, {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
fcntl64(3, F_SETFD, FD_CLOEXEC)         = 0
getdents64(3, /* 88 entries */, 4096)   = 2800
lstat64("/opt/bdc/Plugins/jpeg.xmd", {st_mode=S_IFREG|0644, st_size=850,
...}) = 0
open("/opt/bdc/Plugins/jpeg.xmd", O_RDONLY) = 4
lseek(4, 0, SEEK_CUR)                   = 0
lseek(4, 0, SEEK_END)                   = 850
lseek(4, 0, SEEK_CUR)                   = 850
lseek(4, 0, SEEK_SET)                   = 0
read(4, "\300\1\300\336", 4)            = 4
lseek(4, 0, SEEK_SET)                   = 0
read(4, "\300\1\300\336\1\0\0\0{\4\0\0Y\0\0\0;\4\0\0\4\0\0\0\324"..., 68) =
68
read(4, "x\332\335TAk\23A\24\236M\266\232\246\t)\322JQ\204\5\247"..., 850) =
782
close(4)                                = 0
--- SIGSEGV (Segmentation fault) @ 0 (0) ---
+++ killed by SIGSEGV +++


After doing some googling I found the answer on a german site (babelfish
thank you :))

The problem is to do with a kernel security feature called exec-shield to
solve the above problem you need to turn it off with the following command

echo 0 > /proc/sys/kernel/exec-shield

There is some more background info at
http://people.redhat.com/mingo/exec-shield/ANNOUNCE-exec-shield

Here come my questions :)
Has anybody else had this problem with bitdefender & FC2? (I think it
happened after upgrading to kernel-2.6.8-1.521)

Does anyone know what issues there maybe with running without exec-shield
running or if there maybe another way around this?

Thanks

Hywel





------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Application/X-PKCS7-SIGNATURE  4.1KB. ]
    [ Unable to print this part. ]


From hywel at BURRIS.ORG.UK  Sat Nov 13 11:33:35 2004
From: hywel at BURRIS.ORG.UK (Hywel Burris)
Date: Thu Jan 12 21:27:34 2006
Subject: bitdefender update test
Message-ID: <mailman.4652.1137101254.24926.mailscanner@lists.mailscanner.info>



> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Alessandro Bianchi
> Sent: 13 November 2004 09:52
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: bitdefender update test
>
> Hi everyone
>
> I'm the author of the original bitdefender script.
>
> I'm not using bdc at the moment since it is incompatible with kernels
> higher than 2.6.5, so I cant' test the script.
>
> Since I assume the reoubles the list is having come from bdc itself, I
> enclose a simplified version of the script THAT ONLY WORKS WITH VERSION
> 7 (NOT OLDER).
>
> It should be very simple even to fix just in case.
>
> I've already asked a couple of users to test it but had not any answer
> till now.
>
> Hope this may help you all
>
> Best regards
>
> Alessandro

Hi Alessandro,

I just posted a message to the group about this please see the other tread.

I got the following error from your script.

[root@mail MailScanner]# ./bitdefender-autoupdate-new
Undefined subroutine &main::UpdateLog called at ./bitdefender-autoupdate-new
line 126.

I had to add my $PackageDir = shift || "/opt/bdc"; to get it to work


All I need now is an update to check it properly

Thanks

Hywel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Application/X-PKCS7-SIGNATURE  4.1KB. ]
    [ Unable to print this part. ]


From michele at BLACKNIGHTSOLUTIONS.COM  Sat Nov 13 12:06:15 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon::Blacknight Solutions)
Date: Thu Jan 12 21:27:34 2006
Subject: HOWTO: Setting up local DNSBL mirror
Message-ID: <mailman.4653.1137101254.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "UTF-8" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

A couple of people were asking me about setting up DNSBL mirrors on the
IRC channel yesterday, so I've written a basic "howto".
Your feedback / comments/ critique would be appreciated:
http://www.mneylon.com/blog/archives/2004/11/13/dns-blacklists-setting-up-a-local-mirror/

Disclaimer: This configuration and setup works for me. If it does not
work for you I will not accept any responsibility. If you notice any
errors or ommissions please let me know, but do not blame me if your DNS
server ceases to work or explodes. The information is provided â^Ŕ^Üas is".


Michele


-- 
 Mr. Michele Neylon
Blacknight Solutions
Hosting, Co-location & Domain Registration
http://www.blacknight.ie/
Tel. +353 (0)59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Sat Nov 13 16:50:22 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:34 2006
Subject: {Scanned} bitdefender doesn't update
Message-ID: <mailman.4654.1137101254.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Kevin Spicer wrote:

>On Fri, 2004-11-12 at 13:33, Julian Field wrote:
>
>
>>Can other people confirm this please? I didn't write the original script and
>>it's horribly complicated, and the comments are all in Italian :-(
>>
>>
>>
>IIRC Those lines were commented out a while ago when a faulty plugin
>from bitdefender caused the commented command to stop working and never
>return.  Commenting those lines out allowed the updates to start working
>again.  I suspect (haven't actually looked) that the script doesn't
>clean up after itself so the temporary files it creates would still have
>been present on the systems of users who commented those lines after
>experiencing problems.  However... For any users who installed
>bitdefender when those lines were already commented the temporary files
>would not already be in existance, thus causing countViruses($file) to
>fail.  Plausible?
>
>In any event the problem with bitdefender that made the comments
>necessary has now been fixed so the lines should probably be
>uncommented.
>
>
That rings some bells. I'll uncomment the lines.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Sat Nov 13 16:56:33 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:34 2006
Subject: Another phishing improvement patch
Message-ID: <mailman.4655.1137101254.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Another addition to the phishing net. This patch is designed to be
applied to the Message.pm file as distributed with 4.35.11.

This should help improve the detection rate.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2: "Attached Text" ]

--- Message.pm.old      Wed Nov  3 16:45:37 2004
+++ Message.pm  Sat Nov 13 16:00:35 2004
@@ -4043,21 +4043,27 @@
     $squashedtext =~ s#%([0-9a-f][0-9a-f])#chr(hex('0x' . $1))#gei; # Unescape
     $squashedtext =~ s/\s+//g; # Remove any whitespace
     $squashedtext =~ s/\\/\//g;
+    $squashedtext =~ s/(\<\/?[^>]*\>)*//ig; # Remove tags
+    #$squashedtext =~ s/^(\<\/?(br|p|ul)\>)*//ig; # Remove leading br, p, ul tags
     #print STDERR "Text = \"$text\"\n";
     #print STDERR "1SquashedText = \"$squashedtext\"\n";
     #print STDERR "1LinkURL      = \"$DisarmLinkURL\"\n";
     # If it looks like a link, remove any leading https:// or ftp://
-    if ($squashedtext =~ /^(w+|ftp)(\.|\%2e)/ ||
-        $squashedtext =~ s/^(ht+ps?|ft+p):\/\/(.*(\.|\%2e))/$2/) {
+    if ($squashedtext =~ /^(w+|ft+p|fpt+)([.,]|\%2e)/i ||
+        $squashedtext =~ /[.,](com|org|net|info|biz|ws)/i ||
+        $squashedtext =~ /^(ht+ps?|ft+p|fpt+)[:;]\/\/(.*(\.|\%2e))/i) {
+      $squashedtext =~  s/^(ht+ps?|ft+p|fpt+)[:;]\/\/(.*(\.|\%2e))/$2/i;
       $squashedtext =~ s/\/.*$//; # Only compare the hostnames
       $squashedtext =~ s/[,.]+$//; # Allow trailing dots and commas
       $linkurl = lc($DisarmLinkURL);
-      $linkurl =~ s/\%a0//g;
+      $linkurl =~ s/\%a0//ig;
       $linkurl =~ s#%([0-9a-f][0-9a-f])#chr(hex('0x' . $1))#gei; # Unescape
       $linkurl =~ s/\s+//; # Remove any whitespace
-      $linkurl =~ s/^(https?|ftp):\/\///;
+      #$linkurl =~ s/(\<\/?[^>]*\>)*//ig; # Remove tags
+      #$linkurl =~ s/^(\<\/?(br|p|ul)\>)*//ig; # Remove leading br, p, ul tags
+      $linkurl =~ s/^(https?|ftp):\/\///i;
       $linkurl =~ s/\/.*$//; # Only compare up to the first '/' (hostname only)
-      $linkurl =~ s/\<\/?(br|p)\>$//i; # Remove trailing <br> and <p> tags
+      $linkurl =~ s/(\<\/?(br|p|ul)\>)*$//ig; # Remove trailing br, p, ul tags
       $linkurl =~ s/\/$//; # LinkURL is trimmed -- note
       #print STDERR "2SquashedText = \"$squashedtext\"\n";
       #print STDERR "2LinkURL      = \"$linkurl\"\n";

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From mailscanner at ecs.soton.ac.uk  Sat Nov 13 17:03:11 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:34 2006
Subject: bitdefender update test
Message-ID: <mailman.4656.1137101254.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

All the -autoupdate and -wrapper scripts are designed to be called with
the av engine's installation directory as the first command-line argument.

Hywel Burris wrote:

>Hi Alessandro,
>
>I just posted a message to the group about this please see the other tread.
>
>I got the following error from your script.
>
>[root@mail MailScanner]# ./bitdefender-autoupdate-new
>Undefined subroutine &main::UpdateLog called at ./bitdefender-autoupdate-new
>line 126.
>
>I had to add my $PackageDir = shift || "/opt/bdc"; to get it to work
>
>
>All I need now is an update to check it properly
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Sat Nov 13 17:04:28 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:34 2006
Subject: NASTY phishing attack!
Message-ID: <mailman.4657.1137101254.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "windows-1251" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Do you have
Allow Script Tags = disarm
set in MailScanner.conf?

Greg Deputy wrote:

>Take a look at this NASTY phishing attack.  It managed to sneak past the
>MailScanner phishing detector, but was caught as spam.  What makes it
>especially nasty is the page uses some sort of IE client side scripting
>functionality that puts a text box on TOP of the browser address bar, so
>it covers the actual URL!  I noticed it because I have the google
>toolbar installed and it came up on top of that instead.
>
>Very scary, any non-techie sort of person could easily be fooled by
>this.  Yuck!
>
>In case the page goes down or if you don't have access to a machine
>running IE, here's a screenshot:
>
>http://greg.blastzone.com/nastyPhish.jpg
>
>
>
>>-----Original Message-----
>>From: Washington Mutual Bank [mailto:service@wamu.com]
>>Sent: Friday, November 12, 2004 7:05 PM
>>To: undisclosed-recipients:
>>Subject: [spam] {Spam?} Security Measures !
>>
>>
>>The Blastzone.com MailScanner believes that the attachment to
>>this message sent to you
>>
>>    From: service@wamu.com
>> Subject: Security Measures !
>>
>>is Unsolicited Commercial Email (spam). Unless you are sure
>>that this message is incorrectly thought to be spam, please
>>delete this message without opening it. Opening spam messages
>>might allow the spammer to verify your email address.
>>
>>If you believe that this message has been incorrectly marked
>>as spam, please forward this email to ham@blastzone.com.
>>
>> pts rule name              description
>>---- ----------------------
>>--------------------------------------------------
>> 1.3 UNDISC_RECIPS          Valid-looking To "undisclosed-recipients"
>> 0.0 NORMAL_HTTP_TO_IP      URI: Uses a dotted-decimal IP
>>address in URL
>> 0.0 HTML_MESSAGE           BODY: HTML included in message
>> 0.2 MIME_HTML_ONLY         BODY: Message only has text/html
>>MIME parts
>> 0.1 HTML_50_60             BODY: Message is 50% to 60% HTML
>> 0.0 HTML_TITLE_EMPTY       BODY: HTML title contains no text
>>-0.4 BAYES_05               BODY: Bayesian spam probability is 1 to 5%
>>                            [score: 0.0204]
>> 1.5 RAZOR2_CHECK           Listed in Razor2 (http://razor.sf.net/)
>> 2.2 DCC_CHECK              Listed in DCC
>>(http://rhyolite.com/anti-spam/dcc/)
>> 0.1 DIGEST_MULTIPLE
>>   Message hits more than one network digest check
>> 0.6 FORGED_OUTLOOK_HTML    Outlook can't send HTML message only
>> 0.1 FORGED_OUTLOOK_TAGS    Outlook can't send HTML in this format
>> 0.0 FORGED_MUA_OUTLOOK     Forged mail pretending to be from
>>MS Outlook
>>
>>
>>
>>
>>
>>
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>
>
> ------------------------------------------------------------------------
>
> Subject:
> Security Measures !
> From:
> "Washington Mutual Bank" <service@wamu.com>
> Date:
> Fri, 12 Nov 2004 19:05:10 -0800
> To:
> <undisclosed-recipients:>
>
> To:
> <undisclosed-recipients:>
>
>
>
> Dear Washington Mutual customer,
>
> We recently reviewed your account, and suspect that your Washington
> Mutual Internet Banking accountmay have been
> accessed by an unauthorized third party.
> Protecting the security of your account and of the Washington Mutual
> network is our primary concern. Therefore, as a
> preventative measure, we have temporarily limited access to sensitive
> account features.
>
> To restore your account access, please take the following steps to
> ensure that your account has not been compromised:
>
> 1. Login to your Washington Mutual Internet Banking account. In case
> you are not enrolled for Internet Banking, you will
> have to fill in all the required information, including your name and
> you account number.
>
> 2. Review your recent account history for any unauthorized withdrawals
> or deposits, and check you account profile to
> make sure not changes have been made. If any unauthorized activity has
> taken place on your account, report this to
> Washington Mutual staff immediately.
>
> To get started, please click the link below:
>
> *MailScanner has detected a possible fraud attempt from "66.226.68.25"
> claiming to be *
> _https://login.personal.wamu.com/logon/logon.asp?dd=1_
> <http://66.226.68.25/>_
>
> We apologize for any inconvenience this may cause, and appreciate your
> assistance in helping us maintain the integrity of
> the entire Washington Mutual system. Thank you for attention to this
> matter.
>
> _


--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mark at TIPPINGMAR.COM  Sat Nov 13 20:09:50 2004
From: mark at TIPPINGMAR.COM (Mark Nienberg)
Date: Thu Jan 12 21:27:34 2006
Subject: install-ClamAV-SA
Message-ID: <mailman.4658.1137101254.24926.mailscanner@lists.mailscanner.info>

I'm trying to use the install-ClamAV-SA rpm version package to upgrade
my SA from 2.63 to 3.01 on Fedora Core 1.  I'm not having a lot of
luck.  First, to be sure I have the correct db referred to at the top
of the script output:

[root@gingham perl-rpm]# rpm -qa | grep db
gdbm-1.8.0-21
db4-4.1.25-14
gdb-5.3.90-0.20030710.41
gdbm-devel-1.8.0-21
db4-devel-4.1.25-14
compat-db-4.0.14-2

I hope one of those it what it wants, probably db4 I would guess.

Next, the perl-Test-Harness package won't build because it fails a
test, but the script output says I don't have to worry about it so I
won't. (But the "make test" output is at the bottom of this message if
you are interested).

The ClamAV.rpm install failed with this:

Warning: I am about to uninstall the old Dag Wieers' RPM packages
Warning: of ClamAV and install Oliver Falk's RPMs instead.

Uninstalling...
error: package clamav-devel is not installed
error: package clamav-db is not installed
warning: /var/lib/clamav/daily.cvd saved as
/var/lib/clamav/daily.cvd.rpmsave
warning: /etc/freshclam.conf saved as /etc/freshclam.conf.rpmsave

Installing...
error: Failed dependencies:
         libcom_err.so.3 is needed by clamav-0.80-1
Updating your virus.scanners.conf file to point to the ClamAV I just
installed.

I'm not too concerned about ClamAV at the moment.  I just reinstalled
Dag's rpm.


The first significant problem is that perl-DB_File.rpm builds OK, but
won't install due to this:

[root@gingham noarch]# rpm -Uvh perl-DB_File-1.810-1.noarch.rpm
Preparing...                ###########################################
[100%]
         file /usr/lib/perl5/5.8.3/i386-linux-thread-multi/DB_File.pm
from install of perl-DB_File-1.810-1 conflicts with file from package
perl-5.8.3-16
         file
/usr/lib/perl5/5.8.3/i386-linux-thread-multi/auto/DB_File/DB_File.so
from install of perl-DB_File-1.810-1 conflicts with file from package
perl-5.8.3-16
         file
/usr/lib/perl5/5.8.3/i386-linux-thread-multi/auto/DB_File/autosplit.ix
from install of perl-DB_File-1.810-1 conflicts with file from package
perl-5.8.3-16
         file /usr/share/man/man3/DB_File.3pm.gz from install of
perl-DB_File-1.810-1 conflicts with file from package perl-5.8.3-16

Next the package perl-Digest-HMAC would not build from the install
script. But surprisingly, it did build when I tried it by hand with
"rpmbuild --rebuild".  Same for Digest-SHA1.

Things fell apart quickly after that, as failed dependencies piled up.
I think it boils down to 2 questions to help me get going again.

1. How to I overcome the perl-DB_file conflict with perl?  Should I
force it?
2. If I install the rpms that I manually built and run the script
again, will it skip the build/install for rpms that are already
successfully installed?  If so, I will work on them one-by one.

Thanks for any help.
Mark Nienberg

P.S. just for completeness, here is the build failure for the test
harness:

+ make test
PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e"
"test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
t/00compile.........ok 1/5# Testing Test::Harness 2.42
t/00compile.........ok
t/assert............ok
t/base..............ok
t/callback..........ok
t/inc_taint.........ok
t/nonumbers.........ok
t/ok................ok
t/pod...............skipped
         all skipped: Test::Pod 1.00 required for testing POD
t/prove-globbing....ok
t/prove-switches....ok
t/strap-analyze.....ok
t/strap.............ok
t/test-harness......NOK 40#     Failed test (t/test-harness.t at line
535)
#          got: 'Scalar found where operator expected at (eval 163)
line 1, near "'int'  $__val"
#       (Missing operator before   $__val?)
# '
#     expected: ''
t/test-harness......ok 208/208# Looks like you failed 1 tests of 208.
t/test-harness......dubious
         Test returned status 1 (wstat 256, 0x100)
Scalar found where operator expected at (eval 153) line 1, near "'int'
$__val"
         (Missing operator before   $__val?)
DIED. FAILED test 40
         Failed 1/208 tests, 99.52% okay (less 56 skipped tests: 151
okay, 72.60%)
Failed Test      Stat Wstat Total Fail  Failed  List of Failed
------------------------------------------------------------------------
-------
t/test-harness.t    1   256   208    1   0.48%  40
1 test and 56 subtests skipped.
Failed 1/13 test scripts, 92.31% okay. 1/537 subtests failed, 99.81%
okay.
make: *** [test_dynamic] Error 2
error: Bad exit status from /var/tmp/rpm-tmp.46613 (%build)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Sat Nov 13 20:21:20 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:34 2006
Subject: install-ClamAV-SA
Message-ID: <mailman.4659.1137101254.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

You may find you have more luck running the ./INSTALL-tar.sh instead of
the rpm one. This is equivalent to downloading and installing each of
the modules using CPAN. But much easier :)

I have had problems with the INSTALL-rpm.sh version with some versions
of Perl, and so I often use the INSTALL-tar.sh instead.

Mark Nienberg wrote:

> I'm trying to use the install-ClamAV-SA rpm version package to upgrade
> my SA from 2.63 to 3.01 on Fedora Core 1.  I'm not having a lot of
> luck.  First, to be sure I have the correct db referred to at the top
> of the script output:
>
> [root@gingham perl-rpm]# rpm -qa | grep db
> gdbm-1.8.0-21
> db4-4.1.25-14
> gdb-5.3.90-0.20030710.41
> gdbm-devel-1.8.0-21
> db4-devel-4.1.25-14
> compat-db-4.0.14-2
>
> I hope one of those it what it wants, probably db4 I would guess.
>
> Next, the perl-Test-Harness package won't build because it fails a
> test, but the script output says I don't have to worry about it so I
> won't. (But the "make test" output is at the bottom of this message if
> you are interested).
>
> The ClamAV.rpm install failed with this:
>
> Warning: I am about to uninstall the old Dag Wieers' RPM packages
> Warning: of ClamAV and install Oliver Falk's RPMs instead.
>
> Uninstalling...
> error: package clamav-devel is not installed
> error: package clamav-db is not installed
> warning: /var/lib/clamav/daily.cvd saved as
> /var/lib/clamav/daily.cvd.rpmsave
> warning: /etc/freshclam.conf saved as /etc/freshclam.conf.rpmsave
>
> Installing...
> error: Failed dependencies:
>         libcom_err.so.3 is needed by clamav-0.80-1
> Updating your virus.scanners.conf file to point to the ClamAV I just
> installed.
>
> I'm not too concerned about ClamAV at the moment.  I just reinstalled
> Dag's rpm.
>
>
> The first significant problem is that perl-DB_File.rpm builds OK, but
> won't install due to this:
>
> [root@gingham noarch]# rpm -Uvh perl-DB_File-1.810-1.noarch.rpm
> Preparing...                ###########################################
> [100%]
>         file /usr/lib/perl5/5.8.3/i386-linux-thread-multi/DB_File.pm
> from install of perl-DB_File-1.810-1 conflicts with file from package
> perl-5.8.3-16
>         file
> /usr/lib/perl5/5.8.3/i386-linux-thread-multi/auto/DB_File/DB_File.so
> from install of perl-DB_File-1.810-1 conflicts with file from package
> perl-5.8.3-16
>         file
> /usr/lib/perl5/5.8.3/i386-linux-thread-multi/auto/DB_File/autosplit.ix
> from install of perl-DB_File-1.810-1 conflicts with file from package
> perl-5.8.3-16
>         file /usr/share/man/man3/DB_File.3pm.gz from install of
> perl-DB_File-1.810-1 conflicts with file from package perl-5.8.3-16
>
> Next the package perl-Digest-HMAC would not build from the install
> script. But surprisingly, it did build when I tried it by hand with
> "rpmbuild --rebuild".  Same for Digest-SHA1.
>
> Things fell apart quickly after that, as failed dependencies piled up.
> I think it boils down to 2 questions to help me get going again.
>
> 1. How to I overcome the perl-DB_file conflict with perl?  Should I
> force it?
> 2. If I install the rpms that I manually built and run the script
> again, will it skip the build/install for rpms that are already
> successfully installed?  If so, I will work on them one-by one.
>
> Thanks for any help.
> Mark Nienberg


--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mark at TIPPINGMAR.COM  Sat Nov 13 20:46:39 2004
From: mark at TIPPINGMAR.COM (Mark Nienberg)
Date: Thu Jan 12 21:27:34 2006
Subject: install-ClamAV-SA
Message-ID: <mailman.4660.1137101254.24926.mailscanner@lists.mailscanner.info>

On Saturday, November 13, 2004, at 12:21  PM, Julian Field wrote:

> You may find you have more luck running the ./INSTALL-tar.sh instead of
> the rpm one. This is equivalent to downloading and installing each of
> the modules using CPAN. But much easier :)
>
> I have had problems with the INSTALL-rpm.sh version with some versions
> of Perl, and so I often use the INSTALL-tar.sh instead.
>
What does the tar script to when it encounters modules that are already
installed via rpm?  Should I uninstall the ones that were already
installed by the rpm script? Thanks for your help.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Sat Nov 13 20:57:19 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:34 2006
Subject: install-ClamAV-SA
Message-ID: <mailman.4661.1137101254.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Mark Nienberg wrote:

> On Saturday, November 13, 2004, at 12:21  PM, Julian Field wrote:
>
>> You may find you have more luck running the ./INSTALL-tar.sh instead of
>> the rpm one. This is equivalent to downloading and installing each of
>> the modules using CPAN. But much easier :)
>>
>> I have had problems with the INSTALL-rpm.sh version with some versions
>> of Perl, and so I often use the INSTALL-tar.sh instead.
>>
> What does the tar script to when it encounters modules that are already
> installed via rpm?

It should just skip them.

>   Should I uninstall the ones that were already
> installed by the rpm script?

Not essential by any means, but it probably wouldn't be a bad idea. Then
they are all installed the same way, which is a good thing.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jaearick at COLBY.EDU  Sat Nov 13 21:25:16 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:34 2006
Subject: Another phishing improvement patch
Message-ID: <mailman.4662.1137101254.24926.mailscanner@lists.mailscanner.info>

Julian,
    Can you post the complete latest 4.35.11 Message.pm?  The patch
failed against the original 4.35.11 file, and I've already patched
this file a couple of times.  I could use a fresh copy...

Jeff Earickson
Colby College

On Sat, 13 Nov 2004, Julian Field wrote:

> Date: Sat, 13 Nov 2004 16:56:33 +0000
> From: Julian Field <mailscanner@ECS.SOTON.AC.UK>
> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Another phishing improvement patch
>
> Another addition to the phishing net. This patch is designed to be
> applied to the Message.pm file as distributed with 4.35.11.
>
> This should help improve the detection rate.
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Sat Nov 13 21:41:41 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:35 2006
Subject: Another phishing improvement patch
Message-ID: <mailman.4663.1137101254.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Sure. Zipped copy attached.
2nd attempt, this time not zipped. The JISCmail service objected to a
file called Message.zip, not quite sure why.

Jeff A. Earickson wrote:

> Julian,
>    Can you post the complete latest 4.35.11 Message.pm?  The patch
> failed against the original 4.35.11 file, and I've already patched
> this file a couple of times.  I could use a fresh copy...
>
> Jeff Earickson
> Colby College
>
> On Sat, 13 Nov 2004, Julian Field wrote:
> Date: Sat, 13 Nov 2004 16:56:33 +0000
>
>> From: Julian Field <mailscanner@ECS.SOTON.AC.UK>
>> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>> To: MAILSCANNER@JISCMAIL.AC.UK
>> Subject: Another phishing improvement patch
>>
>> Another addition to the phishing net. This patch is designed to be
>> applied to the Message.pm file as distributed with 4.35.11.
>>
>> This should help improve the detection rate.
>
--

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2: "Attached Text" ]

#
#   MailScanner - SMTP E-Mail Virus Scanner
#   Copyright (C) 2002  Julian Field
#
#   $Id: Message.pm,v 1.126.2.158 2004/10/27 13:50:15 jkf Exp $
#
#   This program is free software; you can redistribute it and/or modify
#   it under the terms of the GNU General Public License as published by
#   the Free Software Foundation; either version 2 of the License, or
#   (at your option) any later version.
#
#   This program is distributed in the hope that it will be useful,
#   but WITHOUT ANY WARRANTY; without even the implied warranty of
#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#   GNU General Public License for more details.
#
#   You should have received a copy of the GNU General Public License
#   along with this program; if not, write to the Free Software
#   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
#
#   The author, Julian Field, can be contacted by email at
#      Jules@JulianField.net
#   or by paper mail at
#      Julian Field
#      Dept of Electronics & Computer Science
#      University of Southampton
#      Southampton
#      SO17 1BJ
#      United Kingdom
#

package MailScanner::Message;

use strict 'vars';
use strict 'refs';
no  strict 'subs'; # Allow bare words for parameter %'s

use DirHandle;
use Time::localtime qw/ctime/;
use MIME::Parser;
use MIME::Decoder::UU;
use MIME::Decoder::BinHex;
use MIME::WordDecoder;
use POSIX qw(setsid);
use HTML::TokeParser;
use HTML::Parser;
use Archive::Zip qw( :ERROR_CODES );
#use MailScanner::BinHex;

# Install an extra MIME decoder for badly-header uue messages.
install MIME::Decoder::UU 'uuencode';
# Install an extra MIME decoder for binhex-encoded attachments.
install MIME::Decoder::BinHex 'binhex','binhex40','mac-binhex40','mac-binhex';

use vars qw($VERSION);

### The package version, both in 1.23 style *and* usable by MakeMaker:
$VERSION = substr q$Revision: 1.126.2.158 $, 10;

# Attributes are
#
# $id                   set by new
# $store                set by new (is a SMDiskStore for now)
# #$hpath               set by new
# #$dpath               set by new
# $size                 set by new (copy of $store->{size})
# #$inhhandle           set by new
# #$indhandle           set by new
# $from                 set by ReadQf
# $fromdomain           set by new
# $fromuser             set by new
# @to                   set by new
# @todomain             set by new
# @touser               set by new
# $subject              set by ReadQf
# @headers              set by ReadQf # just the headers, with /^H/ removed
#                       Note @headers is read-only!
# @metadata             set by ReadQf # the entire qf file excluding final "."
# $returnpathflags      set by ReadQf # Only used for sendmail at the moment
# $clientip             set by ReadQf
# $scanme               set by NeedsScanning (from MsgBatch constructor)
# $workarea             set by new
# @archiveplaces        set by new (addresses and dirs)
# $spamwhitelisted      set by IsSpam
# $spamblacklisted      set by IsSpam
# $isspam               set by IsSpam
# $issaspam             set by IsSpam
# $isrblspam            set by IsSpam
# $ishigh               set by IsSpam
# $sascore              set by IsSpam
# $spamreport           set by IsSpam
# $mcpwhitelisted       set by IsMCP
# $ismcp                set by IsMCP
# $issamcp              set by IsMCP
# $ishighmcp            set by IsMCP
# $mcpsascore           set by IsMCP
# $mcpreport            set by IsMCP
# $deleted              set by delivery functions
# $headerspath          set by WriterHeaderFile # file is read-only
# $cantparse            set by Explode
# $toomanyattach        set by Explode
# $cantdisinfect        set by ExplodeArchive
# $entity               set by Explode
# $tnefentity           set by Explode (only set if it's a TNEF message)
# $badtnef              set by Explode
# $entity               set by Explode
# %name2entity          set by Explode
# %file2parent          set by Explode
# $virusinfected        set by new and ScanBatch
# $nameinfected         set by new and ScanBatch
# $otherinfected        set by new and ScanBatch
# %virusreports         set by TryCommercial (key is filename)
# %virustypes           set by TryCommercial (key is filename)
# %namereports          set by filename trap checker
# %nametypes            set by filename trap checker
# %otherreports         set by TryOther (key is filename)
# %othertypes           set by TryOther (key is filename)
# %entityreports        set by TryOther (key is entity)
# %oldviruses           set by DisinfectAndDeliver
# $infected             set by CombineReports
# %allreports           set by CombineReports
# %alltypes             set by CombineReports
# %entity2parent        set by CreateEntitiesHelpers
# %entity2file          set by CreateEntitiesHelpers
# %file2entity          set by CreateEntitiesHelpers (maps original evil names)
# %file2safefile        set by CreateEntitiesHelpers (evil==>safe)
# %safefile2file        set by CreateEntitiesHelpers (safe==>evil)
# $numberparts          set by CreateEntitiesHelpers
# $signed               set by Clean
# $bodymodified         set by Clean and SignUninfected
# $silent               set by FindSilentAndNoisyInfections
#                               if infected with a silent virus
# $noisy                set by FindSilentAndNoisyInfections
#                               if infected with a noisy virus
# $needsstripping       set by HandleSpam and HandleMCP
# $stillwarn            set by new # Still send warnings even if deleted
# $needsencapsulating   set by HandleSpam and HAndleMCP
# %postfixrecips        set by ReadQf in Postfix support only. Hash of all the
#                               'R' addresses in the message to aid rebuilding.
# %originalrecips       set by ReadQf in Postfix support only. Hash of all the
#                               'O' addresses in the message to aid rebuilding.
# %deleteattach         set by ScanBatch and CheckFiletypeRules. True if
#                              attachment is to be deleted rather than stored.
# $tagstoconvert        set by ??? is list of HTML tags to dis-arm
# $gonefromdisk         set by calls to DeleteUnlock
# $subjectwasunsafe     set by SweepContent.pm
# $safesubject          set by SweepContent.pm
# $mcpdelivering        set by HandleMCP
# $salongreport         set by SA::Checks (longest version of SA report)
#

# Constructor.
# Takes id.
# This isn't specific to the MTA at all, so is all done here.
sub new {
  my $type = shift;
  my($id, $queuedirname) = @_;
  my $this = {};
  my ($queue, $workarea, $mta, $hpath, $dpath, $addr, $user, $domain);
  my ($archiveplaces);
  my $hfile = new FileHandle;

  #print STDERR "Creating message $id\n";

  $this->{id} = $id;
  @{$this->{archiveplaces}} = (); # Hope this syntax is right!

  # Create somewhere to store the message
  $this->{store} = new MailScanner::SMDiskStore($id, $queuedirname);

  # Try to open and exclusive-lock this message. Return undef if failed.
  #print STDERR "Trying to lock message " . $this->{id} . "\n";
  $this->{store}->Lock() or return undef;
  #print STDERR "Locked message\n";

  # Now try to fill as much of the structure as possible
  $this->{size} = $this->{store}->size();
  $global::MS->{mta}->ReadQf($this) or return 'INVALID'; # Return empty if fails

  # Work out the user @ domain components
  ($user, $domain) = address2userdomain($this->{from});
  $this->{fromuser} = $user;
  $this->{fromdomain} = $domain;
  foreach $addr (@{$this->{to}}) {
    ($user, $domain) = address2userdomain($addr);
    push @{$this->{touser}}, $user;
    push @{$this->{todomain}}, $domain;
  }

  # Reset the infection counters to 0
  $this->{virusinfected} = 0;
  $this->{nameinfected}  = 0;
  $this->{otherinfected} = 0;
  $this->{stillwarn}     = 0;

  # Work out where to archive/copy this message.
  # Could do all the archiving in a different separate place.
  $archiveplaces = MailScanner::Config::Value('archivemail', $this);
  @{$this->{archiveplaces}} = ((defined $archiveplaces)?split(" ", $archiveplaces):());

  bless $this, $type;
  return $this;
}


# Take an email address. Return (user, domain).
sub address2userdomain {
  my($addr) = @_;

  my($user, $domain);

  $addr = lc($addr);
  $addr =~ s/^<\s*//; # Delete leading and
  $addr =~ s/\s*>$//; # trailing <>

  $user   = $addr;
  $domain = $addr;

  if ($addr =~ /@/) {
    $user   =~ s/@[^@]*$//;
    $domain =~ s/^[^@]*@//;
  }

  return ($user, $domain);
}


# Print a message
sub print {
  my $this = shift;

  print STDERR "Message " . $this->{id} . "\n";
  print STDERR "  Size = " . $this->{size} . "\n";
  print STDERR "  From = " . $this->{from} . "\n";
  print STDERR "  To   = " . join(',',@{$this->{to}}) . "\n";
  print STDERR "  Subj = " . $this->{subject} . "\n";
}


# Get/Set "scanme" flag
sub NeedsScanning {
  my($this, $value) = @_;

  $this->{scanme} = $value if @_ > 1;
  return $this->{scanme};
}


# Write the file containing all the message headers.
# Called by the MessageBatch constructor.
# Notes: assumes the directories required already exist.
sub WriteHeaderFile {
  my $this = shift;

  #my @headers;
  my $header = new FileHandle;
  my $filename = $global::MS->{work}->{dir} . '/' . $this->{id} . '.header';
  $this->{headerspath} = $filename;

  MailScanner::Lock::openlock($header, ">$filename", "w")
    or MailScanner::Log::DieLog("Cannot create + lock headers file %s, %s",
                                $filename, $!);

  #@headers = $global::MS->{mta}->OriginalMsgHeaders($this);
  #print STDERR "Headers are " . join(', ', @headers) . "\n";
  #foreach (@headers) {
  foreach ($global::MS->{mta}->OriginalMsgHeaders($this)) {
    tr/\r/\n/; # Work around Outlook [Express] bug allowing viruses in headers
    print $header "$_\n";
  }
  print $header "\n";
  MailScanner::Lock::unlockclose($header);

  # Set the owner of the header file
  chown $global::MS->{work}->{uid}, $global::MS->{work}->{gid}, $filename
    if $global::MS->{work}->{changeowner};
}


# Is this message spam? Try to build the spam report and store it in
# the message.
sub IsSpam {
  my $this = shift;
  my($includesaheader, $iswhitelisted);

  my $spamheader    = "";
  my $rblspamheader = "";
  my $saspamheader  = "";
  my $RBLsaysspam   = 0;
  my $rblcounter    = 0;
  my $LogSpam = MailScanner::Config::Value('logspam');
  my $LogNonSpam = MailScanner::Config::Value('lognonspam');
  my $LocalSpamText = MailScanner::Config::LanguageValue($this, 'spam');

  # Construct a pretty list of all the unique domain names for logging
  my(%todomain, $todomain);
  foreach $todomain (@{$this->{todomain}}) {
    $todomain{$todomain} = 1;
  }
  $todomain = join(',', keys %todomain);
  my $recipientcount = @{$this->{to}};

  # $spamwhitelisted      set by IsSpam
  # $spamblacklisted      set by IsSpam
  # $isspam               set by IsSpam
  # $ishigh               set by IsSpam
  # $spamreport           set by IsSpam

  $this->{spamwhitelisted} = 0;
  $this->{spamblacklisted} = 0;
  $this->{isspam} = 0;
  $this->{ishigh} = 0;
  $this->{spamreport} = "";
  $this->{sascore} = 0;

  ## If it's a blacklisted address, don't bother doing any checks at all
  #if (MailScanner::Config::Value('spamblacklist', $this)) {
  #  $this->{isspam} = 1;
  #  $this->{spamreport} = 'spam (blacklisted)';
  #  MailScanner::Log::InfoLog("Message %s from %s (%s) " .
  #                            " is spam (blacklisted)",
  #                            $this->{id}, $this->{clientip},
  #                            $this->{from});
  #  return 1;
  #}

  # Work out if they always want the SA header
  $includesaheader = MailScanner::Config::Value('includespamheader', $this);

  # Do the whitelist check before the blacklist check.
  # If anyone whitelists it, then everyone gets the message.
  # If no-one has whitelisted it, then consider the blacklist.
  $iswhitelisted = 0;
  my $maxrecips = MailScanner::Config::Value('whitelistmaxrecips');
  $maxrecips = 999999 unless $maxrecips;

  if ($recipientcount<=$maxrecips) {
    if (MailScanner::Config::Value('spamwhitelist', $this)) {
      # Whitelisted, so get out unless they want SA header
      #print STDERR "Message is whitelisted\n";
      MailScanner::Log::InfoLog("Message %s from %s (%s) is whitelisted",
                                $this->{id}, $this->{clientip}, $this->{from})
        if $LogSpam || $LogNonSpam;
      $iswhitelisted = 1;
      $this->{spamwhitelisted} = 1;
      # whitelisted and doesn't want SA header so get out
      return 0 unless $includesaheader;
    }
  } else {
    # Had too many recipients, ignoring the whitelist
    MailScanner::Log::InfoLog("Message %s from %s (%s) ignored whitelist, " .
                              "had %d recipients (>%d)", $this->{id},
                              $this->{clientip}, $this->{from},
                              $recipientcount, $maxrecips)
      if $LogSpam || $LogNonSpam;
  }

  # If it's a blacklisted address, don't bother doing any checks at all
  if (MailScanner::Config::Value('spamblacklist', $this)) {
    $this->{spamblacklisted} = 1;
    $this->{isspam} = 1;
    $this->{ishigh} = 1
      if MailScanner::Config::Value('blacklistedishigh', $this);
    $this->{spamreport} = $LocalSpamText . ' (' .
                   MailScanner::Config::LanguageValue($this, 'blacklisted') .
                   ')';
    MailScanner::Log::InfoLog("Message %s from %s (%s) to %s" .
                              " is spam (blacklisted)",
                              $this->{id}, $this->{clientip},
                              $this->{from}, $todomain)
      if $LogSpam;
    return 1;
  }

  if (!$iswhitelisted) {
    # Not whitelisted, so do the RBL checks
    #$rblspamheader     = MailScanner::RBLs::Checks($this);
    ($rblcounter, $rblspamheader) = MailScanner::RBLs::Checks($this);
    $RBLsaysspam       = 1 if $rblcounter;
    #$RBLsaysspam       = 1 if $rblspamheader;
    # Add leading "spam, " if RBL says it is spam. This will be at the
    # front of the spam report.
    $rblspamheader     = $LocalSpamText . ', ' . $rblspamheader if $rblcounter;
    $this->{isspam}    = 1 if $rblcounter;
    $this->{isrblspam} = 1 if $rblcounter;
    $this->{ishigh}    = 1 if $rblcounter >= MailScanner::Config::Value(
                                             'highrbls', $this);
    #print STDERR "RBL report is \"$rblspamheader\"\n";
    #print STDERR "RBLCounter = $rblcounter\n";
    #print STDERR "HighRBLs   = " .
    #             MailScanner::Config::Value('highrbls', $this) . "\n";
  }

  # Don't do the SA checks if they have said no.
  unless (MailScanner::Config::Value('usespamassassin', $this)) {
    $this->{spamwhitelisted} = $iswhitelisted;
    $this->{spamreport}      = $rblspamheader;
    MailScanner::Log::InfoLog("Message %s from %s (%s) to %s is %s",
                              $this->{id}, $this->{clientip},
                              $this->{from}, $todomain, $rblspamheader)
      if $RBLsaysspam && $LogSpam;
    return $RBLsaysspam;
  }

  # If it's spam and they dont want to check SA as well
  if ($this->{isspam} &&
      !MailScanner::Config::Value('checksaifonspamlist', $this)) {
    $this->{spamwhitelisted} = $iswhitelisted;
    $this->{spamreport}      = $rblspamheader;
    MailScanner::Log::InfoLog("Message %s from %s (%s) to %s is %s",
                              $this->{id}, $this->{clientip},
                              $this->{from}, $todomain, $rblspamheader)
      if $RBLsaysspam && $LogSpam;
    return $RBLsaysspam;
  }

  # They must want the SA checks doing.

  my $SAsaysspam = 0;
  my $SAHighScoring = 0;
  my $saheader = "";
  my $sascore  = 0;
  my $salongreport = "";
  ($SAsaysspam, $SAHighScoring, $saheader, $sascore, $salongreport)
    = MailScanner::SA::Checks($this);
  $this->{sascore} = $sascore; # Save the actual figure for use later...
  # Trim all the leading rubbish off the long SA report and turn it back
  # into a multi-line string, then store it in the message properties.
  $salongreport =~ s/^.* pts rule name/ pts rule name/;
  $salongreport =~ tr/\0/\n/;
  $this->{salongreport} = $salongreport;
  #print STDERR $salongreport . "\n";

  # Fix the return values
  $SAsaysspam = 0 unless $saheader;    # Solve bug with empty SAreports
  $saheader =~ s/\s+$//g if $saheader; # Solve bug with trailing space

  #print STDERR "SA report is \"$saheader\"\n";
  #print STDERR "SAsaysspam = $SAsaysspam\n";
  $saheader = MailScanner::Config::LanguageValue($this, 'spamassassin') .
              " ($saheader)" if $saheader;

  # The message really is spam if SA says so (unless it's been whitelisted)
  unless ($iswhitelisted) {
    $this->{isspam} |= $SAsaysspam;
    $this->{issaspam} = $SAsaysspam;
  }

  # If it's spam...
  if ($this->{isspam}) {
    #print STDERR "It is spam\nInclude SA = $includesaheader\n";
    #print STDERR "SAHeader = $saheader\n";
    $spamheader = $rblspamheader;
    # If it's SA spam as well, or they always want the SA header
    if ($SAsaysspam || $includesaheader) {
      #print STDERR "Spam or Add SA Header\n";
      $spamheader = $LocalSpamText unless $spamheader;
      $spamheader .= ', ' if $spamheader && $saheader;
      $spamheader .= $saheader;
      $this->{ishigh} = 1 if $SAHighScoring;
    }
  } else {
    # It's not spam...
    #print STDERR "It's not spam\n";
    #print STDERR "SAHeader = $saheader\n";
    $spamheader = MailScanner::Config::LanguageValue($this, 'notspam');
    if ($iswhitelisted) {
      $spamheader .= ' (' .
                    MailScanner::Config::LanguageValue($this, 'whitelisted') .
                    ')';
    }
    # so RBL report must be blank as you can't force inclusion of that.
    # So just include SA report.
    $spamheader .= ", $saheader";
  }

  # Now just reflow and log the results
  if ($spamheader ne "") {
    $spamheader = $this->ReflowHeader(
                  MailScanner::Config::Value('spamheader',$this), $spamheader);
    $this->{spamreport} = $spamheader;
  }

  # Do the spam logging here so we can log high-scoring spam too
  if (($LogSpam && $this->{isspam}) || ($LogNonSpam && !$this->{isspam})) {
    my $ReportText = $spamheader;
    $ReportText =~ s/\s+/ /sg;
    MailScanner::Log::InfoLog("Message %s from %s (%s) to %s is %s",
                              $this->{id}, $this->{clientip},
                              $this->{from}, $todomain, $ReportText);
  }

  return $this->{isspam};
}
    

# Do whatever is necessary with this message to deal with spam.
# We can assume the message passed is indeed spam (isspam==true).
# Call it with either 'spam' or 'nonspam'. Don't use 'ham'!
sub HandleHamAndSpam {
  my($this, $HamSpam) = @_;

  my($actions, $action, @actions, %actions);

  # Get a space-separated list of all the actions
  if ($HamSpam eq 'nonspam') {
    $actions = lc(MailScanner::Config::Value('hamactions', $this));
    # Fast bail-out if it's just the simple "deliver" case that 99% of
    # people will use
    return if $actions eq 'deliver';
  } else {
    # It must be spam as it's not ham
    if ($this->{ishigh}) {
      $actions = lc(MailScanner::Config::Value('highscorespamactions', $this));
    } else {
      $actions = lc(MailScanner::Config::Value('spamactions', $this));
    }
  }
  $actions =~ tr/,//d; # Remove all commas in case they put any in
  @actions = split(" ", $actions);

  # The default action if they haven't specified anything is to
  # deliver spam like normal mail.
  return unless @actions;

  #print STDERR "Message: HandleHamSpam has actions " . join(',',@actions) .
  #             "\n";

  foreach $action (@actions) {
    # If the message is a MCP message then don't do the ham/spam "deliver"
    # as the MCP actions will have provided a "deliver" if they want one.
    next if $this->{ismcp} && $action eq 'deliver';

    $actions{$action} = 1;
    #print STDERR "Message: HandleSpam action is $action\n";
    if ($action =~ /\@/) {
      #print STDERR "Message " . $this->{id} . " : HandleSpam() adding " .
      #             "$action to archiveplaces\n";
      push @{$this->{archiveplaces}}, $action;
      $actions{'forward'} = 1;
    }
  }

  # Now we are left with deliver, bounce, delete, store and striphtml.
  #print STDERR "Archive places are " . join(',', keys %actions) . "\n";

  # Split this job into 2.
  # 1) The message is being delivered to at least 1 address,
  # 2) The message is not being delivered to anyone.
  # The extra addresses for forward it to have already been added.
  if ($actions{'deliver'} || $actions{'forward'} || $this->{mcpdelivering}) {
    #
    # Message is going to original recipient and/or extra recipients
    #

    # Delete action is over-ridden as we are sending it somewhere
    delete $actions{'delete'};

    MailScanner::Log::InfoLog("Spam Actions: message %s actions are %s",
                              $this->{id}, join(',', keys %actions))
      if $HamSpam eq 'spam' && MailScanner::Config::Value('logspam');

    # Delete the original recipient if they are only forwarding it
    $global::MS->{mta}->DeleteRecipients($this) if !$actions{'deliver'};

    # Message still exists, so it will be delivered to its new recipients
  } else {
    #
    # Message is not going to be delivered anywhere
    #

    MailScanner::Log::InfoLog("Spam Actions: message %s actions are %s",
                              $this->{id}, join(',', keys %actions))
      if $HamSpam eq 'spam' && MailScanner::Config::Value('logspam');

    # Mark the message as deleted, so it won't get delivered
    $this->{deleted} = 1;
  }

  # All delivery will now happen correctly.

  # Bounce a message back to the sender if they want that
  if ($actions{'bounce'}) {
    if ($HamSpam eq 'nonspam') {
      MailScanner::Log::WarnLog("Does not make sense to bounce non-spam");
    } else {
      #MailScanner::Log::WarnLog('The "bounce" Spam Action no longer exists');
      if ($this->{ishigh}) {
        MailScanner::Log::InfoLog("Will not bounce high-scoring spam")
      } else {
        $this->HandleSpamBounce()
          if MailScanner::Config::Value('enablespambounce', $this);
      }
    }
  }

  # Notify the recipient if they want that
  if ($actions{'notify'}) {
    if ($HamSpam eq 'nonspam') {
      MailScanner::Log::WarnLog("Does not make sense to notify recipient about non-spam");
    } else {
      $this->HandleSpamNotify();
    }
  }
  
  # Store it if they want that
  if ($actions{'store'}) {
    my($dir, $dir2, $spamdir, $uid, $gid, $changeowner);
    $uid = $global::MS->{quar}->{uid};
    $gid = $global::MS->{quar}->{gid};
    $changeowner = $global::MS->{quar}->{changeowner};
    $dir = MailScanner::Config::Value('quarantinedir', $this);
    $dir2 = $dir . '/' .  MailScanner::Quarantine::TodayDir();
    $spamdir = $dir2 . '/' . $HamSpam;
    umask $global::MS->{quar}->{dirumask};
    unless (-d $dir) {
      mkdir $dir, 0777;
      chown $uid, $gid, $dir if $changeowner;
    }
    unless (-d $dir2) {
      mkdir $dir2, 0777;
      chown $uid, $gid, $dir2 if $changeowner;
    }
    unless (-d $spamdir) {
    mkdir $spamdir, 0777;
      chown $uid, $gid, $spamdir if $changeowner;
    }
    #print STDERR "Storing spam to $spamdir/" . $this->{id} . "\n";
    #print STDERR "uid=$uid gid=$gid changeowner=$changeowner\n";
    umask $global::MS->{quar}->{fileumask};
    $this->{store}->CopyEntireMessage($this, $spamdir, $this->{id},
                                      $uid, $gid, $changeowner);
    chown $uid, $gid, "$spamdir/" . $this->{id}; # Harmless if this fails
  }
  umask 0077; # Safety net

  # If they want to strip the HTML tags out of it,
  # then just tag it as we can only do this later.
  $this->{needsstripping} = 1 if $actions{'striphtml'};

  # If they want to encapsulate the message in an RFC822 part,
  # then tag it so we can do this later.
  $this->{needsencapsulating} = 1 if $actions{'attachment'};
}


# We want to send a message back to the sender saying that their junk
# email has been rejected by our site.
# Send a message back to the sender which has the local postmaster as
# the header sender, but <> as the envelope sender. This means it
# cannot bounce.
# Now have 3 different message file settings:
# 1. Is spam according to RBL's
# 2. Is spam according to SpamAssassin
# 3. Is spam according to both
sub HandleSpamBounce {
  my $this = shift;

  my($from,$to,$subject,$date,$spamreport,$longspamreport,$hostname);
  my($emailmsg, $line, $messagefh, $filename, $localpostmaster, $id);

  $from = $this->{from};

  # Don't ever send a message to "" or "<>"
  return if $from eq "" || $from eq "<>";

  # Do we want to send the sender a warning at all?
  # If nosenderprecedence is set to non-blank and contains this
  # message precedence header, then just return.
  my(@preclist, $prec, $precedence, $header);
  @preclist = split(" ",
                  lc(MailScanner::Config::Value('nosenderprecedence', $this)));
  $precedence = "";
  foreach $header (@{$this->{headers}}) {
    $precedence = lc($1) if $header =~ /^precedence:\s+(\S+)/i;
  }
  if (@preclist && $precedence ne "") {
    foreach $prec (@preclist) {
      if ($precedence eq $prec) {
        MailScanner::Log::InfoLog("Skipping sender of precedence %s",
                                  $precedence);
        return;
      }
    }
  }

  # Setup other variables they can use in the message template
  $id = $this->{id};
  #$to = join(', ', @{$this->{to}});
  $localpostmaster = MailScanner::Config::Value('localpostmaster', $this);
  $hostname = MailScanner::Config::Value('hostname', $this);
  $subject = $this->{subject};
  $date = scalar localtime;
  $spamreport = $this->{spamreport};
  $longspamreport = $this->{salongreport};
  #print STDERR "longspamreport = \"$longspamreport\"\n";
  my($to, %tolist);
  foreach $to (@{$this->{to}}) {
    $tolist{$to} = 1;
  }
  $to = join(', ', sort keys %tolist);

  # Delete everything in brackets after the SA report, if it exists
  $spamreport =~ s/(spamassassin)[^(]*\([^)]*\)/$1/i;

  # Work out which of the 3 spam reports to send them.
  $filename = "";
  if ($this->{isrblspam} && !$this->{issaspam}) {
    $filename = MailScanner::Config::Value('senderrblspamreport', $this);
    MailScanner::Log::InfoLog("Spam Actions: (RBL) Bounce to %s", $from)
      if MailScanner::Config::Value('logspam');
  } elsif ($this->{issaspam} && !$this->{isrblspam}) {
    $filename = MailScanner::Config::Value('sendersaspamreport', $this);
    MailScanner::Log::InfoLog("Spam Actions: (SpamAssassin) Bounce to %s",
                              $from)
      if MailScanner::Config::Value('logspam');
  }
  if ($filename eq "") {
    $filename = MailScanner::Config::Value('senderbothspamreport', $this);
    MailScanner::Log::InfoLog("Spam Actions: (RBL,SpamAssassin) Bounce to %s",
                              $from)
      if MailScanner::Config::Value('logspam');
  }

  $messagefh = new FileHandle;
  $messagefh->open($filename)
    or MailScanner::Log::WarnLog("Cannot open message file %s, %s",
                                 $filename, $!);
  $emailmsg = "X-MailScanner-Bounce: yes\n";
  while(<$messagefh>) {
    chomp;
    s#"#\\"#g;
    s#@#\\@#g;
    # Boring untainting again...
    /(.*)/;
    $line = eval "\"$1\"";
    $emailmsg .= MailScanner::Config::DoPercentVars($line) . "\n";
  }
  $messagefh->close();

  if (MailScanner::Config::Value('bouncespamasattachment', $this)) {
    $this->HandleSpamBounceAttachment($emailmsg);
  } else {
    # Send the message to the spam sender, but ensure the envelope
    # sender address is "<>" so that it can't be bounced.
    $global::MS->{mta}->SendMessageString($this, $emailmsg, '<>')
      or MailScanner::Log::WarnLog("Could not send sender spam bounce, %s", $!);
  }
}


# Like encapsulating and sending a message to the recipient, take the
# passed text as the text and headers of an email message and attach
# the original message as an rfc/822 attachment.
sub HandleSpamBounceAttachment {
  my($this, $plaintext) = @_;

  my $parser = MIME::Parser->new;
  my $explodeinto = $global::MS->{work}->{dir} . '/' . $this->{id};
  #print STDERR "Extracting spam bounce message into $explodeinto\n";
  my $filer  = MIME::Parser::FileInto->new($explodeinto);
  $parser->filer($filer);

  my $bounce = eval { $parser->parse_data(\$plaintext) };
  if (!$bounce) {
    MailScanner::Log::WarnLog("Cannot parse spam bounce report, %s", $!);
    return;
  }
  #print STDERR "Successfully parsed bounce report\n";

  # Now make it multipart and push the report into a child
  $bounce->make_multipart('report');

  # Now turn the original message into a string and attach it
  my(@original);
  #my $original = $this->{entity}->stringify;
  @original = $global::MS->{mta}->OriginalMsgHeaders($this, "\n");
  push(@original, "\n");
  $this->{store}->ReadBody(\@original, MailScanner::Config::Value(
                                          'maxspamassassinsize'));

  $bounce->add_part(MIME::Entity->build(Type        => 'message/rfc822',
                                        Disposition => 'attachment',
                                        Top         => 0,
                                        'X-Mailer'  => undef,
                                        Data        => \@original));
  
  # Stringify the message and send it -- this could be VERY large!
  my $bouncetext = $bounce->stringify;
  #print STDERR "Spam bounce message is this:\n$bouncetext";
  if ($bouncetext) {
    $global::MS->{mta}->SendMessageString($this, $bouncetext, '<>')
      or MailScanner::Log::WarnLog(
           "Could not send sender spam bounce attachment, %s", $!);
  } else {
    MailScanner::Log::WarnLog(
      "Failed to create sender spam bounce attachment, %s", $!);
  }
}


# We want to send a message to the recipient saying that their spam
# mail has not been delivered.
# Send a message to the recipients which has the local postmaster as
# the sender.
sub HandleSpamNotify {
  my $this = shift;

  my($from,$to,$subject,$date,$spamreport,$hostname,$day,$month,$year);
  my($emailmsg, $line, $messagefh, $filename, $localpostmaster, $id);

  $from = $this->{from};

  # Don't ever send a message to "" or "<>"
  return if $from eq "" || $from eq "<>";

  # Do we want to send the sender a warning at all?
  # If nosenderprecedence is set to non-blank and contains this
  # message precedence header, then just return.
  my(@preclist, $prec, $precedence, $header);
  @preclist = split(" ",
                  lc(MailScanner::Config::Value('nosenderprecedence', $this)));
  $precedence = "";
  foreach $header (@{$this->{headers}}) {
    $precedence = lc($1) if $header =~ /^precedence:\s+(\S+)/i;
  }
  if (@preclist && $precedence ne "") {
    foreach $prec (@preclist) {
      if ($precedence eq $prec) {
        MailScanner::Log::InfoLog("Skipping sender of precedence %s",
                                  $precedence);
        return;
      }
    }
  }

  # Setup other variables they can use in the message template
  $id = $this->{id};
  $localpostmaster = MailScanner::Config::Value('localpostmaster', $this);
  $hostname = MailScanner::Config::Value('hostname', $this);
  $subject = $this->{subject};
  $date = scalar localtime;
  $spamreport = $this->{spamreport};
  # And let them put the date number in there too
  ($day, $month, $year) = (localtime)[3,4,5];
  $month++;
  $year += 1900;
  my $datenumber = sprintf("%04d%02d%02d", $year, $month, $day);


  my($to, %tolist);
  foreach $to (@{$this->{to}}) {
    $tolist{$to} = 1;
  }
  $to = join(', ', sort keys %tolist);

  # Delete everything in brackets after the SA report, if it exists
  $spamreport =~ s/(spamassassin)[^(]*\([^)]*\)/$1/i;

  # Work out which of the 3 spam reports to send them.
  $filename = MailScanner::Config::Value('recipientspamreport', $this);
  MailScanner::Log::InfoLog("Spam Actions: Notify %s", $to)
    if MailScanner::Config::Value('logspam');

  $messagefh = new FileHandle;
  $messagefh->open($filename)
    or MailScanner::Log::WarnLog("Cannot open message file %s, %s",
                                 $filename, $!);
  $emailmsg = "";
  while(<$messagefh>) {
    chomp;
    s#"#\\"#g;
    s#@#\\@#g;
    # Boring untainting again...
    /(.*)/;
    $line = eval "\"$1\"";
    $emailmsg .= MailScanner::Config::DoPercentVars($line) . "\n";
  }
  $messagefh->close();

  # Send the message to the spam sender, but ensure the envelope
  # sender address is "<>" so that it can't be bounced.
  $global::MS->{mta}->SendMessageString($this, $emailmsg, $localpostmaster)
    or MailScanner::Log::WarnLog("Could not send sender spam notify, %s", $!);
}



# Deliver a message that doesn't need scanning at all
# Takes an out queue dir.
sub DeliverUnscanned {
  my $this = shift;
  my($OutQ) = @_;

  return if $this->{deleted};

  #my $OutQ = MailScanner::Config::Value('outqueuedir', $this);
  my $store = $this->{store};

  # Link the queue data file from in to out
  $store->LinkData($OutQ);

  # Add the headers onto the metadata in the message store
  $global::MS->{mta}->AddHeadersToQf($this);

  # Add the information/help X- header
  my $infoheader = MailScanner::Config::Value('infoheader', $this);
  if ($infoheader) {
    my $infovalue = MailScanner::Config::Value('infovalue', $this);
    $global::MS->{mta}->ReplaceHeader($this, $infoheader, $infovalue);
  }

  # Add the Unscanned X- header
  if (MailScanner::Config::Value('signunscannedmessages', $this)) {
    $global::MS->{mta}->AddMultipleHeader($this, 'mailheader',
                 MailScanner::Config::Value('unscannedheader', $this), ', ');
  }

  # Leave old content-length: headers as we aren't changing body.

  # Add the MCP headers if necessary
  $global::MS->{mta}->AddMultipleHeader($this, 'mcpheader',
                                        $this->{mcpreport}, ', ')
    if $this->{ismcp} ||
       MailScanner::Config::Value('includemcpheader', $this);
  # Add spam header if it's spam or they asked for it
  #$global::MS->{mta}->AddHeader($this,
  #                              MailScanner::Config::Value('spamheader',$this),
  #                              $this->{spamreport})
  $global::MS->{mta}->AddMultipleHeader($this, 'spamheader',
                                        $this->{spamreport}, ', ')
    if $this->{isspam} ||
       MailScanner::Config::Value('includespamheader', $this);

  # Add the spam stars if they want that. Limit it to 60 characters to avoid
  # a potential denial-of-service attack.
  my($stars,$starcount,$scoretext,$minstars,$scorefmt);
  $starcount = int($this->{sascore}) + 0;
  $starcount = 0 if $this->{spamwhitelisted}; # 0 stars if white-listed
  $scorefmt = MailScanner::Config::Value('scoreformat', $this);
  $scorefmt = '%d' if $scorefmt eq '';
  $scoretext = sprintf($scorefmt, $this->{sascore}+0);
  $minstars = MailScanner::Config::Value('minstars', $this);
  $starcount = $minstars if $this->{isrblspam} && $minstars &&
                            $starcount<$minstars;
  if (MailScanner::Config::Value('spamstars', $this) =~ /1/ && $starcount>0) {
    if (MailScanner::Config::Value('spamscorenotstars', $this)) {
      $stars = $scoretext; # int($starcount);
    } else {
      $starcount = 60 if $starcount>60;
      $stars = MailScanner::Config::Value('spamstarscharacter') x $starcount;
    }
    $global::MS->{mta}->AddMultipleHeader($this, 'spamstarsheader',
                                          $stars, ', ');
  }

  # Add the Envelope to and from headers
  AddFromAndTo($this);

  # Repair the subject line
  $global::MS->{mta}->ReplaceHeader($this, 'Subject:', $this->{safesubject})
    if $this->{subjectwasunsafe};

  # Modify the subject line for spam
  # if it's spam AND they want to modify the subject line AND it's not
  # already been modified by another of your MailScanners.
  my $spamtag = MailScanner::Config::Value('spamsubjecttext', $this);
  $spamtag =~ s/_SCORE_/$scoretext/;
  if ($this->{isspam} && !$this->{ishigh} &&
      MailScanner::Config::Value('spamprependsubject',$this) &&
      !$global::MS->{mta}->TextStartsHeader($this, 'Subject:', $spamtag)) {
    $global::MS->{mta}->PrependHeader($this, 'Subject:', $spamtag, ' ');
  }
  # If it is high-scoring spam, then add a different bit of text
  $spamtag = MailScanner::Config::Value('highspamsubjecttext', $this);
  $spamtag =~ s/_SCORE_/$scoretext/;
  if ($this->{isspam} && $this->{ishigh} &&
      MailScanner::Config::Value('highspamprependsubject',$this) &&
      !$global::MS->{mta}->TextStartsHeader($this, 'Subject:', $spamtag)) {
    $global::MS->{mta}->PrependHeader($this, 'Subject:', $spamtag, ' ');
  }

  # Modify the subject line for MCP
  # if it's MCP AND they want to modify the subject line AND it's not
  # already been modified by another of your MailScanners.
  $starcount = int($this->{mcpsascore}) + 0;
  $starcount = 0 if $this->{mcpwhitelisted}; # 0 stars if white-listed
  $scorefmt = MailScanner::Config::Value('scoreformat', $this);
  $scorefmt = '%d' if $scorefmt eq '';
  $scoretext = sprintf($scorefmt, $this->{mcpsascore}+0);
  my $mcptag = MailScanner::Config::Value('mcpsubjecttext', $this);
  $mcptag =~ s/_SCORE_/$scoretext/;
  if ($this->{ismcp} && !$this->{ishighmcp} &&
      MailScanner::Config::Value('mcpprependsubject',$this) &&
      !$global::MS->{mta}->TextStartsHeader($this, 'Subject:', $mcptag)) {
    $global::MS->{mta}->PrependHeader($this, 'Subject:', $mcptag, ' ');
  }
  # If it is high-scoring MCP, then add a different bit of text
  $mcptag = MailScanner::Config::Value('highmcpsubjecttext', $this);
  $mcptag =~ s/_SCORE_/$scoretext/;
  if ($this->{ismcp} && $this->{ishighmcp} &&
      MailScanner::Config::Value('highmcpprependsubject',$this) &&
      !$global::MS->{mta}->TextStartsHeader($this, 'Subject:', $mcptag)) {
    $global::MS->{mta}->PrependHeader($this, 'Subject:', $mcptag, ' ');
  }


  # Add the secret archive recipients
  my($extra, @extras);
  foreach $extra (@{$this->{archiveplaces}}) {
    # Email archive recipients include a '@'
    next if $extra =~ /^\//;
    next unless $extra =~ /@/;
    push @extras, $extra;
  }
  $global::MS->{mta}->AddRecipients($this, @extras) if @extras;

  # Write the new qf file, delete originals and unlock the message
  $store->WriteHeader($this, $OutQ);
  unless ($this->{gonefromdisk}) {
    $store->DeleteUnlock();
    $this->{gonefromdisk} = 1;
  }

  # Note this does not kick the MTA into life here any more
}

# Add the X-Envelope-From and X-Envelope-To headers
sub AddFromAndTo {
  my $this = shift;

  my($to, %tolist, $from, $envtoheader);

  # Do they all want the From header
  if (MailScanner::Config::Value('addenvfrom', $this) !~ /0/) {
    $from = $this->{from};
    $global::MS->{mta}->ReplaceHeader($this,
                        MailScanner::Config::Value('envfromheader', $this),
                        $from);
  }

  # Do they all want the To header
  if (MailScanner::Config::Value('addenvto', $this) !~ /0/) {
    # Get the actual text for the header value
    foreach $to (@{$this->{to}}) {
      $tolist{$to} = 1;
    }
    $to = join(', ', sort keys %tolist);

    $envtoheader = MailScanner::Config::Value('envtoheader', $this);
    # Now reflow the To list in case it is very long
    $to = $this->ReflowHeader($envtoheader, $to);

    $global::MS->{mta}->ReplaceHeader($this, $envtoheader, $to);
  }
}

# Explode a message into its MIME structure and attachments.
# Pass in the workarea where it should go.
sub Explode {
  my $this = shift;

  my($pipe, $pid, $workarea, $mailscannername);

  return if $this->{deleted};

  # Get the translation of MailScanner, we use it a lot
  $mailscannername = MailScanner::Config::LanguageValue($this, 'mailscanner');

  # Set up something so that the hash exists
  $this->{file2parent}{""} = "";

  # df file is already locked
  $workarea = $global::MS->{work};
  my $explodeinto = $workarea->{dir} . "/" . $this->{id};
  #print STDERR "Going to explode message " . $this->{id} .
  #             " into $explodeinto\n";

  # Setup everything for the MIME parser
  my $parser = MIME::Parser->new;
  #my $filer  = MIME::Parser::FileInto::MailScanner->new($explodeinto);
  my $filer  = MIME::Parser::FileInto->new($explodeinto);

  # Over-ride the default default character set handler so it does it
  # much better than the MIME-tools default handling.
  MIME::WordDecoder->default->handler('*' => \&WordDecoderKeep7Bit);

  #print STDERR "Exploding message " . $this->{id} . " into " .
  #             $explodeinto . "\n";
  $parser->filer($filer);
  $parser->extract_uuencode(1); # uue is off by default
  $parser->output_to_core('NONE'); # everything into files
  
  # Create the message stream
  # NOTE: This still uses the real path of the message body file.
  ($pipe,$pid) = $this->{store}->ReadMessagePipe($this) or return;

  # Do the actual parsing
  my $maxparts = MailScanner::Config::Value('maxparts', $this) || 200;
  MIME::Entity::ResetMailScannerCounter($maxparts);
  my $entity = eval { $parser->parse($pipe) };
  #print STDERR "Done the parse. Counter = " .
  #      MIME::Entity::MailScannerCounter() . " and max = $maxparts\n";
  #$entity = undef
  #  if $maxparts>0 && MIME::Entity::MailScannerCounter()>=$maxparts;
  if (!$entity) {
    #print STDERR "Found an error!\n";
    $pipe->close();
    waitpid $pid, 0;
    MailScanner::Log::WarnLog("Cannot parse " . $this->{headerspath} . " and " .
                 $this->{dpath} . ", $@");
    $this->{entity} = $entity; # In case it failed due to too many attachments
    $this->{cantparse} = 1;
    $this->{otherinfected} = 1;
    return;
  }
  # Too many attachments in the message?
  if ($maxparts>0 && MIME::Entity::MailScannerCounter()>=$maxparts) {
    #print STDERR "Found an error!\n";
    $pipe->close();
    kill 9, $pid; # Make sure we are reaping a dead'un
    waitpid $pid, 0;
    MailScanner::Log::WarnLog("Too many attachments in %s", $this->{id});
    $this->{entity} = $entity; # In case it failed due to too many attachments
    $this->{toomanyattach} = 1;
    $this->{otherinfected} = 1;
    return;
  }

  #close($pipe);
  # Closing the pipe this way will reap the child, apparently!
  $pipe->close;
  kill 9, $pid; # Make sure we are reaping a dead'un
  # jjh 2004-03-12 don't waitpid here.
  #waitpid $pid, 0;
  $this->{entity} = $entity;

  # Now handle TNEF files. They should be the only attachment to the message.
  $this->{tnefentity} = MailScanner::TNEF::FindTNEFFile($entity)
    if MailScanner::Config::Value('expandtnef');

  # Look for winmail.dat files in each attachment directory $path.
  # When we find one explode it into its files and store the root MIME
  # entity into $IsTNEF{$id} so we can handle it separately later.
  # Pattern to match is actually winmail(digits).dat(digits) as that copes
  # with forwarded or bounced messages from mail packages that download
  # all attachments into 1 directory, adding numbers to their filenames.
  if (MailScanner::Config::Value('tnefexpander') && $this->{tnefentity}) {
    my($tneffile, @tneffiles);
    # Find all the TNEF files called winmail.dat
    my $outputdir = new DirHandle;
    $outputdir->open($explodeinto)
      or MailScanner::Log::WarnLog("Failed to open dir " . $explodeinto .
                      " while scanning for TNEF files, %s", $!);
    @tneffiles = map { /(winmail\d*\.dat\d*)/i } $outputdir->read();
    $outputdir->close();

    #print STDERR "TNEF files are " . join(',',@tneffiles) . "\n";

    foreach $tneffile (@tneffiles) {
      my $result;
      MailScanner::Log::InfoLog("Expanding TNEF archive at %s/%s",
                                $explodeinto, $tneffile);
      $result = MailScanner::TNEF::Decoder($explodeinto, $tneffile, $this);
      unless ($result) {
        MailScanner::Log::WarnLog("Corrupt TNEF %s that cannot be " .
                                  "analysed in message %s", $tneffile,
                                  $this->{id});
        $this->{badtnef} = 1;
        $this->{otherinfected} = 1;
      }
    }
  }

  unless(chdir $explodeinto) {
    MailScanner::Log::WarnLog("Could not chdir to %s just before unpacking " .
                              "extra message parts", $explodeinto);
    return;
  }

  # -------------------------------
  # If the MIME boundary exists and is "" then remove the entire message.
  # The top level must be multipart/mixed
  if ($entity->is_multipart && $entity->head) {
    my $boundary = $entity->head->multipart_boundary;
    #print STDERR "Boundary is \"$boundary\"\n";
    if ($boundary eq "" || $boundary eq "\"\"" || $boundary =~ /^\s/) {
      my $cantparse = MailScanner::Config::LanguageValue($this, 'cantanalyze');
      $this->{allreports}{""} .= "$mailscannername: $cantparse\n";
      $this->{alltypes}{""} .= 'c';
      $this->{otherinfected}++;
      #print STDERR "Found error\n";
    }
  }


  # -------------------------------

  # Now try to extract messages from text files as they might be things
  # we didn't manage to extract first time around.
  # And try to expand .tar.gz .tar.z .tgz .zip files.
  # We will then scan everything from inside them.
  my($allowpasswords, $couldnotreadmesg, $passwordedmesg, $toodeepmesg);
  $allowpasswords = MailScanner::Config::Value('allowpasszips', $this);
  $allowpasswords = ($allowpasswords !~ /0/)?1:0;
  $couldnotreadmesg = MailScanner::Config::LanguageValue($this,
                                                         'unreadablearchive');
  $passwordedmesg = MailScanner::Config::LanguageValue($this,
                                                       'passwordedarchive');
  $toodeepmesg    = MailScanner::Config::LanguageValue($this,
                                                       'archivetoodeep');
  $this->ExplodePartAndArchives($explodeinto,
                                MailScanner::Config::Value('maxzipdepth', $this),
                                $allowpasswords, $couldnotreadmesg,
                                $passwordedmesg, $toodeepmesg,
                                $mailscannername);


  # Set the owner and group on all the extracted files
  chown $workarea->{uid}, $workarea->{gid}, glob "$explodeinto/*"
    if $workarea->{changeowner};
}

# Try to recursively unpack tar (with or without gzip) files and zip files.
# Extracts to a given maximum unpacking depth.
sub ExplodePartAndArchives {
  my($this, $explodeinto, $maxlevels, $allowpasswords,
     $couldnotreadmesg, $passwordedmesg, $toodeepmesg, $msname) = @_;

  my($dir, $file, $part, @parts, $buffer);
  my(%seenbefore, %seenbeforesize, $foundnewfiles);
  my($size, $level, $ziperror, $tarerror, $silentviruses, $noisyviruses);
  my($allziperrors, $alltarerrors, $textlevel, $failisokay);
  my($linenum, $foundheader, $prevline, $line, $position, $prevpos, $nextpos);
  my($cyclecounter);

  $dir = new DirHandle;
  $file = new FileHandle;
  $level = 0; #-1;
  $textlevel = 0;
  $cyclecounter = 0;
  $ziperror = 0;
  $tarerror = 0;

  # Do they only want encryption checking and nothing else?
  my $onlycheckencryption;
  $onlycheckencryption = 0;
  # More robust way of saying maxlevels==0 && allowpasswords==0;
  $onlycheckencryption = 1 if !$maxlevels && !$allowpasswords;

  $silentviruses = ' '. MailScanner::Config::Value('silentviruses', $this) .' ';
  $noisyviruses = ' ' . MailScanner::Config::Value('noisyviruses', $this) .' ';

  $dir->open($explodeinto);

  # $cyclecounter is a sanity check to ensure we don't loop forever
  OUTER: while($cyclecounter<30) {
    $cyclecounter++;
    $textlevel++;
    last if $level>$maxlevels; # && $textlevel>1;
    $foundnewfiles = 0;
    $dir->rewind();
    @parts = $dir->read();
    #print STDERR "Level = $level\n";
    foreach $part (@parts) {
      next if $part eq '.' || $part eq '..';
      # Skip the entire loop if it's not what we are looking for
      next unless $part =~ /(^msg.*txt$)|(\.(tar\.g?z|taz|tgz|tz|zip|exe)$)/i;

      $size = -s "$explodeinto/$part";
      #print STDERR "Checking $part $size bytes\n";
      next if $seenbefore{$part} &&
              $seenbeforesize{$part} == $size;
      $seenbefore{$part} = 1;
      $seenbeforesize{$part} = $size;
      #print STDERR "$level/$maxlevels Found new file $part\n";

      #print STDERR "Reading $part\n";
      if ($part =~ /^msg.*txt/ && $textlevel<=2) {
        # Try and find hidden messages in the text files
        #print STDERR "About to read $explodeinto/$part\n";
        $file->open("$explodeinto/$part") or next;

        # Try reading the first few lines to see if they look like mail headers
        $linenum = 0;
        $foundheader = 0;
        $prevline = "";
        $prevpos = 0;
        $nextpos = 0;
        $line = undef;

        for ($linenum=0; $linenum<30; $linenum++) {
          #$position = $file->getpos();
          $line = <$file>;
          last unless defined $line;
          $nextpos += length $line;
          # Must have 2 lines of header
          # prevline looks like Header:
          # line     looks like       setting
          #          or         Header: 
          if ($prevline =~ /^[^:\s]+: / && $line =~ /(^\s+\S)|(^[^:\s]+: )/) { #|(^\s+.*=)/) {
            #print STDERR "Found header start at \"$prevline\"\n and \"$line\"\n";
            $foundheader = 1;
            last;
          }
          $prevline = $line;
          $prevpos  = $position;
          $position = $nextpos;
        }
    
        if ($foundheader) {
          # Check all lines are header lines up to next blank line
          my($num, $reallyfoundheader);
          $reallyfoundheader = 0;
          # Check for a maximum of 30 lines of headers
          foreach $num (0..30) {
            $line = <$file>;
            last unless defined $line;
            # Must have a valid header line
            #print STDERR "Examining: \"$line\"\n";
            next if $line =~ /(^\s+\S)|(^[^:\s]+: )/;
            #print STDERR "Not a header line\n";
            # Or a blank line
            if ($line =~ /^[\r\n]*$/) {
              $reallyfoundheader = 1;
              last;
            }
            #print STDERR "Not a blank line\n";
            # Non-header line, so it isn't a valid message part
            $reallyfoundheader = 0;
            last;
          }
          #print STDERR "Really found header = $reallyfoundheader\n";
          if ($reallyfoundheader) {
            # Rewind to the start of the header
            #$file->setpos($prevpos);
            seek $file, $prevpos, 0;
            #print STDERR "First line is \"" . <$file> . "\"\n";
    
            # Setup everything for the MIME parser
            my $parser = MIME::Parser->new;
            my $filer  = MIME::Parser::FileInto->new($explodeinto);
    
            # Over-ride the default default character set handler so it does it
            # much better than the MIME-tools default handling.
            MIME::WordDecoder->default->handler('*' => \&WordDecoderKeep7Bit);
  
            #print STDERR "Exploding message " . $this->{id} . " into " .
            #             $explodeinto . "\n";
            $parser->filer($filer);
            $parser->extract_uuencode(1); # uue is off by default
            $parser->output_to_core('NONE'); # everything into files
  
            # Do the actual parsing
            #print STDERR "About to parse\n";
            my $entity = eval { $parser->parse($file) };
            #print STDERR "Done the parse\n";

            # We might have created new files that need parsing
            $foundnewfiles = 1;
            next OUTER;
          }
        }
        $file->close;
      }

      # Not got anything to do?
      next if !$maxlevels && $allowpasswords;

      #$level++;
      next if $level > $maxlevels;

      # Find all the zip files
      #print STDERR "Looking at $explodeinto/$part\n";
      #next if MailScanner::Config::Value('filecommand', $this) eq "";
      next unless $file->open("$explodeinto/$part");
      #print STDERR "About to read 4 bytes\n";
      unless (read($file, $buffer, 4) == 4) {
        #print STDERR "Very short file $part\n";
        $file->close;
        next;
      }
      $file->close;
      $failisokay = 0;
      if ($buffer =~ /^MZ/) {
        $failisokay = 1;
      }
      next unless $buffer eq "PK\003\004" || $failisokay;
      #print STDERR "Found a zip file\n" ;
      next unless MailScanner::Config::Value('findarchivesbycontent', $this) ||
                  $part =~ /\.(tar\.g?z|taz|tgz|tz|zip|exe)$/i;
      $foundnewfiles = 1;
      #print STDERR "Unpacking $part at level $level\n";

      # Is it a zip file, in which case unpack the zip
      $ziperror = "";
      #print STDERR "About to unpackzip $part\n";
      $ziperror = $this->UnpackZip($part, $explodeinto, $allowpasswords,
                                   $onlycheckencryption);
      #print STDERR "* * * * * * * Unpackzip $part returned $ziperror\n";
      # If unpacking as a zip failed, try it as a tar
      $tarerror = "";
      $tarerror = 0 # $this->UnpackTar($part, $explodeinto, $allowpasswords)
        if $ziperror || $part =~ /(tar\.g?z|tgz)$/i;
      #print STDERR "In inner: \"$part\"\n";
      if ($ziperror eq "password") {
        MailScanner::Log::WarnLog("Password-protected archive (%s) in %s",
                                  $part, $this->{id});
        $this->{allreports}{$part} .= "$msname: $passwordedmesg\n";
        $this->{alltypes}{$part} .= 'c';
        $this->{otherinfected} = 1;
        $this->{cantdisinfect} = 1; # Don't even think about disinfecting this!
        $this->{silent}=1 if $silentviruses =~ / Zip-Password | All-Viruses /i;
        $this->{noisy} =1 if $noisyviruses  =~ / Zip-Password /i;
      } elsif ($ziperror && $tarerror && !$failisokay) {
        MailScanner::Log::WarnLog("Unreadable archive (%s) in %s",
                                  $part, $this->{id});
        $this->{allreports}{$part} .= "$msname: $couldnotreadmesg\n";
        $this->{alltypes}{$part} .= 'c';
        $this->{otherinfected} = 1;
      }
    }
    #print STDERR "In outer: \"$part\"\n";
    last if !$foundnewfiles || $level>$maxlevels;
    $dir->rewind;
    #print STDERR "Rewinding, Incrementing level from $level to " . ($level+1) . "\n";
    $level++;
  }

  #print STDERR "Level=$level($maxlevels)\n";
  #print STDERR "Onlycheckencryption=$onlycheckencryption\n";
  if ($level>$maxlevels && !$onlycheckencryption && $maxlevels) {
    MailScanner::Log::WarnLog("Files hidden in very deeply nested archive " .
                              "in %s", $this->{id});
    $this->{allreports}{""} .= "$msname: $toodeepmesg\n";
    $this->{alltypes}{""} .= 'c';
    $this->{otherinfected}++;
  }
}

# Unpack a zip file into the named directory.
# Return 1 if an error occurred, else 0.
# Return 0 on success.
# Return "password" if a member was password-protected.
sub UnpackZip {
  my($this, $zipname, $explodeinto, $allowpasswords, $onlycheckencryption) = @_;

  my($zip, @members, $member, $name, $fh, $safename);

  #print STDERR "Unpacking $zipname\n";
  return 1 if -s "$explodeinto/$zipname" == 4_237_4; # zip of death?
  return 1 unless $zip = Archive::Zip->new("$explodeinto/$zipname");
  return 1 unless @members = $zip->members();

  $fh = new FileHandle;

  foreach $member (@members) {
    #print STDERR "Checking member " . $member->fileName() . "\n";
    #print STDERR "******** Encryption = " . $member->isEncrypted() . "\n";
    return "password" if !$allowpasswords && $member->isEncrypted();

    # If they don't want to extract, but only check for encryption,
    # then skip the rest of this as we don't actually want the files.
    next if $onlycheckencryption;

    $name = $member->fileName();
    $safename = $this->MakeNameSafe($name, $explodeinto);
    $this->{file2parent}{$name} = $zipname;
    $this->{file2parent}{$safename} = $zipname;
    $this->{file2safefile}{$name} = $safename;
    $this->{safefile2file}{$safename} = $name;
    #print STDERR "Archive member \"$name\" is now \"$safename\"\n";

    #$this->{file2entity}{$name} = $this->{entity};
    $this->{file2safefile}{$name} = $zipname;
    #$this->{safefile2file}{$safename} = $zipname;

    $safename = "$explodeinto/$safename";

    #print STDERR "About to extract $member to $safename\n";
    unless ($zip->extractMemberWithoutPaths($member, $safename) == AZ_OK) {
      # Create a zero-length file if extraction failed
      # so the filename tests will still work.
      #print STDERR "Done passworded extraction of $member to $safename\n";
      $fh->open(">$safename") && $fh->close();
    }
    #print STDERR "Done extraction of $member to $safename\n";
  }
  return 0;
}

# Is this filename evil?
sub IsNameEvil {
  my($this, $name, $dir) = @_;

  #print STDERR "Testing \"$name\" to see if it is evil\n";
  return 1 if (!defined($name) or ($name eq ''));   ### empty
  return 1 if ($name =~ m{(^\s)|(\s+\Z)});  ### leading/trailing whitespace
  return 1 if ($name =~ m{^\.+\Z});         ### dots
  return 1 if ($name =~ tr{ \%\(\)\+\,\-\.0-9\=A-Z_a-z\{\}\x80-\xFF}{}c);
  return 1 if (length($name) > 50);
  return 'exists' if (-e "$dir/$name");

  #print STDERR "It is okay\n";
  #$self->debug("it's ok");
  0;
}

# Make this filename safe and return the safe version
sub MakeNameSafe {
  my($self, $fname, $dir) = @_;

    ### Isolate to last path element:
    my $last = $fname; $last =~ s{^.*[/\\\[\]:]}{};
    if ($last and !$self->IsNameEvil($last, $dir)) {
        #$self->debug("looks like I can use the last path element");
        #print STDERR "MakeNameSafe: 1 $fname,$last\n";
        return $last;
    }

    # Try removing leading whitespace, trailing whitespace and all
    # dangerous characters to start with.
    $last =~ s/^\s+//;
    $last =~ s/\s+\Z//;
    $last =~ tr/ \%\(\)\+\,\-\.0-9\=A-Z_a-z\{\}\x80-\xFF//cd;
    #print STDERR "MakeNameSafe: 2 $fname,$last\n";
    return $last unless $self->IsNameEvil($last, $dir);

    ### Break last element into root and extension, and truncate:
    my ($root, $ext) = (($last =~ /^(.*)\.([^\.]+)\Z/)
                        ? ($1, $2)
                        : ($last, ''));
    # JKF Delete leading and trailing whitespace
    $root =~ s/^\s+//;
    $ext  =~ s/\s+$//;
    $root = substr($root, 0, ($self->{MPF_TrimRoot} || 14));
    $ext  = substr($ext,  0, ($self->{MPF_TrimExt}  ||  3));
    $ext =~ /^\w+$/ or $ext = "dat";
    my $trunc = $root . ($ext ? ".$ext" : '');
    if (!$self->IsNameEvil($trunc, $dir)) {
        #$self->debug("looks like I can use the truncated last path element");
        #print STDERR "MakeNameSafe: 3 $fname,$trunc\n";
        return $trunc;
    }

    # It is still evil, but probably just because it exists
    if ($self->IsNameEvil($trunc, $dir) eq 'exists') {
      my $counter = 0;
      $trunc = $trunc . '0';
      do {
        $counter++;
        $trunc = $root . $counter . ($ext ? ".$ext" : '');
      } while $self->IsNameEvil($trunc, $dir) eq 'exists';
      return $trunc;
    }
    ### Hope that works:
    #print STDERR "MakeNameSafe: 4 $fname,:-(\n";
    undef;
}

# Unpack a tar file into the named directory.
# Return 1 if an error occurred, else 0.
sub UnpackTar {
  my($this, $tarname, $explodeinto) = @_;

  return 1; # Not yet implemented
}


# Try to parse all the text bits of each message, looking to see if they
# can be parsed into files which might be infected.
# I then throw these sections back to the MIME parser.
sub ExplodePart {
  my($this, $explodeinto) = @_;

  my($dir, $file, $part, @parts);

  $dir = new DirHandle;
  $file = new FileHandle;

  $dir->open($explodeinto);
  @parts = $dir->read();
  $dir->close();

  my($linenum, $foundheader, $prevline, $line, $position, $prevpos, $nextpos);
  foreach $part (@parts) {
    #print STDERR "Reading $part\n";
    next unless $part =~ /^msg.*txt/;

    # Try and find hidden messages in the text files
    #print STDERR "About to read $explodeinto/$part\n";
    $file->open("$explodeinto/$part") or next;

    # Try reading the first few lines to see if they look like mail headers
    $linenum = 0;
    $foundheader = 0;
    $prevline = "";
    $prevpos = 0;
    $nextpos = 0;
    $line = undef;

    for ($linenum=0; $linenum<30; $linenum++) {
      #$position = $file->getpos();
      $line = <$file>;
      last unless defined $line;
      $nextpos += length $line;
      # Must have 2 lines of header
      if ($prevline =~ /^[^:\s]+: / && $line =~ /(^\s+)|(^[^:]+ )|(^\s+.*=)/) {
        #print STDERR "Found header start at \"$prevline\"\n and \"$line\"\n";
        $foundheader = 1;
        last;
      }
      $prevline = $line;
      $prevpos  = $position;
      $position = $nextpos;
    }

    unless ($foundheader) {
      $file->close();
      next;
    }

    # Rewind to the start of the header
    #$file->setpos($prevpos);
    seek $file, $prevpos, 0;
    #print STDERR "First line is \"" . <$file> . "\"\n";

    # Setup everything for the MIME parser
    my $parser = MIME::Parser->new;
    #my $filer  = MIME::Parser::FileInto::MailScanner->new($explodeinto);
    my $filer  = MIME::Parser::FileInto->new($explodeinto);

    # Over-ride the default default character set handler so it does it
    # much better than the MIME-tools default handling.
    MIME::WordDecoder->default->handler('*' => \&WordDecoderKeep7Bit);

    #print STDERR "Exploding message " . $this->{id} . " into " .
    #             $explodeinto . "\n";
    $parser->filer($filer);
    $parser->extract_uuencode(1); # uue is off by default
    $parser->output_to_core('NONE'); # everything into files

    # Do the actual parsing
    my $entity = eval { $parser->parse($file) };

    $file->close;
  }
}


# Print the infection reports for this message
sub PrintInfections {
  my $this = shift;

  my($filename, $report, $type);

  print STDERR "Virus reports for " . $this->{id} . ":\n";
  foreach $filename (keys %{$this->{virusreports}}) {
    print STDERR "    ";
    print STDERR $filename . "\t" . $this->{virusreports}{$filename} . "\n";
    print STDERR "    " . $this->{virustypes}{$filename} . "\n";
  }

  print STDERR "Name reports for " . $this->{id} . ":\n";
  foreach $filename (keys %{$this->{namereports}}) {
    print STDERR "    ";
    print STDERR $filename . "\t" . $this->{namereports}{$filename} . "\n";
    print STDERR "    " . $this->{nametypes}{$filename} . "\n";
  }

  print STDERR "Other reports for " . $this->{id} . ":\n";
  foreach $filename (keys %{$this->{otherreports}}) {
    print STDERR "    ";
    print STDERR $filename . "\t" . $this->{otherreports}{$filename} . "\n";
    print STDERR "    " . $this->{othertypes}{$filename} . "\n";
  }

  print STDERR "Entity reports for " . $this->{id} . ":\n";
  foreach $filename (keys %{$this->{entityreports}}) {
    print STDERR "    ";
    print STDERR $filename . "\t" . $this->{entityreports}{$filename} . "\n";
  }

  print STDERR "All reports for " . $this->{id} . ":\n";
  foreach $filename (keys %{$this->{allreports}}) {
    print STDERR "    ";
    print STDERR $filename . "\t" . $this->{allreports}{$filename} . "\n";
  }

  print STDERR "Message is TNEF? " . ($this->{tnefentity}?"Yes":"No") . "\n";
  print STDERR "Message is bad TNEF? " . ($this->{badtnef}?"Yes":"No") . "\n";
  print STDERR "Message has " . $this->{virusinfected} . " virus infections\n";
  print STDERR "Message has " . $this->{otherinfected} . " other problems\n";

  print STDERR "\n";
}


# Create the Entity2Parent and Entity2File hashes for a message
#    $message->CreateEntitiesHelpers($this->{entity2parent},
#                                    $this->{entity2file});

sub CreateEntitiesHelpers {
  my $this = shift;
  #my($Entity2Parent, $Entity2File) = @_;

  return undef unless $this->{entity};

  $this->{numberparts} = CountParts($this->{entity}) || 1;

  # Put something useless in the 2 hashes so that they exist.
  $this->{entity2file}{""} = 0;
  $this->{entity2parent}{""} = 0;
  $this->{file2entity}{""} = $this->{entity}; # Root of this message
  $this->{name2entity}{""} = 0;
  $this->{file2safefile}{""} = "";
  $this->{safefile2file}{""} = "";
  BuildFile2EntityAndEntity2File($this->{entity},
                                 $this->{file2entity},
                                 $this->{file2safefile},
                                 $this->{safefile2file},
                                 $this->{entity2file},
                                 $this->{name2entity});
  #print STDERR "In CreateEntitiesHelpers, this = $this\n";
  #print STDERR "In CreateEntitiesHelpers, this entity = " .
  #             $this->{entity} . "\n";
  #print STDERR "In CreateEntitiesHelpers, parameters are " .
  #             scalar($this->{entity2file}) . " and " .
  #             scalar($this->{entity2parent}) . "\n";
  BuildEntity2Parent($this->{entity}, $this->{entity2parent}, undef);
}


# For the MIME entity given, work out the number of message parts.
# Recursive. This is a class function, not a normal method.
sub CountParts {
  my($entity) = @_;
  my(@parts, $total, $part);

  return 0 unless $entity;
  @parts = $entity->parts;
  $total += int(@parts);
  foreach $part (@parts) {
    $total += CountParts($part);
  }
  return $total;
}


# Build the file-->entity and entity-->file mappings for a message.
# This will let us replace infected entities later. Key is the filename,
# value is the entity.
# This is recursive. This is a class function, not a normal method.
sub BuildFile2EntityAndEntity2File {
  my($entity, $file2entity, $file2safefile, $safefile2file, $entity2file,
     $name2entity) = @_;

  # Build the conversion hash from scalar(entity) --> real entity object
  # Need to do this as objects cannot be hash keys.
  $name2entity->{scalar($entity)} = $entity;

  my(@parts, $body, $headfile, $part, $path);

  # Find the body for this entity
  $body = $entity->bodyhandle;
  if (defined($body) && defined($body->path)) {   # data is on disk:
    $path = $body->path;
    $path =~ s#^.*/([^/]*)$#$1#;
    $file2entity->{$path} = $entity;
    $entity2file->{$entity} = $path;
    #print STDERR "Path is $path\n";
  }
  # And the head, which is where the recommended filename is stored
  # This is so we can report infections in the filenames which are
  # recommended, even if they are evil and we hence haven't used them.
  $headfile = $entity->head->recommended_filename || $path;
  #print STDERR "rec filename for \"$headfile\" is \"" . $entity->head->recommended_filename . "\"\n";
  #print STDERR "headfile is $headfile\n";
  if ($headfile) {
    $file2entity->{$headfile} = $entity if !$file2entity->{$headfile};
    $file2safefile->{$headfile} = $path;
    $safefile2file->{$path}     = $headfile;
    #print STDERR "File2SafeFile (\"$headfile\") = \"$path\"\n";
  }

  # And for all its children
  @parts = $entity->parts;
  foreach $part (@parts) {
    BuildFile2EntityAndEntity2File($part, $file2entity, $file2safefile,
                                   $safefile2file, $entity2file, $name2entity);
  }
}


# Build a hash that gives the parent of any entity
# (except for root ones which will be undef).
# This is recursive.
sub BuildEntity2Parent {
  my($entity, $Entity2Parent, $parent) = @_;

  my(@parts, $part);

  $Entity2Parent->{$entity} = $parent;
  @parts = $entity->parts;
  foreach $part (@parts) {
    #print STDERR "BuildEntity2Parent: Doing part $part\n";
    $Entity2Parent->{$part} = $entity;
    BuildEntity2Parent($part, $Entity2Parent, $entity);
  }
}


# Combine the virus reports and the other reports, as otherwise the
# cleaning code is really messy. I might combine them when I create
# them some time later, but I wanted to keep them separate if possible
# in case anyone wanted a feature in the future which would be easier
# with separate reports.
# If safefile2file does not map for a filename, ban the whole message
# to be on the safe side.
sub CombineReports {
  my $this = shift;

  my($file, $text, $Name);
  my(%reports, %types);
  #print STDERR "Combining reports for " . $this->{id} . "\n";

  # If they want to include the scanner name in the reports, then also
  # include the translation of "MailScanner" in the filename/type/content
  # reports.
  # If they set "MailScanner = " in languages.conf then this string will
  # *not* be inserted at the start of the reports.
  $Name = MailScanner::Config::LanguageValue($this, 'mailscanner')
    if MailScanner::Config::Value('showscanner', $this);
  $Name .= ': ' if $Name ne "" && $Name !~ /:/;

  # Or the flags together
  $this->{infected} = $this->{virusinfected} |
                      $this->{nameinfected}  |
                      $this->{otherinfected} ;

  # Combine all the reports and report-types
  while (($file, $text) = each %{$this->{virusreports}}) {
    #print STDERR "Adding file $file report $text\n";
    $this->{allreports}{$file} .= $text;
    $reports{$file} .= $text;
  }
  while (($file, $text) = each %{$this->{virustypes}}) {
    #print STDERR "Adding file $file type $text\n";
    $this->{alltypes}{$file} .= $text;
    $types{$file} .= $text;
  }
  while (($file, $text) = each %{$this->{namereports}}) {
    #print STDERR "Adding file \"$file\" report \"$text\"\n";
    # Next line not needed as we prepend the $Name anyway
    #$text =~ s/\n(.)/\n$Name:  $1/g if $Name; # Make sure name is at the front of this
    #print STDERR "report is now \"$text\"\n";
    $this->{allreports}{$file} .= $Name . $text;
    $reports{$file} .= $Name . $text;
  }
  while (($file, $text) = each %{$this->{nametypes}}) {
    #print STDERR "Adding file $file type $text\n";
    $this->{alltypes}{$file} .= $text;
    $types{$file} .= $text;
  }
  while (($file, $text) = each %{$this->{otherreports}}) {
    #print STDERR "Adding file $file report $text\n";
    $this->{allreports}{$file} .= $Name . $text;
    $reports{$file} .= $Name . $text;
  }
  while (($file, $text) = each %{$this->{othertypes}}) {
    #print STDERR "Adding file $file type $text\n";
    $this->{alltypes}{$file} .= $text;
    $types{$file} .= $text;
  }

  # Now try to map all the reports onto their parents as far as possible
  #print STDERR "About to combine reports\n";
  my($key, $value, $parent, %foundparent);
  while(($key, $value) = each %reports) {
    $parent = $this->{file2parent}{$key};
    #print STDERR "Looking at report for $key (son of $parent)\n";
    if (defined $parent && exists($this->{safefile2file}{$parent})) {
      #print STDERR "Found parent of $key is $parent\n";
      $foundparent{$key} = 1;
      $this->{allreports}{$parent} .= $value;
      $this->{alltypes}{$parent}   .= $types{$key};
    }
  }
  # And delete the records for members we have found.
  #foreach $key (keys %foundparent) {
  #  print STDERR "Deleting report for $key\n";
  #  delete $this->{allreports}{$key};
  #  delete $this->{alltypes}{$key};
  #}

  # Now look for the reports we can't match anywhere and make them
  # map to the entire message.
  while(($key, $value) = each %reports) {
    if (defined $foundparent{$key} && !exists($this->{safefile2file}{$key})) {
      #print STDERR "Promoting report for $key\n";
      delete $this->{allreports}{$key};
      delete $this->{alltypes}{$key};
      $this->{allreports}{""} .= $value;
      $this->{alltypes}{""} .= $types{$key};
    }
  }

  #print STDERR "Finished combining reports\n";
  #$this->PrintInfections();
}


# Clean the message. This involves removing all the infected or
# troublesome sections of the message and replacing them with
# nice little text files explaining what happened.
# We do not do true macro-virus disinfection here.
# Also mark the message as having had its body modified.
sub Clean {
  my $this = shift;

  #print STDERR "\n\n\nStart Of Clean\n\n";
  #$this->PrintInfections();
  # Get out if nothing to do
  #print STDERR "Have we got anything to do?\n";
  return unless ($this->{allreports} && %{$this->{allreports}}) ||
                ($this->{entityreports} && %{$this->{entityreports}});
  #print STDERR "Yes we have\n";

  my($file, $text, $entity, $parent, $filename, $everyreport, %AlreadyCleaned);

  # Work out whether infected bits of this message should be stored
  my $storeme = 0;
  $storeme = 1
    if MailScanner::Config::Value('quarantineinfections', $this) =~ /1/;

  # Construct a string of all the reports, which is used if there is
  # cleaning needing doing on the whole message
  $everyreport = join("\n", values %{$this->{allreports}});

  # Construct a hash of all the entities we will clean,
  # so we clean parents in preference to their children.
  my(%EntitiesWeClean);
  $EntitiesWeClean{scalar($this->{tnefentity})} = 1 if $this->{tnefentity};
  while(($file, $text) = each %{$this->{allreports}}) {
    $entity = $this->{file2entity}{"$file"};
    # If we are a child, push the parent on the list
    $entity = $this->{file2entity}{$this->{file2parent}{$file}} if !$entity;
    # If there isn't a parent either, push the whole message on the list
    $entity = $this->{entity} if !$entity;
    $EntitiesWeClean{scalar $entity} = 1;
  }

  # Work through each filename-based report in turn, 1 per attachment
  while(($file, $text) = each %{$this->{allreports}}) {
    #print STDERR "Cleaning $file which had a report of $text\n";

    $this->{bodymodified} = 1; # This message body has been changed in memory

    # If it's a TNEF message, then use the entity of the winmail.dat
    # file, else use the entity of the infected file.
    my $tnefentity = $this->{tnefentity};
    #print STDERR "It's a TNEF message\n" if $tnefentity;
    if ($file eq "") {
      #print STDERR "It's a whole body infection, entity = ".$this->{entity}."\n";
      $entity = $this->{entity};
    } else {
      if ($tnefentity) {
        $entity = $tnefentity;
      } else {
        $entity = $this->{file2entity}{"$file"};

        # Skip this report if we are reporting this entity's parent
        $parent = scalar($this->{file2entity}{$this->{file2parent}{$file}});
        next if !$entity && $parent && $EntitiesWeClean{$parent};

        #print STDERR "Cleaning $file which is entity $entity\n";
        # Try to find a matching entity, may involve querying the parent
        if (!$entity) {
          $entity = $parent; #$this->{file2entity}{$this->{file2parent}{$file}};
          #print STDERR "Parent of $file is " . $this->{file2parent}{$file} . "\n";
          #print STDERR "Entity was blank, cleaning $entity\n";
        }
        # Could not find parent, give up and zap whole message
        if (!$entity) {
          $entity = $this->{entity};
          #print STDERR "Could not find entity, doing whole message\n";
        }
      }
    }

    # Avoid cleaning the same entity twice as it will clean the wrong thing!
    next if $AlreadyCleaned{$entity};
    $AlreadyCleaned{$entity} = 1;

    # Work out which message to replace the attachment with.
    # As there may be multiple types for 1 file, find them in
    # in decreasing order of importance.
    my $ModificationOnly = 0; # Is this just an "m" modification?
    my $type = $this->{alltypes}{"$file"};
    #print STDERR "In Clean message, type = $type and quar? = $storeme\n";
    if ($type =~ /v/i) {
      # It's a virus. Either delete or store it.
      if ($storeme) {
        $filename = MailScanner::Config::Value('storedvirusmessage',
                                               $this);
      } else {
        $filename = MailScanner::Config::Value('deletedvirusmessage',
                                               $this);
      }
    } elsif ($type =~ /f/i) {
      # It's a filename trap. Either delete or store it.
      if ($storeme) {
        $filename = MailScanner::Config::Value('storedfilenamemessage',
                                               $this);
      } else {
        $filename = MailScanner::Config::Value('deletedfilenamemessage',
                                               $this);
      }
    } elsif ($type =~ /c/i) {
      # It's dangerous content, either delete or store it.
      if ($storeme) {
        $filename = MailScanner::Config::Value('storedcontentmessage',
                                               $this);
      } else {
        $filename = MailScanner::Config::Value('deletedcontentmessage',
                                               $this);
      }
    } elsif ($type eq 'm') {
      # The only thing wrong here is that the MIME structure has been
      # modified, so the message must be re-built. Nothing needs to
      # be removed from the message.
      $ModificationOnly = 1;
    } else {
      # Treat it like a virus anyway, to be on the safe side.
      if ($storeme) {
        $filename = MailScanner::Config::Value('storedvirusmessage',
                                               $this);
      } else {
        $filename = MailScanner::Config::Value('deletedvirusmessage',
                                               $this);
      }
    }

    # If entity is null then there was a parsing problem with the message,
    # so don't try to walk its tree as it will fail.
    next unless $entity;

    # MIME structure has been modified, so the message must be rebuilt.
    # Nothing needs to be cleaned though.
    next if $ModificationOnly;

    # Do the actual attachment replacement
    #print STDERR "File = \"$file\"\nthis = \"$this\"\n";
    #print STDERR "Entity to clean is $entity\n" .
    #             "root entity is " . $this->{entity} . "\n";
    if ($file eq "") {
      # It's a report on the whole message, so use all the reports
      # This is a virus disinfection on the *whole* message, so the
      # cleaner needs to know not to generate any mime parts.
      #print STDERR "Calling CleanEntity for whole message\n";
      $this->CleanEntity($entity, $everyreport, $filename);
    } else {
      # It's a report on 1 section, so just use the report for that
      #print STDERR "About to call CleanEntity of $filename, $text\n";
      $this->CleanEntity($entity, $text, $filename);
    }
  }

  # Now do the entity reports. These are for things like unparsable tnef
  # files, partial messages, external-body messages, things like that
  # which are always just errors.
  # Work through each report in turn, 1 per attachment
  #print STDERR "Entity reports are " . $this->{entityreports} . "\n";
  while(($entity, $text) = each %{$this->{entityreports}}) {
    #print STDERR "Cleaning $entity which had a report of $text\n";

    # Find rogue entity reports that should point to tnefentity but don't
    $entity = $this->{tnefentity} if $this->{badtnef} && !$entity;
    next unless $entity; # Skip rubbish in the reports

    # Turn the text name of the entity into the object itself
    $entity = $this->{name2entity}{scalar($entity)};

    $this->{bodymodified} = 1; # This message body has been changed in memory

    #print STDERR "In Clean message, quar? = $storeme and entity = $entity\n";
    # It's always an error, so handle it like a virus.
    # Either delete or store it.
    if ($storeme) {
      $filename = MailScanner::Config::Value('storedvirusmessage', $this);
    } else {
      $filename = MailScanner::Config::Value('deletedvirusmessage', $this);
    }

    # Do the actual attachment replacement
    #print STDERR "About to try to clean $entity, $text, $filename\n";
    $this->CleanEntity($entity, $text, $filename);
  }

  # Sign the top of the message body with a text/html warning if they want.
  if (MailScanner::Config::Value('markinfectedmessages',$this) =~ /1/ &&
      !$this->{signed}) {
    #print STDERR "In Clean message, about to sign message " . $this->{id} .
    #             "\n";
    $this->SignWarningMessage($this->{entity});
    $this->{signed} = 1;
  }

  #print STDERR "\n\n\nAfter Clean()\n";
  #$this->PrintInfections();
}


# Do the actual attachment replacing
sub CleanEntity {
  my $this = shift;
  my($entity, $report, $reportname) = @_;

  my(@parts, $Warning, $Disposition, $warningfile, $charset, $i);

  # Find the parent as that's what you have to change
  #print STDERR "CleanEntity: In ".$this->{id}." entity is $entity and " .
  #             "its parent is " . $this->{entity2parent}{$entity} . "\n";
  my $parent = $this->{entity2parent}{$entity};
  $warningfile = MailScanner::Config::Value('attachmentwarningfilename', $this);
  $charset = MailScanner::Config::Value('attachmentcharset', $this);

  #print STDERR "Cleaning entity whose report is $report\n";

  # Infections applying to the entire message cannot be simply disinfected.
  # Have to replace the entire message with a text/plain error.
  unless ($parent) {
    #print STDERR "Doing the whole message\n";
    $Warning = $this->ConstructWarning(
                 MailScanner::Config::LanguageValue($this, 'theentiremessage'),
                 $report, $this->{id}, $reportname);
    #031118 if ($this->{entity} eq $entity) {
    if ($entity->bodyhandle) {
      #print STDERR "Really doing the whole message\n";
      #print STDERR "Really doing Whole message\n";
      # Replacing the whole message as the main body text of the message
      # contained a virus (e.g. the text of EICAR) without any proper
      # MIME structure at all.

      #print STDERR "Entity in CleanEntity is $entity\n";
      #print STDERR "Bodyhandle is " . $entity->bodyhandle . "\n";
      #031118 $entity->bodyhandle or return undef;

      # Output message back into body
      my($io, $filename, $temp);
      $io = $entity->open("w");
      $io->print($Warning . "\n");
      $io->close;
      # Set the MIME type if it was wrong
      $filename = MailScanner::Config::Value('attachmentwarningfilename',
                                             $this);
      $temp = $entity->head->mime_attr('content-type');
      $entity->head->mime_attr('Content-Type', 'text/plain') if
        $temp && $temp ne 'text/plain';
      # Set the charset if there was already a Content-type: header
      $entity->head->mime_attr('Content-type.charset', $charset) if $temp;
      $temp = $entity->head->mime_attr('content-type.name');
      $entity->head->mime_attr('Content-type.name', $filename) if $temp;
      $temp = $entity->head->mime_attr('content-disposition');
      $entity->head->mime_attr('content-disposition', 'inline') if $temp;
      $temp = $entity->head->mime_attr('content-disposition.filename');
      $entity->head->mime_attr('content-disposition.filename', $filename)
        if $temp;
      return;
    } else {
      ## When replacing the whole body of message/partial messages,
      ## don't forget to fix the root mime header.
      #$entity->head->mime_attr("Content-type" => "multipart/mixed")
      #  if $entity->head->mime_attr("content-type") =~ /message\/partial/i;
      #print STDERR "In CleanEntity, replacing entire message\n";
      $parts[0] = build MIME::Entity
                        Type => 'text/plain',
                        Filename => $warningfile,
                        Disposition => 'inline',
                        Data => $Warning,
                        Encoding => 'quoted-printable',
                        Charset => $charset,
                        Top => 0;
      #print STDERR "Mime type is " . $entity->mime_type() . "\n";
      #my $sss = $entity->is_multipart();
      #print STDERR "Currently is " . $sss . "\n";
      #print STDERR "Is defined\n" if defined($sss);
      #print STDERR "Type now is " . $entity->head->mime_attr('content-type')
      #             . "\n";
  
      #print STDERR "Status is " . $entity->make_multipart() . "\n"
      $entity->make_multipart()
        if $entity->head && $entity->head->mime_attr('content-type') eq "";
      $entity->parts(\@parts);
      return;
    }
  }

  # Now know that the infection only applies to one part of the message,
  # so replace that part with an error message.
  @parts = $parent->parts;
  # Find the infected part
  my $tnef = $this->{tnefentity};
  #print STDERR "TNEF entity is " . scalar($tnef) . "\n";
  my $infectednum = -1;
  #print STDERR "CleanEntity: Looking for entity $entity\n";
  for ($i=0; $i<@parts; $i++) {
    #print STDERR "CleanEntity: Comparing " . scalar($parts[$i]) .
    #             " with $entity\n";
    if (scalar($parts[$i]) eq scalar($entity)) {
      #print STDERR "Found it in part $i\n";
      $infectednum = $i;
      last;
    }
    if ($tnef && (scalar($parts[$i]) eq scalar($tnef))) {
      #print STDERR "Found winmail.dat in part $i\n";
      $infectednum = $i;
      last;
    }
  }

  #MailScanner::Log::WarnLog(
  #  "Oh bother, missed infected entity in message %s :-(", $this->{id}), return
  #  if $infectednum<0;

  # Now to actually do something about it...
  #print STDERR "About to constructwarning from $report\n";
  $Warning = $this->ConstructWarning($this->{entity2file}{$entity},
                                     $report, $this->{id}, $reportname);
  $Disposition = MailScanner::Config::Value('warningisattachment',$this)
                 ?'attachment':'inline';
  $parts[$infectednum] = build MIME::Entity
                           Type => 'text/plain',
                           Filename => $warningfile,
                           Disposition => $Disposition,
                           Data => $Warning,
                           Encoding => 'quoted-printable',
                           Charset => $charset,
                           Top => 0;
  $parent->parts(\@parts);

  # And make the parent a multipart/mixed if it's a multipart/alternative
  # or multipart/related or message/partial
  $parent->head->mime_attr("Content-type" => "multipart/mixed")
    if ($parent->is_multipart) &&
       ($parent->head->mime_attr("content-type") =~
                                   /multipart\/(alternative|related)/i);
  if ($parent->head->mime_attr("content-type") =~ /message\/partial/i) {
    $parent->head->mime_attr("Content-type" => "multipart/mixed");
  #  $parent->make_singlepart();
  }
}


# Construct a warning message given an attachment filename, a copy of
# what the virus scanner said, the message id and a message filename to parse.
# The id is passed in purely for substituting into the warning message file.
sub ConstructWarning {
  my $this = shift;
  my($attachmententity, $scannersaid, $id, $reportname) = @_;

  my $date = scalar localtime;
  my $textfh = new FileHandle;
  my $dir = $global::MS->{work}{dir}; # Get the working directory
  my $localpostmaster = MailScanner::Config::Value('localpostmaster', $this);

  #print STDERR "ConstructWarning for $attachmententity. Scanner said \"" .
  #             "$scannersaid\", message id $id, file = $reportname\n";

  # Reformat the virus scanner report a bit, and optionally remove dirs
  $scannersaid =~ s/^/   /gm;
  if (MailScanner::Config::Value('hideworkdir',$this)) {
    my $pattern = '(' . quotemeta($global::MS->{work}->{dir}) . "|\\\.)/";
    #print STDERR "In replacement, regexp is \"$pattern\"\n";
    $scannersaid =~ s/$pattern//g; #m # Remove the work dir
    $scannersaid =~ s/\/?$id\/?//g; # Remove the message id
  }
  #print STDERR "After replacement, scanner said \"$scannersaid\"\n";

  my $output = "";
  my $result = "";
  # These are all the variables that are allowed to appear
  # in the report template.
  my $filename = ($attachmententity || 
                  MailScanner::Config::LanguageValue($this, 'notnamed'));
  #my $date = scalar localtime; Already defined above
  my $report = $scannersaid;
  my $hostname = MailScanner::Config::Value('hostname',$this);
  my $quarantinedir = MailScanner::Config::Value('quarantinedir', $this);

  # And let them put the date number in there too
  my($day, $month, $year);
  ($day, $month, $year) = (localtime)[3,4,5];
  $month++;
  $year += 1900;
  my $datenumber = sprintf("%04d%02d%02d", $year, $month, $day);

#  # Do we want to hide the directory and message id from the report path?
#  if (MailScanner::Config::Value('hideworkdir', $this)) {
#    my $pattern = "(" . quotemeta($global::MS->{work}->{dir}) . "|\.)/$id/";
#    $report =~ s/$pattern//gm;
#  }

  open($textfh, $reportname)
    or MailScanner::Log::WarnLog("Cannot open message file %s, %s",
                                 $reportname, $!);
  my $line;
  while(defined ($line = <$textfh>)) {
    chomp $line;
    #$line =~ s/"/\\"/g; # Escape any " characters
    #$line =~ s/@/\\@/g; # Escape any @ characters
    $line =~ s/([\(\)\[\]\.\?\*\+\^"'@])/\\$1/g; # Escape any regex characters
    # Untainting joy...
    $line =~ $1 if $line =~ /(.*)/;
    $result = eval "\"$line\"";
    $output .= $result . "\n";
  }
  $output;
}


# Sign the body of the message with a text or html warning message
# directing users to read the VirusWarning.txt attachment.
# Return 0 if nothing was signed, true if it signed something.
sub SignWarningMessage {
  my $this = shift;
  my $top = shift;

  #print STDERR "Top is $top\n";
  return 0 unless $top;

  # If multipart, try to sign our first part
  if ($top->is_multipart) {
    my $sigcounter = 0;
    #print STDERR "It's a multipart message\n";
    $sigcounter += $this->SignWarningMessage($top->parts(0));
    $sigcounter += $this->SignWarningMessage($top->parts(1))
      if $top->head and $top->effective_type =~ /multipart\/alternative/i;

    if ($sigcounter == 0) {
      # If we haven't signed anything by now, it must be a multipart
      # message containing only things we can't sign. So add a text/plain
      # section on the front and sign that.
      my $text = $this->ReadVirusWarning('inlinetextwarning') . "\n\n";
      my $newpart = build MIME::Entity
                          Type => 'text/plain',
                          Disposition => 'inline',
                          Data => $text,
                          Encoding => 'quoted-printable',
                          Top => 0;
      $top->add_part($newpart, 0);
      $sigcounter = 1;
    }
    return $sigcounter;
  }

  my $MimeType = $top->head->mime_type if $top->head;
  #print STDERR "MimeType is $MimeType\n";
  return 0 unless $MimeType =~ m{text/}i; # Won't sign non-text message.
  # Won't sign attachments.
  return 0 if $top->head->mime_attr('content-disposition') =~ /attachment/i;

  # Get body data as array of newline-terminated lines
  #print STDERR "Bodyhandle is " . $top->bodyhandle . "\n";
  $top->bodyhandle or return undef;
  my @body = $top->bodyhandle->as_lines;

  #print STDERR "Signing message part\n";

  # Output message back into body, followed by original data
  my($line, $io, $warning);
  $io = $top->open("w");
  if ($MimeType =~ /text\/html/i) {
    $warning = $this->ReadVirusWarning('inlinehtmlwarning');
    #$warning = quotemeta $warning; # Must leave HTML tags alone!
    foreach $line (@body) {
      $line =~ s/\<html\>/$&$warning/i;
      $io->print($line);
    }
  } else {
    $warning = $this->ReadVirusWarning('inlinetextwarning');
    $io->print($warning . "\n");
    foreach $line (@body) { $io->print($line) }; # Original body data
  }
  (($body[-1]||'') =~ /\n\Z/) or $io->print("\n"); # Ensure final newline
  $io->close;

  # We signed something
  return 1;
}


# Read the appropriate warning message to sign the top of cleaned messages.
# Passed in the name of the config variable that points to the filename.
# This is also used to read the inline signature added to the bottom of
# clean messages.
# Substitutions allowed in the message are
#     $viruswarningfilename -- by default VirusWarning.txt
#     $from
#     $subject
# and $filename -- comma-separated list of infected attachments
sub ReadVirusWarning {
  my $this = shift;
  my($option) = @_;

  my $file = MailScanner::Config::Value($option, $this);
  my $viruswarningname = MailScanner::Config::Value('attachmentwarningfilename',
                                                    $this);
  my($line);

  #print STDERR "Reading virus warning message from $filename\n";
  my $fh = new FileHandle;
  $fh->open($file)
    or (MailScanner::Log::WarnLog("Could not open inline file %s, %s",
                                  $file, $!),
        return undef);

  # Work out the list of all the infected attachments, including
  # reports applying to the whole message
  my($attach, $text, %infected, $filename, $from, $subject);
  while (($attach, $text) = each %{$this->{allreports}}) {
    # It affects the entire message if the entity of this file matches
    # the entity of the entire message.
    my $entity = $this->{file2entity}{"$attach"};
    #if ($attach eq "") {
    if ($this->{entity} eq $entity) {
      $infected{MailScanner::Config::LanguageValue($this, "theentiremessage")}
        = 1;
    } else {
      $infected{"$attach"} = 1;
    }
  }
  # And don't forget the external bodies which are just entity reports
  while (($attach, $text) = each %{$this->{entityreports}}) {
    $infected{MailScanner::Config::LanguageValue($this, 'notnamed')} = 1;
  }
  $filename = join(', ', keys %infected);
  $from = $this->{from};
  $subject = $this->{subject};

  my $result = "";
  while (<$fh>) {
    chomp;
    s#"#\\"#g;
    s#@#\\@#g;
    # Boring untainting again...
    /(.*)/;
    $line = eval "\"$1\"";
    $result .= $line . "\n";
  }
  $fh->close();
  $result;
}


# Sign the bottom of the message with a tag-line saying it is clean
# and MailScanner is wonderful :-)
# Have already checked that message is not infected, and that they want
# clean signatures adding to messages.
sub SignUninfected {
  my $this = shift;

  return if $this->{infected}; # Double-check!

  my($entity, $scannerheader);

  # Use the presence of an X-MailScanner: header to decide if the
  # message will have already been signed by another MailScanner server.
  $scannerheader = MailScanner::Config::Value('mailheader', $this);
  $scannerheader =~ tr/://d;

  #print STDERR "Signing uninfected message " . $this->{id} . "\n";

  # Want to sign the bottom of the highest-level MIME entity
  $entity = $this->{entity};
  if (MailScanner::Config::Value('signalreadyscanned', $this) ||
      !$entity->head->count($scannerheader)) {
    $this->AppendSignCleanEntity($entity);
    #$this->PrependSignCleanEntity($entity)
    #  if MailScanner::Config::Value('signtopaswell', $this);
    $entity->head->add('MIME-Version', '1.0')
      unless $entity->head->get('mime-version');
    $this->{bodymodified} = 1;
  }
}


# Sign the end of a message (which is an entity) with the given tag-line
sub PrependSignCleanEntity {
  my $this = shift;
  my($top) = @_;

  my($MimeType, $signature, @signature);

  return unless $top;

  #print STDERR "In PrependSignCleanEntity, signing $top\n";

  # If multipart, try to sign our first part
  if ($top->is_multipart) {
    my $sigcounter = 0;
    # JKF Signed and encrypted multiparts must not be touched.
    # JKF Instead put the sig in the epilogue. Breaks the RFC
    # JKF but in a harmless way.
    if ($top->effective_type =~ /multipart\/(signed|encrypted)/i) {
      # Read the sig and put it in the epilogue, which may be ignored
      $signature = $this->ReadVirusWarning('inlinetextpresig');
      @signature = map { "$_\n" } split(/\n/, $signature);
      unshift @signature, "\n";
      $top->preamble(\@signature);
      return 1;
    }
    $sigcounter += $this->PrependSignCleanEntity($top->parts(0));
    $sigcounter += $this->PrependSignCleanEntity($top->parts(1))
      if $top->head and $top->effective_type =~ /multipart\/alternative/i;

    if ($sigcounter == 0) {
      # If we haven't signed anything by now, it must be a multipart
      # message containing only things we can't sign. So add a text/plain
      # section on the front and sign that.
      my $text = $this->ReadVirusWarning('inlinetextpresig') . "\n\n";
      my $newpart = build MIME::Entity
                          Type => 'text/plain',
                          Charset =>
                    MailScanner::Config::Value('attachmentcharset', $this),
                          Disposition => 'inline',
                          Data => $text,
                          Encoding => 'quoted-printable',
                          Top => 0;
      $top->add_part($newpart, 0);
      $sigcounter = 1;
    }
    return $sigcounter;
  }

  $MimeType = $top->head->mime_type if $top->head;
  return 0 unless $MimeType =~ m{text/}i; # Won't sign non-text message.
  # Won't sign attachments.
  return 0 if $top->head->mime_attr('content-disposition') =~ /attachment/i;

  # Get body data as array of newline-terminated lines
  $top->bodyhandle or return undef;
  my @body = $top->bodyhandle->as_lines;

  # Output original data back into body, followed by message
  my($line, $io);
  $io = $top->open("w");
  if ($MimeType =~ /text\/html/i) {
    $signature = $this->ReadVirusWarning('inlinehtmlpresig');
    foreach $line (@body) {
      $line =~ s/\<x?html\>/$&$signature/i;
      $io->print($line);
    }
    #(($body[-1]||'') =~ /\n\Z/) or $io->print("\n"); # Ensure final newline
  } else {
    $signature = $this->ReadVirusWarning('inlinetextpresig');
    $io->print("$signature\n");
    foreach $line (@body) { $io->print($line) }; # Original body data
  }
  $io->close;

  # We signed something
  return 1;
}

# Sign the end of a message (which is an entity) with the given tag-line
sub AppendSignCleanEntity {
  my $this = shift;
  my($top) = @_;

  my($MimeType, $signature, @signature);

  return unless $top;

  #print STDERR "In AppendSignCleanEntity, signing $top\n";

  # If multipart, try to sign our first part
  if ($top->is_multipart) {
    my $sigcounter = 0;
    # JKF Signed and encrypted multiparts must not be touched.
    # JKF Instead put the sig in the epilogue. Breaks the RFC
    # JKF but in a harmless way.
    if ($top->effective_type =~ /multipart\/(signed|encrypted)/i) {
      # Read the sig and put it in the epilogue, which may be ignored
      $signature = $this->ReadVirusWarning('inlinetextsig');
      @signature = map { "$_\n" } split(/\n/, $signature);
      unshift @signature, "\n";
      $top->epilogue(\@signature);
      return 1;
    }
    $sigcounter += $this->AppendSignCleanEntity($top->parts(0));
    $sigcounter += $this->AppendSignCleanEntity($top->parts(1))
      if $top->head and $top->effective_type =~ /multipart\/alternative/i;

    if ($sigcounter == 0) {
      # If we haven't signed anything by now, it must be a multipart
      # message containing only things we can't sign. So add a text/plain
      # section on the front and sign that.
      my $text = $this->ReadVirusWarning('inlinetextsig') . "\n\n";
      my $newpart = build MIME::Entity
                          Type => 'text/plain',
                          Charset =>
                    MailScanner::Config::Value('attachmentcharset', $this),
                          Disposition => 'inline',
                          Data => $text,
                          Encoding => 'quoted-printable',
                          Top => 0;
      $top->add_part($newpart, 0);
      $sigcounter = 1;
    }
    return $sigcounter;
  }

  $MimeType = $top->head->mime_type if $top->head;
  return 0 unless $MimeType =~ m{text/(html|plain)}i; # Won't sign non-text message.
  # Won't sign attachments.
  return 0 if $top->head->mime_attr('content-disposition') =~ /attachment/i;

  # Get body data as array of newline-terminated lines
  $top->bodyhandle or return undef;
  my @body = $top->bodyhandle->as_lines;

  # Output original data back into body, followed by message
  my($line, $io, $FoundHTMLEnd);
  $FoundHTMLEnd = 0; # If there is no </html> tag, still append the signature
  $io = $top->open("w");
  if ($MimeType =~ /text\/html/i) {
    $signature = $this->ReadVirusWarning('inlinehtmlsig');
    foreach $line (@body) {
      $FoundHTMLEnd = 1 if $line =~ s/\<\/x?html\>/$signature$&/i;
      $io->print($line);
    }
    $io->print($signature . "\n") unless $FoundHTMLEnd;
    (($body[-1]||'') =~ /\n\Z/) or $io->print("\n"); # Ensure final newline
  } else {
    foreach $line (@body) { $io->print($line) }; # Original body data
    $signature = $this->ReadVirusWarning('inlinetextsig');
    $io->print("\n$signature\n");
  }
  $io->close;

  # We signed something
  return 1;
}


# Deliver an uninfected message. It is already signed as necessary.
# If the body has been modified then we need to reconstruct it from
# the MIME structure. If not modified, then just link it across to
# the outgoing queue.
sub DeliverUninfected {
  my $this = shift;

  if ($this->{bodymodified}) {
    # The body of this message has been modified, so reconstruct
    # it from the MIME structure and deliver that.
    #print STDERR "Body modified\n";
    $this->DeliverModifiedBody('cleanheader');
  } else {
    #print STDERR "Body not modified\n";
    $this->DeliverUnmodifiedBody('cleanheader');
  }
}


# Deliver a message which has not had its body modified in any way.
# This is a lot faster as it doesn't involve reconstructing the message
# body at all, it is just copied from the inqueue to the outqueue.
sub DeliverUnmodifiedBody {
  my $this = shift;
  my($headervalue) = @_;

  return if $this->{deleted}; # This should never happen

  #print STDERR "Delivering Unmodified Body message\n";

  my $OutQ = MailScanner::Config::Value('outqueuedir', $this);
  my $store = $this->{store};

  # Link the queue data file from in to out
  $store->LinkData($OutQ);

  # Set up the output envelope with its (possibly modified) headers
  # Used to do next line but it breaks text-only messages with no MIME
  # structure as the MIME explosion will have created a MIME structure.
  #$global::MS->{mta}->AddHeadersToQf($this, $this->{entity}->stringify_header);
  $global::MS->{mta}->AddHeadersToQf($this);

  # Add the information/help X- header
  my $infoheader = MailScanner::Config::Value('infoheader', $this);
  if ($infoheader) {
    my $infovalue = MailScanner::Config::Value('infovalue', $this);
    $global::MS->{mta}->ReplaceHeader($this, $infoheader, $infovalue);
  }

  $global::MS->{mta}->AddMultipleHeader($this, 'mailheader',
               MailScanner::Config::Value($headervalue, $this), ', ');
  # Delete all content length headers anyway. They are unsafe.
  # No, leave them if nothing in the body has been modified.
  #$global::MS->{mta}->DeleteHeader($this, 'Content-length:');

  # Add the MCP header if necessary
  $global::MS->{mta}->AddMultipleHeader($this, 'mcpheader',
                                        $this->{mcpreport}, ', ')
    if $this->{ismcp} ||
       MailScanner::Config::Value('includemcpheader', $this);

  # Add the spam header if they want that
  #$global::MS->{mta}->AddHeader($this,
  #                              MailScanner::Config::Value('spamheader',$this),
  #                              $this->{spamreport})
  $global::MS->{mta}->AddMultipleHeader($this, 'spamheader',
                                        $this->{spamreport}, ', ')
    if $this->{isspam} ||
       MailScanner::Config::Value('includespamheader', $this);

  # Add the spam stars if they want that. Limit it to 60 characters to avoid
  # a potential denial-of-service attack.
  my($stars,$starcount,$scoretext,$minstars,$scorefmt);
  $starcount = int($this->{sascore}) + 0;
  $starcount = 0 if $this->{spamwhitelisted}; # 0 stars if white-listed
  $scorefmt = MailScanner::Config::Value('scoreformat', $this);
  $scorefmt = '%d' if $scorefmt eq '';
  $scoretext = sprintf($scorefmt, $this->{sascore}+0);
  $minstars = MailScanner::Config::Value('minstars', $this);
  $starcount = $minstars if $this->{isrblspam} && $minstars &&
                            $starcount<$minstars;
  if (MailScanner::Config::Value('spamstars', $this) =~ /1/ && $starcount>0) {
    if (MailScanner::Config::Value('spamscorenotstars', $this)) {
      $stars = $scoretext; # int($starcount);
    } else {
      $starcount = 60 if $starcount>60;
      $stars = MailScanner::Config::Value('spamstarscharacter') x $starcount;
    }
    $global::MS->{mta}->AddMultipleHeader($this, 'spamstarsheader',
                                          $stars, ', ');
  }

  # Add the Envelope to and from headers
  AddFromAndTo($this);

  # Repair the subject line
  $global::MS->{mta}->ReplaceHeader($this, 'Subject:', $this->{safesubject})
    if $this->{subjectwasunsafe};

  # Modify the subject line for spam
  # if it's spam AND they want to modify the subject line AND it's not
  # already been modified by another of your MailScanners.
  my $subjectchanged = 0;
  my $spamtag = MailScanner::Config::Value('spamsubjecttext', $this);
  $spamtag =~ s/_SCORE_/$scoretext/;
  if ($this->{isspam} && !$this->{ishigh} &&
      MailScanner::Config::Value('spamprependsubject',$this) &&
      !$global::MS->{mta}->TextStartsHeader($this, 'Subject:', $spamtag)) {
    $global::MS->{mta}->PrependHeader($this, 'Subject:', $spamtag, ' ');
    $subjectchanged = 1;
  }
  # If it is high-scoring spam, then add a different bit of text
  $spamtag = MailScanner::Config::Value('highspamsubjecttext', $this);
  $spamtag =~ s/_SCORE_/$scoretext/;
  if ($this->{isspam} && $this->{ishigh} &&
      MailScanner::Config::Value('highspamprependsubject',$this) &&
      !$global::MS->{mta}->TextStartsHeader($this, 'Subject:', $spamtag)) {
    $global::MS->{mta}->PrependHeader($this, 'Subject:', $spamtag, ' ');
    $subjectchanged = 1;
  }

  # Modify the subject line for MCP
  # if it's MCP AND they want to modify the subject line AND it's not
  # already been modified by another of your MailScanners.
  $starcount = int($this->{mcpsascore}) + 0;
  $starcount = 0 if $this->{mcpwhitelisted}; # 0 stars if white-listed
  $scorefmt = MailScanner::Config::Value('scoreformat', $this);
  $scorefmt = '%d' if $scorefmt eq '';
  $scoretext = sprintf($scorefmt, $this->{mcpsascore}+0);
  my $mcptag = MailScanner::Config::Value('mcpsubjecttext', $this);
  $mcptag =~ s/_SCORE_/$scoretext/;
  if ($this->{ismcp} && !$this->{ishighmcp} &&
      MailScanner::Config::Value('mcpprependsubject',$this) &&
      !$global::MS->{mta}->TextStartsHeader($this, 'Subject:', $mcptag)) {
    $global::MS->{mta}->PrependHeader($this, 'Subject:', $mcptag, ' ');
  }
  # If it is high-scoring MCP, then add a different bit of text
  $mcptag = MailScanner::Config::Value('highmcpsubjecttext', $this);
  $mcptag =~ s/_SCORE_/$scoretext/;
  if ($this->{ismcp} && $this->{ishighmcp} &&
      MailScanner::Config::Value('highmcpprependsubject',$this) &&
      !$global::MS->{mta}->TextStartsHeader($this, 'Subject:', $mcptag)) {
    $global::MS->{mta}->PrependHeader($this, 'Subject:', $mcptag, ' ');
  }

  # Modify the subject line for scanning -- but only do it if the
  # subject hasn't already been modified by MailScanner for another reason.
  my $modifscan = MailScanner::Config::Value('scannedmodifysubject', $this);
  my $scantag   = MailScanner::Config::Value('scannedsubjecttext', $this);
  if ($modifscan eq 'start' && !$subjectchanged &&
      !$global::MS->{mta}->TextStartsHeader($this, 'Subject:', $scantag)) {
    $global::MS->{mta}->PrependHeader($this, 'Subject:', $scantag, ' ');
  } elsif ($modifscan eq 'end' && !$subjectchanged &&
      !$global::MS->{mta}->TextEndsHeader($this, 'Subject:', $scantag)) {
    $global::MS->{mta}->AppendHeader($this, 'Subject:', $scantag, ' ');
  }

  # Remove any headers we don't want in the message
  my(@removeme, $remove);
  @removeme = split(/[,\s]+/, MailScanner::Config::Value('removeheaders', $this));
  foreach $remove (@removeme) {
    # Add a : if there isn't one already, it's needed for DeleteHeader()
    $remove .= ':' unless $remove =~ /:$/;
    $global::MS->{mta}->DeleteHeader($this, $remove);
  }

  # Add the secret archive recipients
  my($extra, @extras);
  foreach $extra (@{$this->{archiveplaces}}) {
    next if $extra =~ /^\//;
    next unless $extra =~ /@/;
    push @extras, $extra;
  }
  $global::MS->{mta}->AddRecipients($this, @extras) if @extras;

  # Write the new qf file, delete originals and unlock the message
  $store->WriteHeader($this, $OutQ);
  unless ($this->{gonefromdisk}) {
    $store->DeleteUnlock();
    $this->{gonefromdisk} = 1;
  }

  # Note this does not kick the MTA into life here any more
}


# Deliver a message which has had its body modified.
# This is slower as the message has to be reconstructed from all its
# MIME entities.
sub DeliverModifiedBody {
  my $this = shift;
  my($headervalue) = @_;

  return if $this->{deleted}; # This should never happen

  #print STDERR "Delivering Modified Body message with header \"$headervalue\"\n";

  my $store = $this->{store};

  # If there is no data structure at all for this message, then we
  # can't sensibly deliver anything, so just delete it.
  # The parsing must have failed completely.
  my $entity = $this->{entity};
  unless ($entity) {
    #print STDERR "Deleting duff message\n";
    unless ($this->{gonefromdisk}) {
      $store->DeleteUnlock();
      $this->{gonefromdisk} = 1;
    }
    return;
  }

  my $OutQ = MailScanner::Config::Value('outqueuedir', $this);

  # Write the new body file
  #print STDERR "Writing the MIME body of $this, " . $this->{id} . "\n";
  $store->WriteMIMEBody($this->{id}, $entity, $OutQ);

  # Set up the output envelope with its (possibly modified) headers
  $global::MS->{mta}->AddHeadersToQf($this, $this->{entity}->stringify_header);

  # Add the information/help X- header
  my $infoheader = MailScanner::Config::Value('infoheader', $this);
  if ($infoheader) {
    my $infovalue = MailScanner::Config::Value('infovalue', $this);
    $global::MS->{mta}->ReplaceHeader($this, $infoheader, $infovalue);
  }

  # Add the clean/dirty header
  #print STDERR "Adding clean/dirty header $headervalue\n";
  $global::MS->{mta}->AddMultipleHeader($this, 'mailheader',
               MailScanner::Config::Value($headervalue, $this), ', ');

  # Delete all content length headers as the body has been modified.
  $global::MS->{mta}->DeleteHeader($this, 'Content-length:');

  # Add the MCP header if necessary
  $global::MS->{mta}->AddMultipleHeader($this, 'mcpheader',
                                        $this->{mcpreport}, ', ')
    if $this->{ismcp} ||
       MailScanner::Config::Value('includemcpheader', $this);

  # Add the spam header if they want that
  #$global::MS->{mta}->AddHeader($this,
  #                              MailScanner::Config::Value('spamheader',$this),
  #                              $this->{spamreport})
  $global::MS->{mta}->AddMultipleHeader($this, 'spamheader',
                                        $this->{spamreport}, ', ')
    if $this->{isspam} ||
       MailScanner::Config::Value('includespamheader', $this);

  # Add the spam stars if they want that. Limit it to 60 characters to avoid
  # a potential denial-of-service attack.
  my($stars,$starcount,$scoretext,$minstars,$scorefmt);
  $starcount = int($this->{sascore}) + 0;
  $starcount = 0 if $this->{spamwhitelisted}; # 0 stars if white-listed
  $scorefmt = MailScanner::Config::Value('scoreformat', $this);
  $scorefmt = '%d' if $scorefmt eq '';
  $scoretext = sprintf($scorefmt, $this->{sascore}+0);
  $minstars = MailScanner::Config::Value('minstars', $this);
  $starcount = $minstars if $this->{isrblspam} && $minstars &&
                            $starcount<$minstars;
  if (MailScanner::Config::Value('spamstars', $this) =~ /1/ && $starcount>0) {
    if (MailScanner::Config::Value('spamscorenotstars', $this)) {
      $stars = $scoretext; # int($starcount);
    } else {
      $starcount = 60 if $starcount>60;
      $stars = MailScanner::Config::Value('spamstarscharacter') x $starcount;
    }
    $global::MS->{mta}->AddMultipleHeader($this, 'spamstarsheader',
                                          $stars, ', ');
  }

  # Add the Envelope to and from headers
  AddFromAndTo($this);

  # Repair the subject line
  #print STDERR "Metadata is " . join("\n", @{$this->{metadata}}) . "\n";
  $global::MS->{mta}->ReplaceHeader($this, 'Subject:', $this->{safesubject})
    if $this->{subjectwasunsafe};

  my $subjectchanged = 0;

  # Modify the subject line for viruses or filename traps.
  # Only use the filename trap test if it isn't infected by anything else.
  my $nametag = MailScanner::Config::Value('namesubjecttext', $this);
  my $contenttag = MailScanner::Config::Value('contentsubjecttext', $this);
  #print STDERR "I have triggered a filename trap\n" if $this->{nameinfected};
  if ($this->{nameinfected} &&   # Triggered a filename trap
      !$this->{virusinfected} && # No other reports about it
      !$this->{otherinfected} && # They want the tagging & not already tagged
      !$global::MS->{mta}->TextStartsHeader($this, 'Subject:', $nametag)) {
    if (MailScanner::Config::Value('nameprependsubject',$this)) {
      $global::MS->{mta}->PrependHeader($this, 'Subject:', $nametag, ' ');
      $subjectchanged = 1;
    }
  } elsif ($this->{otherinfected} &&   # Triggered a content trap
      !$this->{virusinfected} && # No other reports about it
      !$this->{nameinfected} && # They want the tagging & not already tagged
      !$global::MS->{mta}->TextStartsHeader($this, 'Subject:', $contenttag)) {
    if (MailScanner::Config::Value('contentprependsubject',$this)) {
      $global::MS->{mta}->PrependHeader($this, 'Subject:', $contenttag, ' ');
      $subjectchanged = 1;
    }
  } else {
    # It may be really virus infected.
    # Modify the subject line for viruses
    # if it's infected AND they want to modify the subject line AND it's not
    # already been modified by another of your MailScanners.
    my $virustag = MailScanner::Config::Value('virussubjecttext', $this);
    #print STDERR "I am infected\n" if $this->{infected};
    if ($this->{infected} &&
        MailScanner::Config::Value('virusprependsubject',$this) &&
        !$global::MS->{mta}->TextStartsHeader($this, 'Subject:', $virustag)) {
      $global::MS->{mta}->PrependHeader($this, 'Subject:', $virustag, ' ');
      $subjectchanged = 1;
    }
  }

  # Modify the subject line for spam
  # if it's spam AND they want to modify the subject line AND it's not
  # already been modified by another of your MailScanners.
  my $spamtag = MailScanner::Config::Value('spamsubjecttext', $this);
  $spamtag =~ s/_SCORE_/$scoretext/;
  if ($this->{isspam} && !$this->{ishigh} &&
      MailScanner::Config::Value('spamprependsubject',$this) &&
      !$global::MS->{mta}->TextStartsHeader($this, 'Subject:', $spamtag)) {
    $global::MS->{mta}->PrependHeader($this, 'Subject:', $spamtag, ' ');
    $subjectchanged = 1;
  }
  # If it is high-scoring spam, then add a different bit of text
  $spamtag = MailScanner::Config::Value('highspamsubjecttext', $this);
  $spamtag =~ s/_SCORE_/$scoretext/;
  if ($this->{isspam} && $this->{ishigh} &&
      MailScanner::Config::Value('highspamprependsubject',$this) &&
      !$global::MS->{mta}->TextStartsHeader($this, 'Subject:', $spamtag)) {
    $global::MS->{mta}->PrependHeader($this, 'Subject:', $spamtag, ' ');
    $subjectchanged = 1;
  }

  # Modify the subject line for MCP
  # if it's MCP AND they want to modify the subject line AND it's not
  # already been modified by another of your MailScanners.
  $starcount = int($this->{mcpsascore}) + 0;
  $starcount = 0 if $this->{mcpwhitelisted}; # 0 stars if white-listed
  $scorefmt = MailScanner::Config::Value('scoreformat', $this);
  $scorefmt = '%d' if $scorefmt eq '';
  $scoretext = sprintf($scorefmt, $this->{mcpsascore}+0);
  my $mcptag = MailScanner::Config::Value('mcpsubjecttext', $this);
  $mcptag =~ s/_SCORE_/$scoretext/;
  if ($this->{ismcp} && !$this->{ishighmcp} &&
      MailScanner::Config::Value('mcpprependsubject',$this) &&
      !$global::MS->{mta}->TextStartsHeader($this, 'Subject:', $mcptag)) {
    $global::MS->{mta}->PrependHeader($this, 'Subject:', $mcptag, ' ');
  }
  # If it is high-scoring MCP, then add a different bit of text
  $mcptag = MailScanner::Config::Value('highmcpsubjecttext', $this);
  $mcptag =~ s/_SCORE_/$scoretext/;
  if ($this->{ismcp} && $this->{ishighmcp} &&
      MailScanner::Config::Value('highmcpprependsubject',$this) &&
      !$global::MS->{mta}->TextStartsHeader($this, 'Subject:', $mcptag)) {
    $global::MS->{mta}->PrependHeader($this, 'Subject:', $mcptag, ' ');
  }

  # Modify the subject line for scanning -- but only do it if the
  # subject hasn't already been modified by MailScanner for another reason.
  my $modifscan = MailScanner::Config::Value('scannedmodifysubject', $this);
  my $scantag   = MailScanner::Config::Value('scannedsubjecttext', $this);
  if ($modifscan eq 'start' && !$subjectchanged &&
      !$global::MS->{mta}->TextStartsHeader($this, 'Subject:', $scantag)) {
    $global::MS->{mta}->PrependHeader($this, 'Subject:', $scantag, ' ');
  } elsif ($modifscan eq 'end' && !$subjectchanged &&
      !$global::MS->{mta}->TextEndsHeader($this, 'Subject:', $scantag)) {
    $global::MS->{mta}->AppendHeader($this, 'Subject:', $scantag, ' ');
  }

  # Remove any headers we don't want in the message
  my(@removeme, $remove);
  @removeme = split(/[,\s]+/, MailScanner::Config::Value('removeheaders', $this));
  foreach $remove (@removeme) {
    # Add a : if there isn't one already, it's needed for DeleteHeader()
    $remove .= ':' unless $remove =~ /:$/;
    $global::MS->{mta}->DeleteHeader($this, $remove);
  }

  # Add the secret archive recipients
  my($extra, @extras);
  foreach $extra (@{$this->{archiveplaces}}) {
    next if $extra =~ /^\//;
    next unless $extra =~ /@/;
    push @extras, $extra;
  }
  $global::MS->{mta}->AddRecipients($this, @extras) if @extras;

  # Write the new qf file, delete originals and unlock the message
  #print STDERR "Writing the new qf file\n";
  $store->WriteHeader($this, $OutQ);
  unless ($this->{gonefromdisk}) {
    $store->DeleteUnlock();
    $this->{gonefromdisk} = 1;
  }

  # Note this does not kick the MTA into life here any more
}


# Delete a message from the incoming queue
sub DeleteMessage {
  my $this = shift;

  #print STDERR "DeletingMessage " . $this->{id} . "\n";

  unless ($this->{gonefromdisk}) {
    $this->{store}->DeleteUnlock();
    $this->{gonefromdisk} = 1;
  }
  $this->{deleted} = 1;
}


## Is this message from a local domain?
#sub IsFromLocalDomain {
#  my $this = shift;
#
#  #print STDERR "Deleting cleaned message " . $this->{id} . "\n";
#  $this->{store}->Delete();
#  $this->{store}->Unlock();
#  $this->{deleted} = 1;
#}


# Work out if the message is infected with a "silent" virus such as Klez.
# Set the "silent" flag on all such messages.
# At the same time, find the "noisy" non-spoofing infections such as
# document macro viruses.
sub FindSilentAndNoisyInfections {
  my $this = shift;

  my(@silentin) = split(" ",MailScanner::Config::Value('silentviruses', $this));
  my($silent, $silentin, @silent, $regexp, $allreports, $logstring, $allsilent);

  my(@noisyin) = split(" ",MailScanner::Config::Value('noisyviruses', $this));
  my($noisy, $noisyin, @noisy, $nregexp);

  # Get out quickly if there's nothing to do
  return unless @silentin || @noisyin;

  # Turn each silent and noisy report into a regexp
  $allsilent = 0;
  foreach $silent (@silentin) {
    if (lc($silent) eq 'all-viruses') {
      $allsilent = 1;
      next;
    }
    $silentin = quotemeta $silent;
    push @silent, $silentin;
  }
  foreach $noisy (@noisyin) {
    next if lc($noisy) eq 'all-viruses';
    $noisyin = quotemeta $noisy;
    push @noisy, $noisyin;
  }
  # Make 2 big regexps from them all
  $regexp = '(' . join(')|(', @silent) . ')';
  $nregexp = '(' . join(')|(', @noisy) . ')';

  # Make 1 big string from all the reports
  $allreports = join('', values %{$this->{allreports}});

  #print STDERR "FindSilentInfection: Looking for \"$regexp\" in \"" .
  #             $allreports . "\"\n";
  #print STDERR "FindNoisyInfection: Looking for \"$nregexp\" in \"" .
  #             $allreports . "\"\n";

  #$this->{silent} = 1 if @silentin && $allreports =~ /$regexp/i;
  #$this->{noisy}  = 1 if @noisyin  && $allreports =~ /$nregexp/i;

  # Do this with grep so I can extract the matching line.
  $this->{silent} = 1 if @silentin && grep {$logstring .= "$_ " if /$regexp/i;}
                                           values %{$this->{allreports}};
  $this->{noisy}  = 1 if @noisyin && grep /$nregexp/i,
                                          values %{$this->{allreports}};

  return unless MailScanner::Config::Value('logsilentviruses', $this);

  $logstring = join(',', values %{$this->{allreports}})
    if !$logstring && $allsilent && $this->{silent} == 1;
  $logstring =~ s/[\n,]+(.)/,$1/g;
  MailScanner::Log::InfoLog("Viruses marked as silent: %s", $logstring)
    if $logstring;

  #print STDERR "FindSilentInfection: Found it!\n" if $this->{silent};
  #print STDERR "FindNoisyInfection: Found it!\n" if $this->{noisy};
}


# Deliver a cleaned message and remove it from the incoming queue
sub DeliverCleaned {
  my $this = shift;

  # The body of this message has been modified, so reconstruct
  # it from the MIME structure and deliver that.
  #print STDERR "Delivering cleaned up message " . $this->{id} . "\n";
  $this->DeliverModifiedBody('dirtyheader');
}


# Send a warning message to the person who sent this message.
# Need to create variables for from, to, subject, date and report
# for use within the message.
sub WarnSender {
  my $this = shift;

  my($from,$to,$subject,$date,$allreports,$alltypes,$report,$type);
  my($entityreports, @everyreport, $entitytypes, @everytype);
  my($emailmsg, $line, $messagefh, $msgname, $localpostmaster, $id);
  my($hostname);

  # Do we want to send the sender a warning at all?
  # If nosenderprecedence is set to non-blank and contains this
  # message precedence header, then just return.
  my(@preclist, $prec, $precedence, $header);
  @preclist = split(" ",
                  lc(MailScanner::Config::Value('nosenderprecedence', $this)));
  $precedence = "";
  foreach $header (@{$this->{headers}}) {
    $precedence = lc($1) if $header =~ /^precedence:\s+(\S+)/i;
  }
  if (@preclist && $precedence ne "") {
    foreach $prec (@preclist) {
      if ($precedence eq $prec) {
        MailScanner::Log::InfoLog("Skipping sender of precedence %s",
                                  $precedence);
        return;
      }
    }
  }

  # Now we know we want to send the message, it's not a bulk mail
  $from = $this->{from};

  # Don't ever send a message to "" or "<>"
  return if $from eq "" || $from eq "<>";

  # Setup other variables they can use in the message template
  $id = $this->{id};
  #$to = join(', ', @{$this->{to}});
  $localpostmaster = MailScanner::Config::Value('localpostmaster', $this);
  $hostname = MailScanner::Config::Value('hostname', $this);
  $subject = $this->{subject};
  $date = scalar localtime;

  my($to, %tolist);
  foreach $to (@{$this->{to}}) {
    $tolist{$to} = 1;
  }
  $to = join(', ', sort keys %tolist);

  $allreports    = $this->{allreports};
  $entityreports = $this->{entityreports};
  push @everyreport, values %$allreports;
  push @everyreport, values %$entityreports;
  my $reportword = MailScanner::Config::LanguageValue($this, "report");
  $report = join($reportword . ': ', @everyreport);
  
  $alltypes    = $this->{alltypes};
  $entitytypes = $this->{entitytypes};
  push @everytype, values %$alltypes;
  push @everytype, values %$entitytypes;
  $type  = join('', @everytype);

  # Do we want to hide the directory and message id from the report path?
  if (MailScanner::Config::Value('hideworkdir', $this)) {
    my $pattern = "(" . quotemeta($global::MS->{work}->{dir}) . "|\\\.)/";
    $report =~ s/$pattern//g; # m # Remove the work dir
    $report =~ s/\/?$id\/?//g; # Remove the message id
  }

  # Set the report filename dependent on what triggered MailScanner, be it
  # a virus, a filename trap, a Denial Of Service attack, or an parsing error.
  if ($type =~ /v/i) {
    $msgname = MailScanner::Config::Value('sendervirusreport', $this);
  } elsif ($type =~ /f/i) {
    $msgname = MailScanner::Config::Value('senderfilenamereport', $this);
  } elsif ($type =~ /e/i) {
    $msgname = MailScanner::Config::Value('sendererrorreport', $this);
  } elsif ($type =~ /c/i) {
    $msgname = MailScanner::Config::Value('sendercontentreport', $this);
  } else {
    $msgname = MailScanner::Config::Value('sendervirusreport', $this);
  }

  # Work out the list of all the infected attachments, including
  # reports applying to the whole message
  my($attach, $text, %infected, $filename);
  while (($attach, $text) = each %$allreports) {
    if ($attach eq "") {
      $infected{MailScanner::Config::LanguageValue($this, "theentiremessage")}
        = 1;
    } else {
      $infected{"$attach"} = 1;
    }
  }
  # And don't forget the external bodies which are just entity reports
  while (($attach, $text) = each %$entityreports) {
    $infected{MailScanner::Config::LanguageValue($this, 'notnamed')} = 1;
  }
  $filename = join(', ', keys %infected);

  $messagefh = new FileHandle;
  $messagefh->open($msgname)
    or MailScanner::Log::WarnLog("Cannot open message file %s, %s",
                                 $msgname, $!);
  $emailmsg = "";
  while(<$messagefh>) {
    chomp;
    s#"#\\"#g;
    s#@#\\@#g;
    # Boring untainting again...
    /(.*)/;
    $line = eval "\"$1\"";
    $emailmsg .= MailScanner::Config::DoPercentVars($line) . "\n";
  }
  $messagefh->close();

  # This did say $localpostmaster in the last parameter, but I changed
  # it to '<>' so that the sender warnings couldn't bounce.
  $global::MS->{mta}->SendMessageString($this, $emailmsg, '<>')
    or MailScanner::Log::WarnLog("Could not send sender warning, %s", $!);
}


# Create the headers for a postmaster notification message.
# This is expensive so don't do it much!
sub CreatePostmasterHeaders {
  my $this = shift;
  my($to)  = @_;

  my($result, $charset);

  # Make sure the Postmaster notice is in the right character set
  $charset = MailScanner::Config::Value('attachmentcharset',$this);

  $result = "From: \"" .
            MailScanner::Config::Value('noticesfrom', $this) . "\" <" .
            MailScanner::Config::Value('localpostmaster',$this) . ">\nTo: ";
  #$to = MailScanner::Config::Value('noticerecipient',$this);
  #$to =~ s/ +/, /g;
  $result .= $to . "\nSubject: " .
             MailScanner::Config::LanguageValue($this, 'noticesubject') . "\n";
  $result .= "Content-type: text/plain; charset=$charset\n" if $charset;

  return $result;
}


# Create the notification text for 1 email message.
sub CreatePostmasterNotice {
  my $this = shift;

  my(@everyrept);
  push @everyrept, values %{$this->{allreports}};
  push @everyrept, values %{$this->{entityreports}};

  foreach (@everyrept) {
      chomp;
      s/\n/\n            /g;
      $_ .= "\n";
  }

  my $reportword = MailScanner::Config::LanguageValue($this, "report");
  my $id   = $this->{id};
  my $from = $this->{from};
  #my $to   = join(', ', @{$this->{to}});
  my $subj = $this->{subject};
  my $rept = join("    $reportword: ", @everyrept);
  my $ip   = $this->{clientip};

  # Build unique list of recipients. Avoids Postfix problem which has
  # separate lists of real recipients and original recipients.
  my($to, %tolist);
  foreach $to (@{$this->{to}}) {
    $tolist{$to} = 1;
  }
  $to = join(', ', sort keys %tolist);

  my($result, $headers);

  if (MailScanner::Config::Value('hideworkdirinnotice',$this)) {
    my $pattern = '(' . quotemeta($global::MS->{work}->{dir}) . "|\\\.)/";
    #print STDERR "In replacement, regexp is \"$pattern\"\n";
    $rept =~ s/$pattern//g; #m # Remove the work dir
    $rept =~ s/\/?$id\/?//g; # Remove the message id
  }

  my $reportspaces = 10 - length($reportword);
  $reportword = ' ' x $reportspaces . $reportword if $reportspaces>0;
  $result = "\n" .
            "    Sender: $from\n" .
            "IP Address: $ip\n" .
            " Recipient: $to\n" .
            "   Subject: $subj\n" .
            " MessageID: $id\n" .
            "$reportword: $rept\n";

  if (MailScanner::Config::Value('noticefullheaders', $this)) {
    $headers = join("\n ", $global::MS->{mta}->OriginalMsgHeaders($this));
    $result .= MailScanner::Config::LanguageValue($this, 'fullheadersare') .
               ":\n\n $headers\n\n";
  }

  $result;
}


# Find the attachments that have been disinfected and deliver them all
# in a new MIME message.
sub DeliverDisinfectedAttachments {
  my $this = shift;

  my(@list, $reports, $attachment);

  $reports = $this->{oldviruses};

  # Loop through every attachment in the original list
  foreach $attachment (keys %$reports) {
    #print STDERR "Looking to see if \"$attachment\" has been disinfected\n";
    # Never attempt "whole body" disinfections
    next if $attachment eq "";
    # Skip messages that are in the new report list
    next if defined $this->{virusreports}{"$attachment"};
    # Don't disinfect files the disinfector renamed
    if (!$global::MS->{work}->FileExists($this, $attachment)) {
      #print STDERR "Skipping deleted/renamed attachment $attachment\n";
      next;
    }
    # Add it to the list
    #print STDERR "Adding $attachment to list of disinfected files\n";
    push @list, $attachment;
  }

  # Is there nothing to do?
  return unless @list;

  #print STDERR "Have disinfected attachments " . join(',',@list) . "\n";
  # Deliver a message to the original recipients containing the
  # disinfected attachments. This is really a Sendmail-specific thing.
  $global::MS->{work}->ChangeToMessage($this);
  $this->DeliverFiles(@list);
}


# Create and deliver a new message from MailScanner about the
# disinfected files passed in @list.
sub DeliverFiles {
  my $this = shift;
  my(@files) = @_;

  my($MaxSubjectLength, $from, $to, $subject, $newsubject, $top);
  my($localpostmaster);
  $MaxSubjectLength  = 25;
  $from = $this->{from};
  #$to   = join(', ', @{$this->{to}});
  my($to, %tolist);
  foreach $to (@{$this->{to}}) {
    $tolist{$to} = 1;
  }
  $to = join(', ', sort keys %tolist);

  $subject = $this->{subject};
  $localpostmaster = MailScanner::Config::Value('localpostmaster', $this);

  $newsubject = MailScanner::Config::LanguageValue($this, 'disinfected') .
                ": " . substr($subject, 0, $MaxSubjectLength);
  $newsubject .= '...' if length($subject)>$MaxSubjectLength;

  #print STDERR "About to deliver " . join(',',@files) . " to original " .
  #             "recipients after disinfection\n";

  # Create the top-level MIME entity, just the headers
  $top = MIME::Entity->build(Type       => 'multipart/mixed',
                             From       => "MailScanner <$localpostmaster>",
                             To         => $to,
                             Subject    => $newsubject,
                             'X-Mailer' => 'MailScanner',
                       MailScanner::Config::Value('mailheader', $this) =>
                       MailScanner::Config::Value('disinfectedheader', $this));

  # Construct the text of the message body
  my($textfh, $textfile, $output, $result, $attachment);
  $textfh = new FileHandle;
  $textfile = MailScanner::Config::Value('disinfectedreporttext', $this);
  $textfh->open($textfile)
    or MailScanner::Log::WarnLog("Cannot open disinfected report message " .
                                 "file %s, %s", $textfile, $!);
  $output = "";
  my $line;
  my $ea = qr/([\(\)\[\]\.\?\*\+\^"'@<>:])/;
  while(<$textfh>) {
    $line = chomp;
    #s#"#\\"#g; # Escape any " characters
    #s#@#\\@#g; # Escape any @ characters
    $line =~ s/$ea/\\$1/g; # Escape any regex characters
    # Untainting joy...
    $line =~ /(.*)/;
    $result = eval "\"$1\"";
    $output .= $result . "\n";
  }
  $textfh->close();
  $top->attach(Data => $output);

  # Construct all the attachments
  foreach $attachment (@files) {
    # Added "./" to start of next line to avoid potential DoS attack
    $top->attach(Path        => "./$attachment",
                 Type        => "application/octet-stream",
                 Encoding    => "base64",
                 Disposition => "attachment");
  }

  # Now send the message
  $global::MS->{mta}->SendMessageEntity($this, $top, $localpostmaster)
    or MailScanner::Log::WarnLog("Could not send disinfected message, %s",$!);
}


# Archive this message to any directories in its archiveplaces attribute
sub ArchiveToFilesystem {
  my $this = shift;

  my($dir, $todaydir, $target, $didanything);
  $didanything = 0;

  $todaydir = MailScanner::Quarantine::TodayDir();

  foreach $dir (@{$this->{archiveplaces}}) {
    #print STDERR "Archive to $dir\n";
    next unless $dir =~ /^\//; # Must be a pathname
    # If it exists, and it's a file, then append the message to it
    # in mbox format.
    if (-f $dir) {
      #print STDERR "It is a file\n";
      $this->AppendToMbox($dir);
      $didanything = 1;
      next;
    }
    $target = "$dir/$todaydir";
    unless (-d "$target") {
      umask $global::MS->{quar}->{dirumask};
      mkdir "$target",0777 or
        MailScanner::Log::WarnLog("Cannot create directory %s", $target);
      umask 0077;
    }
    #print STDERR "It is a dir\n";
    umask $global::MS->{quar}->{fileumask};
    $this->{store}->CopyToDir($target);
    umask 0077;
    $didanything = 1;
  }
  return $didanything;
}


# Append a message to an mbox file
sub AppendToMbox {
  my($this, $mbox) = @_;

  my $fh = new IO::File "$mbox", "a";
  if ($fh) {
    # Print the mbox message header starting with a blank line and "From"
    # From $from `date "+%a %b %d %T %Y"`
    my($now, $recip);
    $now = ctime();
    $now =~ s/  (\d)/ 0$1/g; # Insert leading zeros where needed

    print $fh "From " . $this->{from} . ' ' . $now . "\n";
    foreach $recip (@{$this->{to}}) {
      print $fh "X-MailScanner-Recipient: $recip\n";
    }
    $fh->flush;

    # Write the entire message to this handle, then close.
    $this->{store}->WriteEntireMessage($this, $fh);
    print $fh "\n"; # Blank line at end of message to separate messages
    $fh->close;
    MailScanner::Log::InfoLog("Archived message %s to mbox file %s",
                              $this->{id}, $mbox);
  } else {
    MailScanner::Log::WarnLog("Failed to append message to pre-existing " .
                              "mbox file %s", $mbox);
  }
}


sub ReflowHeader {
  my($this, $key, $input) = @_;
  my($output, $pos, $len, $firstline, @words, $word);
  $output = "";
  $pos = 0;
  $firstline = 1;

  @words = split(/,\s*/, $input);
  foreach $word (@words) {
    $len = length($word);
    if ($firstline) {
      $output = "$word";
      $pos = $len + length($key)+1; # 1 = space between key and input
      $firstline = 0;
      next;
    }

    # Wrap at column 75 (pretty arbitrary number just less than 80)
    if ($pos+$len < 75) {
      $output .= ", $word";
      $pos += 2 + $len;
    } else {
      $output .= ",\n\t$word";
      $pos = 8 + $len;
    }
  }

  return $output;
}


# Strip the HTML out of this message. All the checks have already
# been done, so just get on with it.
sub StripHTML {
  my $this = shift;

  #print STDERR "Stripping HTML from message " . $this->{id} . "\n";
  $this->HTMLToText($this->{entity});
}


# Disarm some of the HTML tags in this message.
my($DisarmFormTag, $DisarmScriptTag, $DisarmCodebaseTag, $DisarmIframeTag,
   $DisarmWebBug, $DisarmPhishing, $DisarmPhishingFound);
sub DisarmHTML {
  my $this = shift;

  #print STDERR "Tags to convert are " . $this->{tagstoconvert} . "\n";

  # Set the disarm booleans for this message
  $DisarmFormTag     = 1 if $this->{tagstoconvert} =~ /form/i;
  $DisarmScriptTag   = 1 if $this->{tagstoconvert} =~ /script/i;
  $DisarmCodebaseTag = 1 if $this->{tagstoconvert} =~ /codebase/i;
  $DisarmCodebaseTag = 1 if $this->{tagstoconvert} =~ /data/i;
  $DisarmIframeTag   = 1 if $this->{tagstoconvert} =~ /iframe/i;
  $DisarmWebBug      = 1 if $this->{tagstoconvert} =~ /webbug/i;
  if (MailScanner::Config::Value('findphishing', $this) =~ /1/) {
    $DisarmPhishing = 1;
    $DisarmPhishingFound = 0;
  }

  $this->DisarmHTMLTree($this->{entity});

  # And save the results from the phishing trip
  if ($DisarmPhishingFound) {
    # Do we want this or not? I say no. $this->{otherinfected} = 1;
    $this->{bodymodified}  = 1;
  }
}


# Search for a multipart/alternative.
# If found, change it to multipart/mixed and make all its members into
# suitable named attachments.
sub EncapsulateAttachments {
  my($message, $searchtype, $entity, $filename) = @_;

  # Reached a leaf node?
  return 0 unless $entity && defined($entity->head);

  my(@parts, $part, $type, $extension, $newname);
  my $counter = 0;

  $type = $entity->head->mime_attr('content-type');
  if (!$searchtype || ($type && $type =~ /$searchtype/i)) {
    #print STDERR "Found alternative message at entity $entity\n";

    # Turn it into a multipart/mixed
    $entity->head->mime_attr('content-type' => 'multipart/mixed')
      if $searchtype;

    # Change the parts into attachments
    @parts = $entity->parts;
    foreach $part (@parts) {
      my $head = $part->head;
      $type = $head->mime_attr('content-type') || 'text/plain';
      $extension = '.dat';
      $type =~ /\/([a-z0-9-]+)$/i and $extension = '.' . lc($1);
      $extension = '.txt'  if $type =~ /text\/plain/i;
      $extension = '.html' if $type =~ /text\/html/i;

      $newname = $filename . $extension;

      $head->mime_attr('Content-Type'                 => $type);
      $head->mime_attr('Content-Disposition'          => 'attachment');
      $head->mime_attr('Content-Disposition.filename' => $newname)
        unless $head->mime_attr('Content-Disposition.filename');
      $head->mime_attr('Content-Type.name'            => $newname)
        unless $head->mime_attr('Content-Type.name');
      
      $counter++;
    }
  } else {
    # Now try the same on all the parts
    foreach $part (@parts) {
      $counter += $message->EncapsulateAttachments($searchtype, $part,
                                                   $filename);
    }
  }

  return $counter;
}


sub EncapsulateMessageHTML {
  my $this = shift;

  my($entity, $filename, $newpart);

  $entity = $this->{entity};

  $filename = MailScanner::Config::Value('originalmessage', $this);

  $entity->make_multipart('mixed');
  $this->EncapsulateAttachments('multipart/alternative', $entity, $filename)
    or $this->EncapsulateAttachments(undef, $entity, $filename);

  # Insert the new message part
  $newpart = MIME::Entity->build(Type => "text/plain",
                                 Disposition => undef,
                                 Data => [ "Hello\n","There\n","Last line\n" ],
                                 Filename => undef,
                                 Top  => 0,
                                 'X-Mailer' => undef
                                );
  $entity->add_part($newpart, 0); # Insert at the start of the message

  # Clean up the message so spammers can't pollute me
  $this->{entity}->preamble(undef);
  $this->{entity}->epilogue(undef);
  $this->{entity}->head->add('MIME-Version', '1.0')
    unless $this->{entity}->head->get('mime-version');
  $this->{bodymodified} = 1;
  return;
}


# Encapsulate the message in an RFC822 structure so that it becomes a
# single atachment of the message. Need to build the spam report to put
# in as the text/plain body of the main message.
sub EncapsulateMessage {
  my $this = shift;

  my($entity, $rfc822, $mimeversion, $mimeboundary, @newparts);
  my($messagefh, $filename, $emailmsg, $line, $charset);
  my($id, $to, $from, $localpostmaster, $hostname, $subject, $date);
  my($fullspamreport, $briefspamreport, $longspamreport, $sascore);

  # For now, if there is no entity structure at all then just return,
  # we cannot encapsulate a message without it.
  # Unfortunately that means we can't encapsulate messages that are
  # Virus Scanning = no ("yes" but also having "Virus Scanners=none" is
  # fine, and works). The encapsulation will merely fail to do anything.
  # Hopefully this will only be used by corporates who are virus scanning
  # everything anyway.
  # Workaround: Instead of using "Virus Scanning = no", use
  # "Virus Scanners = none" and a set of filename rules that pass all files.
  $entity = $this->{entity} or return;

  # Construct the RFC822 attachment
  $mimeversion = $entity->head->get('mime-version');
  $rfc822 = $entity->stringify;

  # Setup variables they can use in the spam report that is inserted at
  # the top of the message.
  $id = $this->{id};
  #$to = join(', ', @{$this->{to}});
  my($to, %tolist);
  foreach $to (@{$this->{to}}) {
    $tolist{$to} = 1;
  }
  $to = join(', ', sort keys %tolist);

  $from = $this->{from};
  $localpostmaster = MailScanner::Config::Value('localpostmaster', $this);
  $hostname = MailScanner::Config::Value('hostname', $this);
  $subject = $this->{subject};
  $date = scalar localtime;
  $fullspamreport = $this->{spamreport};
  $longspamreport = $this->{salongreport};
  $sascore = $this->{sascore};
  #$this->{salongreport} = ""; # Reset it so we don't ever insert it twice

  # Delete everything in brackets after the SA report, if it exists
  $briefspamreport = $fullspamreport;
  $briefspamreport =~ s/(spamassassin)[^(]*\([^)]*\)/$1/i;
  $charset = MailScanner::Config::Value('attachmentcharset', $this);

  # Construct the spam report at the top of the message
  $messagefh = new FileHandle;
  $filename  = MailScanner::Config::Value('inlinespamwarning', $this);
  $messagefh->open($filename)
    or MailScanner::Log::WarnLog("Cannot open inline spam warning file %s, %s",
                                 $filename, $!);
  $emailmsg = "";
  while(<$messagefh>) {
    chomp;
    s#"#\\"#g;
    s#@#\\@#g;
    # Boring untainting again...
    /(.*)/;
    $line = eval "\"$1\"";
    $emailmsg .= $line . "\n";
  }
  $messagefh->close();


  $newparts[0] = MIME::Entity->build(Type     => 'text/plain',
                                     Disposition => 'inline',
                                     Encoding => 'quoted-printable',
                                     Top      => 0,
                                     'X-Mailer' => undef,
                                     Charset => $charset,
                                     Data     => $emailmsg);

  $newparts[1] = MIME::Entity->build(Type     => 'message/rfc822',
                                     Disposition => 'attachment',
                                     Top      => 0,
                                     'X-Mailer' => undef,
                                     Data     => $rfc822);

  # If there was a multipart boundary, then create a new one so that
  # the main message has a different boundary from the RFC822 attachment.
  # Leave the RFC822 one alone, so we don't corrupt the original message,
  # but make sure we create a new one instead.
  # Keep generating random boundaries until we have definitely got a new one.
  my $oldboundary = $entity->head->multipart_boundary;
  do {
    $mimeboundary = '======' . $$ . '==' . int(rand(100000)) . '======';
  } while $mimeboundary eq $oldboundary;

  # Put the new parts in place, hopefully it will correct all the multipart
  # headers for me. Wipe the preamble and epilogue or else someone will use
  # them to bypass the encapsulation process.
  # Make it a report if it wasn't multipart already.
  $entity->make_multipart("report"); # Used to be digest
  # Try *real* hard to make it a digest.
  $entity->head->mime_attr("Content-type" => "multipart/report"); # Used to be digest
  $entity->head->mime_attr("Content-type.boundary" => $mimeboundary);
  # Delete the "type" subfield which I don't think should be there
  $entity->head->mime_attr("Content-type.type" => undef);
  $entity->parts(\@newparts);
  $entity->preamble(undef);
  $entity->epilogue(undef);
  $entity->head->add('MIME-Version', '1.0') unless $mimeversion;
  $this->{bodymodified} = 1; # No infection but we changed the MIIME tree
}

sub DisarmHTMLTree {
  my($this, $entity) = @_;

  my $counter; # Have we modified this message at all?

  #print STDERR "Disarming HTML Tree\n";

  # Reached a leaf node?
  return 0 unless $entity && defined($entity->head);

  if ($entity->head->mime_attr('content-disposition') !~ /attachment/i &&
      $entity->head->mime_attr('content-type')        =~ /text\/html/i) {
    #print STDERR "Found text/html message at entity $entity\n";
    $this->DisarmHTMLEntity($entity);
    MailScanner::Log::InfoLog('Content Checks: Detected and will disarm ' .
                              'HTML message in %s', $this->{id});
    $this->{bodymodified} = 1; # No infection but we changed the MIIME tree
    #$this->{otherreports}{""} .= "Converted HTML to plain text\n";
    #$this->{othertypes}{""} .= "m"; # Modified body, but no infection
    #$this->{otherinfected}++;
    $counter++;
  }

  # Now try the same on all the parts
  my(@parts, $part);
  @parts = $entity->parts;
  foreach $part (@parts) {
    $counter += $this->DisarmHTMLTree($part);
  }

  return $counter;
}


# Walk the MIME tree, looking for text/html entities. Whenever we find
# one, create a new filename for a text/plain entity, and replace the
# part that pointed to the filename with a replacement that points to
# the new txt filename.
# Only replace inline sections, don't replace attachments, so that your
# users can still mail HTML attachments to each other.
# Then tag the message to say it has been modified, so that it is
# rebuilt from the MIME tree when it is delivered.
sub HTMLToText {
  my($this, $entity) = @_;

  my $counter; # Have we modified this message at all?

  # Reached a leaf node?
  return 0 unless $entity && defined($entity->head);

  if ($entity->head->mime_attr('content-disposition') !~ /attachment/i &&
      $entity->head->mime_attr('content-type')        =~ /text\/html/i) {
    #print STDERR "Found text/html message at entity $entity\n";
    $this->HTMLEntityToText($entity);
    MailScanner::Log::InfoLog('Content Checks: Detected and will convert ' .
                              'HTML message to plain text in %s',
                              $this->{id});
    $this->{bodymodified} = 1; # No infection but we changed the MIIME tree
    #$this->{otherreports}{""} .= "Converted HTML to plain text\n";
    #$this->{othertypes}{""} .= "m"; # Modified body, but no infection
    #$this->{otherinfected}++;
    $counter++;
  }

  # Now try the same on all the parts
  my(@parts, $part);
  @parts = $entity->parts;
  foreach $part (@parts) {
    $counter += $this->HTMLToText($part);
  }

  return $counter;
}

# Convert 1 MIME entity from html to dis-armed HTML using HTML::Parser.
sub DisarmHTMLEntity {
  my($this, $entity) = @_;

  my($oldname, $newname, $oldfh, $outfh, $htmlparser);

  #print STDERR "Disarming HTML entity\n";

  # Replace the filename with a new one
  $oldname = $entity->bodyhandle->path();
  $newname = $oldname;
  $newname =~ s/\..?html?$//i; # Remove .htm .html .shtml
  $newname .= '2.html'; # This should always pass the filename checks
  $entity->bodyhandle->path($newname);

  $outfh = new FileHandle;
  unless ($outfh->open(">$newname")) {
    MailScanner::Log::WarnLog('Could not create disarmed HTML file %s',
                              $newname);
    return;
  }

  # Set default output filehandle so we generate the new HTML
  $oldfh = select $outfh;

  # Process the old HTML file into the new one
  if ($DisarmPhishing) {
    HTML::Parser->new(api_version => 3,
      start_h     => [\&DisarmTagCallback,    "tagname, text, attr, attrseq"],
      end_h       => [\&DisarmEndtagCallback, "tagname, text"],
      text_h      => [\&DisarmTextCallback,   "text"],
      default_h   => [ sub { print @_; },     "text"],
                   )
      ->parse_file($oldname)
      or MailScanner::Log::WarnLog("HTML disarming, can't open file %s: %s",
                                   $oldname, $!);
  } else {
    HTML::Parser->new(api_version => 3,
      start_h     => [\&DisarmTagCallback,    "tagname, text, attr, attrseq"],
      end_h       => [\&DisarmEndtagCallback, "tagname, text"],
      default_h   => [ sub { print @_; },     "text"],
                   )
      ->parse_file($oldname)
      or MailScanner::Log::WarnLog("HTML disarming, can't open file %s: %s",
                                   $oldname, $!);
  }

  select $oldfh;
  $outfh->close();
}

# HTML::Parset callback function for normal text
my($DisarmLinkText, $DisarmLinkURL, $DisarmInsideLink);

# HTML::Parser callback for text so we can collect the contents of links
sub DisarmTextCallback {
  my($text) = @_;

  unless ($DisarmInsideLink) {
    print $text;
    return;
  }

  # We are inside a link.
  # Save the original text, we well might need it.
  $DisarmLinkText .= $text;
}

# HTML::Parser callback function for start tags
sub DisarmTagCallback {
  my($tagname, $text, $attr, $attrseq) = @_;

  #print STDERR "Disarming $tagname\n";

  my $output = "";

  if ($tagname eq 'form' && $DisarmFormTag) {
    #print "It's a form\n";
    $text = substr $text, 1;
    $output .= "<BR><MailScannerForm$$ " . $text;
  } elsif ($tagname eq 'input' && $DisarmFormTag) {
    #print "It's an input button\n";
    $attr->{'type'} = "reset";
    $output .= '<' . $tagname;
    foreach (@$attrseq) {
      next if /^on/;
      $output .= ' ' . $_ . '="' . $attr->{$_} . '"';
    }
    $output .= '>';
  } elsif ($tagname eq 'button' && $DisarmFormTag) {
    #print "It's a button\n";
    $attr->{'type'} = "reset";
    $output .= '<' . $tagname;
    foreach (@$attrseq) {
      next if /^on/;
      $output .= ' ' . $_ . '="' . $attr->{$_} . '"';
    }
    $output .= '>';
  } elsif ($tagname eq 'object' && $DisarmCodebaseTag) {
    #print "It's an object\n";
    if (exists $attr->{'codebase'}) {
      $text = substr $text, 1;
      $output .= "<MailScannerObject$$ " . $text;
    } elsif (exists $attr->{'data'}) {
      $text = substr $text, 1;
      $output .= "<MailScannerObject$$ " . $text;
    } else {
      $output .= $text;
    }
  } elsif ($tagname eq 'iframe' && $DisarmIframeTag) {
    #print "It's an iframe\n";
    $text = substr $text, 1;
    $output .= "<MailScannerIFrame$$ " . $text;
  } elsif ($tagname eq 'script' && $DisarmScriptTag) {
    #print "It's a script\n";
    $text = substr $text, 1;
    $output .= "<MailScannerScript$$ " . $text;
  } elsif ($tagname eq 'a' && $DisarmPhishing) {
    #print STDERR "It's a link\n";
    $output .= $text;
    $DisarmLinkText = '';
    $DisarmLinkURL = $attr->{'href'} if exists $attr->{'href'};
    $DisarmInsideLink = 1;
  } elsif ($tagname eq 'img' && $DisarmWebBug) {
    #print "It's an image\n";
    if (exists $attr->{'width'}  && $attr->{'width'}<=2 &&
        exists $attr->{'height'} && $attr->{'height'}<=2) {
      $output .= '<img src="MailScannerWebBug" width="' . $attr->{'width'} .
            '" height="' . $attr->{'height'} . '" alt="';
      $output .= 'Web Bug from ' . $attr->{'src'} if $attr->{'src'};
      $output .= '" />';
    } else {
      $output .= $text;
    }
  } else {
    #print STDERR "The tag was a \"$tagname\"\n";
    $output .= $text;
  }
  if ($DisarmInsideLink && ($tagname ne 'a' || !$DisarmPhishing)) {
    $DisarmLinkText .= $output;
  } else {
    print $output;
  }
}

# HTML::Parser callback function for end tags
sub DisarmEndtagCallback {
  my($tagname, $text) = @_;

  if ($tagname eq 'iframe' && $DisarmIframeTag) {
    print "</MailScannerIFrame$$>";
  } elsif ($tagname eq 'form' && $DisarmFormTag) {
    print "</MailScannerForm$$>";
  } elsif ($tagname eq 'script' && $DisarmScriptTag) {
    print "</MailScannerScript$$>";
  } elsif ($tagname eq 'a' && $DisarmPhishing) {
    my($squashedtext,$linkurl);
    $DisarmInsideLink = 0;
    $squashedtext = lc($DisarmLinkText);
    $squashedtext =~ s/\%a0//g;
    $squashedtext =~ s#%([0-9a-f][0-9a-f])#chr(hex('0x' . $1))#gei; # Unescape
    $squashedtext =~ s/\s+//g; # Remove any whitespace
    $squashedtext =~ s/\\/\//g;
    $squashedtext =~ s/(\<\/?[^>]*\>)*//ig; # Remove tags
    #$squashedtext =~ s/^(\<\/?(br|p|ul)\>)*//ig; # Remove leading br, p, ul tags
    #print STDERR "Text = \"$text\"\n";
    #print STDERR "1SquashedText = \"$squashedtext\"\n";
    #print STDERR "1LinkURL      = \"$DisarmLinkURL\"\n";
    # If it looks like a link, remove any leading https:// or ftp://
    if ($squashedtext =~ /^(w+|ft+p|fpt+)([.,]|\%2e)/i || 
        $squashedtext =~ /[.,](com|org|net|info|biz|ws)/i ||
        $squashedtext =~ /^(ht+ps?|ft+p|fpt+)[:;]\/\/(.*(\.|\%2e))/i) {
      $squashedtext =~  s/^(ht+ps?|ft+p|fpt+)[:;]\/\/(.*(\.|\%2e))/$2/i;
      $squashedtext =~ s/\/.*$//; # Only compare the hostnames
      $squashedtext =~ s/[,.]+$//; # Allow trailing dots and commas
      $linkurl = lc($DisarmLinkURL);
      $linkurl =~ s/\%a0//ig;
      $linkurl =~ s#%([0-9a-f][0-9a-f])#chr(hex('0x' . $1))#gei; # Unescape
      $linkurl =~ s/\s+//; # Remove any whitespace
      #$linkurl =~ s/(\<\/?[^>]*\>)*//ig; # Remove tags
      #$linkurl =~ s/^(\<\/?(br|p|ul)\>)*//ig; # Remove leading br, p, ul tags
      $linkurl =~ s/^(https?|ftp):\/\///i;
      $linkurl =~ s/\/.*$//; # Only compare up to the first '/' (hostname only)
      $linkurl =~ s/(\<\/?(br|p|ul)\>)*$//ig; # Remove trailing br, p, ul tags
      $linkurl =~ s/\/$//; # LinkURL is trimmed -- note
      #print STDERR "2SquashedText = \"$squashedtext\"\n";
      #print STDERR "2LinkURL      = \"$linkurl\"\n";
      if ($linkurl ne "" && $squashedtext !~ /^\Q$linkurl\E\/?$/) {
        print MailScanner::Config::LanguageValue(0, 'possiblefraudstart') .
              ' "' . $linkurl . '" ' .
              MailScanner::Config::LanguageValue(0, 'possiblefraudend') . ' ';
        $DisarmPhishingFound = 1;
        MailScanner::Log::InfoLog('Found phishing fraud from %s ' .
                                  'claiming to be %s',
                                  $linkurl, $squashedtext);
                                  #$DisarmLinkURL);
      }
    }
    print "$DisarmLinkText$text";
  } else {
    print $text;
  }
}



# Convert 1 MIME entity from html to text using HTML::Parser.
sub HTMLEntityToText {
  my($this, $entity) = @_;

  my($htmlname, $textname, $textfh, $htmlparser);

  # Replace the MIME Content-Type
  $entity->head->mime_attr('Content-type' => 'text/plain');

  # Replace the filename with a new one
  $htmlname = $entity->bodyhandle->path();
  $textname = $htmlname;
  $textname =~ s/\..?html?$//i; # Remove .htm .html .shtml
  $textname .= '.txt'; # This should always pass the filename checks
  $entity->bodyhandle->path($textname);

  # Create the new file with the plain text in it
  $textfh = new FileHandle;
  unless ($textfh->open(">$textname")) {
    MailScanner::Log::WarnLog('Could not create plain text file %s', $textname);
    return;
  }
  $htmlparser = HTML::TokeParser::MailScanner->new($htmlname);
  # Turn links into text containing the URL
  $htmlparser->{textify}{a} = 'href';
  $htmlparser->{textify}{img} = 'src';

  while (my $token = $htmlparser->get_token()) {
    next if $token->[0] eq 'C';
    my $text = $htmlparser->get_trimmed_text();
    print $textfh $text . "\n" if $text;
  }
  $textfh->close();
}

#
# This is an improvement to the default HTML-Parser routine for getting
# the text out of an HTML message. The only difference to their one is
# that I join the array of items together with spaces rather than "".
#
package HTML::TokeParser::MailScanner;

use HTML::Entities qw(decode_entities);

use vars qw(@ISA);
@ISA = qw(HTML::TokeParser);

sub get_text
{
    my $self = shift;
    my $endat = shift;
    my @text;
    while (my $token = $self->get_token) {
        my $type = $token->[0];
        if ($type eq "T") {
            my $text = $token->[1];
            decode_entities($text) unless $token->[2];
            push(@text, $text);
        } elsif ($type =~ /^[SE]$/) {
            my $tag = $token->[1];
            if ($type eq "S") {
                if (exists $self->{textify}{$tag}) {
                    my $alt = $self->{textify}{$tag};
                    my $text;
                    if (ref($alt)) {
                        $text = &$alt(@$token);
                    } else {
                        $text = $token->[2]{$alt || "alt"};
                        $text = "[\U$tag]" unless defined $text;
                    }
                    push(@text, $text);
                    next;
                }
            } else {
                $tag = "/$tag";
            }
            if (!defined($endat) || $endat eq $tag) {
                 $self->unget_token($token);
                 last;
            }
        }
    }
    # JKF join("", @text);
    join(" ", @text);
}

# And switch back to the original package we were in
package MailScanner::Message;

#
# This is an improvement to the default MIME character set decoding that
# is done on attachment filenames. It decodes all the character sets it
# knows about, just as before. But instead of warning about character sets
# it doesn't know about (and removing characters in them), it strips
# out all the 8-bit characters (rare) and leaves the 7-bit ones (common).
#
sub WordDecoderKeep7Bit {
    local $_ = shift;
    tr/\x00-\x7F/#/c;
    $_;
}

#
# Create a subclass of MIME::Parser:FileInto so that I can over-ride
# the "evil filename" code with a slightly better one that detects
# filenames made up solely of whitespace, which breaks the Perl open().
# I have also improved exorcise_filename to detect and remove any leading
# or trailing whitespace, which should make life a lot easier for the
# virus scanner output parsers.
#
# For the original version see .../MIME/Parser/Filer.pm

#package MIME::Parser::FileInto::MailScanner;
#
#use vars qw(@ISA);
#@ISA = qw(MIME::Parser::FileInto);
#
## A filename is evil unless it only contains any of the following:
##  \%\(\)\+\,\-\.0-9\=A-Z_a-z\x80-\xFF
## To get the correct pattern match string, do this:
## print '\x00-\x1F\x7F' . quotemeta(' !"Ł$&') . quotemeta("'") .
##       quotemeta('*/:/<>?@[\]^`{|}~') . "\n";
## print ' ' . quotemeta('%()+,-.') . '0-9' . quotemeta('=') .
##       'A-Z' . quotemeta('_') . 'a-z' . quotemeta('{}') . '\x80-\xFF' . "\n";
##
#sub evil_filename {
#    my ($self, $name) = @_;
#
#    #$self->debug("is this evil? '$name'");
#
#    #print STDERR "Testing \"$name\" to see if it is evil\n";
#    return 1 if (!defined($name) or ($name eq ''));   ### empty
#    return 1 if ($name =~ m{(^\s)|(\s+\Z)});  ### leading/trailing whitespace
#    return 1 if ($name =~ m{^\.+\Z});         ### dots
#    return 1 if ($name =~ tr{ \%\(\)\+\,\-\.0-9\=A-Z_a-z\{\}\x80-\xFF}{}c);
#    return 1 if ($self->{MPF_MaxName} and
#                 (length($name) > $self->{MPF_MaxName}));
#
#    #print STDERR "It is okay\n";
#    #$self->debug("it's ok");
#    0;
#}
#
#sub exorcise_filename {
#    my ($self, $fname) = @_;
#
#    ### Isolate to last path element:
#    my $last = $fname; $last =~ s{^.*[/\\\[\]:]}{};
#    if ($last and !$self->evil_filename($last)) {
#        #$self->debug("looks like I can use the last path element");
#        return $last;
#    }
#
#    # Try removing leading whitespace, trailing whitespace and all
#    # dangerous characters to start with.
#    $last =~ s/^\s+//;
#    $last =~ s/\s+\Z//;
#    $last =~ tr/ \%\(\)\+\,\-\.0-9\=A-Z_a-z\{\}\x80-\xFF//cd;
#    return $last unless $self->evil_filename($last);
#
#    ### Break last element into root and extension, and truncate:
#    my ($root, $ext) = (($last =~ /^(.*)\.([^\.]+)\Z/)
#                        ? ($1, $2)
#                        : ($last, ''));
#    # JKF Delete leading and trailing whitespace
#    $root =~ s/^\s+//;
#    $ext  =~ s/\s+$//;
#    $root = substr($root, 0, ($self->{MPF_TrimRoot} || 14));
#    $ext  = substr($ext,  0, ($self->{MPF_TrimExt}  ||  3));
#    $ext =~ /^\w+$/ or $ext = "dat";
#    my $trunc = $root . ($ext ? ".$ext" : '');
#    if (!$self->evil_filename($trunc)) {
#        #$self->debug("looks like I can use the truncated last path element");
#        return $trunc;
#    }
#
#    ### Hope that works:
#    undef;
#}


#
# Over-ride a function in MIME::Entity that gets called every time a MIME
# part is added to a message. The new version bails out if there were too
# many parts in the message. The limit will be read from the config.
# It just sets the entity to undef and relies on the supporting code to
# actually generate the error.
#

package MIME::Entity;

use vars qw(@ISA $EntityPartCounter $EntityPartCounterMax);
@ISA = qw(Mail::Internet);

# Reset the counter and the limit
sub ResetMailScannerCounter {
    my($number) = @_;
    $EntityPartCounter = 0;
    $EntityPartCounterMax = $number;
} 

# Read the Counter
sub MailScannerCounter {
    return $EntityPartCounter || 0;
}


# Over-rise their add_part function with my own with counting added
sub add_part {
    my ($self, $part, $index) = @_;
    defined($index) or $index = -1;

    # Incrememt the part counter so I can detect messages with too many parts
    $EntityPartCounter++;
    #print STDERR "Added a part. Counter = $EntityPartCounter, Max = " .
    #             $EntityPartCounterMax\n";
    return undef
      if $EntityPartCounterMax>0 && $EntityPartCounter > $EntityPartCounterMax;

    ### Make $index count from the end if negative:
    $index = $#{$self->{ME_Parts}} + 2 + $index if ($index < 0);
    splice(@{$self->{ME_Parts}}, $index, 0, $part);
    $part;
}


#
# Over-ride a function in Mail::Header that parses the block of headers
# at the top of each MIME section. My improvement allows the first line
# of the header block to be missing, which breaks the original parser
# though the filename is still there.
#

package Mail::Header;

sub extract
{
 my $me = shift;
 my $arr = shift;
 my $line;

 $me->empty;

 # JKF Make this more robust by allowing first line of header to be missing
 shift @{$arr} while scalar(@{$arr}) &&
                     $arr->[0] =~ /\A[ \t]+/o &&
                     $arr->[1] =~ /\A$FIELD_NAME/o;
 # JKF End mod here

 while(scalar(@{$arr}) && $arr->[0] =~ /\A($FIELD_NAME|From )/o)
  {
   my $tag = $1;

   $line = shift @{$arr};
   $line .= shift @{$arr}
       while(scalar(@{$arr}) && $arr->[0] =~ /\A[ \t]+/o);

   ($tag,$line) = _fmt_line($me,$tag,$line);

   _insert($me,$tag,$line,-1)
      if defined $line;
  }

 shift @{$arr}
  if(scalar(@{$arr}) && $arr->[0] =~ /\A\s*\Z/o);

 $me;
}

##
## Over-ride the MIME boundary extracting code so that we fail to parse
## messages with an empty MIME boundary. Best I can do for now.
##
#
#package MIME::Parser::Reader;
#
#sub add_boundary {
#    my ($self, $bound) = @_;
#    unshift @{$self->{Bounds}}, $bound;   ### now at index 0
#    # JKF Fix problem with the Britney virus
#    $bound = "" if $bound eq '""';
#    # JKF End
#    $self->{BH}{"--$bound"}   = "DELIM $bound";
#    $self->{BH}{"--$bound--"} = "CLOSE $bound";
#    $self;
#}

#
# Over-ride the hunt-for-uuencoded file code as it now needs to hunt for
# binhex-encoded text as well.
#

#package MIME::Parser;
#
##------------------------------
##
## hunt_for_uuencode ENCODED, ENTITY
##
## I<Instance method.>
## Try to detect and dispatch embedded uuencode as a fake multipart message.
## Returns new entity or undef.
##
#sub hunt_for_uuencode {
#    my ($self, $ENCODED, $ent) = @_;
#    my ($good, $jkfis);
#    local $_;
#    $self->debug("sniffing around for UUENCODE");
#
#    ### Heuristic:
#    $ENCODED->seek(0,0);
#    while (defined($_ = $ENCODED->getline)) {
#        if ($good = /^begin [0-7]{3}/) {
#          $jkfis = 'uu';
#          last;
#        }
#        if ($good = /^\(This file must be converted with/i) {
#          $jkfis = 'binhex';
#          last;
#        }
#    }
#    $good or do { $self->debug("no one made the cut"); return 0 };
#
#    ### New entity:
#    my $top_ent = $ent->dup;      ### no data yet
#    $top_ent->make_multipart;
#    my @parts;
#
#    ### Made the first cut; on to the real stuff:
#    $ENCODED->seek(0,0);
#    my $decoder = MIME::Decoder->new(($jkfis eq 'uu')?'x-uuencode'
#                                                     :'binhex');
#    $self->whine("Found a $jkfis attachment");
#    my $pre;
#    while (1) {
#        my @bin_data;
#
#        ### Try next part:
#        my $out = IO::ScalarArray->new(\@bin_data);
#        eval { $decoder->decode($ENCODED, $out) }; last if $@;
#        my $preamble = $decoder->last_preamble;
#        my $filename = $decoder->last_filename;
#        my $mode     = $decoder->last_mode;
#
#        ### Get probable type:
#        my $type = 'application/octet-stream';
#        my ($ext) = $filename =~ /\.(\w+)\Z/; $ext = lc($ext || '');
#        if ($ext =~ /^(gif|jpe?g|xbm|xpm|png)\Z/) { $type = "image/$1" }
#
#        ### If we got our first preamble, create the text portion:
#        if (@$preamble and
#            (grep /\S/, @$preamble) and
#            !@parts) {
#            my $txt_ent = $self->interface('ENTITY_CLASS')->new;
#
#            MIME::Entity->build(Type => "text/plain",
#                                Data => "");
#            $txt_ent->bodyhandle($self->new_body_for($txt_ent->head));
#            my $io = $txt_ent->bodyhandle->open("w");
#            $io->print(@$preamble);
#            $io->close;
#            push @parts, $txt_ent;
#        }
#
#        ### Create the attachment:
#        ### We use the x-unix-mode convention from "dtmail 1.2.1 SunOS 5.6".
#        if (1) {
#            my $bin_ent = MIME::Entity->build(Type=>$type,
#                                              Filename=>$filename,
#                                              Data=>"");
#            $bin_ent->head->mime_attr('Content-type.x-unix-mode' => "0$mode");
#            $bin_ent->bodyhandle($self->new_body_for($bin_ent->head));
#            $bin_ent->bodyhandle->binmode(1);
#            my $io = $bin_ent->bodyhandle->open("w");
#            $io->print(@bin_data);
#            $io->close;
#            push @parts, $bin_ent;
#        }
#    }
#
#    ### Did we get anything?
#    @parts or return undef;
#
#    ### Set the parts and a nice preamble:
#    $top_ent->parts(\@parts);
#    $top_ent->preamble
#        (["The following is a multipart MIME message which was extracted\n",
#          "from a $jkfis-encoded message.\n"]);
#    $top_ent;
#}

#
# Overload the MIME quoted-printable decoder.
# This version will make lines that end in \n now end in \r\n.
# This hopefully fixes problems with PDF files as they are now extracted
# correctly.
#
#package MIME::QuotedPrint;
#
#sub decode_qp ($)
#{
#    my $res = shift;
#    $res =~ s/[ \t]+?(\r?\n)/$1/g;  # rule #3 (trailing space must be deleted)
#    $res =~ s/=\r?\n//g;            # rule #5 (soft line breaks)
#    $res =~ s/([^\r])\n\Z/$1\r\n/;  # JKF rule to replace trailing \n with \r\n
#    $res =~ s/=([\da-fA-F]{2})/pack("C", hex($1))/ge;
#    $res;
#}


1;


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From mailscanner at ecs.soton.ac.uk  Sat Nov 13 22:33:47 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:35 2006
Subject: FW: Another phishing improvement patch
Message-ID: <mailman.4664.1137101255.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Interesting Thunderbird bug!
I'll cross-post this to the list so everyone gets to see it.

Steve Swaney wrote:

>Julian,
>
>When I tried to install I notice that it has:
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>Tacked on to the end. Very poor perl and not really up to your standards ;>)
>
>I trimmed the excess and it worked just fine.
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jaearick at COLBY.EDU  Sun Nov 14 13:16:26 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:35 2006
Subject: Another phishing improvement patch
Message-ID: <mailman.4665.1137101255.24926.mailscanner@lists.mailscanner.info>

Thanks, now in place.  To others who grab this and drop it into place,
beware of the errant mailscanner list signature at the bottom of the
file.  I wondered why I got bareword perl errors when I turned MailScanner
back on.  Remove the signature first!

Jeff Earickson
Colby College

On Sat, 13 Nov 2004, Julian Field wrote:

> Date: Sat, 13 Nov 2004 21:41:41 +0000
> From: Julian Field <mailscanner@ECS.SOTON.AC.UK>
> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Another phishing improvement patch
>
> Sure. Zipped copy attached.
> 2nd attempt, this time not zipped. The JISCmail service objected to a
> file called Message.zip, not quite sure why.
>
> Jeff A. Earickson wrote:
>
>> Julian,
>>    Can you post the complete latest 4.35.11 Message.pm?  The patch
>> failed against the original 4.35.11 file, and I've already patched
>> this file a couple of times.  I could use a fresh copy...
>>
>> Jeff Earickson
>> Colby College
>>
>> On Sat, 13 Nov 2004, Julian Field wrote:
>> Date: Sat, 13 Nov 2004 16:56:33 +0000
>>
>>> From: Julian Field <mailscanner@ECS.SOTON.AC.UK>
>>> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>> To: MAILSCANNER@JISCMAIL.AC.UK
>>> Subject: Another phishing improvement patch
>>>
>>> Another addition to the phishing net. This patch is designed to be
>>> applied to the Message.pm file as distributed with 4.35.11.
>>>
>>> This should help improve the detection rate.
>>
> --
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From m.althoff at BROMBERG.XS4ALL.NL  Sun Nov 14 14:37:54 2004
From: m.althoff at BROMBERG.XS4ALL.NL (Matthijs Althoff)
Date: Thu Jan 12 21:27:35 2006
Subject: all local rules not loaded
Message-ID: <mailman.4666.1137101255.24926.mailscanner@lists.mailscanner.info>

Hello,

Switched today to latest MailScanner and upgraded Spamassassin from 2.64 to
3.01 I have noticed the file /etc/mail/spamassassin/local.cf is still there
but a new file init.pre has been written is this the new file also to put
in some of my rules. Problem is the custom spam rules are ignored

# The site-local rules are searched for here, and in
prefix/etc/spamassassin,
#
prefix/etc/mail/spamassassin, /usr/local/etc/spamassassin, /etc/spamassassin
,
# /etc/mail/spamassassin, and maybe others.
# If this is set then it adds to the list of places that are searched;
# otherwise it has no effect.
#SpamAssassin Local Rules Dir = /etc/MailScanner/mail/spamassassin
SpamAssassin Local Rules Dir =

# The default rules are searched for here, and in prefix/share/spamassassin,
# /usr/local/share/spamassassin, /usr/share/spamassassin, and maybe others.
# If this is set then it adds to the list of places that are searched;
# otherwise it has no effect.
#SpamAssassin Default Rules Dir = /opt/MailScanner/share/spamassassin
SpamAssassin Default Rules Dir =

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From rcooper at DWFORD.COM  Sun Nov 14 16:42:35 2004
From: rcooper at DWFORD.COM (Rick Cooper)
Date: Thu Jan 12 21:27:35 2006
Subject: Another phishing improvement patch
Message-ID: <mailman.4667.1137101255.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> Behalf Of Julian Field
> Sent: Saturday, November 13, 2004 4:42 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Another phishing improvement patch
>
>
> Sure. Zipped copy attached.
> 2nd attempt, this time not zipped. The JISCmail service objected to a
> file called Message.zip, not quite sure why.
>
<snip>

Lovegate, MyDoom, Netsky, Bagle all use message.zip at one time or another.
I would imagine that is why it got dumped.

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mark at TIPPINGMAR.COM  Sun Nov 14 18:30:03 2004
From: mark at TIPPINGMAR.COM (Mark Nienberg)
Date: Thu Jan 12 21:27:35 2006
Subject: install-ClamAV-SA
Message-ID: <mailman.4668.1137101255.24926.mailscanner@lists.mailscanner.info>

On Saturday, November 13, 2004, at 12:57  PM, Julian Field wrote:

> Mark Nienberg wrote:
>
>> On Saturday, November 13, 2004, at 12:21  PM, Julian Field wrote:
>>
>>> You may find you have more luck running the ./INSTALL-tar.sh instead
>>> of
>>> the rpm one. This is equivalent to downloading and installing each of
>>> the modules using CPAN. But much easier :)
>>>
>>> I have had problems with the INSTALL-rpm.sh version with some
>>> versions
>>> of Perl, and so I often use the INSTALL-tar.sh instead.
>>>
>> What does the tar script to when it encounters modules that are
>> already
>> installed via rpm?
>
> It should just skip them.
>
>>   Should I uninstall the ones that were already
>> installed by the rpm script?
>
> Not essential by any means, but it probably wouldn't be a bad idea.
> Then
> they are all installed the same way, which is a good thing.
>

The INSTALL-tar.sh worked just fine.  It couldn't install Test-Harness,
but the rest worked and SA3.01 is now running.  I'm convinced again (I
was convinced before but had forgotten) that it isn't worth the
headaches to try to maintain a Perl installation with rpm based
packages.  Personally, it would be fine with me if you give up and
distribute all MailScanner related stuff in the tar format with an
install script to do the make and install.  Although my Perl
installation has a mix of rpms and not, this would be easily remedied
by using "rpm -e --justdb" to remove the rpm database entries while
leaving the files in place.

Thanks again for your help.
Mark Nienberg

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From alex at SKYNET-SRL.COM  Sun Nov 14 21:25:56 2004
From: alex at SKYNET-SRL.COM (Alessandro Bianchi)
Date: Thu Jan 12 21:27:35 2006
Subject: bitdefender update test
Message-ID: <mailman.4669.1137101255.24926.mailscanner@lists.mailscanner.info>

Hywel

Thank you for your feedback

line 126 must be commented (or deleted)

It should work

Best regards

Alessandro

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From alex at SKYNET-SRL.COM  Sun Nov 14 21:33:58 2004
From: alex at SKYNET-SRL.COM (Alessandro Bianchi)
Date: Thu Jan 12 21:27:35 2006
Subject: OT: Bitdefender issues
Message-ID: <mailman.4670.1137101255.24926.mailscanner@lists.mailscanner.info>

> The problem is to do with a kernel security feature called exec-shield
> to
> solve the above problem you need to turn it off with the following
> command
>
> echo 0 > /proc/sys/kernel/exec-shield
>
> There is some more background info at
> http://people.redhat.com/mingo/exec-shield/ANNOUNCE-exec-shield
>
> Here come my questions :)
> Has anybody else had this problem with bitdefender & FC2? (I think it
> happened after upgrading to kernel-2.6.8-1.521)

Hywel

Same problem here and after playing with the bitdefender support team
they emailed tha " a fix will be available soon".

It was two months ago...

They also confirm the problem is about the kernel...

I don't think to have to low my defences for a buggy piece of software,
so I stopped using bitdefender until they will fix it , but I wonder if
it will ever happen.

In the while it seems they are releasing version 8 but I cant' see the
free version

Take your own conclusions...

Best regards

Alessandro

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Mon Nov 15 02:30:17 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:35 2006
Subject: SAVI-Perl 0.20 released
Message-ID: <mailman.4671.1137101255.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

For users of the "sophossavi" virus scanner setting, a new version 0.20
of the SAVI-Perl module has been released. You can get it from
http://www.csupomona.edu/~henson/www/projects/SAVI-Perl/dist/

I have just installed this module in the same way as I have installed
its predecessors, and it appears to work fine with MailScanner 4.35.11.
I haven't tried earlier versions, but the MailScanner SAVI code hasn't
changed for a very long time. Please report any problems you see.

Unpack the .tar.gz file
cd SAVI-Perl-0.20
Edit Makefile.PL
Change /opt/local/lib to /usr/local/Sophos/lib in both places
perl Makefile.PL
make
make test
make install

Then restart MailScanner.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Q.G.Campbell at NEWCASTLE.AC.UK  Mon Nov 15 07:47:02 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:35 2006
Subject: Never getting URIBL_PH_SURBL hits
Message-ID: <mailman.4672.1137101255.24926.mailscanner@lists.mailscanner.info>

>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>Sent: 12 November 2004 14:11
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Never getting URIBL_PH_SURBL hits
>
>I've only got 1 non-Solaris MX and that doesn't handle huge 
>amounts of mail.
>But no URIBL_PH_SURBL on there either.
>
>Maybe it is just a geographic thing. Sure glad I wrote my 
>"phishing net"
>code though!
>
[snip]

This is another UK.AC site but we have seen 130 URIBL_PH_SURBL hits in
the last 3.5 hours this morning.

These were all logged on the seven RH AS 3 mail gateways we operate.
They together handle about 1,000,000 messages/day for individual users. 

It is worth pointing out as a comparison that on two other identically
configured RH AS 3 mail gateways we operate to filter e-mail for another
university plus three small colleges (all in AC.UK), I have seen just 4
URIBL_PH_SURBL hits in the same period. The volume of mail handled in
these cases is significantly less than the figure given above.

Rather than being "geographical", it seems that the incidence of
phishing spam is related to the domain(s) you host and the volume of
mail you receive.   

Quentin 
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own." 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Mon Nov 15 09:24:33 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:35 2006
Subject: SAVI-Perl 0.20 released
Message-ID: <mailman.4673.1137101255.24926.mailscanner@lists.mailscanner.info>

Julian

a small reminder - don't forget to sleep....emailing at 2.30am on a
Monday....to much coffee young man :-)


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Julian Field wrote:
> For users of the "sophossavi" virus scanner setting, a new version 0.20
> of the SAVI-Perl module has been released. You can get it from
> http://www.csupomona.edu/~henson/www/projects/SAVI-Perl/dist/
>
> I have just installed this module in the same way as I have installed
> its predecessors, and it appears to work fine with MailScanner 4.35.11.
> I haven't tried earlier versions, but the MailScanner SAVI code hasn't
> changed for a very long time. Please report any problems you see.
>
> Unpack the .tar.gz file
> cd SAVI-Perl-0.20
> Edit Makefile.PL
> Change /opt/local/lib to /usr/local/Sophos/lib in both places
> perl Makefile.PL
> make
> make test
> make install
>
> Then restart MailScanner.
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at BARENDSE.TO  Mon Nov 15 09:45:29 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:35 2006
Subject: install-Clam-spamass
Message-ID: <mailman.4674.1137101255.24926.mailscanner@lists.mailscanner.info>

Hi

I just wanted to upgrade a box to the latest spamass. but SA didn't
upgrade.

Oh good, module Mail::SpamAssassin version 3.0.1 is already installed.

[root@linuxgw install-Clam-SA]# spamassassin --version
SpamAssassin version 3.0.0
   running on Perl version


Weird huh?

Mail-ClamAV-0.13.tar.gz
Text-Balanced-1.95.tar.gz

didn't upgrade either, the other modules upgraded ok. Even when re-running
the script these modules fail to upgrade?

(Mail-Clam av is probably due to the fact that I did not upgrade Clam yet,
I need to keep the .7x release because another program depends on it)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Mon Nov 15 10:04:51 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:35 2006
Subject: Another phishing improvement patch
Message-ID: <mailman.4675.1137101255.24926.mailscanner@lists.mailscanner.info>

Installed and runs (once removed cruft from end of file :-)

Will see how it gets on with all these FP's from HTML email we get..

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Julian Field wrote:
> Sure. Zipped copy attached.
> 2nd attempt, this time not zipped. The JISCmail service objected to a
> file called Message.zip, not quite sure why.
>
> Jeff A. Earickson wrote:
>
>> Julian,
>>    Can you post the complete latest 4.35.11 Message.pm?  The patch
>> failed against the original 4.35.11 file, and I've already patched
>> this file a couple of times.  I could use a fresh copy...
>>
>> Jeff Earickson
>> Colby College
>>
>> On Sat, 13 Nov 2004, Julian Field wrote:
>> Date: Sat, 13 Nov 2004 16:56:33 +0000
>>
>>> From: Julian Field <mailscanner@ECS.SOTON.AC.UK>
>>> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>> To: MAILSCANNER@JISCMAIL.AC.UK
>>> Subject: Another phishing improvement patch
>>>
>>> Another addition to the phishing net. This patch is designed to be
>>> applied to the Message.pm file as distributed with 4.35.11.
>>>
>>> This should help improve the detection rate.

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Q.G.Campbell at NEWCASTLE.AC.UK  Mon Nov 15 10:24:05 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:35 2006
Subject: RE. my earlier message - please ignore it
Message-ID: <mailman.4676.1137101255.24926.mailscanner@lists.mailscanner.info>

Julian

Please ignore my previous message.

Thanks

Quentin 
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own." 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Mon Nov 15 10:32:30 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:35 2006
Subject: install-Clam-spamass
Message-ID: <mailman.4677.1137101255.24926.mailscanner@lists.mailscanner.info>

"rpm -e spamassassin spamassassin-tools" first?

On 15/11/04 9:45 am, "Remco Barendse" <mailscanner@BARENDSE.TO> wrote:
> Hi
>
> I just wanted to upgrade a box to the latest spamass. but SA didn't
> upgrade.
>
> Oh good, module Mail::SpamAssassin version 3.0.1 is already installed.
>
> [root@linuxgw install-Clam-SA]# spamassassin --version
> SpamAssassin version 3.0.0
>    running on Perl version
>
>
> Weird huh?
>
> Mail-ClamAV-0.13.tar.gz
> Text-Balanced-1.95.tar.gz
>
> didn't upgrade either, the other modules upgraded ok. Even when re-running
> the script these modules fail to upgrade?
>
> (Mail-Clam av is probably due to the fact that I did not upgrade Clam yet,
> I need to keep the .7x release because another program depends on it)

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at BARENDSE.TO  Mon Nov 15 10:59:11 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:35 2006
Subject: {Spam?} Re: install-Clam-spamass
Message-ID: <mailman.4678.1137101255.24926.mailscanner@lists.mailscanner.info>

On Mon, 15 Nov 2004, Julian Field wrote:

> "rpm -e spamassassin spamassassin-tools" first?

I already checked that, they were not installed as an RPM version.



>
> On 15/11/04 9:45 am, "Remco Barendse" <mailscanner@BARENDSE.TO> wrote:
>> Hi
>>
>> I just wanted to upgrade a box to the latest spamass. but SA didn't
>> upgrade.
>>
>> Oh good, module Mail::SpamAssassin version 3.0.1 is already installed.
>>
>> [root@linuxgw install-Clam-SA]# spamassassin --version
>> SpamAssassin version 3.0.0
>>    running on Perl version
>>
>>
>> Weird huh?
>>
>> Mail-ClamAV-0.13.tar.gz
>> Text-Balanced-1.95.tar.gz
>>
>> didn't upgrade either, the other modules upgraded ok. Even when re-running
>> the script these modules fail to upgrade?
>>
>> (Mail-Clam av is probably due to the fact that I did not upgrade Clam yet,
>> I need to keep the .7x release because another program depends on it)
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ccampbell at BRUEGGERS.COM  Mon Nov 15 13:32:01 2004
From: ccampbell at BRUEGGERS.COM (Christian Campbell)
Date: Thu Jan 12 21:27:35 2006
Subject: Another phishing improvement patch
Message-ID: <mailman.4679.1137101255.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Does Message.pm.phishing.patch need to be installed before
Message.pm.phishing2.patch ?

When trying to patch with Message.pm.phishing2.patch I get:

# patch < /tmp/Message.pm.phishing2.patch
(Stripping trailing CRs from patch.)
patching file Message.pm
Hunk #1 FAILED at 4043.
1 out of 1 hunk FAILED -- saving rejects to file Message.pm.rej

I'm running MS 4.35.11.

Thanks,

Christian

Christian Campbell
Systems Engineer, Sair LCP, A+, N+, i-Net+
Bruegger's Enterprises
Desk: 802-652-9270
Cell: 802-734-5023
Fax: 802-660-4034
Email: ccampbell at brueggers dot com

PGP Public Key available via PGP keyservers
or http://www2.brueggers.com/pgp/ccampbell.html

"We all know Linux is great...
It does infinite loops in 5 seconds."
          -Linus Torvalds


> -----Original Message-----
> From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK]
> Sent: Saturday, November 13, 2004 11:57 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Another phishing improvement patch
>
>
> Another addition to the phishing net. This patch is designed to be
> applied to the Message.pm file as distributed with 4.35.11.
>
> This should help improve the detection rate.
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jaearick at COLBY.EDU  Mon Nov 15 14:04:57 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:35 2006
Subject: Never getting URIBL_PH_SURBL hits
Message-ID: <mailman.4680.1137101255.24926.mailscanner@lists.mailscanner.info>

Hmmm, I've noticed that we have started getting hits against
URIBL_PH_SURBL in the last few days with our Solaris 9 setup.
Haven't changed much, except for the new anti-phishing version
of Message.pm.  I saw the hits before this change.

Jeff Earickson
Colby College

On Mon, 15 Nov 2004, Quentin Campbell wrote:

> Date: Mon, 15 Nov 2004 07:47:02 -0000
> From: Quentin Campbell <Q.G.Campbell@NEWCASTLE.AC.UK>
> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Never getting URIBL_PH_SURBL hits
>
>> -----Original Message-----
>> From: MailScanner mailing list
>> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>> Sent: 12 November 2004 14:11
>> To: MAILSCANNER@JISCMAIL.AC.UK
>> Subject: Re: Never getting URIBL_PH_SURBL hits
>>
>> I've only got 1 non-Solaris MX and that doesn't handle huge
>> amounts of mail.
>> But no URIBL_PH_SURBL on there either.
>>
>> Maybe it is just a geographic thing. Sure glad I wrote my
>> "phishing net"
>> code though!
>>
> [snip]
>
> This is another UK.AC site but we have seen 130 URIBL_PH_SURBL hits in
> the last 3.5 hours this morning.
>
> These were all logged on the seven RH AS 3 mail gateways we operate.
> They together handle about 1,000,000 messages/day for individual users.
>
> It is worth pointing out as a comparison that on two other identically
> configured RH AS 3 mail gateways we operate to filter e-mail for another
> university plus three small colleges (all in AC.UK), I have seen just 4
> URIBL_PH_SURBL hits in the same period. The volume of mail handled in
> these cases is significantly less than the figure given above.
>
> Rather than being "geographical", it seems that the incidence of
> phishing spam is related to the domain(s) you host and the volume of
> mail you receive.
>
> Quentin
> ---
> PHONE: +44 191 222 8209    Information Systems and Services (ISS),
>                           University of Newcastle,
>                           Newcastle upon Tyne,
> FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
> ------------------------------------------------------------------------
> "Any opinion expressed above is mine. The University can get its own."
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From raymond at PROLOCATION.NET  Mon Nov 15 14:06:57 2004
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:27:35 2006
Subject: Never getting URIBL_PH_SURBL hits
Message-ID: <mailman.4681.1137101255.24926.mailscanner@lists.mailscanner.info>

Hi!

> Hmmm, I've noticed that we have started getting hits against
> URIBL_PH_SURBL in the last few days with our Solaris 9 setup.
> Haven't changed much, except for the new anti-phishing version
> of Message.pm.  I saw the hits before this change.

The list is merged with another datasource, so if you are getting more
hits now its a good thing! ;)

Bye,
Raymond.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Mon Nov 15 14:16:24 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:35 2006
Subject: Another phishing improvement patch
Message-ID: <mailman.4682.1137101255.24926.mailscanner@lists.mailscanner.info>

The previous "improvement" caused problems with links to email addresses in
some email signatures.
This revision fixes that.

Just replace your 4.35.11 Message.pm with the file attached (once you've
gunzipped it of course :-)

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Application/OCTET-STREAM (Name: "Message.pm.gz")  54KB. ]
    [ Unable to print this part. ]


From David.While at UCE.AC.UK  Mon Nov 15 15:02:13 2004
From: David.While at UCE.AC.UK (David While)
Date: Thu Jan 12 21:27:35 2006
Subject: Vispan - new release
Message-ID: <mailman.4683.1137101255.24926.mailscanner@lists.mailscanner.info>

I have just released a new version of Vispan for download.

It has several changes:
        command line option for removing IP addresses
        the GeoIp stuff is now optional
        ability to suuply header and footer files

A full changelog is available on the web site.

Download as usual from http://www.while.homeunix.net/mailstats/

--------------------------------------------
David While BSc CEng MBCS CITP
Technical Development Manager
School of Computing & Information
University of Central England
Tel: 0121 331 6211
--------------------------------------------

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From gercke at HNM.DE  Mon Nov 15 16:06:06 2004
From: gercke at HNM.DE (Daniel Gercke)
Date: Thu Jan 12 21:27:35 2006
Subject: German Word/Excel Spam
Message-ID: <mailman.4684.1137101255.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

hi list,

since some days we receive tons of spam with word, excel & ebay subjects.

Where can i find a rule to catch this.

--

Daniel Gercke

programmierung . system managements

--
haus neuer medien GmbH . agentur fuer neuen antrieb
.
Tel 03834 8313 0 . Fax 8313 13 . info@hnm.de . www.hnm.de
Wolgaster Strasse 146  (Ollmannsche Villa) . 17489 Greifswald
AG Stralsund HRB 5089 . Geschaeftsfuehrer RA Daniel Scheibner
.
--
[Diese Nachricht gilt als frei von Viren und gefaehrlichen Dateianhaengen.
Schutz vor Viren und Spam von haus neuer medien. Bei Fragen oder Interesse Kontakt ueber mailscanner@hnm.de oder 03834 83130.]

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dean at SAHRA.ARIZONA.EDU  Mon Nov 15 16:26:29 2004
From: dean at SAHRA.ARIZONA.EDU (Dean Jones)
Date: Thu Jan 12 21:27:35 2006
Subject: Postfix + mailscanner, spool lock type
Message-ID: <mailman.4685.1137101255.24926.mailscanner@lists.mailscanner.info>

hi,

What type of spool locking should be used for postfix?
Mailscanner.conf details both Sendmail and Exim but not postfix.

thanks

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From billy at PLANETGEEK.BIZ  Mon Nov 15 16:37:28 2004
From: billy at PLANETGEEK.BIZ (Billy Pumphrey)
Date: Thu Jan 12 21:27:35 2006
Subject: German Word/Excel Spam
Message-ID: <mailman.4686.1137101255.24926.mailscanner@lists.mailscanner.info>

Speaking of ebay.  Anyone getting the spam, looks real, about updating your
ebay information along with paypal/credit card and so forth?

Here is the link in the email that says to update:
http://203.251.21.2/signin.ebay.com/ws2/eBayISAPI.dll/b2baf0b6a57d39abd6c44b
48d6fe3559112c21e54b7e705ecc5116b3c7c38c37949e8aa81848934faf0821be04210e8c2d
ed3c4159edbee3ee1439f3892a3e91/

The ip address in the url gives it away for one.  This email is very
convincing.

Here is the body:

We regret to inform you that your eBay account could be suspended if you
don't re-update your account information. To resolve this problems please
click here and re-enter your account information. If your problems could not
be resolved your account will be suspended for a period of 24 hours, after
this period your account will be terminated.

For the User Agreement, Section 9, we may immediately issue a warning,
temporarily suspend, indefinitely suspend or terminate your membership and
refuse to provide our services to you if we believe that your actions may
cause financial loss or legal liability for you, our users or us. We may
also take these actions if we are unable to verify or authenticate any
information you provide to us.

Due to the suspension of this account, please be advised you are prohibited
from using eBay in any way. This includes the registering of a new account.
Please note that this suspension does not relieve you of your agreed-upon
obligation to pay any fees you may owe to eBay.


Regards, Safeharbor Department eBay, Inc
The eBay team.
This is an automatic message. Please do not reply.




-----Original Message-----
From: Daniel Gercke [mailto:gercke@HNM.DE]
Sent: Monday, November 15, 2004 11:06 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: German Word/Excel Spam

hi list,

since some days we receive tons of spam with word, excel & ebay subjects.

Where can i find a rule to catch this.

--

Daniel Gercke

programmierung . system managements

--
haus neuer medien GmbH . agentur fuer neuen antrieb
.
Tel 03834 8313 0 . Fax 8313 13 . info@hnm.de . www.hnm.de
Wolgaster Strasse 146  (Ollmannsche Villa) . 17489 Greifswald
AG Stralsund HRB 5089 . Geschaeftsfuehrer RA Daniel Scheibner
.
--
[Diese Nachricht gilt als frei von Viren und gefaehrlichen Dateianhaengen.
Schutz vor Viren und Spam von haus neuer medien. Bei Fragen oder Interesse
Kontakt ueber mailscanner@hnm.de oder 03834 83130.]

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ugob at CAMO-ROUTE.COM  Mon Nov 15 16:32:34 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:35 2006
Subject: German Word/Excel Spam
Message-ID: <mailman.4687.1137101255.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Daniel Gercke wrote:
> hi list,
>
> since some days we receive tons of spam with word, excel & ebay subjects.
>

I just found this:

http://sandgnat.com/cmos/cmos.jsp

SA rules generator

> Where can i find a rule to catch this.
>
> --
>
> Daniel Gercke
>
> programmierung . system managements
>
> --

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Mon Nov 15 16:56:42 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:35 2006
Subject: Postfix + mailscanner, spool lock type
Message-ID: <mailman.4688.1137101255.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

You should just be able to leave it blank, and it will choose the right
value itself.

Dean Jones wrote:

> hi,
>
> What type of spool locking should be used for postfix?
> Mailscanner.conf details both Sendmail and Exim but not postfix.
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ebruce at HPMICH.COM  Mon Nov 15 17:08:35 2004
From: ebruce at HPMICH.COM (Ed Bruce)
Date: Thu Jan 12 21:27:35 2006
Subject: Another phishing improvement patch
Message-ID: <mailman.4689.1137101255.24926.mailscanner@lists.mailscanner.info>

Which Message.pm should be replaced. I did a find . -name Message\.pm
and found 12 copies???

Julian Field wrote:

>The previous "improvement" caused problems with links to email addresses in
>some email signatures.
>This revision fixes that.
>
>Just replace your 4.35.11 Message.pm with the file attached (once you've
>gunzipped it of course :-)
>
>--
>Julian Field
>www.MailScanner.info
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>
>

--
Ed Bruce
Health Plan of Michigan
Senior Programmer
Phone:  248.226.1512
FAX:    248.204.6569



--
This message, including any attachments, is intended solely for the use
of the named recipients(s) and may contain confidential and/or
privileged information. Any unauthorized review, use, disclosure or
distribution of this communication is expressly prohibited. If you are
not the intended recipient, please contact the sender by reply e-mail
and destroy any and all copies of the original message.

Thank you for your cooperation.

--
This message has been scanned for viruses and dangerous content by
Secure Resource, and is believed to be clean.
MailScanner thanks transtec Computers for their support.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mkettler at EVI-INC.COM  Mon Nov 15 17:14:00 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:35 2006
Subject: all local rules not loaded
Message-ID: <mailman.4690.1137101255.24926.mailscanner@lists.mailscanner.info>

At 09:37 AM 11/14/2004, Matthijs Althoff wrote:
>Switched today to latest MailScanner and upgraded Spamassassin from 2.64 to
>3.01 I have noticed the file /etc/mail/spamassassin/local.cf is still there
>but a new file init.pre has been written is this the new file also to put
>in some of my rules. Problem is the custom spam rules are ignored

I'd first check this out at the SA level.

First, run spamassassin --lint. You should get no complaints and it should
exit silently. If it complains, fix any compliants before going further.

Second, run spamassassin -D --lint. The first few lines should tell you
where your "site rules dir" is, as SA understands it. Make sure your custom
rules are located there.

Third, make sure that any custom rules are in .cf file.

Fourth, try running a message through SA's command line that will trigger a
custom rule and make sure it works:
         spamassassin -t < message.txt.

You can use SA's sample-spam.txt as a template if you don't have any
messages in plain RFC 822 format.

If you get through all that, and SA uses the rule but not under
mailscanner, then you might have a mailscanner issue....

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Leonard.Hermens at POTLATCHCORP.COM  Mon Nov 15 17:20:50 2004
From: Leonard.Hermens at POTLATCHCORP.COM (Leonard Hermens)
Date: Thu Jan 12 21:27:35 2006
Subject: Another phishing improvement patch
Message-ID: <mailman.4691.1137101255.24926.mailscanner@lists.mailscanner.info>

For Linux, you'll want the one in:
/usr/lib/MailScanner/MailScanner

At 09:08 AM 11/15/2004, you wrote:
>Which Message.pm should be replaced. I did a find . -name Message\.pm
>and found 12 copies???
>
>Julian Field wrote:
>
>>The previous "improvement" caused problems with links to email addresses in
>>some email signatures.
>>This revision fixes that.
>>
>>Just replace your 4.35.11 Message.pm with the file attached (once you've
>>gunzipped it of course :-)
>>
>>--
>>Julian Field
>>www.MailScanner.info
>>Buy the MailScanner book at www.MailScanner.info/store
>>
>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>
>
>--
>Ed Bruce
>Health Plan of Michigan
>Senior Programmer
>Phone:  248.226.1512
>FAX:    248.204.6569
>
>
>
>--
>This message, including any attachments, is intended solely for the use
>of the named recipients(s) and may contain confidential and/or
>privileged information. Any unauthorized review, use, disclosure or
>distribution of this communication is expressly prohibited. If you are
>not the intended recipient, please contact the sender by reply e-mail
>and destroy any and all copies of the original message.
>
>Thank you for your cooperation.
>
>--
>This message has been scanned for viruses and dangerous content by
>Secure Resource, and is believed to be clean.
>MailScanner thanks transtec Computers for their support.
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dean at SAHRA.ARIZONA.EDU  Mon Nov 15 17:37:09 2004
From: dean at SAHRA.ARIZONA.EDU (Dean Jones)
Date: Thu Jan 12 21:27:35 2006
Subject: Postfix + mailscanner, spool lock type
Message-ID: <mailman.4692.1137101255.24926.mailscanner@lists.mailscanner.info>

Thanks!


Julian Field wrote:
> You should just be able to leave it blank, and it will choose the right
> value itself.
>
> Dean Jones wrote:
>
>> hi,
>>
>> What type of spool locking should be used for postfix?
>> Mailscanner.conf details both Sendmail and Exim but not postfix.
>>
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ebruce at HPMICH.COM  Mon Nov 15 17:35:54 2004
From: ebruce at HPMICH.COM (Ed Bruce)
Date: Thu Jan 12 21:27:35 2006
Subject: Another phishing improvement patch
Message-ID: <mailman.4693.1137101255.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Thanks.

Leonard Hermens wrote:

> For Linux, you'll want the one in:
> /usr/lib/MailScanner/MailScanner
>
> At 09:08 AM 11/15/2004, you wrote:
>
>> Which Message.pm should be replaced. I did a find . -name Message\.pm
>> and found 12 copies???
>>
>> Julian Field wrote:
>>
>>> The previous "improvement" caused problems with links to email
>>> addresses in
>>> some email signatures.
>>> This revision fixes that.
>>>
>>> Just replace your 4.35.11 Message.pm with the file attached (once
>>> you've
>>> gunzipped it of course :-)
>>>
>>> --
>>> Julian Field
>>> www.MailScanner.info
>>> Buy the MailScanner book at www.MailScanner.info/store
>>>
>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>>
>>>
>>> ------------------------ MailScanner list ------------------------
>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>> 'leave mailscanner' in the body of the email.
>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>> Support MailScanner development - buy the book off the website!
>>>
>>>
>>
>> --
>> Ed Bruce
>> Health Plan of Michigan
>> Senior Programmer
>> Phone:  248.226.1512
>> FAX:    248.204.6569
>>
>>
>>
>> --
>> This message, including any attachments, is intended solely for the use
>> of the named recipients(s) and may contain confidential and/or
>> privileged information. Any unauthorized review, use, disclosure or
>> distribution of this communication is expressly prohibited. If you are
>> not the intended recipient, please contact the sender by reply e-mail
>> and destroy any and all copies of the original message.
>>
>> Thank you for your cooperation.
>>
>> --
>> This message has been scanned for viruses and dangerous content by
>> Secure Resource, and is believed to be clean.
>> MailScanner thanks transtec Computers for their support.
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>> Support MailScanner development - buy the book off the website!
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>



--
This message, including any attachments, is intended solely for the use
of the named recipients(s) and may contain confidential and/or
privileged information. Any unauthorized review, use, disclosure or
distribution of this communication is expressly prohibited. If you are
not the intended recipient, please contact the sender by reply e-mail
and destroy any and all copies of the original message.

Thank you for your cooperation.

--
This message has been scanned for viruses and dangerous content by
Secure Resource, and is believed to be clean.
MailScanner thanks transtec Computers for their support.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Denis.Beauchemin at USHERBROOKE.CA  Mon Nov 15 18:30:03 2004
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:27:35 2006
Subject: OT: Bitdefender issues
Message-ID: <mailman.4694.1137101255.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Alessandro Bianchi wrote:

>> The problem is to do with a kernel security feature called exec-shield
>> to
>> solve the above problem you need to turn it off with the following
>> command
>>
>> echo 0 > /proc/sys/kernel/exec-shield
>>
>> There is some more background info at
>> http://people.redhat.com/mingo/exec-shield/ANNOUNCE-exec-shield
>>
>> Here come my questions :)
>> Has anybody else had this problem with bitdefender & FC2? (I think it
>> happened after upgrading to kernel-2.6.8-1.521)
>
>
> Hywel
>
> Same problem here and after playing with the bitdefender support team
> they emailed tha " a fix will be available soon".
>
> It was two months ago...
>
> They also confirm the problem is about the kernel...
>
> I don't think to have to low my defences for a buggy piece of software,
> so I stopped using bitdefender until they will fix it , but I wonder if
> it will ever happen.
>

Alessandro,

Did you try to set and export the LD_ASSUME_KERNEL=2.4.21 (or any other 
working version) before calling bdc?

I can't test this here because I am running RHEL 3 and we are still with 
kernel 2.4.

Denis

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mkettler at EVI-INC.COM  Mon Nov 15 20:06:09 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:35 2006
Subject: German Word/Excel Spam
Message-ID: <mailman.4695.1137101255.24926.mailscanner@lists.mailscanner.info>

At 11:37 AM 11/15/2004, Billy Pumphrey wrote:
>Speaking of ebay.  Anyone getting the spam, looks real, about updating your
>ebay information along with paypal/credit card and so forth?

Yes.. Tons of them, and they aren't new. Other popular targets are
citibank, and MBNA (major credit card providers).

This scam tactic is called Phishing, and it's been so heavily covered in
the media it's not really worth covering here. A little googling should
turn up tons of information. I got 1,360 hits in google news and 10k in
google groups (although only 875 of these remain after "duplicate"
elimination).

Some quick random selections
http://www.thebostonchannel.com/buyerbeware/3907225/detail.html

http://www.miami.com/mld/miamiherald/business/technology/10073280.htm?1c

http://www.nationnews.com/StoryView.cfm?Record=54648&Section=LO

There's even a very good security whitepaper on the subject published. 42
pages long:

http://www.nextgenss.com/papers/NISR-WP-Phishing.pdf

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Mon Nov 15 20:21:58 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:35 2006
Subject: German Word/Excel Spam
Message-ID: <mailman.4696.1137101255.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Matt Kettler wrote:

> At 11:37 AM 11/15/2004, Billy Pumphrey wrote:
>
>> Speaking of ebay.  Anyone getting the spam, looks real, about
>> updating your
>> ebay information along with paypal/credit card and so forth?
>
>
> Yes.. Tons of them, and they aren't new. Other popular targets are
> citibank, and MBNA (major credit card providers).
>
> This scam tactic is called Phishing, and it's been so heavily covered in
> the media it's not really worth covering here. A little googling should
> turn up tons of information. I got 1,360 hits in google news and 10k in
> google groups (although only 875 of these remain after "duplicate"
> elimination).
>
Also worth a quick mention for
http://www.sng.ecs.soton.ac.uk/mailscanner/phishing.html
as MailScanner successfully detects quite a few of these scams in the
latest version (with the updated Message.pm file added to it that I have
posted here).

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From billy at PLANETGEEK.BIZ  Mon Nov 15 20:32:21 2004
From: billy at PLANETGEEK.BIZ (Billy Pumphrey)
Date: Thu Jan 12 21:27:35 2006
Subject: German Word/Excel Spam
Message-ID: <mailman.4697.1137101255.24926.mailscanner@lists.mailscanner.info>

Thank you for the information.  I seen the long talk about phishing but
since I didn't know what it was I ignored it.  Way to go MailScanner picking
up on these already.

Thanks Julian for MailScanner.  FYI:  I bought your MailScanner book to
support your cause, and of course for the humor that you put in it.

-----Original Message-----
From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK]
Sent: Monday, November 15, 2004 3:22 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: German Word/Excel Spam

Matt Kettler wrote:

> At 11:37 AM 11/15/2004, Billy Pumphrey wrote:
>
>> Speaking of ebay.  Anyone getting the spam, looks real, about
>> updating your
>> ebay information along with paypal/credit card and so forth?
>
>
> Yes.. Tons of them, and they aren't new. Other popular targets are
> citibank, and MBNA (major credit card providers).
>
> This scam tactic is called Phishing, and it's been so heavily covered in
> the media it's not really worth covering here. A little googling should
> turn up tons of information. I got 1,360 hits in google news and 10k in
> google groups (although only 875 of these remain after "duplicate"
> elimination).
>
Also worth a quick mention for
http://www.sng.ecs.soton.ac.uk/mailscanner/phishing.html
as MailScanner successfully detects quite a few of these scams in the
latest version (with the updated Message.pm file added to it that I have
posted here).

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Mon Nov 15 20:37:50 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:35 2006
Subject: German Word/Excel Spam
Message-ID: <mailman.4698.1137101255.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Billy Pumphrey wrote:

>Thanks Julian for MailScanner.  FYI:  I bought your MailScanner book to
>support your cause, and of course for the humor that you put in it.
>
>
Guess you found the bit about gnawing your own legs off and the appendix
at the back :-)
Glad you like the book! Many thanks for supporting MailScanner.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From james_gray at ocs.com  Tue Nov 16 03:00:08 2004
From: james_gray at ocs.com (James Gray)
Date: Thu Jan 12 21:27:35 2006
Subject: notice help
Message-ID: <mailman.4699.1137101255.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "utf-8" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Tue, 16 Nov 2004 12:57 pm, Jorge A. Arenas Quezada wrote:
> Hi everyone:
>
>     I like to know if there is a way to send notice about virus to the
> administrator, but only from mails from inside address.
>
>     I have problems because i receive 300 notice mails, but i like to make
> some separation from virus from inside computers and virus received from
> the rest of the world.
>
>     i like to point my view to internal addresses with problems, not to
> all 300 mails.
>
> it's possible to do this ?
>
> thanks
>
> jorge arenas

Simple answer: ruleset

Find the bit in MailScanner.conf that says:

# Notify the local system administrators ("Notices To") when any infections
# are found?
# This can also be the filename of a ruleset.
Send Notices = yes

Change to "Send Notices = %rules-dir%/notices.rules"

"%rules-dir%" is usually /opt/MailScanner/etc/rules - or check where it points
at the top of MailScanner.conf.  Anyway, in %rules-dir% create the file
"notices.rules" with the following:

From:         1.2.3.4       yes
From:         1.2.3.5    yes
ToOrFrom:     default    no

where those IP addresses reflect your internal networks.  Then restart
mailscanner.  Voila.  For further info, read the MAQ and archives about
rulesets (links at th bottom of every post on this list).

Cheers

James

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jorgeaaq at CSAGS.COM.MX  Tue Nov 16 01:43:20 2004
From: jorgeaaq at CSAGS.COM.MX (Jorge A. Arenas Quezada)
Date: Thu Jan 12 21:27:35 2006
Subject: notice help
Message-ID: <mailman.4700.1137101255.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi everyone:
 
    I like to know if there is a way to send notice about virus to the
administrator, but only from mails from inside address.  
 
    I have problems because i receive 300 notice mails, but i like to
make some separation from virus from inside computers and virus received
from the rest of the world.
 
    i like to point my view to internal addresses with problems, not to
all 300 mails.
 
it's possible to do this ?
 
thanks
 
jorge arenas
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From jorgeaaq at CSAGS.COM.MX  Tue Nov 16 01:57:57 2004
From: jorgeaaq at CSAGS.COM.MX (Jorge A. Arenas Quezada)
Date: Thu Jan 12 21:27:35 2006
Subject: notice help
Message-ID: <mailman.4701.1137101255.24926.mailscanner@lists.mailscanner.info>

Hi everyone:

    I like to know if there is a way to send notice about virus to the
administrator, but only from mails from inside address.

    I have problems because i receive 300 notice mails, but i like to make
some separation from virus from inside computers and virus received from
the rest of the world.

    i like to point my view to internal addresses with problems, not to
all 300 mails.

it's possible to do this ?

thanks

jorge arenas

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From BBerglund at TECHPRO.COM  Tue Nov 16 02:09:06 2004
From: BBerglund at TECHPRO.COM (Brian Berglund)
Date: Thu Jan 12 21:27:35 2006
Subject: New question
Message-ID: <mailman.4702.1137101255.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Does anyone know how to do the following?
 
I want to setup Sendmail to connect to a mysql database to check for
users.
 
Meaning. 
In my database I have.
 
domain name:
email address:
relay location:
 
so it looks like
 
test.com
userA@test.com
123.123.123.123
test.com
userB@test.com
123.123.123.123
another.com
userF@another.com
321.321.321.321
another.com
userO@another.com
321.321.321.321
 
So I want sendmail to receive the email, check against the database if
the user is valid.  If so, then Mailscanner will scan for spam and virus.
Then give back to sendmail to check against the database for the relay
address to send to.
 
Can this be done?
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From vachanta at GMAIL.COM  Mon Nov 15 23:05:26 2004
From: vachanta at GMAIL.COM (Venkata Achanta)
Date: Thu Jan 12 21:27:35 2006
Subject: whitelist rules are being overridden by the blacklist rules ?
Message-ID: <mailman.4703.1137101255.24926.mailscanner@lists.mailscanner.info>

hello all,

I have the following rule set listed in blacklist.rules
From:   *@domain.com and To: *@domain.com   yes

( i want to disallow spoofing )


and i allowed this in whitelist.rules

From:   no-reply@domain.com   yes
To:     no-reply@domain.com   yes
(these are some administrative scipts e-mailing from that e-mail addy)


Here are the logs

Nov 15 14:36:12 host sendmail[26920]: iAFMaCJI026920:
from=<no-reply@domain.com>, size=902, class=0, nrcpts=1,
msgid=<200411152236.iAFMaCJI026920@host.domain.com>, proto=ESMTP,
daemon=MTA, relay=host [127.0.0.1]
Nov 15 13:52:02 host MailScanner[29537]: Message iAFLldov018164 from
127.0.0.1 (no-reply@domain.com) is whitelisted
Nov 15 13:52:02 host MailScanner[29537]: Message iAFLldov018164 from
127.0.0.1 (no-reply@domain.com) to domain.com is spam (blacklisted)
Nov 15 13:53:18 host sendmail[24290]: iAFLldov018164: to=<johnq@domain.com>,
delay=00:05:39, xdelay=00:00:00, mailer=esmtp, pri=120902,
relay=[192.168.1.1], dsn=2.0.0, stat=Sent (
<200411152147.iAFLldov018164@domain.com> Queued mail for delivery)


Why is MS marking it as spam when it is whitelisted.Its looking at
whitelist.rules and says its whitelisted but then its looking at blacklist
and marking it as spam.

I thought whitelist should take precedence over blacklist.Am i wrong here or
am i missing something ?


Please advise.

Thanks much,
Venkata Achanta

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dhawal at NETMAGICSOLUTIONS.COM  Tue Nov 16 09:16:26 2004
From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy)
Date: Thu Jan 12 21:27:35 2006
Subject: SQL database for bayes
Message-ID: <mailman.4704.1137101255.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Dhawal Doshy wrote:

> Hello all,
>
> Is anyone using the SQL features in SA 3+ for storing the bayesian
> information in a SQL database? We have multiple MS servers and would
> prefer this over NFS / Samba sharing though currently we maintain native
> disk based bayesian databases. (/etc/MailScanner/bayes)
>
> How are you sharing the bayesian information?
> What would be the advantages / disadvantages of doing it in SQL?
> Can anyone comment on the performance after the change?
>
> regards,
> - dhawal

Anyone using SQL for bayes??

- dhawal

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From m.sapsed at BANGOR.AC.UK  Tue Nov 16 09:20:19 2004
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:27:35 2006
Subject: install-Clam-spamass
Message-ID: <mailman.4705.1137101255.24926.mailscanner@lists.mailscanner.info>

Remco Barendse wrote:
> Hi
>
> I just wanted to upgrade a box to the latest spamass. but SA didn't
> upgrade.
>
> Oh good, module Mail::SpamAssassin version 3.0.1 is already installed.
>
> [root@linuxgw install-Clam-SA]# spamassassin --version
> SpamAssassin version 3.0.0
>   running on Perl version

What does this perl script say? I believe this is a more reliable way of
finding what MailScanner will use that the spamassassin command?

#! /usr/bin/perl
use Mail::SpamAssassin;
print $Mail::SpamAssassin::VERSION . "\n";


Cheers,

Martin

--
Martin Sapsed            "I've got 8 little fingers and only 2 thumbs,
Microcomputer Support                      won't you leave me in peace
Information Services                        while I get the job done?"
University of Wales, Bangor             Chris Rea, "I'm working on it"

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Tue Nov 16 09:26:40 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:35 2006
Subject: install-Clam-spamass
Message-ID: <mailman.4706.1137101255.24926.mailscanner@lists.mailscanner.info>

On 16/11/04 9:20 am, "Martin Sapsed" <m.sapsed@BANGOR.AC.UK> wrote:

> Remco Barendse wrote:
>> Hi
>>
>> I just wanted to upgrade a box to the latest spamass. but SA didn't
>> upgrade.
>>
>> Oh good, module Mail::SpamAssassin version 3.0.1 is already installed.
>>
>> [root@linuxgw install-Clam-SA]# spamassassin --version
>> SpamAssassin version 3.0.0
>>   running on Perl version
>
> What does this perl script say? I believe this is a more reliable way of
> finding what MailScanner will use that the spamassassin command?
>
> #! /usr/bin/perl
> use Mail::SpamAssassin;
> print $Mail::SpamAssassin::VERSION . "\n";

The best bet is to do
    MailScanner -v
as that will print the version numbers MailScanner is trying to use. Also
what does
    which spamassassin
say?
--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From sylvain.phaneuf at IMSU.OXFORD.AC.UK  Tue Nov 16 10:41:10 2004
From: sylvain.phaneuf at IMSU.OXFORD.AC.UK (Sylvain Phaneuf)
Date: Thu Jan 12 21:27:35 2006
Subject: Another phishing improvement patch
Message-ID: <mailman.4707.1137101255.24926.mailscanner@lists.mailscanner.info>

sorry to ask, but I haven't got a Message.pm in
/usr/lib/MailScanner/MailScanner...

I have one in:
/usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/Message.pm
which dates from when I updated SpamAssassin to 3.01

and one in
/opt/MailScanner-4.35.11/lib/MailScanner/Message.pm
which dates from when I installed MS 4.35.11

I suspect the one in /opt is the one...

Can someone confirm please?

And can someone tell me why I am different?  OK, apart from my accent,
my lack of unix expertise, etc.... Why is my setup not like others?  I
am using MS 4.35.11, have started with 4.22-5 in Nov. 2003, and have
upgraded it regularly since.

Thanks in advance,

Sylvain






===========================================================
Sylvain Phaneuf --- Systems Manager   | phone : +44 (0)1865 221323
Clinical School Information Management Services Unit  (IMSU)
Medical Sciences Division
University of Oxford                                  |   email :
sylvain.phaneuf@imsu.ox.ac.uk
Room 3A25B John Radcliffe Hospital      |   fax :  +44 (0) 1865 221322
Oxford   OX3 9DU   England
===========================================================

>>> Leonard.Hermens@POTLATCHCORP.COM 15/11/2004 17:20:50 >>>
For Linux, you'll want the one in:
/usr/lib/MailScanner/MailScanner

At 09:08 AM 11/15/2004, you wrote:
>Which Message.pm should be replaced. I did a find . -name Message\.pm
>and found 12 copies???
>
>Julian Field wrote:
>
>>The previous "improvement" caused problems with links to email
addresses in
>>some email signatures.
>>This revision fixes that.
>>
>>Just replace your 4.35.11 Message.pm with the file attached (once
you've
>>gunzipped it of course :-)
>>
>>--
>>Julian Field
>>www.MailScanner.info
>>Buy the MailScanner book at www.MailScanner.info/store
>>
>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>
>
>--
>Ed Bruce
>Health Plan of Michigan
>Senior Programmer
>Phone:  248.226.1512
>FAX:    248.204.6569
>
>
>
>--
>This message, including any attachments, is intended solely for the
use
>of the named recipients(s) and may contain confidential and/or
>privileged information. Any unauthorized review, use, disclosure or
>distribution of this communication is expressly prohibited. If you
are
>not the intended recipient, please contact the sender by reply e-mail
>and destroy any and all copies of the original message.
>
>Thank you for your cooperation.
>
>--
>This message has been scanned for viruses and dangerous content by
>Secure Resource, and is believed to be clean.
>MailScanner thanks transtec Computers for their support.
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Tue Nov 16 10:49:04 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:35 2006
Subject: Another phishing improvement patch
Message-ID: <mailman.4708.1137101255.24926.mailscanner@lists.mailscanner.info>

On 16/11/04 10:41 am, "Sylvain Phaneuf" <sylvain.phaneuf@IMSU.OXFORD.AC.UK>
wrote:

> sorry to ask, but I haven't got a Message.pm in
> /usr/lib/MailScanner/MailScanner...

That's on Linux systems.

>
> I have one in:
> /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/Message.pm
> which dates from when I updated SpamAssassin to 3.01
>
> and one in
> /opt/MailScanner-4.35.11/lib/MailScanner/Message.pm
> which dates from when I installed MS 4.35.11
>
> I suspect the one in /opt is the one...
>
> Can someone confirm please?

Correct.

>
> And can someone tell me why I am different?  OK, apart from my accent,
> my lack of unix expertise, etc.... Why is my setup not like others?  I
> am using MS 4.35.11, have started with 4.22-5 in Nov. 2003, and have
> upgraded it regularly since.

You aren't a Linux user. That's all.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
--
Julian Field
jkf@ecs.soton.ac.uk
Teaching Systems Manager
Electronics & Computer Science
University of Southampton
SO17 1BJ, UK

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Tue Nov 16 10:46:13 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:35 2006
Subject: Another phishing improvement patch
Message-ID: <mailman.4709.1137101255.24926.mailscanner@lists.mailscanner.info>

Sylvain

yes the one in /opt

the /usr/lib/ one is where the RPM versions of MailScanner get put...

I presume (like me) you are using the generic tar.gz install....


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Sylvain Phaneuf wrote:
> sorry to ask, but I haven't got a Message.pm in
> /usr/lib/MailScanner/MailScanner...
>
> I have one in:
> /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/Message.pm
> which dates from when I updated SpamAssassin to 3.01
>
> and one in
> /opt/MailScanner-4.35.11/lib/MailScanner/Message.pm
> which dates from when I installed MS 4.35.11
>
> I suspect the one in /opt is the one...
>
> Can someone confirm please?
>
> And can someone tell me why I am different?  OK, apart from my accent,
> my lack of unix expertise, etc.... Why is my setup not like others?  I
> am using MS 4.35.11, have started with 4.22-5 in Nov. 2003, and have
> upgraded it regularly since.
>
> Thanks in advance,
>
> Sylvain
>
>
>
>
>
>
> ===========================================================
> Sylvain Phaneuf --- Systems Manager   | phone : +44 (0)1865 221323
> Clinical School Information Management Services Unit  (IMSU)
> Medical Sciences Division
> University of Oxford                                  |   email :
> sylvain.phaneuf@imsu.ox.ac.uk
> Room 3A25B John Radcliffe Hospital      |   fax :  +44 (0) 1865 221322
> Oxford   OX3 9DU   England
> ===========================================================
>
>
>>>>Leonard.Hermens@POTLATCHCORP.COM 15/11/2004 17:20:50 >>>
>
> For Linux, you'll want the one in:
> /usr/lib/MailScanner/MailScanner
>
> At 09:08 AM 11/15/2004, you wrote:
>
>>Which Message.pm should be replaced. I did a find . -name Message\.pm
>>and found 12 copies???
>>
>>Julian Field wrote:
>>
>>
>>>The previous "improvement" caused problems with links to email
>
> addresses in
>
>>>some email signatures.
>>>This revision fixes that.
>>>
>>>Just replace your 4.35.11 Message.pm with the file attached (once
>
> you've
>
>>>gunzipped it of course :-)
>>>
>>>--
>>>Julian Field
>>>www.MailScanner.info
>>>Buy the MailScanner book at www.MailScanner.info/store
>>>
>>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>>
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>>
>>>
>>
>>--
>>Ed Bruce
>>Health Plan of Michigan
>>Senior Programmer
>>Phone:  248.226.1512
>>FAX:    248.204.6569
>>
>>
>>
>>--
>>This message, including any attachments, is intended solely for the
>
> use
>
>>of the named recipients(s) and may contain confidential and/or
>>privileged information. Any unauthorized review, use, disclosure or
>>distribution of this communication is expressly prohibited. If you
>
> are
>
>>not the intended recipient, please contact the sender by reply e-mail
>>and destroy any and all copies of the original message.
>>
>>Thank you for your cooperation.
>>
>>--
>>This message has been scanned for viruses and dangerous content by
>>Secure Resource, and is believed to be clean.
>>MailScanner thanks transtec Computers for their support.
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From sylvain.phaneuf at IMSU.OXFORD.AC.UK  Tue Nov 16 11:25:55 2004
From: sylvain.phaneuf at IMSU.OXFORD.AC.UK (Sylvain Phaneuf)
Date: Thu Jan 12 21:27:35 2006
Subject: Another phishing improvement patch
Message-ID: <mailman.4710.1137101255.24926.mailscanner@lists.mailscanner.info>

sorry to be very thick... I forgot to mention that our box run on RedHat
8...

Anyway, It seems to work...


Sylvain



>>> mailscanner@ECS.SOTON.AC.UK 16/11/2004 10:49:04 >>>
On 16/11/04 10:41 am, "Sylvain Phaneuf"
<sylvain.phaneuf@IMSU.OXFORD.AC.UK>
wrote:

> sorry to ask, but I haven't got a Message.pm in
> /usr/lib/MailScanner/MailScanner...

That's on Linux systems.

>
> I have one in:
> /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/Message.pm
> which dates from when I updated SpamAssassin to 3.01
>
> and one in
> /opt/MailScanner-4.35.11/lib/MailScanner/Message.pm
> which dates from when I installed MS 4.35.11
>
> I suspect the one in /opt is the one...
>
> Can someone confirm please?

Correct.

>
> And can someone tell me why I am different?  OK, apart from my
accent,
> my lack of unix expertise, etc.... Why is my setup not like others?
I
> am using MS 4.35.11, have started with 4.22-5 in Nov. 2003, and have
> upgraded it regularly since.

You aren't a Linux user. That's all.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
--
Julian Field
jkf@ecs.soton.ac.uk
Teaching Systems Manager
Electronics & Computer Science
University of Southampton
SO17 1BJ, UK

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Tue Nov 16 11:33:38 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:35 2006
Subject: Another phishing improvement patch
Message-ID: <mailman.4711.1137101255.24926.mailscanner@lists.mailscanner.info>

Sylvain

must have used the tar.gz installer rather than the RPM then????


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Sylvain Phaneuf wrote:
> sorry to be very thick... I forgot to mention that our box run on RedHat
> 8...
>
> Anyway, It seems to work...
>
>
> Sylvain
>
>
>
>
>>>>mailscanner@ECS.SOTON.AC.UK 16/11/2004 10:49:04 >>>
>
> On 16/11/04 10:41 am, "Sylvain Phaneuf"
> <sylvain.phaneuf@IMSU.OXFORD.AC.UK>
> wrote:
>
>
>>sorry to ask, but I haven't got a Message.pm in
>>/usr/lib/MailScanner/MailScanner...
>
>
> That's on Linux systems.
>
>
>>I have one in:
>>/usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/Message.pm
>>which dates from when I updated SpamAssassin to 3.01
>>
>>and one in
>>/opt/MailScanner-4.35.11/lib/MailScanner/Message.pm
>>which dates from when I installed MS 4.35.11
>>
>>I suspect the one in /opt is the one...
>>
>>Can someone confirm please?
>
>
> Correct.
>
>
>>And can someone tell me why I am different?  OK, apart from my
>
> accent,
>
>>my lack of unix expertise, etc.... Why is my setup not like others?
>
> I
>
>>am using MS 4.35.11, have started with 4.22-5 in Nov. 2003, and have
>>upgraded it regularly since.
>
>
> You aren't a Linux user. That's all.
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> --
> Julian Field
> jkf@ecs.soton.ac.uk
> Teaching Systems Manager
> Electronics & Computer Science
> University of Southampton
> SO17 1BJ, UK
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From sylvain.phaneuf at IMSU.OXFORD.AC.UK  Tue Nov 16 11:58:59 2004
From: sylvain.phaneuf at IMSU.OXFORD.AC.UK (Sylvain Phaneuf)
Date: Thu Jan 12 21:27:35 2006
Subject: Another phishing improvement patch
Message-ID: <mailman.4712.1137101255.24926.mailscanner@lists.mailscanner.info>

You are right again Martin. That explains that.

 I am getting there...

Thanks



>>> martinh@SOLID-STATE-LOGIC.COM 16/11/2004 11:33:38 >>>
Sylvain

must have used the tar.gz installer rather than the RPM then????


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Sylvain Phaneuf wrote:
> sorry to be very thick... I forgot to mention that our box run on
RedHat
> 8...
>
> Anyway, It seems to work...
>
>
> Sylvain
>
>
>
>
>>>>mailscanner@ECS.SOTON.AC.UK 16/11/2004 10:49:04 >>>
>
> On 16/11/04 10:41 am, "Sylvain Phaneuf"
> <sylvain.phaneuf@IMSU.OXFORD.AC.UK>
> wrote:
>
>
>>sorry to ask, but I haven't got a Message.pm in
>>/usr/lib/MailScanner/MailScanner...
>
>
> That's on Linux systems.
>
>
>>I have one in:
>>/usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/Message.pm
>>which dates from when I updated SpamAssassin to 3.01
>>
>>and one in
>>/opt/MailScanner-4.35.11/lib/MailScanner/Message.pm
>>which dates from when I installed MS 4.35.11
>>
>>I suspect the one in /opt is the one...
>>
>>Can someone confirm please?
>
>
> Correct.
>
>
>>And can someone tell me why I am different?  OK, apart from my
>
> accent,
>
>>my lack of unix expertise, etc.... Why is my setup not like others?
>
> I
>
>>am using MS 4.35.11, have started with 4.22-5 in Nov. 2003, and have
>>upgraded it regularly since.
>
>
> You aren't a Linux user. That's all.
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> --
> Julian Field
> jkf@ecs.soton.ac.uk
> Teaching Systems Manager
> Electronics & Computer Science
> University of Southampton
> SO17 1BJ, UK
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at MARKF.MAILSHELL.COM  Tue Nov 16 11:57:01 2004
From: mailscanner at MARKF.MAILSHELL.COM (Mark Fyvie)
Date: Thu Jan 12 21:27:35 2006
Subject: Problems with SA/Mailscanner using different perl versions
Message-ID: <mailman.4713.1137101255.24926.mailscanner@lists.mailscanner.info>

Hi list,

 I have a small problem. Well actually it is not so small. I'm no linux
expert, but have had a bit of experience tinkering around on my Cobalt RAQ4
(based on Redhat), so please bear with me...

 I was running Mailscanner 4.30 and what I thought was SpamAssassin 2.63
(turns out that Mailscanner 4.30 was actually referencing a previous
installation of SA 2.55!). Last weekend I decided to upgrade to SpamAssassin
3.01, so at the same time I upgraded to MailScanner 4.35.

 After reading through all the help files, FAQs, and every bit of
documentation I could find for MailScanner and SpamAssassin I did make
considerable progress. For example, I discovered that SA 2.55 was still
being referenced by the new version of MailScanner and all sorts of other
issues. I completely purged my system of previous versions of both programs.

 Before I go on I should mention that I am running two versions of Perl, and
have been doing so for quite some time. The version which is shipped with
the RAQ4 is 5.005. I also installed 5.8.0 in parallel to this. If I need to
use the newer version in a given script I usually just change the
#!/usr/bin/perl line at the start of the script. Why did I keep the old
version of perl? Well after some investigation it seems that many of the
built-in functions and scripts used by the RAQ will break if the original
perl version is removed, so I decided to run both in parallel.

 Now the issue here is that the new SpamAssassin no longer works with any of
the old perl versions, so I installed it into my 5.8.0. The problem I have
is that MailScanner is running with my 5.005 version, so when SA.pm does its
check to see if SpamAssassin is present, it reports that it cannot find
SpamAssassin. I've tried playing with the paths in the MailScanner.conf
file, turning on all the debugs, adding the line #!/home/perl/bin/perl (this
points to 5.8.0) to SA.pm, but no luck.

 I tried to reinstall MailScanner (I always did it via make) to see if there
were any options I could choose to specify a different copy of perl, but I
could find no such options. I could find routines that searched for multiple
versions of perl and simply told the user that it wasn't a good idea. The
FAQ on the mailscanner site says something similar, along the lines of "It's
not bad to have more than one version, but you'll have less problems if you
choose just one".

 My problem is that I can't just have one version. My question is this: How
do I either A> Install mailscanner so that it uses my 5.8.0 version
exclusively, or B> Tell it to use 5.8.0 when it calls any scripts related to
the use of SpamAssassin?

 Thanks in advance for your help.

Regards,
Mark

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From pat713ou at PACIFIC.NET.SG  Tue Nov 16 12:13:55 2004
From: pat713ou at PACIFIC.NET.SG (Patrick Ou Yong)
Date: Thu Jan 12 21:27:35 2006
Subject: Anti Phishing feature
Message-ID: <mailman.4714.1137101255.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

As anyone enabled the new Anti-Phising feature on their MS?

Any feedback, would be greatly appreciated.

Thank you.

Patrick

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Tue Nov 16 12:16:48 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:35 2006
Subject: Problems with SA/Mailscanner using different perl versions
Message-ID: <mailman.4715.1137101255.24926.mailscanner@lists.mailscanner.info>

Mark

if you use the tar.gz version to install there's an option on the
'install' script to tell it where to look for the correct perl version..


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Mark Fyvie wrote:
> Hi list,
>
>  I have a small problem. Well actually it is not so small. I'm no linux
> expert, but have had a bit of experience tinkering around on my Cobalt RAQ4
> (based on Redhat), so please bear with me...
>
>  I was running Mailscanner 4.30 and what I thought was SpamAssassin 2.63
> (turns out that Mailscanner 4.30 was actually referencing a previous
> installation of SA 2.55!). Last weekend I decided to upgrade to SpamAssassin
> 3.01, so at the same time I upgraded to MailScanner 4.35.
>
>  After reading through all the help files, FAQs, and every bit of
> documentation I could find for MailScanner and SpamAssassin I did make
> considerable progress. For example, I discovered that SA 2.55 was still
> being referenced by the new version of MailScanner and all sorts of other
> issues. I completely purged my system of previous versions of both programs.
>
>  Before I go on I should mention that I am running two versions of Perl, and
> have been doing so for quite some time. The version which is shipped with
> the RAQ4 is 5.005. I also installed 5.8.0 in parallel to this. If I need to
> use the newer version in a given script I usually just change the
> #!/usr/bin/perl line at the start of the script. Why did I keep the old
> version of perl? Well after some investigation it seems that many of the
> built-in functions and scripts used by the RAQ will break if the original
> perl version is removed, so I decided to run both in parallel.
>
>  Now the issue here is that the new SpamAssassin no longer works with any of
> the old perl versions, so I installed it into my 5.8.0. The problem I have
> is that MailScanner is running with my 5.005 version, so when SA.pm does its
> check to see if SpamAssassin is present, it reports that it cannot find
> SpamAssassin. I've tried playing with the paths in the MailScanner.conf
> file, turning on all the debugs, adding the line #!/home/perl/bin/perl (this
> points to 5.8.0) to SA.pm, but no luck.
>
>  I tried to reinstall MailScanner (I always did it via make) to see if there
> were any options I could choose to specify a different copy of perl, but I
> could find no such options. I could find routines that searched for multiple
> versions of perl and simply told the user that it wasn't a good idea. The
> FAQ on the mailscanner site says something similar, along the lines of "It's
> not bad to have more than one version, but you'll have less problems if you
> choose just one".
>
>  My problem is that I can't just have one version. My question is this: How
> do I either A> Install mailscanner so that it uses my 5.8.0 version
> exclusively, or B> Tell it to use 5.8.0 when it calls any scripts related to
> the use of SpamAssassin?
>
>  Thanks in advance for your help.
>
> Regards,
> Mark
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Tue Nov 16 12:18:26 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:36 2006
Subject: Anti Phishing feature
Message-ID: <mailman.4716.1137101255.24926.mailscanner@lists.mailscanner.info>

Partrick

yes - seems to be trapping mainly incorrect URLs in newsletters and html
email footers. BUT they are phishing style URL's/ I'm whitelisting via a
ruleset for our common false posiives.


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Patrick Ou Yong wrote:
> As anyone enabled the new Anti-Phising feature on their MS?
>
> Any feedback, would be greatly appreciated.
>
> Thank you.
>
> Patrick
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ebruce at HPMICH.COM  Tue Nov 16 12:39:59 2004
From: ebruce at HPMICH.COM (Ed Bruce)
Date: Thu Jan 12 21:27:36 2006
Subject: Mailto's being marked as detected fraud attempt.
Message-ID: <mailman.4717.1137101256.24926.mailscanner@lists.mailscanner.info>

I'm seeing this problem now were mailto: is being marked as detected
fraud attempt. I've just installed the latest Message.pm from yesterday.

Brian Berglund wrote:
      Does anyone know how to do the following?
 
I want to setup Sendmail to connect to a mysql database to check
for users.
 
Meaning. 
In my database I have.
 
domain name:
email address:
relay location:
 
so it looks like
 
test.com
MailScanner has detected a possible fraud attempt from
"mailto:usera@test.com" claiming to be MailScanner has detected a
possible fraud attempt from "mailto:usera@test.com" claiming to be
userA@test.com
123.123.123.123
test.com
MailScanner has detected a possible fraud attempt from
"mailto:userb@test.com" claiming to be MailScanner has detected a
possible fraud attempt from "mailto:userb@test.com" claiming to be
userB@test.com
123.123.123.123
another.com
MailScanner has detected a possible fraud attempt from
"mailto:userf@another.com" claiming to be MailScanner has detected
a possible fraud attempt from "mailto:userf@another.com" claiming
to be userF@another.com
321.321.321.321
another.com
MailScanner has detected a possible fraud attempt from
"mailto:usero@another.com" claiming to be MailScanner has detected
a possible fraud attempt from "mailto:usero@another.com" claiming
to be userO@another.com
321.321.321.321
 
So I want sendmail to receive the email, check against the database
if the user is valid.  If so, then Mailscanner will scan for spam
and virus. Then give back to sendmail to check against the database
for the relay address to send to.
 
Can this be done?

--
This message has been scanned for viruses and
dangerous content by Secure Resource, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


 --
Ed Bruce
Health Plan of Michigan
Senior Programmer
Phone:  248.226.1512
FAX:    248.204.6569


--
This message, including any attachments, is intended solely for the use
of the named
recipients(s) and may contain confidential and/or privileged information.
Any
unauthorized review, use, disclosure or distribution of this
communication is expressly
prohibited. If you are not the intended recipient, please contact the
sender by reply
e-mail and destroy any and all copies of the original message. Thank you
for your
cooperation.
--
This message has been scanned for viruses and
dangerous content by Secure Resource, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From carinus.carelse at MRC.AC.ZA  Tue Nov 16 12:52:32 2004
From: carinus.carelse at MRC.AC.ZA (Carinus Carelse)
Date: Thu Jan 12 21:27:36 2006
Subject: Upgrade Query
Message-ID: <mailman.4718.1137101256.24926.mailscanner@lists.mailscanner.info>

I have MailScanner-4.31.6 and I want to upgrade to
MailScanner-4.35.11-1.  What is the best way to do the upgrade without
losing any settings.

Carinus

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ugob at CAMO-ROUTE.COM  Tue Nov 16 13:12:08 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:36 2006
Subject: Upgrade Query
Message-ID: <mailman.4719.1137101256.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Carinus Carelse wrote:
> I have MailScanner-4.31.6 and I want to upgrade to
> MailScanner-4.35.11-1.  What is the best way to do the upgrade without
> losing any settings.

Please see the install/upgrade section of the MAQ page (see url below)

>
> Carinus
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From joshua.hirsh at PARTNERSOLUTIONS.CA  Tue Nov 16 13:34:31 2004
From: joshua.hirsh at PARTNERSOLUTIONS.CA (Hirsh, Joshua)
Date: Thu Jan 12 21:27:36 2006
Subject: New question
Message-ID: <mailman.4720.1137101256.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> So I want sendmail to receive the email, check against the database if the
user is valid.
> If so, then Mailscanner will scan for spam and virus. Then give back to
sendmail to check
> against the database for the relay address to send to.
>
> Can this be done?


 Anything is possible if you write code for it =p

 That being said, it might be easier for you to just automate an extract
every hour of the users and relay destinations and build the required files
that Sendmail uses from that.

 Probably less overhead than having to check against an SQL source for every
incoming message.



 Cheers,

-Joshua

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From BBerglund at TECHPRO.COM  Tue Nov 16 13:57:52 2004
From: BBerglund at TECHPRO.COM (Brian Berglund)
Date: Thu Jan 12 21:27:36 2006
Subject: New question
Message-ID: <mailman.4721.1137101256.24926.mailscanner@lists.mailscanner.info>

Would it be good to just do an LDAP pull rather than a SQL pull?

My setup is quite different I am sure. But if anyone has a easy
solution. 

We are trying to validate users from 
5 - 6 exchange servers and an Imail server. 

Once the validation is done, then we will scan and relay to those
servers based on ip addresses. 

 Is anyone else doing something like this?


 

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Hirsh, Joshua
Sent: Tuesday, November 16, 2004 7:35 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: New question

> So I want sendmail to receive the email, check against the database if

> the
user is valid.
> If so, then Mailscanner will scan for spam and virus. Then give back 
> to
sendmail to check
> against the database for the relay address to send to.
>
> Can this be done?


 Anything is possible if you write code for it =p

 That being said, it might be easier for you to just automate an extract
every hour of the users and relay destinations and build the required
files that Sendmail uses from that.

 Probably less overhead than having to check against an SQL source for
every incoming message.



 Cheers,

-Joshua

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From joshua.hirsh at PARTNERSOLUTIONS.CA  Tue Nov 16 14:00:17 2004
From: joshua.hirsh at PARTNERSOLUTIONS.CA (Hirsh, Joshua)
Date: Thu Jan 12 21:27:36 2006
Subject: New question
Message-ID: <mailman.4722.1137101256.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> We are trying to validate users from
> 5 - 6 exchange servers and an Imail server.
>
> Once the validation is done, then we will scan and relay to those
> servers based on ip addresses.
>
>  Is anyone else doing something like this?


 Similar, but not nearly as many servers. I do something along those lines
for two Exchange servers here. However, in my case I build a recipient list
on each server and push it down to my MailScanner box, at which point the
two files are merged together into a list of all possible recipients. In my
case the routing is done on a per domain basis, so I have static entries in
my transports file to redirect the domains to the appropriate server. It
wouldn't be too hard to have it redirect on a per user basis though.


 My particular setup is loosely based on the following two articles:

 http://www.unixwiz.net/techtips/postfix-exchange-users.html

 http://postfix.state-of-mind.de/patrick.koetter/mailrelay/


 Cheers,
-Joshua

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From el.baby at gmail.com  Tue Nov 16 14:04:33 2004
From: el.baby at gmail.com (Mariano Absatz)
Date: Thu Jan 12 21:27:36 2006
Subject: filetype rules (was Re: Pregunta sobre Mailscanner)
Message-ID: <mailman.4723.1137101256.24926.mailscanner@lists.mailscanner.info>

Hola Henry,

I'll answer in English so the list can profit from it too... I'm not
working with MailScanner right now so I'm not active in the list...
anyway, here it goes:

for what I see in the logs, the filetype rules don't seem to be
running at all... what do you have (in MailScanner.conf) in the
following entries:
%etc-dir% =
File Command =
File Timeout =
Filetype Rules =
Log Permitted Filetypes =

also, at the shell prompt say:
$ which file

and tell me what it says.

If I have to make a guess, 'File Command' may be blank or wrong...

On Tue, 9 Nov 2004 12:15:35 -0500, Henry Burbano
<hburbano@novadevices.com> wrote:
> Hola, te escribo para preguntarte si me podiras ayudar a resolver un
> problema con MailScanner, ya he posteado a la lista, pero no responden,
> estoy tratando de configurar reglas para utilizar filetype, pero me sale el
> siguiente mensaje:
>
> Nov  9 11:41:18 kypus MailScanner[3815]: New Batch: Scanning 1 messages,
> 3679528 bytes
> Nov  9 11:41:18 kypus MailScanner[3815]: MCP Checks: Starting
> Nov  9 11:41:18 kypus MailScanner[3815]: Spam Checks: Starting
> Nov  9 11:41:20 kypus MailScanner[3815]: Virus and Content Scanning:
> Starting
> Nov  9 11:41:22 kypus MailScanner[3815]: Filename Checks: Allowing
> iA9Gf2Xb023475 msg-3815-1.txt (no rule matched)
> Nov  9 11:41:22 kypus MailScanner[3815]: Filename Checks: Allowing
> iA9Gf2Xb023475 SockNovaManager.exe (no rule matched)
> Nov  9 11:41:22 kypus MailScanner[3815]: Filename Checks: Allowing
> iA9Gf2Xb023475 shakira.exe (no rule matched)
> Nov  9 11:41:22 kypus MailScanner[3815]: Filename Checks: Allowing
> iA9Gf2Xb023475 Shakira.scr (no rule matched)
> Nov  9 11:41:22 kypus MailScanner[3815]: Uninfected: Delivered 1 messages
>
> mi archivo filetype.rules.conf:
>
> allow text - -
> allow script - -
> allow archive - -
> deny self-extract No self-extracting archives No self-extracting archives
> deny ELF No executables No executables
> deny executable No executables No executables
> deny MPEG No MPEG movies No MPEG movies
> deny AVI No AVI movies No AVI movies
> deny MNG No MNG/PNG movies No MNG/PNG movies
> deny QuickTime No QuickTime movies No QuickTime movies
> deny Registry No Windows Registry entries No Windows Registry entries
>
> Saludos y gracias,
>
>


--
Mariano Absatz - El Baby
el (dot) baby (AT) gmail (dot) com
el (punto) baby (ARROBA:@) gmail (punto) com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dustin.baer at IHS.COM  Tue Nov 16 14:05:14 2004
From: dustin.baer at IHS.COM (Dustin Baer)
Date: Thu Jan 12 21:27:36 2006
Subject: whitelist rules are being overridden by the blacklist rules ?
Message-ID: <mailman.4724.1137101256.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Venkata Achanta wrote:

>hello all,
>
>I have the following rule set listed in blacklist.rules
>From:   *@domain.com and To: *@domain.com   yes
>
>( i want to disallow spoofing )
>
>
>and i allowed this in whitelist.rules
>
>From:   no-reply@domain.com   yes
>To:     no-reply@domain.com   yes
>
>
Put the above as "no" in your blacklist rules.

Dustin

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at MARKF.MAILSHELL.COM  Tue Nov 16 14:26:34 2004
From: mailscanner at MARKF.MAILSHELL.COM (Mark Fyvie)
Date: Thu Jan 12 21:27:36 2006
Subject: Problems with SA/Mailscanner using different perl versions
Message-ID: <mailman.4725.1137101256.24926.mailscanner@lists.mailscanner.info>

Hi Martin,

        Thanks for that tip, I found that I had originally been using the
rpm version, I found (on closer inspection) that the non-rpm version had an
additional --perl switch, and I used this (and while it was installing I saw
it referencing the 5.8.0 version of perl!). So this installed a parallel
version of mailscanner in /opt/MailScanner, so I decided to keep this one
and changed the check_mailscanner file to point to this one instead.
Relevant config options:

process=MailScanner
msbindir=/opt/MailScanner/bin (the location of the freshly installed
MailScanner which points to my 5.8.0 version of perl)
config=/etc/MailScanner/MailScanner.conf (my existing config file)

# These seem to get put all over the shop...
PATH=/home/perl/bin:/usr/bin:/bin (I put the new perl path in front just in
case...)
export PATH
PERL=/home/perl/bin/perl (the path to my 5.8.0 version)

        I then fire up mailscanner in debug mode, and get the same error I
got before :-(

Starting MailScanner daemons:
         incoming sendmail: ok
         outgoing sendmail: ok
         MailScanner:       In Debugging mode, not forking...
SpamAssassin installation could not be found at
/opt/MailScanner/lib/MailScanner/SA.pm line 119

The relevant line is:
   MailScanner::Log::DieLog("SpamAssassin installation could not be found")
      unless eval "require Mail::SpamAssassin";

So as I understand it, the SA modules are not being found in my perl
installation. So I double checked:

[root MailScanner]# /home/perl/bin/perl -MMail::SpamAssassin -e 1

Nothing is returned, so the module is installed. This confirms that it is
living in my 5.8.0 version

[root MailScanner]# /usr/bin/perl -MMail::SpamAssassin -e 1
Can't locate Mail/SpamAssassin.pm in @INC (@INC contains:
/usr/lib/perl5/5.00503/i386-linux /usr/lib/perl5/5.00503
/usr/lib/perl5/site_perl/5.005/i386-linux /usr/lib/perl5/site_perl/5.005 .).
BEGIN failed--compilation aborted.

This is my 5.005 version. SpamAssassin doesn't live there (because I deleted
it earlier, since 3.0 and above can't run with this version)

[root MailScanner]# perl -MMail::SpamAssassin -e 1
Can't locate Mail/SpamAssassin.pm in @INC (@INC contains:
/usr/lib/perl5/5.00503/i386-linux /usr/lib/perl5/5.00503
/usr/lib/perl5/site_perl/5.005/i386-linux /usr/lib/perl5/site_perl/5.005 .).
BEGIN failed--compilation aborted.

This just confirms that the path environment variable brings us to the 5.005
version.

So I guess I am back to square 1: I've told MailScanner to use my 5.8.0
version, but it still seems to be running SA.pm with the old one. Is there
anything else I may have missed?

Mark

> -----Original Message-----
> From: MailScanner mailing list 
> [mailto:MAILSCANNER.at.JISCMAIL.AC.UK@mailscanner.at.markf.mai
> lshell.com] On Behalf Of Martin Hepworth
> Sent: 16 November 2004 14:17
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Problems with SA/Mailscanner using different 
> perl versions
> 
> 
> Mark
> 
> if you use the tar.gz version to install there's an option on 
> the 'install' script to tell it where to look for the correct 
> perl version..
> 
> 
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
> 
> 
> Mark Fyvie wrote:
> > Hi list,
> >
> >  I have a small problem. Well actually it is not so small. I'm no 
> > linux expert, but have had a bit of experience tinkering 
> around on my 
> > Cobalt RAQ4 (based on Redhat), so please bear with me...
> >
> >  I was running Mailscanner 4.30 and what I thought was SpamAssassin 
> > 2.63 (turns out that Mailscanner 4.30 was actually referencing a 
> > previous installation of SA 2.55!). Last weekend I decided 
> to upgrade 
> > to SpamAssassin 3.01, so at the same time I upgraded to MailScanner 
> > 4.35.
> >
> >  After reading through all the help files, FAQs, and every bit of 
> > documentation I could find for MailScanner and SpamAssassin 
> I did make 
> > considerable progress. For example, I discovered that SA 2.55 was 
> > still being referenced by the new version of MailScanner 
> and all sorts 
> > of other issues. I completely purged my system of previous 
> versions of 
> > both programs.
> >
> >  Before I go on I should mention that I am running two versions of 
> > Perl, and have been doing so for quite some time. The 
> version which is 
> > shipped with the RAQ4 is 5.005. I also installed 5.8.0 in 
> parallel to 
> > this. If I need to use the newer version in a given script 
> I usually 
> > just change the #!/usr/bin/perl line at the start of the 
> script. Why 
> > did I keep the old version of perl? Well after some 
> investigation it 
> > seems that many of the built-in functions and scripts used 
> by the RAQ 
> > will break if the original perl version is removed, so I decided to 
> > run both in parallel.
> >
> >  Now the issue here is that the new SpamAssassin no longer 
> works with 
> > any of the old perl versions, so I installed it into my 5.8.0. The 
> > problem I have is that MailScanner is running with my 5.005 
> version, 
> > so when SA.pm does its check to see if SpamAssassin is present, it 
> > reports that it cannot find SpamAssassin. I've tried 
> playing with the 
> > paths in the MailScanner.conf file, turning on all the 
> debugs, adding 
> > the line #!/home/perl/bin/perl (this points to 5.8.0) to 
> SA.pm, but no 
> > luck.
> >
> >  I tried to reinstall MailScanner (I always did it via 
> make) to see if 
> > there were any options I could choose to specify a 
> different copy of 
> > perl, but I could find no such options. I could find routines that 
> > searched for multiple versions of perl and simply told the 
> user that 
> > it wasn't a good idea. The FAQ on the mailscanner site says 
> something 
> > similar, along the lines of "It's not bad to have more than one 
> > version, but you'll have less problems if you choose just one".
> >
> >  My problem is that I can't just have one version. My question is 
> > this: How do I either A> Install mailscanner so that it 
> uses my 5.8.0 
> > version exclusively, or B> Tell it to use 5.8.0 when it calls any 
> > scripts related to the use of SpamAssassin?
> >
> >  Thanks in advance for your help.
> >
> > Regards,
> > Mark
> >
> > ------------------------ MailScanner list 
> ------------------------ To 
> > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave 
> > mailscanner' in the body of the email. Before posting, read the MAQ 
> > (http://rd.mailshell.com/www.mailscanner.biz/maq/) and the archives 
> > (http://rd.mailshell.com/www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> > Support MailScanner development - buy the book off the website!
> 
> **********************************************************************
> 
> This email and any files transmitted with it are confidential 
> and intended solely for the use of the individual or entity 
> to whom they are addressed. If you have received this email 
> in error please notify the system manager.
> 
> This footnote confirms that this email message has been swept 
> for the presence of computer viruses and is believed to be clean.
> 
> **********************************************************************
> 
> ------------------------ MailScanner list 
> ------------------------ To unsubscribe, email 
> jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' 
> in the body of the email. Before posting, read the MAQ 
> (http://rd.mailshell.com/www.mailscanner.biz/m> aq/) and the 
> archives 
> (http://rd.mailshell.com/www.jiscmail.ac.uk/lists/mailscanner.html).
> 
> Support MailScanner development - buy the book off the website!
> 
> 
> ---------- Your email is protected by Mailshell ---------- 
> To block spam or change delivery options: 
> http://www.mailshell.com/control.html?a=bmy5s24s45xydj4ejzp36_
bv07u4ae_c48_jl5

FreshAddress.com http://rd.mailshell.com/ad482
Earn up to $3 for each of your friends who signs up with Mailshell!
http://rd.mailshell.com/sp5

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Tue Nov 16 15:24:30 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:36 2006
Subject: Mailto's being marked as detected fraud attempt.
Message-ID: <mailman.4726.1137101256.24926.mailscanner@lists.mailscanner.info>

I published the one yesterday to stop this problem. Are you 100% sure you
are using the right version? It should be 166111 bytes long.


On 16/11/04 12:39 pm, "Ed Bruce" <ebruce@HPMICH.COM> wrote:

      I'm seeing this problem now were mailto: is being marked as
      detected fraud attempt. I've just installed the latest
      Message.pm from yesterday.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From mailscanner at ecs.soton.ac.uk  Tue Nov 16 15:28:07 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:36 2006
Subject: Problems with SA/Mailscanner using different perl versions
Message-ID: <mailman.4727.1137101256.24926.mailscanner@lists.mailscanner.info>

Check the first line of /opt/MailScanner/bin/MailScanner.

On 16/11/04 2:26 pm, "Mark Fyvie" <mailscanner@MARKF.MAILSHELL.COM> wrote:

> Hi Martin,
>
>         Thanks for that tip, I found that I had originally been using the
> rpm version, I found (on closer inspection) that the non-rpm version had an
> additional --perl switch, and I used this (and while it was installing I saw
> it referencing the 5.8.0 version of perl!). So this installed a parallel
> version of mailscanner in /opt/MailScanner, so I decided to keep this one
> and changed the check_mailscanner file to point to this one instead.
> Relevant config options:
>
> process=MailScanner
> msbindir=/opt/MailScanner/bin (the location of the freshly installed
> MailScanner which points to my 5.8.0 version of perl)
> config=/etc/MailScanner/MailScanner.conf (my existing config file)
>
> # These seem to get put all over the shop...
> PATH=/home/perl/bin:/usr/bin:/bin (I put the new perl path in front just in
> case...)
> export PATH
> PERL=/home/perl/bin/perl (the path to my 5.8.0 version)
>
>         I then fire up mailscanner in debug mode, and get the same error I
> got before :-(
>
> Starting MailScanner daemons:
>          incoming sendmail: ok
>          outgoing sendmail: ok
>          MailScanner:       In Debugging mode, not forking...
> SpamAssassin installation could not be found at
> /opt/MailScanner/lib/MailScanner/SA.pm line 119
>
> The relevant line is:
>    MailScanner::Log::DieLog("SpamAssassin installation could not be found")
>       unless eval "require Mail::SpamAssassin";
>
> So as I understand it, the SA modules are not being found in my perl
> installation. So I double checked:
>
> [root MailScanner]# /home/perl/bin/perl -MMail::SpamAssassin -e 1
>
> Nothing is returned, so the module is installed. This confirms that it is
> living in my 5.8.0 version
>
> [root MailScanner]# /usr/bin/perl -MMail::SpamAssassin -e 1
> Can't locate Mail/SpamAssassin.pm in @INC (@INC contains:
> /usr/lib/perl5/5.00503/i386-linux /usr/lib/perl5/5.00503
> /usr/lib/perl5/site_perl/5.005/i386-linux /usr/lib/perl5/site_perl/5.005 .).
> BEGIN failed--compilation aborted.
>
> This is my 5.005 version. SpamAssassin doesn't live there (because I deleted
> it earlier, since 3.0 and above can't run with this version)
>
> [root MailScanner]# perl -MMail::SpamAssassin -e 1
> Can't locate Mail/SpamAssassin.pm in @INC (@INC contains:
> /usr/lib/perl5/5.00503/i386-linux /usr/lib/perl5/5.00503
> /usr/lib/perl5/site_perl/5.005/i386-linux /usr/lib/perl5/site_perl/5.005 .).
> BEGIN failed--compilation aborted.
>
> This just confirms that the path environment variable brings us to the 5.005
> version.
>
> So I guess I am back to square 1: I've told MailScanner to use my 5.8.0
> version, but it still seems to be running SA.pm with the old one. Is there
> anything else I may have missed?

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ebruce at HPMICH.COM  Tue Nov 16 15:43:59 2004
From: ebruce at HPMICH.COM (Ed Bruce)
Date: Thu Jan 12 21:27:36 2006
Subject: Mailto's being marked as detected fraud attempt.
Message-ID: <mailman.4728.1137101256.24926.mailscanner@lists.mailscanner.info>

Thanks. I missed that and got the wrong one.

Julian Field wrote:
      I published the one yesterday to stop this problem. Are you
      100% sure you are using the right version? It should be
      166111 bytes long.


      On 16/11/04 12:39 pm, "Ed Bruce" MailScanner has detected a
      possible fraud attempt from "mailto:ebruce@hpmich.com"
      claiming to be <ebruce@HPMICH.COM> wrote:

            I'm seeing this problem now were mailto: is being
            marked as detected fraud attempt. I've just
            installed the latest Message.pm from yesterday.

      --
      Julian Field
      www.MailScanner.info
      Buy the MailScanner book at www.MailScanner.info/store

      PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415
      B654

      --
      This message has been scanned for viruses and
      dangerous content by Secure Resource, and is
      believed to be clean.
      MailScanner thanks transtec Computers for their support.
      ------------------------ MailScanner list
      ------------------------ To unsubscribe, email
      jiscmail@jiscmail.ac.uk with the words:
      'leave mailscanner' in the body of the email.
      Before posting, read the MAQ
      (http://www.mailscanner.biz/maq/)
      and the archives
      (http://www.jiscmail.ac.uk/lists/mailscanner.html).

      Support MailScanner development - buy the book off the
      website!


 --
Ed Bruce
Health Plan of Michigan
Senior Programmer
Phone:  248.226.1512
FAX:    248.204.6569


--
This message, including any attachments, is intended solely for the use
of the named
recipients(s) and may contain confidential and/or privileged information.
Any
unauthorized review, use, disclosure or distribution of this
communication is expressly
prohibited. If you are not the intended recipient, please contact the
sender by reply
e-mail and destroy any and all copies of the original message. Thank you
for your
cooperation.
--
This message has been scanned for viruses and
dangerous content by Secure Resource, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From hostmaster at AGIMSA.COM.MX  Tue Nov 16 15:56:24 2004
From: hostmaster at AGIMSA.COM.MX (Cecilia [iso-8859-1] Martínez)
Date: Thu Jan 12 21:27:36 2006
Subject: Oversized Zip?
Message-ID: <mailman.4729.1137101256.24926.mailscanner@lists.mailscanner.info>

Fedora C1 / Ensim Pro 4.01 / MailScanner / Sendmail / ClamAV / SpamAssassin


Hello,

Some ZIP attachments have been sent to quarantine because of their size,
which in fact I don't think it is too much (200-300 kb). I can't find where
to adjust this setting. Please help.

This is the info sent to managers regarding the scanned message:

Sender: user@domain.com
IP Address: 201.128.183.45
  Recipient: user1@domain.com, user2@domain.com
    Subject: re-envio de informacion
  MessageID: iAGFQfsg006140
    Info: PU_SINAN_A_USD_REV_1.zip contains Oversized Zip
     Info: PU_SINAN_B_USD_REV_1.zip contains Oversized Zip


Thanks

Cecilia Mtz



--
Mensaje escaneado por el servicio Anti-Virus de correo de CEGIMSA

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Tue Nov 16 16:36:28 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:36 2006
Subject: Oversized Zip?
Message-ID: <mailman.4730.1137101256.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

This is almost certainly being generated by ClamAV which has checks in it to
catch large zip files. Check your ClamAV configuration.


On 16/11/04 3:56 pm, "Cecilia Martínez" <hostmaster@AGIMSA.COM.MX> wrote:

> Fedora C1 / Ensim Pro 4.01 / MailScanner / Sendmail / ClamAV / SpamAssassin
> 
> 
> Hello,
> 
> Some ZIP attachments have been sent to quarantine because of their size,
> which in fact I don't think it is too much (200-300 kb). I can't find where
> to adjust this setting. Please help.
> 
> This is the info sent to managers regarding the scanned message:
> 
> Sender: user@domain.com
> IP Address: 201.128.183.45
>   Recipient: user1@domain.com, user2@domain.com
>     Subject: re-envio de informacion
>   MessageID: iAGFQfsg006140
>     Info: PU_SINAN_A_USD_REV_1.zip contains Oversized Zip
>      Info: PU_SINAN_B_USD_REV_1.zip contains Oversized Zip

-- 
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
-- 
Julian Field
jkf@ecs.soton.ac.uk
Teaching Systems Manager
Electronics & Computer Science
University of Southampton
SO17 1BJ, UK

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at MARKF.MAILSHELL.COM  Tue Nov 16 18:10:28 2004
From: mailscanner at MARKF.MAILSHELL.COM (Mark Fyvie)
Date: Thu Jan 12 21:27:36 2006
Subject: Problems with SA/Mailscanner using different perl versions
Message-ID: <mailman.4731.1137101256.24926.mailscanner@lists.mailscanner.info>

Thanks Julian,

        That did the trick. Just as a side note, I think it would be a
really great idea if there were a document that described all the various
components in mailscanner (and its implementation of spamassassin). For
example, what calls what right from the beginning, and where are various
things configured. For example, MailScanner.conf is not the only
configuration file, and sometimes multiple copies of files might exist in
different parts of the system, and it can be struggle to determine which
ones are being read. Maybe I'm just a bit slow but it took me a long time of
reading various documents, and googling all over the place to try and figure
out which files were related to which.

        Just my two cents worth...

Mark

P.S. Google hasn't seemed to have indexed the archives of this list. Not
sure if that is deliberate, but it would make it easier for people trying to
solve mailscanner problems (imho)

> -----Original Message-----
> From: MailScanner mailing list 
> [mailto:MAILSCANNER.at.JISCMAIL.AC.UK@mailscanner.at.markf.mai
> lshell.com] On Behalf Of Julian Field
> Sent: 16 November 2004 17:28
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Problems with SA/Mailscanner using different 
> perl versions
> 
> 
> Check the first line of /opt/MailScanner/bin/MailScanner.
> 
> On 16/11/04 2:26 pm, "Mark Fyvie" 
> <mailscanner@MARKF.MAILSHELL.COM> wrote:
> 
> > Hi Martin,
> >
> >         Thanks for that tip, I found that I had originally 
> been using 
> > the rpm version, I found (on closer inspection) that the non-rpm 
> > version had an additional --perl switch, and I used this 
> (and while it 
> > was installing I saw it referencing the 5.8.0 version of perl!). So 
> > this installed a parallel version of mailscanner in 
> /opt/MailScanner, 
> > so I decided to keep this one and changed the 
> check_mailscanner file 
> > to point to this one instead. Relevant config options:
> >
> > process=MailScanner
> > msbindir=/opt/MailScanner/bin (the location of the freshly 
> installed 
> > MailScanner which points to my 5.8.0 version of perl) 
> > config=/etc/MailScanner/MailScanner.conf (my existing config file)
> >
> > # These seem to get put all over the shop... 
> > PATH=/home/perl/bin:/usr/bin:/bin (I put the new perl path in front 
> > just in
> > case...)
> > export PATH
> > PERL=/home/perl/bin/perl (the path to my 5.8.0 version)
> >
> >         I then fire up mailscanner in debug mode, and get the same 
> > error I got before :-(
> >
> > Starting MailScanner daemons:
> >          incoming sendmail: ok
> >          outgoing sendmail: ok
> >          MailScanner:       In Debugging mode, not forking...
> > SpamAssassin installation could not be found at 
> > /opt/MailScanner/lib/MailScanner/SA.pm line 119
> >
> > The relevant line is:
> >    MailScanner::Log::DieLog("SpamAssassin installation 
> could not be found")
> >       unless eval "require Mail::SpamAssassin";
> >
> > So as I understand it, the SA modules are not being found 
> in my perl 
> > installation. So I double checked:
> >
> > [root MailScanner]# /home/perl/bin/perl -MMail::SpamAssassin -e 1
> >
> > Nothing is returned, so the module is installed. This 
> confirms that it 
> > is living in my 5.8.0 version
> >
> > [root MailScanner]# /usr/bin/perl -MMail::SpamAssassin -e 1 Can't 
> > locate Mail/SpamAssassin.pm in @INC (@INC contains: 
> > /usr/lib/perl5/5.00503/i386-linux /usr/lib/perl5/5.00503 
> > /usr/lib/perl5/site_perl/5.005/i386-linux 
> > /usr/lib/perl5/site_perl/5.005 .). BEGIN 
> failed--compilation aborted.
> >
> > This is my 5.005 version. SpamAssassin doesn't live there 
> (because I 
> > deleted it earlier, since 3.0 and above can't run with this version)
> >
> > [root MailScanner]# perl -MMail::SpamAssassin -e 1
> > Can't locate Mail/SpamAssassin.pm in @INC (@INC contains: 
> > /usr/lib/perl5/5.00503/i386-linux /usr/lib/perl5/5.00503 
> > /usr/lib/perl5/site_perl/5.005/i386-linux 
> > /usr/lib/perl5/site_perl/5.005 .). BEGIN 
> failed--compilation aborted.
> >
> > This just confirms that the path environment variable 
> brings us to the 
> > 5.005 version.
> >
> > So I guess I am back to square 1: I've told MailScanner to use my 
> > 5.8.0 version, but it still seems to be running SA.pm with the old 
> > one. Is there anything else I may have missed?
> 
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> 
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> 
> ------------------------ MailScanner list 
> ------------------------ To unsubscribe, email 
> jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' 
> in the body of the email. Before posting, read the MAQ 
> (http://rd.mailshell.com/www.mailscanner.biz/m> aq/) and the 
> archives 
> (http://rd.mailshell.com/www.jiscmail.ac.uk/lists/mailscanner.html).
> 
> Support MailScanner development - buy the book off the website!
> 
> 
> ---------- Your email is protected by Mailshell ---------- 
> To block spam or change delivery options: 
> http://www.mailshell.com/control.html?a=bmy5s24s45xydj4ejzp36_
bv07u4ae_c48_jl5

ReturnPath.net http://rd.mailshell.com/ad481
Earn up to $3 for each of your friends who signs up with Mailshell!
http://rd.mailshell.com/sp5

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Tue Nov 16 18:20:29 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:36 2006
Subject: Problems with SA/Mailscanner using different perl versions
Message-ID: <mailman.4732.1137101256.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I think the book covers a lot of this. Do others agree?

What do you mean about multiple copies of files? Other applications may
happen to use the filenames I do, but that's not something I can control.

I don't run the mailing list server, you could direct this to their help
desk.

Mark Fyvie wrote:

>Thanks Julian,
>
>        That did the trick. Just as a side note, I think it would be a
>really great idea if there were a document that described all the various
>components in mailscanner (and its implementation of spamassassin). For
>example, what calls what right from the beginning, and where are various
>things configured. For example, MailScanner.conf is not the only
>configuration file, and sometimes multiple copies of files might exist in
>different parts of the system, and it can be struggle to determine which
>ones are being read. Maybe I'm just a bit slow but it took me a long time of
>reading various documents, and googling all over the place to try and figure
>out which files were related to which.
>
>        Just my two cents worth...
>
>Mark
>
>P.S. Google hasn't seemed to have indexed the archives of this list. Not
>sure if that is deliberate, but it would make it easier for people trying to
>solve mailscanner problems (imho)
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jaearick at COLBY.EDU  Tue Nov 16 18:27:44 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:36 2006
Subject: SAVI-Perl 0.20 released
Message-ID: <mailman.4733.1137101256.24926.mailscanner@lists.mailscanner.info>

Gang,

Alas, This guy won't compile with Sun's cc (Forte) compiler:

cp SAVI.pm blib/lib/SAVI.pm
AutoSplitting blib/lib/SAVI.pm (blib/lib/auto/SAVI)
/usr/bin/perl /opt/perl5/lib/5.8.5/ExtUtils/xsubpp  -typemap
/opt/perl5/lib/5.8.5/ExtUtils/typemap -typemap typemap  SAVI.xs > SAVI.xsc
&& mv SAVI.xsc SAVI.c
Please specify prototyping behavior for SAVI.xs (see perlxs manual)
/opt/SUNWspro/bin/cc -c  -I. -I/opt/openssl/include
-I/opt/BerkeleyDB/include -I/usr/local/include -D_LARGEFILE_SOURCE
-D_FILE_OFFSET_BITS=64 -O   -DVERSION=\"0.20\" -DXS_VERSION=\"0.20\" -KPIC
"-I/opt/perl5/lib/5.8.5/sun4-solaris/CORE"   SAVI.c
"sav_if/s_comput.h", line 838: #error: Unsupported compiler
cc: acomp failed for SAVI.c
gmake: *** [SAVI.o] Error 2

I reduced the full path of Forte C down to "cc" and it didn't work.
I'll report this to Paul Henson and see what he says.

Jeff Earickson
Colby College

On Mon, 15 Nov 2004, Julian Field wrote:

> Date: Mon, 15 Nov 2004 02:30:17 +0000
> From: Julian Field <mailscanner@ECS.SOTON.AC.UK>
> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: SAVI-Perl 0.20 released
>
> For users of the "sophossavi" virus scanner setting, a new version 0.20
> of the SAVI-Perl module has been released. You can get it from
> http://www.csupomona.edu/~henson/www/projects/SAVI-Perl/dist/
>
> I have just installed this module in the same way as I have installed
> its predecessors, and it appears to work fine with MailScanner 4.35.11.
> I haven't tried earlier versions, but the MailScanner SAVI code hasn't
> changed for a very long time. Please report any problems you see.
>
> Unpack the .tar.gz file
> cd SAVI-Perl-0.20
> Edit Makefile.PL
> Change /opt/local/lib to /usr/local/Sophos/lib in both places
> perl Makefile.PL
> make
> make test
> make install
>
> Then restart MailScanner.
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at MARKF.MAILSHELL.COM  Tue Nov 16 18:28:07 2004
From: mailscanner at MARKF.MAILSHELL.COM (Mark Fyvie)
Date: Thu Jan 12 21:27:36 2006
Subject: Problems with SA/Mailscanner using different perl versions
Message-ID: <mailman.4734.1137101256.24926.mailscanner@lists.mailscanner.info>

Hi Julian,

        Unfortunately I don't have the book, but I'll be sure to try and buy
it. Of course, when one gets into trouble, one doesn't always have the book
to hand, which is where online documentation has always been a great idea!

        I'll send an email to the lists helpdesk.

Mark

P.S. Great software - thanks for all your great work!

> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER.at.JISCMAIL.AC.UK@mailscanner.at.markf.mai
> lshell.com] On Behalf Of Julian Field
> Sent: 16 November 2004 20:20
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Problems with SA/Mailscanner using different
> perl versions
>
>
> I think the book covers a lot of this. Do others agree?
>
> What do you mean about multiple copies of files? Other
> applications may happen to use the filenames I do, but that's
> not something I can control.
>
> I don't run the mailing list server, you could direct this to
> their help desk.
>
> Mark Fyvie wrote:
>
> >Thanks Julian,
> >
> >        That did the trick. Just as a side note, I think it
> would be a
> >really great idea if there were a document that described all the
> >various components in mailscanner (and its implementation of
> >spamassassin). For example, what calls what right from the
> beginning,
> >and where are various things configured. For example,
> MailScanner.conf
> >is not the only configuration file, and sometimes multiple copies of
> >files might exist in different parts of the system, and it can be
> >struggle to determine which ones are being read. Maybe I'm
> just a bit
> >slow but it took me a long time of reading various documents, and
> >googling all over the place to try and figure out which files were
> >related to which.
> >
> >        Just my two cents worth...
> >
> >Mark
> >
> >P.S. Google hasn't seemed to have indexed the archives of this list.
> >Not sure if that is deliberate, but it would make it easier
> for people
> >trying to solve mailscanner problems (imho)
> >
> >
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list
> ------------------------ To unsubscribe, email
> jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner'
> in the body of the email. Before posting, read the MAQ
> (http://rd.mailshell.com/www.mailscanner.biz/m> aq/) and the
> archives
> (http://rd.mailshell.com/www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
>
> ---------- Your email is protected by Mailshell ----------
> To block spam or change delivery options:
> http://www.mailshell.com/control.html?a=bmy5s24s45xydj4ejzp36_
bv07u4ae_c48_jl5

Wouldn't you rather have mark.com as your personal domain?
http://rd.mailshell.com/ad465 Earn up to $3 for each of your friends who
signs up with Mailshell! http://rd.mailshell.com/sp5

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ugob at CAMO-ROUTE.COM  Tue Nov 16 18:25:31 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:36 2006
Subject: Problems with SA/Mailscanner using different perl versions
Message-ID: <mailman.4735.1137101256.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

>
> P.S. Google hasn't seemed to have indexed the archives of this list. Not
> sure if that is deliberate, but it would make it easier for people trying to
> solve mailscanner problems (imho)

I think google just can't index gmane, because of its dynamic nature.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From vachanta at GMAIL.COM  Wed Nov 17 00:52:42 2004
From: vachanta at GMAIL.COM (Venkata Achanta)
Date: Thu Jan 12 21:27:36 2006
Subject: design issue - whitelist rules/blacklist rules
Message-ID: <mailman.4736.1137101256.24926.mailscanner@lists.mailscanner.info>

Julian,

I am trying to accomplish the following

DENY   Anything From *@domain.com To *@domain.com
EXCEPT From no-reply@domain.com To *@domain.com

I have tried different combinations of whitelist and blacklist rules to get
this working and cant get it to work.

blacklist.rules
From:   *@domain.com and To: *@domain.com   yes
From:   no-reply@domain.com and To: *@domain.com   no
( WTH am i doing this? i want to disallow spoofing.MS running Linux box
delivers clean messages to our exchange server so all internal e-mail wont
go thru the MS box )

whitelist.rules
From:   no-reply@domain.com   yes
From:   no-reply@domain.com and To: *@domain.com   yes

(these are some administrative scipts e-mailing from that e-mail addy, i got
to get those but they are getting tagged as spam)


Here are the logs to reinforce my statements:

Nov 15 14:36:12 host sendmail[26920]: iAFMaCJI026920:
from=<no-reply@domain.com>, size=902, class=0, nrcpts=1,
msgid=<200411152236.iAFMaCJI026920@host.domain.com>, proto=ESMTP,
daemon=MTA, relay=host [127.0.0.1]
Nov 15 13:52:02 host MailScanner[29537]: Message iAFLldov018164 from
127.0.0.1 (no-reply@domain.com) is whitelisted
Nov 15 13:52:02 host MailScanner[29537]: Message iAFLldov018164 from
127.0.0.1 (no-reply@domain.com) to domain.com is spam (blacklisted)
Nov 15 13:53:18 host sendmail[24290]: iAFLldov018164: to=<johnq@domain.com>,
delay=00:05:39, xdelay=00:00:00, mailer=esmtp, pri=120902,
relay=[192.168.1.1], dsn=2.0.0, stat=Sent (
<200411152147.iAFLldov018164@domain.com> Queued mail for delivery)

And i dont understand why we are looking at blacklist rules and marking it
as spam if it is already whitelisted in the first place.Is this a design flaw ?

I want to hear from you what the design of this part of the mailscanner is ?
Doesnt the whitelist stuff override the blackklist ? why is it getting
blacklisted ?

Isnt there a way to do "deny by exception" in the mailscanner , i thought it
did but the logs prove me wrong.

Please advice.

Thanks much,
Venkata Achanta




I already started the discussion under "Re: whitelist rules are being
overridden by the blacklist rules ?" ,if you want to look what else i tried.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From carinus.carelse at MRC.AC.ZA  Wed Nov 17 04:50:26 2004
From: carinus.carelse at MRC.AC.ZA (Carinus Carelse)
Date: Thu Jan 12 21:27:36 2006
Subject: Upgrade Query
Message-ID: <mailman.4737.1137101256.24926.mailscanner@lists.mailscanner.info>

Ja thats the rpm upgrade though i want to upgrade a sparc server with the
tar.gz version.

Carinus

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Q.G.Campbell at NEWCASTLE.AC.UK  Wed Nov 17 08:04:43 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:36 2006
Subject: Mailto's being marked as detected fraud attempt.
Message-ID: <mailman.4738.1137101256.24926.mailscanner@lists.mailscanner.info>

Julian

I installed your latest version of Message.pm (the 166111 byte version)
early on Tuesday.

Prior to that the log entries read:

  "Found phishing fraud from mailto:bloggs@domain.com claiming to be
bloggs@domain.com"

After installing this fixed version (166111 bytes) the logs entries now
read:

  "Found phishing fraud from dave@somewhere.com claiming to be
mailto:dave@somewhere.com"

The latter looks more believable but still not desirable in my view. Why
can't this special case be ignored? 

I made the change to the 166111 byte version at about 08:20 on Tuesday.
Later that day complaints started coming in about messages being
"mangled". The complainants usually did not include the affected
message. When they did it was clear the "mangled" messages had actually
been received on the Monday, _before_ I installed your latest
Message.pm.

Quentin
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own." 

 


________________________________

        From: MailScanner mailing list
[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
        Sent: 16 November 2004 15:25
        To: MAILSCANNER@JISCMAIL.AC.UK
        Subject: Re: Mailto's being marked as detected fraud attempt.
	
	
        I published the one yesterday to stop this problem. Are you 100%
sure you are using the right version? It should be 166111 bytes long.
	
	
        On 16/11/04 12:39 pm, "Ed Bruce" <ebruce@HPMICH.COM> wrote:
	
	

                I'm seeing this problem now were mailto: is being marked
as detected fraud attempt. I've just installed the latest Message.pm
from yesterday.
        	
        	

        -- 
        Julian Field
        www.MailScanner.info
        Buy the MailScanner book at www.MailScanner.info/store
	
        PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
        ------------------------ MailScanner list
------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk
with the words:
        'leave mailscanner' in the body of the email.
        Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
        and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html). 
	
        Support MailScanner development - buy the book off the website! 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jaearick at COLBY.EDU  Tue Nov 16 21:38:57 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:36 2006
Subject: SAVI-Perl 0.20 released
Message-ID: <mailman.4739.1137101256.24926.mailscanner@lists.mailscanner.info>

Gang,

I have corresponded with Paul Henson this afternoon about the problem
of SAVI-Perl-0.20 not working with Sun (Forte or StudioONE) compilers.
He sent me a new version of sav_if/s_comput.h which corrects this
problem, I tried it, and it works.  I have the modified version of 0.20
installed with my MailScanner 4.35.11 and SophosSAVI is working.

Paul has indicated that he will roll a new version of SAVI-Perl as a
result of this change.  Keep your eyes peeled for it.

Jeff Earickson
Colby College

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From hb.maillists at DFS.DK  Tue Nov 16 21:53:53 2004
From: hb.maillists at DFS.DK (Henrik Bro)
Date: Thu Jan 12 21:27:36 2006
Subject: Howto relay mails with a "mailscanner-relay-server"?
Message-ID: <mailman.4740.1137101256.24926.mailscanner@lists.mailscanner.info>

Hi all!

I have looked at mailscanner site, and as I can understand, it gives me 2
solutions.

I want to have a "mailscanner-relay-server" that can relay mails to an
internal mailserver but also to mailservers outside my network.

"relay-domains"

http://www.sng.ecs.soton.ac.uk/mailscanner/faq.shtml#16


"mailertable"

http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/152.html

Any thoughts on what solutions I should prefer?

/henrik

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From peter at UCGBOOK.COM  Tue Nov 16 22:11:47 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:36 2006
Subject: Howto relay mails with a "mailscanner-relay-server"?
Message-ID: <mailman.4741.1137101256.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Henrik Bro wrote:
> Hi all!
>
> I have looked at mailscanner site, and as I can understand, it gives me 2
> solutions.
>
> I want to have a "mailscanner-relay-server" that can relay mails to an
> internal mailserver but also to mailservers outside my network.
>
> "relay-domains"
>
> http://www.sng.ecs.soton.ac.uk/mailscanner/faq.shtml#16
>
>
> "mailertable"
>
> http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/152.html
>
> Any thoughts on what solutions I should prefer?

The mailertable solution is the best one, second paragraph on the page.

That FAQ entry (the first paragraph) is another example of people not
understanding what the FAQ-o-Matic is all about. There's numerous
questions in it, I have cleared a lot but find new stuff all the time.
If people can find it, can't they find this list too? I never recognize
their names in the entries. This particular entry can't easily be
modified since several others have answered his question.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Stephane.Lentz at ANSF.ALCATEL.FR  Tue Nov 16 23:07:54 2004
From: Stephane.Lentz at ANSF.ALCATEL.FR (Stephane Lentz)
Date: Thu Jan 12 21:27:36 2006
Subject: Oversized Zip?
Message-ID: <mailman.4742.1137101256.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Tue, Nov 16, 2004 at 09:56:24AM -0600, Cecilia Martínez wrote:
> Fedora C1 / Ensim Pro 4.01 / MailScanner / Sendmail / ClamAV / SpamAssassin
> 
> 
> Hello,
> 
> Some ZIP attachments have been sent to quarantine because of their size,
> which in fact I don't think it is too much (200-300 kb). I can't find where
> to adjust this setting. Please help.
> 
> This is the info sent to managers regarding the scanned message:
> 
> Sender: user@domain.com
> IP Address: 201.128.183.45
>  Recipient: user1@domain.com, user2@domain.com
>    Subject: re-envio de informacion
>  MessageID: iAGFQfsg006140
>    Info: PU_SINAN_A_USD_REV_1.zip contains Oversized Zip
>     Info: PU_SINAN_B_USD_REV_1.zip contains Oversized Zip
> 
> 
In clamd.conf, tune up ArchiveMaxCompressionRatio
Try 700 and if it does not solve all cases increase it
to 1000

SL/
---
Stephane Lentz 
AES TSC

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From rich at MAIL.WVNET.EDU  Tue Nov 16 23:52:50 2004
From: rich at MAIL.WVNET.EDU (Richard Lynch)
Date: Thu Jan 12 21:27:36 2006
Subject: Problem with ClamAVmodule
Message-ID: <mailman.4743.1137101256.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

This past weekend I upgraded our MailScanner servers to version
4.35.11-1 along with SA 3.0.1,  ClamAV-0.80, and Mail-ClamAV-0.13.  The
problem is that password protected zips always get flagged by
clamavmodule even when the recipient is listed as being allowed in a
ruleset for "Allow Password-Protected Archives".   I also have "Maximum
Archive Depth = 0".   The message in the maillog is...

... ClamAVModule::INFECTED:: Encrypted.Zip:: ...

When I run with Virus Scanners set to clamav things work as expected --
it's only when I use clamavmodule that I have this problem.  I suspect
that this is a bug in Mail-ClamAV but I suppose it could be a problem
with MS.  The relevant code is in  SweepViruses.pm at around line 998.  ...

      if (MailScanner::Config::Value('allowpasszips')) { # || $haverar) {
        $results = $Clam->scan("$dirname/$childname/$filename",
                               Mail::ClamAV::CL_SCAN_ARCHIVE() |
                               Mail::ClamAV::CL_SCAN_OLE2());
      } else {
        $results = $Clam->scan("$dirname/$childname/$filename",
                               Mail::ClamAV::CL_SCAN_ARCHIVE() |
                               Mail::ClamAV::CL_SCAN_BLOCKENCRYPTED() |
                               Mail::ClamAV::CL_SCAN_OLE2());
      }

The option CL_SCAN_BLOCKENCRYPTED is used by Mail-ClamAV to pass to
ClamAV and indicates that password protected zips should be treated as
infected.  It seems clear to me that MS is calling the interface
correctly depending on the setting of "Allow Protected-Protected Archives".

So... Is anyone else having this problem?   Am I doing something dumb?
(I realize that answers to these two questions are not necessarily
dependent :) ).

 If this is a Mail-ClamAV problem how does one get it reported?

Thanks,
Rich

--


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Text/X-VCARD (charset: UTF-8 "Internet-standard Unicode") ]
    [ (Name: "rich.vcf")  13 lines. ]
    [ Unable to print this part. ]


From ugob at CAMO-ROUTE.COM  Tue Nov 16 18:45:14 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:36 2006
Subject: Problems with SA/Mailscanner using different perl versions
Message-ID: <mailman.4744.1137101256.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Mark Fyvie wrote:
> Hi Julian,
>
>         Unfortunately I don't have the book, but I'll be sure to try and buy
> it. Of course, when one gets into trouble, one doesn't always have the book
> to hand, which is where online documentation has always been a great idea!
>

Personnaly, I think that the online documentation is very exhaustive.
There are the install docs, the FAQs, the MailScanner manual (from FSL),
the MAQ page and I think they cover all one should know to be able to
operate and manage a MailScanner server.  In fact, it is probably more
exhaustive than any manual for a proprietary application.

I may be blinded by the fact that I've been using MS for more than a
year, but for a standard setup, it is not that complex: config in
MailScanner.conf, SpamAssassin conf in spam.assassin.prefs.conf, rules
in the rules directory.  If you are playing in the program files
themselves (like message.pm), this is what I call a non-standard setup,
but Julian's directives for patches are usually very clear.

Of course, if you're beginning with MailScanner or if you have a special
setup or problem, it might not be addressed, so just post on this list
and we'll be there to help you.  Relevant problems are usually addressed
within 24 hours on this list, and they usually get fixed really quickly
as well.

Give you some time to learn about it.  It is quite complex, but it is
still understandable.

Hope this helps you and feel free to ask other questions if need be :).

Ugo

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From vachanta at GMAIL.COM  Tue Nov 16 19:59:02 2004
From: vachanta at GMAIL.COM (Venkata Achanta)
Date: Thu Jan 12 21:27:36 2006
Subject: whitelist rules are being overridden by the blacklist rules ?
Message-ID: <mailman.4745.1137101256.24926.mailscanner@lists.mailscanner.info>

>Put the above as "no" in your blacklist rules.

>Dustin


smart answer but that defeats the whole purpose of this.As i stated i want
to deny spoofing.FYI,Mail Scanner runs on a linux box and serves as our
mail gateway which delivers clean message to our exchange server. all
internal messages dont go to the mail scanner box so the blacklist
rule.hope u got my point ;-)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dustin.baer at IHS.COM  Tue Nov 16 20:29:40 2004
From: dustin.baer at IHS.COM (Dustin Baer)
Date: Thu Jan 12 21:27:36 2006
Subject: whitelist rules are being overridden by the blacklist rules ?
Message-ID: <mailman.4746.1137101256.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Venkata Achanta wrote:

>>Put the above as "no" in your blacklist rules.
>>
>>
> smart answer but that defeats the whole purpose of this.

If you are thinking that way, then no-reply@domain.com in your whitelist
would have still defeated your purpose, since "no-reply@domain.com" is
just as easy to spoof as "billybob@domain.com".

If you only want email From no-reply@domain.com, or To
no-reply@domain.com to come through, but anything else from *@domain.com
AND to *@domain.com, then try what I mentioned and test it:

blacklist.rules -

FromTo: no-reply@domain.com no
From: *@domain.com and To: *@domain.com   yes
FromTo: default no

If your desired goal isn't reached, let us know.  I'm sure someone
smarter than me can offer a solution.

Dustin

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From vachanta at GMAIL.COM  Tue Nov 16 21:08:24 2004
From: vachanta at GMAIL.COM (Venkata Achanta)
Date: Thu Jan 12 21:27:36 2006
Subject: whitelist rules are being overridden by the blacklist rules ?
Message-ID: <mailman.4747.1137101256.24926.mailscanner@lists.mailscanner.info>

>If your desired goal isn't reached, let us know.  I'm sure someone
>smarter than me can offer a solution.

The goal isn't reached the results didn't change when made the changes you
suggested. Any more ideas/solutions to accomplish this goal,anyone ?

thanks Dustin for the replies.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dustin.baer at IHS.COM  Tue Nov 16 21:15:41 2004
From: dustin.baer at IHS.COM (Dustin Baer)
Date: Thu Jan 12 21:27:36 2006
Subject: whitelist rules are being overridden by the blacklist rules ?
Message-ID: <mailman.4748.1137101256.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Venkata Achanta wrote:

>>If your desired goal isn't reached, let us know.  I'm sure someone
>>smarter than me can offer a solution.
>>
>>
>
>The goal isn't reached the results didn't change when made the changes you
>suggested. Any more ideas/solutions to accomplish this goal,anyone ?
>
>thanks Dustin for the replies.
>
Yep, sorry I couldn't help.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Wed Nov 17 09:04:43 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:36 2006
Subject: Problem with ClamAVmodule
Message-ID: <mailman.4749.1137101256.24926.mailscanner@lists.mailscanner.info>

You have found a bug, but I'm not sure it is easy to work around.
You need to set
Allow Password-Protected Archives = yes
and not use a ruleset. I allow a ruleset as this is only the case when using
the "clamavmodule" virus scanner. I guess I should put a check in there to
ensure that this is a simple value when using clamavmodule.

On 16/11/04 11:52 pm, "Richard Lynch" <rich@MAIL.WVNET.EDU> wrote:

> This past weekend I upgraded our MailScanner servers to version
> 4.35.11-1 along with SA 3.0.1,  ClamAV-0.80, and Mail-ClamAV-0.13.  The
> problem is that password protected zips always get flagged by
> clamavmodule even when the recipient is listed as being allowed in a
> ruleset for "Allow Password-Protected Archives".   I also have "Maximum
> Archive Depth = 0".   The message in the maillog is...
>
> ... ClamAVModule::INFECTED:: Encrypted.Zip:: ...
>
> When I run with Virus Scanners set to clamav things work as expected --
> it's only when I use clamavmodule that I have this problem.  I suspect
> that this is a bug in Mail-ClamAV but I suppose it could be a problem
> with MS.  The relevant code is in  SweepViruses.pm at around line 998.  ...
>
>       if (MailScanner::Config::Value('allowpasszips')) { # || $haverar) {
>         $results = $Clam->scan("$dirname/$childname/$filename",
>                                Mail::ClamAV::CL_SCAN_ARCHIVE() |
>                                Mail::ClamAV::CL_SCAN_OLE2());
>       } else {
>         $results = $Clam->scan("$dirname/$childname/$filename",
>                                Mail::ClamAV::CL_SCAN_ARCHIVE() |
>                                Mail::ClamAV::CL_SCAN_BLOCKENCRYPTED() |
>                                Mail::ClamAV::CL_SCAN_OLE2());
>       }
>
> The option CL_SCAN_BLOCKENCRYPTED is used by Mail-ClamAV to pass to
> ClamAV and indicates that password protected zips should be treated as
> infected.  It seems clear to me that MS is calling the interface
> correctly depending on the setting of "Allow Protected-Protected Archives".
>
> So... Is anyone else having this problem?   Am I doing something dumb?
> (I realize that answers to these two questions are not necessarily
> dependent :) ).
>
>  If this is a Mail-ClamAV problem how does one get it reported?
>
> Thanks,
> Rich
>
> --
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Wed Nov 17 09:05:10 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:36 2006
Subject: Mailto's being marked as detected fraud attempt.
Message-ID: <mailman.4750.1137101256.24926.mailscanner@lists.mailscanner.info>

Quentin

new version cam out on 15th at 14.16 (according to timestamp on Julian's
email). This fixes the mailto: issue.


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Quentin Campbell wrote:
> Julian
>
> I installed your latest version of Message.pm (the 166111 byte version)
> early on Tuesday.
>
> Prior to that the log entries read:
>
>   "Found phishing fraud from mailto:bloggs@domain.com claiming to be
> bloggs@domain.com"
>
> After installing this fixed version (166111 bytes) the logs entries now
> read:
>
>   "Found phishing fraud from dave@somewhere.com claiming to be
> mailto:dave@somewhere.com"
>
> The latter looks more believable but still not desirable in my view. Why
> can't this special case be ignored?
>
> I made the change to the 166111 byte version at about 08:20 on Tuesday.
> Later that day complaints started coming in about messages being
> "mangled". The complainants usually did not include the affected
> message. When they did it was clear the "mangled" messages had actually
> been received on the Monday, _before_ I installed your latest
> Message.pm.
>
> Quentin
> ---
> PHONE: +44 191 222 8209    Information Systems and Services (ISS),
>                            University of Newcastle,
>                            Newcastle upon Tyne,
> FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
> ------------------------------------------------------------------------
> "Any opinion expressed above is mine. The University can get its own."
>
>
>
>
> ________________________________
>
>         From: MailScanner mailing list
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>         Sent: 16 November 2004 15:25
>         To: MAILSCANNER@JISCMAIL.AC.UK
>         Subject: Re: Mailto's being marked as detected fraud attempt.
>
>
>         I published the one yesterday to stop this problem. Are you 100%
> sure you are using the right version? It should be 166111 bytes long.
>
>
>         On 16/11/04 12:39 pm, "Ed Bruce" <ebruce@HPMICH.COM> wrote:
>
>
>
>                 I'm seeing this problem now were mailto: is being marked
> as detected fraud attempt. I've just installed the latest Message.pm
> from yesterday.
>
>
>
>         --
>         Julian Field
>         www.MailScanner.info
>         Buy the MailScanner book at www.MailScanner.info/store
>
>         PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>         ------------------------ MailScanner list
> ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk
> with the words:
>         'leave mailscanner' in the body of the email.
>         Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
>         and the archives
> (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>         Support MailScanner development - buy the book off the website!
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Wed Nov 17 09:10:04 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:36 2006
Subject: Mailto's being marked as detected fraud attempt.
Message-ID: <mailman.4751.1137101256.24926.mailscanner@lists.mailscanner.info>

I have just tested it with
Contact <a href="mailto:steve.swaney@fsl.com">Steve.Swaney@fsl.com</a>
and it allowed it through just fine.


On 17/11/04 8:04 am, "Quentin Campbell" <Q.G.Campbell@NEWCASTLE.AC.UK>
wrote:

> Julian
>
> I installed your latest version of Message.pm (the 166111 byte version)
> early on Tuesday.
>
> Prior to that the log entries read:
>
>   "Found phishing fraud from mailto:bloggs@domain.com claiming to be
> bloggs@domain.com"
>
> After installing this fixed version (166111 bytes) the logs entries now
> read:
>
>   "Found phishing fraud from dave@somewhere.com claiming to be
> mailto:dave@somewhere.com"
>
> The latter looks more believable but still not desirable in my view. Why
> can't this special case be ignored?
>
> I made the change to the 166111 byte version at about 08:20 on Tuesday.
> Later that day complaints started coming in about messages being
> "mangled". The complainants usually did not include the affected
> message. When they did it was clear the "mangled" messages had actually
> been received on the Monday, _before_ I installed your latest
> Message.pm.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at BARENDSE.TO  Wed Nov 17 10:02:51 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:36 2006
Subject: install-Clam-spamass
Message-ID: <mailman.4752.1137101256.24926.mailscanner@lists.mailscanner.info>

On Tue, 16 Nov 2004, Julian Field wrote:

> On 16/11/04 9:20 am, "Martin Sapsed" <m.sapsed@BANGOR.AC.UK> wrote:
>
>> Remco Barendse wrote:
>>> Hi
>>>
>>> I just wanted to upgrade a box to the latest spamass. but SA didn't
>>> upgrade.
>>>
>>> Oh good, module Mail::SpamAssassin version 3.0.1 is already installed.
>>>
>>> [root@linuxgw install-Clam-SA]# spamassassin --version
>>> SpamAssassin version 3.0.0
>>>   running on Perl version
>>
>> What does this perl script say? I believe this is a more reliable way of
>> finding what MailScanner will use that the spamassassin command?
>>
>> #! /usr/bin/perl
>> use Mail::SpamAssassin;
>> print $Mail::SpamAssassin::VERSION . "\n";
>
> The best bet is to do
>    MailScanner -v
> as that will print the version numbers MailScanner is trying to use. Also
> what does
>    which spamassassin
> say?

Both the above script, and MailScanner -v and spamassassin --version
confirm that 3.0.0 is running.

Does the install script determine the spamass version number in another
way maybe?

Thanks!


> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Q.G.Campbell at NEWCASTLE.AC.UK  Wed Nov 17 11:39:31 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:36 2006
Subject: Mailto's being marked as detected fraud attempt.
Message-ID: <mailman.4753.1137101256.24926.mailscanner@lists.mailscanner.info>

Julian

Then I am perplexed by what is going on. The Message.pm file I am using
is 166111 bytes and is time stamped "Nov 15 14:18" - not 14:16 as in
Martin's case).

It is clobbering signature lines still. I provide two examples:

----- Example #1
[This user usually sends mail in RTF format. He of course does not have
the problem below when he sends mail in text format.]

Here are copies of my signature with and without the http bit added. 

__________________________________________________________ 
Professor Colin Ingram 
Director, Institute of Neuroscience
(http://www.ncl.ac.uk/research/institutes/ionslides) 
Director of Research, School of Neurology, Neurobiology & Psychiatry 

University of Newcastle 
Leazes Wing, Royal Victoria Infirmary 
Newcastle-upon-Tyne NE1 4LP, U.K. 
Tel (Office): (+44) 191 282 5678 
Tel (Secretary): (+44) 191 282 4336. 
Tel (Laboratory): (+44) 191 222 5528 
Fax: (+44) 191 222 6162 
E-mail: c.d.ingram@ncl.ac.uk 

__________________________________________________________ 
Professor Colin Ingram 
Director, Institute of Neuroscience (

WARNING FROM ISS: The Newcastle MailScanner has detected a possible
fraud attempt from "file:" claiming to be
www.ncl.ac.uk/research/institutes/ionslides) 
Director of Research, School of Neurology, Neurobiology & Psychiatry 

University of Newcastle 
Leazes Wing, Royal Victoria Infirmary 
Newcastle-upon-Tyne NE1 4LP, U.K. 
Tel (Office): (+44) 191 282 5678 
Tel (Secretary): (+44) 191 282 4336. 
Tel (Laboratory): (+44) 191 222 5528 
Fax: (+44) 191 222 6162 
E-mail: c.d.ingram@ncl.ac.uk 

----- Example #1 end

----- Example #2 
[this one has been edited in a consistent way to hide real domain and
other info.]

From: Kevin XXX <kxxx@domain.com>
Date: Tue, 16 Nov 2004 09:49:04 -0000
To: <user at Newcastle>
Subject: Gladstone

Hi there
Just tried your number but I'm guessing your busy. Give me a call when
you're free [deleted]
Speak to you soon
Kevin

Kevin XXX
Project Manager
[deleted]
 
T: +44 (0)[deleted] (DDI)
F: +44 (0)[deleted]
M: +44 (0)[deleted]
E: 

WARNING FROM ISS: The Newcastle MailScanner has detected a possible
fraud attempt from "blocked::

WARNING FROM ISS: The Newcastle MailScanner has detected a possible
fraud attempt from "kxxx@domain.com" claiming to be
mailto:kxxx@domain.com <mailto:kxxx@domain.com>
" claiming to be kxxx@domain.com <blocked::

WARNING FROM ISS: The Newcastle MailScanner has detected a possible
fraud attempt from "kxxx@domain.com>" claiming to be
mailto:kxxx@domain.com>
<mailto:kxxx@domain.com>>  
W: 

WARNING FROM ISS: The Newcastle MailScanner has detected a possible
fraud attempt from "blocked::http:" claiming to be www.domain.com
<blocked::http://www.domain.com/> 
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they are
addressed. If you have received this email in error please notify the
system manager. Please note that any views or opinions presented in this
email are solely those of the author and do not necessarily represent
those of the company. Finally, the recipient should check this email and
any attachments for the presence of viruses. The company accepts no
liability for any damage caused by any virus transmitted by this email.
This email has been scanned with Trend AV.

----- Example #2 end


Quentin
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own."  

>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>Sent: 17 November 2004 09:10
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Mailto's being marked as detected fraud attempt.
>
>I have just tested it with
>Contact <a href="mailto:steve.swaney@fsl.com">Steve.Swaney@fsl.com</a>
>and it allowed it through just fine.
>
>
>On 17/11/04 8:04 am, "Quentin Campbell" <Q.G.Campbell@NEWCASTLE.AC.UK>
>wrote:
>
>> Julian
>>
>> I installed your latest version of Message.pm (the 166111 
>byte version)
>> early on Tuesday.
>>
>> Prior to that the log entries read:
>>
>>   "Found phishing fraud from mailto:bloggs@domain.com claiming to be
>> bloggs@domain.com"
>>
>> After installing this fixed version (166111 bytes) the logs 
>entries now
>> read:
>>
>>   "Found phishing fraud from dave@somewhere.com claiming to be
>> mailto:dave@somewhere.com"
>>
>> The latter looks more believable but still not desirable in 
>my view. Why
>> can't this special case be ignored?
>>
>> I made the change to the 166111 byte version at about 08:20 
>on Tuesday.
>> Later that day complaints started coming in about messages being
>> "mangled". The complainants usually did not include the affected
>> message. When they did it was clear the "mangled" messages 
>had actually
>> been received on the Monday, _before_ I installed your latest
>> Message.pm.
>
>--
>Julian Field
>www.MailScanner.info
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Wed Nov 17 11:48:48 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:36 2006
Subject: Mailto's being marked as detected fraud attempt.
Message-ID: <mailman.4754.1137101256.24926.mailscanner@lists.mailscanner.info>

It's not clobbering email addresses, which I thought was your original
problem.
It's getting upset by URLs that have already been disabled by something
else, or were broken to start with.

Your first example is a link to
file::www.ncl.ac.uk/research/institutes/ionslides which is clearly never
going to work.
Your second example is a link to mailto:kxxx@domain.com
<mailto:kxxx@domain.com> which is also not going to work as the text
shouldn't be part of the link.
And there is also a "blocked::http://xxxx.yyyy.zzzz" link in there, which
has been broken by something else before it got to MailScanner (hence the
"blocked::" on the front).

In all cases, what would you like MailScanner to have done? It's complaining
about broken links :-(

On 17/11/04 11:39 am, "Quentin Campbell" <Q.G.Campbell@NEWCASTLE.AC.UK>
wrote:

> Julian
>
> Then I am perplexed by what is going on. The Message.pm file I am using
> is 166111 bytes and is time stamped "Nov 15 14:18" - not 14:16 as in
> Martin's case).
>
> It is clobbering signature lines still. I provide two examples:
>
> ----- Example #1
> [This user usually sends mail in RTF format. He of course does not have
> the problem below when he sends mail in text format.]
>
> Here are copies of my signature with and without the http bit added.
>
> __________________________________________________________
> Professor Colin Ingram
> Director, Institute of Neuroscience
> (http://www.ncl.ac.uk/research/institutes/ionslides)
> Director of Research, School of Neurology, Neurobiology & Psychiatry
>
> University of Newcastle
> Leazes Wing, Royal Victoria Infirmary
> Newcastle-upon-Tyne NE1 4LP, U.K.
> Tel (Office): (+44) 191 282 5678
> Tel (Secretary): (+44) 191 282 4336.
> Tel (Laboratory): (+44) 191 222 5528
> Fax: (+44) 191 222 6162
> E-mail: c.d.ingram@ncl.ac.uk
>
> __________________________________________________________
> Professor Colin Ingram
> Director, Institute of Neuroscience (
>
> WARNING FROM ISS: The Newcastle MailScanner has detected a possible
> fraud attempt from "file:" claiming to be
> www.ncl.ac.uk/research/institutes/ionslides)
> Director of Research, School of Neurology, Neurobiology & Psychiatry
>
> University of Newcastle
> Leazes Wing, Royal Victoria Infirmary
> Newcastle-upon-Tyne NE1 4LP, U.K.
> Tel (Office): (+44) 191 282 5678
> Tel (Secretary): (+44) 191 282 4336.
> Tel (Laboratory): (+44) 191 222 5528
> Fax: (+44) 191 222 6162
> E-mail: c.d.ingram@ncl.ac.uk
>
> ----- Example #1 end
>
> ----- Example #2
> [this one has been edited in a consistent way to hide real domain and
> other info.]
>
> From: Kevin XXX <kxxx@domain.com>
> Date: Tue, 16 Nov 2004 09:49:04 -0000
> To: <user at Newcastle>
> Subject: Gladstone
>
> Hi there
> Just tried your number but I'm guessing your busy. Give me a call when
> you're free [deleted]
> Speak to you soon
> Kevin
>
> Kevin XXX
> Project Manager
> [deleted]
>
> T: +44 (0)[deleted] (DDI)
> F: +44 (0)[deleted]
> M: +44 (0)[deleted]
> E:
>
> WARNING FROM ISS: The Newcastle MailScanner has detected a possible
> fraud attempt from "blocked::
>
> WARNING FROM ISS: The Newcastle MailScanner has detected a possible
> fraud attempt from "kxxx@domain.com" claiming to be
> mailto:kxxx@domain.com <mailto:kxxx@domain.com>
> " claiming to be kxxx@domain.com <blocked::
>
> WARNING FROM ISS: The Newcastle MailScanner has detected a possible
> fraud attempt from "kxxx@domain.com>" claiming to be
> mailto:kxxx@domain.com>
> <mailto:kxxx@domain.com>>
> W:
>
> WARNING FROM ISS: The Newcastle MailScanner has detected a possible
> fraud attempt from "blocked::http:" claiming to be www.domain.com
> <blocked::http://www.domain.com/>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they are
> addressed. If you have received this email in error please notify the
> system manager. Please note that any views or opinions presented in this
> email are solely those of the author and do not necessarily represent
> those of the company. Finally, the recipient should check this email and
> any attachments for the presence of viruses. The company accepts no
> liability for any damage caused by any virus transmitted by this email.
> This email has been scanned with Trend AV.
>
> ----- Example #2 end
>
>
> Quentin
> ---
> PHONE: +44 191 222 8209    Information Systems and Services (ISS),
>                            University of Newcastle,
>                            Newcastle upon Tyne,
> FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
> ------------------------------------------------------------------------
> "Any opinion expressed above is mine. The University can get its own."
>
>> -----Original Message-----
>> From: MailScanner mailing list
>> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>> Sent: 17 November 2004 09:10
>> To: MAILSCANNER@JISCMAIL.AC.UK
>> Subject: Re: Mailto's being marked as detected fraud attempt.
>>
>> I have just tested it with
>> Contact <a href="mailto:steve.swaney@fsl.com">Steve.Swaney@fsl.com</a>
>> and it allowed it through just fine.
>>
>>
>> On 17/11/04 8:04 am, "Quentin Campbell" <Q.G.Campbell@NEWCASTLE.AC.UK>
>> wrote:
>>
>>> Julian
>>>
>>> I installed your latest version of Message.pm (the 166111
>> byte version)
>>> early on Tuesday.
>>>
>>> Prior to that the log entries read:
>>>
>>>   "Found phishing fraud from mailto:bloggs@domain.com claiming to be
>>> bloggs@domain.com"
>>>
>>> After installing this fixed version (166111 bytes) the logs
>> entries now
>>> read:
>>>
>>>   "Found phishing fraud from dave@somewhere.com claiming to be
>>> mailto:dave@somewhere.com"
>>>
>>> The latter looks more believable but still not desirable in
>> my view. Why
>>> can't this special case be ignored?
>>>
>>> I made the change to the 166111 byte version at about 08:20
>> on Tuesday.
>>> Later that day complaints started coming in about messages being
>>> "mangled". The complainants usually did not include the affected
>>> message. When they did it was clear the "mangled" messages
>> had actually
>>> been received on the Monday, _before_ I installed your latest
>>> Message.pm.
>>
>> --
>> Julian Field
>> www.MailScanner.info
>> Buy the MailScanner book at www.MailScanner.info/store
>>
>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>> Support MailScanner development - buy the book off the website!
>>
>>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Wed Nov 17 12:01:31 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:36 2006
Subject: Mailto's being marked as detected fraud attempt.
Message-ID: <mailman.4755.1137101256.24926.mailscanner@lists.mailscanner.info>

Quentin

I'm getting alot of reports about 'broken links' reported by MS in emails.

I quick view of the original message does indeed show the link is broken
in some way, mainly people sending out HTML email as marketing brochures
- ligitimate companies we deal with not 'spam' - where thet send out a
brokeb link accidentally in footers or do a phishing style redirect to a
link the text claims not to point to.

However it is providing many false positives, and although I'm disabling
the anti-phishing feature for those domains with a ruleset, it is making
me contemplate turning off the feature altogether. Otherwise it merely
suffers from the cry wolf problem.


--
Martin Hepworth
Senior Systems Administrator
Solid State Logic Ltd
tel: +44 (0)1865 842300

Julian Field wrote:
> It's not clobbering email addresses, which I thought was your original
> problem.
> It's getting upset by URLs that have already been disabled by something
> else, or were broken to start with.
>
> Your first example is a link to
> file::www.ncl.ac.uk/research/institutes/ionslides which is clearly never
> going to work.
> Your second example is a link to mailto:kxxx@domain.com
> <mailto:kxxx@domain.com> which is also not going to work as the text
> shouldn't be part of the link.
> And there is also a "blocked::http://xxxx.yyyy.zzzz" link in there, which
> has been broken by something else before it got to MailScanner (hence the
> "blocked::" on the front).
>
> In all cases, what would you like MailScanner to have done? It's complaining
> about broken links :-(
>
> On 17/11/04 11:39 am, "Quentin Campbell" <Q.G.Campbell@NEWCASTLE.AC.UK>
> wrote:
>
>
>>Julian
>>
>>Then I am perplexed by what is going on. The Message.pm file I am using
>>is 166111 bytes and is time stamped "Nov 15 14:18" - not 14:16 as in
>>Martin's case).
>>
>>It is clobbering signature lines still. I provide two examples:
>>
>>----- Example #1
>>[This user usually sends mail in RTF format. He of course does not have
>>the problem below when he sends mail in text format.]
>>
>>Here are copies of my signature with and without the http bit added.
>>
>>__________________________________________________________
>>Professor Colin Ingram
>>Director, Institute of Neuroscience
>>(http://www.ncl.ac.uk/research/institutes/ionslides)
>>Director of Research, School of Neurology, Neurobiology & Psychiatry
>>
>>University of Newcastle
>>Leazes Wing, Royal Victoria Infirmary
>>Newcastle-upon-Tyne NE1 4LP, U.K.
>>Tel (Office): (+44) 191 282 5678
>>Tel (Secretary): (+44) 191 282 4336.
>>Tel (Laboratory): (+44) 191 222 5528
>>Fax: (+44) 191 222 6162
>>E-mail: c.d.ingram@ncl.ac.uk
>>
>>__________________________________________________________
>>Professor Colin Ingram
>>Director, Institute of Neuroscience (
>>
>>WARNING FROM ISS: The Newcastle MailScanner has detected a possible
>>fraud attempt from "file:" claiming to be
>>www.ncl.ac.uk/research/institutes/ionslides)
>>Director of Research, School of Neurology, Neurobiology & Psychiatry
>>
>>University of Newcastle
>>Leazes Wing, Royal Victoria Infirmary
>>Newcastle-upon-Tyne NE1 4LP, U.K.
>>Tel (Office): (+44) 191 282 5678
>>Tel (Secretary): (+44) 191 282 4336.
>>Tel (Laboratory): (+44) 191 222 5528
>>Fax: (+44) 191 222 6162
>>E-mail: c.d.ingram@ncl.ac.uk
>>
>>----- Example #1 end
>>
>>----- Example #2
>>[this one has been edited in a consistent way to hide real domain and
>>other info.]
>>
>>From: Kevin XXX <kxxx@domain.com>
>>Date: Tue, 16 Nov 2004 09:49:04 -0000
>>To: <user at Newcastle>
>>Subject: Gladstone
>>
>>Hi there
>>Just tried your number but I'm guessing your busy. Give me a call when
>>you're free [deleted]
>>Speak to you soon
>>Kevin
>>
>>Kevin XXX
>>Project Manager
>>[deleted]
>>
>>T: +44 (0)[deleted] (DDI)
>>F: +44 (0)[deleted]
>>M: +44 (0)[deleted]
>>E:
>>
>>WARNING FROM ISS: The Newcastle MailScanner has detected a possible
>>fraud attempt from "blocked::
>>
>>WARNING FROM ISS: The Newcastle MailScanner has detected a possible
>>fraud attempt from "kxxx@domain.com" claiming to be
>>mailto:kxxx@domain.com <mailto:kxxx@domain.com>
>>" claiming to be kxxx@domain.com <blocked::
>>
>>WARNING FROM ISS: The Newcastle MailScanner has detected a possible
>>fraud attempt from "kxxx@domain.com>" claiming to be
>>mailto:kxxx@domain.com>
>><mailto:kxxx@domain.com>>
>>W:
>>
>>WARNING FROM ISS: The Newcastle MailScanner has detected a possible
>>fraud attempt from "blocked::http:" claiming to be www.domain.com
>><blocked::http://www.domain.com/>
>>This email and any files transmitted with it are confidential and
>>intended solely for the use of the individual or entity to whom they are
>>addressed. If you have received this email in error please notify the
>>system manager. Please note that any views or opinions presented in this
>>email are solely those of the author and do not necessarily represent
>>those of the company. Finally, the recipient should check this email and
>>any attachments for the presence of viruses. The company accepts no
>>liability for any damage caused by any virus transmitted by this email.
>>This email has been scanned with Trend AV.
>>
>>----- Example #2 end
>>
>>
>>Quentin
>>---
>>PHONE: +44 191 222 8209    Information Systems and Services (ISS),
>>                           University of Newcastle,
>>                           Newcastle upon Tyne,
>>FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
>>------------------------------------------------------------------------
>>"Any opinion expressed above is mine. The University can get its own."
>>
>>
>>>-----Original Message-----
>>>From: MailScanner mailing list
>>>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>>>Sent: 17 November 2004 09:10
>>>To: MAILSCANNER@JISCMAIL.AC.UK
>>>Subject: Re: Mailto's being marked as detected fraud attempt.
>>>
>>>I have just tested it with
>>>Contact <a href="mailto:steve.swaney@fsl.com">Steve.Swaney@fsl.com</a>
>>>and it allowed it through just fine.
>>>
>>>
>>>On 17/11/04 8:04 am, "Quentin Campbell" <Q.G.Campbell@NEWCASTLE.AC.UK>
>>>wrote:
>>>
>>>
>>>>Julian
>>>>
>>>>I installed your latest version of Message.pm (the 166111
>>>
>>>byte version)
>>>
>>>>early on Tuesday.
>>>>
>>>>Prior to that the log entries read:
>>>>
>>>>  "Found phishing fraud from mailto:bloggs@domain.com claiming to be
>>>>bloggs@domain.com"
>>>>
>>>>After installing this fixed version (166111 bytes) the logs
>>>
>>>entries now
>>>
>>>>read:
>>>>
>>>>  "Found phishing fraud from dave@somewhere.com claiming to be
>>>>mailto:dave@somewhere.com"
>>>>
>>>>The latter looks more believable but still not desirable in
>>>
>>>my view. Why
>>>
>>>>can't this special case be ignored?
>>>>
>>>>I made the change to the 166111 byte version at about 08:20
>>>
>>>on Tuesday.
>>>
>>>>Later that day complaints started coming in about messages being
>>>>"mangled". The complainants usually did not include the affected
>>>>message. When they did it was clear the "mangled" messages
>>>
>>>had actually
>>>
>>>>been received on the Monday, _before_ I installed your latest
>>>>Message.pm.
>>>
>>>--
>>>Julian Field

--


**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Wed Nov 17 12:17:12 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:36 2006
Subject: Mailto's being marked as detected fraud attempt.
Message-ID: <mailman.4756.1137101256.24926.mailscanner@lists.mailscanner.info>

How could I improve it?


On 17/11/04 12:01 pm, "Martin Hepworth" <martinh@SOLID-STATE-LOGIC.COM>
wrote:
> Quentin
>
> I'm getting alot of reports about 'broken links' reported by MS in emails.
>
> I quick view of the original message does indeed show the link is broken
> in some way, mainly people sending out HTML email as marketing brochures
> - ligitimate companies we deal with not 'spam' - where thet send out a
> brokeb link accidentally in footers or do a phishing style redirect to a
> link the text claims not to point to.
>
> However it is providing many false positives, and although I'm disabling
> the anti-phishing feature for those domains with a ruleset, it is making
> me contemplate turning off the feature altogether. Otherwise it merely
> suffers from the cry wolf problem.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Wed Nov 17 12:30:25 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:36 2006
Subject: Mailto's being marked as detected fraud attempt.
Message-ID: <mailman.4757.1137101256.24926.mailscanner@lists.mailscanner.info>

Julian

good question...I'm not sure much can be done apart from tune the thing
using rules....

I think the phishing detector is showing how badly formatted  many URL's
actually are, esp in legitimate  html based marketing emails. I'm not
sure how many are sent from third party marketing people, rather than
direct. Perhaps some sort of check  on the sending ip-address matching
the sender domain as well.??? But this means a deeper analysis of the
whole email, so perhaps it's dropping into a SA 3 plugin solution. Or
even just making sure  people are using the phishing surbl.org URI RBL???

Anyone else any ideas????

<rant>
For me this is another reason why non-text emails are a bad idea.....
</rant>
--
Martin Hepworth
Senior Systems Administrator
Solid State Logic Ltd
tel: +44 (0)1865 842300

Julian Field wrote:

> How could I improve it?
>
>
> On 17/11/04 12:01 pm, "Martin Hepworth" <martinh@SOLID-STATE-LOGIC.COM>
> wrote:
>
>>Quentin
>>
>>I'm getting alot of reports about 'broken links' reported by MS in emails.
>>
>>I quick view of the original message does indeed show the link is broken
>>in some way, mainly people sending out HTML email as marketing brochures
>>- ligitimate companies we deal with not 'spam' - where thet send out a
>>brokeb link accidentally in footers or do a phishing style redirect to a
>>link the text claims not to point to.
>>
>>However it is providing many false positives, and although I'm disabling
>>the anti-phishing feature for those domains with a ruleset, it is making
>>me contemplate turning off the feature altogether. Otherwise it merely
>>suffers from the cry wolf problem.
>
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>




**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From anders.andersson at LTKALMAR.SE  Wed Nov 17 12:38:21 2004
From: anders.andersson at LTKALMAR.SE (Anders Andersson, IT)
Date: Thu Jan 12 21:27:36 2006
Subject: Howto relay mails with a "mailscanner-relay-server"?
Message-ID: <mailman.4758.1137101256.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list 
> Subject: Howto relay mails with a "mailscanner-relay-server"?
> 
> Hi all!
> 
> I have looked at mailscanner site, and as I can understand, 
> it gives me 2 solutions.
> 
> I want to have a "mailscanner-relay-server" that can relay 
> mails to an internal mailserver but also to mailservers 
> outside my network.
> 
> "relay-domains"
> 
> http://www.sng.ecs.soton.ac.uk/mailscanner/faq.shtml#16
> 
> 
> "mailertable"
> 
> http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/152.html
> 
> Any thoughts on what solutions I should prefer?
> 
> /henrik
> 

I've been using mailertable without any problems so far for my
mailscanner server that do exatcly what you want it to do. But i have to
admit that sendmail isn't my strong side but so far its been doing as I
want it to   :)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From prandal at HEREFORDSHIRE.GOV.UK  Wed Nov 17 12:45:59 2004
From: prandal at HEREFORDSHIRE.GOV.UK (Randal, Phil)
Date: Thu Jan 12 21:27:36 2006
Subject: Mailto's being marked as detected fraud attempt.
Message-ID: <mailman.4759.1137101256.24926.mailscanner@lists.mailscanner.info>

You probably can't.

One of our biggest headaches here is so-called "legitimate" newsletters
which, to the untrained eye, are indistinguishable from spam.  They use
the same bulk-emailers that spammers do, and insist on redirecting via
some suspicious link, and contain dodgy html markup.

I personally see these newsletters as being part of the problem.  People
who should know better are often the worst offenders, too.

Whitelisting leaves you open to all sorts of garbage (even
whitelist_from if the spammer runs their own poisoned reverse DNS
lookups).

Cheers,

Phil

----
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK

> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
> Sent: 17 November 2004 12:17
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Mailto's being marked as detected fraud attempt.
>
> How could I improve it?
>
>
> On 17/11/04 12:01 pm, "Martin Hepworth"
> <martinh@SOLID-STATE-LOGIC.COM>
> wrote:
> > Quentin
> >
> > I'm getting alot of reports about 'broken links' reported
> by MS in emails.
> >
> > I quick view of the original message does indeed show the link is
> > broken in some way, mainly people sending out HTML email as
> marketing
> > brochures
> > - ligitimate companies we deal with not 'spam' - where thet
> send out a
> > brokeb link accidentally in footers or do a phishing style
> redirect to
> > a link the text claims not to point to.
> >
> > However it is providing many false positives, and although I'm
> > disabling the anti-phishing feature for those domains with
> a ruleset,
> > it is making me contemplate turning off the feature altogether.
> > Otherwise it merely suffers from the cry wolf problem.
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list
> ------------------------ To unsubscribe, email
> jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ
> (http://www.mailscanner.biz/maq/) and the archives
> (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Glenn.Steen at AP1.SE  Wed Nov 17 12:54:36 2004
From: Glenn.Steen at AP1.SE (Steen, Glenn)
Date: Thu Jan 12 21:27:36 2006
Subject: Postfix, mailwatch and queue IDs (and  of course mailscanner:-)
Message-ID: <mailman.4760.1137101256.24926.mailscanner@lists.mailscanner.info>

Hi all,

(this is mainly old news for the followers of the mailwatch-users
list... Just want to clue you all in:-)

As can be seen in the following references to the not-so-threaded view
of the mailwatch-users list (I might have missed some "branch"...):
http://sourceforge.net/mailarchive/forum.php?thread_id=5934318&forum_id=
34994

http://sourceforge.net/mailarchive/forum.php?thread_id=5964404&forum_id=
34994

http://sourceforge.net/mailarchive/forum.php?thread_id=5964780&forum_id=
34994

... I've run into a rather sticky thing with message logging to database
and postfix/MS.
Executive summary is that postfix can, and will, reuse queue file IDs...
Which can lead to some strangeness in the MailWatch display ("message
details" showing two messages in one rather confusing display, viruses
appearing "clean" etc), and possibly a form of "quarantine corruption"
if the queue inode number isn't preserved.

As is plain in the above conversation(s) I thoroughly aggravated the
problem by separating the spool area from the rest of /var, so perhaps
this issue could be handled with a FAQ saying "don't do that stupid",
but I'd prefer something more slick... somehow making the IDs
bulletproof unique... but I'm unsure if that's even possible.
Any of you MS gurus care to comment?

Yours
-- Glenn

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ugob at CAMO-ROUTE.COM  Wed Nov 17 12:56:20 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:36 2006
Subject: Upgrade Query
Message-ID: <mailman.4761.1137101256.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Carinus Carelse wrote:
> Ja thats the rpm upgrade though i want to upgrade a sparc server with the
> tar.gz version.


Ok, I'm sorry, I'm the one who wrote the MAQ and I don't have a non-rpm
system to upgrade, so I don't really know.  I know that there is a
./install script even in the non-rpm, that might be the solution.

>
> Carinus
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jaearick at COLBY.EDU  Wed Nov 17 13:02:19 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:36 2006
Subject: SAVI-Perl-0.25 released
Message-ID: <mailman.4762.1137101256.24926.mailscanner@lists.mailscanner.info>

Gang,

Paul Henson has released SAVI-Perl-0.25.tar.gz at:

http://www.csupomona.edu/~henson/www/projects/SAVI-Perl/dist/

The one change since 0.20 is the addition of support for Sun
compilers (Forte or StudioONE).  I have installed 0.25 with my
MailScanner 4.35.11 setup and things work just fine.

Jeff Earickson
Colby College

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Glenn.Steen at AP1.SE  Wed Nov 17 13:29:31 2004
From: Glenn.Steen at AP1.SE (Steen, Glenn)
Date: Thu Jan 12 21:27:36 2006
Subject: Postfix, mailwatch and queue IDs (and  of course mailscanner:-)
Message-ID: <mailman.4763.1137101256.24926.mailscanner@lists.mailscanner.info>

Grmbl... Autowrap messing up the perfectly fine links....
Here in a "wrap-safe" version:-)

http://sf.net/mailarchive/forum.php?thread_id=5934318&forum_id=34994

http://sf.net/mailarchive/forum.php?thread_id=5964404&forum_id=34994

http://sf.net/mailarchive/forum.php?thread_id=5964780&forum_id=34994

Sorry for that.

-- Glenn
-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Steen, Glenn
Sent: den 17 november 2004 13:55
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Postfix, mailwatch and queue IDs (and of course mailscanner:-)


Hi all,
(snip)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Q.G.Campbell at NEWCASTLE.AC.UK  Wed Nov 17 14:05:59 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:36 2006
Subject: Mailto's being marked as detected fraud attempt.
Message-ID: <mailman.4764.1137101256.24926.mailscanner@lists.mailscanner.info>

Julian

One bit of help would be considering exempting 'href="file:www...."'
tags.

It appears that in some circumstances Outlook/Exchange converts the URL
www.ncl.ac.uk/research/institutes/ionslides into
'href="file:www.ncl.ac.uk/research/institutes/ionslides"' rather than
'href="http://www.ncl.ac.uk/research/institutes/ionslides"'.

I have only seen it happen in signature lines but have not been able to
reproduce the behaviour myself using Outlook/Exchange and sending
messages via the same mail gateways route as affected messages.  :-(

There is another curiosity. The Sendmail logs say that HTML in the
affected user's signature line is disarmed by MailScanner's "Content
Checks". The only content check that disarms HTML is the new "WebBugs"
one. All the other content checks strip the HTML.

A consequence of this disarming is that all the text following the
"href=" tag is underlined until the end of the message. Do you know why
that might be happening?  

Thanks

Quentin 
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own."  

>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>Sent: 17 November 2004 12:17
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Mailto's being marked as detected fraud attempt.
>
>How could I improve it?
>
>
>On 17/11/04 12:01 pm, "Martin Hepworth" <martinh@SOLID-STATE-LOGIC.COM>
>wrote:
>> Quentin
>>
>> I'm getting alot of reports about 'broken links' reported by 
>MS in emails.
>>
>> I quick view of the original message does indeed show the 
>link is broken
>> in some way, mainly people sending out HTML email as 
>marketing brochures
>> - ligitimate companies we deal with not 'spam' - where thet 
>send out a
>> brokeb link accidentally in footers or do a phishing style 
>redirect to a
>> link the text claims not to point to.
>>
>> However it is providing many false positives, and although 
>I'm disabling
>> the anti-phishing feature for those domains with a ruleset, 
>it is making
>> me contemplate turning off the feature altogether. Otherwise 
>it merely
>> suffers from the cry wolf problem.
>
>--
>Julian Field
>www.MailScanner.info
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Wed Nov 17 14:10:30 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:36 2006
Subject: Mailto's being marked as detected fraud attempt.
Message-ID: <mailman.4765.1137101256.24926.mailscanner@lists.mailscanner.info>

I use a ruleset for the phishing detection in MS, rather than
whitelisting in spam.assassin.pref.conf which helps, but is a pain to
setup...

--
Martin Hepworth
Senior Systems Administrator
Solid State Logic Ltd
tel: +44 (0)1865 842300

Randal, Phil wrote:

> You probably can't.
>
> One of our biggest headaches here is so-called "legitimate" newsletters
> which, to the untrained eye, are indistinguishable from spam.  They use
> the same bulk-emailers that spammers do, and insist on redirecting via
> some suspicious link, and contain dodgy html markup.
>
> I personally see these newsletters as being part of the problem.  People
> who should know better are often the worst offenders, too.
>
> Whitelisting leaves you open to all sorts of garbage (even
> whitelist_from if the spammer runs their own poisoned reverse DNS
> lookups).
>
> Cheers,
>
> Phil
>
> ----
> Phil Randal
> Network Engineer
> Herefordshire Council
> Hereford, UK
>
>
>>-----Original Message-----
>>From: MailScanner mailing list
>>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>>Sent: 17 November 2004 12:17
>>To: MAILSCANNER@JISCMAIL.AC.UK
>>Subject: Re: Mailto's being marked as detected fraud attempt.
>>
>>How could I improve it?
>>
>>


--



**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Q.G.Campbell at NEWCASTLE.AC.UK  Wed Nov 17 14:13:59 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:36 2006
Subject: Mailto's being marked as detected fraud attempt.
Message-ID: <mailman.4766.1137101256.24926.mailscanner@lists.mailscanner.info>

>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Quentin Campbell
>Sent: 17 November 2004 14:06
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Mailto's being marked as detected fraud attempt.
>
[snip]
>There is another curiosity. The Sendmail logs say that HTML in the
>affected user's signature line is disarmed by MailScanner's "Content
>Checks". The only content check that disarms HTML is the new "WebBugs"
>one. All the other content checks strip the HTML.
>
>A consequence of this disarming is that all the text following the
>"href=" tag is underlined until the end of the message. Do you know why
>that might be happening?  

Note that this only happens when the signature is added to a message
sent as RTF. It does not seem to happen when the message is sent as
HTML.

Quentin

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From marcel-ml at IRC-ADDICTS.DE  Wed Nov 17 14:30:03 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:36 2006
Subject: Antivir founds a new Trojan..other virus-scanners do not
Message-ID: <mailman.4767.1137101256.24926.mailscanner@lists.mailscanner.info>

Hi there,

just for you all to know..

there is a new Trojan in Germany spreading around..

It is called

TR/Pish.Telekom.A

Only antivir found this trojan on my maschine..
the other Virus-Scanners (clamav, bitdefender, f-prot) do not react on
this Virus.

Greetings

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Jan-Peter.Koopmann at SECEIDOS.DE  Wed Nov 17 14:40:58 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:36 2006
Subject: Antivir founds a new Trojan..other virus-scanners do not
Message-ID: <mailman.4768.1137101256.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> just for you all to know..
> 
> there is a new Trojan in Germany spreading around..
> 
> It is called
> 
> TR/Pish.Telekom.A

Yep. Unfortunatly thats very true. We had problems with this as well. Please note though that the mail itself does not contain the Trojan. It is a Phishing-Style mail that requests the user to open a link. If you do in IE the webpage uses some "old" IE vulnerabilities to download the trojan in the background. Local virus scanners detect that vulnerability (Microsoft VM problem), at least eTrust did here. 

So technically it is "ok" for the other virus scanners not to detect this, since it is "only" a mail message....

Regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mike at CAMAROSS.NET  Wed Nov 17 14:40:53 2004
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:27:36 2006
Subject: Antivir founds a new Trojan..other virus-scanners do not
Message-ID: <mailman.4769.1137101256.24926.mailscanner@lists.mailscanner.info>

Marcel Blenkers wrote:
> Hi there,
>
> just for you all to know..
>
> there is a new Trojan in Germany spreading around..
>
> It is called
>
> TR/Pish.Telekom.A
>
> Only antivir found this trojan on my maschine..
> the other Virus-Scanners (clamav, bitdefender, f-prot) do not react
> on this Virus.
>
> Greetings
>
> Marcel
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave
> mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

Do these look familiar?

http://www.sophos.com/search/index.cgi?scope=whole_site&terms=TR%2FPish.Tele
kom.A&x=15&y=6

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From rich at MAIL.WVNET.EDU  Wed Nov 17 14:43:45 2004
From: rich at MAIL.WVNET.EDU (Richard Lynch)
Date: Thu Jan 12 21:27:36 2006
Subject: Problem with ClamAVmodule
Message-ID: <mailman.4770.1137101256.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian Field wrote:

>You have found a bug, but I'm not sure it is easy to work around.
>You need to set
>Allow Password-Protected Archives = yes
>and not use a ruleset. I allow a ruleset as this is only the case when using
>the "clamavmodule" virus scanner. I guess I should put a check in there to
>ensure that this is a simple value when using clamavmodule.
>
>
I see.  You're testing the value of "Allow Password-Protected Archives"
which returns "0" since it's not "yes" (i.e. it's a file reference), and
it passes the "Mail::ClamAV::CL_SCAN_BLOCKENCRYPTED()" parameter to
Mail::ClamAV.

Solving this is problematic.  What about adding a user supplied option
list for Mail::ClamAV in MailScanner.conf?  Then, you could make the
call without making the test on "allowpasszips".  Something like...

$results = $Clam->scan("$dirname/$childname/$filename",
           Mail::ClamAV::CL_SCAN_ARCHIVE() |
           MailScanner::Config::Value('clammodopt') |
           Mail::ClamAV::CL_SCAN_OLE2());

Then users could specify the CL_SCAN_BLOCKENCRYPTED option if they want it.  Or perhaps, don't pass the option at all since MS provides that facility on its own anyway.

Just a couple of suggestions off the top of my head -- you know better than I.  In my case I'm forced to abandon clamavmodule since I need the ability to control who can receive password protected zips.  Just using clamav works fine, I'm only using clamavmodule because of the better performance.

Thanks for clearing up what was happening.  I very much appreciate all
your efforts and it won't bother me too much if I have to quit using
clamavmodule.  It's nothing major.

Thanks,
Rich

>On 16/11/04 11:52 pm, "Richard Lynch" <rich@MAIL.WVNET.EDU> wrote:
>
>
>
>>This past weekend I upgraded our MailScanner servers to version
>>4.35.11-1 along with SA 3.0.1,  ClamAV-0.80, and Mail-ClamAV-0.13.  The
>>problem is that password protected zips always get flagged by
>>clamavmodule even when the recipient is listed as being allowed in a
>>ruleset for "Allow Password-Protected Archives".   I also have "Maximum
>>Archive Depth = 0".   The message in the maillog is...
>>
>>... ClamAVModule::INFECTED:: Encrypted.Zip:: ...
>>
>>When I run with Virus Scanners set to clamav things work as expected --
>>it's only when I use clamavmodule that I have this problem.  I suspect
>>that this is a bug in Mail-ClamAV but I suppose it could be a problem
>>with MS.  The relevant code is in  SweepViruses.pm at around line 998.  ...
>>
>>      if (MailScanner::Config::Value('allowpasszips')) { # || $haverar) {
>>        $results = $Clam->scan("$dirname/$childname/$filename",
>>                               Mail::ClamAV::CL_SCAN_ARCHIVE() |
>>                               Mail::ClamAV::CL_SCAN_OLE2());
>>      } else {
>>        $results = $Clam->scan("$dirname/$childname/$filename",
>>                               Mail::ClamAV::CL_SCAN_ARCHIVE() |
>>                               Mail::ClamAV::CL_SCAN_BLOCKENCRYPTED() |
>>                               Mail::ClamAV::CL_SCAN_OLE2());
>>      }
>>
>>The option CL_SCAN_BLOCKENCRYPTED is used by Mail-ClamAV to pass to
>>ClamAV and indicates that password protected zips should be treated as
>>infected.  It seems clear to me that MS is calling the interface
>>correctly depending on the setting of "Allow Protected-Protected Archives".
>>
>>So... Is anyone else having this problem?   Am I doing something dumb?
>>(I realize that answers to these two questions are not necessarily
>>dependent :) ).
>>
>> If this is a Mail-ClamAV problem how does one get it reported?
>>
>>Thanks,
>>Rich
>>
>>--
>>
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>
>
>--
>Julian Field
>www.MailScanner.info
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>


--



------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Text/X-VCARD (charset: UTF-8 "Internet-standard Unicode") ]
    [ (Name: "rich.vcf")  13 lines. ]
    [ Unable to print this part. ]


From dustin.baer at IHS.COM  Wed Nov 17 14:57:23 2004
From: dustin.baer at IHS.COM (Dustin Baer)
Date: Thu Jan 12 21:27:36 2006
Subject: design issue - whitelist rules/blacklist rules
Message-ID: <mailman.4771.1137101256.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Venkata Achanta wrote:

>blacklist.rules
>From:   *@domain.com and To: *@domain.com   yes
>From:   no-reply@domain.com and To: *@domain.com   no
>
As I mentioned in my post yesterday, put the NO entry ABOVE the YES
entry.  Your testing is matching on the FIRST rule, which is going to
blacklist it.

FromTo:   no-reply@domain.com no
From:   *@domain.com and To: *@domain.com   yes


Dustin

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Wed Nov 17 15:04:33 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:36 2006
Subject: Mailto's being marked as detected fraud attempt.
Message-ID: <mailman.4772.1137101256.24926.mailscanner@lists.mailscanner.info>

Please try the attached Message.pm file. It's a 1-line change that should do
the trick.

On 17/11/04 2:05 pm, "Quentin Campbell" <Q.G.Campbell@NEWCASTLE.AC.UK>
wrote:
> Julian
>
> One bit of help would be considering exempting 'href="file:www...."'
> tags.
>
> It appears that in some circumstances Outlook/Exchange converts the URL
> www.ncl.ac.uk/research/institutes/ionslides into
> 'href="file:www.ncl.ac.uk/research/institutes/ionslides"' rather than
> 'href="http://www.ncl.ac.uk/research/institutes/ionslides"'.


--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Application/OCTET-STREAM (Name: ]
    [ "Message.pm.ignore.file.gz")  54KB. ]
    [ Unable to print this part. ]


From engin at COZUMTEKNIK.COM  Wed Nov 17 14:58:08 2004
From: engin at COZUMTEKNIK.COM ([windows-1254] Ali Engin Erođuz)
Date: Thu Jan 12 21:27:36 2006
Subject: All deliveries are deferred (exim - openprotect)
Message-ID: <mailman.4773.1137101256.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "windows-1254" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]


Hello,

I've a problem on my mail server. I can't get or post any mails. All
mails are rejected by same reason that "All deliveries are deferred". I'm
using exim-4.42-1 and read the documentation about "defer_router"
configuration in exim.conf.in. I've installed mailscanner by openprotect
and did the changes what the docs says for my exim version. I only can
receive mails by disabling openprotect.

What would i do to solve the problem.

Best Regards.
Ali Engin

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From ebruce at HPMICH.COM  Wed Nov 17 15:05:17 2004
From: ebruce at HPMICH.COM (Ed Bruce)
Date: Thu Jan 12 21:27:36 2006
Subject: Mailscanner restarting over and over after detecting phishing
    attack
Message-ID: <mailman.4774.1137101256.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I'm seeing this in my maillog:

Nov 17 10:01:09 mail2 MailScanner[31220]: Spam Checks: Found 19 spam messages
Nov 17 10:01:13 mail2 postfix/smtp[30684]: B93F137E58D: to=<1zbztgr1hloxrxxhilr27sjs8c8fbb@85338.reply.zs-n.com>, relay=smtp.zs-n.com[63.251.54.70],
 delay=49465, status=deferred (host smtp.zs-n.com[63.251.54.70] said: 451 Timeout)
Nov 17 10:01:14 mail2 MailScanner[31220]: Virus and Content Scanning: Starting
Nov 17 10:01:14 mail2 MailScanner[31220]: Content Checks: Detected and will disarm HTML message in 4864330A929
Nov 17 10:01:14 mail2 MailScanner[31220]: Found phishing fraud from www.otcbb.com/asp/quote_module.asp?symbol=mtdn</a><br><br>
Nov 17 10:01:14 mail2 MailScanner[31220]: big year expected in 2005 for motion dna<br>
Nov 17 10:01:15 mail2 MailScanner[31220]:   <br>
Nov 17 10:01:15 mail2 MailScanner[31220]: trading symbol mtdn<br>
Nov 17 10:01:15 mail2 MailScanner[31220]: current price (est.) $0.025<br>
Nov 17 10:01:15 mail2 MailScanner[31220]: valued price (est.) $1.00<br><br>
Nov 17 10:01:16 mail2 MailScanner[31373]: MailScanner E-Mail Virus Scanner version 4.35.10 starting...
Nov 17 10:01:17 mail2 MailScanner[31373]: Using locktype = flock
Nov 17 10:01:17 mail2 MailScanner[31373]: New Batch: Scanning 30 messages, 131067 bytes



Everytime I see this MailScanner is restarting. This has occurred over 170 times over the past 90 minutes.


--
Ed Bruce
Health Plan of Michigan
Senior Programmer
Phone:  248.226.1512
FAX:    248.204.6569



--
This message, including any attachments, is intended solely for the use
of the named recipients(s) and may contain confidential and/or
privileged information. Any unauthorized review, use, disclosure or
distribution of this communication is expressly prohibited. If you are
not the intended recipient, please contact the sender by reply e-mail
and destroy any and all copies of the original message.

Thank you for your cooperation.

--
This message has been scanned for viruses and dangerous content by
Secure Resource, and is believed to be clean.
MailScanner thanks transtec Computers for their support.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jaearick at COLBY.EDU  Wed Nov 17 15:18:18 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:36 2006
Subject: Mailto's being marked as detected fraud attempt.
Message-ID: <mailman.4775.1137101256.24926.mailscanner@lists.mailscanner.info>

Julian,

I've started paying attention to the rcs/cvs version numbers at the
top of the file, every time a new version of Message.pm flies by.
This one is 1.126.2.158 2004/10/27, but the complete copy you posted
a couple of days ago (the one I'm running) is 1.126.2.166 2004/11/15.
Confusion reigns for those of us trying to keep up.

Jeff Earickson
Colby College

On Wed, 17 Nov 2004, Julian Field wrote:

> Date: Wed, 17 Nov 2004 15:04:33 +0000
> From: Julian Field <mailscanner@ECS.SOTON.AC.UK>
> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Mailto's being marked as detected fraud attempt.
>
> Please try the attached Message.pm file. It's a 1-line change that should do
> the trick.
>
> On 17/11/04 2:05 pm, "Quentin Campbell" <Q.G.Campbell@NEWCASTLE.AC.UK>
> wrote:
>> Julian
>>
>> One bit of help would be considering exempting 'href="file:www...."'
>> tags.
>>
>> It appears that in some circumstances Outlook/Exchange converts the URL
>> www.ncl.ac.uk/research/institutes/ionslides into
>> 'href="file:www.ncl.ac.uk/research/institutes/ionslides"' rather than
>> 'href="http://www.ncl.ac.uk/research/institutes/ionslides"'.
>
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From rcooper at DWFORD.COM  Wed Nov 17 15:23:19 2004
From: rcooper at DWFORD.COM (Rick Cooper)
Date: Thu Jan 12 21:27:36 2006
Subject: Problem with ClamAVmodule
Message-ID: <mailman.4776.1137101256.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> Behalf Of Richard Lynch
> Sent: Wednesday, November 17, 2004 9:44 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Problem with ClamAVmodule
>
>
> Julian Field wrote:
>
> >You have found a bug, but I'm not sure it is easy to work around.
> >You need to set
> >Allow Password-Protected Archives = yes
> >and not use a ruleset. I allow a ruleset as this is only the
> case when using
> >the "clamavmodule" virus scanner. I guess I should put a check
> in there to
> >ensure that this is a simple value when using clamavmodule.
> >
> >
> I see.  You're testing the value of "Allow Password-Protected Archives"
> which returns "0" since it's not "yes" (i.e. it's a file reference), and
> it passes the "Mail::ClamAV::CL_SCAN_BLOCKENCRYPTED()" parameter to
> Mail::ClamAV.
>
> Solving this is problematic.  What about adding a user supplied option
> list for Mail::ClamAV in MailScanner.conf?  Then, you could make the
> call without making the test on "allowpasszips".  Something like...
>
> $results = $Clam->scan("$dirname/$childname/$filename",
>            Mail::ClamAV::CL_SCAN_ARCHIVE() |
>            MailScanner::Config::Value('clammodopt') |
>            Mail::ClamAV::CL_SCAN_OLE2());
>
> Then users could specify the CL_SCAN_BLOCKENCRYPTED option if
> they want it.  Or perhaps, don't pass the option at all since MS
> provides that facility on its own anyway.
>

Actually MS doesn't handle password protected RARs on it's own. If that
option isn't there then clamavmodule will not flag the rar as a problem. I
had added this because the Unrar function I had submitted was never
accepted. RARs are not handled like Zips (except for my own patched system).
If Julian doesn't have time to look at this I can try and find sometime soon
to see if I can do something with it... I mistakenly assumed (my bad) that
the allow password protected archives would be correct at a given moment...
that the rules set was already processed, but I guess that couldn't happen
until delivery processing :->[

Unless something has changed in the latest betas, the RAR files are not
processed like zips in terms in file name/type checks are passwords. You
will note some commented references in the clamavmodule code that related to
$haverar, that is because if the UnpackRar function exists then
CL_SCAN_BLOCKENCRYPTED becomes redundant.

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Wed Nov 17 15:29:27 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:36 2006
Subject: Mailto's being marked as detected fraud attempt.
Message-ID: <mailman.4777.1137101256.24926.mailscanner@lists.mailscanner.info>

Don't take any notice of the rcs/cvs version numbers. I don't work directly
in the CVS tree, I work in another development area. When I'm happy
something works, I copy it to the CVS tree and commit it. So the version in
the CVS tree and my devel copy of the file will have different version
numbers. Depending on what copy of the file I happen to post to the list,
you'll get different cvs version numbers.

I should try to post the copy of the file from the CVS tree, but that isn't
always possible as I may be working on more than one thing at once and don't
want to commit it yet.

I'll try to behave better in future, promise :o)


On 17/11/04 3:18 pm, "Jeff A. Earickson" <jaearick@COLBY.EDU> wrote:

> Julian,
>
> I've started paying attention to the rcs/cvs version numbers at the
> top of the file, every time a new version of Message.pm flies by.
> This one is 1.126.2.158 2004/10/27, but the complete copy you posted
> a couple of days ago (the one I'm running) is 1.126.2.166 2004/11/15.
> Confusion reigns for those of us trying to keep up.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From michele at BLACKNIGHTSOLUTIONS.COM  Wed Nov 17 14:48:44 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:36 2006
Subject: Upgrade Query
Message-ID: <mailman.4778.1137101256.24926.mailscanner@lists.mailscanner.info>

MailScanner mailing list wrote:
> Carinus Carelse wrote:
>> Ja thats the rpm upgrade though i want to upgrade a sparc server with
>> the tar.gz version.
>
>
> Ok, I'm sorry, I'm the one who wrote the MAQ and I don't have
> a non-rpm system to upgrade, so I don't really know.  I know
> that there is a ./install script even in the non-rpm, that might be
> the solution.


The tar.gz upgrade is very similar. Admittedly I haven't done it since the
install.sh version was first released, but it worked very well.





Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
http://www.blacknight.ie/specialoffers.html

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Q.G.Campbell at NEWCASTLE.AC.UK  Wed Nov 17 15:33:37 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:36 2006
Subject: Mailto's being marked as detected fraud attempt
    (text->RTF/HTML conversion problem)
Message-ID: <mailman.4779.1137101256.24926.mailscanner@lists.mailscanner.info>

Julian

Thanks for that. I will not try it out today as I have reverted to the
4.35.11-1 Message.pm to get a breathing space from user complaints.

The next step is to control the application of the phishing net by using
a MS ruleset as Martin Hepworth is doing. We will exempt our outgoing
mail traffic.

Then I can go back to the modified Message.pm and try your latest
version.

I have confirmed that it is the text -> RTF convertor used by
Outlook/Exchange version 6.5.6944.0 that is converting
('www.ncl.ac.uk/...)' to '(</FONT><A
HREF=3D"file=://www.ncl.ac.uk..."></U></FONT></U><U><U>FONT
COLOR=3D"#0000FF" ...'   

AND in addition it converts 'E-mail: c.d.ingram@ncl.ac.uk' to 'E-mail:
</FONT><A HREF=3D"mailto:c.d.ingram@ncl.ac.uk"></FONT></U><U><FONT
COLOR=3d"#0000FF" ...'

If he uses the same signature as part of an HTML message the URL is left
as-is but the "E-mail: c.d.ingram@ncl.ac.uk" is converted similarly to
that which takes place for RTF.

I will send separately copies of the same signature lines as received:

1. in a plain text message
2. in an RTF message
3. in an HTML message
   
Quentin
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own."  

>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>Sent: 17 November 2004 15:05
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Mailto's being marked as detected fraud attempt.
>
>Please try the attached Message.pm file. It's a 1-line change 
>that should do
>the trick.
>
>On 17/11/04 2:05 pm, "Quentin Campbell" <Q.G.Campbell@NEWCASTLE.AC.UK>
>wrote:
>> Julian
>>
>> One bit of help would be considering exempting 'href="file:www...."'
>> tags.
>>
>> It appears that in some circumstances Outlook/Exchange 
>converts the URL
>> www.ncl.ac.uk/research/institutes/ionslides into
>> 'href="file:www.ncl.ac.uk/research/institutes/ionslides"' rather than
>> 'href="http://www.ncl.ac.uk/research/institutes/ionslides"'.
>
>
>--
>Julian Field
>www.MailScanner.info
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Wed Nov 17 15:48:17 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:36 2006
Subject: All deliveries are deferred (exim - openprotect)
Message-ID: <mailman.4780.1137101256.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "windows-1254" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Ali Engin Erođuz wrote:

> Hello,
> 
> I've a problem on my mail server. I can't get or post any mails. All 
> mails are rejected by same reason that/ "All deliveries are deferred"/. 
> I'm using exim-4.42-1 and read the documentation about /"defer_router" 
> /configuration in exim.conf.in. I've installed mailscanner by 
> openprotect and did the changes what the docs says for my exim version. 
> I only can receive mails by disabling openprotect.
> 
> What would i do to solve the problem.
> 
> Best Regards.
> Ali Engin
> 

Ali

I presume you are start BOTH instances of exim, one for the inbound and 
one for outbound queue...

--
Martin Hepworth
Senior Systems Administrator
Solid State Logic Ltd
tel: +44 (0)1865 842300


**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ELIQUID.COM  Wed Nov 17 13:57:51 2004
From: mailscanner at ELIQUID.COM (Wess)
Date: Thu Jan 12 21:27:37 2006
Subject: design issue - whitelist rules/blacklist rules
Message-ID: <mailman.4781.1137101256.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "utf-8" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Venkata,

Let me try to clear this up for you.

The whilelist rules override the blacklist rules everytime.


This is from spam.whitelist.rules

This first line tells MS to whilelist the entire domain. 
The second line tells MS to NOT whitelist and mail sent TO the user
specified.  These two rules will work together, the second being the
exception to the first.

FromOrTo:       *@domain.tld         yes
To:                   user@domain.tld    no


Only use the spam.blacklist.rules file if you want to just mark mail to
an account as garbage right away, without processing.  Keep in mind that
whitelist always over-rides the blacklist.

On Tue, 2004-11-16 at 19:52, Venkata Achanta wrote:

 Julian,

I am trying to accomplish the following

DENY   Anything From *@domain.com To *@domain.com
EXCEPT From no-reply@domain.com To *@domain.com

I have tried different combinations of whitelist and blacklist rules to get
this working and cant get it to work.

blacklist.rules
From:   *@domain.com and To: *@domain.com   yes
From:   no-reply@domain.com and To: *@domain.com   no
( WTH am i doing this? i want to disallow spoofing.MS running Linux box
delivers clean messages to our exchange server so all internal e-mail wont
go thru the MS box )

whitelist.rules
From:   no-reply@domain.com   yes
From:   no-reply@domain.com and To: *@domain.com   yes

(these are some administrative scipts e-mailing from that e-mail addy, i got
to get those but they are getting tagged as spam)


Here are the logs to reinforce my statements:

Nov 15 14:36:12 host sendmail[26920]: iAFMaCJI026920:
from=<no-reply@domain.com>, size=902, class=0, nrcpts=1,
msgid=<200411152236.iAFMaCJI026920@host.domain.com>, proto=ESMTP,
daemon=MTA, relay=host [127.0.0.1]
Nov 15 13:52:02 host MailScanner[29537]: Message iAFLldov018164 from
127.0.0.1 (no-reply@domain.com) is whitelisted
Nov 15 13:52:02 host MailScanner[29537]: Message iAFLldov018164 from
127.0.0.1 (no-reply@domain.com) to domain.com is spam (blacklisted)
Nov 15 13:53:18 host sendmail[24290]: iAFLldov018164: to=<johnq@domain.com>,
delay=00:05:39, xdelay=00:00:00, mailer=esmtp, pri=120902,
relay=[192.168.1.1], dsn=2.0.0, stat=Sent (
<200411152147.iAFLldov018164@domain.com> Queued mail for delivery)

And i dont understand why we are looking at blacklist rules and marking it
as spam if it is already whitelisted in the first place.Is this a design flaw ?

I want to hear from you what the design of this part of the mailscanner is ?
Doesnt the whitelist stuff override the blackklist ? why is it getting
blacklisted ?

Isnt there a way to do "deny by exception" in the mailscanner , i thought it
did but the logs prove me wrong.

Please advice.

Thanks much,
Venkata Achanta




I already started the discussion under "Re: whitelist rules are being
overridden by the blacklist rules ?" ,if you want to look what else i tried.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

 MailScanner on IRC

Community Support

irc.freenode.net

#mailscanner



------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From marcel-ml at IRC-ADDICTS.DE  Wed Nov 17 16:01:43 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:37 2006
Subject: Antivir founds a new Trojan..other virus-scanners do not
Message-ID: <mailman.4782.1137101257.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi there,



On Wed, 17 Nov 2004, Jan-Peter Koopmann wrote:

> > just for you all to know..
> >
> > there is a new Trojan in Germany spreading around..
> >
> > It is called
> >
> > TR/Pish.Telekom.A
>
> Yep. Unfortunatly thats very true. We had problems with this as well.
> Please note though that the mail itself does not contain the Trojan. It
> is a Phishing-Style mail that requests the user to open a link. If you
> do in IE the webpage uses some "old" IE vulnerabilities to download the
> trojan in the background. Local virus scanners detect that vulnerability
> (Microsoft VM problem), at least eTrust did here.

Yes..it is a html-mail, opening a frame, which then installs the trojan.


>
> So technically it is "ok" for the other virus scanners not to detect
> this, since it is "only" a mail message....

But some users do use a webinterface via IE..and this would get very
boring..as only Antivir and Sophos seems to know this stuff.. :(

Haven´t tried on my Windows-Maschine with AVG or Norton..maybe i shoud
start this OS again ;)

Greetings

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From marcel-ml at IRC-ADDICTS.DE  Wed Nov 17 16:05:47 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:37 2006
Subject: Antivir founds a new Trojan..other virus-scanners do not
Message-ID: <mailman.4783.1137101257.24926.mailscanner@lists.mailscanner.info>

Hi there,

>
> Do these look familiar?
>
> http://www.sophos.com/search/index.cgi?scope=whole_site&terms=TR%2FPish.Tele
> kom.A&x=15&y=6
>
Not really ;)

this seems to be a new variation of this stuff..

Maybe i should post it into the web :)

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Jan-Peter.Koopmann at SECEIDOS.DE  Wed Nov 17 16:09:19 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:37 2006
Subject: Antivir founds a new Trojan..other virus-scanners do not
Message-ID: <mailman.4784.1137101257.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> Yes..it is a html-mail, opening a frame, which then installs the
> trojan. 

The ones I saw were not opening the mail itself (since MailScanner should have disarmed the tags) but things started getting funny the moment the people clicked on the link...

> But some users do use a webinterface via IE..and this would
> get very boring..

True. But if the objectcode etc. tags are disarmed then nothing should happen _automatically_. Still: Bad thing most anti-vir packages do not react to this since it seems to be a german problem only... 

Regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From marcel-ml at IRC-ADDICTS.DE  Wed Nov 17 16:25:33 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:37 2006
Subject: Problems with the latest SpamAssassin
Message-ID: <mailman.4785.1137101257.24926.mailscanner@lists.mailscanner.info>

Hi there,

it seems that, if i do install the latest SpamAssassin, some weird things
are happening with MS itself.

It starts a lot of tasks until my ram is full.
As this only happenes with the latest version, i reinstalled the
SA-Version 2.64..

now my question..

how do i update the tests? As i do want to use the latest tests itself..

someone mentioned rules_du_jour or something like that..

any ideas where i could find that?

Thanks in advance

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From lists at TRCINTL.COM  Wed Nov 17 16:26:43 2004
From: lists at TRCINTL.COM (Kyle Harris)
Date: Thu Jan 12 21:27:37 2006
Subject: SpamAssassin 3
Message-ID: <mailman.4786.1137101257.24926.mailscanner@lists.mailscanner.info>

Now that SpamAssassin 3 has been out for a little while and several on this
list have updated to it, I am curious.  What is the overall opinion as to
whether or not it catches more spam than the old 2.63 version running with
MailScanner?

I realize that there are many factors involved in making this determination,
but an off-the-cuff discussion is more what I am looking for.  Perhaps the
assumption should also be made that the 2.63 version was using some of the
more popular rule additions such as the antidrug.cf and the like.  I realize
that many of these are included in the new version so I thought I would
throw that in.

For those that have made the upgrade, are you generally seeing more spam
being caught, less being caught, or about the same?  Opinions?

Kyle Harris
IT Manager
TRC International, Ltd.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From marco at XSSNET.COM  Wed Nov 17 16:32:21 2004
From: marco at XSSNET.COM (Marco Benton)
Date: Thu Jan 12 21:27:37 2006
Subject: Problems with the latest SpamAssassin
Message-ID: <mailman.4787.1137101257.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Marcel Blenkers wrote:

>Hi there,
>
>it seems that, if i do install the latest SpamAssassin, some weird things
>are happening with MS itself.
>
>It starts a lot of tasks until my ram is full.
>As this only happenes with the latest version, i reinstalled the
>SA-Version 2.64..
>
>now my question..
>
>how do i update the tests? As i do want to use the latest tests itself..
>
>someone mentioned rules_du_jour or something like that..
>
>any ideas where i could find that?
>
>

try getting rid of all the custom rules you previously had.  most of the
custom rules are now built into SA.

check out the SA doco page for the Wiki on how setup RDJ (rules_du_jour)
or www.rulesemporium.com.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mkettler at EVI-INC.COM  Wed Nov 17 16:49:47 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:37 2006
Subject: SpamAssassin 3
Message-ID: <mailman.4788.1137101257.24926.mailscanner@lists.mailscanner.info>

At 11:26 AM 11/17/2004, Kyle Harris wrote:
>Now that SpamAssassin 3 has been out for a little while and several on this
>list have updated to it, I am curious.  What is the overall opinion as to
>whether or not it catches more spam than the old 2.63 version running with
>MailScanner?
>

<snip>

>For those that have made the upgrade, are you generally seeing more spam
>being caught, less being caught, or about the same?  Opinions?

I've not made the upgrade yet. I'm on 2.64 (I'd not run 2.63 or older on a
production box. It has a malformed message DoS vulnerability).

However, I've been closely following the threads on this subject here, and
on sa-talk, and I've been studying the SA 3.0 rules, mass-checks, scores,
and code a bit.

Really, you hear a lot of people claiming that SA 3.0 catches more, and a
lot of people claiming it catches less.

The general summary I can conclude from talking to lots of happy and
unhappy upgraders is:

1) anyone upgrading from stock SA 2.6x sees an improvement.

2) Anyone who already has surbl, antidrug, and all the other add-ons that
are now built into SA 3.0 see much less improvement. The mass-check tested
scores are much less aggressive than those assigned by many rule-writers,
some of whom still don't quite understand some of the detailed subtleties
of how SA scoring works (I'm talking scoreset balance issues, overlapping
rules with paired-firing, the real impacts of 'FPs are 100 times worse than
FNs" concept in the score assignment, etc)


3) anyone with a NATed mailserver, or other mailserver configuration where
your externally accessible MX appears to be a reserved IP, must set
trusted_networks manually. Otherwise major FN problems ensue from
ALL_TRUSTED misfiring. The trusted_networks problem is not new to 3.0, it's
been around since 2.50, but it's impact is much more severe in 3.0 than
earlier versions. (in 2.6x and 2.5x it mostly caused dialup rbls to
false-positive)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jaearick at COLBY.EDU  Wed Nov 17 16:51:07 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:37 2006
Subject: how to write an anti-phishing ruleset (and test?)
Message-ID: <mailman.4789.1137101257.24926.mailscanner@lists.mailscanner.info>

Gang,

Our alumni office uses one of these click-thru counter services for
the alumni newsletter.  They sent out their monthly newsletter a
couple of days ago and all of their URLs got marked as phishing attempts
by MailScanner.  They were peeved at me.  Now I need to write a
ruleset to exempt the click-thru service and then be able to test it.
A sample bit of URL code is:

<p>See more at <a href="http://www.xyz.com/links/link.cgi?31889|363543|CLY-20041117090021">http://www.colby.edu/eag</a>.</p>

If I email myself this snippet, I can't get MailScanner to bark like it
did for the real message (which came from xyz.com).  Why?  How to test
a ruleset?

What would a sample anti-phishing ruleset look like?  Something like:

    #---exempt from xyz.com->colby.edu from anti-phishing tests
    From: xyz.com and To: colby.edu     no

    #---everybody else gets tested
    Default: yes

An example in the etc/rules/EXAMPLES file would be nice.

Jeff Earickson
Colby College

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From marcel-ml at IRC-ADDICTS.DE  Wed Nov 17 16:50:31 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:37 2006
Subject: Problems with the latest SpamAssassin
Message-ID: <mailman.4790.1137101257.24926.mailscanner@lists.mailscanner.info>

Hi there..

[...]

> >
>
> try getting rid of all the custom rules you previously had.  most of the
> custom rules are now built into SA.

I know that they are :( but the last version 3.0.1 did not work properly
with MS..

I could turn SA off within the MS.conf, but i do not want SA run again
after the Mail enters via procmail.. :(

and as i did not have any custom rules on my own..there is nothing to get
rid off ;)

>
> check out the SA doco page for the Wiki on how setup RDJ (rules_du_jour)
> or www.rulesemporium.com.

it seems that the website of RDJ is down :(

Thanks for the help anyway

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From engin at COZUMTEKNIK.COM  Wed Nov 17 16:59:22 2004
From: engin at COZUMTEKNIK.COM ([windows-1254] Ali Engin Erođuz)
Date: Thu Jan 12 21:27:37 2006
Subject: All deliveries are deferred (exim - openprotect)
Message-ID: <mailman.4791.1137101257.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "windows-1254" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

So, how can i fix it. I only installed openprotect and it did all the
configuration. 
How can i control or disable one of that instances if i have to. And i
couldn't understand why does it deferred all mailboxes, can you make a
detailed explanation on it.

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Martin Hepworth
Sent: Wednesday, November 17, 2004 5:48 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: All deliveries are deferred (exim - openprotect)

Ali Engin Erođuz wrote:

> Hello,
> 
> I've a problem on my mail server. I can't get or post any mails. All 
> mails are rejected by same reason that/ "All deliveries are deferred"/.
> I'm using exim-4.42-1 and read the documentation about /"defer_router" 
> /configuration in exim.conf.in. I've installed mailscanner by 
> openprotect and did the changes what the docs says for my exim version.
> I only can receive mails by disabling openprotect.
> 
> What would i do to solve the problem.
> 
> Best Regards.
> Ali Engin
> 

Ali

I presume you are start BOTH instances of exim, one for the inbound and one
for outbound queue...

--
Martin Hepworth
Senior Systems Administrator
Solid State Logic Ltd
tel: +44 (0)1865 842300


**********************************************************************

This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the system manager.

This footnote confirms that this email message has been swept for the
presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Wed Nov 17 17:08:00 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:37 2006
Subject: how to write an anti-phishing ruleset (and test?)
Message-ID: <mailman.4792.1137101257.24926.mailscanner@lists.mailscanner.info>

On 17/11/04 4:51 pm, "Jeff A. Earickson" <jaearick@COLBY.EDU> wrote:

> Gang,
>
> Our alumni office uses one of these click-thru counter services for
> the alumni newsletter.  They sent out their monthly newsletter a
> couple of days ago and all of their URLs got marked as phishing attempts
> by MailScanner.  They were peeved at me.  Now I need to write a
> ruleset to exempt the click-thru service and then be able to test it.
> A sample bit of URL code is:
>
> <p>See more at <a
> href="http://www.xyz.com/links/link.cgi?31889|363543|CLY-20041117090021">http:
> //www.colby.edu/eag</a>.</p>
>
> If I email myself this snippet, I can't get MailScanner to bark like it
> did for the real message (which came from xyz.com).  Why?  How to test
> a ruleset?
>
> What would a sample anti-phishing ruleset look like?  Something like:
>
>     #---exempt from xyz.com->colby.edu from anti-phishing tests
>     From: xyz.com and To: colby.edu     no
>
>     #---everybody else gets tested
>     Default: yes
>
> An example in the etc/rules/EXAMPLES file would be nice.

It looks just like any other ruleset.

From: your-alumni@office.address no
FromOrTo: default yes

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From marco at XSSNET.COM  Wed Nov 17 17:02:20 2004
From: marco at XSSNET.COM (Marco Benton)
Date: Thu Jan 12 21:27:37 2006
Subject: SpamAssassin 3
Message-ID: <mailman.4793.1137101257.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Kyle Harris wrote:

>Now that SpamAssassin 3 has been out for a little while and several on this
>list have updated to it, I am curious.  What is the overall opinion as to
>whether or not it catches more spam than the old 2.63 version running with
>MailScanner?
>
>
<...snip...>

i've had a few production SA 2.64 servers with oodles of extra rules and
it was SLOW but caught a huge percentage of spam...  after upgrading to
SA 3 i knocked down the number of rules (redundant) and found just a few
minor spam get through, but mail flows a little faster.

my opinion is 2.64 w/ the SURBL patch, all SURBL lists, and extra rules
from SARE does a great job.  but the rules from 2.6x are pretty
outdated, the SA 3 rules are more current...  so there's nothing wrong
with updating.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Wed Nov 17 17:22:44 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:37 2006
Subject: All deliveries are deferred (exim - openprotect)
Message-ID: <mailman.4794.1137101257.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "windows-1254" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Ali

have a look on the mailscanner.info site about installing MailScanner, 
esp for Exim.

I've no idea how the openprotect softwares works, and especially if it 
works with Exim rather than sendmail..

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Ali Engin Erođuz wrote:
> So, how can i fix it. I only installed openprotect and it did all the
> configuration. 
> How can i control or disable one of that instances if i have to. And i
> couldn't understand why does it deferred all mailboxes, can you make a
> detailed explanation on it.
> 
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
> Of Martin Hepworth
> Sent: Wednesday, November 17, 2004 5:48 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: All deliveries are deferred (exim - openprotect)
> 
> Ali Engin Erođuz wrote:
> 
> 
>>Hello,
>>
>>I've a problem on my mail server. I can't get or post any mails. All 
>>mails are rejected by same reason that/ "All deliveries are deferred"/.
>>I'm using exim-4.42-1 and read the documentation about /"defer_router" 
>>/configuration in exim.conf.in. I've installed mailscanner by 
>>openprotect and did the changes what the docs says for my exim version.
>>I only can receive mails by disabling openprotect.
>>
>>What would i do to solve the problem.
>>
>>Best Regards.
>>Ali Engin
>>
> 
> 
> Ali
> 
> I presume you are start BOTH instances of exim, one for the inbound and one
> for outbound queue...
> 
> --
> Martin Hepworth
> Senior Systems Administrator
> Solid State Logic Ltd
> tel: +44 (0)1865 842300
> 
> 
> **********************************************************************
> 
> This email and any files transmitted with it are confidential and intended
> solely for the use of the individual or entity to whom they are addressed.
> If you have received this email in error please notify the system manager.
> 
> This footnote confirms that this email message has been swept for the
> presence of computer viruses and is believed to be clean.
> 
> **********************************************************************
> 
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
> archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 
> Support MailScanner development - buy the book off the website!
> 
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Kevin_Miller at CI.JUNEAU.AK.US  Wed Nov 17 17:26:47 2004
From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller)
Date: Thu Jan 12 21:27:37 2006
Subject: Mailto's being marked as detected fraud attempt.
Message-ID: <mailman.4795.1137101257.24926.mailscanner@lists.mailscanner.info>

Julian Field wrote:
> How could I improve it?
>

I haven't played w/it yet so maybe I'm completely missing the boat, but what
about stripping out the link entirely and just turning it into straight
text?  Often, when I get an HTML mail at my home account I'll forward it to
paypal or ebay or wherever.  I use Mozilla which converts it to text so what
I end up with is the displayed text (where they want you to think you're
going) followed by the actual URL.  Don't have an example at hand, but
something like:
www,ebay,com <http;//192.168.3.4/phishingsite/>  (Note that I altered the
"." and ";" because Outlook wanted to make the examples actual links if I
didn't which might alter the example I'm trying to give.)

If the email is legitimate, the user has the real link right there.  They'll
have to copy/paste it into their browser, which for me would be a small
price to pay for more security...


...Kevin
--
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Admin., Mail Admin.
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From john at TRADOC.FR  Wed Nov 17 17:28:18 2004
From: john at TRADOC.FR (John Wilcock)
Date: Thu Jan 12 21:27:37 2006
Subject: how to write an anti-phishing ruleset (and test?)
Message-ID: <mailman.4796.1137101257.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Wed, 17 Nov 2004 11:51:07 -0500, Jeff A. Earickson wrote:
> What would a sample anti-phishing ruleset look like?  Something like:

Julian has answered the specific question. 

However this highlights a big problem in the anti-phishing system - you
can whitelist specific senders using a ruleset, but both the
envelope-sender and the From: header are trivial to forge.

For example I have a user who receives ebay notices containing a
mismatched URL - possible fraud attempt from "click2.ebay.com" claiming
to be www.ebay.fr - but if I set up a ruleset containing
"From: *@reply.ebay.com no" then any ebay phishing attacks can also get
through simply by forging the From: address. 

One solution would be to whitelist based on the first non-trusted (i.e.
not a secondary MX) host in the Received: headers, but I don't think
this is currently possible in MS. In any case it would mean keeping
track of the outgoing mail hosts for the problem domains. My ebay
example is currently delivered by camppool*.emailebay.com - yet another
domain to keep track of.

A better solution IMO would be the ability to whitelist based on the
actual domain in the URL. I don't care in the slightest if
click2.ebay.com claims to be www.ebay.fr, but I really don't want
ebay-phisher.com to get away with the same claim!

John.

-- 
-- Over 2500 webcams from ski resorts around the world - www.snoweye.com
-- Translate your technical documents and web pages    - www.tradoc.fr

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Wed Nov 17 17:53:15 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:37 2006
Subject: how to write an anti-phishing ruleset (and test?)
Message-ID: <mailman.4797.1137101257.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

John Wilcock wrote:

>On Wed, 17 Nov 2004 11:51:07 -0500, Jeff A. Earickson wrote:
>
>
>>What would a sample anti-phishing ruleset look like?  Something like:
>>
>>
>
>Julian has answered the specific question.
>
>However this highlights a big problem in the anti-phishing system - you
>can whitelist specific senders using a ruleset, but both the
>envelope-sender and the From: header are trivial to forge.
>
>For example I have a user who receives ebay notices containing a
>mismatched URL - possible fraud attempt from "click2.ebay.com" claiming
>to be www.ebay.fr - but if I set up a ruleset containing
>"From: *@reply.ebay.com no" then any ebay phishing attacks can also get
>through simply by forging the From: address.
>
>One solution would be to whitelist based on the first non-trusted (i.e.
>not a secondary MX) host in the Received: headers, but I don't think
>this is currently possible in MS. In any case it would mean keeping
>track of the outgoing mail hosts for the problem domains. My ebay
>example is currently delivered by camppool*.emailebay.com - yet another
>domain to keep track of.
>
>A better solution IMO would be the ability to whitelist based on the
>actual domain in the URL. I don't care in the slightest if
>click2.ebay.com claims to be www.ebay.fr, but I really don't want
>ebay-phisher.com to get away with the same claim!
>
>John.
>
Does the file need to be any more than a list of hostnames? Do I need to
allow *.domain.com as well? What syntax would you like for this file?
Should it just look like any other ruleset file? It would be interpreted
differently as the "direction" in the rule would be ignored, or it would
only allowed to be "From". The address pattern would be used to match
the hostname of the real destination of the link, only the hostname bit
of the address pattern would be used.

It's purpose is similar to a normal ruleset, but not quite the same. I
don't want to end up confusing users.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at LISTS.COM.AR  Wed Nov 17 17:53:19 2004
From: mailscanner at LISTS.COM.AR (Leonardo Helman)
Date: Thu Jan 12 21:27:37 2006
Subject: es/languages.conf
Message-ID: <mailman.4798.1137101257.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi

In MailScanner/etc/reports/es/languages.conf
there are a few translations missing.


AttachmentTooSmall = El adjunto es demasiado pequeńo


and the MCP ones, but never used those.


Saludos
--  
Leonardo Helman
Pert Consultores
Argentina

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From marco at XSSNET.COM  Wed Nov 17 18:33:58 2004
From: marco at XSSNET.COM (Marco Benton)
Date: Thu Jan 12 21:27:37 2006
Subject: Mailto's being marked as detected fraud attempt.
Message-ID: <mailman.4799.1137101257.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Martin Hepworth wrote:

> Julian
>
> good question...I'm not sure much can be done apart from tune the thing
> using rules....
>
> I think the phishing detector is showing how badly formatted  many URL's
> actually are, esp in legitimate  html based marketing emails. I'm not
> sure how many are sent from third party marketing people, rather than
> direct. Perhaps some sort of check  on the sending ip-address matching
> the sender domain as well.??? But this means a deeper analysis of the
> whole email, so perhaps it's dropping into a SA 3 plugin solution. Or
> even just making sure  people are using the phishing surbl.org URI RBL???
>
> Anyone else any ideas????


i think you are correct...  like what SA does with URI's..  you might
have to do a reverse lookup on the URL to see if it matches.  SA wont
change the message body but MS will.

but this might add overhead.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ebruce at HPMICH.COM  Wed Nov 17 13:23:43 2004
From: ebruce at HPMICH.COM (Ed Bruce)
Date: Thu Jan 12 21:27:37 2006
Subject: Problem with ClamAVmodule
Message-ID: <mailman.4800.1137101257.24926.mailscanner@lists.mailscanner.info>

I have this problem as well. I reported it several weeks ago but never
got an answer. I'm glad to hear this is a bug 'cause I was thinking it
must have been something I had done.

Julian Field wrote:

 You have found a bug, but I'm not sure it is easy to work around.
You need to set
Allow Password-Protected Archives = yes
and not use a ruleset. I allow a ruleset as this is only the case when using
the "clamavmodule" virus scanner. I guess I should put a check in there to
ensure that this is a simple value when using clamavmodule.

On 16/11/04 11:52 pm, "Richard Lynch" <rich@MAIL.WVNET.EDU> wrote:

  

 This past weekend I upgraded our MailScanner servers to version
4.35.11-1 along with SA 3.0.1,  ClamAV-0.80, and Mail-ClamAV-0.13.  The
problem is that password protected zips always get flagged by
clamavmodule even when the recipient is listed as being allowed in a
ruleset for "Allow Password-Protected Archives".   I also have "Maximum
Archive Depth = 0".   The message in the maillog is...

... ClamAVModule::INFECTED:: Encrypted.Zip:: ...

When I run with Virus Scanners set to clamav things work as expected --
it's only when I use clamavmodule that I have this problem.  I suspect
that this is a bug in Mail-ClamAV but I suppose it could be a problem
with MS.  The relevant code is in  SweepViruses.pm at around line 998.  ...

      if (MailScanner::Config::Value('allowpasszips')) { # || $haverar) {
        $results = $Clam->scan("$dirname/$childname/$filename",
                               Mail::ClamAV::CL_SCAN_ARCHIVE() |
                               Mail::ClamAV::CL_SCAN_OLE2());
      } else {
        $results = $Clam->scan("$dirname/$childname/$filename",
                               Mail::ClamAV::CL_SCAN_ARCHIVE() |
                               Mail::ClamAV::CL_SCAN_BLOCKENCRYPTED() |
                               Mail::ClamAV::CL_SCAN_OLE2());
      }

The option CL_SCAN_BLOCKENCRYPTED is used by Mail-ClamAV to pass to
ClamAV and indicates that password protected zips should be treated as
infected.  It seems clear to me that MS is calling the interface
correctly depending on the setting of "Allow Protected-Protected Archives".

So... Is anyone else having this problem?   Am I doing something dumb?
(I realize that answers to these two questions are not necessarily
dependent :) ).

 If this is a Mail-ClamAV problem how does one get it reported?

Thanks,
Rich

--


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!
    

 --
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

  


 --
Ed Bruce
Health Plan of Michigan
Senior Programmer
Phone:  248.226.1512
FAX:    248.204.6569


--
This message, including any attachments, is intended solely for the use
of the named
recipients(s) and may contain confidential and/or privileged information.
Any
unauthorized review, use, disclosure or distribution of this
communication is expressly
prohibited. If you are not the intended recipient, please contact the
sender by reply
e-mail and destroy any and all copies of the original message. Thank you
for your
cooperation.
--
This message has been scanned for viruses and
dangerous content by Secure Resource, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From hostmaster at AGIMSA.COM.MX  Wed Nov 17 18:53:42 2004
From: hostmaster at AGIMSA.COM.MX (Cecilia [iso-8859-1] Martínez)
Date: Thu Jan 12 21:27:37 2006
Subject: Oversized Zip?
Message-ID: <mailman.4801.1137101257.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

At 05:07 p.m. 16/11/2004, you wrote:
>On Tue, Nov 16, 2004 at 09:56:24AM -0600, Cecilia Martínez wrote:
> > Fedora C1 / Ensim Pro 4.01 / MailScanner / Sendmail / ClamAV / SpamAssassin
> >
> >
> > Hello,
> >
> > Some ZIP attachments have been sent to quarantine because of their size,
> > which in fact I don't think it is too much (200-300 kb). I can't find where
> > to adjust this setting. Please help.
> >
> > This is the info sent to managers regarding the scanned message:
> >
> > Sender: user@domain.com
> > IP Address: 201.128.183.45
> >  Recipient: user1@domain.com, user2@domain.com
> >    Subject: re-envio de informacion
> >  MessageID: iAGFQfsg006140
> >    Info: PU_SINAN_A_USD_REV_1.zip contains Oversized Zip
> >     Info: PU_SINAN_B_USD_REV_1.zip contains Oversized Zip
> >
> >
>In clamd.conf, tune up ArchiveMaxCompressionRatio
>Try 700 and if it does not solve all cases increase it
>to 1000
>
>SL/
>---
>Stephane Lentz
>AES TSC

I can't find clamd.conf but in clamav.conf I found these:

ArchiveMaxFileSize = 10M (my setting)
ArchiveMaxRecursion = 0 (changed this to 1000 and I keep getting the same 
'oversized zip' message)
ArchiveMaxFiles = 0
#ArchiveLimitMemoryUsage

Any other idea?

Thanks

Cecillia Mtz
Emagen





-- 
Mensaje escaneado por el servicio Anti-Virus de correo de CEGIMSA

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From peter at UCGBOOK.COM  Wed Nov 17 19:00:29 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:37 2006
Subject: Oversized Zip?
Message-ID: <mailman.4802.1137101257.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Cecilia Martínez wrote:
> I can't find clamd.conf but in clamav.conf I found these:

Sorry for not answering your original question but if you have 
clamav.conf instead of clamd.conf you really should upgrade Clam to the 
latest version, 0.80.

-- 
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jaearick at COLBY.EDU  Wed Nov 17 20:03:06 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:37 2006
Subject: anti-phishing ruleset, still no cigar
Message-ID: <mailman.4803.1137101257.24926.mailscanner@lists.mailscanner.info>

Julian,

I'm beating my head against the wall on this anti-phishing ruleset.  The
email gets actually sent from xyz.com, with a "from" line of colby, like
so (from the mail headers):

Return-Path: <automailer-bounce@xyz.com>
(header traffic info removed)
Date: Wed, 17 Nov 2004 14:48:07 -0500 (EST)
From: Colby Alumni Relations <ootb@colby.edu>
To: Out of the Blue <jaearick@colby.edu>
Subject: test4

And the URL in the body of the message gets the red flag, like so:

See more at
<a
href="http://www.xyz.com/links/link.cgi?31957|9003843|CLY-200411171
44457"><font color="red"><b>MailScanner has detected a possible fraud attempt
from "www.xyz.com" claiming to be</b></font>
http://www.colby.edu/eag</a>.

My anti-phishing ruleset looks like so:

    #---exempt sites from anti-phishing rules
    From:   137.146.        no
    From:   127.0.0.1       no
    From:   xyz.com   no
    From:   colby.edu       no

    #---do anti-phishing on everything else
    FromOrTo:       default yes

Am I doing something stoopid here, or have I hit a bug?  Help!

Jeff Earickson
Colby College

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at LISTS.COM.AR  Wed Nov 17 20:00:18 2004
From: mailscanner at LISTS.COM.AR (Leonardo Helman)
Date: Thu Jan 12 21:27:37 2006
Subject: SpamAssassin perl-5.8.5
Message-ID: <mailman.4804.1137101257.24926.mailscanner@lists.mailscanner.info>

Hi

It's me or newer versions of perl (5.8.5)
put SpamAssassin modules in

  $val/lib/site_perl/$perl_vers

instead of
  $val/lib/perl5/site_perl/$perl_vers

where
  $val=MailScanner::Config::Value('spamassassininstallprefix')



Cheers
--
Leonardo Helman
Pert Consultores
Argentina

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From john at TRADOC.FR  Thu Nov 18 07:16:34 2004
From: john at TRADOC.FR (John Wilcock)
Date: Thu Jan 12 21:27:37 2006
Subject: how to write an anti-phishing ruleset (and test?)
Message-ID: <mailman.4805.1137101257.24926.mailscanner@lists.mailscanner.info>

On Wed, 17 Nov 2004 17:53:15 +0000, Julian Field wrote:
> >A better solution IMO would be the ability to whitelist based on the
> >actual domain in the URL. I don't care in the slightest if
> >click2.ebay.com claims to be www.ebay.fr, but I really don't want
> >ebay-phisher.com to get away with the same claim!
> >
> >John.
> >
> Does the file need to be any more than a list of hostnames? Do I need to
> allow *.domain.com as well? What syntax would you like for this file?
> Should it just look like any other ruleset file? It would be interpreted
> differently as the "direction" in the rule would be ignored, or it would
> only allowed to be "From". The address pattern would be used to match
> the hostname of the real destination of the link, only the hostname bit
> of the address pattern would be used.
> 
> It's purpose is similar to a normal ruleset, but not quite the same. I
> don't want to end up confusing users.

Firstly, I think you want to keep the Find Phishing Fraud setting as it
is, in case anyone wants to use a standard address-based ruleset for
this. 

As to the phishing whitelist, I think all that is needed is a list of
hostnames, yes. If you want it to look like a standard ruleset for
consistency, fair enough. Wildcards would be useful, though not
essential judging on the small sample available to me. 

While we're at it, trying to get this as near perfect as possible, how
about a Log Phishing Fraud setting, analogous to the current Log Iframe
Tags, to allow people to build up their whitelist before enabling the
detection. 

John.

-- 
-- Over 2500 webcams from ski resorts around the world - www.snoweye.com
-- Translate your technical documents and web pages    - www.tradoc.fr

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From greg at BLASTZONE.COM  Thu Nov 18 08:02:01 2004
From: greg at BLASTZONE.COM (Greg Deputy)
Date: Thu Jan 12 21:27:37 2006
Subject: Phishing detector apparently slogged up my server
Message-ID: <mailman.4806.1137101257.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Fedora core 2, MailScanner 4.35.9, Postfix 2.1.5.  Phishing detection
turned on.  Currently acting as a gateway (no mail on server, all gets
scanned and passed on to another server for delivery) for about 500 mail
boxes on 100 hosted domains.

Today I was looking at my mailscanner-mrtg page
(http://mx.blastzone.com/mailscanner-mrtg) and noticed that at around
1:30 am the CPU pegged on the box.  I spent some time trying to figure
out why, looking at the logs for a DOS attack or some evidence that the
box had been compromised, but found nothing.  

What I eventually figured out was Mailscanner seemed to be hitting the
same mail in the postfix hold queue over and over again.  It would hit
the mail, and apparently restart.  It would seem to hit the queue,
process a few messages, hit one, and then choke, restart.  It also
caused the CPU to be a lot more active (85% +) than it normally is
(~25%).  

I believe it was dying in the phishing detector logic for 2 reasons.
One, I kept seeing the same phishing detection over and over again in
the logs.  Two, I turned off the phishing detection in MailScanner.conf,
restarted MailScanner, and the queue cleared out and CPU dropped back to
normal.  

I can provide the entire logs if needed, but they're big.  Probably
around 20 megs worth, as I have the verbosity turned up pretty high at
the moment on both mailscanner and postfix for troubleshooting.

Here's a snippet of the log where you see MailScanner quoting part of
the same Phishing email over and over again.  Note the 'Big year
expected in 2005' and some HTML about 3 times below:

Nov 17 09:01:05 mx MailScanner[32483]: Found phishing fraud attack from
http://www.otcbb.com/asp/quote_module.asp?symbol=MTDN</a> 
Nov 17 09:01:05 mx MailScanner[32483]: <br><br> 
Nov 17 09:01:05 mx MailScanner[32483]: Big year expected in 2005 for
Motion DNA<br> 
Nov 17 09:01:05 mx MailScanner[32483]:   <br> 
Nov 17 09:01:05 mx MailScanner[32483]: Trading Symbol MTDN<br> 
Nov 17 09:01:05 mx MailScanner[32483]: Current Price (est.) $0.025<br> 
Nov 17 09:01:05 mx MailScanner[32483]: Valued Price (est.) $1.00<br><br>

Nov 17 09:01:07 mx postfix/smtpd[32344]: NOQUEUE: reject: RCPT from
pool-68-239-72-146.res.east.verizon.net[68.239.72.146]: 554 Service
unavailable; Client host [68.239.72.146] blocked using
sbl-xbl.spamhaus.org; http://www.spamhaus.org/query/bl?ip=68.239.72.146;
from=<subplr@verizon.net> to=<marquez@northwestrocketry.com> proto=SMTP
helo=<pool-68-239-72-146.res.east.verizon.net>
Nov 17 09:01:07 mx MailScanner[32525]: Using locktype = flock 
Nov 17 09:01:07 mx MailScanner[32525]: New Batch: Scanning 4 messages,
404119 bytes 
Nov 17 09:01:07 mx MailScanner[32525]: MCP Checks completed at 404119
bytes per second 
Nov 17 09:01:07 mx MailScanner[32525]: Spam Checks: Starting 
Nov 17 09:01:07 mx MailScanner[32525]: Spam Checks completed at 404119
bytes per second 
Nov 17 09:01:08 mx postfix/smtpd[32353]: NOQUEUE: reject: RCPT from
YahooBB219176178079.bbtec.net[219.176.178.79]: 554 Service unavailable;
Client host [219.176.178.79] blocked using sbl-xbl.spamhaus.org;
http://www.spamhaus.org/query/bl?ip=219.176.178.79;
from=<ldtxmzhlsmui@bbtec.net> to=<bragg@paratech-parachutes.com>
proto=SMTP helo=<yahoobb219176178079.bbtec.net>
Nov 17 09:01:09 mx MailScanner[32525]: Virus and Content Scanning:
Starting 
Nov 17 09:01:09 mx postfix/smtpd[32353]: NOQUEUE: reject: RCPT from
YahooBB219176178079.bbtec.net[219.176.178.79]: 554 Service unavailable;
Client host [219.176.178.79] blocked using sbl-xbl.spamhaus.org;
http://www.spamhaus.org/query/bl?ip=219.176.178.79;
from=<ldtxmzhlsmui@bbtec.net> to=<byrne@paratech-parachutes.com>
proto=SMTP helo=<yahoobb219176178079.bbtec.net>
Nov 17 09:01:09 mx postfix/smtpd[32353]: NOQUEUE: reject: RCPT from
YahooBB219176178079.bbtec.net[219.176.178.79]: 554 Service unavailable;
Client host [219.176.178.79] blocked using sbl-xbl.spamhaus.org;
http://www.spamhaus.org/query/bl?ip=219.176.178.79;
from=<ldtxmzhlsmui@bbtec.net> to=<ali@paratech-parachutes.com>
proto=SMTP helo=<yahoobb219176178079.bbtec.net>
Nov 17 09:01:10 mx MailScanner[32525]: Virus Scanning completed at
134706 bytes per second 
Nov 17 09:01:10 mx MailScanner[32525]: Found phishing fraud attack from
http://www.otcbb.com/asp/quote_module.asp?symbol=MTDN</a> 
Nov 17 09:01:10 mx MailScanner[32525]: <br><br> 
Nov 17 09:01:10 mx MailScanner[32525]: Big year expected in 2005 for
Motion DNA<br> 
Nov 17 09:01:10 mx MailScanner[32525]:   <br> 
Nov 17 09:01:10 mx MailScanner[32525]: Trading Symbol MTDN<br> 
Nov 17 09:01:10 mx MailScanner[32525]: Current Price (est.) $0.025<br> 
Nov 17 09:01:10 mx MailScanner[32525]: Valued Price (est.) $1.00<br><br>

Nov 17 09:01:10 mx postfix/smtpd[32353]: NOQUEUE: reject: RCPT from
YahooBB219176178079.bbtec.net[219.176.178.79]: 554 Service unavailable;
Client host [219.176.178.79] blocked using sbl-xbl.spamhaus.org;
http://www.spamhaus.org/query/bl?ip=219.176.178.79;
from=<ldtxmzhlsmui@bbtec.net> to=<abraham@paratech-parachutes.com>
proto=SMTP helo=<yahoobb219176178079.bbtec.net>
Nov 17 09:01:10 mx postfix/smtpd[32353]: NOQUEUE: reject: RCPT from
YahooBB219176178079.bbtec.net[219.176.178.79]: 554 Service unavailable;
Client host [219.176.178.79] blocked using sbl-xbl.spamhaus.org;
http://www.spamhaus.org/query/bl?ip=219.176.178.79;
from=<ldtxmzhlsmui@bbtec.net> to=<arrington@paratech-parachutes.com>
proto=SMTP helo=<yahoobb219176178079.bbtec.net>
Nov 17 09:01:11 mx postfix/smtpd[32344]: disconnect from
pool-68-239-72-146.res.east.verizon.net[68.239.72.146]
Nov 17 09:01:11 mx MailScanner[32562]: MailScanner E-Mail Virus Scanner
version 4.35.9 starting... 
Nov 17 09:01:11 mx MailScanner[32562]: Config: calling custom init
function ByDomainSpamBlacklist 
Nov 17 09:01:11 mx MailScanner[32562]: Starting up by-domain spam
blacklist, reading from /etc/MailScanner/spam.bydomain/blacklist 
Nov 17 09:01:11 mx MailScanner[32562]: Read blacklist for 2 domains 
Nov 17 09:01:11 mx MailScanner[32562]: Config: calling custom init
function ByDomainSpamWhitelist 
Nov 17 09:01:11 mx MailScanner[32562]: Starting up by-domain spam
whitelist, reading from /etc/MailScanner/spam.bydomain/whitelist 
Nov 17 09:01:11 mx MailScanner[32562]: Read whitelist for 5 domains 
Nov 17 09:01:14 mx MailScanner[32267]: New Batch: Scanning 4 messages,
404119 bytes 
Nov 17 09:01:14 mx MailScanner[32267]: MCP Checks completed at 404119
bytes per second 
Nov 17 09:01:14 mx MailScanner[32267]: Spam Checks: Starting 
Nov 17 09:01:14 mx MailScanner[32267]: Spam Checks completed at 404119
bytes per second 
Nov 17 09:01:15 mx postfix/smtpd[32353]: NOQUEUE: reject: RCPT from
YahooBB219176178079.bbtec.net[219.176.178.79]: 554 Service unavailable;
Client host [219.176.178.79] blocked using sbl-xbl.spamhaus.org;
http://www.spamhaus.org/query/bl?ip=219.176.178.79;
from=<ldtxmzhlsmui@bbtec.net> to=<brantley@paratech-parachutes.com>
proto=SMTP helo=<yahoobb219176178079.bbtec.net>
Nov 17 09:01:15 mx MailScanner[32562]: Using locktype = flock 
Nov 17 09:01:15 mx postfix/smtpd[32353]: NOQUEUE: reject: RCPT from
YahooBB219176178079.bbtec.net[219.176.178.79]: 554 Service unavailable;
Client host [219.176.178.79] blocked using sbl-xbl.spamhaus.org;
http://www.spamhaus.org/query/bl?ip=219.176.178.79;
from=<ldtxmzhlsmui@bbtec.net> to=<cassidy@paratech-parachutes.com>
proto=SMTP helo=<yahoobb219176178079.bbtec.net>
Nov 17 09:01:16 mx MailScanner[32267]: Virus and Content Scanning:
Starting 
Nov 17 09:01:16 mx postfix/smtpd[32353]: NOQUEUE: reject: RCPT from
YahooBB219176178079.bbtec.net[219.176.178.79]: 554 Service unavailable;
Client host [219.176.178.79] blocked using sbl-xbl.spamhaus.org;
http://www.spamhaus.org/query/bl?ip=219.176.178.79;
from=<ldtxmzhlsmui@bbtec.net> to=<benoit@paratech-parachutes.com>
proto=SMTP helo=<yahoobb219176178079.bbtec.net>
Nov 17 09:01:17 mx postfix/smtpd[32353]: NOQUEUE: reject: RCPT from
YahooBB219176178079.bbtec.net[219.176.178.79]: 554 Service unavailable;
Client host [219.176.178.79] blocked using sbl-xbl.spamhaus.org;
http://www.spamhaus.org/query/bl?ip=219.176.178.79;
from=<ldtxmzhlsmui@bbtec.net> to=<andrade@paratech-parachutes.com>
proto=SMTP helo=<yahoobb219176178079.bbtec.net>
Nov 17 09:01:17 mx MailScanner[32267]: Virus Scanning completed at
134706 bytes per second 
Nov 17 09:01:17 mx MailScanner[32267]: Found phishing fraud attack from
http://www.otcbb.com/asp/quote_module.asp?symbol=MTDN</a> 
Nov 17 09:01:17 mx MailScanner[32267]: <br><br> 
Nov 17 09:01:17 mx MailScanner[32267]: Big year expected in 2005 for
Motion DNA<br> 
Nov 17 09:01:17 mx MailScanner[32267]:   <br> 
Nov 17 09:01:17 mx MailScanner[32267]: Trading Symbol MTDN<br> 
Nov 17 09:01:17 mx MailScanner[32267]: Current Price (est.) $0.025<br> 
Nov 17 09:01:17 mx MailScanner[32267]: Valued Price (est.) $1.00<br><br>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From carinus.carelse at MRC.AC.ZA  Thu Nov 18 08:06:24 2004
From: carinus.carelse at MRC.AC.ZA (Carinus Carelse)
Date: Thu Jan 12 21:27:37 2006
Subject: MAilScanner & MailWatch
Message-ID: <mailman.4807.1137101257.24926.mailscanner@lists.mailscanner.info>

I am trying to ru two copies of the New Version of mailscanner 4.35.11
and have them use the functionality provide by MailWatch to do their
logging to log to different databases and I am running into a problem
where if I start up the new versions of mailscanner it all logs to the
same database and not to the different databases as it used to.  The
only change I made was the upgrade can someone please give me some
advice

Carinus

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dean at MYSTERIOUSPLANET.CO.UK  Thu Nov 18 08:24:35 2004
From: dean at MYSTERIOUSPLANET.CO.UK (Dean Liversidge)
Date: Thu Jan 12 21:27:37 2006
Subject: New question
Message-ID: <mailman.4808.1137101257.24926.mailscanner@lists.mailscanner.info>

On Tue, 16 Nov 2004 07:57:52 -0600, you wrote:

>Would it be good to just do an LDAP pull rather than a SQL pull?
>
>My setup is quite different I am sure. But if anyone has a easy
>solution. 
>
>We are trying to validate users from 
>5 - 6 exchange servers and an Imail server. 
>
>Once the validation is done, then we will scan and relay to those
>servers based on ip addresses. 
>
> Is anyone else doing something like this?
>

We used to use a dynamic LDAP lookup to exchange from our sendmail
boxes, which worked great, until one day we had a problem with the
LDAP on exchange, and the whole thing came crashing to a halt, and
rejected everyone.

So although the dynamic ability of LDAP maps in sendmail is great, we
needed to weigh that up again the loss if it broke again.
Intead I created for a few scripts that runs via cron to extract all
the users from active directory via LDAP, and create a static alias
file whcih are syncronised accross multiple sendmail servers, which
gave us a bit of both dynamic updates, and security from failure.

-- 
Dean Liversidge

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dh at UPTIME.AT  Thu Nov 18 08:39:44 2004
From: dh at UPTIME.AT ([ISO-8859-1] David Höhn)
Date: Thu Jan 12 21:27:37 2006
Subject: New question
Message-ID: <mailman.4809.1137101257.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

Dean Liversidge wrote:
| On Tue, 16 Nov 2004 07:57:52 -0600, you wrote:
|
|
|>Would it be good to just do an LDAP pull rather than a SQL pull?
|>
|>My setup is quite different I am sure. But if anyone has a easy
|>solution.
|>
|>We are trying to validate users from
|>5 - 6 exchange servers and an Imail server.
|>
|>Once the validation is done, then we will scan and relay to those
|>servers based on ip addresses.
|>
|>Is anyone else doing something like this?
|>
|
|
| We used to use a dynamic LDAP lookup to exchange from our sendmail
| boxes, which worked great, until one day we had a problem with the
| LDAP on exchange, and the whole thing came crashing to a halt, and
| rejected everyone.
|
I assume that you set the `bounce` instead of the `passthru`option and
had no local (aliases/users) whatever :)

- -d


- --
nee anata wo mitsukete soshite nidoto wasurezu
~      donna ni munega itakutemo soba ni iru no
~                         zutto...zutto...zutto
Key fingerprint = FD77 F0B7 5C65 F546 EB08  A4EC 3CCA 1A32 7E24 291E
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFBnF/QPMoaMn4kKR4RAzOFAJ978Twk+01Z18gLB0rneotkI5f92gCeNnJh
D0b3JWebs/8JYZNZYDjUzXs=
=1/XW
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From brahn at woh.rr.com  Thu Nov 18 08:40:20 2004
From: brahn at woh.rr.com (Bruce Rahn)
Date: Thu Jan 12 21:27:37 2006
Subject: Phishing detector apparently slogged up my server
Message-ID: <mailman.4810.1137101257.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Greg Deputy wrote:

>Fedora core 2, MailScanner 4.35.9, Postfix 2.1.5.  Phishing detection
>turned on.  Currently acting as a gateway (no mail on server, all gets
>scanned and passed on to another server for delivery) for about 500 mail
>boxes on 100 hosted domains.
>
>Today I was looking at my mailscanner-mrtg page
>(http://mx.blastzone.com/mailscanner-mrtg) and noticed that at around
>1:30 am the CPU pegged on the box.  I spent some time trying to figure
>out why, looking at the logs for a DOS attack or some evidence that the
>box had been compromised, but found nothing.
>
>What I eventually figured out was Mailscanner seemed to be hitting the
>same mail in the postfix hold queue over and over again.  It would hit
>the mail, and apparently restart.  It would seem to hit the queue,
>process a few messages, hit one, and then choke, restart.  It also
>caused the CPU to be a lot more active (85% +) than it normally is
>(~25%).
>
>I believe it was dying in the phishing detector logic for 2 reasons.
>One, I kept seeing the same phishing detection over and over again in
>the logs.  Two, I turned off the phishing detection in MailScanner.conf,
>restarted MailScanner, and the queue cleared out and CPU dropped back to
>normal.
>
>
>
[stuff deleted]

>
>Nov 17 09:01:05 mx MailScanner[32483]: Found phishing fraud attack from
>http://www.otcbb.com/asp/quote_module.asp?symbol=MTDN</a>
>Nov 17 09:01:05 mx MailScanner[32483]: <br><br>
>Nov 17 09:01:05 mx MailScanner[32483]: Big year expected in 2005 for
>Motion DNA<br>
>Nov 17 09:01:05 mx MailScanner[32483]:   <br>
>Nov 17 09:01:05 mx MailScanner[32483]: Trading Symbol MTDN<br>
>Nov 17 09:01:05 mx MailScanner[32483]: Current Price (est.) $0.025<br>
>Nov 17 09:01:05 mx MailScanner[32483]: Valued Price (est.) $1.00<br><br>
>
>
I had the exact same thing happen today on what looks like the exact
same SPAM message.  It was looping over, and over, and over again.

Something about that message MailScanner didn't like.

Bruce

--
Bruce Rahn

Wisdom has two parts:
1.  having a lot to say; and
2.  not saying it!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From harry at LUCKYGROUP.NET  Thu Nov 18 05:25:08 2004
From: harry at LUCKYGROUP.NET (Harry Wang)
Date: Thu Jan 12 21:27:37 2006
Subject: design issue - whitelist rules/blacklist rules
Message-ID: <mailman.4811.1137101257.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "big5" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Venkata Achanta,
From:	no-reply@domain.com	and	To: 	*@domain.com	no
From:   *@domain.com	 and 	To: 	*@domain.com   yes
	

======= 2004-11-18 07:52:18 you wroteˇG=======

>>As I mentioned in my post yesterday, put the NO entry ABOVE the YES
>>entry.  Your testing is matching on the FIRST rule, which is going to
>>blacklist it.
>>
>>FromTo:   no-reply@domain.com no
>>From:   *@domain.com and To: *@domain.com   yes
>
>
>Dustin, i would like to say yeah it worked but the thing is it is not
>tagging From:   *@domain.com and To: *@domain.com as spam.
>
>I have tested it again just to see if i did anything wrong.It sure allows
>no-reply@domain.com to flow thru without any problems but its letting
>everything else from domain.com also along with that which is not what i
>want.i also checked my whitelist rules.
>
>Thanks for your reply again,
>
>Venkata Achanta
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>
>
>
>

= = = = = = = = = = = = = = = = = = = =
sincerely yours, 
				 
                Harry Wang
                harry@luckygroup.net
                   2004-11-18







------------------------------------------------------
Ą»¶lĄó¤w¸gąL080.net ¸s·ů¬ě§ŢŻf¬r±˝şË
Viruses Scanned by 080.net


From Jan-Peter.Koopmann at SECEIDOS.DE  Thu Nov 18 07:04:33 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:37 2006
Subject: Oversized Zip?
Message-ID: <mailman.4812.1137101257.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Wednesday, November 17, 2004 8:00 PM MailScanner mailing list wrote:

> Cecilia Martínez wrote:
>> I can't find clamd.conf but in clamav.conf I found these:
> 
> Sorry for not answering your original question but if you
> have clamav.conf instead of clamd.conf you really should
> upgrade Clam to the latest version, 0.80.

Will clamd.conf be used together with MailScanner? It says

clamd.conf configures the Clam AntiVirus daemon, clamd(8).

And after all, MailScanner does not use clamd...

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From john at TRADOC.FR  Thu Nov 18 07:15:44 2004
From: john at TRADOC.FR (John Wilcock)
Date: Thu Jan 12 21:27:37 2006
Subject: NASTY phishing attack!
Message-ID: <mailman.4813.1137101257.24926.mailscanner@lists.mailscanner.info>

On Wed, 17 Nov 2004 15:58:09 -0800, Greg Deputy wrote:
> Yes, I have
> 
> Allow Script Tags = disarm
> 
> In MailScanner.conf

That won't help, unfortunately - the script was on the target site, not
in the e-mail. 

John.

-- 
-- Over 2500 webcams from ski resorts around the world - www.snoweye.com
-- Translate your technical documents and web pages    - www.tradoc.fr

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mark at TIPPINGMAR.COM  Wed Nov 17 22:35:53 2004
From: mark at TIPPINGMAR.COM (Mark Nienberg)
Date: Thu Jan 12 21:27:37 2006
Subject: anti-phishing ruleset, still no cigar
Message-ID: <mailman.4814.1137101257.24926.mailscanner@lists.mailscanner.info>

On 17 Nov 2004 at 15:03, Jeff A. Earickson wrote:
> I'm beating my head against the wall on this anti-phishing ruleset.  The
> email gets actually sent from xyz.com, with a "from" line of colby, like
> so (from the mail headers):

The "From" in this case is the "envelope-from".  Have a look at the header "X-
MailScanner-From" to see what that is.

Also, all of the examples in the rules/README file are like this:

*@xyz.com

I'm not sure if that is necessary or not.
--
Mark W. Nienberg, SE
Tipping Mar + associates
1906 Shattuck Ave
Berkeley, CA 94704
510 549-1906 ext 236
http://www.tippingmar.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mark at TIPPINGMAR.COM  Wed Nov 17 23:01:16 2004
From: mark at TIPPINGMAR.COM (Mark Nienberg)
Date: Thu Jan 12 21:27:37 2006
Subject: SpamAssassin 3
Message-ID: <mailman.4815.1137101257.24926.mailscanner@lists.mailscanner.info>

On 17 Nov 2004 at 16:26, Kyle Harris wrote:
> For those that have made the upgrade, are you generally seeing more spam
> being caught, less being caught, or about the same?  Opinions?

Initially, I was catching fewer spam messages with 3.01 than I was with 2.64.  But
that is probably because I had tweaked the old version as time went by until it was
very specific to our mail flow. Now that I have been gradually revising scores and
adding a few custom rules, it is getting better.  Also, when I upgraded, the conversion
of my Bayes database failed (yes, I followed the directions carefully).  I was  forced to
abandon it and use the starter database from Fortress.  So it probably hasn't settled
down completely yet.

In particular, my opinion is that the default Bayes scores and SPF scores don't make
much sense and are overall too low.  I realize that they are derived from a
complicated statistical analysis aimed at minimizing false positives etc.  Maybe
statisticians can appreciate that, but as an engineer, I can't abide scores where
BAYES_99 is less than BAYES_95, or SPF_FAIL is less than one point.

I'm pretty confident that with a little more tweaking I'm going to get back to (and
probably improve on) my old detection rate.
--
Mark W. Nienberg, SE
Tipping Mar + associates
1906 Shattuck Ave
Berkeley, CA 94704
510 549-1906 ext 236
http://www.tippingmar.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From vachanta at GMAIL.COM  Wed Nov 17 23:23:11 2004
From: vachanta at GMAIL.COM (Venkata Achanta)
Date: Thu Jan 12 21:27:37 2006
Subject: design issue - whitelist rules/blacklist rules
Message-ID: <mailman.4816.1137101257.24926.mailscanner@lists.mailscanner.info>

Thanks for replying.Clearly,You didnt answer "HOW TO" accomplish what i am
trying to accomplish here.

So can you please give me the white/blacklist rules to achieve this.

i want every thing coming

from *@xyz.com to *@xyz.com to be blacklisted except for the one e-mail
coming from no-reply@xyz.com to *@xyz.com (which shouldnt be tagged as spam)

Please test that if you can make that work on your setup. if you can please
post the rules that you used to achieve this.

Looking forward for your reply,

Thanks much,
Venkata Achanta






On Wed, 17 Nov 2004 08:57:51 -0500, Wess <mailscanner@ELIQUID.COM> wrote:

>Venkata,
>
>Let me try to clear this up for you.
>
>The whilelist rules override the blacklist rules everytime.
>
>
>This is from spam.whitelist.rules
>
>This first line tells MS to whilelist the entire domain.
>The second line tells MS to NOT whitelist and mail sent TO the user
>specified.  These two rules will work together, the second being the
>exception to the first.
>
>FromOrTo:       *@domain.tld         yes
>To:                   user@domain.tld    no
>
>
>Only use the spam.blacklist.rules file if you want to just mark mail to
>an account as garbage right away, without processing.  Keep in mind that
>whitelist always over-rides the blacklist.
>
>On Tue, 2004-11-16 at 19:52, Venkata Achanta wrote:
>
>> Julian,
>>
>> I am trying to accomplish the following
>>
>> DENY   Anything From *@domain.com To *@domain.com
>> EXCEPT From no-reply@domain.com To *@domain.com
>>
>> I have tried different combinations of whitelist and blacklist rules to
get
>> this working and cant get it to work.
>>
>> blacklist.rules
>> From:   *@domain.com and To: *@domain.com   yes
>> From:   no-reply@domain.com and To: *@domain.com   no
>> ( WTH am i doing this? i want to disallow spoofing.MS running Linux box
>> delivers clean messages to our exchange server so all internal e-mail
wont
>> go thru the MS box )
>>
>> whitelist.rules
>> From:   no-reply@domain.com   yes
>> From:   no-reply@domain.com and To: *@domain.com   yes
>>
>> (these are some administrative scipts e-mailing from that e-mail addy, i
got
>> to get those but they are getting tagged as spam)
>>
>>
>> Here are the logs to reinforce my statements:
>>
>> Nov 15 14:36:12 host sendmail[26920]: iAFMaCJI026920:
>> from=<no-reply@domain.com>, size=902, class=0, nrcpts=1,
>> msgid=<200411152236.iAFMaCJI026920@host.domain.com>, proto=ESMTP,
>> daemon=MTA, relay=host [127.0.0.1]
>> Nov 15 13:52:02 host MailScanner[29537]: Message iAFLldov018164 from
>> 127.0.0.1 (no-reply@domain.com) is whitelisted
>> Nov 15 13:52:02 host MailScanner[29537]: Message iAFLldov018164 from
>> 127.0.0.1 (no-reply@domain.com) to domain.com is spam (blacklisted)
>> Nov 15 13:53:18 host sendmail[24290]: iAFLldov018164:
to=<johnq@domain.com>,
>> delay=00:05:39, xdelay=00:00:00, mailer=esmtp, pri=120902,
>> relay=[192.168.1.1], dsn=2.0.0, stat=Sent (
>> <200411152147.iAFLldov018164@domain.com> Queued mail for delivery)
>>
>> And i dont understand why we are looking at blacklist rules and marking
it
>> as spam if it is already whitelisted in the first place.Is this a design
flaw ?
>>
>> I want to hear from you what the design of this part of the mailscanner
is ?
>> Doesnt the whitelist stuff override the blackklist ? why is it getting
>> blacklisted ?
>>
>> Isnt there a way to do "deny by exception" in the mailscanner , i
thought it
>> did but the logs prove me wrong.
>>
>> Please advice.
>>
>> Thanks much,
>> Venkata Achanta
>>
>>
>>
>>
>> I already started the discussion under "Re: whitelist rules are being
>> overridden by the blacklist rules ?" ,if you want to look what else i
tried.
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>> Support MailScanner development - buy the book off the website!
>
>MailScanner on IRC
>Community Support
>irc.freenode.net
>#mailscanner
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From vachanta at GMAIL.COM  Wed Nov 17 23:52:18 2004
From: vachanta at GMAIL.COM (Venkata Achanta)
Date: Thu Jan 12 21:27:37 2006
Subject: design issue - whitelist rules/blacklist rules
Message-ID: <mailman.4817.1137101257.24926.mailscanner@lists.mailscanner.info>

>As I mentioned in my post yesterday, put the NO entry ABOVE the YES
>entry.  Your testing is matching on the FIRST rule, which is going to
>blacklist it.
>
>FromTo:   no-reply@domain.com no
>From:   *@domain.com and To: *@domain.com   yes


Dustin, i would like to say yeah it worked but the thing is it is not
tagging From:   *@domain.com and To: *@domain.com as spam.

I have tested it again just to see if i did anything wrong.It sure allows
no-reply@domain.com to flow thru without any problems but its letting
everything else from domain.com also along with that which is not what i
want.i also checked my whitelist rules.

Thanks for your reply again,

Venkata Achanta

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From greg at BLASTZONE.COM  Wed Nov 17 23:58:09 2004
From: greg at BLASTZONE.COM (Greg Deputy)
Date: Thu Jan 12 21:27:37 2006
Subject: NASTY phishing attack!
Message-ID: <mailman.4818.1137101257.24926.mailscanner@lists.mailscanner.info>

Sorry for the slow reply, been at the hospital with a new baby...

Yes, I have

Allow Script Tags = disarm

In MailScanner.conf

> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
> Sent: Saturday, November 13, 2004 9:04 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: NASTY phishing attack!
>
>
> Do you have
> Allow Script Tags = disarm
> set in MailScanner.conf?
>
> Greg Deputy wrote:
>
> >Take a look at this NASTY phishing attack.  It managed to sneak past
> >the MailScanner phishing detector, but was caught as spam.
> What makes
> >it especially nasty is the page uses some sort of IE client side
> >scripting functionality that puts a text box on TOP of the browser
> >address bar, so it covers the actual URL!  I noticed it
> because I have
> >the google toolbar installed and it came up on top of that instead.
> >
> >Very scary, any non-techie sort of person could easily be fooled by
> >this.  Yuck!
> >
> >In case the page goes down or if you don't have access to a machine
> >running IE, here's a screenshot:
> >
> >http://greg.blastzone.com/nastyPhish.jpg
> >
> >
> >
> >>-----Original Message-----
> >>From: Washington Mutual Bank [mailto:service@wamu.com]
> >>Sent: Friday, November 12, 2004 7:05 PM
> >>To: undisclosed-recipients:
> >>Subject: [spam] {Spam?} Security Measures !
> >>
> >>
> >>The Blastzone.com MailScanner believes that the attachment to this
> >>message sent to you
> >>
> >>    From: service@wamu.com
> >> Subject: Security Measures !
> >>
> >>is Unsolicited Commercial Email (spam). Unless you are sure
> that this
> >>message is incorrectly thought to be spam, please delete
> this message
> >>without opening it. Opening spam messages might allow the
> spammer to
> >>verify your email address.
> >>
> >>If you believe that this message has been incorrectly
> marked as spam,
> >>please forward this email to ham@blastzone.com.
> >>
> >> pts rule name              description
> >>---- ----------------------
> >>--------------------------------------------------
> >> 1.3 UNDISC_RECIPS          Valid-looking To
> "undisclosed-recipients"
> >> 0.0 NORMAL_HTTP_TO_IP      URI: Uses a dotted-decimal IP
> >>address in URL
> >> 0.0 HTML_MESSAGE           BODY: HTML included in message
> >> 0.2 MIME_HTML_ONLY         BODY: Message only has text/html
> >>MIME parts
> >> 0.1 HTML_50_60             BODY: Message is 50% to 60% HTML
> >> 0.0 HTML_TITLE_EMPTY       BODY: HTML title contains no text
> >>-0.4 BAYES_05               BODY: Bayesian spam probability
> is 1 to 5%
> >>                            [score: 0.0204]
> >> 1.5 RAZOR2_CHECK           Listed in Razor2 (http://razor.sf.net/)
> >> 2.2 DCC_CHECK              Listed in DCC
> >>(http://rhyolite.com/anti-spam/dcc/)
> >> 0.1 DIGEST_MULTIPLE
> >>   Message hits more than one network digest check
> >> 0.6 FORGED_OUTLOOK_HTML    Outlook can't send HTML message only
> >> 0.1 FORGED_OUTLOOK_TAGS    Outlook can't send HTML in this format
> >> 0.0 FORGED_MUA_OUTLOOK     Forged mail pretending to be from
> >>MS Outlook
> >>
> >>
> >>
> >>
> >>
> >>
> >
> >------------------------ MailScanner list
> ------------------------ To
> >unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave
> >mailscanner' in the body of the email. Before posting, read the MAQ
> >(http://www.mailscanner.biz/maq/) and the archives
> >(http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> >Support MailScanner development - buy the book off the website!
> >
> >
> >
> >
> ----------------------------------------------------------------------
> > --
> >
> > Subject:
> > Security Measures !
> > From:
> > "Washington Mutual Bank" <service@wamu.com>
> > Date:
> > Fri, 12 Nov 2004 19:05:10 -0800
> > To:
> > <undisclosed-recipients:>
> >
> > To:
> > <undisclosed-recipients:>
> >
> >
> >
> > Dear Washington Mutual customer,
> >
> > We recently reviewed your account, and suspect that your Washington
> > Mutual Internet Banking accountmay have been accessed by an
> > unauthorized third party. Protecting the security of your
> account and
> > of the Washington Mutual network is our primary concern.
> Therefore, as
> > a preventative measure, we have temporarily limited access to
> > sensitive account features.
> >
> > To restore your account access, please take the following steps to
> > ensure that your account has not been compromised:
> >
> > 1. Login to your Washington Mutual Internet Banking
> account. In case
> > you are not enrolled for Internet Banking, you will have to fill in
> > all the required information, including your name and you account
> > number.
> >
> > 2. Review your recent account history for any unauthorized
> withdrawals
> > or deposits, and check you account profile to make sure not changes
> > have been made. If any unauthorized activity has taken
> place on your
> > account, report this to Washington Mutual staff immediately.
> >
> > To get started, please click the link below:
> >
> > *MailScanner has detected a possible fraud attempt from
> "66.226.68.25"
> > claiming to be *
> > _https://login.personal.wamu.com/logon/logon.asp?dd=1_
> > <http://66.226.68.25/>_
> >
> > We apologize for any inconvenience this may cause, and
> appreciate your
> > assistance in helping us maintain the integrity of the entire
> > Washington Mutual system. Thank you for attention to this matter.
> >
> > _
>
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list
> ------------------------ To unsubscribe, email
> jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner'
> in the body of the email. Before posting, read the MAQ
> (http://www.mailscanner.biz/maq/) and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner-user at NELAND.DK  Thu Nov 18 00:20:45 2004
From: mailscanner-user at NELAND.DK (Leif Neland)
Date: Thu Jan 12 21:27:37 2006
Subject: how to write an anti-phishing ruleset (and test?)
Message-ID: <mailman.4819.1137101257.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Jeff A. Earickson <jaearick@COLBY.EDU> wrote:
> Gang,
>
> Our alumni office uses one of these click-thru counter services for
> the alumni newsletter.  They sent out their monthly newsletter a
> couple of days ago and all of their URLs got marked as phishing
> attempts by MailScanner.  They were peeved at me.  Now I need to write a
> ruleset to exempt the click-thru service and then be able to test it.
> A sample bit of URL code is:
>
> <p>See more at <a
> href="http://www.xyz.com/links/link.cgi?31889|363543|CLY-20041117090021">http://www.colby.edu/eag</a>.</p>
>
What is the problem? It is a phishing attempt, and MailScanner is detecting 
it,

> If I email myself this snippet, I can't get MailScanner to bark like
> it did for the real message (which came from xyz.com).  Why?  How to test
> a ruleset?

Are you whitelisting yourself?

Leif¨

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Thu Nov 18 09:07:30 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:37 2006
Subject: Phishing detector apparently slogged up my server
Message-ID: <mailman.4820.1137101257.24926.mailscanner@lists.mailscanner.info>

On 18/11/04 8:40 am, "Bruce Rahn" <brahn@woh.rr.com> wrote:
> Greg Deputy wrote:
>
>> Fedora core 2, MailScanner 4.35.9, Postfix 2.1.5.  Phishing detection
>> turned on.  Currently acting as a gateway (no mail on server, all gets
>> scanned and passed on to another server for delivery) for about 500 mail
>> boxes on 100 hosted domains.
>>
>> Today I was looking at my mailscanner-mrtg page
>> (http://mx.blastzone.com/mailscanner-mrtg) and noticed that at around
>> 1:30 am the CPU pegged on the box.  I spent some time trying to figure
>> out why, looking at the logs for a DOS attack or some evidence that the
>> box had been compromised, but found nothing.
>>
>> What I eventually figured out was Mailscanner seemed to be hitting the
>> same mail in the postfix hold queue over and over again.  It would hit
>> the mail, and apparently restart.  It would seem to hit the queue,
>> process a few messages, hit one, and then choke, restart.  It also
>> caused the CPU to be a lot more active (85% +) than it normally is
>> (~25%).
>>
>> I believe it was dying in the phishing detector logic for 2 reasons.
>> One, I kept seeing the same phishing detection over and over again in
>> the logs.  Two, I turned off the phishing detection in MailScanner.conf,
>> restarted MailScanner, and the queue cleared out and CPU dropped back to
>> normal.
>>
>>
>>
> [stuff deleted]
>
>>
>> Nov 17 09:01:05 mx MailScanner[32483]: Found phishing fraud attack from
>> http://www.otcbb.com/asp/quote_module.asp?symbol=MTDN</a>
>> Nov 17 09:01:05 mx MailScanner[32483]: <br><br>
>> Nov 17 09:01:05 mx MailScanner[32483]: Big year expected in 2005 for
>> Motion DNA<br>
>> Nov 17 09:01:05 mx MailScanner[32483]:   <br>
>> Nov 17 09:01:05 mx MailScanner[32483]: Trading Symbol MTDN<br>
>> Nov 17 09:01:05 mx MailScanner[32483]: Current Price (est.) $0.025<br>
>> Nov 17 09:01:05 mx MailScanner[32483]: Valued Price (est.) $1.00<br><br>
>>
>>
> I had the exact same thing happen today on what looks like the exact
> same SPAM message.  It was looping over, and over, and over again.
>
> Something about that message MailScanner didn't like.

In which case can someone send me a copy of the message please? Don't mind
much what format, I can handle most things.
--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From carinus.carelse at MRC.AC.ZA  Thu Nov 18 09:09:52 2004
From: carinus.carelse at MRC.AC.ZA (Carinus Carelse)
Date: Thu Jan 12 21:27:37 2006
Subject: MAilScanner & MailWatch
Message-ID: <mailman.4821.1137101257.24926.mailscanner@lists.mailscanner.info>

Ja I have checked my MailWatch.pm and it is setup for the right database I
have checked both of them and they both point to different databases on the
localhost with different usernames and passwords.

Carinus

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Thu Nov 18 09:04:09 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:37 2006
Subject: MAilScanner & MailWatch
Message-ID: <mailman.4822.1137101257.24926.mailscanner@lists.mailscanner.info>

Hi

how did you upgrade. Did you re-apply the MailWatch install and change
the info in the MailWatch.pm so it logs to the 'correct' database, ie
change to following in MailWatch.pm

# Modify this as necessary for your configuration
my($db_name) = "mailscanner";
my($db_host) = "localhost";
my($db_user) = "mailwatch";
my($db_pass) = "my passwd";


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Carinus Carelse wrote:
> I am trying to ru two copies of the New Version of mailscanner 4.35.11
> and have them use the functionality provide by MailWatch to do their
> logging to log to different databases and I am running into a problem
> where if I start up the new versions of mailscanner it all logs to the
> same database and not to the different databases as it used to.  The
> only change I made was the upgrade can someone please give me some
> advice
>
> Carinus
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Thu Nov 18 09:29:49 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:37 2006
Subject: MAilScanner & MailWatch
Message-ID: <mailman.4823.1137101257.24926.mailscanner@lists.mailscanner.info>

Carinus


have you checked these settings aren't getting overridden a few lines
further down the file...

What happend if you just run the one that doesn't work, turn on the
mysql debugging and have a look at the log file so see what's happening.

Who are the two MailScanner's running - same box??? If so how do you
make sure that they are using seperate /opt/MailScanner/lib (or
/usr/lib/MailScanner if GNU/Linux)  directories.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Carinus Carelse wrote:
> Ja I have checked my MailWatch.pm and it is setup for the right database I
> have checked both of them and they both point to different databases on the
> localhost with different usernames and passwords.
>
> Carinus
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From carinus.carelse at MRC.AC.ZA  Thu Nov 18 09:39:41 2004
From: carinus.carelse at MRC.AC.ZA (Carinus Carelse)
Date: Thu Jan 12 21:27:37 2006
Subject: MAilScanner & MailWatch
Message-ID: <mailman.4824.1137101257.24926.mailscanner@lists.mailscanner.info>

I have a line in the MailWatch.pm use lib qw(/opt/MailScanner2/lib).  I
try to turn on the debugging but it doesn't output a file so I can't see
the only symptom I have is that the database and the frontend don't
update.

I have them running as the  mta user postfix.

Carinus
  ------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From martinh at SOLID-STATE-LOGIC.COM  Thu Nov 18 09:50:15 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:37 2006
Subject: MAilScanner & MailWatch
Message-ID: <mailman.4825.1137101257.24926.mailscanner@lists.mailscanner.info>

Carius

I'd put in a bit of debug into the  perl so make sure it;s calling the
correct MailWatch.pm. It sounds like it's getting confused and not
calling the correct one.

have you tried putting in the full path to the MailWatch.pm in the
CustomConfig.pm in /opt/MailScanner2/lib/MailScanner??

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Carinus Carelse wrote:
> I have a line in the MailWatch.pm *use lib qw(/opt/MailScanner2/lib).
> *I try to turn on the debugging but it doesn't output a file so I can't
> see the only symptom I have is that the database and the frontend don't
> update.
>
> I have them running as the  mta user postfix.
>
> Carinus
>  ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> *Support MailScanner development - buy the book off the website!*
>

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From carinus.carelse at MRC.AC.ZA  Thu Nov 18 10:01:35 2004
From: carinus.carelse at MRC.AC.ZA (Carinus Carelse)
Date: Thu Jan 12 21:27:37 2006
Subject: MAilScanner & MailWatch
Message-ID: <mailman.4826.1137101257.24926.mailscanner@lists.mailscanner.info>

CAn you give me some advice on how to put in the debug info in perl.  I just
tried putting in the whole path as you suggested but no luck. I think it must
be calling the wrong MailWatch.pm.

Carinus

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dmehler26 at WOH.RR.COM  Thu Nov 18 09:44:09 2004
From: dmehler26 at WOH.RR.COM (dave)
Date: Thu Jan 12 21:27:37 2006
Subject: mailscanner with postfix header checks vs. amavisd-new
Message-ID: <mailman.4827.1137101257.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hello,
    I'm a newbie to this list and am hoping to learn a great deal. I've got
several FreeBSD and Linux mail servers running postfix 2 2.1.5 on the
FreeBSD side and 2.1.3 on Linux. I'm wondering if anyone has experience with
both mailscanner and amavisd-new with postfix, spamassassin, and razor plus
an AV either clamav or fprot though the AV isn't really important? I was
previously using amavisd-new, postfix, and spamassassin for antispam, but
was not very happy with this setup, it did ok, but i feel it could have done
better, maybe i'm just a perfectionist. What i'd like to know is your
personal pros and cons of either solution, in terms of speed, reliability,
ease of use/configuration, approx amount of spam caught, and general
impressions. A friend of mine set up a postfix box with mailscanner about a
year ago, the thing i didn't like was i had to use two postfix instances, i
like to keep things as standard as possible. I checked the postfix section
of the user's guide today when another friend said mailscanner had a
feature, see next point, that i've been looking for and discovered that now
you can use header checks for mailscanner. My question is where in the
header checks file should you put the HOLD line? To me it would seem to go
at the end, so headers get processed first, and anything unnecessary
discarded outright before being moved through mailscanner. Or does it go at
the beginning? Or does it matter? I'd also like more information on
connection limiting. One of my mail servers is natted behind a firewall and
is being blasted by connecting clients trying to spam, it does well, but i'd
like to block the offending IP or drop it for instances if it connects
within x times within a minute.
Thanks for any replies.
Dave.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Thu Nov 18 10:14:35 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:37 2006
Subject: mailscanner with postfix header checks vs. amavisd-new
Message-ID: <mailman.4828.1137101257.24926.mailscanner@lists.mailscanner.info>

dave

what were your concerns with amavis-new?

Spamassassin is only as good the rules in it. I find it necesscary to
add more rules in to get the hit rate acceptable. www.rulesemporium.com
is a good place to start along with adding the URI RBL's from www.surbl.org

If you look on the Install bit of the FAQ, it describes how to setup
Postfix with a single instance for MailScanner.

AFAIK the rate limiting feature in MS only works with sendmail and takes
about 1 hour to kick in.

I use a different technique - get the MTA to only allow known good email
addresses in. IE reject all none existant email addresses. This reduces
my scanning load buy about 66%!

oh - paragraphs are good too :-)
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


dave wrote:
> Hello,
>     I'm a newbie to this list and am hoping to learn a great deal. I've got
> several FreeBSD and Linux mail servers running postfix 2 2.1.5 on the
> FreeBSD side and 2.1.3 on Linux. I'm wondering if anyone has experience with
> both mailscanner and amavisd-new with postfix, spamassassin, and razor plus
> an AV either clamav or fprot though the AV isn't really important? I was
> previously using amavisd-new, postfix, and spamassassin for antispam, but
> was not very happy with this setup, it did ok, but i feel it could have done
> better, maybe i'm just a perfectionist. What i'd like to know is your
> personal pros and cons of either solution, in terms of speed, reliability,
> ease of use/configuration, approx amount of spam caught, and general
> impressions. A friend of mine set up a postfix box with mailscanner about a
> year ago, the thing i didn't like was i had to use two postfix instances, i
> like to keep things as standard as possible. I checked the postfix section
> of the user's guide today when another friend said mailscanner had a
> feature, see next point, that i've been looking for and discovered that now
> you can use header checks for mailscanner. My question is where in the
> header checks file should you put the HOLD line? To me it would seem to go
> at the end, so headers get processed first, and anything unnecessary
> discarded outright before being moved through mailscanner. Or does it go at
> the beginning? Or does it matter? I'd also like more information on
> connection limiting. One of my mail servers is natted behind a firewall and
> is being blasted by connecting clients trying to spam, it does well, but i'd
> like to block the offending IP or drop it for instances if it connects
> within x times within a minute.
> Thanks for any replies.
> Dave.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Thu Nov 18 10:18:42 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:37 2006
Subject: MAilScanner & MailWatch
Message-ID: <mailman.4829.1137101257.24926.mailscanner@lists.mailscanner.info>

Carinus

have a look at how the debug statements are used within MailScanner,
turning on the debug flag in MailScanner.conf will cause it NOT to fork
multiple processes but merely run a single check of the mailq.

You can then insert the $self->debug statements to trace where the
code's actually going..

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Carinus Carelse wrote:
> CAn you give me some advice on how to put in the debug info in perl.  I just
> tried putting in the whole path as you suggested but no luck. I think it must
> be calling the wrong MailWatch.pm.
>
> Carinus
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From sylvain.phaneuf at IMSU.OXFORD.AC.UK  Thu Nov 18 10:26:49 2004
From: sylvain.phaneuf at IMSU.OXFORD.AC.UK (Sylvain Phaneuf)
Date: Thu Jan 12 21:27:37 2006
Subject: specs & platform for new server
Message-ID: <mailman.4830.1137101257.24926.mailscanner@lists.mailscanner.info>

Hi everyone,

Our 20 months old server is being a bit overworked and we are going to
buy a new box.

Could the experts out there help us a bit with suggestions. We would
like to know where to throw our money at. More memory, multuiple
processors?

We will use the box only as a mail gateway running MailScanner,
SpamAssassin, Sendmail, Sophos, MRTG and very little else. We don't need
to run any RBL checks as our ISP does it for us. We currently get
approx. 35,000 messages per day, and we expect that will increase to
possibly 50,000 in the next year or two. Currently we get somewhere
between 1 and 1.5 GB of mail per day.

We don't want to spend more than 2,500 - 3,000 pounds if possible. We
are thinking of:
Dual Xeon 3.2 GHz with 1 MB L2 cache
2 GB DDR2 RAM (400 MHz DIMMS)
RAID 1
Intel Gigabit NIC

Finally, we are thinking of running the new box with SLSE (we are using
RH at the moment). Any problem with SuSE?

I will really appreciate your input. MialScanner is great, we love it,
our users love us!

Thanks in advance,

Sylvain



===========================================================
Sylvain Phaneuf --- Systems Manager   | phone : +44 (0)1865 221323
Clinical School Information Management Services Unit  (IMSU)
Medical Sciences Division
University of Oxford                                  |   email :
sylvain.phaneuf@imsu.ox.ac.uk
Room 3A25B John Radcliffe Hospital      |   fax :  +44 (0) 1865 221322
Oxford   OX3 9DU   England
===========================================================

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From prandal at HEREFORDSHIRE.GOV.UK  Thu Nov 18 10:34:52 2004
From: prandal at HEREFORDSHIRE.GOV.UK (Randal, Phil)
Date: Thu Jan 12 21:27:37 2006
Subject: specs & platform for new server
Message-ID: <mailman.4831.1137101257.24926.mailscanner@lists.mailscanner.info>

I'd add ClamAV and Bitdefender for Linux to that list.

That hardware should be perfectly adequate.

Our Mailscanner box handles around 9,000 messages a day totalling about
800MB, running MailScanner / spamassassin 2.6x patched for the surbl
stuff / DCC / pyzor / razor and three virus scanners.

Dell 2650, single P4 Xeon 2400 MHz, RAID-1.  Load average is rarely over
2.

And it's running squid for over 800 users at the same time.

----
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK

> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Sylvain Phaneuf
> Sent: 18 November 2004 10:27
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: specs & platform for new server
>
> Hi everyone,
>
> Our 20 months old server is being a bit overworked and we are
> going to buy a new box.
>
> Could the experts out there help us a bit with suggestions.
> We would like to know where to throw our money at. More
> memory, multuiple processors?
>
> We will use the box only as a mail gateway running
> MailScanner, SpamAssassin, Sendmail, Sophos, MRTG and very
> little else. We don't need to run any RBL checks as our ISP
> does it for us. We currently get approx. 35,000 messages per
> day, and we expect that will increase to possibly 50,000 in
> the next year or two. Currently we get somewhere between 1
> and 1.5 GB of mail per day.
>
> We don't want to spend more than 2,500 - 3,000 pounds if
> possible. We are thinking of:
> Dual Xeon 3.2 GHz with 1 MB L2 cache
> 2 GB DDR2 RAM (400 MHz DIMMS)
> RAID 1
> Intel Gigabit NIC
>
> Finally, we are thinking of running the new box with SLSE (we
> are using RH at the moment). Any problem with SuSE?
>
> I will really appreciate your input. MialScanner is great, we
> love it, our users love us!
>
> Thanks in advance,
>
> Sylvain
>
>
>
> ===========================================================
> Sylvain Phaneuf --- Systems Manager   | phone : +44 (0)1865 221323
> Clinical School Information Management Services Unit  (IMSU)
> Medical Sciences Division
> University of Oxford                                  |   email :
> sylvain.phaneuf@imsu.ox.ac.uk
> Room 3A25B John Radcliffe Hospital      |   fax :  +44 (0) 1865 221322
> Oxford   OX3 9DU   England
> ===========================================================
>
> ------------------------ MailScanner list
> ------------------------ To unsubscribe, email
> jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ
> (http://www.mailscanner.biz/maq/) and the archives
> (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Thu Nov 18 10:39:57 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:37 2006
Subject: specs & platform for new server
Message-ID: <mailman.4832.1137101257.24926.mailscanner@lists.mailscanner.info>

Sylvain

loads of capacity, there.that machine should be able to process well
over 1 million per day.

maybe you could get a couple of single processor machines so you can
load balance and have redundancy should one fail.

my 800mhz celeron with 512MB 133mhz sdram and a 100mhx IDE drive tops
outat about 15,000 records per day...so a 2.8 ghx PIV with HT and 2GB of
ram should be more than enough and you get get those for around 1000 uk
pounds from dell rack mounted...



--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Sylvain Phaneuf wrote:
> Hi everyone,
>
> Our 20 months old server is being a bit overworked and we are going to
> buy a new box.
>
> Could the experts out there help us a bit with suggestions. We would
> like to know where to throw our money at. More memory, multuiple
> processors?
>
> We will use the box only as a mail gateway running MailScanner,
> SpamAssassin, Sendmail, Sophos, MRTG and very little else. We don't need
> to run any RBL checks as our ISP does it for us. We currently get
> approx. 35,000 messages per day, and we expect that will increase to
> possibly 50,000 in the next year or two. Currently we get somewhere
> between 1 and 1.5 GB of mail per day.
>
> We don't want to spend more than 2,500 - 3,000 pounds if possible. We
> are thinking of:
> Dual Xeon 3.2 GHz with 1 MB L2 cache
> 2 GB DDR2 RAM (400 MHz DIMMS)
> RAID 1
> Intel Gigabit NIC
>
> Finally, we are thinking of running the new box with SLSE (we are using
> RH at the moment). Any problem with SuSE?
>
> I will really appreciate your input. MialScanner is great, we love it,
> our users love us!
>
> Thanks in advance,
>
> Sylvain
>
>
>
> ===========================================================
> Sylvain Phaneuf --- Systems Manager   | phone : +44 (0)1865 221323
> Clinical School Information Management Services Unit  (IMSU)
> Medical Sciences Division
> University of Oxford                                  |   email :
> sylvain.phaneuf@imsu.ox.ac.uk
> Room 3A25B John Radcliffe Hospital      |   fax :  +44 (0) 1865 221322
> Oxford   OX3 9DU   England
> ===========================================================
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dh at UPTIME.AT  Thu Nov 18 11:34:33 2004
From: dh at UPTIME.AT ([ISO-8859-1] David Höhn)
Date: Thu Jan 12 21:27:37 2006
Subject: specs & platform for new server
Message-ID: <mailman.4833.1137101257.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

Sylvain Phaneuf wrote:
<snip>
|
| We don't want to spend more than 2,500 - 3,000 pounds if possible. We
| are thinking of:
| Dual Xeon 3.2 GHz with 1 MB L2 cache
| 2 GB DDR2 RAM (400 MHz DIMMS)
| RAID 1
| Intel Gigabit NIC
|
<snip>
for 35 000 to 50 000 messages that CPU Spec seems a bit too much in my
humble opinion. You can do well with only a single Xeon and put more
money into buying a very good RAID Controller.

<advertisement mode>
I can only recommend the IBM X-Series
</advertisement mode>

Most of the smaller Mailserver here run on xSeries 345 or 346 and we are
quite happy with that and the ServeRAID controllers.

Hope that helps
- -d

- --
nee anata wo mitsukete soshite nidoto wasurezu
~      donna ni munega itakutemo soba ni iru no
~                         zutto...zutto...zutto
Key fingerprint = FD77 F0B7 5C65 F546 EB08  A4EC 3CCA 1A32 7E24 291E
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFBnIjHPMoaMn4kKR4RA9G9AJ4tz+xSRt8wjwPU7NrZvM2DpwNKXgCggCQl
PtCaswhezLGtzPX6aS7VmGY=
=Oge1
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From carinus.carelse at MRC.AC.ZA  Thu Nov 18 12:07:36 2004
From: carinus.carelse at MRC.AC.ZA (Carinus Carelse)
Date: Thu Jan 12 21:27:37 2006
Subject: MAilScanner & MailWatch
Message-ID: <mailman.4834.1137101257.24926.mailscanner@lists.mailscanner.info>

I turned on the debug but I can't seem to see which MailWatch.pm is being used.  It
would be nice if somone could build into mailscanner a place where you could
specify down to the file level which MailWatch.pm to use.

Does any one have anything else I can try.

CArinus

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Thu Nov 18 12:09:45 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:37 2006
Subject: Phishing detector apparently slogged up my server
Message-ID: <mailman.4835.1137101257.24926.mailscanner@lists.mailscanner.info>

I have found and fixed the problem with the (malformed) messages. Attached
is a new Message.pm for those of you who just want this update.

I will also release a new beta after lunch, including this change and all
the other phishing net improvements among other things. I now support RedHat
Enterprise Server 4 beta 2 as well.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


On 18/11/04 9:07 am, "Julian Field" <mailscanner@ecs.soton.ac.uk> wrote:

> On 18/11/04 8:40 am, "Bruce Rahn" <brahn@woh.rr.com> wrote:
>> Greg Deputy wrote:
>>
>>> Fedora core 2, MailScanner 4.35.9, Postfix 2.1.5.  Phishing detection
>>> turned on.  Currently acting as a gateway (no mail on server, all gets
>>> scanned and passed on to another server for delivery) for about 500 mail
>>> boxes on 100 hosted domains.
>>>
>>> Today I was looking at my mailscanner-mrtg page
>>> (http://mx.blastzone.com/mailscanner-mrtg) and noticed that at around
>>> 1:30 am the CPU pegged on the box.  I spent some time trying to figure
>>> out why, looking at the logs for a DOS attack or some evidence that the
>>> box had been compromised, but found nothing.
>>>
>>> What I eventually figured out was Mailscanner seemed to be hitting the
>>> same mail in the postfix hold queue over and over again.  It would hit
>>> the mail, and apparently restart.  It would seem to hit the queue,
>>> process a few messages, hit one, and then choke, restart.  It also
>>> caused the CPU to be a lot more active (85% +) than it normally is
>>> (~25%).
>>>
>>> I believe it was dying in the phishing detector logic for 2 reasons.
>>> One, I kept seeing the same phishing detection over and over again in
>>> the logs.  Two, I turned off the phishing detection in MailScanner.conf,
>>> restarted MailScanner, and the queue cleared out and CPU dropped back to
>>> normal.
>>>
>>>
>>>
>> [stuff deleted]
>>
>>>
>>> Nov 17 09:01:05 mx MailScanner[32483]: Found phishing fraud attack from
>>> http://www.otcbb.com/asp/quote_module.asp?symbol=MTDN</a>
>>> Nov 17 09:01:05 mx MailScanner[32483]: <br><br>
>>> Nov 17 09:01:05 mx MailScanner[32483]: Big year expected in 2005 for
>>> Motion DNA<br>
>>> Nov 17 09:01:05 mx MailScanner[32483]:   <br>
>>> Nov 17 09:01:05 mx MailScanner[32483]: Trading Symbol MTDN<br>
>>> Nov 17 09:01:05 mx MailScanner[32483]: Current Price (est.) $0.025<br>
>>> Nov 17 09:01:05 mx MailScanner[32483]: Valued Price (est.) $1.00<br><br>
>>>
>>>
>> I had the exact same thing happen today on what looks like the exact
>> same SPAM message.  It was looping over, and over, and over again.
>>
>> Something about that message MailScanner didn't like.
>
> In which case can someone send me a copy of the message please? Don't mind
> much what format, I can handle most things.
--
Julian Field
jkf@ecs.soton.ac.uk
Teaching Systems Manager
Electronics & Computer Science
University of Southampton
SO17 1BJ, UK


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Application/OCTET-STREAM (Name: "Message.pm.gz")  54KB. ]
    [ Unable to print this part. ]


From martelm at QUARK.VSC.EDU  Thu Nov 18 12:12:58 2004
From: martelm at QUARK.VSC.EDU (Michael H. Martel)
Date: Thu Jan 12 21:27:37 2006
Subject: Phishing detector apparently slogged up my server
Message-ID: <mailman.4836.1137101257.24926.mailscanner@lists.mailscanner.info>

--On Thursday, November 18, 2004 12:09 PM +0000 Julian Field
<mailscanner@ECS.SOTON.AC.UK> wrote:

> I have found and fixed the problem with the (malformed) messages. Attached
> is a new Message.pm for those of you who just want this update.

So what does this Message.pm replace ?  Is this to replace the default one
in the distribution or does this include the other phising updates you've
posted to the list as well ?

Thanks


Michael

--

  --------------------------------o---------------------------------
   Michael H. Martel              | Systems Administrator
   martelm@quark.vsc.edu          | Vermont State Colleges
   http://probe.vsc.edu/~michael  | PH:802-241-2544 FX:802-241-3363

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Thu Nov 18 12:21:47 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:37 2006
Subject: Phishing detector apparently slogged up my server
Message-ID: <mailman.4837.1137101257.24926.mailscanner@lists.mailscanner.info>

It is to replace the one in 4.35.11, and it supercedes all the previous
replacement versions I have posted earlier. It includes all the phishing
updates.


On 18/11/04 12:12 pm, "Michael H. Martel" <martelm@QUARK.VSC.EDU> wrote:

> --On Thursday, November 18, 2004 12:09 PM +0000 Julian Field
> <mailscanner@ECS.SOTON.AC.UK> wrote:
>
>> I have found and fixed the problem with the (malformed) messages. Attached
>> is a new Message.pm for those of you who just want this update.
>
> So what does this Message.pm replace ?  Is this to replace the default one
> in the distribution or does this include the other phising updates you've
> posted to the list as well ?

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From anders.andersson at LTKALMAR.SE  Thu Nov 18 12:22:15 2004
From: anders.andersson at LTKALMAR.SE (Anders Andersson, IT)
Date: Thu Jan 12 21:27:37 2006
Subject: Vispan - new release
Message-ID: <mailman.4838.1137101257.24926.mailscanner@lists.mailscanner.info>

Thanks, I like the new style now I only need to figure out what happend
to my old stats  =(

/Anders

> -----Original Message-----
> From: MailScanner mailing list 
> Subject: Vispan - new release
> 
> I have just released a new version of Vispan for download.
> 
> It has several changes:
>         command line option for removing IP addresses
>         the GeoIp stuff is now optional
>         ability to suuply header and footer files
> 
> A full changelog is available on the web site.
> 
> Download as usual from http://www.while.homeunix.net/mailstats/
> 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Thu Nov 18 12:23:19 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:37 2006
Subject: MAilScanner & MailWatch
Message-ID: <mailman.4839.1137101257.24926.mailscanner@lists.mailscanner.info>

Carinus Carelse wrote:
> I turned on the debug but I can't seem to see which MailWatch.pm is being used.  It
> would be nice if somone could build into mailscanner a place where you could
> specify down to the file level which MailWatch.pm to use.
>
> Does any one have anything else I can try.
>
> CArinus
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
Carinus

if you edit the CustomConfig.pm you should be able to explictily state
the full path of the MailWatch.pm ...

--
Martin Hepworth
Senior Systems Administrator
Solid State Logic Ltd
tel: +44 (0)1865 842300


**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ugob at CAMO-ROUTE.COM  Thu Nov 18 12:04:06 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:37 2006
Subject: specs & platform for new server
Message-ID: <mailman.4840.1137101257.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I've never tried it with mailscanner, but I suggest you have a look at

- A single athlon 64 CPU
- A dual AMD opteron CPU
- 3 Ware Raid Controller + The new Seagate hard drives with Native
Command Queuing

Must make sure you don't lack RAM.

And like someone else said, maybe 2 small boxes would be better for
redundancy, something like single Athlon 64 boxes.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Thu Nov 18 12:36:40 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:37 2006
Subject: Phishing detector apparently slogged up my server
Message-ID: <mailman.4841.1137101257.24926.mailscanner@lists.mailscanner.info>

Julian Field wrote:

> I have found and fixed the problem with the (malformed) messages. Attached
> is a new Message.pm for those of you who just want this update.
>
> I will also release a new beta after lunch, including this change and all
> the other phishing net improvements among other things. I now support RedHat
> Enterprise Server 4 beta 2 as well.
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store

Installed - will see how we go....ta for the hard work...

--
Martin Hepworth
Senior Systems Administrator
Solid State Logic Ltd
tel: +44 (0)1865 842300


**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ebruce at HPMICH.COM  Thu Nov 18 12:53:25 2004
From: ebruce at HPMICH.COM (Ed Bruce)
Date: Thu Jan 12 21:27:37 2006
Subject: Phishing detector apparently slogged up my server
Message-ID: <mailman.4842.1137101257.24926.mailscanner@lists.mailscanner.info>

Thanks for the fix. I just turned off phishing checks when I reported
this problem and got no response.

Julian Field wrote:

 I have found and fixed the problem with the (malformed) messages. Attached
is a new Message.pm for those of you who just want this update.

I will also release a new beta after lunch, including this change and all
the other phishing net improvements among other things. I now support RedHat
Enterprise Server 4 beta 2 as well.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


On 18/11/04 9:07 am, "Julian Field" <mailscanner@ecs.soton.ac.uk> wrote:

  

 On 18/11/04 8:40 am, "Bruce Rahn" <brahn@woh.rr.com> wrote:
    

 Greg Deputy wrote:

      

 Fedora core 2, MailScanner 4.35.9, Postfix 2.1.5.  Phishing detection
turned on.  Currently acting as a gateway (no mail on server, all gets
scanned and passed on to another server for delivery) for about 500 mail
boxes on 100 hosted domains.

Today I was looking at my mailscanner-mrtg page
(http://mx.blastzone.com/mailscanner-mrtg) and noticed that at around
1:30 am the CPU pegged on the box.  I spent some time trying to figure
out why, looking at the logs for a DOS attack or some evidence that the
box had been compromised, but found nothing.

What I eventually figured out was Mailscanner seemed to be hitting the
same mail in the postfix hold queue over and over again.  It would hit
the mail, and apparently restart.  It would seem to hit the queue,
process a few messages, hit one, and then choke, restart.  It also
caused the CPU to be a lot more active (85% +) than it normally is
(~25%).

I believe it was dying in the phishing detector logic for 2 reasons.
One, I kept seeing the same phishing detection over and over again in
the logs.  Two, I turned off the phishing detection in MailScanner.conf,
restarted MailScanner, and the queue cleared out and CPU dropped back to
normal.



        

 [stuff deleted]

      

 Nov 17 09:01:05 mx MailScanner[32483]: Found phishing fraud attack from
http://www.otcbb.com/asp/quote_module.asp?symbol=MTDN</a>
Nov 17 09:01:05 mx MailScanner[32483]: <br><br>
Nov 17 09:01:05 mx MailScanner[32483]: Big year expected in 2005 for
Motion DNA<br>
Nov 17 09:01:05 mx MailScanner[32483]:   <br>
Nov 17 09:01:05 mx MailScanner[32483]: Trading Symbol MTDN<br>
Nov 17 09:01:05 mx MailScanner[32483]: Current Price (est.) $0.025<br>
Nov 17 09:01:05 mx MailScanner[32483]: Valued Price (est.) $1.00<br><br>


        

 I had the exact same thing happen today on what looks like the exact
same SPAM message.  It was looping over, and over, and over again.

Something about that message MailScanner didn't like.
      

 In which case can someone send me a copy of the message please? Don't mind
much what format, I can handle most things.
    

 --
Julian Field
jkf@ecs.soton.ac.uk
Teaching Systems Manager
Electronics & Computer Science
University of Southampton
SO17 1BJ, UK


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

  


 --
Ed Bruce
Health Plan of Michigan
Senior Programmer
Phone:  248.226.1512
FAX:    248.204.6569


--
This message, including any attachments, is intended solely for the use
of the named
recipients(s) and may contain confidential and/or privileged information.
Any
unauthorized review, use, disclosure or distribution of this
communication is expressly
prohibited. If you are not the intended recipient, please contact the
sender by reply
e-mail and destroy any and all copies of the original message. Thank you
for your
cooperation.
--
This message has been scanned for viruses and
dangerous content by Secure Resource, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From drew at THEMARSHALLS.CO.UK  Thu Nov 18 13:01:48 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:37 2006
Subject: mailscanner with postfix header checks vs.
Message-ID: <mailman.4843.1137101257.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Thu, November 18, 2004 9:44, dave said:
> I'm wondering if anyone has experience with
> both mailscanner and amavisd-new with postfix

Yes. For a short time I ran both (1 on one machine, 1 on another).

> spamassassin, and razor plus an AV either clamav or fprot though the AV
> isn't really important?

Indeed as both AMAVIS and MailScanner are just interfaces for all of the
above.
>I was previously using amavisd-new, postfix, and spamassassin for
> antispam, but
> was not very happy with this setup, it did ok, but i feel it could have
> done
> better, maybe i'm just a perfectionist. What i'd like to know is your
> personal pros and cons of either solution, in terms of speed, reliability,
> ease of use/configuration, approx amount of spam caught, and general
> impressions.

I moved everything to MS because it has far more features. I like the HTML
disarming, including scripts etc. As for anti-spam, well that's as good as
you SpamAssassin setup. Both AMAVIS and MS will miss spam if SA isn't
working to it's best (Likewise Anti-Virus).

For speed, MS uses batch processing so will tend to be more efficient in
it's processing in busy environments. AMAVIS uses SMTP/ LMTP to process
messages (One at a time) but uses daemons to speedup the scanning process.
TBH my boxes don't handle huge amounts of mail so speed differences were
not really noticeable. MS handles it's own queue/ batch processing where
as AMAVIS expects Postfix to manage the queue processing so when all the
connections are used up by AMAVIS Postfix has to do the delaying/
retrying. With MS the messages just sit in the hold queue until processed.
IMHO this must release extra cycles to the bottle neck (Ths AV/ SA
scanning) but again I have never actually soak tested this theory.

> A friend of mine set up a postfix box with mailscanner about
> a
> year ago, the thing i didn't like was i had to use two postfix instances,
> i
> like to keep things as standard as possible. I checked the postfix section
> of the user's guide today when another friend said mailscanner had a
> feature, see next point, that i've been looking for and discovered that
> now
> you can use header checks for mailscanner. My question is where in the
> header checks file should you put the HOLD line?

Postfix will do first line matching so put it at the end as the 'catch
all'. Again this is one of the benefits of using this setup. Use Postfix
for what it's good for. Use MS for what it's good for!

> I'd also like more information on
> connection limiting. One of my mail servers is natted behind a firewall
> and
> is being blasted by connecting clients trying to spam, it does well, but
> i'd
> like to block the offending IP or drop it for instances if it connects
> within x times within a minute.

That's a job for Postfix. Have a look at the smtpd_error_sleep_time,
smtpd_soft_error_limit and smtpd_hard_error_limit and either slow the
response times (Which will be happening by default) or reduce the number
of errors required before Postfix disconnects.

HTH

Drew


--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From drew at THEMARSHALLS.CO.UK  Thu Nov 18 13:52:49 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:37 2006
Subject: NASTY phishing attack!
Message-ID: <mailman.4844.1137101257.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Wed, November 17, 2004 23:58, Greg Deputy said:
> Sorry for the slow reply, been at the hospital with a new baby...

Congratulations! Bang went nights with sleep. Mind you I became better
educated in world current affairs as that's about all that's on TV at that
time of the night...


--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jaearick at COLBY.EDU  Thu Nov 18 14:00:35 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:37 2006
Subject: anti-phish ruleset problems SOLVED
Message-ID: <mailman.4845.1137101257.24926.mailscanner@lists.mailscanner.info>

Gang,

The following anti-phishing ruleset of:

     #---exempt sites from anti-phishing rules
     From:   137.146.        no
     From:   127.0.0.1       no
     From:   *@*.xyz.com       no
     From:   *@colby.edu     no

     #---do anti-phishing on everything else
     FromOrTo:       default yes

successfully exempted the following URL from the anti-phishing
complaint:

See more at <a href="http://www.xyz.com/links/link.cgi?31889|363543|CLY-20041117090021">http://www.colby.edu/eag</a>.

The IP number netblock of 137.146 is my own domain.  So...  the
asterisks around the "at" sign are needed after all.

BTW, this was tested and works with version
"1.126.2.168 2004/11/18 12:06:31" of Message.pm, the one that
Julian posted to the list last night.

Jeff Earickson
Colby College

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dwinkler at ALGORITHMICS.COM  Thu Nov 18 14:02:40 2004
From: dwinkler at ALGORITHMICS.COM (Derek Winkler)
Date: Thu Jan 12 21:27:37 2006
Subject: Oversized Zip?
Message-ID: <mailman.4846.1137101257.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

You don't say which version of Clam you use, earlier ones needed to be
recompiled.

You can try this from the archive...

http://www.jiscmail.ac.uk/cgi-bin/wa.exe?A2=ind0408&L=mailscanner&P=R37420&I
=-1


> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> Behalf Of Cecilia Martínez
> Sent: Wednesday, November 17, 2004 1:54 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Oversized Zip?
> 
> 
> At 05:07 p.m. 16/11/2004, you wrote:
> >On Tue, Nov 16, 2004 at 09:56:24AM -0600, Cecilia Martínez wrote:
> > > Fedora C1 / Ensim Pro 4.01 / MailScanner / Sendmail / 
> ClamAV / SpamAssassin
> > >
> > >

This email and any files transmitted with it are confidential and
proprietary to Algorithmics Incorporated and its affiliates
("Algorithmics").  If received in error, use is prohibited.  Please destroy,
and notify sender.  Sender does not waive confidentiality or privilege.
Internet communications cannot be guaranteed to be timely, secure, error or
virus-free.  Algorithmics does not accept liability for any errors or
omissions.  Any commitment intended to bind Algorithmics must be reduced to
writing and signed by an authorized signatory.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From carinus.carelse at MRC.AC.ZA  Thu Nov 18 14:21:02 2004
From: carinus.carelse at MRC.AC.ZA (Carinus Carelse)
Date: Thu Jan 12 21:27:37 2006
Subject: MAilScanner & MailWatch
Message-ID: <mailman.4847.1137101257.24926.mailscanner@lists.mailscanner.info>

I have just about tried everything and still now luck.  I would welcome anymore
suggestions as to why I cannot seem to run the two versions of Mailscanner side by side
and have them logging to different mailwatch databases.

Carinus

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Thu Nov 18 14:32:37 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:37 2006
Subject: MAilScanner & MailWatch
Message-ID: <mailman.4848.1137101257.24926.mailscanner@lists.mailscanner.info>

Carinus Carelse wrote:

> I have just about tried everything and still now luck.  I would welcome anymore
> suggestions as to why I cannot seem to run the two versions of Mailscanner side by side
> and have them logging to different mailwatch databases.
>
> Carinus
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
Carinus

what the the debug statements show - is it call the 'correct' copy of
MailWatch.pm or not?


--
Martin Hepworth
Senior Systems Administrator
Solid State Logic Ltd
tel: +44 (0)1865 842300


**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From j510889 at ABERTAY.AC.UK  Thu Nov 18 14:40:23 2004
From: j510889 at ABERTAY.AC.UK (Jason Cormie)
Date: Thu Jan 12 21:27:37 2006
Subject: 4.35.11 : phishing stall
Message-ID: <mailman.4849.1137101257.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "UTF-8" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi guys,

Nov 18 14:01:59 uadspa01 MailScanner[3961]: Found phishing fraud from
www.otcbb.com/asp/quote_module.asp?symbol=mtdn</a><br><br>
Nov 18 14:01:59 uadspa01 MailScanner[3961]: big year expected in 2005
for motion dna<br>
Nov 18 14:01:59 uadspa01 MailScanner[3961]:   <br>
Nov 18 14:01:59 uadspa01 MailScanner[3961]: trading symbol�mtdn<br>
Nov 18 14:01:59 uadspa01 MailScanner[3961]: current price (est.)ďż˝$0.025<br>
Nov 18 14:01:59 uadspa01 MailScanner[3961]: valued price
(est.)ďż˝$1.00<br><br>
Nov 18 14:01:59 uadspa01 mail: Process did not exit cleanly, returned
255 with signal 0

running on a Debian 3.1 box

caused a big slow down in mail processing this morning,

unfortunatly I didnt capture the message, I just switched phishing off
till it cleared then switched it on again


--
Jason Cormie
Information Services
University of Abertay Dundee

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, "OpenPGP digital signature"  Application/PGP-SIGNATURE  ]
    [ 196bytes. ]
    [ Unable to print this part. ]


From carinus.carelse at MRC.AC.ZA  Thu Nov 18 14:52:35 2004
From: carinus.carelse at MRC.AC.ZA (Carinus Carelse)
Date: Thu Jan 12 21:27:37 2006
Subject: MAilScanner & MailWatch
Message-ID: <mailman.4850.1137101257.24926.mailscanner@lists.mailscanner.info>

I ran the MailScanner in Debug mode and I get no reference to the MailWatch.pm in both debug
files.  I first did it with the one that works and then with the on that doesn't and it saved
the debug info with out any reference to the MailWatch.pm in it.

Carinus

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Thu Nov 18 15:13:13 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:37 2006
Subject: MAilScanner & MailWatch
Message-ID: <mailman.4851.1137101257.24926.mailscanner@lists.mailscanner.info>

Carinus Carelse wrote:

> I ran the MailScanner in Debug mode and I get no reference to the MailWatch.pm in both debug
> files.  I first did it with the one that works and then with the on that doesn't and it saved
> the debug info with out any reference to the MailWatch.pm in it.
>
> Carinus
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
Carinus...

So what 'debug' statements did you add into either or both MailWatch.pm's...

--
Martin Hepworth
Senior Systems Administrator
Solid State Logic Ltd
tel: +44 (0)1865 842300


**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From carinus.carelse at MRC.AC.ZA  Thu Nov 18 15:19:25 2004
From: carinus.carelse at MRC.AC.ZA (Carinus Carelse)
Date: Thu Jan 12 21:27:37 2006
Subject: MAilScanner & MailWatch
Message-ID: <mailman.4852.1137101257.24926.mailscanner@lists.mailscanner.info>

Sorry I didn't know I had to do that as well i am not good at perl so I don't know what debug
statements to add.

Carinus

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Thu Nov 18 15:22:14 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:37 2006
Subject: MailScanner: Beta 4.36.1 released
Message-ID: <mailman.4853.1137101257.24926.mailscanner@lists.mailscanner.info>

I have just released the latest version 4.36.1.
This is mostly to get everyone up to the same point in the development of
the phishing net.
It also adds support for RedHat Enterprise Server (and AS) version 4 beta 2.

One more thing: the Linux install.sh script now supports a command-line
option "fast" (i.e. "./install.sh fast") which makes it only ever wait 1
second in the pauses, rather than up to 10 seconds which it does normally.
Speeds up installations enormously!

Download it as usual from www.mailscanner.info.

There is now unofficial support on IRC (irc.freenode.net #mailscanner).

The full Changelog is this:

* New Features and Improvements *
- Improved URL trimming in phishing net.
- Various improvements and fixes in phishing net.
- Added support for RedHat Enterprise Linux 4.
- Added check for Password-Protected Archives setting when using
clamavmodule.

* Fixes *
- Fixed outstanding problem in bitdefender-autoupdate, so that it works
  properly on new installations.
- Fixed logging problem with phishing net on a few malformed messages.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Thu Nov 18 15:23:11 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:37 2006
Subject: 4.35.11 : phishing stall
Message-ID: <mailman.4854.1137101257.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "UTF-8" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Fixed in 4.36.1 which I have just released.


On 18/11/04 2:40 pm, "Jason Cormie" <j510889@ABERTAY.AC.UK> wrote:

> Hi guys,
> 
> Nov 18 14:01:59 uadspa01 MailScanner[3961]: Found phishing fraud from
> www.otcbb.com/asp/quote_module.asp?symbol=mtdn</a><br><br>
> Nov 18 14:01:59 uadspa01 MailScanner[3961]: big year expected in 2005
> for motion dna<br>
> Nov 18 14:01:59 uadspa01 MailScanner[3961]:   <br>
> Nov 18 14:01:59 uadspa01 MailScanner[3961]: trading symbol�mtdn<br>
> Nov 18 14:01:59 uadspa01 MailScanner[3961]: current price (est.)ďż˝$0.025<br>
> Nov 18 14:01:59 uadspa01 MailScanner[3961]: valued price
> (est.)ďż˝$1.00<br><br>
> Nov 18 14:01:59 uadspa01 mail: Process did not exit cleanly, returned
> 255 with signal 0
> 
-- 
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From sylvain.phaneuf at IMSU.OXFORD.AC.UK  Thu Nov 18 15:38:07 2004
From: sylvain.phaneuf at IMSU.OXFORD.AC.UK (Sylvain Phaneuf)
Date: Thu Jan 12 21:27:38 2006
Subject: specs & platform for new server
Message-ID: <mailman.4855.1137101258.24926.mailscanner@lists.mailscanner.info>

Thanks Martin and all the others. We are now leaning on your side: two
smaller boxes. Load balancing, resilience and no more down-time sound
good. And if we have two boxes, we don't see the need for RAID or
redundant power supplies, etc. And we only need next day on-site service
& support, don't we? Two boxes for the price of one looks like a great
idea. The only downside is two boxes to configure instead of one.

Sylvain


>>> martinh@SOLID-STATE-LOGIC.COM 18/11/2004 10:39:57 >>>
Sylvain

loads of capacity, there.that machine should be able to process well
over 1 million per day.

maybe you could get a couple of single processor machines so you can
load balance and have redundancy should one fail.

my 800mhz celeron with 512MB 133mhz sdram and a 100mhx IDE drive tops
outat about 15,000 records per day...so a 2.8 ghx PIV with HT and 2GB
of
ram should be more than enough and you get get those for around 1000
uk
pounds from dell rack mounted...



--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Sylvain Phaneuf wrote:
> Hi everyone,
>
> Our 20 months old server is being a bit overworked and we are going
to
> buy a new box.
>
> Could the experts out there help us a bit with suggestions. We would
> like to know where to throw our money at. More memory, multuiple
> processors?
>
> We will use the box only as a mail gateway running MailScanner,
> SpamAssassin, Sendmail, Sophos, MRTG and very little else. We don't
need
> to run any RBL checks as our ISP does it for us. We currently get
> approx. 35,000 messages per day, and we expect that will increase to
> possibly 50,000 in the next year or two. Currently we get somewhere
> between 1 and 1.5 GB of mail per day.
>
> We don't want to spend more than 2,500 - 3,000 pounds if possible.
We
> are thinking of:
> Dual Xeon 3.2 GHz with 1 MB L2 cache
> 2 GB DDR2 RAM (400 MHz DIMMS)
> RAID 1
> Intel Gigabit NIC
>
> Finally, we are thinking of running the new box with SLSE (we are
using
> RH at the moment). Any problem with SuSE?
>
> I will really appreciate your input. MialScanner is great, we love
it,
> our users love us!
>
> Thanks in advance,
>
> Sylvain
>
>
>
> ===========================================================
> Sylvain Phaneuf --- Systems Manager   | phone : +44 (0)1865 221323
> Clinical School Information Management Services Unit  (IMSU)
> Medical Sciences Division
> University of Oxford                                  |   email :
> sylvain.phaneuf@imsu.ox.ac.uk
> Room 3A25B John Radcliffe Hospital      |   fax :  +44 (0) 1865
221322
> Oxford   OX3 9DU   England
> ===========================================================
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From michele at BLACKNIGHTSOLUTIONS.COM  Thu Nov 18 15:43:40 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:38 2006
Subject: MailScanner: Beta 4.36.1 released
Message-ID: <mailman.4856.1137101258.24926.mailscanner@lists.mailscanner.info>

> One more thing: the Linux install.sh script now supports a
> command-line option "fast" (i.e. "./install.sh fast") which
> makes it only ever wait 1 second in the pauses, rather than
> up to 10 seconds which it does normally.
> Speeds up installations enormously!


Yes! Fastest upgrade I've ever seen!!

>
> There is now unofficial support on IRC (irc.freenode.net
> #mailscanner).

A few of us are in there all the time, so just "holler" if you have any
questions or just want to swap ideas/tips or banter





Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
http://www.blacknight.ie/specialoffers.html

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mikea at MIKEA.ATH.CX  Thu Nov 18 15:47:55 2004
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:27:38 2006
Subject: specs & platform for new server
Message-ID: <mailman.4857.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Thu, Nov 18, 2004 at 12:34:33PM +0100, David Höhn wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: RIPEMD160
> 
> Sylvain Phaneuf wrote:
> <snip>
> |
> | We don't want to spend more than 2,500 - 3,000 pounds if possible. We
> | are thinking of:
> | Dual Xeon 3.2 GHz with 1 MB L2 cache
> | 2 GB DDR2 RAM (400 MHz DIMMS)
> | RAID 1
> | Intel Gigabit NIC
> |
> <snip>
> for 35 000 to 50 000 messages that CPU Spec seems a bit too much in my
> humble opinion. You can do well with only a single Xeon and put more
> money into buying a very good RAID Controller.
> 
> <advertisement mode>
> I can only recommend the IBM X-Series
> </advertisement mode>
> 
> Most of the smaller Mailserver here run on xSeries 345 or 346 and we are
> quite happy with that and the ServeRAID controllers.
> 
> Hope that helps

I second the xSeries recommendation. I have 3 xSeries 335, all 3.2 GHz 
uniprocessors with 3 GB RAM and 2 73GB Ultra320 SCSI. One does the 
inbound mail, one the outbound, and the third is on my desk as a 
controller for the other two and as backup. The inbound server is just
loafing at ~16K inbound mails per day. As configured, each cost us 
just about US$6600. I think each could handle > 150K mails per day, 
more or less, and I may be on the low side. 

-- 
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From alden at engineno9inc.com  Thu Nov 18 16:08:53 2004
From: alden at engineno9inc.com (Alden Levy)
Date: Thu Jan 12 21:27:38 2006
Subject: Anti-phishing issues
Message-ID: <mailman.4858.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I've been upgrading my Message.pm diligently.  I have the newest version
(166111 bytes), and I'm on FC 1 with MS 4.35.11, SA 3.01, and Mail::ClamAV
0.13.

I have one further request for a tweak: apparently, there are a few (ha!)
sites that drop the "www" from their web address in their hrefs.  Can we
account for this?

Here are two lines from my maillog indicating the problem:

Nov 18 03:15:27 engine MailScanner[7081]: Found phishing fraud from
www.emergingarts.com claiming to be emergingarts.com
Nov 18 03:15:27 engine MailScanner[7081]: Found phishing fraud from
www.spsounds.com claiming to be spsounds.com

Any thoughts?

Thank you,
Alden

Alden Levy
Engine No. 9, Inc.
130 West 57th Street, Suite 12E
New York, NY 10019
(212) 981-1122
(212) 725-7202 (fax)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From greg at BLASTZONE.COM  Thu Nov 18 16:18:00 2004
From: greg at BLASTZONE.COM (Greg Deputy)
Date: Thu Jan 12 21:27:38 2006
Subject: Phishing detector apparently slogged up my server
Message-ID: <mailman.4859.1137101258.24926.mailscanner@lists.mailscanner.info>

Thanks for the quick response and excellent product!

> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
> Sent: Thursday, November 18, 2004 4:10 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Phishing detector apparently slogged up my server
>
>
> I have found and fixed the problem with the (malformed)
> messages. Attached is a new Message.pm for those of you who
> just want this update.
>
> I will also release a new beta after lunch, including this
> change and all the other phishing net improvements among
> other things. I now support RedHat Enterprise Server 4 beta 2 as well.
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Glenn.Steen at AP1.SE  Thu Nov 18 16:51:34 2004
From: Glenn.Steen at AP1.SE (Steen, Glenn)
Date: Thu Jan 12 21:27:38 2006
Subject: Postfix, mailwatch and queue IDs (and  of course mailscanner:-)
Message-ID: <mailman.4860.1137101258.24926.mailscanner@lists.mailscanner.info>

Hi all...

I gather from the gigantic shrug I'm getting here (how else to interpret
... silence:-) that noone has a good handle on how to "improve" the
situation regarding duplicates in sql-logs (and possible quarantine
corruption) when using some such log feature with MS, due to postfix
reusing queue IDs (the quarantine is in danger when using systems like
MailWatch, which will not preserve the queue file inode (number)...
Sure, it's a slim window, but it could happen).

One could of course try to "work around" this in the "logging subsytem"
(MailWatch in my case), but.. I dunno, it feels like it's better to do
closer to the source:-).

Why not ask the postfix people to "fix it"? Well, I'm guessing one will
get even less response (if that's possible:-) from then, and then
probably just a pointer to amavisd-new.

Sure, for MailScanner it's not a central problem, but... Well, my PHB
likes what he can see in MW (that's what sold him on MS...:), and when
he starts to see the duplicates on a more ... regular basis... Suffice
it to say that it gets to be my problem then:-).

Or has this been discussed in depth already? I couldn't find mention of
it in the list archive...

Any feedback would be welcome.

-- Glenn

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Steen, Glenn
Sent: den 17 november 2004 14:30
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Postfix, mailwatch and queue IDs (and of course
mailscanner:-)


Grmbl... Autowrap messing up the perfectly fine links....
Here in a "wrap-safe" version:-)

http://sf.net/mailarchive/forum.php?thread_id=5934318&forum_id=34994

http://sf.net/mailarchive/forum.php?thread_id=5964404&forum_id=34994

http://sf.net/mailarchive/forum.php?thread_id=5964780&forum_id=34994

Sorry for that.

-- Glenn
-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Steen, Glenn
Sent: den 17 november 2004 13:55
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Postfix, mailwatch and queue IDs (and of course mailscanner:-)


Hi all,

(this is mainly old news for the followers of the mailwatch-users
list... Just want to clue you all in:-)

As can be seen in the following references to the not-so-threaded view
of the mailwatch-users list (I might have missed some "branch"...):
http://sourceforge.net/mailarchive/forum.php?thread_id=5934318&forum_id=
34994

http://sourceforge.net/mailarchive/forum.php?thread_id=5964404&forum_id=
34994

http://sourceforge.net/mailarchive/forum.php?thread_id=5964780&forum_id=
34994

... I've run into a rather sticky thing with message logging to database
and postfix/MS.
Executive summary is that postfix can, and will, reuse queue file IDs...
Which can lead to some strangeness in the MailWatch display ("message
details" showing two messages in one rather confusing display, viruses
appearing "clean" etc), and possibly a form of "quarantine corruption"
if the queue inode number isn't preserved.

As is plain in the above conversation(s) I thoroughly aggravated the
problem by separating the spool area from the rest of /var, so perhaps
this issue could be handled with a FAQ saying "don't do that stupid",
but I'd prefer something more slick... somehow making the IDs
bulletproof unique... but I'm unsure if that's even possible.
Any of you MS gurus care to comment?

Yours
-- Glenn

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From walkera at OFB.NET  Thu Nov 18 16:57:37 2004
From: walkera at OFB.NET (Walker Aumann)
Date: Thu Jan 12 21:27:38 2006
Subject: 4.35.11 : phishing stall
Message-ID: <mailman.4861.1137101258.24926.mailscanner@lists.mailscanner.info>

On Thu, 2004-11-18 at 07:23, Julian Field wrote:
> Fixed in 4.36.1 which I have just released.

By the way, I captured it, in case you want to see it, Julian.

Walker

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Thu Nov 18 17:01:57 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:38 2006
Subject: Postfix, mailwatch and queue IDs (and  of course mailscanner:-)
Message-ID: <mailman.4862.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Steen, Glenn wrote:

>Hi all...
>
>I gather from the gigantic shrug I'm getting here (how else to interpret
>... silence:-) that noone has a good handle on how to "improve" the
>situation regarding duplicates in sql-logs (and possible quarantine
>corruption) when using some such log feature with MS, due to postfix
>reusing queue IDs
>
No, sorry, there's not a whole lot that can be easily done here. I guess
I could tack the time onto the end of the message id when it is used
inside MailScanner, just for Postfix. Then I could remove the timestamp
again when the message is written into the outgoing queue (the
"requeueing" code will probably do thay anyway).

It would have to be a small custom patch just for you, so some payment
would be appreciated if that's possible.

>Why not ask the postfix people to "fix it"? Well, I'm guessing one will
>get even less response (if that's possible:-) from then, and then
>probably just a pointer to amavisd-new.
>
>
A helpful response from the postfix people to a MailScanner question?
The pigs are taxi-ing to the end of the runway as I type...

>Or has this been discussed in depth already? I couldn't find mention of
>it in the list archive...
>
>
Interestingly I don't think it has come up before.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Thu Nov 18 17:03:26 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:38 2006
Subject: Postfix, mailwatch and queue IDs (and  of course mailscanner:-)
Message-ID: <mailman.4863.1137101258.24926.mailscanner@lists.mailscanner.info>

Glenn
move to another MTA that doesn't exhibit this 'feature' :-) Exim's
nice....depends on why you use Postfix anyhow..

Not much love lost by the Postfix guys for the MS way of doing things, I
doubt they'd fix this for a product they don't 'support' anyway.



--
Martin Hepworth
Senior Systems Administrator
Solid State Logic Ltd
tel: +44 (0)1865 842300


Steen, Glenn wrote:

> Hi all...
>
> I gather from the gigantic shrug I'm getting here (how else to interpret
> ... silence:-) that noone has a good handle on how to "improve" the
> situation regarding duplicates in sql-logs (and possible quarantine
> corruption) when using some such log feature with MS, due to postfix
> reusing queue IDs (the quarantine is in danger when using systems like
> MailWatch, which will not preserve the queue file inode (number)...
> Sure, it's a slim window, but it could happen).
>
> One could of course try to "work around" this in the "logging subsytem"
> (MailWatch in my case), but.. I dunno, it feels like it's better to do
> closer to the source:-).
>
> Why not ask the postfix people to "fix it"? Well, I'm guessing one will
> get even less response (if that's possible:-) from then, and then
> probably just a pointer to amavisd-new.
>
> Sure, for MailScanner it's not a central problem, but... Well, my PHB
> likes what he can see in MW (that's what sold him on MS...:), and when
> he starts to see the duplicates on a more ... regular basis... Suffice
> it to say that it gets to be my problem then:-).
>
> Or has this been discussed in depth already? I couldn't find mention of
> it in the list archive...
>
> Any feedback would be welcome.
>


**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Thu Nov 18 17:04:08 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:38 2006
Subject: 4.35.11 : phishing stall
Message-ID: <mailman.4864.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I found my own MailScanners were starting to get bogged down in this
problem, so I got the message from my own queue. The fix in 4.36.1
sorted it out.

I'm a bit worried that it caused a problem in the first place, as the
only thing I changed was to stop the logged string getting too long.
Points to a potential overflow bug in Linux's syslogd. But I'll leave
fixing that to someone else.

Walker Aumann wrote:

>On Thu, 2004-11-18 at 07:23, Julian Field wrote:
>
>
>>Fixed in 4.36.1 which I have just released.
>>
>>
>
>By the way, I captured it, in case you want to see it, Julian.
>
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Glenn.Steen at AP1.SE  Thu Nov 18 17:17:40 2004
From: Glenn.Steen at AP1.SE (Steen, Glenn)
Date: Thu Jan 12 21:27:38 2006
Subject: Postfix, mailwatch and queue IDs (and  of course mailscanner:-)
Message-ID: <mailman.4865.1137101258.24926.mailscanner@lists.mailscanner.info>

:-) Martin,

Well I fancied the elegant design, easy configuration, security (qmail
(which was the secure alternative to sendmail back when... I sort of
fell in love with Postfix) never appealed to me... Too much PC cr*p:)
and non-monolithic nature of Postfix.

I don't think I'll switch MTA/Scanner just because of this (too set in
my ways... Don't try to teach an old dog to sit, and all that:-)... I'll
probably try and see if "smarter/dumber partitioning" helps enough to
make it bearable... At least as a first step.

Thanks for the input though.

-- Glenn

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Martin Hepworth
Sent: den 18 november 2004 18:03
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Postfix, mailwatch and queue IDs (and of course
mailscanner:-)


Glenn
move to another MTA that doesn't exhibit this 'feature' :-) Exim's
nice....depends on why you use Postfix anyhow..

Not much love lost by the Postfix guys for the MS way of doing things, I
doubt they'd fix this for a product they don't 'support' anyway.



--
Martin Hepworth
Senior Systems Administrator
Solid State Logic Ltd
tel: +44 (0)1865 842300


Steen, Glenn wrote:

> Hi all...
>
> I gather from the gigantic shrug I'm getting here (how else to
interpret
> ... silence:-) that noone has a good handle on how to "improve" the
> situation regarding duplicates in sql-logs (and possible quarantine
> corruption) when using some such log feature with MS, due to postfix
> reusing queue IDs (the quarantine is in danger when using systems like
> MailWatch, which will not preserve the queue file inode (number)...
> Sure, it's a slim window, but it could happen).
>
> One could of course try to "work around" this in the "logging
subsytem"
> (MailWatch in my case), but.. I dunno, it feels like it's better to do
> closer to the source:-).
>
> Why not ask the postfix people to "fix it"? Well, I'm guessing one
will
> get even less response (if that's possible:-) from then, and then
> probably just a pointer to amavisd-new.
>
> Sure, for MailScanner it's not a central problem, but... Well, my PHB
> likes what he can see in MW (that's what sold him on MS...:), and when
> he starts to see the duplicates on a more ... regular basis... Suffice
> it to say that it gets to be my problem then:-).
>
> Or has this been discussed in depth already? I couldn't find mention
of
> it in the list archive...
>
> Any feedback would be welcome.
>


**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Thu Nov 18 17:46:00 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:38 2006
Subject: Postfix, mailwatch and queue IDs (and  of course mailscanner:-)
Message-ID: <mailman.4866.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

The news was boring, so I wrote a patch for you instead.
Please apply the attached patch to Postfix.pm and then restart MailScanner.
Let me know how you get on.

Julian Field wrote:

> Steen, Glenn wrote:
>
>> Hi all...
>>
>> I gather from the gigantic shrug I'm getting here (how else to interpret
>> ... silence:-) that noone has a good handle on how to "improve" the
>> situation regarding duplicates in sql-logs (and possible quarantine
>> corruption) when using some such log feature with MS, due to postfix
>> reusing queue IDs
>>
> No, sorry, there's not a whole lot that can be easily done here. I guess
> I could tack the time onto the end of the message id when it is used
> inside MailScanner, just for Postfix. Then I could remove the timestamp
> again when the message is written into the outgoing queue (the
> "requeueing" code will probably do thay anyway).
>
> It would have to be a small custom patch just for you, so some payment
> would be appreciated if that's possible.
>
>> Why not ask the postfix people to "fix it"? Well, I'm guessing one will
>> get even less response (if that's possible:-) from then, and then
>> probably just a pointer to amavisd-new.
>>
>>
> A helpful response from the postfix people to a MailScanner question?
> The pigs are taxi-ing to the end of the runway as I type...
>
>> Or has this been discussed in depth already? I couldn't find mention of
>> it in the list archive...
>>
>>
> Interestingly I don't think it has come up before.
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2: "Attached Text" ]

--- Postfix.pm.old      2004-10-14 18:56:53.000000000 +0100
+++ Postfix.pm  2004-11-18 17:43:50.000000000 +0000
@@ -237,6 +237,7 @@
     #$id =~ /^(.)(.)(.+)$/;
     #($dir1, $dir2, $file) = ($1,$2,$3);
     #return "$dir1/$dir2/$file";
+    $id =~ s/\.[^.]+$//;
     return "$id";
   }

@@ -1241,14 +1242,20 @@
           if $MailScanner::SMDiskStore::HashDirDepth == 1 &&
              $file =~ /^(.*)\/(.)\/([^\/]+)$/;
         next unless $file =~ /$mta->{HDFileRegexp}/;
-        $id = $1;
+        # Put the real message id in $idorig and the unique name in $id
+        # JKF Add a dot followed by a random number to try to get a unique
+        # JKF filename, as Postfix re-uses filenames too often.
+        my $idtemp = $1;
+        my $id = $idtemp . sprintf(".%05X", int(rand 1000000)+1);
+        my $idorig = $idtemp;

         #print STDERR "Adding $id to batch\n";

         # Lock and read the qf file. Skip this message if the lock fails.
         $newmessage = MailScanner::Message->new($id, $queuedirname);
         if ($newmessage eq 'INVALID') {
-          $invalidfiles .= "$id ";
+          #$invalidfiles .= "$id ";
+          $invalidfiles .= "$idorig ";
           next;
         }
         next unless $newmessage;

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From Glenn.Steen at AP1.SE  Thu Nov 18 17:47:32 2004
From: Glenn.Steen at AP1.SE (Steen, Glenn)
Date: Thu Jan 12 21:27:38 2006
Subject: Postfix, mailwatch and queue IDs (and  of course mailscanner:-)
Message-ID: <mailman.4867.1137101258.24926.mailscanner@lists.mailscanner.info>

Hi Julian,

Thank you for replying. Steve already alerted me there are some ...
issues ... between you and the postfix crowd, so... I really appreciate
that you take the time to at least look/respond.

I'm not sure if I'll be able to get any funding from the company (well,
.gov actually:), the PHB being a bit ... tightfisted... He might spring
for the book, but... Might depend a bit on your rates too. I'll see what
I can do though.
If I find a moment I might take a crack at it myself. In the mean time
I'm setting up a "stupid partitioned" server, that'll replace the old
one come monday, with everything in one big partition... This should
make the reuse far less likely to happen, and might even be a "good
enough" solution.
Next I'll probably be looking at how hard it could be to make MW able to
work with the queue files in the quarantine (thus preserving inode, thus
preventing the very slight risk of quarantine corruption).

I think I can explain why it's never been talked about before:
I suspect none (running Postfix at least:-) ever was dumb enough to make
/var/spool separate from /var, so the problem was never noticed... But
when you get the percentage I get, it's pretty obvious _something_ is
wrong:-). It wasn't that difficult to find out why, once I had a look at
the MW (and to some extent the MS) code... And read some postfix docs
_carefully_:-).

Even before I knew about the ... issues... I sort of had gathered that
MS wasn't the "one true postfix way" at least not according to
postfix.org. Sort of had the same thought (diverse flying critters and
all:).

-- Glenn

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Julian Field
Sent: den 18 november 2004 18:02
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Postfix, mailwatch and queue IDs (and of course
mailscanner:-)


Steen, Glenn wrote:

>Hi all...
>
>I gather from the gigantic shrug I'm getting here (how else to
interpret
>... silence:-) that noone has a good handle on how to "improve" the
>situation regarding duplicates in sql-logs (and possible quarantine
>corruption) when using some such log feature with MS, due to postfix
>reusing queue IDs
>
No, sorry, there's not a whole lot that can be easily done here. I guess
I could tack the time onto the end of the message id when it is used
inside MailScanner, just for Postfix. Then I could remove the timestamp
again when the message is written into the outgoing queue (the
"requeueing" code will probably do thay anyway).

It would have to be a small custom patch just for you, so some payment
would be appreciated if that's possible.

>Why not ask the postfix people to "fix it"? Well, I'm guessing one will
>get even less response (if that's possible:-) from then, and then
>probably just a pointer to amavisd-new.
>
>
A helpful response from the postfix people to a MailScanner question?
The pigs are taxi-ing to the end of the runway as I type...

>Or has this been discussed in depth already? I couldn't find mention of
>it in the list archive...
>
>
Interestingly I don't think it has come up before.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Thu Nov 18 17:50:38 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:38 2006
Subject: Postfix, mailwatch and queue IDs (and  of course mailscanner:-)
Message-ID: <mailman.4868.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Now we've got an overlapping mail conversation :-)


--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Glenn.Steen at AP1.SE  Thu Nov 18 17:53:07 2004
From: Glenn.Steen at AP1.SE (Steen, Glenn)
Date: Thu Jan 12 21:27:38 2006
Subject: Postfix, mailwatch and queue IDs (and  of course mailscanner:-)
Message-ID: <mailman.4869.1137101258.24926.mailscanner@lists.mailscanner.info>

Yep, more fun than the news (at least here in sweden)...:-):-) Ouch,
gotta run...

-- Glenn

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Julian Field
Sent: den 18 november 2004 18:51
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Postfix, mailwatch and queue IDs (and of course
mailscanner:-)


Now we've got an overlapping mail conversation :-)


--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Steve.Swaney at FSL.COM  Thu Nov 18 17:52:46 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:38 2006
Subject: Postfix, mailwatch and queue IDs (and  of course mailscanner:-)
Message-ID: <mailman.4870.1137101258.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Steen, Glenn
> Sent: Thursday, November 18, 2004 11:52 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Postfix, mailwatch and queue IDs (and of course mailscanner:-
> )
>
> Hi all...
>
> I gather from the gigantic shrug I'm getting here (how else to interpret
> ... silence:-) that noone has a good handle on how to "improve" the
> situation regarding duplicates in sql-logs (and possible quarantine
> corruption) when using some such log feature with MS, due to postfix
> reusing queue IDs (the quarantine is in danger when using systems like
> MailWatch, which will not preserve the queue file inode (number)...
> Sure, it's a slim window, but it could happen).
>
> One could of course try to "work around" this in the "logging subsytem"
> (MailWatch in my case), but.. I dunno, it feels like it's better to do
> closer to the source:-).
>
> Why not ask the postfix people to "fix it"? Well, I'm guessing one will
> get even less response (if that's possible:-) from then, and then
> probably just a pointer to amavisd-new.
>
> Sure, for MailScanner it's not a central problem, but... Well, my PHB
> likes what he can see in MW (that's what sold him on MS...:), and when
> he starts to see the duplicates on a more ... regular basis... Suffice
> it to say that it gets to be my problem then:-).
>
> Or has this been discussed in depth already? I couldn't find mention of
> it in the list archive...
>
> Any feedback would be welcome.

Have you checked the MailWatch mail list and Archives? Start at:

http://mailwatch.sourceforge.net/

You might post this question there after checking the MailWatch Archives.

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Glenn.Steen at AP1.SE  Thu Nov 18 17:49:16 2004
From: Glenn.Steen at AP1.SE (Steen, Glenn)
Date: Thu Jan 12 21:27:38 2006
Subject: Postfix, mailwatch and queue IDs (and  of course mailscanner:-)
Message-ID: <mailman.4871.1137101258.24926.mailscanner@lists.mailscanner.info>

Many many thanks Julian!

Will apply first thing tomorrow (have to catch a train or the Mrs will
skin me:-).

-- Glenn

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Julian Field
Sent: den 18 november 2004 18:46
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Postfix, mailwatch and queue IDs (and of course
mailscanner:-)


The news was boring, so I wrote a patch for you instead.
Please apply the attached patch to Postfix.pm and then restart
MailScanner.
Let me know how you get on.

Julian Field wrote:

> Steen, Glenn wrote:
>
>> Hi all...
>>
>> I gather from the gigantic shrug I'm getting here (how else to
interpret
>> ... silence:-) that noone has a good handle on how to "improve" the
>> situation regarding duplicates in sql-logs (and possible quarantine
>> corruption) when using some such log feature with MS, due to postfix
>> reusing queue IDs
>>
> No, sorry, there's not a whole lot that can be easily done here. I
guess
> I could tack the time onto the end of the message id when it is used
> inside MailScanner, just for Postfix. Then I could remove the
timestamp
> again when the message is written into the outgoing queue (the
> "requeueing" code will probably do thay anyway).
>
> It would have to be a small custom patch just for you, so some payment
> would be appreciated if that's possible.
>
>> Why not ask the postfix people to "fix it"? Well, I'm guessing one
will
>> get even less response (if that's possible:-) from then, and then
>> probably just a pointer to amavisd-new.
>>
>>
> A helpful response from the postfix people to a MailScanner question?
> The pigs are taxi-ing to the end of the runway as I type...
>
>> Or has this been discussed in depth already? I couldn't find mention
of
>> it in the list archive...
>>
>>
> Interestingly I don't think it has come up before.
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ELIQUID.COM  Thu Nov 18 20:11:57 2004
From: mailscanner at ELIQUID.COM (Wess)
Date: Thu Jan 12 21:27:38 2006
Subject: [Spam] Re: 4.35.11 : phishing stall
Message-ID: <mailman.4872.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "utf-8" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Fortunately I have yet to see any Canadian Phishing attempts for our
banks.  Always seems to be an american bank.

On Thu, 2004-11-18 at 12:04, Julian Field wrote:

 I found my own MailScanners were starting to get bogged down in this
problem, so I got the message from my own queue. The fix in 4.36.1
sorted it out.

I'm a bit worried that it caused a problem in the first place, as the
only thing I changed was to stop the logged string getting too long.
Points to a potential overflow bug in Linux's syslogd. But I'll leave
fixing that to someone else.

Walker Aumann wrote:

>On Thu, 2004-11-18 at 07:23, Julian Field wrote:
>
>
>>Fixed in 4.36.1 which I have just released.
>>
>>
>
>By the way, I captured it, in case you want to see it, Julian.
>
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

 MailScanner on IRC

Community Support

irc.freenode.net

#mailscanner



------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From cstone at AXINT.NET  Thu Nov 18 20:33:09 2004
From: cstone at AXINT.NET (Chris Stone)
Date: Thu Jan 12 21:27:38 2006
Subject: Phishing detector apparently slogged up my server
Message-ID: <mailman.4873.1137101258.24926.mailscanner@lists.mailscanner.info>

Julian,

If this Message.pm the same that is in the 4.36.1 release? Or are there
still problems with this code that is further fixed in the 4.36.1 release?


Chris


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Thursday, November 18, 2004 5:10 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Phishing detector apparently slogged up my server

I have found and fixed the problem with the (malformed) messages. Attached
is a new Message.pm for those of you who just want this update.

I will also release a new beta after lunch, including this change and all
the other phishing net improvements among other things. I now support RedHat
Enterprise Server 4 beta 2 as well.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


On 18/11/04 9:07 am, "Julian Field" <mailscanner@ecs.soton.ac.uk> wrote:

> On 18/11/04 8:40 am, "Bruce Rahn" <brahn@woh.rr.com> wrote:
>> Greg Deputy wrote:
>>
>>> Fedora core 2, MailScanner 4.35.9, Postfix 2.1.5.  Phishing detection
>>> turned on.  Currently acting as a gateway (no mail on server, all gets
>>> scanned and passed on to another server for delivery) for about 500 mail
>>> boxes on 100 hosted domains.
>>>
>>> Today I was looking at my mailscanner-mrtg page
>>> (http://mx.blastzone.com/mailscanner-mrtg) and noticed that at around
>>> 1:30 am the CPU pegged on the box.  I spent some time trying to figure
>>> out why, looking at the logs for a DOS attack or some evidence that the
>>> box had been compromised, but found nothing.
>>>
>>> What I eventually figured out was Mailscanner seemed to be hitting the
>>> same mail in the postfix hold queue over and over again.  It would hit
>>> the mail, and apparently restart.  It would seem to hit the queue,
>>> process a few messages, hit one, and then choke, restart.  It also
>>> caused the CPU to be a lot more active (85% +) than it normally is
>>> (~25%).
>>>
>>> I believe it was dying in the phishing detector logic for 2 reasons.
>>> One, I kept seeing the same phishing detection over and over again in
>>> the logs.  Two, I turned off the phishing detection in MailScanner.conf,
>>> restarted MailScanner, and the queue cleared out and CPU dropped back to
>>> normal.
>>>
>>>
>>>
>> [stuff deleted]
>>
>>>
>>> Nov 17 09:01:05 mx MailScanner[32483]: Found phishing fraud attack from
>>> http://www.otcbb.com/asp/quote_module.asp?symbol=MTDN</a>
>>> Nov 17 09:01:05 mx MailScanner[32483]: <br><br>
>>> Nov 17 09:01:05 mx MailScanner[32483]: Big year expected in 2005 for
>>> Motion DNA<br>
>>> Nov 17 09:01:05 mx MailScanner[32483]:   <br>
>>> Nov 17 09:01:05 mx MailScanner[32483]: Trading Symbol MTDN<br>
>>> Nov 17 09:01:05 mx MailScanner[32483]: Current Price (est.) $0.025<br>
>>> Nov 17 09:01:05 mx MailScanner[32483]: Valued Price (est.) $1.00<br><br>
>>>
>>>
>> I had the exact same thing happen today on what looks like the exact
>> same SPAM message.  It was looping over, and over, and over again.
>>
>> Something about that message MailScanner didn't like.
>
> In which case can someone send me a copy of the message please? Don't mind
> much what format, I can handle most things.
--
Julian Field
jkf@ecs.soton.ac.uk
Teaching Systems Manager
Electronics & Computer Science
University of Southampton
SO17 1BJ, UK


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From paddy at PANICI.NET  Thu Nov 18 20:43:57 2004
From: paddy at PANICI.NET (paddy)
Date: Thu Jan 12 21:27:38 2006
Subject: MIME-Base64 package problems ...
Message-ID: <mailman.4874.1137101258.24926.mailscanner@lists.mailscanner.info>

Julian,

Hi, I'm just installing 4.35.11.  Straight away I noticed
the new package name 'MailScanner-perl-MIME-Base64' (yes, I've not been
paying attention awhile).

When I built it and rpm -qlp it I see

  /usr/lib/MailScanner/utils/

and then again

  /var/tmp/MailScanner-perl-MIME-Base64-3.05-root/usr/lib/MailScanner/utils

each with the expected hierarchy under it.

Straight away I say to myself "what was that show where they used to
say 'now that was not supposed to happen'".

I've looked around for docs on why the move, and grepped the list, but
I seem to be missing the vital intel.  I'm guessing this helps with some
installation problem somewhere.  Should MailScanner work happily with
a MIME-Base64-3.05 installed from an rpm built with the spec for 3.00
that you shipped (much more vanilla), as I have built that and
rpm --test -Uvh seems happy, or is MailScanner now looking for MIME::Base64
only in this 'non-standard' place (I'd imagine you just gave that place
priority in an @INC somewhere), or is there some subtle breakage in
this way of installing things ... (and so on ...)

Many Thanks,
Paddy.
--
Perl 6 will give you the big knob. -- Larry Wall

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From paddy at PANICI.NET  Thu Nov 18 21:07:03 2004
From: paddy at PANICI.NET (paddy)
Date: Thu Jan 12 21:27:38 2006
Subject: whitelisting by connection tracking
Message-ID: <mailman.4875.1137101258.24926.mailscanner@lists.mailscanner.info>

Hi,

I've been asked to implement a specific feature:

  When we relay outgoing mail for a client we are to track the recipients
  and then, essentially, whitelist those recipients for return mail.

This seems like a reasonable and simple idea, and yet I'm having trouble
tracking down any other mention of it.  I figure this indicates some or
all of the following

1. I'm not looking very hard (okay, true ...)
2. It's a deeply flawed idea

... you get the idea.

So if anyone can point me at existing implementations of this kind of thing
or cares to point out complexities I may yet have overlooked, I'd be
overjoyed.

Regards,
Paddy
--
Perl 6 will give you the big knob. -- Larry Wall

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Thu Nov 18 21:10:35 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:38 2006
Subject: Phishing detector apparently slogged up my server
Message-ID: <mailman.4876.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Should be the same.

Chris Stone wrote:

>Julian,
>
>If this Message.pm the same that is in the 4.36.1 release? Or are there
>still problems with this code that is further fixed in the 4.36.1 release?
>
>
>Chris
>
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
>Of Julian Field
>Sent: Thursday, November 18, 2004 5:10 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Phishing detector apparently slogged up my server
>
>I have found and fixed the problem with the (malformed) messages. Attached
>is a new Message.pm for those of you who just want this update.
>
>I will also release a new beta after lunch, including this change and all
>the other phishing net improvements among other things. I now support RedHat
>Enterprise Server 4 beta 2 as well.
>
>--
>Julian Field
>www.MailScanner.info
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>
>On 18/11/04 9:07 am, "Julian Field" <mailscanner@ecs.soton.ac.uk> wrote:
>
>
>
>>On 18/11/04 8:40 am, "Bruce Rahn" <brahn@woh.rr.com> wrote:
>>
>>
>>>Greg Deputy wrote:
>>>
>>>
>>>
>>>>Fedora core 2, MailScanner 4.35.9, Postfix 2.1.5.  Phishing detection
>>>>turned on.  Currently acting as a gateway (no mail on server, all gets
>>>>scanned and passed on to another server for delivery) for about 500 mail
>>>>boxes on 100 hosted domains.
>>>>
>>>>Today I was looking at my mailscanner-mrtg page
>>>>(http://mx.blastzone.com/mailscanner-mrtg) and noticed that at around
>>>>1:30 am the CPU pegged on the box.  I spent some time trying to figure
>>>>out why, looking at the logs for a DOS attack or some evidence that the
>>>>box had been compromised, but found nothing.
>>>>
>>>>What I eventually figured out was Mailscanner seemed to be hitting the
>>>>same mail in the postfix hold queue over and over again.  It would hit
>>>>the mail, and apparently restart.  It would seem to hit the queue,
>>>>process a few messages, hit one, and then choke, restart.  It also
>>>>caused the CPU to be a lot more active (85% +) than it normally is
>>>>(~25%).
>>>>
>>>>I believe it was dying in the phishing detector logic for 2 reasons.
>>>>One, I kept seeing the same phishing detection over and over again in
>>>>the logs.  Two, I turned off the phishing detection in MailScanner.conf,
>>>>restarted MailScanner, and the queue cleared out and CPU dropped back to
>>>>normal.
>>>>
>>>>
>>>>
>>>>
>>>>
>>>[stuff deleted]
>>>
>>>
>>>
>>>>Nov 17 09:01:05 mx MailScanner[32483]: Found phishing fraud attack from
>>>>http://www.otcbb.com/asp/quote_module.asp?symbol=MTDN</a>
>>>>Nov 17 09:01:05 mx MailScanner[32483]: <br><br>
>>>>Nov 17 09:01:05 mx MailScanner[32483]: Big year expected in 2005 for
>>>>Motion DNA<br>
>>>>Nov 17 09:01:05 mx MailScanner[32483]:   <br>
>>>>Nov 17 09:01:05 mx MailScanner[32483]: Trading Symbol MTDN<br>
>>>>Nov 17 09:01:05 mx MailScanner[32483]: Current Price (est.) $0.025<br>
>>>>Nov 17 09:01:05 mx MailScanner[32483]: Valued Price (est.) $1.00<br><br>
>>>>
>>>>
>>>>
>>>>
>>>I had the exact same thing happen today on what looks like the exact
>>>same SPAM message.  It was looping over, and over, and over again.
>>>
>>>Something about that message MailScanner didn't like.
>>>
>>>
>>In which case can someone send me a copy of the message please? Don't mind
>>much what format, I can handle most things.
>>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Thu Nov 18 21:12:59 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:38 2006
Subject: MIME-Base64 package problems ...
Message-ID: <mailman.4877.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

The package build accidentally left a bunch of temporary files in
/var/tmp. You can ignore them. The installation under
/usr/lib/MailScanner/utils is entirely intentional. This is to work
round some very nasty interactions between perl and rpm.

I will get rid of the temporary files before the next stable release.

paddy wrote:

>Julian,
>
>Hi, I'm just installing 4.35.11.  Straight away I noticed
>the new package name 'MailScanner-perl-MIME-Base64' (yes, I've not been
>paying attention awhile).
>
>When I built it and rpm -qlp it I see
>
>  /usr/lib/MailScanner/utils/
>
>and then again
>
>  /var/tmp/MailScanner-perl-MIME-Base64-3.05-root/usr/lib/MailScanner/utils
>
>each with the expected hierarchy under it.
>
>Straight away I say to myself "what was that show where they used to
>say 'now that was not supposed to happen'".
>
>I've looked around for docs on why the move, and grepped the list, but
>I seem to be missing the vital intel.  I'm guessing this helps with some
>installation problem somewhere.  Should MailScanner work happily with
>a MIME-Base64-3.05 installed from an rpm built with the spec for 3.00
>that you shipped (much more vanilla), as I have built that and
>rpm --test -Uvh seems happy, or is MailScanner now looking for MIME::Base64
>only in this 'non-standard' place (I'd imagine you just gave that place
>priority in an @INC somewhere), or is there some subtle breakage in
>this way of installing things ... (and so on ...)
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Steve.Swaney at FSL.COM  Thu Nov 18 21:35:49 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:38 2006
Subject: whitelisting by connection tracking
Message-ID: <mailman.4878.1137101258.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of paddy
> Sent: Thursday, November 18, 2004 4:07 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: whitelisting by connection tracking
>
> Hi,
>
> I've been asked to implement a specific feature:
>
>   When we relay outgoing mail for a client we are to track the recipients
>   and then, essentially, whitelist those recipients for return mail.
>
> This seems like a reasonable and simple idea, and yet I'm having trouble
> tracking down any other mention of it.  I figure this indicates some or
> all of the following
>
> 1. I'm not looking very hard (okay, true ...)
> 2. It's a deeply flawed idea
>
> ... you get the idea.
>
> So if anyone can point me at existing implementations of this kind of
> thing
> or cares to point out complexities I may yet have overlooked, I'd be
> overjoyed.
>

If you're using sendmail, you might look at milter-sender. It's pretty
configurable and I think you might be able to turn off all of the blocking
features except:

# White list recipients of a local sender for future replies.

WhiteListFutureSender=1

At least it maight be a start :)

Steve
Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Glenn.Steen at AP1.SE  Thu Nov 18 21:47:19 2004
From: Glenn.Steen at AP1.SE (Steen, Glenn)
Date: Thu Jan 12 21:27:38 2006
Subject: Postfix, mailwatch and queue IDs (and  of course mailscanner:-)
Message-ID: <mailman.4879.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "Windows-1252" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi Steve (and Julian, a bit further down),

As can be seen in the mailwatch-users list archive links you snipped in your reply, I already did that... Further one could see that Steve F (and lil' ol' me) had reached the conclusion that it'd be rather messy to fix this in MailWatch. My reason for asking here was solely because I (after looking at the code briefly) had a hope that it'd be easier to fix in MailScanner... Which Julians very elegant patch shows is possible;-).

Julian, I couldn't help myself... It's in production already, working splendidly (yeah, I missed the commuter train by a hair (Saw it fade into the distance, me still on the platform (breathing heavily from the sprint (And yes, I still have my skin attached, wife's just a bit miffed (setq 'wow-this-looks-like-lisp)))))... We'll see over the next couple of days how it holds up.
The best thing with it is that it's not MailWatch-centric (all "tools" would benefit from it), and is completely transparent to MailWatch.
I was hoping it'd be this simple, but hadn't worked my way through the "requeue bit" yet...:-)

Should perhaps go into the beta? I can see no real drawbacks with it.

Again, many thanks.

-- Glenn

-----Original Message-----
From:   MailScanner mailing list on behalf of Steve Swaney
Sent:   to 2004-11-18 18:52
To:     MAILSCANNER@JISCMAIL.AC.UK
Cc:	
Subject:        Re: Postfix, mailwatch and queue IDs (and  of course mailscanner:-)
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Steen, Glenn
> Sent: Thursday, November 18, 2004 11:52 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Postfix, mailwatch and queue IDs (and of course mailscanner:-
> )
>
> Hi all...
>
> I gather from the gigantic shrug I'm getting here (how else to interpret
> ... silence:-) that noone has a good handle on how to "improve" the
> situation regarding duplicates in sql-logs (and possible quarantine
> corruption) when using some such log feature with MS, due to postfix
> reusing queue IDs (the quarantine is in danger when using systems like
> MailWatch, which will not preserve the queue file inode (number)...
> Sure, it's a slim window, but it could happen).
>
> One could of course try to "work around" this in the "logging subsytem"
> (MailWatch in my case), but.. I dunno, it feels like it's better to do
> closer to the source:-).
>
> Why not ask the postfix people to "fix it"? Well, I'm guessing one will
> get even less response (if that's possible:-) from then, and then
> probably just a pointer to amavisd-new.
>
> Sure, for MailScanner it's not a central problem, but... Well, my PHB
> likes what he can see in MW (that's what sold him on MS...:), and when
> he starts to see the duplicates on a more ... regular basis... Suffice
> it to say that it gets to be my problem then:-).
>
> Or has this been discussed in depth already? I couldn't find mention of
> it in the list archive...
>
> Any feedback would be welcome.

Have you checked the MailWatch mail list and Archives? Start at:

http://mailwatch.sourceforge.net/

You might post this question there after checking the MailWatch Archives.

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Thu Nov 18 21:57:35 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:38 2006
Subject: Postfix, mailwatch and queue IDs (and  of course mailscanner:-)
Message-ID: <mailman.4880.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "windows-1252" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Steen, Glenn wrote:

>Julian, I couldn't help myself... It's in production already, working splendidly (yeah, I missed the commuter train by a hair (Saw it fade into the distance, me still on the platform (breathing heavily from the sprint (And yes, I still have my skin attached, wife's just a bit miffed (setq 'wow-this-looks-like-lisp)))))... We'll see over the next couple of days how it holds up.
>The best thing with it is that it's not MailWatch-centric (all "tools" would benefit from it), and is completely transparent to MailWatch.
>I was hoping it'd be this simple, but hadn't worked my way through the "requeue bit" yet...:-)
>
>Should perhaps go into the beta? I can see no real drawbacks with it.
>
>
Let's leave it running for a few days first. If it behaves itself (which
it should) then it will go in the main distribution, as it is A Good
Thing(tm). As you say it is transparent to MailWatch, then if it works
at all it should be fine.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at CPYOU.COM  Fri Nov 19 01:33:59 2004
From: mailscanner at CPYOU.COM (J. Bishop)
Date: Thu Jan 12 21:27:38 2006
Subject: specs & platform for new server
Message-ID: <mailman.4881.1137101258.24926.mailscanner@lists.mailscanner.info>

Since reading this and other related threads of late, I have to revisit my
server design guidelines.  I administrate 5 production MailScanner based
email servers processing a total of 80-100k messages per day.  I was
recently asked to design and possibly build a spam/virus filtering solution
to easily support up to 2 million messages per day.

I remember seeing guidelines (from Julian himself I believe) on this list
and in the FAQ mentioning to design MailScanner running on decent hardware
for approximately 50,000 messages per day.  Now that I read the suggestions
and the FAQ again, I see that people are saying a well tuned solution
should be capable of 1 million...

Most of my email servers (2-3 year old P3 and P4's typically) have periods
of increased load even when processing a measley 20-30k messages per day, I
doubt that the effective throughput difference makes the system scale to a
million (thats why I am asking you folks).  I have seen less load with
recent versions of MS and SA but not to that degree.

For the first time ever I have a nearly unlimited design budget for this
project (but I might not get to build it for other reasons) and am
wondering a few things.  I was initially thinking of using a quad Opteron
system with 4 gigs of ram and 8 disks in raid 10 based on the benchmarks I
am seeing.  Since the solution has to be completely redundant I would need
at least 2 of these boxes...  I assume from the new comments that 2 of
these should have no problems handling more than 2 million messages per day.

Alternately I would use 4 or 6 smaller dual Xeon Nocona or 2xx series
Opteron servers with 2 GB ram and 4 disks in raid 10 each.  I assume this
would give greater CPU and I/O per email request at a lower cost.  Would 6
of these handle the expected peak loads?

Also, should I use the Linux High Availability project to direct SMTP
requests evenly across all or should I simply load balance using (even or
odd) weighted MX records in DNS?  I guess the LHA solution would require an
extra 2 small servers acting as external facing TCP port 25 directors and 2
high I/O systems acting as internal central mailbox repository servers
which drives up the cost/complexity.

The solution I have proposed is the standard Sendmail, Procmail,
MailScanner, Spamassassin, a list of RBLs, DCC, Vipuls Razor, Pyzor, ClamAV
with at least 2 other commercial virus scanners running on RHEL.

Thanks again for a fine product Julian...

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From cl.yeo at FTDTECH.COM  Fri Nov 19 07:20:06 2004
From: cl.yeo at FTDTECH.COM (Yeo Chit Loong)
Date: Thu Jan 12 21:27:38 2006
Subject: I'm lost: Virus: keyword in ruleset - is this a limitation?
Message-ID: <mailman.4882.1137101258.24926.mailscanner@lists.mailscanner.info>


(Apologies for sending this to announce list previously)
Hi everyone,

I like to know if there are any more references to the usage of the
keyword "Virus:" in rulesets?

**What I have done:
I've done searches on google, the archives and mailinglist and whatever
FAQ (even several foreign language forums) for the past 10 hours.

But most of the examples are concentrated on filtering by domain and/or
regexs.
the EXAMPLES file only shows Virus: <virus name> <yes | no >

I think I've actually missed out the documents on the ruleset syntax, but
I've figured out it's something as follows:
<ruletype>: <domain | virusname | default> < yes | no | address >

Please correct me if I'm wrong.


**What I want to do:
For example, I want to MS to send me notices if it is a virus infection
(some virus) and not events like "Bad Filename",

At the same time, I like another person to receive "Other bad content
detected" notices and another list of virus.

In other words:
1) if virus "virus" detected - email to account1
2) emails with "bad filename" errors - > /dev/null  ELSE email to
account1
3) if virus "anothervirus" detected - email to account2

Is this a limitation of MS or am I missing out something here?

Thanks!

Best regards,
Yeo Chit Loong
MIS - Systems Administrator
(mcse/sa,ccna)



------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From p.g.m.peters at utwente.nl  Fri Nov 19 07:58:46 2004
From: p.g.m.peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:27:38 2006
Subject: specs & platform for new server
Message-ID: <mailman.4883.1137101258.24926.mailscanner@lists.mailscanner.info>

On Thu, 18 Nov 2004 15:38:07 +0000, you wrote:

>Thanks Martin and all the others. We are now leaning on your side: two
>smaller boxes. Load balancing, resilience and no more down-time sound
>good. And if we have two boxes, we don't see the need for RAID or
>redundant power supplies, etc. And we only need next day on-site service
>& support, don't we? Two boxes for the price of one looks like a great
>idea. The only downside is two boxes to configure instead of one.

The problem is not configuring the boxes but the installation of the OS
and later on the patching. I maintain three identical (in respect to
MailScanner) systems and use some scripts to update the other two. At
this moment I use one for configuration (and testing) and then copy all
configuration files over to the other systems. Depending on the need I
reload the configurations or let MS handle that in the 4 hour reload.

Two of the systems are on site and the third is on an other network. So
in case of an outage we still accept e-mail with full addresscheck and
MS capabilities.

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/itbe

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Fri Nov 19 09:12:15 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:38 2006
Subject: specs & platform for new server
Message-ID: <mailman.4884.1137101258.24926.mailscanner@lists.mailscanner.info>

Hi

A few off the top og my head thoughts....


the less number of physical boxes the better (keep it simple!), but
don't forget scalability.

If you load balance via DNS then both hosts will need to same MX value,
otherwise the one with the lowest value will *always* get the traffic.

As to LHA vs a simple pair, it depends on what the requirements for
archiving/releasing/bayes are. if you want a shared bayes you're prob
better looking at a mysql rather than Berkley DB implementation, and
then you need to decide where to put the mysql server (another system,
maybe two small clustered machines??)....then what do you do with
archiving email. the S-OX act may have implications here..

Before deciding on the architecure look at all the requirements, then
you cam biuld the system around the requirements. Don't forget legal
stuff like S-OX, disaster recovery, maintenance (patching, hardware
fixes), and uptime requirements. Don't forget, power, air con and
weight/space required/contraints of the new system.

Also if possible allow for double the amount of actual traffic now and
have a growth plan, so you don't have to rebuild the whole thing in 12
months!

Maybe look at some of the nice blade systems you can get today, esp
where they have auto-updating of boot images etc. It's not just the nice
hardware look at the management software as well.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


J. Bishop wrote:
> Since reading this and other related threads of late, I have to revisit my
> server design guidelines.  I administrate 5 production MailScanner based
> email servers processing a total of 80-100k messages per day.  I was
> recently asked to design and possibly build a spam/virus filtering solution
> to easily support up to 2 million messages per day.
>
> I remember seeing guidelines (from Julian himself I believe) on this list
> and in the FAQ mentioning to design MailScanner running on decent hardware
> for approximately 50,000 messages per day.  Now that I read the suggestions
> and the FAQ again, I see that people are saying a well tuned solution
> should be capable of 1 million...
>
> Most of my email servers (2-3 year old P3 and P4's typically) have periods
> of increased load even when processing a measley 20-30k messages per day, I
> doubt that the effective throughput difference makes the system scale to a
> million (thats why I am asking you folks).  I have seen less load with
> recent versions of MS and SA but not to that degree.
>
> For the first time ever I have a nearly unlimited design budget for this
> project (but I might not get to build it for other reasons) and am
> wondering a few things.  I was initially thinking of using a quad Opteron
> system with 4 gigs of ram and 8 disks in raid 10 based on the benchmarks I
> am seeing.  Since the solution has to be completely redundant I would need
> at least 2 of these boxes...  I assume from the new comments that 2 of
> these should have no problems handling more than 2 million messages per day.
>
> Alternately I would use 4 or 6 smaller dual Xeon Nocona or 2xx series
> Opteron servers with 2 GB ram and 4 disks in raid 10 each.  I assume this
> would give greater CPU and I/O per email request at a lower cost.  Would 6
> of these handle the expected peak loads?
>
> Also, should I use the Linux High Availability project to direct SMTP
> requests evenly across all or should I simply load balance using (even or
> odd) weighted MX records in DNS?  I guess the LHA solution would require an
> extra 2 small servers acting as external facing TCP port 25 directors and 2
> high I/O systems acting as internal central mailbox repository servers
> which drives up the cost/complexity.
>
> The solution I have proposed is the standard Sendmail, Procmail,
> MailScanner, Spamassassin, a list of RBLs, DCC, Vipuls Razor, Pyzor, ClamAV
> with at least 2 other commercial virus scanners running on RHEL.
>
> Thanks again for a fine product Julian...
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From sylvain.phaneuf at IMSU.OXFORD.AC.UK  Fri Nov 19 09:29:39 2004
From: sylvain.phaneuf at IMSU.OXFORD.AC.UK (Sylvain Phaneuf)
Date: Thu Jan 12 21:27:38 2006
Subject: specs & platform for new server
Message-ID: <mailman.4885.1137101258.24926.mailscanner@lists.mailscanner.info>

I think the number of messages a system can process is slightly besides
the point. The size of the messages is surely an important factor,
especially when the system runs anti-virus checks.

Far from being a Unix expert, I have asked advice from expert
colleagues for tuning our current server (P3, 1.4 GHZ cpu, 1 GB RAM,
RAID 1), and we have followed the suggestions given on the FAQ and MAQ.
Processing 35k messages a day gives us several periods of load > 12. For
about 5 or 6 hours during the day we receive nearly 100 messages per
minute, the average size being 30 to 40 KB. I have difficulties seing
that our system should be able to handle 1 million messages per day as
suggested by some.

Sylvain


>>> mailscanner@CPYOU.COM 19/11/2004 01:33:59 >>>
Since reading this and other related threads of late, I have to revisit
my
server design guidelines.  I administrate 5 production MailScanner
based
email servers processing a total of 80-100k messages per day.  I was
recently asked to design and possibly build a spam/virus filtering
solution
to easily support up to 2 million messages per day.

I remember seeing guidelines (from Julian himself I believe) on this
list
and in the FAQ mentioning to design MailScanner running on decent
hardware
for approximately 50,000 messages per day.  Now that I read the
suggestions
and the FAQ again, I see that people are saying a well tuned solution
should be capable of 1 million...

Most of my email servers (2-3 year old P3 and P4's typically) have
periods
of increased load even when processing a measley 20-30k messages per
day, I
doubt that the effective throughput difference makes the system scale
to a
million (thats why I am asking you folks).  I have seen less load with
recent versions of MS and SA but not to that degree.

For the first time ever I have a nearly unlimited design budget for
this
project (but I might not get to build it for other reasons) and am
wondering a few things.  I was initially thinking of using a quad
Opteron
system with 4 gigs of ram and 8 disks in raid 10 based on the
benchmarks I
am seeing.  Since the solution has to be completely redundant I would
need
at least 2 of these boxes...  I assume from the new comments that 2 of
these should have no problems handling more than 2 million messages per
day.

Alternately I would use 4 or 6 smaller dual Xeon Nocona or 2xx series
Opteron servers with 2 GB ram and 4 disks in raid 10 each.  I assume
this
would give greater CPU and I/O per email request at a lower cost.
Would 6
of these handle the expected peak loads?

Also, should I use the Linux High Availability project to direct SMTP
requests evenly across all or should I simply load balance using (even
or
odd) weighted MX records in DNS?  I guess the LHA solution would
require an
extra 2 small servers acting as external facing TCP port 25 directors
and 2
high I/O systems acting as internal central mailbox repository servers
which drives up the cost/complexity.

The solution I have proposed is the standard Sendmail, Procmail,
MailScanner, Spamassassin, a list of RBLs, DCC, Vipuls Razor, Pyzor,
ClamAV
with at least 2 other commercial virus scanners running on RHEL.

Thanks again for a fine product Julian...

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Fri Nov 19 09:46:23 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:38 2006
Subject: specs & platform for new server
Message-ID: <mailman.4886.1137101258.24926.mailscanner@lists.mailscanner.info>

You have raised one interesting point: MailScanner will happily drive your
system's load average up through the roof. Most of these will be processes
awaiting network response. A load average of 10 or 12 doesn't really mean
anything. What counts is the size of message batches that are being
processed. If the batches are small then you have nothing to worry about. If
the batches start approaching 30 regularly, then you should look into more
powerful hardware and better network setup.

Don't think your system is being hammered because it reports a load average
over 10 most of the time. That is MailScanner working your box very hard!

On 19/11/04 9:29 am, "Sylvain Phaneuf" <sylvain.phaneuf@IMSU.OXFORD.AC.UK>
wrote:

> I think the number of messages a system can process is slightly besides
> the point. The size of the messages is surely an important factor,
> especially when the system runs anti-virus checks.
>
> Far from being a Unix expert, I have asked advice from expert
> colleagues for tuning our current server (P3, 1.4 GHZ cpu, 1 GB RAM,
> RAID 1), and we have followed the suggestions given on the FAQ and MAQ.
> Processing 35k messages a day gives us several periods of load > 12. For
> about 5 or 6 hours during the day we receive nearly 100 messages per
> minute, the average size being 30 to 40 KB. I have difficulties seing
> that our system should be able to handle 1 million messages per day as
> suggested by some.
>
> Sylvain
>
>
>>>> mailscanner@CPYOU.COM 19/11/2004 01:33:59 >>>
> Since reading this and other related threads of late, I have to revisit
> my
> server design guidelines.  I administrate 5 production MailScanner
> based
> email servers processing a total of 80-100k messages per day.  I was
> recently asked to design and possibly build a spam/virus filtering
> solution
> to easily support up to 2 million messages per day.
>
> I remember seeing guidelines (from Julian himself I believe) on this
> list
> and in the FAQ mentioning to design MailScanner running on decent
> hardware
> for approximately 50,000 messages per day.  Now that I read the
> suggestions
> and the FAQ again, I see that people are saying a well tuned solution
> should be capable of 1 million...
>
> Most of my email servers (2-3 year old P3 and P4's typically) have
> periods
> of increased load even when processing a measley 20-30k messages per
> day, I
> doubt that the effective throughput difference makes the system scale
> to a
> million (thats why I am asking you folks).  I have seen less load with
> recent versions of MS and SA but not to that degree.
>
> For the first time ever I have a nearly unlimited design budget for
> this
> project (but I might not get to build it for other reasons) and am
> wondering a few things.  I was initially thinking of using a quad
> Opteron
> system with 4 gigs of ram and 8 disks in raid 10 based on the
> benchmarks I
> am seeing.  Since the solution has to be completely redundant I would
> need
> at least 2 of these boxes...  I assume from the new comments that 2 of
> these should have no problems handling more than 2 million messages per
> day.
>
> Alternately I would use 4 or 6 smaller dual Xeon Nocona or 2xx series
> Opteron servers with 2 GB ram and 4 disks in raid 10 each.  I assume
> this
> would give greater CPU and I/O per email request at a lower cost.
> Would 6
> of these handle the expected peak loads?
>
> Also, should I use the Linux High Availability project to direct SMTP
> requests evenly across all or should I simply load balance using (even
> or
> odd) weighted MX records in DNS?  I guess the LHA solution would
> require an
> extra 2 small servers acting as external facing TCP port 25 directors
> and 2
> high I/O systems acting as internal central mailbox repository servers
> which drives up the cost/complexity.
>
> The solution I have proposed is the standard Sendmail, Procmail,
> MailScanner, Spamassassin, a list of RBLs, DCC, Vipuls Razor, Pyzor,
> ClamAV
> with at least 2 other commercial virus scanners running on RHEL.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Fri Nov 19 09:48:12 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:38 2006
Subject: specs & platform for new server
Message-ID: <mailman.4887.1137101258.24926.mailscanner@lists.mailscanner.info>

Sylvain

depending on the amount of SA tests you're doing I'd suggest you're
maxing out that server. why a load of 12, how many MS children are you
calling???

Also are you still using any of the bigevil.cf style SA rules. If you
are then move off to the surbl.org URI rbl's instead.

If you want to take this off list  drop me line.. I'm only just up the
road in Begbroke..

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Sylvain Phaneuf wrote:
> I think the number of messages a system can process is slightly besides
> the point. The size of the messages is surely an important factor,
> especially when the system runs anti-virus checks.
>
> Far from being a Unix expert, I have asked advice from expert
> colleagues for tuning our current server (P3, 1.4 GHZ cpu, 1 GB RAM,
> RAID 1), and we have followed the suggestions given on the FAQ and MAQ.
> Processing 35k messages a day gives us several periods of load > 12. For
> about 5 or 6 hours during the day we receive nearly 100 messages per
> minute, the average size being 30 to 40 KB. I have difficulties seing
> that our system should be able to handle 1 million messages per day as
> suggested by some.
>
> Sylvain
>
>
>
>>>>mailscanner@CPYOU.COM 19/11/2004 01:33:59 >>>
>
> Since reading this and other related threads of late, I have to revisit
> my
> server design guidelines.  I administrate 5 production MailScanner
> based
> email servers processing a total of 80-100k messages per day.  I was
> recently asked to design and possibly build a spam/virus filtering
> solution
> to easily support up to 2 million messages per day.
>
> I remember seeing guidelines (from Julian himself I believe) on this
> list
> and in the FAQ mentioning to design MailScanner running on decent
> hardware
> for approximately 50,000 messages per day.  Now that I read the
> suggestions
> and the FAQ again, I see that people are saying a well tuned solution
> should be capable of 1 million...
>
> Most of my email servers (2-3 year old P3 and P4's typically) have
> periods
> of increased load even when processing a measley 20-30k messages per
> day, I
> doubt that the effective throughput difference makes the system scale
> to a
> million (thats why I am asking you folks).  I have seen less load with
> recent versions of MS and SA but not to that degree.
>
> For the first time ever I have a nearly unlimited design budget for
> this
> project (but I might not get to build it for other reasons) and am
> wondering a few things.  I was initially thinking of using a quad
> Opteron
> system with 4 gigs of ram and 8 disks in raid 10 based on the
> benchmarks I
> am seeing.  Since the solution has to be completely redundant I would
> need
> at least 2 of these boxes...  I assume from the new comments that 2 of
> these should have no problems handling more than 2 million messages per
> day.
>
> Alternately I would use 4 or 6 smaller dual Xeon Nocona or 2xx series
> Opteron servers with 2 GB ram and 4 disks in raid 10 each.  I assume
> this
> would give greater CPU and I/O per email request at a lower cost.
> Would 6
> of these handle the expected peak loads?
>
> Also, should I use the Linux High Availability project to direct SMTP
> requests evenly across all or should I simply load balance using (even
> or
> odd) weighted MX records in DNS?  I guess the LHA solution would
> require an
> extra 2 small servers acting as external facing TCP port 25 directors
> and 2
> high I/O systems acting as internal central mailbox repository servers
> which drives up the cost/complexity.
>
> The solution I have proposed is the standard Sendmail, Procmail,
> MailScanner, Spamassassin, a list of RBLs, DCC, Vipuls Razor, Pyzor,
> ClamAV
> with at least 2 other commercial virus scanners running on RHEL.
>
> Thanks again for a fine product Julian...
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From h.goebel at GOEBEL-CONSULT.DE  Fri Nov 19 09:56:35 2004
From: h.goebel at GOEBEL-CONSULT.DE (Hartmut Goebel)
Date: Thu Jan 12 21:27:38 2006
Subject: 'DoD detected!' prohibits mailprocessing
Message-ID: <mailman.4888.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi,

on one of the systems I'm in charage off, I get 'Denial Of Service 
detected!' messages in the mail-log. Unfortunatly this seams to prohibit 
all otehr MailScanning.

How can I find out, what the reason for this DoD is?

I already increased the "Virus Scanning Timeout" to 10 Minutes, but this 
does not help. I also radically reduced 'Max Unsafe' and 'Max Unscanned 
Bytes per Scan'. No change, except of smaller batches.

For me it does not look like MailScanner is scanning other messages 
then. But I'm not sure. There is no log-entry about this, neither about 
the files causing the DoD. MailScanner just says 'Scanner timed out' and 
'Denial Of Service detected!', but nothing about new batches. When I 
look at 'ps ax', I see that the Virus Scanner is started again (new 
process ID), but nothing happens.

How can I find out what happens here?
How can I make MailScanner scan and deliver other messages, esp. the 
small ones first?

Thanks in advance for any help!

-- 
Schönen Gruß - Regards
Hartmut Goebel

| Hartmut Goebel             | IT-Security -- effizient |
| h.goebel@goebel-consult.de | www.goebel-consult.de    |

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Fri Nov 19 10:11:16 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:38 2006
Subject: 'DoD detected!' prohibits mailprocessing
Message-ID: <mailman.4889.1137101258.24926.mailscanner@lists.mailscanner.info>

Start by running the virus scanner by hand. Why has it suddenly started
doing this? Are there any particular messages in the incoming queue which
have been sitting there for a long time? You may have hit some problem with
the virus scanner.

To help you more, we are going to need a whole lot more information...

Once you get this sorted, if you have a large incoming queue then
MailScanner will automatically switch into "emergency queue-clearing mode"
which stops it doing loads of directory traversals and should clear the
backlog quite happily.

On 19/11/04 9:56 am, "Hartmut Goebel" <h.goebel@GOEBEL-CONSULT.DE> wrote:
> on one of the systems I'm in charage off, I get 'Denial Of Service
> detected!' messages in the mail-log. Unfortunatly this seams to prohibit
> all otehr MailScanning.
>
> How can I find out, what the reason for this DoD is?
>
> I already increased the "Virus Scanning Timeout" to 10 Minutes, but this
> does not help. I also radically reduced 'Max Unsafe' and 'Max Unscanned
> Bytes per Scan'. No change, except of smaller batches.
>
> For me it does not look like MailScanner is scanning other messages
> then. But I'm not sure. There is no log-entry about this, neither about
> the files causing the DoD. MailScanner just says 'Scanner timed out' and
> 'Denial Of Service detected!', but nothing about new batches. When I
> look at 'ps ax', I see that the Virus Scanner is started again (new
> process ID), but nothing happens.
>
> How can I find out what happens here?
> How can I make MailScanner scan and deliver other messages, esp. the
> small ones first?

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From paddy at PANICI.NET  Fri Nov 19 12:37:51 2004
From: paddy at PANICI.NET (paddy)
Date: Thu Jan 12 21:27:38 2006
Subject: whitelisting by connection tracking
Message-ID: <mailman.4890.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Thu, Nov 18, 2004 at 04:35:49PM -0500, Steve Swaney wrote:
> 
> If you're using sendmail, you might look at milter-sender. It's pretty
> configurable and I think you might be able to turn off all of the blocking
> features except:
> 
> # White list recipients of a local sender for future replies.
> 
> WhiteListFutureSender=1
> 
> At least it maight be a start :)
> 
> Steve
> Steve Swaney
> President
> Fortress Systems Ltd.
> www.fsl.com
> steve.swaney@fsl.com

Steve,

Thanks, that's just the sort of thing I'm looking for.  Does any amount of
other groovy stuff too, this feature seems to be just incidental.

I'm particularly impressed by author's credentials:

  WINNER!! « Best Abuse of Guidelines » in the International Obfuscated C Code Contest 2004

That's cool!

Regards,
Paddy
-- 
Perl 6 will give you the big knob. -- Larry Wall

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From sylvain.phaneuf at IMSU.OXFORD.AC.UK  Fri Nov 19 12:39:52 2004
From: sylvain.phaneuf at IMSU.OXFORD.AC.UK (Sylvain Phaneuf)
Date: Thu Jan 12 21:27:38 2006
Subject: specs & platform for new server
Message-ID: <mailman.4891.1137101258.24926.mailscanner@lists.mailscanner.info>

I see your point and I don't mind the server being very busy. The only
problem is that we have left the default setting "reject MTA connections
when load is >12". So when our ISP realises that we don't accept their
messages, our messages are put on their "wait 15 min" queue. Should I
change the setting to much bigger nmbers?

Sylvain



>>> mailscanner@ECS.SOTON.AC.UK 19/11/2004 09:46:23 >>>
You have raised one interesting point: MailScanner will happily drive
your
system's load average up through the roof. Most of these will be
processes
awaiting network response. A load average of 10 or 12 doesn't really
mean
anything. What counts is the size of message batches that are being
processed. If the batches are small then you have nothing to worry
about. If
the batches start approaching 30 regularly, then you should look into
more
powerful hardware and better network setup.

Don't think your system is being hammered because it reports a load
average
over 10 most of the time. That is MailScanner working your box very
hard!

On 19/11/04 9:29 am, "Sylvain Phaneuf"
<sylvain.phaneuf@IMSU.OXFORD.AC.UK>
wrote:

> I think the number of messages a system can process is slightly
besides
> the point. The size of the messages is surely an important factor,
> especially when the system runs anti-virus checks.
>
> Far from being a Unix expert, I have asked advice from expert
> colleagues for tuning our current server (P3, 1.4 GHZ cpu, 1 GB RAM,
> RAID 1), and we have followed the suggestions given on the FAQ and
MAQ.
> Processing 35k messages a day gives us several periods of load > 12.
For
> about 5 or 6 hours during the day we receive nearly 100 messages per
> minute, the average size being 30 to 40 KB. I have difficulties
seing
> that our system should be able to handle 1 million messages per day
as
> suggested by some.
>
> Sylvain
>
>
>>>> mailscanner@CPYOU.COM 19/11/2004 01:33:59 >>>
> Since reading this and other related threads of late, I have to
revisit
> my
> server design guidelines.  I administrate 5 production MailScanner
> based
> email servers processing a total of 80-100k messages per day.  I was
> recently asked to design and possibly build a spam/virus filtering
> solution
> to easily support up to 2 million messages per day.
>
> I remember seeing guidelines (from Julian himself I believe) on this
> list
> and in the FAQ mentioning to design MailScanner running on decent
> hardware
> for approximately 50,000 messages per day.  Now that I read the
> suggestions
> and the FAQ again, I see that people are saying a well tuned
solution
> should be capable of 1 million...
>
> Most of my email servers (2-3 year old P3 and P4's typically) have
> periods
> of increased load even when processing a measley 20-30k messages per
> day, I
> doubt that the effective throughput difference makes the system
scale
> to a
> million (thats why I am asking you folks).  I have seen less load
with
> recent versions of MS and SA but not to that degree.
>
> For the first time ever I have a nearly unlimited design budget for
> this
> project (but I might not get to build it for other reasons) and am
> wondering a few things.  I was initially thinking of using a quad
> Opteron
> system with 4 gigs of ram and 8 disks in raid 10 based on the
> benchmarks I
> am seeing.  Since the solution has to be completely redundant I
would
> need
> at least 2 of these boxes...  I assume from the new comments that 2
of
> these should have no problems handling more than 2 million messages
per
> day.
>
> Alternately I would use 4 or 6 smaller dual Xeon Nocona or 2xx
series
> Opteron servers with 2 GB ram and 4 disks in raid 10 each.  I assume
> this
> would give greater CPU and I/O per email request at a lower cost.
> Would 6
> of these handle the expected peak loads?
>
> Also, should I use the Linux High Availability project to direct
SMTP
> requests evenly across all or should I simply load balance using
(even
> or
> odd) weighted MX records in DNS?  I guess the LHA solution would
> require an
> extra 2 small servers acting as external facing TCP port 25
directors
> and 2
> high I/O systems acting as internal central mailbox repository
servers
> which drives up the cost/complexity.
>
> The solution I have proposed is the standard Sendmail, Procmail,
> MailScanner, Spamassassin, a list of RBLs, DCC, Vipuls Razor, Pyzor,
> ClamAV
> with at least 2 other commercial virus scanners running on RHEL.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From h.goebel at GOEBEL-CONSULT.DE  Fri Nov 19 12:57:32 2004
From: h.goebel at GOEBEL-CONSULT.DE (Hartmut Goebel)
Date: Thu Jan 12 21:27:38 2006
Subject: 'DoD detected!' prohibits mailprocessing
Message-ID: <mailman.4892.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi,

Okay, we solved the problem. It was the Virus-DB which has not been 
updated correctly. This made the Virus-Scanner hang and thus MailScanner 
to timeout.

Julian Field schrieb:

> Start by running the virus scanner by hand. Why has it suddenly started

This brought us on the right way to solve the problem. Thanks!

-- 
Schönen Gruß - Regards
Hartmut Goebel

| Hartmut Goebel             | IT-Security -- effizient |
| h.goebel@goebel-consult.de | www.goebel-consult.de    |

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From sylvain.phaneuf at IMSU.OXFORD.AC.UK  Fri Nov 19 13:05:00 2004
From: sylvain.phaneuf at IMSU.OXFORD.AC.UK (Sylvain Phaneuf)
Date: Thu Jan 12 21:27:38 2006
Subject: specs & platform for new server
Message-ID: <mailman.4893.1137101258.24926.mailscanner@lists.mailscanner.info>

A few other details I should have given you:

Delivery Method = batch

Max Unscanned Bytes Per Scan = 100000000
Max Unsafe Bytes Per Scan = 50000000
Max Unscanned Messages Per Scan = 30
Max Unsafe Messages Per Scan = 30

Queue Scan Interval = 5   # I want to move the messages as fast as I
can...

Maximum Attachments Per Message = 200

Sylvain


>>> martinh@SOLID-STATE-LOGIC.COM 19/11/2004 09:48:12 >>>
Sylvain

depending on the amount of SA tests you're doing I'd suggest you're
maxing out that server. why a load of 12, how many MS children are you
calling???

Also are you still using any of the bigevil.cf style SA rules. If you
are then move off to the surbl.org URI rbl's instead.

If you want to take this off list  drop me line.. I'm only just up the
road in Begbroke..

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Sylvain Phaneuf wrote:
> I think the number of messages a system can process is slightly
besides
> the point. The size of the messages is surely an important factor,
> especially when the system runs anti-virus checks.
>
> Far from being a Unix expert, I have asked advice from expert
> colleagues for tuning our current server (P3, 1.4 GHZ cpu, 1 GB RAM,
> RAID 1), and we have followed the suggestions given on the FAQ and
MAQ.
> Processing 35k messages a day gives us several periods of load > 12.
For
> about 5 or 6 hours during the day we receive nearly 100 messages per
> minute, the average size being 30 to 40 KB. I have difficulties
seing
> that our system should be able to handle 1 million messages per day
as
> suggested by some.
>
> Sylvain
>
>
>
>>>>mailscanner@CPYOU.COM 19/11/2004 01:33:59 >>>
>
> Since reading this and other related threads of late, I have to
revisit
> my
> server design guidelines.  I administrate 5 production MailScanner
> based
> email servers processing a total of 80-100k messages per day.  I was
> recently asked to design and possibly build a spam/virus filtering
> solution
> to easily support up to 2 million messages per day.
>
> I remember seeing guidelines (from Julian himself I believe) on this
> list
> and in the FAQ mentioning to design MailScanner running on decent
> hardware
> for approximately 50,000 messages per day.  Now that I read the
> suggestions
> and the FAQ again, I see that people are saying a well tuned
solution
> should be capable of 1 million...
>
> Most of my email servers (2-3 year old P3 and P4's typically) have
> periods
> of increased load even when processing a measley 20-30k messages per
> day, I
> doubt that the effective throughput difference makes the system
scale
> to a
> million (thats why I am asking you folks).  I have seen less load
with
> recent versions of MS and SA but not to that degree.
>
> For the first time ever I have a nearly unlimited design budget for
> this
> project (but I might not get to build it for other reasons) and am
> wondering a few things.  I was initially thinking of using a quad
> Opteron
> system with 4 gigs of ram and 8 disks in raid 10 based on the
> benchmarks I
> am seeing.  Since the solution has to be completely redundant I
would
> need
> at least 2 of these boxes...  I assume from the new comments that 2
of
> these should have no problems handling more than 2 million messages
per
> day.
>
> Alternately I would use 4 or 6 smaller dual Xeon Nocona or 2xx
series
> Opteron servers with 2 GB ram and 4 disks in raid 10 each.  I assume
> this
> would give greater CPU and I/O per email request at a lower cost.
> Would 6
> of these handle the expected peak loads?
>
> Also, should I use the Linux High Availability project to direct
SMTP
> requests evenly across all or should I simply load balance using
(even
> or
> odd) weighted MX records in DNS?  I guess the LHA solution would
> require an
> extra 2 small servers acting as external facing TCP port 25
directors
> and 2
> high I/O systems acting as internal central mailbox repository
servers
> which drives up the cost/complexity.
>
> The solution I have proposed is the standard Sendmail, Procmail,
> MailScanner, Spamassassin, a list of RBLs, DCC, Vipuls Razor, Pyzor,
> ClamAV
> with at least 2 other commercial virus scanners running on RHEL.
>
> Thanks again for a fine product Julian...
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From h.goebel at GOEBEL-CONSULT.DE  Fri Nov 19 13:51:43 2004
From: h.goebel at GOEBEL-CONSULT.DE (Hartmut Goebel)
Date: Thu Jan 12 21:27:38 2006
Subject: 'DoD detected!' prohibits mailprocessing
Message-ID: <mailman.4894.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi,

Hartmut Goebel schrieb:

> Okay, we solved the problem. It was the Virus-DB which has not been 

Hallooed to early :-(

We dropped in the quarantined messages to get them processed, and the 
same problem occurs again. But this time, if the virus-scanner get's 
called stand-alone, it works. (This has not been the case earlier.)

Ths logfiles show 5 scanning-processes to be started, all of which start 
a virus-scanner. Scanner TImeout is 5 Minutes, and after these 5 Minutes 
I get 5 'DoS detected' messages. 5 Minutes later the same and so on.

There are no new 'Batch started' messages nor other messages like 'This 
message contined the DoS'.

On this gateway, there is F-Secure running which is installed as 
described by the F-Secure installation manual. 'fsav' will be called 
with '--archive --mime--dumb --archive'. System is a RedHat Linux 9.

Is there a way to find out which messages are currently processed (say: 
which messages cause the DoS)?
What other information do you need for analyzing the problem?

-- 
Schönen Gruß - Regards
Hartmut Goebel

| Hartmut Goebel             | IT-Security -- effizient |
| h.goebel@goebel-consult.de | www.goebel-consult.de    |

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ugob at CAMO-ROUTE.COM  Fri Nov 19 13:42:51 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:38 2006
Subject: specs & platform for new server
Message-ID: <mailman.4895.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Sylvain Phaneuf wrote:
> I see your point and I don't mind the server being very busy. The only
> problem is that we have left the default setting "reject MTA connections
> when load is >12". So when our ISP realises that we don't accept their
> messages, our messages are put on their "wait 15 min" queue. Should I
> change the setting to much bigger nmbers?

What I'd do is push this number a little, then see if the delay for
delivery and other factors (memory usage, swapping, message batch size,
etc.) go bad.  If it is still ok, I'd keep on pushing it up.

>
> Sylvain
>
>
>
>
>>>>mailscanner@ECS.SOTON.AC.UK 19/11/2004 09:46:23 >>>
>
> You have raised one interesting point: MailScanner will happily drive
> your
> system's load average up through the roof. Most of these will be
> processes
> awaiting network response. A load average of 10 or 12 doesn't really
> mean
> anything. What counts is the size of message batches that are being
> processed. If the batches are small then you have nothing to worry
> about. If
> the batches start approaching 30 regularly, then you should look into
> more
> powerful hardware and better network setup.
>
> Don't think your system is being hammered because it reports a load
> average
> over 10 most of the time. That is MailScanner working your box very
> hard!
>
> On 19/11/04 9:29 am, "Sylvain Phaneuf"
> <sylvain.phaneuf@IMSU.OXFORD.AC.UK>
> wrote:
>
>
>>I think the number of messages a system can process is slightly
>
> besides
>
>>the point. The size of the messages is surely an important factor,
>>especially when the system runs anti-virus checks.
>>
>>Far from being a Unix expert, I have asked advice from expert
>>colleagues for tuning our current server (P3, 1.4 GHZ cpu, 1 GB RAM,
>>RAID 1), and we have followed the suggestions given on the FAQ and
>
> MAQ.
>
>>Processing 35k messages a day gives us several periods of load > 12.
>
> For
>
>>about 5 or 6 hours during the day we receive nearly 100 messages per
>>minute, the average size being 30 to 40 KB. I have difficulties
>
> seing
>
>>that our system should be able to handle 1 million messages per day
>
> as
>
>>suggested by some.
>>
>>Sylvain
>>
>>
>>
>>>>>mailscanner@CPYOU.COM 19/11/2004 01:33:59 >>>
>>
>>Since reading this and other related threads of late, I have to
>
> revisit
>
>>my
>>server design guidelines.  I administrate 5 production MailScanner
>>based
>>email servers processing a total of 80-100k messages per day.  I was
>>recently asked to design and possibly build a spam/virus filtering
>>solution
>>to easily support up to 2 million messages per day.
>>
>>I remember seeing guidelines (from Julian himself I believe) on this
>>list
>>and in the FAQ mentioning to design MailScanner running on decent
>>hardware
>>for approximately 50,000 messages per day.  Now that I read the
>>suggestions
>>and the FAQ again, I see that people are saying a well tuned
>
> solution
>
>>should be capable of 1 million...
>>
>>Most of my email servers (2-3 year old P3 and P4's typically) have
>>periods
>>of increased load even when processing a measley 20-30k messages per
>>day, I
>>doubt that the effective throughput difference makes the system
>
> scale
>
>>to a
>>million (thats why I am asking you folks).  I have seen less load
>
> with
>
>>recent versions of MS and SA but not to that degree.
>>
>>For the first time ever I have a nearly unlimited design budget for
>>this
>>project (but I might not get to build it for other reasons) and am
>>wondering a few things.  I was initially thinking of using a quad
>>Opteron
>>system with 4 gigs of ram and 8 disks in raid 10 based on the
>>benchmarks I
>>am seeing.  Since the solution has to be completely redundant I
>
> would
>
>>need
>>at least 2 of these boxes...  I assume from the new comments that 2
>
> of
>
>>these should have no problems handling more than 2 million messages
>
> per
>
>>day.
>>
>>Alternately I would use 4 or 6 smaller dual Xeon Nocona or 2xx
>
> series
>
>>Opteron servers with 2 GB ram and 4 disks in raid 10 each.  I assume
>>this
>>would give greater CPU and I/O per email request at a lower cost.
>>Would 6
>>of these handle the expected peak loads?
>>
>>Also, should I use the Linux High Availability project to direct
>
> SMTP
>
>>requests evenly across all or should I simply load balance using
>
> (even
>
>>or
>>odd) weighted MX records in DNS?  I guess the LHA solution would
>>require an
>>extra 2 small servers acting as external facing TCP port 25
>
> directors
>
>>and 2
>>high I/O systems acting as internal central mailbox repository
>
> servers
>
>>which drives up the cost/complexity.
>>
>>The solution I have proposed is the standard Sendmail, Procmail,
>>MailScanner, Spamassassin, a list of RBLs, DCC, Vipuls Razor, Pyzor,
>>ClamAV
>>with at least 2 other commercial virus scanners running on RHEL.
>
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From michele at BLACKNIGHTSOLUTIONS.COM  Fri Nov 19 13:55:56 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:38 2006
Subject: specs & platform for new server
Message-ID: <mailman.4896.1137101258.24926.mailscanner@lists.mailscanner.info>

> I see your point and I don't mind the server being very busy.
> The only problem is that we have left the default setting
> "reject MTA connections when load is >12". So when our ISP
> realises that we don't accept their messages, our messages
> are put on their "wait 15 min" queue. Should I change the
> setting to much bigger nmbers?

The default setting is for "normal" use, so you should definitely increase
it, otherwise you'll end up in mail hell :)


Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
http://www.blacknight.ie/specialoffers.html

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ugob at CAMO-ROUTE.COM  Fri Nov 19 13:43:41 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:38 2006
Subject: specs & platform for new server
Message-ID: <mailman.4897.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian Field wrote:
> You have raised one interesting point: MailScanner will happily drive your
> system's load average up through the roof. Most of these will be processes
> awaiting network response. A load average of 10 or 12 doesn't really mean
> anything. What counts is the size of message batches that are being
> processed. If the batches are small then you have nothing to worry about. If
> the batches start approaching 30 regularly, then you should look into more
> powerful hardware and better network setup.
>
> Don't think your system is being hammered because it reports a load average
> over 10 most of the time. That is MailScanner working your box very hard!

What was the load average on the system that processed 1.5 millions
message/day, Julian?

Ugo

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From alex at nkpanama.com  Fri Nov 19 14:22:21 2004
From: alex at nkpanama.com (Alex Neuman van der Hans)
Date: Thu Jan 12 21:27:38 2006
Subject: 'DoD detected!' prohibits mailprocessing
Message-ID: <mailman.4898.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Have you tried disabling f-secure, at least temporarily, and using ClamAV
and/or BitDefender instead, at least to check whether it's fsecure that's
causing (or being affected) by the problem?

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Hartmut Goebel
Sent: Friday, November 19, 2004 8:52 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: 'DoD detected!' prohibits mailprocessing

Hi,

Hartmut Goebel schrieb:

> Okay, we solved the problem. It was the Virus-DB which has not been

Hallooed to early :-(

We dropped in the quarantined messages to get them processed, and the same
problem occurs again. But this time, if the virus-scanner get's called
stand-alone, it works. (This has not been the case earlier.)

Ths logfiles show 5 scanning-processes to be started, all of which start a
virus-scanner. Scanner TImeout is 5 Minutes, and after these 5 Minutes I get
5 'DoS detected' messages. 5 Minutes later the same and so on.

There are no new 'Batch started' messages nor other messages like 'This
message contined the DoS'.

On this gateway, there is F-Secure running which is installed as described
by the F-Secure installation manual. 'fsav' will be called with '--archive
--mime--dumb --archive'. System is a RedHat Linux 9.

Is there a way to find out which messages are currently processed (say: 
which messages cause the DoS)?
What other information do you need for analyzing the problem?

--
Schönen Gruß - Regards
Hartmut Goebel

| Hartmut Goebel             | IT-Security -- effizient |
| h.goebel@goebel-consult.de | www.goebel-consult.de    |

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From garry at GLENDOWN.DE  Fri Nov 19 14:26:04 2004
From: garry at GLENDOWN.DE (Garry Glendown)
Date: Thu Jan 12 21:27:38 2006
Subject: Querying other SMTP server for valid addresses?
Message-ID: <mailman.4899.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi,

I'm running MS for several domains, some of which are receiving
tremendous amounts of spam for non-existent mail addresses. As the
domain itself is handled on another MX, I do not have (and probably
never will) a list of valid recipients - is there a way to set something
up that will do an MTA check upon receiving a message whether the
recipient does exist, and then accept (or deny) the message on MTA level?

Tnx, -gg

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From sylvain.phaneuf at IMSU.OXFORD.AC.UK  Fri Nov 19 14:28:09 2004
From: sylvain.phaneuf at IMSU.OXFORD.AC.UK (Sylvain Phaneuf)
Date: Thu Jan 12 21:27:38 2006
Subject: specs & platform for new server
Message-ID: <mailman.4900.1137101258.24926.mailscanner@lists.mailscanner.info>

Thanks. I will try your suggestions for a few days.

Sylvain

>>> ugob@CAMO-ROUTE.COM 19/11/2004 13:42:51 >>>
Sylvain Phaneuf wrote:
> I see your point and I don't mind the server being very busy. The
only
> problem is that we have left the default setting "reject MTA
connections
> when load is >12". So when our ISP realises that we don't accept
their
> messages, our messages are put on their "wait 15 min" queue. Should
I
> change the setting to much bigger nmbers?

What I'd do is push this number a little, then see if the delay for
delivery and other factors (memory usage, swapping, message batch
size,
etc.) go bad.  If it is still ok, I'd keep on pushing it up.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jaearick at COLBY.EDU  Fri Nov 19 14:35:46 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:38 2006
Subject: 4.35.11, new Message.pm = higher load
Message-ID: <mailman.4901.1137101258.24926.mailscanner@lists.mailscanner.info>

Julian,

Just a vague observation here that with the latest Message.pm
(version 1.126.2.168) and 4.35.11, Solaris 9, I've noticed that
my system load on my mail server has been consistantly higher
than before.  It is not a huge increase, but normally my system
is fairly quiet in the wee hours.  Not last night.  But maybe it
is just more spam than usual, who knows.

Jeff Earickson
Colby College

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From rcooper at DWFORD.COM  Fri Nov 19 14:35:16 2004
From: rcooper at DWFORD.COM (Rick Cooper)
Date: Thu Jan 12 21:27:38 2006
Subject: MailScanner: Beta 4.36.1 released
Message-ID: <mailman.4902.1137101258.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> Behalf Of Julian Field
> Sent: Thursday, November 18, 2004 10:22 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: MailScanner: Beta 4.36.1 released
>
>
> I have just released the latest version 4.36.1.
> This is mostly to get everyone up to the same point in the development of
> the phishing net.
> It also adds support for RedHat Enterprise Server (and AS)
> version 4 beta 2.
>
<sniP

>
> The full Changelog is this:
>
> * New Features and Improvements *
> - Improved URL trimming in phishing net.
> - Various improvements and fixes in phishing net.
> - Added support for RedHat Enterprise Linux 4.
> - Added check for Password-Protected Archives setting when using
> clamavmodule.
>
> * Fixes *
> - Fixed outstanding problem in bitdefender-autoupdate, so that it works
>   properly on new installations.
> - Fixed logging problem with phishing net on a few malformed messages.
>

I was looking at the clamavmodule changes that check for a simple value for
the Password-Protected archives, and I have a suggestion (since it there is
no reasonable way to use a rule set here)

How about adding something like:

        if(MailScanner::Config::IsSimpleValue('allowpasszips')){
                my $AllowPasswd = MailScanner::Config::Value('allowpasszips');
        }else{
                my $AllowPasswd = 1;
        }

At the top of the ClamAVModule sub then change:

if (MailScanner::Config::Value('allowpasszips')) { # || $haverar) {

To

if ($AllowPasswd) { # || $haverar) {

This way if someone is using a rule file the action would change to allow so
no one loses an attachment. I think warning them in the log and defaulting
to "no", or taking away the ability to use rules is not a good solution. The
UnpackZip sub respects the rule sets and it's not fair to take away the
ability to use a rule set there just to ensure password protected RARs are
caught for all.

Or just remove the CL_SCAN_BLOCKENCRYPTED flag all together. The only reason
I made the suggestion was because MS doesn't include the UnpackRar sub,
which would catch the password protected RARs, respect the rules sets and
report the file as password protected (rather than as an infected file). I
thought adding the CL_SCAN_BLOCKENCRYPTED would allow other MS systems to at
least catch protected RARs, even though the internal file name processing
wouldn't take place.

Doesn't matter to me either way since my patched Message.pm includes
UnpackRar, and SweepVirues.pm includes the $haverar checks, so I never use
the CL_SCAN_BLOCKENCRYPTED flag anyway.

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From h.goebel at GOEBEL-CONSULT.DE  Fri Nov 19 14:42:43 2004
From: h.goebel at GOEBEL-CONSULT.DE (Hartmut Goebel)
Date: Thu Jan 12 21:27:38 2006
Subject: 'DoD detected!' prohibits mailprocessing
Message-ID: <mailman.4903.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Alex Neuman van der Hans schrieb:
> Have you tried disabling f-secure, at least temporarily, and using ClamAV
> and/or BitDefender instead, at least to check whether it's fsecure that's
> causing (or being affected) by the problem?

No, I havn't tried yet. There is only one engine installed on the 
system, so this is a bit of work.

But it's becoming even better:
Iv' moved the old quarantined files 10 per chunk into the hold-queue, 
starting with the newst one. Now they have all been processed without 
problems.

I've to leave now, so we have to wait until monday for further 
investigations.

-- 
Schönen Gruß - Regards
Hartmut Goebel

| Hartmut Goebel             | IT-Security -- effizient |
| h.goebel@goebel-consult.de | www.goebel-consult.de    |

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From billy at PLANETGEEK.BIZ  Fri Nov 19 14:49:48 2004
From: billy at PLANETGEEK.BIZ (Billy Pumphrey)
Date: Thu Jan 12 21:27:38 2006
Subject: Querying other SMTP server for valid addresses?
Message-ID: <mailman.4904.1137101258.24926.mailscanner@lists.mailscanner.info>

I second this question.  Possible LDAP lookup for Active Directory.  Another
thing that people would not have enter as a deny in the MTA, for people that
are no longer with the company.  Also would eliminate bogus addresses too.

-----Original Message-----
From: Garry Glendown [mailto:garry@GLENDOWN.DE]
Sent: Friday, November 19, 2004 9:26 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Querying other SMTP server for valid addresses?

Hi,

I'm running MS for several domains, some of which are receiving
tremendous amounts of spam for non-existent mail addresses. As the
domain itself is handled on another MX, I do not have (and probably
never will) a list of valid recipients - is there a way to set something
up that will do an MTA check upon receiving a message whether the
recipient does exist, and then accept (or deny) the message on MTA level?

Tnx, -gg

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ugob at CAMO-ROUTE.COM  Fri Nov 19 14:40:10 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:38 2006
Subject: specs & platform for new server
Message-ID: <mailman.4905.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Sylvain Phaneuf wrote:
> Thanks. I will try your suggestions for a few days.
>
In fact, I think this setting is for a general-purpose server, not a
mail server.  It stops processing mail after it gets to a load of 12 so
that other applications and services on the server can cope with the
imprtant requests, leaving mail, a secondary service, unprocessed during
that time.

For a dedicated mail server, it doesn't really make sense to stop
processing mail even if the load is high, unless you run out of memory.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dh at UPTIME.AT  Fri Nov 19 14:50:21 2004
From: dh at UPTIME.AT (David H.)
Date: Thu Jan 12 21:27:38 2006
Subject: Querying other SMTP server for valid addresses?
Message-ID: <mailman.4906.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "UTF-8" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

Garry Glendown wrote:
| Hi,
|
| I'm running MS for several domains, some of which are receiving
| tremendous amounts of spam for non-existent mail addresses. As the
| domain itself is handled on another MX, I do not have (and probably
| never will) a list of valid recipients - is there a way to set something
| up that will do an MTA check upon receiving a message whether the
| recipient does exist, and then accept (or deny) the message on MTA level?

Look at LASER LDAP routing (the sendmail site has a good tip) or milter-ahead
on snert.com/software

- -d
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.3.6 (Darwin)

iD8DBQFBnggtPMoaMn4kKR4RA4JjAJ4qnyyjpHuzanmd+WABpWzCAJS9zACfeYF1
MecF4IU5Hbx9QfvjhQvV2dQ=
=VRk3
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Denis.Beauchemin at USHERBROOKE.CA  Fri Nov 19 14:46:10 2004
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:27:38 2006
Subject: specs & platform for new server
Message-ID: <mailman.4907.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Sylvain Phaneuf wrote:

>I see your point and I don't mind the server being very busy. The only
>problem is that we have left the default setting "reject MTA connections
>when load is >12". So when our ISP realises that we don't accept their
>messages, our messages are put on their "wait 15 min" queue. Should I
>change the setting to much bigger nmbers?
>
>Sylvain
>
Sylvain,

I run with the following sendmail setup:
define(`confDELAY_LA', `8')dnl
define(`confQUEUE_LA', `18')dnl
define(`confREFUSE_LA', `12')dnl

This makes my server delay connections when the load is above 8.  It 
then almost never get over 12, when I stop accepting new connections.  
If that happens I hope the remote mailer is smart enough to go to my 
second MS host (same MX weight).

One small log excerpt:
Nov 18 10:50:43 132.210.244.92 sendmail[5539]: iAIFoh6C005539: 
delaying=EHLO, load average=11 >= 8
Nov 18 10:50:44 132.210.244.93 sendmail[4075]: iAIFoSiZ004075: 
delaying=RCPT, load average=12 >= 8
Nov 18 10:50:44 132.210.244.93 sendmail[20150]: rejecting connections on 
daemon MTA: load average: 12

In yesterday's log I counted 616 delay messages and only 10 reject ones.

Denis
PS: Those 2 servers are for internal University emails. They are P3 
1.2GHz with 768MB/1GB RAM.  They run 3 MS children each. Each box 
process around 10K messages/day (for 30K recipients) for 1GB data (up to 
5-10GB). Batch size is small, except when many messages come at the same 
time (such as a mass-mailing to all University employees). During day 
time, load average is somewhat below 3.  My MS-MRTG graphs say it 
averages at 1.0/1.3 in the daily graph. On occasions their in queue may 
grow up to 1000 but it clears quite rapidly.

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Kevin.Spicer at BMRB.CO.UK  Fri Nov 19 14:49:20 2004
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin (MBLEA it))
Date: Thu Jan 12 21:27:38 2006
Subject: Querying other SMTP server for valid addresses?
Message-ID: <mailman.4908.1137101258.24926.mailscanner@lists.mailscanner.info>

It rather depends what MTA you are running and what the destination MX
is (i.e. what MTA software), but as general advice milter-ahead is one
option, or if the final destination is a windows domain theres an FAQ
that describes how to use the LDAP routing feature of sendmail (without
actually using LDAP!) to achieve the same thing

-----Original Message-----
From: Garry Glendown [mailto:garry@GLENDOWN.DE] 
Sent: 19 November 2004 14:26
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Querying other SMTP server for valid addresses?

Hi,

I'm running MS for several domains, some of which are receiving
tremendous amounts of spam for non-existent mail addresses. As the
domain itself is handled on another MX, I do not have (and probably
never will) a list of valid recipients - is there a way to set something
up that will do an MTA check upon receiving a message whether the
recipient does exist, and then accept (or deny) the message on MTA
level?

Tnx, -gg

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!





BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Q.G.Campbell at NEWCASTLE.AC.UK  Fri Nov 19 15:03:03 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:38 2006
Subject: Suggested phishing net tuning
Message-ID: <mailman.4909.1137101258.24926.mailscanner@lists.mailscanner.info>

Julian

I have seen repeated examples of log entries similar to:

Nov 19 05:21:10 cheviot5 MailScanner[14191]: Found phishing fraud from
orders@ebnerandsons.com claiming to be mailto:orders@ebnerandsons.com

and

Nov 19 05:30:34 cheviot5 MailScanner[14082]: Found phishing fraud from
www.airmileswineclub.co.uk?wine_11-04=true claiming to be
www.airmileswineclub.co.uk

Why might it be dangerous to strip the prefixing "mailto:" in the first
example and the appended script & arguments in the second before doing the
comparison?

Quentin
--
PHONE: +44 191 222 8209     Computing Service, University of Newcastle
FAX:   +44 191 222 8765     Newcastle upon Tyne, United Kingdom, NE1 7RU.
-------------------------------------------------------------------------
"Any opinions expressed above are mine. The University can get its own."

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Steve.Swaney at FSL.COM  Fri Nov 19 15:07:52 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:38 2006
Subject: Querying other SMTP server for valid addresses?
Message-ID: <mailman.4910.1137101258.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Garry Glendown
> Sent: Friday, November 19, 2004 9:26 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Querying other SMTP server for valid addresses?
>
> Hi,
>
> I'm running MS for several domains, some of which are receiving
> tremendous amounts of for non-existent mail addresses. As the
> domain itself is handled spam on another MX, I do not have (and probably
> never will) a list of valid recipients - is there a way to set something
> up that will do an MTA check upon receiving a message whether the
> recipient does exist, and then accept (or deny) the message on MTA level?
>
> Tnx, -gg
>

Yes, there is a way. If you use sendmail, you might want to look at
milter-ahead.

        http://www.milter.info/milter-ahead/

I quote from the web site:

"This Sendmail milter (mail filter) allows a gateway mail server to
call-ahead to a relay or internal mail store before accepting mail for
recipients of a message. Think of it as a lazy man's LDAP. It could also be
used by fallback MX servers to verify recipients with the primary MX."

We have milter-ahead working with MailScanner and are just about through
testing it.  It works.

It totally solves the problem of the gateway knowing who are valid users on
the backend mailhubs - with almost no work on the part of the administrator.
This is especially helpful on gateways that scan email for many different
mailhubs.

The only problem is Exchange. My experience is it that "out of the box",
Exchange defaults to blindly accepting email for invalid recipients and then
issues a Non Delivery Receipt (NDR).

I know that Exchange 2003 can be reconfigured to accept email only for valid
recipients and not to issue NDRs. I seem to remember there is a MS
Knowledgebase article on how to re-configure Exchange 2003 to behave a bit
more sensibly. Obviously for milter-ahead to work, the back end mail hub has
to reject email for invalid users.

I don't know if Exchange 2000 or 5.5 can be configured to reject mail for
invalid users. Again if anyone has any tips or suggestions for configuring
2000 or 5.5, please let me know.

Note that milter-ahead should for just about any type of backend mailhub,
sendmail, postfix, Notes - it's just more difficult with Exchange.

I've put copies of the files I had to reconfigure to get milter-ahead to
work in a very typical MailScanner configuration on our web site. There are
no install directions in the package but the install instructions on the
snert site are quite good. I'll post a short note when I have time to create
specific MailScanner install notes and update the package.

There is no link on our site to these files but you can download the file:

        wget http://www.fsl.com/support/milter-ahead.tar.gz

You might wonder about how efficient this method is and if it will slow down
the delivery of email. I have a note from the author explaining that it
should not. He believes the programs speed and caching methodology doesn't
slow things down that much. (It might even drop some spam if the spammer
can't wait for the response :) Our experience is that it's pretty quick. The
reduction of spam processing resulting from dictionary attacks that are
processed by MailScanner might actually reduce server load.

This may now be the best reason I know to use sendmail :)

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Kevin.Spicer at BMRB.CO.UK  Fri Nov 19 15:28:10 2004
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin (MBLEA it))
Date: Thu Jan 12 21:27:38 2006
Subject: Querying other SMTP server for valid addresses?
Message-ID: <mailman.4911.1137101258.24926.mailscanner@lists.mailscanner.info>

From: Steve Swaney [mailto:Steve.Swaney@FSL.COM] 
>I know that Exchange 2003 can be reconfigured to accept email only for
valid recipients 
>and not to issue NDRs. I seem to remember there is a MS Knowledgebase
article on how to 
>re-configure Exchange 2003 to behave a bit more sensibly. Obviously for
milter-ahead to 
>work, the back end mail hub has to reject email for invalid users.

I think I posted a link a while ago, should be in the archives (search
for exchange 2003 ?)

>I don't know if Exchange 2000 or 5.5 can be configured to reject mail
for invalid users. 
>Again if anyone has any tips or suggestions for configuring 2000 or
5.5, please let me 
>know.

As far as I have been albe to ascertain it can't, hence the LDAP routing
stuff.



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Q.G.Campbell at NEWCASTLE.AC.UK  Fri Nov 19 15:35:22 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:38 2006
Subject: Suggested phishing net tuning (more examples)
Message-ID: <mailman.4912.1137101258.24926.mailscanner@lists.mailscanner.info>

Julian

A difficult false positive example is:

Nov 19 04:15:18 cheviot5 MailScanner[14191]: Found phishing fraud from
support@pegasusworks.com?subject=unsubscriberequest for j.bloggs@ncl.ac.uk
claiming to be emailsupport@pegasusworks.com

Is it impossible to parse this safely before comparing the strings?

A more common type of false positive is:

Nov 19 05:51:14 cheviot5 MailScanner[14163]: Found phishing fraud from
www.worldonaplate.com claiming to be worldonaplate.com

I can see why you might be unwilling to remove the "www." from the actual
link before doing the comparison but is it really that unsafe?

What is a good and useful feature still has a false positive rate that is
unacceptably high.

Could your editing of the strings in the hypertext link be done more
aggressively before comparison? I know this may risk a possible rise in
the false negative rate but there are other detectors in MailScanner which
you acknowledge have a non-zero false negative rate.

I would be willing to see the false negative rate increase slightly in
order to reduce the number of times we cry "wolf!"

Quentin
--
PHONE: +44 191 222 8209     Computing Service, University of Newcastle
FAX:   +44 191 222 8765     Newcastle upon Tyne, United Kingdom, NE1 7RU.
-------------------------------------------------------------------------
"Any opinions expressed above are mine. The University can get its own."

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Steve.Swaney at FSL.COM  Fri Nov 19 16:24:15 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:38 2006
Subject: Querying other SMTP server for valid addresses?
Message-ID: <mailman.4913.1137101258.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Spicer, Kevin (MBLEA it)
> Sent: Friday, November 19, 2004 10:28 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Querying other SMTP server for valid addresses?
>
> From: Steve Swaney [mailto:Steve.Swaney@FSL.COM]
>
> I know that Exchange 2003 can be reconfigured to accept email only for
> valid recipients
> and not to issue NDRs. I seem to remember there is a MS Knowledgebase
>
> article on how to
> re-configure Exchange 2003 to behave a bit more sensibly. Obviously for
> milter-ahead to
> work, the back end mail hub has to reject email for invalid users.
> I think I posted a link a while ago, should be in the archives (search
> for exchange 2003 ?)

Couldn't find it in the Archives but I was able to find it here:

http://weblogs.asp.net/dlemson/archive/2003/10/17/52019.aspx


>
> >I don't know if Exchange 2000 or 5.5 can be configured to reject mail
> for invalid users.
> >Again if anyone has any tips or suggestions for configuring 2000 or
> 5.5, please let me know.
>
>
> As far as I have been albe to ascertain it can't, hence the LDAP routing

This is what I was afraid of and the information in the like above seems to
prove this is true. Looks like LDAP is the only option for Exchange 5.5 and
2000

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Mark.Pottage at SELECTION.CO.UK  Fri Nov 19 16:52:37 2004
From: Mark.Pottage at SELECTION.CO.UK (Mark Pottage)
Date: Thu Jan 12 21:27:38 2006
Subject: virtusertable...
Message-ID: <mailman.4914.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

We have a situation where we want to divert messages on a user basis to a
different local server.
 
Currently all mails to abc.com goto esmtp[192.168.1.1]  using the
mailertable database.
 
 
We are looking at using virtusertable to divert mesasge destined for:
 
user1@abc.com to user1@wxyz.com
 
Is it possible to use the mailertable and the virtusertable alongside
each other?
 
Is this theory going to work with what we are planning?
 
 
We use:
 
SendMail
MailScanner
MailWatch
 
many thanks
 
Mark Pottage
Systems Administrator
Tel:       0870 411 7914
Mobile:  07740 578 647
Fax:       0870 163 9001
mark.pottage@selection.co.uk

--
This message has been scanned for viruses and
dangerous content by Selection Services MailScanner, and is
believed to be clean.. ------------------------ MailScanner list
------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Text/PLAIN (Name: "Mark Pottage.vcf")  20 lines. ]
    [ Unable to print this part. ]


From brent at MIRABITO.COM  Fri Nov 19 17:04:12 2004
From: brent at MIRABITO.COM (Brent Strignano)
Date: Thu Jan 12 21:27:38 2006
Subject: Querying other SMTP server for valid addresses?
Message-ID: <mailman.4915.1137101258.24926.mailscanner@lists.mailscanner.info>

Take a look at:
http://support.microsoft.com/kb/823866

Then at:
http://support.microsoft.com/kb/842851


Brent Strignano
System Administrator
Granite Capital Holdings
Sidney, NY
 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Jan-Peter.Koopmann at SECEIDOS.DE  Fri Nov 19 17:45:33 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:38 2006
Subject: Querying other SMTP server for valid addresses?
Message-ID: <mailman.4916.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

>>> I don't know if Exchange 2000 or 5.5 can be configured to reject
>>> mail for invalid users. 

No way.

> This is what I was afraid of and the information in the like
> above seems to prove this is true. Looks like LDAP is the
> only option for Exchange 5.5 and 2000

Or you can periodically extract all valid e-mail adresses from the Exchange 5.5 Directory or the Active Directory, push this to your gateway and do a local database lookup. That way you will not need to allow incoming LDAP on your firewall.

Scripts etc. for this should be in the FAQ/MAQ.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From paddy at PANICI.NET  Fri Nov 19 19:53:36 2004
From: paddy at PANICI.NET (paddy)
Date: Thu Jan 12 21:27:38 2006
Subject: virtusertable...
Message-ID: <mailman.4917.1137101258.24926.mailscanner@lists.mailscanner.info>

On Fri, Nov 19, 2004 at 04:52:37PM +0000, Mark Pottage wrote:
> We have a situation where we want to divert messages on a user basis to
> a different local server.
>
> Currently all mails to abc.com goto esmtp[192.168.1.1]  using the
> mailertable database.
>
>
> We are looking at using virtusertable to divert mesasge destined for:
>
> user1@abc.com to user1@wxyz.com
>
> Is it possible to use the mailertable and the virtusertable alongside
> each other?

Yes, after a certain version of sendmail.

>
> Is this theory going to work with what we are planning?
>
>
> We use:
>
> SendMail
> MailScanner
> MailWatch
>
> many thanks
>
> Mark Pottage
> Systems Administrator
> Tel:       0870 411 7914
> Mobile:  07740 578 647
> Fax:       0870 163 9001
> mark.pottage@selection.co.uk
>
> --
> This message has been scanned for viruses and
> dangerous content by Selection Services MailScanner, and is
> believed to be clean.
>
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

> BEGIN:VCARD
> VERSION:2.1
> X-GWTYPE:USER
> FN:Mark Pottage
> TEL;WORK:0870 411 7914
> ORG:;Internal Support
> TEL;PREF;FAX:0870 163 9001
> EMAIL;WORK;PREF;NGW:Mark.Pottage@selection.co.uk
> N:Pottage;Mark
> TITLE:Systems Administrator
> END:VCARD
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!


--
Perl 6 will give you the big knob. -- Larry Wall

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jaearick at COLBY.EDU  Fri Nov 19 19:59:26 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:38 2006
Subject: 255 retcodes in syslog
Message-ID: <mailman.4918.1137101258.24926.mailscanner@lists.mailscanner.info>

Julian,

Weirdness with 4.35.11 plus latest Message.pm; this may be the cause
of my excess load.  I noticed a gob of the following in my syslogs
over the last day or so:

Nov 19 14:50:54 basalt <12>root: Process did not exit cleanly, returned
255 with signal 0

I found a couple of tnef files in my /var/spool/mqueue that should not
have been there.  I zapped them and ran MS in debug mode.  The end of
that output said:

syslog: expecting argument $format at
/opt/MailScanner/lib/MailScanner/Log.pm line 140
255

The "MailScanner -v" output is attached and I can send you the entire
debug output if needed (518K).  The only other thing that I've done
lately (yesterday) was install dccifd for DCC, which seems to work
correctly.  I followed the MAQ, following the advice of:

http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/312.html

(Thanks Ugo and Tomar)

Advice please?

Jeff Earickson
Colby College

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!
    [ Part 2, ""  Text/PLAIN (Name: "ms.version")  25 lines. ]
    [ Unable to print this part. ]


From garry at GLENDOWN.DE  Fri Nov 19 20:12:50 2004
From: garry at GLENDOWN.DE (Garry Glendown)
Date: Thu Jan 12 21:27:38 2006
Subject: Querying other SMTP server for valid addresses?
Message-ID: <mailman.4919.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Steve Swaney wrote:
> Yes, there is a way. If you use sendmail, you might want to look at
> milter-ahead.

Cool! Just what I as looking for!!!

> We have milter-ahead working with MailScanner and are just about through
> testing it.  It works.

Yup, took a moment to set it up, and after adding some "[]" to the
mailertable, it seems to work just as advertised ... ;)

> The only problem is Exchange. My experience is it that "out of the box",

Not only Exchange ... got at least one or two other products running at
customer sites (like Notes for example) that will accept anything, just
to send out a error message itself ... oh well ...

> specific MailScanner install notes and update the package.

I didn't seem to have to do anything special ... !?

> You might wonder about how efficient this method is and if it will slow down
> the delivery of email. I have a note from the author explaining that it

... I don't think that the queries are slower than later scanning every
message for being spam or a virus, then trying to deliver AND THEN
trying to get rid of the error message to the original sender (who might
not exist) ... also, some waiting time is preferable to CPU cycles ;)

-garry

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From kodak at FRONTIERHOMEMORTGAGE.COM  Fri Nov 19 21:58:10 2004
From: kodak at FRONTIERHOMEMORTGAGE.COM (Jason Balicki)
Date: Thu Jan 12 21:27:38 2006
Subject: OT: Quickie Sophos workstation reporting script
Message-ID: <mailman.4920.1137101258.24926.mailscanner@lists.mailscanner.info>

If you're using Sophos on your MailScanner box, chances
are you also have Sophos on your Windows workstations.

I've made a quickie script that retrieves the logs,
does a little bit of massaging them and reports back
to you via email about the state of virus scanning
on your network.

I know Sophos has their own tools, but I wanted
something I could control.  Plus, writing this
seemed easier than the instructions they had for
setting up emreporting, and I'm lazy.  I decided
to share it for the usual reasons...

This script makes some assumptions:

1)  You're running Samba and you use wins (I pull
the list of machines directly from the wins.dat,
then compare the list to the smbpasswd file (to
weed out things like printers and such.)

2)  You have a "sophos" user that has sufficient
rights on every workstation.  This is a requirement
of Enterprise Library as well.  My requirement is
that the user be the same on each workstation (this
is NOT required by EM.)

3)  You have all NT class machines and Sophos is
installed to the default location on all machines.

4)  You have a share named c$ available on all
workstations.  I plan on sharing out the log
directory read only to a throw away user
instead of the Sophos user, but this was quick
and dirty.

5)  You have the ability to mount smb shares.

This is a really small and easily adaptable script,
so even if you don't meet the requirements above,
you'll probably be able to change it easily for
your circumstances.

I know this isn't all that complex, but I
wasted some time on it and I thought other
MailScanner/Sophos users might be interested.

Sorry if it's too OT.

Also, if someone has already done this better
with a 3 line perl script, I don't want to
hear about it. :)

--J(K)

---cut here----
#!/bin/sh
# sophos_report
# written Jason Balicki
# just a quickie to get the Sophos logs from the workstations,
# and check them to see if Sophos has detected any viruses.
#
# last updated: 11-19-2004
WINSFILE=/var/cache/samba/wins.dat
DATE=`date +%m%d%y%h%m%s`
TEMPFILE=/tmp/sophoslog.$DATE
TEMPDIR=/tmp/sophosdir.$DATE
TEMPREPORT=/tmp/sophosreport.$DATE
# you will need to change this bit, obviously
SMBUSER=yoursophosuser
SMBPASS=yoursophospass
MAILTO=root
MOUNTPOINT=/mnt/sophoslogs
# your log location may differ.  You'll have to add a bit of logic
# if you've got older 9x (or other) clients.  Mine are all XP or 2k
LOGLOCATION=Program\ Files/Sophos\ Sweep\ for\ NT/Reports/Daily.REP
HASVIRUS=0
HASERROR=0
HOSTCOUNT=0
HOSTCOUNTMOUNTED=0
# you can pipe the following grep line through one or more grep -v to get
rid of
# wins listings you know you don't need, like other linux boxes or
# printers or whatnot.
grep \#00 $WINSFILE | cut -d " " -f 1 | cut -d \# -f 1 | cut -d \" -f 2  >
$TEMPFILE
mkdir $TEMPDIR
echo Sophos report for `date` > $TEMPREPORT
echo >> $TEMPREPORT
echo >> $TEMPREPORT
for HOST in `cat $TEMPFILE`; do
        if (grep -i $HOST /etc/samba/smbpasswd > /dev/null 2>&1); then
                echo $HOST >> $TEMPFILE.indomain
                HOSTCOUNT=`expr ${HOSTCOUNT} + 1`;
        else
                echo $HOST is not listed in domain. >> $TEMPREPORT
        fi;
done
echo >> $TEMPREPORT
echo >> $TEMPREPORT
for HOST in `cat $TEMPFILE.indomain`; do
        TARGET=//$HOST/c\$
        if (mount -t smbfs -o username=$SMBUSER -o password=$SMBPASS $TARGET
$MOUNTPOINT > /dev/null 2>&1); then
                if [ -e "$MOUNTPOINT/$LOGLOCATION" ]; then
                        cp "$MOUNTPOINT/$LOGLOCATION"
$TEMPDIR/$HOST.Daily.log >/dev/null 2>&1
                        HOSTCOUNTMOUNTED=`expr ${HOSTCOUNTMOUNTED} + 1`;
                else
                        echo WARNING: $HOST mounted, but no daily log found,
check Sophos installation >> $TEMPREPORT
                fi
                if (umount $MOUNTPOINT);then
                        true
                else
                        echo WARNING: unable to unmount $TARGET, you might
want to fix this. >> $TEMPREPORT
                fi
        else
                echo INFO: could not mount $TARGET, moving on.
>>$TEMPREPORT;
        fi;
done
echo >> $TEMPREPORT
echo >> $TEMPREPORT
echo ${HOSTCOUNTMOUNTED} of ${HOSTCOUNT} hosts in domain had retrievable
logs. >> $TEMPREPORT
echo >> $TEMPREPORT
echo >> $TEMPREPORT
echo Virus summary: >> $TEMPREPORT
for LOG in `ls $TEMPDIR`; do
        HN=`echo $LOG | cut -d "." -f 1`;
        if (grep Virus $TEMPDIR/$LOG | grep  detected>/dev/null 2>&1);then
                echo Found one or more viruses in $HN >> $TEMPREPORT
                HASVIRUS=1
        fi;
done
if [ $HASVIRUS -eq 0 ]; then
        echo Sophos reports no viruses found on any machine scanned. >>
$TEMPREPORT
fi
echo >> $TEMPREPORT
echo >> $TEMPREPORT
echo Error summary: >> $TEMPREPORT
for LOG in `ls $TEMPDIR`; do
        HN=`echo $LOG | cut -d "." -f 1`;
        if (grep Error: $TEMPDIR/$LOG >/dev/null 2>&1);then
                echo Found one or more errors in $HN >> $TEMPREPORT
                HASERROR=1
        fi;
done
if [ $HASERROR -eq 0 ]; then
        echo Sophos reports no errors found on any machine scanned. >>
$TEMPREPORT
fi
echo >> $TEMPREPORT
echo >> $TEMPREPORT
echo Report Details: >> $TEMPREPORT;
echo >> $TEMPREPORT
echo >> $TEMPREPORT
for LOG in `ls $TEMPDIR`; do
        HN=`echo $LOG | cut -d "." -f 1`;
        echo $LOG: >>$TEMPREPORT;
        grep Info: $TEMPDIR/$LOG | grep started >> $TEMPREPORT;
        grep Version $TEMPDIR/$LOG >> $TEMPREPORT;
        grep Includes $TEMPDIR/$LOG | grep detection >> $TEMPREPORT;
        if (grep Virus $TEMPDIR/$LOG | grep detected >> $TEMPREPORT);then
                true
        else
                echo -n No viruses detected by Sophos on\ >>$TEMPREPORT
                echo $HN >> $TEMPREPORT
        fi;
        if (grep Error: $TEMPDIR/$LOG >> $TEMPREPORT);then
                true
        else
                echo -n No errors detected by Sophos on\ >>$TEMPREPORT
                echo $HN >> $TEMPREPORT
        fi;
        echo >> $TEMPREPORT;
done
mail -s "Virus report" $MAILTO < $TEMPREPORT
if (df | grep $MOUNTPOINT > /dev/null 2>&1); then
        echo WARNING: it appears $MOUNTPOINT is still mounted. >>$TEMPREPORT
fi
#clean up /tmp
rm -rf $TEMPFILE $TEMPDIR $TEMPREPORT

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From doko at CS.TU-BERLIN.DE  Fri Nov 19 22:55:41 2004
From: doko at CS.TU-BERLIN.DE (Matthias Klose)
Date: Thu Jan 12 21:27:38 2006
Subject: MailScanner: Beta 4.36.1 released
Message-ID: <mailman.4921.1137101258.24926.mailscanner@lists.mailscanner.info>

Julian Field writes:
> I have just released the latest version 4.36.1.

the Mailscanner.tgz still includes in bin/ the tnef tarball, which is
included in the install tarball as well.

        Matthias

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From isp-list at TULSACONNECT.COM  Sat Nov 20 00:00:16 2004
From: isp-list at TULSACONNECT.COM (Mike Bacher)
Date: Thu Jan 12 21:27:39 2006
Subject: Querying other SMTP server for valid addresses?
Message-ID: <mailman.4922.1137101258.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Steve Swaney wrote:

> Yes, there is a way. If you use sendmail, you might want to look at
> milter-ahead.
>
>         http://www.milter.info/milter-ahead/
>
> I quote from the web site:
>
> "This Sendmail milter (mail filter) allows a gateway mail server to
> call-ahead to a relay or internal mail store before accepting mail for
> recipients of a message. Think of it as a lazy man's LDAP. It could also be
> used by fallback MX servers to verify recipients with the primary MX."

So, what does it do exactly -- connect to your backend mailhubs via SMTP and try a RCPT TO
command to see if the user is valid?

--

-----------------------------------------
Mike Bacher / isp-list@tulsaconnect.com
TCIS - TulsaConnect Internet Services
Phone: 918-584-1100x110 Fax: 918-582-5776
-----------------------------------------

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From isp-list at TULSACONNECT.COM  Sat Nov 20 00:08:09 2004
From: isp-list at TULSACONNECT.COM (Mike Bacher)
Date: Thu Jan 12 21:27:39 2006
Subject: Querying other SMTP server for valid addresses?
Message-ID: <mailman.4923.1137101259.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "windows-1252" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Steve Swaney wrote:

> 
> Yes, there is a way. If you use sendmail, you might want to look at
> milter-ahead.
> 
>         http://www.milter.info/milter-ahead/
> 
> I quote from the web site:
> 
> "This Sendmail milter (mail filter) allows a gateway mail server to
> call-ahead to a relay or internal mail store before accepting mail for
> recipients of a message. Think of it as a lazy man's LDAP. It could also be
> used by fallback MX servers to verify recipients with the primary MX."

Looks like exim has this sort of facility built-in.  Per the manual:

38.21. Callout verification

For non-local addresses, routing verifies the domain, but is unable to do any checking of 
the local part. There are situations where some means of verifying the local part is 
desirable. One way this can be done is to make an SMTP callback to the sending host (for a 
sender address) or a callforward to a subsequent host (for a recipient address), to see if 
the host accepts the address. We use the term callout to cover both cases. This facility 
should be used with care, because it can add a lot of resource usage to the cost of 
verifying an address. However, Exim does cache the results of callouts, which helps to 
reduce the cost. Details of caching are in the next section.

Recipient callouts are usually used only between hosts that are controlled by the same 
administration. For example, a corporate gateway host could use callouts to check for 
valid recipients on an internal mailserver. A successful callout does not guarantee that a 
real delivery to the address would succeed; on the other hand, a failing callout does 
guarantee that a delivery would fail.

If the callout option is present on a condition that verifies an address, a second stage 
of verification occurs if the address is successfully routed to one or more remote hosts. 
The usual case is routing by a dnslookup or a manualroute router, where the router 
specifies the hosts. However, if a router that does not set up hosts routes to an smtp 
transport with a hosts setting, the transport's hosts are used. If an smtp transport has 
hosts_override set, its hosts are always used, whether or not the router supplies a host 
list.

The port that is used is taken from the transport, if it is specified and is a remote 
transport. (For routers that do verification only, no transport need be specified.) 
Otherwise, the default SMTP port is used. If a remote transport specifies an outgoing 
interface, this is used; otherwise the interface is not specified.

For a sender callout check, Exim makes SMTP connections to the remote hosts, to test 
whether a bounce message could be delivered to the sender address. The following SMTP 
commands are sent:

   HELO <primary host name>
   MAIL FROM:<>
   RCPT TO:<the address to be tested>
   QUIT

LHLO is used instead of HELO if the transport's protocol option is set to ^Ólmtp^Ô.

A recipient callout check is similar. By default, it also uses an empty address for the 
sender. This default is chosen because most hosts do not make use of the sender address 
when verifying a recipient. Using the same address means that a single cache entry can be 
used for each recipient. Some sites, however, do make use of the sender address when 
verifying. These are catered for by the use_sender and use_postmaster options, described 
in the next section.

If the response to the RCPT command is a 2xx code, the verification succeeds. If it is 
5xx, the verification fails. For any other condition, Exim tries the next host, if any. If 
there is a problem with all the remote hosts, the ACL yields ^Ódefer^Ô, unless the defer_ok 
parameter of the callout option is given, in which case the condition is forced to succeed.

-- 

-----------------------------------------
Mike Bacher / isp-list@tulsaconnect.com
TCIS - TulsaConnect Internet Services
Phone: 918-584-1100x110 Fax: 918-582-5776
-----------------------------------------

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Steve.Swaney at FSL.COM  Sat Nov 20 00:04:48 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:39 2006
Subject: Querying other SMTP server for valid addresses?
Message-ID: <mailman.4924.1137101259.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Mike Bacher
> Sent: Friday, November 19, 2004 7:00 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Querying other SMTP server for valid addresses?
>
> Steve Swaney wrote:
>
> > Yes, there is a way. If you use sendmail, you might want to look at
> > milter-ahead.
> >
> >         http://www.milter.info/milter-ahead/
> >
> > I quote from the web site:
> >
> > "This Sendmail milter (mail filter) allows a gateway mail server to
> > call-ahead to a relay or internal mail store before accepting mail for
> > recipients of a message. Think of it as a lazy man's LDAP. It could also
> be
> > used by fallback MX servers to verify recipients with the primary MX."
>
> So, what does it do exactly -- connect to your backend mailhubs via SMTP
> and try a RCPT TO
> command to see if the user is valid?
>

A bit more sophisticated but the answer is essentially yes.

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com

>
> -----------------------------------------
> Mike Bacher / isp-list@tulsaconnect.com
> TCIS - TulsaConnect Internet Services
> Phone: 918-584-1100x110 Fax: 918-582-5776
> -----------------------------------------
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> Fortress Systems Ltd.
> www.fsl.com
>



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From isp-list at TULSACONNECT.COM  Sat Nov 20 00:19:41 2004
From: isp-list at TULSACONNECT.COM (Mike Bacher)
Date: Thu Jan 12 21:27:39 2006
Subject: Querying other SMTP server for valid addresses?
Message-ID: <mailman.4925.1137101259.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Steve Swaney wrote:

> A bit more sophisticated but the answer is essentially yes.

My only concern would be performance.  Yes, I know it caches (as does exim) but with the
huge amount of dictionary attacks that many of us see each day it might be a problem
performance wise.  We currently do LDAP lookups which work OK, but it has some downsides
related to domain aliases on our primary mailhost.

--

-----------------------------------------
Mike Bacher / isp-list@tulsaconnect.com
TCIS - TulsaConnect Internet Services
Phone: 918-584-1100x110 Fax: 918-582-5776
-----------------------------------------

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Steve.Swaney at FSL.COM  Sat Nov 20 00:21:16 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:39 2006
Subject: Querying other SMTP server for valid addresses?
Message-ID: <mailman.4926.1137101259.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Mike Bacher
> Sent: Friday, November 19, 2004 7:08 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Querying other SMTP server for valid addresses?
>
> Steve Swaney wrote:
>
> >
> > Yes, there is a way. If you use sendmail, you might want to look at
> > milter-ahead.
> >
> >         http://www.milter.info/milter-ahead/
> >
> > I quote from the web site:
> >
> > "This Sendmail milter (mail filter) allows a gateway mail server to
> > call-ahead to a relay or internal mail store before accepting mail for
> > recipients of a message. Think of it as a lazy man's LDAP. It could also
> be
> > used by fallback MX servers to verify recipients with the primary MX."
>
> Looks like exim has this sort of facility built-in.  Per the manual:
>
> 38.21. Callout verification
>
> For non-local addresses, routing verifies the domain, but is unable to do
> any checking of
> the local part. There are situations where some means of verifying the
> local part is
> desirable. One way this can be done is to make an SMTP callback to the
> sending host (for a
> sender address) or a callforward to a subsequent host (for a recipient
> address), to see if
> the host accepts the address. We use the term callout to cover both cases.
> This facility
> should be used with care, because it can add a lot of resource usage to
> the cost of
> verifying an address. However, Exim does cache the results of callouts,
> which helps to
> reduce the cost. Details of caching are in the next section.
>
> Recipient callouts are usually used only between hosts that are controlled
> by the same
> administration. For example, a corporate gateway host could use callouts
> to check for
> valid recipients on an internal mailserver. A successful callout does not
> guarantee that a
> real delivery to the address would succeed; on the other hand, a failing
> callout does
> guarantee that a delivery would fail.
>
> If the callout option is present on a condition that verifies an address,
> a second stage
> of verification occurs if the address is successfully routed to one or
> more remote hosts.
> The usual case is routing by a dnslookup or a manualroute router, where
> the router
> specifies the hosts. However, if a router that does not set up hosts
> routes to an smtp
> transport with a hosts setting, the transport's hosts are used. If an smtp
> transport has
> hosts_override set, its hosts are always used, whether or not the router
> supplies a host
> list.
>
> The port that is used is taken from the transport, if it is specified and
> is a remote
> transport. (For routers that do verification only, no transport need be
> specified.)
> Otherwise, the default SMTP port is used. If a remote transport specifies
> an outgoing
> interface, this is used; otherwise the interface is not specified.
>
> For a sender callout check, Exim makes SMTP connections to the remote
> hosts, to test
> whether a bounce message could be delivered to the sender address. The
> following SMTP
> commands are sent:
>
>    HELO <primary host name>
>    MAIL FROM:<>
>    RCPT TO:<the address to be tested>
>    QUIT
>
> LHLO is used instead of HELO if the transport's protocol option is set to
> "lmtp".
>
> A recipient callout check is similar. By default, it also uses an empty
> address for the
> sender. This default is chosen because most hosts do not make use of the
> sender address
> when verifying a recipient. Using the same address means that a single
> cache entry can be
> used for each recipient. Some sites, however, do make use of the sender
> address when
> verifying. These are catered for by the use_sender and use_postmaster
> options, described
> in the next section.
>
> If the response to the RCPT command is a 2xx code, the verification
> succeeds. If it is
> 5xx, the verification fails. For any other condition, Exim tries the next
> host, if any. If
> there is a problem with all the remote hosts, the ACL yields "defer",
> unless the defer_ok
> parameter of the callout option is given, in which case the condition is
> forced to succeed.
>
> --
>
> -----------------------------------------
> Mike Bacher / isp-list@tulsaconnect.com
> TCIS - TulsaConnect Internet Services
> Phone: 918-584-1100x110 Fax: 918-582-5776
> -----------------------------------------

Mike,

Thanks very much for the information. My quick and thoughtless comments:

1. Its Excellent and good to know that Exim has this facility built-in
2. From my limited knowledge of milter-ahead, it looks to
   be a bit more sophisticated than the functionality provided
   by Exim. (I could easily be wrong)
3. Both will have problems with Exchange and Notes servers

Now can Postfix do this trick?

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Steve.Swaney at FSL.COM  Sat Nov 20 00:28:22 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:39 2006
Subject: Querying other SMTP server for valid addresses?
Message-ID: <mailman.4927.1137101259.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Mike Bacher
> Sent: Friday, November 19, 2004 7:20 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Querying other SMTP server for valid addresses?
>
> Steve Swaney wrote:
>
> > A bit more sophisticated but the answer is essentially yes.
>
> My only concern would be performance.  Yes, I know it caches (as does
> exim) but with the
> huge amount of dictionary attacks that many of us see each day it might be
> a problem
> performance wise.  We currently do LDAP lookups which work OK, but it has
> some downsides
> related to domain aliases on our primary mailhost.

I've had some correspondence with the author, Anthony C Howe, and some
limited experience just watching logs scroll by :) Anthony thinks the
rejection of most dictionary attacks leads to overall improved performance
on the email gateway. I agree, although I don't yet have any empirical
evidence.

I also had an earlier post today that discussed performance issues

The time it takes to make the query appears to be very quick for most of the
domains we are testing - and they are not local domains.

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com
>
> -----------------------------------------
> Mike Bacher / isp-list@tulsaconnect.com
> TCIS - TulsaConnect Internet Services
> Phone: 918-584-1100x110 Fax: 918-582-5776
> -----------------------------------------
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> Fortress Systems Ltd.
> www.fsl.com
>



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From hden at KCBBS.GEN.NZ  Sat Nov 20 02:38:27 2004
From: hden at KCBBS.GEN.NZ (Hendrik den Hartog)
Date: Thu Jan 12 21:27:39 2006
Subject: Sophos Error
Message-ID: <mailman.4928.1137101259.24926.mailscanner@lists.mailscanner.info>

I've just installed the new sophosSAVI, so was keeping an eye
on the logs to ensure all was well.

This error was reported in the logs..

SophosSAVI::ERROR:: The file passed for scanning represented part of
a multi volume archive - the file cannot be scanned

I've found one other reference to a similar Sophos error in the archives,
but that didn't really explain the problem/a solution [if required?]

I know it is a Sophos Error, but anyone know whether it can be attributed
to the update?

Cheers!
Hendrik

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mark at TIPPINGMAR.COM  Sat Nov 20 02:59:09 2004
From: mark at TIPPINGMAR.COM (Mark Nienberg)
Date: Thu Jan 12 21:27:39 2006
Subject: Sophos Error
Message-ID: <mailman.4929.1137101259.24926.mailscanner@lists.mailscanner.info>

On Friday, November 19, 2004, at 06:38  PM, Hendrik den Hartog wrote:
> I've just installed the new sophosSAVI, so was keeping an eye
> on the logs to ensure all was well.
>
> This error was reported in the logs..
>
> SophosSAVI::ERROR:: The file passed for scanning represented part of
> a multi volume archive - the file cannot be scanned
>
> I've found one other reference to a similar Sophos error in the
> archives,
> but that didn't really explain the problem/a solution [if required?]
>
> I know it is a Sophos Error, but anyone know whether it can be
> attributed
> to the update?

It's not the update.  I've seen that error too and I still use the
older version.

Mark Nienberg

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Sat Nov 20 12:14:31 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:39 2006
Subject: specs & platform for new server
Message-ID: <mailman.4930.1137101259.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Ugo Bellavance wrote:

> Julian Field wrote:
>
>> You have raised one interesting point: MailScanner will happily drive
>> your
>> system's load average up through the roof. Most of these will be
>> processes
>> awaiting network response. A load average of 10 or 12 doesn't really
>> mean
>> anything. What counts is the size of message batches that are being
>> processed. If the batches are small then you have nothing to worry
>> about. If
>> the batches start approaching 30 regularly, then you should look into
>> more
>> powerful hardware and better network setup.
>>
>> Don't think your system is being hammered because it reports a load
>> average
>> over 10 most of the time. That is MailScanner working your box very
>> hard!
>
>
> What was the load average on the system that processed 1.5 millions
> message/day, Julian?

15 or so rings a bell. That was when version 4 first came out.
SpamAssassin has grown by orders of magnitude since, so I suspect a
reasonable load might be even higher now. It's the average batch size
you really want to watch.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Sat Nov 20 12:23:39 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:39 2006
Subject: Suggested phishing net tuning
Message-ID: <mailman.4931.1137101259.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Quentin Campbell wrote:

>Julian
>
>I have seen repeated examples of log entries similar to:
>
>Nov 19 05:21:10 cheviot5 MailScanner[14191]: Found phishing fraud from
>orders@ebnerandsons.com claiming to be mailto:orders@ebnerandsons.com
>
>and
>
>Nov 19 05:30:34 cheviot5 MailScanner[14082]: Found phishing fraud from
>www.airmileswineclub.co.uk?wine_11-04=true claiming to be
>www.airmileswineclub.co.uk
>
>Why might it be dangerous to strip the prefixing "mailto:" in the first
>example
>
Sounds fair enough.

> and the appended script & arguments in the second before doing the
>comparison?
>
>
I am wary of doing that as (a) there should be a / before the ? and (b)
could the ? be part of a username or password passed to the http server
which could therefore be used to evade the phishing net?

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Sat Nov 20 12:18:09 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:39 2006
Subject: 'DoD detected!' prohibits mailprocessing
Message-ID: <mailman.4932.1137101259.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hartmut Goebel wrote:

> Hi,
>
> Hartmut Goebel schrieb:
>
>> Okay, we solved the problem. It was the Virus-DB which has not been
>
>
> Hallooed to early :-(
>
> We dropped in the quarantined messages to get them processed, and the
> same problem occurs again. But this time, if the virus-scanner get's
> called stand-alone, it works. (This has not been the case earlier.)
>
> Ths logfiles show 5 scanning-processes to be started, all of which
> start a virus-scanner. Scanner TImeout is 5 Minutes, and after these 5
> Minutes I get 5 'DoS detected' messages. 5 Minutes later the same and
> so on.
>
> There are no new 'Batch started' messages nor other messages like
> 'This message contined the DoS'.
>
> On this gateway, there is F-Secure running which is installed as
> described by the F-Secure installation manual. 'fsav' will be called
> with '--archive --mime--dumb --archive'. System is a RedHat Linux 9.
>
> Is there a way to find out which messages are currently processed
> (say: which messages cause the DoS)?
> What other information do you need for analyzing the problem?
>
After it gets the first DoS report, it goes through the messages in the
batch and scans them one by one to work out exactly which message called
the problem. So it does that for you already :-)
Take a look at the logs and hopefully it will tell you (2nd time round
on the batch) which message caused it. You might try running in Debug
mode so that it's easier to see what's going on, as then there will only
be 1 MailScanner process running.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Sat Nov 20 12:25:32 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:39 2006
Subject: Suggested phishing net tuning (more examples)
Message-ID: <mailman.4933.1137101259.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Fair enough. I will take a look at this next week, and have a go at
rewriting the net to be more agressive with its data while minimising
false negatives.

Quentin Campbell wrote:

>Julian
>
>A difficult false positive example is:
>
>Nov 19 04:15:18 cheviot5 MailScanner[14191]: Found phishing fraud from
>support@pegasusworks.com?subject=unsubscriberequest for j.bloggs@ncl.ac.uk
>claiming to be emailsupport@pegasusworks.com
>
>Is it impossible to parse this safely before comparing the strings?
>
>A more common type of false positive is:
>
>Nov 19 05:51:14 cheviot5 MailScanner[14163]: Found phishing fraud from
>www.worldonaplate.com claiming to be worldonaplate.com
>
>I can see why you might be unwilling to remove the "www." from the actual
>link before doing the comparison but is it really that unsafe?
>
>What is a good and useful feature still has a false positive rate that is
>unacceptably high.
>
>Could your editing of the strings in the hypertext link be done more
>aggressively before comparison? I know this may risk a possible rise in
>the false negative rate but there are other detectors in MailScanner which
>you acknowledge have a non-zero false negative rate.
>
>I would be willing to see the false negative rate increase slightly in
>order to reduce the number of times we cry "wolf!"
>
>Quentin
>--
>PHONE: +44 191 222 8209     Computing Service, University of Newcastle
>FAX:   +44 191 222 8765     Newcastle upon Tyne, United Kingdom, NE1 7RU.
>-------------------------------------------------------------------------
>"Any opinions expressed above are mine. The University can get its own."
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Sat Nov 20 12:27:26 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:39 2006
Subject: 255 retcodes in syslog
Message-ID: <mailman.4934.1137101259.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Please can you try the Message.pm from 4.36.1 as I fixed 1 syslog bug in
there.

Jeff A. Earickson wrote:

> Julian,
>
> Weirdness with 4.35.11 plus latest Message.pm; this may be the cause
> of my excess load.  I noticed a gob of the following in my syslogs
> over the last day or so:
>
> Nov 19 14:50:54 basalt <12>root: Process did not exit cleanly, returned
> 255 with signal 0
>
> I found a couple of tnef files in my /var/spool/mqueue that should not
> have been there.  I zapped them and ran MS in debug mode.  The end of
> that output said:
>
> syslog: expecting argument $format at
> /opt/MailScanner/lib/MailScanner/Log.pm line 140
> 255
>
> The "MailScanner -v" output is attached and I can send you the entire
> debug output if needed (518K).  The only other thing that I've done
> lately (yesterday) was install dccifd for DCC, which seems to work
> correctly.  I followed the MAQ, following the advice of:
>
> http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/312.html
>
> (Thanks Ugo and Tomar)
>
> Advice please?
>
> Jeff Earickson
> Colby College
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
>------------------------------------------------------------------------
>
>Running on
>SunOS basalt 5.9 Generic_117171-12 sun4u sparc SUNW,Netra-T12
>This is Perl version 5.008005 (5.8.5)
>
>This is MailScanner version 4.35.11
>Module versions are:
>1.00   AnyDBM_File
>1.14   Archive::Zip
>1.03   Carp
>1.119  Convert::BinHex
>1.00   DirHandle
>1.05   Fcntl
>2.73   File::Basename
>2.08   File::Copy
>2.01   FileHandle
>1.06   File::Path
>0.14   File::Temp
>1.27   HTML::Entities
>3.36   HTML::Parser
>2.28   HTML::TokeParser
>1.21   IO
>1.10   IO::File
>1.123  IO::Pipe
>3.05   MIME::Base64
>5.415  MIME::Decoder
>5.415  MIME::Decoder::UU
>5.415  MIME::Head
>5.415  MIME::Parser
>3.03   MIME::QuotedPrint
>5.415  MIME::Tools
>0.10   Net::CIDR
>1.08   POSIX
>1.77   Socket
>0.05   Sys::Syslog
>1.02   Time::localtime
>
>Optional module versions are:
>1.810  DB_File
>1.08   Digest
>1.01   Digest::HMAC
>2.33   Digest::MD5
>2.10   Digest::SHA1
>0.44   Inline
>0.12   Mail::ClamAV
>3.000001       Mail::SpamAssassin
>1.997  Mail::SPF::Query
>0.15   Net::CIDR::Lite
>0.48   Net::DNS
>missing        Net::LDAP
>1.94   Parse::RecDescent
>0.25   SAVI
>1.2    Sys::Hostname::Long
>2.42   Test::Harness
>0.47   Test::Simple
>1.95   Text::Balanced
>1.35   URI
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Sat Nov 20 12:21:33 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:39 2006
Subject: 4.35.11, new Message.pm = higher load
Message-ID: <mailman.4935.1137101259.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Please keep an eye on this and let me know. There shouldn't have been
any major changes in there between 4.35.11 and 4.36.1 (just phishing
improvements). But if you continue to see it I will take a look and see
if any of the regexps could be better phrased.

Jeff A. Earickson wrote:

> Julian,
>
> Just a vague observation here that with the latest Message.pm
> (version 1.126.2.168) and 4.35.11, Solaris 9, I've noticed that
> my system load on my mail server has been consistantly higher
> than before.  It is not a huge increase, but normally my system
> is fairly quiet in the wee hours.  Not last night.  But maybe it
> is just more spam than usual, who knows.


--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From carl at WERNHART.PRIV.AT  Sat Nov 20 12:49:13 2004
From: carl at WERNHART.PRIV.AT (Carl A. Wernhart)
Date: Thu Jan 12 21:27:39 2006
Subject: zip-virus problems
Message-ID: <mailman.4936.1137101259.24926.mailscanner@lists.mailscanner.info>

Hello!

 i'm new to the list and i'm desperately searching
 for a solution to the zip-file problem:

 the problem:

   i want the option "Maximum Archive Depth" to "0"
   so people can send their things (.exe etc..) as
   zip-files.
   now, if a virus in a zip-file occurres the scanner
   (calmav) detects it (i can see this in the log) but
   the file-rules say ".zip" is ok and delivers the
   virus! though it was detected bei the AV!!!

   ps: when "Maximum Archive Depth" ist "2" the
   detections is also not treated but the rules block
   the virus because of the extension.

  my versions:
   MS-Version:    MailScanner 4.36.1
   Antivirus:     ClamAV (not the module)
   System:        Linux 2.4.26
   MTA            Sendmail 8.13.1

 yours, carl

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ugob at CAMO-ROUTE.COM  Sat Nov 20 13:53:26 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:39 2006
Subject: zip-virus problems
Message-ID: <mailman.4937.1137101259.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Carl A. Wernhart wrote:
> Hello!
>
>  i'm new to the list and i'm desperately searching
>  for a solution to the zip-file problem:
>
>  the problem:
>
>    i want the option "Maximum Archive Depth" to "0"
>    so people can send their things (.exe etc..) as
>    zip-files.
>    now, if a virus in a zip-file occurres the scanner
>    (calmav) detects it (i can see this in the log) but
>    the file-rules say ".zip" is ok and delivers the
>    virus! though it was detected bei the AV!!!
>
>    ps: when "Maximum Archive Depth" ist "2" the
>    detections is also not treated but the rules block
>    the virus because of the extension.
>
>   my versions:
>    MS-Version:    MailScanner 4.36.1
>    Antivirus:     ClamAV (not the module)
>    System:        Linux 2.4.26
>    MTA            Sendmail 8.13.1
>
>  yours, carl
>

Could we see some log entries?

Thanks,

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jaearick at COLBY.EDU  Sat Nov 20 14:43:38 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:39 2006
Subject: 255 retcodes in syslog
Message-ID: <mailman.4938.1137101259.24926.mailscanner@lists.mailscanner.info>

Julian,

    What I already had in my 4.35.11 and the Message.pm file in 4.36.1
were the same (cksum = 1930658726 166284).  Thinking that the syslog
fix might have been someplace else in 4.36.1, I went ahead and upgraded
to 4.36.1.  Still the same syslog complaint at the bottom of a debug
run:

syslog: expecting argument $format at /opt/MailScanner/lib/MailScanner/Log.pm line 140
255

The entire debug output is 496KB.  The "MailScanner -v" output is
attached.

Jeff Earickson
Colby College

On Sat, 20 Nov 2004, Julian Field wrote:

> Date: Sat, 20 Nov 2004 12:27:26 +0000
> From: Julian Field <mailscanner@ECS.SOTON.AC.UK>
> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: 255 retcodes in syslog
>
> Please can you try the Message.pm from 4.36.1 as I fixed 1 syslog bug in
> there.
>
> Jeff A. Earickson wrote:
>
>> Julian,
>>
>> Weirdness with 4.35.11 plus latest Message.pm; this may be the cause
>> of my excess load.  I noticed a gob of the following in my syslogs
>> over the last day or so:
>>
>> Nov 19 14:50:54 basalt <12>root: Process did not exit cleanly, returned
>> 255 with signal 0
>>
>> I found a couple of tnef files in my /var/spool/mqueue that should not
>> have been there.  I zapped them and ran MS in debug mode.  The end of
>> that output said:
>>
>> syslog: expecting argument $format at
>> /opt/MailScanner/lib/MailScanner/Log.pm line 140
>> 255
>>
>> The "MailScanner -v" output is attached and I can send you the entire
>> debug output if needed (518K).  The only other thing that I've done
>> lately (yesterday) was install dccifd for DCC, which seems to work
>> correctly.  I followed the MAQ, following the advice of:
>>
>> http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/312.html
>>
>> (Thanks Ugo and Tomar)
>>
>> Advice please?
>>
>> Jeff Earickson
>> Colby College
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>> Support MailScanner development - buy the book off the website!
>>
>> ------------------------------------------------------------------------
>>
>> Running on
>> SunOS basalt 5.9 Generic_117171-12 sun4u sparc SUNW,Netra-T12
>> This is Perl version 5.008005 (5.8.5)
>>
>> This is MailScanner version 4.35.11
>> Module versions are:
>> 1.00   AnyDBM_File
>> 1.14   Archive::Zip
>> 1.03   Carp
>> 1.119  Convert::BinHex
>> 1.00   DirHandle
>> 1.05   Fcntl
>> 2.73   File::Basename
>> 2.08   File::Copy
>> 2.01   FileHandle
>> 1.06   File::Path
>> 0.14   File::Temp
>> 1.27   HTML::Entities
>> 3.36   HTML::Parser
>> 2.28   HTML::TokeParser
>> 1.21   IO
>> 1.10   IO::File
>> 1.123  IO::Pipe
>> 3.05   MIME::Base64
>> 5.415  MIME::Decoder
>> 5.415  MIME::Decoder::UU
>> 5.415  MIME::Head
>> 5.415  MIME::Parser
>> 3.03   MIME::QuotedPrint
>> 5.415  MIME::Tools
>> 0.10   Net::CIDR
>> 1.08   POSIX
>> 1.77   Socket
>> 0.05   Sys::Syslog
>> 1.02   Time::localtime
>>
>> Optional module versions are:
>> 1.810  DB_File
>> 1.08   Digest
>> 1.01   Digest::HMAC
>> 2.33   Digest::MD5
>> 2.10   Digest::SHA1
>> 0.44   Inline
>> 0.12   Mail::ClamAV
>> 3.000001       Mail::SpamAssassin
>> 1.997  Mail::SPF::Query
>> 0.15   Net::CIDR::Lite
>> 0.48   Net::DNS
>> missing        Net::LDAP
>> 1.94   Parse::RecDescent
>> 0.25   SAVI
>> 1.2    Sys::Hostname::Long
>> 2.42   Test::Harness
>> 0.47   Test::Simple
>> 1.95   Text::Balanced
>> 1.35   URI
>>
>>
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!
    [ Part 2, ""  Text/PLAIN (Name: "ms.version")  25 lines. ]
    [ Unable to print this part. ]


From mailscanner at WERNHART.PRIV.AT  Sat Nov 20 15:03:57 2004
From: mailscanner at WERNHART.PRIV.AT (Carl Wernhart - MailScannerAdm)
Date: Thu Jan 12 21:27:39 2006
Subject: zip-virus problems
Message-ID: <mailman.4939.1137101259.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Ugo Bellavance
> Sent: Saturday, November 20, 2004 2:53 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: [MAILSCANNER] zip-virus problems

[...]

> Could we see some log entries?

sure!

Nov 20 16:00:00 scanner sm-mta[21772]: iAKExxis021772:
from=<carl.wernhart@acw.at>, size=31682, class=0, nrcpts=1,
msgid=<419F5BE9.9030604@acw.at>, proto=ESMTP, daemon=MTA,
relay=line210.acw.at [195.230.52.210]
Nov 20 16:00:00 scanner sm-mta[21772]: iAKExxis021772:
to=<carl@wernhart.priv.at>, delay=00:00:00, mailer=smtp, pri=61682,
stat=queued
Nov 20 16:00:00 scanner MailScanner[21372]: New Batch: Scanning 1 messages,
32143 bytes
Nov 20 16:00:00 scanner MailScanner[21372]: Spam Checks: Starting
Nov 20 16:00:02 scanner MailScanner[21372]: Message iAKExxis021772 from
195.230.52.210 (carl.wernhart@acw.at) to wernhart.priv.at is not spam,
SpamAssassin (Wertung=-5.77, benoetigt 6, autolearn=not spam, ALL_TRUSTED
-3.30, AWL 0.13, BAYES_00 -2.60)
Nov 20 16:00:02 scanner MailScanner[21372]: Virus and Content Scanning:
Starting
Nov 20 16:00:04 scanner MailScanner[21372]:
/usr/varnew/spool/MailScanner/incoming/21372/./iAKExxis021772/Informations.z
ip: Worm.SomeFool.Z FOUND
Nov 20 16:00:04 scanner MailScanner[21372]: Virus Scanning: ClamAV found 1
infections
Nov 20 16:00:04 scanner MailScanner[21372]: Infected message usr came from
Nov 20 16:00:04 scanner MailScanner[21372]: Virus Scanning: Found 1 viruses
Nov 20 16:00:04 scanner MailScanner[21372]: Filename Checks: Allowing
iAKExxis021772 msg-21372-5.txt
Nov 20 16:00:04 scanner MailScanner[21372]: Filename Checks: Allowing
iAKExxis021772 Informations.zip
Nov 20 16:00:04 scanner MailScanner[21372]: Filename Checks: Allowing
iAKExxis021772 msg-21372-6.txt
Nov 20 16:00:04 scanner MailScanner[21372]: Filename Checks: Allowing
iAKExxis021772 msg-21372-7.txt
Nov 20 16:00:04 scanner MailScanner[21372]: Filetype Checks: Allowing
iAKExxis021772 msg-21372-6.txt
Nov 20 16:00:04 scanner MailScanner[21372]: Filetype Checks: Allowing
iAKExxis021772 msg-21372-7.txt
Nov 20 16:00:04 scanner MailScanner[21372]: Filetype Checks: Allowing
iAKExxis021772 msg-21372-5.txt
Nov 20 16:00:04 scanner MailScanner[21372]: Filetype Checks: Allowing
iAKExxis021772 Informations.zip
Nov 20 16:00:04 scanner MailScanner[21372]: Uninfected: Delivered 1 messages
Nov 20 16:00:05 scanner sendmail[21793]: iAKExxis021772:
to=<carl@wernhart.priv.at>, delay=00:00:05, xdelay=00:00:01, mailer=smtp,
pri=151682, relay=mail.wernhart.priv.at [217.116.177.18], dsn=2.0.0,
stat=Sent (iAKF04v7032632 Message accepted for delivery)


 carl

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From drew at THEMARSHALLS.CO.UK  Sat Nov 20 20:37:54 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:39 2006
Subject: Querying other SMTP server for valid addresses?
Message-ID: <mailman.4940.1137101259.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Steve Swaney wrote:

>Now can Postfix do this trick?
>
>
Put simply, yes! Postfix uses an extension of it's address verification
system. Full details are here
http://www.postfix.org/ADDRESS_VERIFICATION_README.html all you need to
do if you don't want to do address verification on all incoming
connections (See the warning at the top of that document) is just
specify the domains you control. Postfix also has the luxury of using a
cache  after (un)successful verification, which will speed up future
look ups still further. Obviously the same caveats apply to Postfix's
version as Exim's and milter-ahead. It won't work on >Exchange 2003 or
Notes.

Drew

--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Steve.Swaney at FSL.COM  Sat Nov 20 21:23:13 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:39 2006
Subject: Querying other SMTP server for valid addresses?
Message-ID: <mailman.4941.1137101259.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Drew Marshall
> Sent: Saturday, November 20, 2004 3:38 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Querying other SMTP server for valid addresses?
>
> Steve Swaney wrote:
>
> >Now can Postfix do this trick?
> >
> >
> Put simply, yes! Postfix uses an extension of it's address verification
> system. Full details are here
> http://www.postfix.org/ADDRESS_VERIFICATION_README.html all you need to
> do if you don't want to do address verification on all incoming
> connections (See the warning at the top of that document) is just
> specify the domains you control. Postfix also has the luxury of using a
> cache  after (un)successful verification, which will speed up future
> look ups still further. Obviously the same caveats apply to Postfix's
> version as Exim's and milter-ahead. It won't work on >Exchange 2003 or
> Notes.
>
> Drew
>
Thanks Drew,

We now have method for verifying valid recipients on back end mailhubs for
sendmail Ensim and Postfix. I'll work with Ugo and see if we can't get this
information written up and the MAQ updated.

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Kevin.Spicer at BMRB.CO.UK  Sun Nov 21 12:39:58 2004
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin (MBLEA it))
Date: Thu Jan 12 21:27:39 2006
Subject: Anyone else seeing....
Message-ID: <mailman.4942.1137101259.24926.mailscanner@lists.mailscanner.info>

http://www.bmrb.co.uk
+44 (0)20 8566 5000

This message (and any attachment) is intended only for the recipient and
may contain confidential and/or privileged material. If you have received
this in error, please contact the sender and delete this message
immediately. Disclosure, copying or other action taken in respect of this
email or in reliance on it is prohibited. BMRB International Limited
accept no liability in relation to any personal emails, or content of any
email which does not directly relate to our business.
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From drew at THEMARSHALLS.CO.UK  Sun Nov 21 14:35:56 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:39 2006
Subject: Anyone else seeing....
Message-ID: <mailman.4943.1137101259.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Spicer, Kevin (MBLEA it) wrote:
      lots of Spamassassin timeouts this morning?

No, but there so little mail moving at the moment it's not really a fair
judgement...

Drew

--
In line with our policy, this message has been scanned for
viruses and dangerous content by MailScanner, and is
believed to be clean. ------------------------ MailScanner list
------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From dean at MYSTERIOUSPLANET.CO.UK  Sun Nov 21 20:20:48 2004
From: dean at MYSTERIOUSPLANET.CO.UK (Dean Liversidge)
Date: Thu Jan 12 21:27:39 2006
Subject: New question
Message-ID: <mailman.4944.1137101259.24926.mailscanner@lists.mailscanner.info>

On Thu, 18 Nov 2004 09:39:44 +0100, you wrote:

>| We used to use a dynamic LDAP lookup to exchange from our sendmail
>| boxes, which worked great, until one day we had a problem with the
>| LDAP on exchange, and the whole thing came crashing to a halt, and
>| rejected everyone.
>|
>I assume that you set the `bounce` instead of the `passthru`option and
>had no local (aliases/users) whatever :)
>

i'm not sure what options you mean, and we were not using the new
standard sendmail ldap map as we were working on the normal exchange
ldap schema and not using any extra attributes. We were just
validating addresses against searches to exchange for valid user
accounts, and against local aliases to cover mailing lists and
applications. If there was no match on either, it was bounced as we
wanted to reject mail that we didnt have a valid user for, not forward
it on to anything
Im sure there are ways to make it more resilient, this was originally
setup by the guy before me, but i didnt see any reasonable straight
forward way of handling it, other than some complex rulesets
-- 
Dean Liversidge

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dean at MYSTERIOUSPLANET.CO.UK  Sun Nov 21 23:56:40 2004
From: dean at MYSTERIOUSPLANET.CO.UK (Dean Liversidge)
Date: Thu Jan 12 21:27:39 2006
Subject: Suggested phishing net tuning
Message-ID: <mailman.4945.1137101259.24926.mailscanner@lists.mailscanner.info>

On Sat, 20 Nov 2004 12:23:39 +0000, you wrote:

>>
>>Why might it be dangerous to strip the prefixing "mailto:" in the first
>>example
>>
>Sounds fair enough.
>
>> and the appended script & arguments in the second before doing the
>>comparison?
>>
>>
>I am wary of doing that as (a) there should be a / before the ? and (b)
>could the ? be part of a username or password passed to the http server
>which could therefore be used to evade the phishing net?

I dont know if the trailing / is a requirement or not, but it would
seem nearly everyone doenst use it. I know incorrect usage doesnt make
it right

Im not an expert, but my thoughts would be to drop any mailto: prefix,
as most display text wouldnt include that, and drop anything after the
first non acceptable domain name character set, so anything / or ? and
after would go, since it looks ugly to have a display part showing
parameters - most dont show it

Creaters should know better than to mismatch the www. part of a url,
and these could be completly different websites and my thoughts would
be to make the creaters do the work properly, and fix their url's.

That said, different hosts within a domain come from the original
'trusted' parent domain, i think it would be acceptable to trust a
hostname within the domain, but i see a problem there with how many
levels of name to match, you cant just accept one extra level of child
domain, or you may get something like
display=http://org    link=http://dodgysite.org

and at the top level domain who knows who to trust...

-- 
Dean Liversidge

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dmehler26 at WOH.RR.COM  Mon Nov 22 00:16:43 2004
From: dmehler26 at WOH.RR.COM (dave)
Date: Thu Jan 12 21:27:39 2006
Subject: mailscanner with postfix startup messages
Message-ID: <mailman.4946.1137101259.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hello,
    I'm trying to get mailscanner going with postfix. I have customized
mailscanner.conf and made the other changes as per the howto. I am getting
some strange messages in the maillog:
"bogus file HOLD/razor-agent.log"
That's coming from postfix postsuper when i start postfix. Checking
/var/spool/postfix/hold there is indeed a file razor-agent.log. I do not
know how this got here and would like to know if it's something i have to
worry about or a config problem? Next, i'm getting a message about
spamassassin whitelist functionality, not sure what this is? I'm also
getting a message "messages found but no hashed queue directories".
    I'd also like to know if postfix-style virtual domains are also effected
by this setup?
Thanks.
Dave.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dean at MYSTERIOUSPLANET.CO.UK  Mon Nov 22 00:17:23 2004
From: dean at MYSTERIOUSPLANET.CO.UK (Dean Liversidge)
Date: Thu Jan 12 21:27:39 2006
Subject: Mailto's being marked as detected fraud attempt.
Message-ID: <mailman.4947.1137101259.24926.mailscanner@lists.mailscanner.info>

On Wed, 17 Nov 2004 08:26:47 -0900, you wrote:

>Julian Field wrote:
>> How could I improve it?
>>
>
>I haven't played w/it yet so maybe I'm completely missing the boat, but what
>about stripping out the link entirely and just turning it into straight
>text?  Often, when I get an HTML mail at my home account I'll forward it to
>paypal or ebay or wherever.  I use Mozilla which converts it to text so what
>I end up with is the displayed text (where they want you to think you're
>going) followed by the actual URL.

>If the email is legitimate, the user has the real link right there.  They'll
>have to copy/paste it into their browser, which for me would be a small
>price to pay for more security...
>...Kevin


I think this is a great idea for a disarm phishing url function.
Just diplaying the <a href> linked url, and removing the html tags
-- 
Dean Liversidge

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dmehler26 at WOH.RR.COM  Mon Nov 22 03:33:19 2004
From: dmehler26 at WOH.RR.COM (dave)
Date: Thu Jan 12 21:27:39 2006
Subject: mailscanner f-prot wrapper
Message-ID: <mailman.4948.1137101259.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hello,
    I'm using f-prot for virus checking along with clamav. The clamav
wrapper worked fine, but when i tested the f-prot wrapper, this is on a
FreeBSD 5.3 box with mailscanner 4.3.5 i get the following:

shift: can't shift that many
shift: can't shift that many
find: illegal option -- t
find: illegal option -- y
find: illegal option -- p
find: illegal option -- e
find: f: No such file or directory

Any suggestions appreciated.
Dave.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Q.G.Campbell at NEWCASTLE.AC.UK  Mon Nov 22 07:43:50 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:39 2006
Subject: virtusertable...
Message-ID: <mailman.4949.1137101259.24926.mailscanner@lists.mailscanner.info>

Mark

The answer is "yes" to all your questions. I found all the information
that I needed in the O'Reilly "Sendmail" book and on the Sendmail web
site. 

Our mail relays host addresses in 40+ domains and deliver to many mail
servers. Some of the domains are handled via mailertable and the rest by
virtusertable which has 94,000+ address entries. We use the version of
Sendmail distributed with RedHat AS 3.

What I did was set up a development mail relay on an on old Linux box.
It does not have to be very powerful since it will not carry a
production mail load. You can experiment with what you learn from the
book and then develop and test a production configuration on this
system.  

Quentin 
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own." 

 


________________________________

        From: MailScanner mailing list
[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Mark Pottage
        Sent: 19 November 2004 16:53
        To: MAILSCANNER@JISCMAIL.AC.UK
        Subject: virtusertable...
	
	
        We have a situation where we want to divert messages on a user
basis to a different local server.
         
        Currently all mails to abc.com goto esmtp[192.168.1.1]  using
the mailertable database.
         
         
        We are looking at using virtusertable to divert mesasge destined
for:
         
        user1@abc.com to user1@wxyz.com
         
        Is it possible to use the mailertable and the virtusertable
alongside each other?
         
        Is this theory going to work with what we are planning?
         
         
        We use:
         
        SendMail
        MailScanner
        MailWatch
         
        many thanks
         
        Mark Pottage
        Systems Administrator
        Tel:       0870 411 7914
        Mobile:  07740 578 647
        Fax:       0870 163 9001
        mark.pottage@selection.co.uk

        -- 
        This message has been scanned for viruses and 
        dangerous content by Selection Services MailScanner
<http://www.selection.co.uk> , and is 
        believed to be clean.. ------------------------ MailScanner list
------------------------
        To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
        'leave mailscanner' in the body of the email.
        Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
        and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html). 
	
        Support MailScanner development - buy the book off the website! 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Q.G.Campbell at NEWCASTLE.AC.UK  Mon Nov 22 08:42:07 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:39 2006
Subject: Suggested phishing net tuning
Message-ID: <mailman.4950.1137101259.24926.mailscanner@lists.mailscanner.info>

>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>Sent: 20 November 2004 12:24
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Suggested phishing net tuning
>
>Quentin Campbell wrote:
>
>>Julian
>>
>>I have seen repeated examples of log entries similar to:
>>
>>Nov 19 05:21:10 cheviot5 MailScanner[14191]: Found phishing fraud from
>>orders@ebnerandsons.com claiming to be mailto:orders@ebnerandsons.com
>>
>>and
>>
>>Nov 19 05:30:34 cheviot5 MailScanner[14082]: Found phishing fraud from
>>www.airmileswineclub.co.uk?wine_11-04=true claiming to be
>>www.airmileswineclub.co.uk
>>
>>Why might it be dangerous to strip the prefixing "mailto:" in 
>the first
>>example
>>
>Sounds fair enough.
>
>> and the appended script & arguments in the second before doing the
>>comparison?
>>
>>
>I am wary of doing that as (a) there should be a / before the ? and (b)
>could the ? be part of a username or password passed to the http server
>which could therefore be used to evade the phishing net?

There must be enough expertise on this list which could help you here by
coming together to create an informed concensus on these sorts of
issues. Dean Liversidge has made a contribution already. What about the
rest of you helping Julian out too?

It looks like tuning the phishing detector code will be a complex and
ongoing task since there is so much broken HTML around that seems to be
tolerated by display systems.

The one thing I am sure about is that unless the false positive rate can
be significantly reduced the phishing detector will be unuseable at many
sites. I am under pressure to disable the feature here. I have tried to
reduce FPs where possible by using rulesets to exempt our sending
domains. In the end though it will have to be more sophisticated
parsing.

A suggestion I would like to make is to enable the "phishing net"
feature with one of 3 "risk" levels:

Level 1 would use your current, conservative, parsing. This means,
potentially, high rates of FPs because you would treat broken HTML as
risky and thus flag it. 

Level 2 more aggressive parsing to reduce FPs while minimising risks
(ie. Potential for FNs).

Level 3 very aggressive parsing which deals with a wide range of broken
HTML. Would make decisions which will reduce FPs to a minimum but at the
risk of allowing more FNs.


With my experience of the phishing net detector so far I would chose to
operate it at level 3. 

Thanks.

Quentin 
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own." 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From sambaiah at NMSWORKS.CO.IN  Mon Nov 22 08:49:51 2004
From: sambaiah at NMSWORKS.CO.IN (Kilaru Sambaiah)
Date: Thu Jan 12 21:27:39 2006
Subject: scanning forwarded mail
Message-ID: <mailman.4951.1137101259.24926.mailscanner@lists.mailscanner.info>

  Dear All,

     I have two email ids. I am forwarding with .forward from first id
     to second one. Mailscanner is running on second one. It is not
     recognizing spam in the forwarded mail. How do I enable it.


--

thanks and regards,
Sambaiah K

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From drew at THEMARSHALLS.CO.UK  Mon Nov 22 09:09:25 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:39 2006
Subject: mailscanner with postfix startup messages
Message-ID: <mailman.4952.1137101259.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Mon, November 22, 2004 0:16, dave said:
> Hello,
>     I'm trying to get mailscanner going with postfix. I have customized
> mailscanner.conf and made the other changes as per the howto. I am getting
> some strange messages in the maillog:
> "bogus file HOLD/razor-agent.log"
> That's coming from postfix postsuper when i start postfix. Checking
> /var/spool/postfix/hold there is indeed a file razor-agent.log. I do not
> know how this got here and would like to know if it's something i have to
> worry about or a config problem?

It comes from running Razor as the Postfix user (Which you have to do as
that is what MailScanner will use). You should remove this file and
configure Razor to log else where (In spam.assassin.prefs.conf).

> Next, i'm getting a message about
> spamassassin whitelist functionality, not sure what this is? I'm also
> getting a message "messages found but no hashed queue directories".

That is caused by the above log file. It will go if you remove it.

>     I'd also like to know if postfix-style virtual domains are also
> effected by this setup?

MailScanner makes no difference to virtual domains or local domains. It
just does it's job and lets Postfix worry about what is virual/ local and
how to make delivery.

HTH

Drew


--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Mon Nov 22 09:14:04 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:39 2006
Subject: mailscanner with postfix startup messages
Message-ID: <mailman.4953.1137101259.24926.mailscanner@lists.mailscanner.info>

Dave

this is because the home dir for postfix/MailScanner-user is being use
to store the 'working' files etc for other tools (razor in this case).

There maybe a config option that you can set in spam.assassin.prefs.org
where you can override this....

You can also turn off the auto-whitelist SA functionality as well (or
redirect the file where it holds this info) in the
spam.assassin.prefs.conf as well..

for a list of options you can put in the file see...

http://spamassassin.apache.org/doc.html

and select the version of SA you are using inthe POD section..

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


dave wrote:
> Hello,
>     I'm trying to get mailscanner going with postfix. I have customized
> mailscanner.conf and made the other changes as per the howto. I am getting
> some strange messages in the maillog:
> "bogus file HOLD/razor-agent.log"
> That's coming from postfix postsuper when i start postfix. Checking
> /var/spool/postfix/hold there is indeed a file razor-agent.log. I do not
> know how this got here and would like to know if it's something i have to
> worry about or a config problem? Next, i'm getting a message about
> spamassassin whitelist functionality, not sure what this is? I'm also
> getting a message "messages found but no hashed queue directories".
>     I'd also like to know if postfix-style virtual domains are also effected
> by this setup?
> Thanks.
> Dave.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Sun Nov 21 12:09:16 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:39 2006
Subject: zip-virus problems
Message-ID: <mailman.4954.1137101259.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Can you try the latest CVS build of ClamAV please. There are some known
problems with the reporting of viruses in some archives in 0.80.

Also, from your log entries your incoming work dir is /usr/varnew/.....
Is this really the path you put into MailScanner.conf. As the comments
in there make very clear, you *must* put in the *real* path name to the
directory, and not some path that gets their via symlinks.

Carl Wernhart - MailScannerAdm wrote:

>>-----Original Message-----
>>From: MailScanner mailing list
>>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Ugo Bellavance
>>Sent: Saturday, November 20, 2004 2:53 PM
>>To: MAILSCANNER@JISCMAIL.AC.UK
>>Subject: Re: [MAILSCANNER] zip-virus problems
>>
>>
>
>[...]
>
>
>
>>Could we see some log entries?
>>
>>
>
>sure!
>
>Nov 20 16:00:00 scanner sm-mta[21772]: iAKExxis021772:
>from=<carl.wernhart@acw.at>, size=31682, class=0, nrcpts=1,
>msgid=<419F5BE9.9030604@acw.at>, proto=ESMTP, daemon=MTA,
>relay=line210.acw.at [195.230.52.210]
>Nov 20 16:00:00 scanner sm-mta[21772]: iAKExxis021772:
>to=<carl@wernhart.priv.at>, delay=00:00:00, mailer=smtp, pri=61682,
>stat=queued
>Nov 20 16:00:00 scanner MailScanner[21372]: New Batch: Scanning 1 messages,
>32143 bytes
>Nov 20 16:00:00 scanner MailScanner[21372]: Spam Checks: Starting
>Nov 20 16:00:02 scanner MailScanner[21372]: Message iAKExxis021772 from
>195.230.52.210 (carl.wernhart@acw.at) to wernhart.priv.at is not spam,
>SpamAssassin (Wertung=-5.77, benoetigt 6, autolearn=not spam, ALL_TRUSTED
>-3.30, AWL 0.13, BAYES_00 -2.60)
>Nov 20 16:00:02 scanner MailScanner[21372]: Virus and Content Scanning:
>Starting
>Nov 20 16:00:04 scanner MailScanner[21372]:
>/usr/varnew/spool/MailScanner/incoming/21372/./iAKExxis021772/Informations.z
>ip: Worm.SomeFool.Z FOUND
>Nov 20 16:00:04 scanner MailScanner[21372]: Virus Scanning: ClamAV found 1
>infections
>Nov 20 16:00:04 scanner MailScanner[21372]: Infected message usr came from
>Nov 20 16:00:04 scanner MailScanner[21372]: Virus Scanning: Found 1 viruses
>Nov 20 16:00:04 scanner MailScanner[21372]: Filename Checks: Allowing
>iAKExxis021772 msg-21372-5.txt
>Nov 20 16:00:04 scanner MailScanner[21372]: Filename Checks: Allowing
>iAKExxis021772 Informations.zip
>Nov 20 16:00:04 scanner MailScanner[21372]: Filename Checks: Allowing
>iAKExxis021772 msg-21372-6.txt
>Nov 20 16:00:04 scanner MailScanner[21372]: Filename Checks: Allowing
>iAKExxis021772 msg-21372-7.txt
>Nov 20 16:00:04 scanner MailScanner[21372]: Filetype Checks: Allowing
>iAKExxis021772 msg-21372-6.txt
>Nov 20 16:00:04 scanner MailScanner[21372]: Filetype Checks: Allowing
>iAKExxis021772 msg-21372-7.txt
>Nov 20 16:00:04 scanner MailScanner[21372]: Filetype Checks: Allowing
>iAKExxis021772 msg-21372-5.txt
>Nov 20 16:00:04 scanner MailScanner[21372]: Filetype Checks: Allowing
>iAKExxis021772 Informations.zip
>Nov 20 16:00:04 scanner MailScanner[21372]: Uninfected: Delivered 1 messages
>Nov 20 16:00:05 scanner sendmail[21793]: iAKExxis021772:
>to=<carl@wernhart.priv.at>, delay=00:00:05, xdelay=00:00:01, mailer=smtp,
>pri=151682, relay=mail.wernhart.priv.at [217.116.177.18], dsn=2.0.0,
>stat=Sent (iAKF04v7032632 Message accepted for delivery)
>
>
> carl
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Sun Nov 21 12:12:41 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:39 2006
Subject: perhaps this is old news
Message-ID: <mailman.4955.1137101259.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Thanks for that. I will take a look. I suspect I need to change the
header-modifying code so that it changes all matching headers and not
just the first one. Will be slower though :-(

Robin, Rob wrote:

>All,
>
>        Just would like to share this. Perhaps this is old news.
>        I have a couple of spam 'creep through'. I checked the score, it's over 20. From my outlook client, the word '{Spam?}' did not appear ib the subject (and therefore not sorted to my suspected spam folder). I set my spam to be tagged. All others are tagged just fine.
>        After looking through the header, I realized that there are 2 'Subject' headers. Only the first one is tagged '{Spam?}.
>        This has sucesfully made my Outlook client to use only the second header and ignoring the tagged one (and thus not go into junk folder).
>        Not sure this is a new trick by spammers to bypass subject spam tagging mechanism. Or it's spammers' incidental bug. Or Outlook's handling of headers.
>        Below is the header if you are interested.
>        Time to add new rules to the mail client :-). How many customers I need to call for adding new rules if things continue like this...
>
>Regards,
>Rob Robin
>rrobin@greenpple.com
>
>
>
>Microsoft Mail Internet Headers Version 2.0
>Received: from mbox2.greenapple.com ([192.168.188.134]) by ex1.ex.greenapple.com with Microsoft SMTPSVC(5.0.2195.6713);
>         Sat, 20 Nov 2004 09:29:13 -0500
>Received: from mx3.greenapple.com (root@mx3.greenapple.com [198.144.72.52])
>        by mbox2.greenapple.com (8.12.11/8.12.11) with ESMTP id iAKET1k7016021
>        for <robin@mbox2.greenapple.com>; Sat, 20 Nov 2004 09:29:12 -0500 (EST)
>Received: from c-67-173-202-59.client.comcast.net (c-67-173-202-59.client.comcast.net [67.173.202.59])
>        by mx3.greenapple.com (8.12.11/8.12.11) with SMTP id iAKERMLZ020088;
>        Sat, 20 Nov 2004 09:27:51 -0500 (EST)
>Message-Id: <200411201427.iAKERMLZ020088@mx3.greenapple.com>
>Received: from chinesemail.org ([90.224.80.255]) by headway.belgique.com
>          (InterMail vK.4.04.00.00 413-142-933 license 4vt762vi9489s1og5s4dmc5794i5lcm6)
>          with ESMTP id <03261766537363.QOAZ921.amtrak@chinesemail.org>
>          for <robertp@greenapple.com>; Sat, 20 Nov 2004 16:27:18 +0200
>Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
>         Sat, 20 Nov 2004 07:30:18 -0700
>Received: from 144.128.126.130 by closeup.block.hotmail.msn.com with HTTP;
>        Sat, 20 Nov 2004 17:25:18 +0300 GMT
>X-Originating-IP: [144.0.240.228]
>X-Originating-Email: [correct@chinesemail.org]
>From: "Frances Shirley" <Caronvlf@mail.ru>
>To: robertp@greenapple.com
>Subject: {Spam?} RE : pain specialist on tuesday at 14-00
>Date: Sat, 20 Nov 2004 17:31:18 +0300
>Mime-Version: 1.0
>Received: from chinesemail.org ([35.8.168.232])
>          by headway.belgique.com
>          (InterMail vK.4.04.00.00 883-811-552 license 4vt762vi9489s1og5s4dmc5794i5lcm6)
>          with ESMTP id <61774162358055.TJJJ9488.headway.belgique.com>
>          for <robertp@greenapple.com>; Sat, 20 Nov 2004 08:25:18 -0600
>From: "Frances Shirley" <Caronvlf@mail.ru>
>To: "Robertp" <robertp@greenapple.com>
>Subject: RE : pain specialist on tuesday at 14-00
>Sender: "Frances Shirley" <Caronvlf@mail.ru>
>X-GreenApple-MailScanner-Information: Please contact the ISP for more information
>X-GreenApple-MailScanner: Found to be clean
>X-GreenApple-MailScanner-SpamCheck: spam, SpamAssassin (score=27.731,
>        required 9, autolearn=disabled, DRUGS_PAIN 0.01,
>        DRUGS_PAIN_OBFU 1.00, HELO_DYNAMIC_IPADDR 2.75, INVALID_TZ_GMT 0.64,
>        MSGID_FROM_MTA_HEADER 0.00, MSGID_FROM_MTA_ID 1.70,
>        RCVD_IN_BL_SPAMCOP_NET 1.83, RCVD_IN_DSBL 2.77,
>        RCVD_IN_NJABL_DUL 1.66, RCVD_IN_SORBS_DUL 0.14, RCVD_IN_XBL 2.51,
>        SARE_FREE_WEBM_RuMail 1.67, SARE_HTML_A_HIDE 1.16,
>        URIBL_OB_SURBL 3.00, URIBL_SBL 1.50, URIBL_SC_SURBL 3.90,
>        URIBL_WS_SURBL 1.50)
>X-GreenApple-MailScanner-SpamScore: sssssssssssssssssssssssssss
>X-MailScanner-From: caronvlf@mail.ru
>Return-Path: Caronvlf@mail.ru
>X-OriginalArrivalTime: 20 Nov 2004 14:29:13.0541 (UTC) FILETIME=[4EB7CF50:01C4CF0D]
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Sun Nov 21 12:11:25 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:39 2006
Subject: 255 retcodes in syslog
Message-ID: <mailman.4956.1137101259.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Can you change Log.pm line 140 to read
    Sys::Syslog::syslog($level, $_) if $_ ne "";
and tell me if this helps.

Jeff A. Earickson wrote:

> Julian,
>
>    What I already had in my 4.35.11 and the Message.pm file in 4.36.1
> were the same (cksum = 1930658726 166284).  Thinking that the syslog
> fix might have been someplace else in 4.36.1, I went ahead and upgraded
> to 4.36.1.  Still the same syslog complaint at the bottom of a debug
> run:
>
> syslog: expecting argument $format at
> /opt/MailScanner/lib/MailScanner/Log.pm line 140
> 255
>
> The entire debug output is 496KB.  The "MailScanner -v" output is
> attached.
>
> Jeff Earickson
> Colby College
>
> On Sat, 20 Nov 2004, Julian Field wrote:
>
>> Date: Sat, 20 Nov 2004 12:27:26 +0000
>> From: Julian Field <mailscanner@ECS.SOTON.AC.UK>
>> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>> To: MAILSCANNER@JISCMAIL.AC.UK
>> Subject: Re: 255 retcodes in syslog
>>
>> Please can you try the Message.pm from 4.36.1 as I fixed 1 syslog bug in
>> there.
>>
>> Jeff A. Earickson wrote:
>>
>>> Julian,
>>>
>>> Weirdness with 4.35.11 plus latest Message.pm; this may be the cause
>>> of my excess load.  I noticed a gob of the following in my syslogs
>>> over the last day or so:
>>>
>>> Nov 19 14:50:54 basalt <12>root: Process did not exit cleanly, returned
>>> 255 with signal 0
>>>
>>> I found a couple of tnef files in my /var/spool/mqueue that should not
>>> have been there.  I zapped them and ran MS in debug mode.  The end of
>>> that output said:
>>>
>>> syslog: expecting argument $format at
>>> /opt/MailScanner/lib/MailScanner/Log.pm line 140
>>> 255
>>>
>>> The "MailScanner -v" output is attached and I can send you the entire
>>> debug output if needed (518K).  The only other thing that I've done
>>> lately (yesterday) was install dccifd for DCC, which seems to work
>>> correctly.  I followed the MAQ, following the advice of:
>>>
>>> http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/312.html
>>>
>>> (Thanks Ugo and Tomar)
>>>
>>> Advice please?
>>>
>>> Jeff Earickson
>>> Colby College
>>>
>>> ------------------------ MailScanner list ------------------------
>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>> 'leave mailscanner' in the body of the email.
>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>> Support MailScanner development - buy the book off the website!
>>>
>>> ------------------------------------------------------------------------
>>>
>>>
>>> Running on
>>> SunOS basalt 5.9 Generic_117171-12 sun4u sparc SUNW,Netra-T12
>>> This is Perl version 5.008005 (5.8.5)
>>>
>>> This is MailScanner version 4.35.11
>>> Module versions are:
>>> 1.00   AnyDBM_File
>>> 1.14   Archive::Zip
>>> 1.03   Carp
>>> 1.119  Convert::BinHex
>>> 1.00   DirHandle
>>> 1.05   Fcntl
>>> 2.73   File::Basename
>>> 2.08   File::Copy
>>> 2.01   FileHandle
>>> 1.06   File::Path
>>> 0.14   File::Temp
>>> 1.27   HTML::Entities
>>> 3.36   HTML::Parser
>>> 2.28   HTML::TokeParser
>>> 1.21   IO
>>> 1.10   IO::File
>>> 1.123  IO::Pipe
>>> 3.05   MIME::Base64
>>> 5.415  MIME::Decoder
>>> 5.415  MIME::Decoder::UU
>>> 5.415  MIME::Head
>>> 5.415  MIME::Parser
>>> 3.03   MIME::QuotedPrint
>>> 5.415  MIME::Tools
>>> 0.10   Net::CIDR
>>> 1.08   POSIX
>>> 1.77   Socket
>>> 0.05   Sys::Syslog
>>> 1.02   Time::localtime
>>>
>>> Optional module versions are:
>>> 1.810  DB_File
>>> 1.08   Digest
>>> 1.01   Digest::HMAC
>>> 2.33   Digest::MD5
>>> 2.10   Digest::SHA1
>>> 0.44   Inline
>>> 0.12   Mail::ClamAV
>>> 3.000001       Mail::SpamAssassin
>>> 1.997  Mail::SPF::Query
>>> 0.15   Net::CIDR::Lite
>>> 0.48   Net::DNS
>>> missing        Net::LDAP
>>> 1.94   Parse::RecDescent
>>> 0.25   SAVI
>>> 1.2    Sys::Hostname::Long
>>> 2.42   Test::Harness
>>> 0.47   Test::Simple
>>> 1.95   Text::Balanced
>>> 1.35   URI
>>>
>>>
>>
>> --
>> Julian Field
>> www.MailScanner.info
>> Buy the MailScanner book at www.MailScanner.info/store
>> Professional Support Services at www.MailScanner.biz
>> MailScanner thanks transtec Computers for their support
>>
>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>> Support MailScanner development - buy the book off the website!
>>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
>------------------------------------------------------------------------
>
>Running on
>SunOS basalt 5.9 Generic_117171-12 sun4u sparc SUNW,Netra-T12
>This is Perl version 5.008005 (5.8.5)
>
>This is MailScanner version 4.36.1
>Module versions are:
>1.00   AnyDBM_File
>1.14   Archive::Zip
>1.03   Carp
>1.119  Convert::BinHex
>1.00   DirHandle
>1.05   Fcntl
>2.73   File::Basename
>2.08   File::Copy
>2.01   FileHandle
>1.06   File::Path
>0.14   File::Temp
>1.27   HTML::Entities
>3.36   HTML::Parser
>2.28   HTML::TokeParser
>1.21   IO
>1.10   IO::File
>1.123  IO::Pipe
>3.05   MIME::Base64
>5.415  MIME::Decoder
>5.415  MIME::Decoder::UU
>5.415  MIME::Head
>5.415  MIME::Parser
>3.03   MIME::QuotedPrint
>5.415  MIME::Tools
>0.10   Net::CIDR
>1.08   POSIX
>1.77   Socket
>0.05   Sys::Syslog
>1.02   Time::localtime
>
>Optional module versions are:
>1.810  DB_File
>1.08   Digest
>1.01   Digest::HMAC
>2.33   Digest::MD5
>2.10   Digest::SHA1
>0.44   Inline
>0.12   Mail::ClamAV
>3.000001       Mail::SpamAssassin
>1.997  Mail::SPF::Query
>0.15   Net::CIDR::Lite
>0.48   Net::DNS
>missing        Net::LDAP
>1.94   Parse::RecDescent
>0.25   SAVI
>1.2    Sys::Hostname::Long
>2.42   Test::Harness
>0.47   Test::Simple
>1.95   Text::Balanced
>1.35   URI
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Sun Nov 21 12:05:03 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:39 2006
Subject: Suggested phishing net tuning (more examples)
Message-ID: <mailman.4957.1137101259.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I have worked in checks for these and also for mailto links. Please keep
providing the feedback, this is by nature a very fuzzy matching system
and it will take time to perfect it.

Quentin Campbell wrote:

>Julian
>
>A difficult false positive example is:
>
>Nov 19 04:15:18 cheviot5 MailScanner[14191]: Found phishing fraud from
>support@pegasusworks.com?subject=unsubscriberequest for j.bloggs@ncl.ac.uk
>claiming to be emailsupport@pegasusworks.com
>
>Is it impossible to parse this safely before comparing the strings?
>
>A more common type of false positive is:
>
>Nov 19 05:51:14 cheviot5 MailScanner[14163]: Found phishing fraud from
>www.worldonaplate.com claiming to be worldonaplate.com
>
>I can see why you might be unwilling to remove the "www." from the actual
>link before doing the comparison but is it really that unsafe?
>
>What is a good and useful feature still has a false positive rate that is
>unacceptably high.
>
>Could your editing of the strings in the hypertext link be done more
>aggressively before comparison? I know this may risk a possible rise in
>the false negative rate but there are other detectors in MailScanner which
>you acknowledge have a non-zero false negative rate.
>
>I would be willing to see the false negative rate increase slightly in
>order to reduce the number of times we cry "wolf!"
>
>Quentin
>--
>PHONE: +44 191 222 8209     Computing Service, University of Newcastle
>FAX:   +44 191 222 8765     Newcastle upon Tyne, United Kingdom, NE1 7RU.
>-------------------------------------------------------------------------
>"Any opinions expressed above are mine. The University can get its own."
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Application/X-ZIP-COMPRESSED  54KB. ]
    [ Unable to print this part. ]


From martinh at SOLID-STATE-LOGIC.COM  Mon Nov 22 09:43:07 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:39 2006
Subject: Suggested phishing net tuning (more examples)
Message-ID: <mailman.4958.1137101259.24926.mailscanner@lists.mailscanner.info>

Julian

What version can this Message.pm be applied to?

Also I know it's a pain, but would a full beta be better so us users can
  track where we are..

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Julian Field wrote:
> I have worked in checks for these and also for mailto links. Please keep
> providing the feedback, this is by nature a very fuzzy matching system
> and it will take time to perfect it.
>
> Quentin Campbell wrote:
>
>> Julian
>>
>> A difficult false positive example is:
>>
>> Nov 19 04:15:18 cheviot5 MailScanner[14191]: Found phishing fraud from
>> support@pegasusworks.com?subject=unsubscriberequest for
>> j.bloggs@ncl.ac.uk
>> claiming to be emailsupport@pegasusworks.com
>>
>> Is it impossible to parse this safely before comparing the strings?
>>
>> A more common type of false positive is:
>>
>> Nov 19 05:51:14 cheviot5 MailScanner[14163]: Found phishing fraud from
>> www.worldonaplate.com claiming to be worldonaplate.com
>>
>> I can see why you might be unwilling to remove the "www." from the actual
>> link before doing the comparison but is it really that unsafe?
>>
>> What is a good and useful feature still has a false positive rate that is
>> unacceptably high.
>>
>> Could your editing of the strings in the hypertext link be done more
>> aggressively before comparison? I know this may risk a possible rise in
>> the false negative rate but there are other detectors in MailScanner
>> which
>> you acknowledge have a non-zero false negative rate.
>>
>> I would be willing to see the false negative rate increase slightly in
>> order to reduce the number of times we cry "wolf!"
>>
>> Quentin
>> --
>> PHONE: +44 191 222 8209     Computing Service, University of Newcastle
>> FAX:   +44 191 222 8765     Newcastle upon Tyne, United Kingdom, NE1 7RU.
>> -------------------------------------------------------------------------
>> "Any opinions expressed above are mine. The University can get its own."
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>> Support MailScanner development - buy the book off the website!
>>
>>
>>
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From m.sapsed at BANGOR.AC.UK  Mon Nov 22 10:07:44 2004
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:27:39 2006
Subject: Sophos Error
Message-ID: <mailman.4959.1137101259.24926.mailscanner@lists.mailscanner.info>

Hendrik den Hartog wrote:
> I've just installed the new sophosSAVI, so was keeping an eye
> on the logs to ensure all was well.
>
> This error was reported in the logs..
>
> SophosSAVI::ERROR:: The file passed for scanning represented part of
> a multi volume archive - the file cannot be scanned
>
> I've found one other reference to a similar Sophos error in the archives,
> but that didn't really explain the problem/a solution [if required?]
>
> I know it is a Sophos Error, but anyone know whether it can be attributed
> to the update?

It's not an error as in fault. It's an error in as much as Sophos can't
be sure that the file is ok, because it doesn't have access to all the
parts to reassemble it and check it properly.

By default, unless Sophos says the attachment is OK, MailScanner will
treat the content as malicious. If you're happy to permit these
attachments, even though you have no idea whether they're safe, you
could add some part of the error message to the allowed Sophos error
messages configuration entry.

Cheers,

Martin

--
Martin Sapsed            "I've got 8 little fingers and only 2 thumbs,
Microcomputer Support                      won't you leave me in peace
Information Services                        while I get the job done?"
University of Wales, Bangor             Chris Rea, "I'm working on it"

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Q.G.Campbell at NEWCASTLE.AC.UK  Mon Nov 22 11:23:22 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:39 2006
Subject: Testing Message.pm.041121
Message-ID: <mailman.4960.1137101259.24926.mailscanner@lists.mailscanner.info>

Julian

With the latest Message.pm the HTML tag

<a
href=3D"http://www.worldonaplate.com/session.html">worldonaplate.com</a>

is caught thus:

The Newcastle MailScanner has detected a possible 'phishing fraud'
attempt because there is a difference between the actual link
"www.worldonaplate.com" and what it claims to be worldonaplate.com  

The HTML tag

<a
href=3D"http://worldonaplate.com/session.html">www.worldonaplate.com</a>

is not flagged.

As I understood your comments that accompanied the latest Message.pm,
the first tag should also have been passed unflagged. The example to
which you responded and said you had fixed was of the first type of tag.

Quentin
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own."

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Mark.Pottage at SELECTION.CO.UK  Mon Nov 22 11:39:46 2004
From: Mark.Pottage at SELECTION.CO.UK (Mark Pottage)
Date: Thu Jan 12 21:27:39 2006
Subject: virtusertable...
Message-ID: <mailman.4961.1137101259.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Thanks for your reply.
 
We have no domains on this server.  This server is purely for relaying
services.  We want certain addresses to be converted as follows.
 
user1@abc.com to user1@wxyz.com
 
So that mail arriving for user1@abc.com is converted to user1@wxyz.com
and relayed to the wxyz.com server not abc.com server.
If this is what you are doing can you send us config for configuration
you have done?
Is there any other configuration changes to make other than
virtusertable?
We have checked that the below line is in the .mc file.
 
FEATURE(`virtusertable',`hash -o /etc/mail/virtusertable.db')dnl
 
The only other entry we have is user1@abc.com to user1@wxyz.com which is
in the virtusertable file.
 
 
 
 
many thanks
 
Mark Pottage
Systems Administrator
Tel:       0870 411 7914
Mobile:  07740 578 647
Fax:       0870 163 9001
mark.pottage@selection.co.uk


>>> Q.G.Campbell@NEWCASTLE.AC.UK 22/11/2004 07:43:50 >>>
Mark

The answer is "yes" to all your questions. I found all the information
that I needed in the O'Reilly "Sendmail" book and on the Sendmail web
site.

Our mail relays host addresses in 40+ domains and deliver to many mail
servers. Some of the domains are handled via mailertable and the rest by
virtusertable which has 94,000+ address entries. We use the version of
Sendmail distributed with RedHat AS 3.

What I did was set up a development mail relay on an on old Linux box.
It does not have to be very powerful since it will not carry a
production mail load. You can experiment with what you learn from the
book and then develop and test a production configuration on this
system. 

Quentin
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own."




________________________________

        From: MailScanner mailing list
[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Mark Pottage
        Sent: 19 November 2004 16:53
        To: MAILSCANNER@JISCMAIL.AC.UK
        Subject: virtusertable...
   
   
        We have a situation where we want to divert messages on a user
basis to a different local server.
        
        Currently all mails to abc.com goto esmtp[192.168.1.1]  using
the mailertable database.
        
        
        We are looking at using virtusertable to divert mesasge destined
for:
        
        user1@abc.com to user1@wxyz.com
        
        Is it possible to use the mailertable and the virtusertable
alongside each other?
        
        Is this theory going to work with what we are planning?
        
        
        We use:
        
        SendMail
        MailScanner
        MailWatch
        
        many thanks
        
        Mark Pottage
        Systems Administrator
        Tel:       0870 411 7914
        Mobile:  07740 578 647
        Fax:       0870 163 9001
        mark.pottage@selection.co.uk

        --
        This message has been scanned for viruses and
        dangerous content by Selection Services MailScanner
<http://www.selection.co.uk> , and is
        believed to be clean.. ------------------------ MailScanner list
------------------------
        To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
        'leave mailscanner' in the body of the email.
        Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
        and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html).
   
        Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

--
This message has been scanned for viruses and
dangerous content by Selection Services MailScanner, and is
believed to be clean.



--
This message has been scanned for viruses and
dangerous content by Selection Services MailScanner, and is
believed to be clean.. ------------------------ MailScanner list
------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Text/PLAIN (Name: "Mark Pottage.vcf")  20 lines. ]
    [ Unable to print this part. ]


From shrek-m at GMX.DE  Mon Nov 22 11:52:19 2004
From: shrek-m at GMX.DE (shrek-m@gmx.de)
Date: Thu Jan 12 21:27:39 2006
Subject: virtusertable...
Message-ID: <mailman.4962.1137101259.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Mark Pottage wrote:

> We have no domains on this server.  This server is purely for relaying
> services.  We want certain addresses to be converted as follows.
>
> user1@abc.com <mailto:user1@abc.com> to user1@wxyz.com
> <mailto:user1@wxyz.com>
>
> So that mail arriving for user1@abc.com <mailto:user1@abc.com> is
> converted to user1@wxyz.com <mailto:user1@wxyz.com> and relayed to the
> wxyz.com server not abc.com server.
> If this is what you are doing can you send us config for configuration
> you have done?
> Is there any other configuration changes to make other than virtusertable?
> We have checked that the below line is in the .mc file.
>
> FEATURE(`virtusertable',`hash -o /etc/mail/virtusertable.db')dnl
>
> The only other entry we have is user1@abc.com
> <mailto:user1@abc.com> to user1@wxyz.com <mailto:user1@wxyz.com> which
> is in the virtusertable file.


http://www.sendmail.org/m4/features.html
<virtusertable>


$ vi /usr/share/doc/sendmail/README.cf

# make -C /etc/mail

--
shrek-m

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Mark.Pottage at SELECTION.CO.UK  Mon Nov 22 11:58:10 2004
From: Mark.Pottage at SELECTION.CO.UK (Mark Pottage)
Date: Thu Jan 12 21:27:39 2006
Subject: virtusertable...
Message-ID: <mailman.4963.1137101259.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Further to the previous post.
 
We have seen discussions about adding the following line to enable
sendmail to look at thte local hosts/virtusertable.
 
I have not added this line, as I would like to know more about it first.
 
define(`SMTP_MAILER_FLAGS', `A')
 
Can anyone tell me if by adding this we can then add lines to
virtusertable. and they will be picked up?
 
many thanks
 
Mark Pottage
Systems Administrator
Tel:       0870 411 7914
Mobile:  07740 578 647
Fax:       0870 163 9001
mark.pottage@selection.co.uk

>>> Mark.Pottage@SELECTION.CO.UK 22/11/2004 11:39:46 >>>
Thanks for your reply.
 
We have no domains on this server.  This server is purely for relaying
services.  We want certain addresses to be converted as follows.
 
user1@abc.com to user1@wxyz.com
 
So that mail arriving for user1@abc.com is converted to user1@wxyz.com
and relayed to the wxyz.com server not abc.com server.
If this is what you are doing can you send us config for configuration
you have done?
Is there any other configuration changes to make other than
virtusertable?
We have checked that the below line is in the .mc file.
 
FEATURE(`virtusertable',`hash -o /etc/mail/virtusertable.db')dnl
 
The only other entry we have is user1@abc.com to user1@wxyz.com which is
in the virtusertable file.
 
 
 
 
many thanks
 
Mark Pottage
Systems Administrator
Tel:       0870 411 7914
Mobile:  07740 578 647
Fax:       0870 163 9001
mark.pottage@selection.co.uk


>>> Q.G.Campbell@NEWCASTLE.AC.UK 22/11/2004 07:43:50 >>>
Mark

The answer is "yes" to all your questions. I found all the information
that I needed in the O'Reilly "Sendmail" book and on the Sendmail web
site.

Our mail relays host addresses in 40+ domains and deliver to many mail
servers. Some of the domains are handled via mailertable and the rest by
virtusertable which has 94,000+ address entries. We use the version of
Sendmail distributed with RedHat AS 3.

What I did was set up a development mail relay on an on old Linux box.
It does not have to be very powerful since it will not carry a
production mail load. You can experiment with what you learn from the
book and then develop and test a production configuration on this
system. 

Quentin
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own."




________________________________

        From: MailScanner mailing list
[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Mark Pottage
        Sent: 19 November 2004 16:53
        To: MAILSCANNER@JISCMAIL.AC.UK
        Subject: virtusertable...
   
   
        We have a situation where we want to divert messages on a user
basis to a different local server.
        
        Currently all mails to abc.com goto esmtp[192.168.1.1]  using
the mailertable database.
        
        
        We are looking at using virtusertable to divert mesasge destined
for:
        
        user1@abc.com to user1@wxyz.com
        
        Is it possible to use the mailertable and the virtusertable
alongside each other?
        
        Is this theory going to work with what we are planning?
        
        
        We use:
        
        SendMail
        MailScanner
        MailWatch
        
        many thanks
        
        Mark Pottage
        Systems Administrator
        Tel:       0870 411 7914
        Mobile:  07740 578 647
        Fax:       0870 163 9001
        mark.pottage@selection.co.uk

        --
        This message has been scanned for viruses and
        dangerous content by Selection Services MailScanner
<http://www.selection.co.uk> , and is
        believed to be clean.. ------------------------ MailScanner list
------------------------
        To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
        'leave mailscanner' in the body of the email.
        Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
        and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html).
   
        Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

--
This message has been scanned for viruses and
dangerous content by Selection Services MailScanner, and is
believed to be clean.



--
This message has been scanned for viruses and
dangerous content by Selection Services MailScanner, and is
believed to be clean.. ------------------------ MailScanner list
------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

--
This message has been scanned for viruses and
dangerous content by Selection Services MailScanner, and is
believed to be clean.. ------------------------ MailScanner list
------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Text/PLAIN (Name: "Mark Pottage.vcf")  20 lines. ]
    [ Unable to print this part. ]


From shrek-m at GMX.DE  Mon Nov 22 12:10:21 2004
From: shrek-m at GMX.DE (shrek-m@gmx.de)
Date: Thu Jan 12 21:27:39 2006
Subject: virtusertable...
Message-ID: <mailman.4964.1137101259.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Mark Pottage wrote:

> Further to the previous post.
>
> We have seen discussions about adding the following line to enable
> sendmail to look at thte local hosts/virtusertable.
>
> I have not added this line, as I would like to know more about it first.
>
> define(`SMTP_MAILER_FLAGS', `A')
>
> Can anyone tell me if by adding this we can then add lines to
> virtusertable. and they will be picked up?



$ grep -i smtp_mailer /usr/share/doc/sendmail/README.cf
SMTP_MAILER_FLAGS       [undefined] Flags added to SMTP mailer.  Default
                        then SMTP_MAILER_FLAGS is used.
SMTP_MAILER_MAX         [undefined] The maximum size of messages that will
SMTP_MAILER_MAXMSGS     [undefined] If defined, the maximum number of
SMTP_MAILER_MAXRCPTS    [undefined] If defined, the maximum number of
SMTP_MAILER_ARGS        [TCP $h] The arguments passed to the smtp mailer.
ESMTP_MAILER_ARGS       [TCP $h] The arguments passed to the esmtp mailer.
DSMTP_MAILER_ARGS       [TCP $h] The arguments passed to the dsmtp mailer.
SMTP_MAILER_QGRP        [undefined] The queue group for the smtp mailer.
ESMTP_MAILER_QGRP       [undefined] The queue group for the esmtp mailer.
DSMTP_MAILER_QGRP       [undefined] The queue group for the dsmtp mailer.
SMTP_MAILER_CHARSET     [undefined] If defined, messages containing
8-bit data
confSMTP_MAILER         -               [esmtp] The mailer name used when


$ grep -i2 smtp_mailer_flags /usr/share/doc/sendmail/README.cf
                        be accepted by the usenet mailer.
USENET_MAILER_QGRP      [undefined] The queue group for the usenet mailer.
SMTP_MAILER_FLAGS       [undefined] Flags added to SMTP mailer.  Default
                        flags are `mDFMuX' for all SMTP-based mailers; the
                        "esmtp" mailer adds `a'; "smtp8" adds `8'; and
--
                        flags are `mDFMuX' for all SMTP-based mailers; the
                        relay mailer adds `a8'.  If this is not defined,
                        then SMTP_MAILER_FLAGS is used.
SMTP_MAILER_MAX         [undefined] The maximum size of messages that will
                        be transported using the smtp, smtp8, esmtp, or
dsmtp


--
shrek-m

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From clas at MAYER.SE  Mon Nov 22 12:02:54 2004
From: clas at MAYER.SE (Clas Mayer)
Date: Thu Jan 12 21:27:39 2006
Subject: mailscanner f-prot wrapper
Message-ID: <mailman.4965.1137101259.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi
what is the command you are trying to run?
./f-prot-wrapper ?
try

./f-prot-wrapper /usr/local/f-prot/ /tmp

/Clas


On Sun, 21 Nov 2004 22:33:19 -0500, dave wrote
> Hello,
>     I'm using f-prot for virus checking along with clamav. The clamav
> wrapper worked fine, but when i tested the f-prot wrapper, this is
> on a FreeBSD 5.3 box with mailscanner 4.3.5 i get the following:
>
> shift: can't shift that many
> shift: can't shift that many
> find: illegal option -- t
> find: illegal option -- y
> find: illegal option -- p
> find: illegal option -- e
> find: f: No such file or directory
>
> Any suggestions appreciated.
> Dave.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!


--
Open WebMail Project (http://openwebmail.org)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From DawsonA at CHESTERFIELD.AC.UK  Mon Nov 22 12:31:28 2004
From: DawsonA at CHESTERFIELD.AC.UK (Dawson, Alan)
Date: Thu Jan 12 21:27:39 2006
Subject: Messages sent with header only, SYSERR(root): readqf: cannot open
Message-ID: <mailman.4966.1137101259.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I'm seeing a few messages that seem to get sent twice, the first time with
only the header, then the full message later.

/var/log/mail shows entries like

Nov 22 12:20:28 charon sendmail[16998]: iAMCKBqG016952: SYSERR(root):
readqf: cannot open ./dfiAMCKBqG016952: No such file or directory


I've googled for this and found

http://www.talkroot.com/archivee/index.php/t-3023__SYSERR(root):_readqf:_can
not_open.html

which suggests some file locking issues

I'm running
Sendmail 8.12.10 from SuSE Linux 9.0

with MailScanner 4.35.11

I notice in the depths of the MailScanner.conf

# How to lock spool files.
# Don't set this unless you *know* you need to.
# For sendmail, it defaults to "flock".
# For sendmail 8.13 onwards, you will probably need to change it to posix.
# For Exim, it defaults to "posix".
# No other type is implemented.
Lock Type =


Do i "need to"  and how would I know ?

Any help appreciated
Alan Dawson
--
ICT Services

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From sylvain.phaneuf at IMSU.OXFORD.AC.UK  Mon Nov 22 12:43:00 2004
From: sylvain.phaneuf at IMSU.OXFORD.AC.UK (Sylvain Phaneuf)
Date: Thu Jan 12 21:27:39 2006
Subject: sophossavi
Message-ID: <mailman.4967.1137101259.24926.mailscanner@lists.mailscanner.info>

I have started using sophossavi this morning. Every now and then, I get
the following in the maillog file:

Nov 22 11:37:26 mailscan MailScanner[29415]: SophosSAVI::ERROR:: Sweep
could not proceed, the file was corrupted (538)::
./iAMBZv9T029593/letterXYZ.doc
Nov 22 11:37:26 mailscan MailScanner[29415]: SophosSAVI::ERROR:: Sweep
could not proceed, the file was corrupted (538)::
./iAMBZv9T029593/msg-29415-30.txt
Nov 22 11:37:26 mailscan MailScanner[29415]: SophosSAVI::ERROR:: Sweep
could not proceed, the file was corrupted (538)::
./iAMBZx9T029606/msg-29415-18.txt
Nov 22 11:37:27 mailscan MailScanner[29415]: Virus Scanning: SophosSAVI
found 3 infections

After a few minutes of starting MailScanner with sophossavi, messages
start accumulating in mqueue.in. They pile up there until I get very
nervous (>2000 messages), and restart MailScaner with the regullar
sophos. Sendmail looks OK when this happens.

using Sophos version 3.87, and SAVI perl module 0.25, MS 4.35.11.

Anything obvious comes to mind?

Sylvain


===========================================================
Sylvain Phaneuf --- Systems Manager   | phone : +44 (0)1865 221323
Clinical School Information Management Services Unit  (IMSU)
Medical Sciences Division
University of Oxford                                  |   email :
sylvain.phaneuf@imsu.ox.ac.uk
Room 3A25B John Radcliffe Hospital      |   fax :  +44 (0) 1865 221322
Oxford   OX3 9DU   England
===========================================================

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Q.G.Campbell at NEWCASTLE.AC.UK  Mon Nov 22 12:48:30 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:39 2006
Subject: virtusertable...
Message-ID: <mailman.4968.1137101259.24926.mailscanner@lists.mailscanner.info>

Mark

By "hosting" domains I meant that our mail gateways relay mail for 40+
domains, just as you want to do for a single domain. 

Shrek-m has given you some pointers. I would strongly urge you to follow
the advice I gave in my first reply:

1. Get the O'Reilly "Sendmail" book
2. Try things out on a small test mail gateway/relay

Once you are making progress with that you will find correspondence on
specific technical issues more readily provided and useful. 

I will send you off-line a copy of our sendmail.mc file.
 
Quentin 
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own." 

 


________________________________

        From: MailScanner mailing list
[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Mark Pottage
        Sent: 22 November 2004 11:40
        To: MAILSCANNER@JISCMAIL.AC.UK
        Subject: Re: virtusertable...
	
	
        Thanks for your reply.
         
        We have no domains on this server.  This server is purely for
relaying services.  We want certain addresses to be converted as
follows.
         
        user1@abc.com to user1@wxyz.com
         
        So that mail arriving for user1@abc.com is converted to
user1@wxyz.com and relayed to the wxyz.com server not abc.com server.
        If this is what you are doing can you send us config for
configuration you have done?
        Is there any other configuration changes to make other than
virtusertable?
        We have checked that the below line is in the .mc file.
         
        FEATURE(`virtusertable',`hash -o /etc/mail/virtusertable.db')dnl
         
        The only other entry we have is user1@abc.com to user1@wxyz.com
which is in the virtusertable file.
         
         
         
         
        many thanks
         
        Mark Pottage
        Systems Administrator
        Tel:       0870 411 7914
        Mobile:  07740 578 647
        Fax:       0870 163 9001
        mark.pottage@selection.co.uk


        >>> Q.G.Campbell@NEWCASTLE.AC.UK 22/11/2004 07:43:50 >>>
	
        Mark
	
        The answer is "yes" to all your questions. I found all the
information
        that I needed in the O'Reilly "Sendmail" book and on the
Sendmail web
        site. 
	
        Our mail relays host addresses in 40+ domains and deliver to
many mail
        servers. Some of the domains are handled via mailertable and the
rest by
        virtusertable which has 94,000+ address entries. We use the
version of
        Sendmail distributed with RedHat AS 3.
	
        What I did was set up a development mail relay on an on old
Linux box.
        It does not have to be very powerful since it will not carry a
        production mail load. You can experiment with what you learn
from the
        book and then develop and test a production configuration on
this
        system.  
	
        Quentin 
        ---
        PHONE: +44 191 222 8209    Information Systems and Services
(ISS),
                                   University of Newcastle,
                                   Newcastle upon Tyne,
        FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
	
------------------------------------------------------------------------
        "Any opinion expressed above is mine. The University can get its
own." 
	
	
	
	
        ________________________________
	
                From: MailScanner mailing list
        [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Mark Pottage
                Sent: 19 November 2004 16:53
                To: MAILSCANNER@JISCMAIL.AC.UK
                Subject: virtusertable...
            
            
                We have a situation where we want to divert messages on
a user
        basis to a different local server.
                 
                Currently all mails to abc.com goto esmtp[192.168.1.1]
using
        the mailertable database.
                 
                 
                We are looking at using virtusertable to divert mesasge
destined
        for:
                 
                user1@abc.com to user1@wxyz.com
                 
                Is it possible to use the mailertable and the
virtusertable
        alongside each other?
                 
                Is this theory going to work with what we are planning?
                 
                 
                We use:
                 
                SendMail
                MailScanner
                MailWatch
                 
                many thanks
                 
                Mark Pottage
                Systems Administrator
                Tel:       0870 411 7914
                Mobile:  07740 578 647
                Fax:       0870 163 9001
                mark.pottage@selection.co.uk
	
                -- 
                This message has been scanned for viruses and 
                dangerous content by Selection Services MailScanner
        <http://www.selection.co.uk> , and is 
                believed to be clean.. ------------------------
MailScanner list
        ------------------------
                To unsubscribe, email jiscmail@jiscmail.ac.uk with the
words:
                'leave mailscanner' in the body of the email.
                Before posting, read the MAQ
(http://www.mailscanner.biz/maq/)
                and the archives
        (http://www.jiscmail.ac.uk/lists/mailscanner.html). 
            
                Support MailScanner development - buy the book off the
website! 
	
        ------------------------ MailScanner list
------------------------
        To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
        'leave mailscanner' in the body of the email.
        Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and
        the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
	
        Support MailScanner development - buy the book off the website!
	
        -- 
        This message has been scanned for viruses and
        dangerous content by Selection Services MailScanner, and is
        believed to be clean.
	
	
	

        -- 
        This message has been scanned for viruses and 
        dangerous content by Selection Services MailScanner
<http://www.selection.co.uk> , and is 
        believed to be clean.. ------------------------ MailScanner list
------------------------
        To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
        'leave mailscanner' in the body of the email.
        Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
        and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html). 
	
        Support MailScanner development - buy the book off the website! 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Mon Nov 22 12:57:54 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:39 2006
Subject: sophossavi
Message-ID: <mailman.4969.1137101259.24926.mailscanner@lists.mailscanner.info>

Sylvain

make sure the following is set in MailScanner.conf

Allowed Sophos Error Messages = "corrupt", "format not supported"

Certain vesions of Sophos seem to have problems with PDF's, this gets
around the issue.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Sylvain Phaneuf wrote:
> I have started using sophossavi this morning. Every now and then, I get
> the following in the maillog file:
>
> Nov 22 11:37:26 mailscan MailScanner[29415]: SophosSAVI::ERROR:: Sweep
> could not proceed, the file was corrupted (538)::
> ./iAMBZv9T029593/letterXYZ.doc
> Nov 22 11:37:26 mailscan MailScanner[29415]: SophosSAVI::ERROR:: Sweep
> could not proceed, the file was corrupted (538)::
> ./iAMBZv9T029593/msg-29415-30.txt
> Nov 22 11:37:26 mailscan MailScanner[29415]: SophosSAVI::ERROR:: Sweep
> could not proceed, the file was corrupted (538)::
> ./iAMBZx9T029606/msg-29415-18.txt
> Nov 22 11:37:27 mailscan MailScanner[29415]: Virus Scanning: SophosSAVI
> found 3 infections
>
> After a few minutes of starting MailScanner with sophossavi, messages
> start accumulating in mqueue.in. They pile up there until I get very
> nervous (>2000 messages), and restart MailScaner with the regullar
> sophos. Sendmail looks OK when this happens.
>
> using Sophos version 3.87, and SAVI perl module 0.25, MS 4.35.11.
>
> Anything obvious comes to mind?
>
> Sylvain
>
>
> ===========================================================
> Sylvain Phaneuf --- Systems Manager   | phone : +44 (0)1865 221323
> Clinical School Information Management Services Unit  (IMSU)
> Medical Sciences Division
> University of Oxford                                  |   email :
> sylvain.phaneuf@imsu.ox.ac.uk
> Room 3A25B John Radcliffe Hospital      |   fax :  +44 (0) 1865 221322
> Oxford   OX3 9DU   England
> ===========================================================
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jaearick at COLBY.EDU  Mon Nov 22 13:00:56 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:39 2006
Subject: 255 retcodes in syslog
Message-ID: <mailman.4970.1137101259.24926.mailscanner@lists.mailscanner.info>

Julian,
    Yes, this change fixed the problem.  A debug run after this fix
ended with:

debug: bayes: 15435 untie-ing db_seen
debug: bayes: files locked, now unlocking lock
debug: unlock: 15435 unlocked /var/spool/spamassassin/bayes.mutex
Stopping now as you are debugging me.

The "root:" syslog message is now gone.  Thank you!  Now to try the
latest Message.pm that you posted yesterday...

Jeff Earickson
Colby College

On Sun, 21 Nov 2004, Julian Field wrote:

> Date: Sun, 21 Nov 2004 12:11:25 +0000
> From: Julian Field <mailscanner@ECS.SOTON.AC.UK>
> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: 255 retcodes in syslog
>
> Can you change Log.pm line 140 to read
>   Sys::Syslog::syslog($level, $_) if $_ ne "";
> and tell me if this helps.
>
> Jeff A. Earickson wrote:
>
>> Julian,
>>
>>    What I already had in my 4.35.11 and the Message.pm file in 4.36.1
>> were the same (cksum = 1930658726 166284).  Thinking that the syslog
>> fix might have been someplace else in 4.36.1, I went ahead and upgraded
>> to 4.36.1.  Still the same syslog complaint at the bottom of a debug
>> run:
>>
>> syslog: expecting argument $format at
>> /opt/MailScanner/lib/MailScanner/Log.pm line 140
>> 255
>>
>> The entire debug output is 496KB.  The "MailScanner -v" output is
>> attached.
>>
>> Jeff Earickson
>> Colby College
>>
>> On Sat, 20 Nov 2004, Julian Field wrote:
>>
>>> Date: Sat, 20 Nov 2004 12:27:26 +0000
>>> From: Julian Field <mailscanner@ECS.SOTON.AC.UK>
>>> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>> To: MAILSCANNER@JISCMAIL.AC.UK
>>> Subject: Re: 255 retcodes in syslog
>>>
>>> Please can you try the Message.pm from 4.36.1 as I fixed 1 syslog bug in
>>> there.
>>>
>>> Jeff A. Earickson wrote:
>>>
>>>> Julian,
>>>>
>>>> Weirdness with 4.35.11 plus latest Message.pm; this may be the cause
>>>> of my excess load.  I noticed a gob of the following in my syslogs
>>>> over the last day or so:
>>>>
>>>> Nov 19 14:50:54 basalt <12>root: Process did not exit cleanly, returned
>>>> 255 with signal 0
>>>>
>>>> I found a couple of tnef files in my /var/spool/mqueue that should not
>>>> have been there.  I zapped them and ran MS in debug mode.  The end of
>>>> that output said:
>>>>
>>>> syslog: expecting argument $format at
>>>> /opt/MailScanner/lib/MailScanner/Log.pm line 140
>>>> 255
>>>>
>>>> The "MailScanner -v" output is attached and I can send you the entire
>>>> debug output if needed (518K).  The only other thing that I've done
>>>> lately (yesterday) was install dccifd for DCC, which seems to work
>>>> correctly.  I followed the MAQ, following the advice of:
>>>>
>>>> http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/312.html
>>>>
>>>> (Thanks Ugo and Tomar)
>>>>
>>>> Advice please?
>>>>
>>>> Jeff Earickson
>>>> Colby College
>>>>
>>>> ------------------------ MailScanner list ------------------------
>>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>> 'leave mailscanner' in the body of the email.
>>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>
>>>> Support MailScanner development - buy the book off the website!
>>>>
>>>> ------------------------------------------------------------------------
>>>>
>>>>
>>>> Running on
>>>> SunOS basalt 5.9 Generic_117171-12 sun4u sparc SUNW,Netra-T12
>>>> This is Perl version 5.008005 (5.8.5)
>>>>
>>>> This is MailScanner version 4.35.11
>>>> Module versions are:
>>>> 1.00   AnyDBM_File
>>>> 1.14   Archive::Zip
>>>> 1.03   Carp
>>>> 1.119  Convert::BinHex
>>>> 1.00   DirHandle
>>>> 1.05   Fcntl
>>>> 2.73   File::Basename
>>>> 2.08   File::Copy
>>>> 2.01   FileHandle
>>>> 1.06   File::Path
>>>> 0.14   File::Temp
>>>> 1.27   HTML::Entities
>>>> 3.36   HTML::Parser
>>>> 2.28   HTML::TokeParser
>>>> 1.21   IO
>>>> 1.10   IO::File
>>>> 1.123  IO::Pipe
>>>> 3.05   MIME::Base64
>>>> 5.415  MIME::Decoder
>>>> 5.415  MIME::Decoder::UU
>>>> 5.415  MIME::Head
>>>> 5.415  MIME::Parser
>>>> 3.03   MIME::QuotedPrint
>>>> 5.415  MIME::Tools
>>>> 0.10   Net::CIDR
>>>> 1.08   POSIX
>>>> 1.77   Socket
>>>> 0.05   Sys::Syslog
>>>> 1.02   Time::localtime
>>>>
>>>> Optional module versions are:
>>>> 1.810  DB_File
>>>> 1.08   Digest
>>>> 1.01   Digest::HMAC
>>>> 2.33   Digest::MD5
>>>> 2.10   Digest::SHA1
>>>> 0.44   Inline
>>>> 0.12   Mail::ClamAV
>>>> 3.000001       Mail::SpamAssassin
>>>> 1.997  Mail::SPF::Query
>>>> 0.15   Net::CIDR::Lite
>>>> 0.48   Net::DNS
>>>> missing        Net::LDAP
>>>> 1.94   Parse::RecDescent
>>>> 0.25   SAVI
>>>> 1.2    Sys::Hostname::Long
>>>> 2.42   Test::Harness
>>>> 0.47   Test::Simple
>>>> 1.95   Text::Balanced
>>>> 1.35   URI
>>>>
>>>>
>>>
>>> --
>>> Julian Field
>>> www.MailScanner.info
>>> Buy the MailScanner book at www.MailScanner.info/store
>>> Professional Support Services at www.MailScanner.biz
>>> MailScanner thanks transtec Computers for their support
>>>
>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>>
>>> ------------------------ MailScanner list ------------------------
>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>> 'leave mailscanner' in the body of the email.
>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>> Support MailScanner development - buy the book off the website!
>>>
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>> Support MailScanner development - buy the book off the website!
>>
>> ------------------------------------------------------------------------
>>
>> Running on
>> SunOS basalt 5.9 Generic_117171-12 sun4u sparc SUNW,Netra-T12
>> This is Perl version 5.008005 (5.8.5)
>>
>> This is MailScanner version 4.36.1
>> Module versions are:
>> 1.00   AnyDBM_File
>> 1.14   Archive::Zip
>> 1.03   Carp
>> 1.119  Convert::BinHex
>> 1.00   DirHandle
>> 1.05   Fcntl
>> 2.73   File::Basename
>> 2.08   File::Copy
>> 2.01   FileHandle
>> 1.06   File::Path
>> 0.14   File::Temp
>> 1.27   HTML::Entities
>> 3.36   HTML::Parser
>> 2.28   HTML::TokeParser
>> 1.21   IO
>> 1.10   IO::File
>> 1.123  IO::Pipe
>> 3.05   MIME::Base64
>> 5.415  MIME::Decoder
>> 5.415  MIME::Decoder::UU
>> 5.415  MIME::Head
>> 5.415  MIME::Parser
>> 3.03   MIME::QuotedPrint
>> 5.415  MIME::Tools
>> 0.10   Net::CIDR
>> 1.08   POSIX
>> 1.77   Socket
>> 0.05   Sys::Syslog
>> 1.02   Time::localtime
>>
>> Optional module versions are:
>> 1.810  DB_File
>> 1.08   Digest
>> 1.01   Digest::HMAC
>> 2.33   Digest::MD5
>> 2.10   Digest::SHA1
>> 0.44   Inline
>> 0.12   Mail::ClamAV
>> 3.000001       Mail::SpamAssassin
>> 1.997  Mail::SPF::Query
>> 0.15   Net::CIDR::Lite
>> 0.48   Net::DNS
>> missing        Net::LDAP
>> 1.94   Parse::RecDescent
>> 0.25   SAVI
>> 1.2    Sys::Hostname::Long
>> 2.42   Test::Harness
>> 0.47   Test::Simple
>> 1.95   Text::Balanced
>> 1.35   URI
>>
>>
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ronaldj at NETXACTICS.CO.ZA  Mon Nov 22 13:10:29 2004
From: ronaldj at NETXACTICS.CO.ZA (Ronald James)
Date: Thu Jan 12 21:27:39 2006
Subject: sophossavi
Message-ID: <mailman.4971.1137101259.24926.mailscanner@lists.mailscanner.info>

Sure, but if you look at the error msgs, you will see that the msg it is
getting errors on are not pdf's. Am looking into this and trying to find a
solution.

Ronald James
NetXactics
Tel: +27 21 680-5069
Fax: +27 21 680-5011
http://www.netxactics.co.za
Sophos - protecting businesses against viruses and spam


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Martin Hepworth
Sent: 22 November 2004 02:58
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: sophossavi

Sylvain

make sure the following is set in MailScanner.conf

Allowed Sophos Error Messages = "corrupt", "format not supported"

Certain vesions of Sophos seem to have problems with PDF's, this gets
around the issue.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Sylvain Phaneuf wrote:
> I have started using sophossavi this morning. Every now and then, I get
> the following in the maillog file:
>
> Nov 22 11:37:26 mailscan MailScanner[29415]: SophosSAVI::ERROR:: Sweep
> could not proceed, the file was corrupted (538)::
> ./iAMBZv9T029593/letterXYZ.doc
> Nov 22 11:37:26 mailscan MailScanner[29415]: SophosSAVI::ERROR:: Sweep
> could not proceed, the file was corrupted (538)::
> ./iAMBZv9T029593/msg-29415-30.txt
> Nov 22 11:37:26 mailscan MailScanner[29415]: SophosSAVI::ERROR:: Sweep
> could not proceed, the file was corrupted (538)::
> ./iAMBZx9T029606/msg-29415-18.txt
> Nov 22 11:37:27 mailscan MailScanner[29415]: Virus Scanning: SophosSAVI
> found 3 infections
>
> After a few minutes of starting MailScanner with sophossavi, messages
> start accumulating in mqueue.in. They pile up there until I get very
> nervous (>2000 messages), and restart MailScaner with the regullar
> sophos. Sendmail looks OK when this happens.
>
> using Sophos version 3.87, and SAVI perl module 0.25, MS 4.35.11.
>
> Anything obvious comes to mind?
>
> Sylvain
>
>
> ===========================================================
> Sylvain Phaneuf --- Systems Manager   | phone : +44 (0)1865 221323
> Clinical School Information Management Services Unit  (IMSU)
> Medical Sciences Division
> University of Oxford                                  |   email :
> sylvain.phaneuf@imsu.ox.ac.uk
> Room 3A25B John Radcliffe Hospital      |   fax :  +44 (0) 1865 221322
> Oxford   OX3 9DU   England
> ===========================================================
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ronaldj at NETXACTICS.CO.ZA  Mon Nov 22 13:12:02 2004
From: ronaldj at NETXACTICS.CO.ZA (Ronald James)
Date: Thu Jan 12 21:27:39 2006
Subject: sophossavi
Message-ID: <mailman.4972.1137101259.24926.mailscanner@lists.mailscanner.info>

How many minutes is it before you have 2000 error msgs ?

Ronald James
NetXactics
Tel: +27 21 680-5069
Fax: +27 21 680-5011
http://www.netxactics.co.za
Sophos - protecting businesses against viruses and spam


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Sylvain Phaneuf
Sent: 22 November 2004 02:43
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: sophossavi

I have started using sophossavi this morning. Every now and then, I get
the following in the maillog file:

Nov 22 11:37:26 mailscan MailScanner[29415]: SophosSAVI::ERROR:: Sweep
could not proceed, the file was corrupted (538)::
./iAMBZv9T029593/letterXYZ.doc
Nov 22 11:37:26 mailscan MailScanner[29415]: SophosSAVI::ERROR:: Sweep
could not proceed, the file was corrupted (538)::
./iAMBZv9T029593/msg-29415-30.txt
Nov 22 11:37:26 mailscan MailScanner[29415]: SophosSAVI::ERROR:: Sweep
could not proceed, the file was corrupted (538)::
./iAMBZx9T029606/msg-29415-18.txt
Nov 22 11:37:27 mailscan MailScanner[29415]: Virus Scanning: SophosSAVI
found 3 infections

After a few minutes of starting MailScanner with sophossavi, messages
start accumulating in mqueue.in. They pile up there until I get very
nervous (>2000 messages), and restart MailScaner with the regullar
sophos. Sendmail looks OK when this happens.

using Sophos version 3.87, and SAVI perl module 0.25, MS 4.35.11.

Anything obvious comes to mind?

Sylvain


===========================================================
Sylvain Phaneuf --- Systems Manager   | phone : +44 (0)1865 221323
Clinical School Information Management Services Unit  (IMSU)
Medical Sciences Division
University of Oxford                                  |   email :
sylvain.phaneuf@imsu.ox.ac.uk
Room 3A25B John Radcliffe Hospital      |   fax :  +44 (0) 1865 221322
Oxford   OX3 9DU   England
===========================================================

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ugob at CAMO-ROUTE.COM  Mon Nov 22 13:47:15 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:39 2006
Subject: scanning forwarded mail
Message-ID: <mailman.4973.1137101259.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Kilaru Sambaiah wrote:
>   Dear All,
>
>      I have two email ids. I am forwarding with .forward from first id
>      to second one. Mailscanner is running on second one. It is not
>      recognizing spam in the forwarded mail. How do I enable it.
>
>

Maybe the server is in your whitelist?

> --
>
> thanks and regards,
> Sambaiah K
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From alex at nkpanama.com  Mon Nov 22 14:03:16 2004
From: alex at nkpanama.com (Alex Neuman van der Hans)
Date: Thu Jan 12 21:27:39 2006
Subject: Suggested phishing net tuning
Message-ID: <mailman.4974.1137101259.24926.mailscanner@lists.mailscanner.info>

There *is* a "Level 4" as well... Disable HTML! :D Seriously, though, I
don't get that many phishing e-mails so I don't have your experience in that
area, but I agree with you wholeheartedly.

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Quentin Campbell
Sent: Monday, November 22, 2004 3:42 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Suggested phishing net tuning

>-----Original Message-----
>From: MailScanner mailing list
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>Sent: 20 November 2004 12:24
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Suggested phishing net tuning
>
>Quentin Campbell wrote:
>
>>Julian
>>
>>I have seen repeated examples of log entries similar to:
>>
>>Nov 19 05:21:10 cheviot5 MailScanner[14191]: Found phishing fraud from
>>orders@ebnerandsons.com claiming to be mailto:orders@ebnerandsons.com
>>
>>and
>>
>>Nov 19 05:30:34 cheviot5 MailScanner[14082]: Found phishing fraud from
>>www.airmileswineclub.co.uk?wine_11-04=true claiming to be
>>www.airmileswineclub.co.uk
>>
>>Why might it be dangerous to strip the prefixing "mailto:" in
>the first
>>example
>>
>Sounds fair enough.
>
>> and the appended script & arguments in the second before doing the
>>comparison?
>>
>>
>I am wary of doing that as (a) there should be a / before the ? and (b)
>could the ? be part of a username or password passed to the http server
>which could therefore be used to evade the phishing net?

There must be enough expertise on this list which could help you here by
coming together to create an informed concensus on these sorts of issues.
Dean Liversidge has made a contribution already. What about the rest of you
helping Julian out too?

It looks like tuning the phishing detector code will be a complex and
ongoing task since there is so much broken HTML around that seems to be
tolerated by display systems.

The one thing I am sure about is that unless the false positive rate can be
significantly reduced the phishing detector will be unuseable at many sites.
I am under pressure to disable the feature here. I have tried to reduce FPs
where possible by using rulesets to exempt our sending domains. In the end
though it will have to be more sophisticated parsing.

A suggestion I would like to make is to enable the "phishing net"
feature with one of 3 "risk" levels:

Level 1 would use your current, conservative, parsing. This means,
potentially, high rates of FPs because you would treat broken HTML as risky
and thus flag it.

Level 2 more aggressive parsing to reduce FPs while minimising risks (ie.
Potential for FNs).

Level 3 very aggressive parsing which deals with a wide range of broken
HTML. Would make decisions which will reduce FPs to a minimum but at the
risk of allowing more FNs.


With my experience of the phishing net detector so far I would chose to
operate it at level 3.

Thanks.

Quentin
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own."

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From sylvain.phaneuf at IMSU.OXFORD.AC.UK  Mon Nov 22 14:14:19 2004
From: sylvain.phaneuf at IMSU.OXFORD.AC.UK (Sylvain Phaneuf)
Date: Thu Jan 12 21:27:39 2006
Subject: sophossavi
Message-ID: <mailman.4975.1137101259.24926.mailscanner@lists.mailscanner.info>

I already had
Allowed Sophos Error Messages = "corrupt"

Any idea about the messages that accumulate badly in mqueue.in?

Sylvain



>>> ronaldj@NETXACTICS.CO.ZA 22/11/2004 13:10:29 >>>
Sure, but if you look at the error msgs, you will see that the msg it
is
getting errors on are not pdf's. Am looking into this and trying to
find a
solution.

Ronald James
NetXactics
Tel: +27 21 680-5069
Fax: +27 21 680-5011
http://www.netxactics.co.za
Sophos - protecting businesses against viruses and spam


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf
Of Martin Hepworth
Sent: 22 November 2004 02:58
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: sophossavi

Sylvain

make sure the following is set in MailScanner.conf

Allowed Sophos Error Messages = "corrupt", "format not supported"

Certain vesions of Sophos seem to have problems with PDF's, this gets
around the issue.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Sylvain Phaneuf wrote:
> I have started using sophossavi this morning. Every now and then, I
get
> the following in the maillog file:
>
> Nov 22 11:37:26 mailscan MailScanner[29415]: SophosSAVI::ERROR::
Sweep
> could not proceed, the file was corrupted (538)::
> ./iAMBZv9T029593/letterXYZ.doc
> Nov 22 11:37:26 mailscan MailScanner[29415]: SophosSAVI::ERROR::
Sweep
> could not proceed, the file was corrupted (538)::
> ./iAMBZv9T029593/msg-29415-30.txt
> Nov 22 11:37:26 mailscan MailScanner[29415]: SophosSAVI::ERROR::
Sweep
> could not proceed, the file was corrupted (538)::
> ./iAMBZx9T029606/msg-29415-18.txt
> Nov 22 11:37:27 mailscan MailScanner[29415]: Virus Scanning:
SophosSAVI
> found 3 infections
>
> After a few minutes of starting MailScanner with sophossavi,
messages
> start accumulating in mqueue.in. They pile up there until I get very
> nervous (>2000 messages), and restart MailScaner with the regullar
> sophos. Sendmail looks OK when this happens.
>
> using Sophos version 3.87, and SAVI perl module 0.25, MS 4.35.11.
>
> Anything obvious comes to mind?
>
> Sylvain
>
>
> ===========================================================
> Sylvain Phaneuf --- Systems Manager   | phone : +44 (0)1865 221323
> Clinical School Information Management Services Unit  (IMSU)
> Medical Sciences Division
> University of Oxford                                  |   email :
> sylvain.phaneuf@imsu.ox.ac.uk
> Room 3A25B John Radcliffe Hospital      |   fax :  +44 (0) 1865
221322
> Oxford   OX3 9DU   England
> ===========================================================
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From sylvain.phaneuf at IMSU.OXFORD.AC.UK  Mon Nov 22 14:16:21 2004
From: sylvain.phaneuf at IMSU.OXFORD.AC.UK (Sylvain Phaneuf)
Date: Thu Jan 12 21:27:39 2006
Subject: sophossavi
Message-ID: <mailman.4976.1137101259.24926.mailscanner@lists.mailscanner.info>

>>> ronaldj@NETXACTICS.CO.ZA 22/11/2004 13:12:02 >>>
>>  How many minutes is it before you have 2000 error msgs ?

15 -20 minutes. But sorry, they are not error messages. They are
incoming messages waiteing to be processed by MS. Some mesages get
scanned, etc. But only a small number.


Sylvain





-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf
Of Sylvain Phaneuf
Sent: 22 November 2004 02:43
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: sophossavi

I have started using sophossavi this morning. Every now and then, I
get
the following in the maillog file:

Nov 22 11:37:26 mailscan MailScanner[29415]: SophosSAVI::ERROR:: Sweep
could not proceed, the file was corrupted (538)::
./iAMBZv9T029593/letterXYZ.doc
Nov 22 11:37:26 mailscan MailScanner[29415]: SophosSAVI::ERROR:: Sweep
could not proceed, the file was corrupted (538)::
./iAMBZv9T029593/msg-29415-30.txt
Nov 22 11:37:26 mailscan MailScanner[29415]: SophosSAVI::ERROR:: Sweep
could not proceed, the file was corrupted (538)::
./iAMBZx9T029606/msg-29415-18.txt
Nov 22 11:37:27 mailscan MailScanner[29415]: Virus Scanning:
SophosSAVI
found 3 infections

After a few minutes of starting MailScanner with sophossavi, messages
start accumulating in mqueue.in. They pile up there until I get very
nervous (>2000 messages), and restart MailScaner with the regullar
sophos. Sendmail looks OK when this happens.

using Sophos version 3.87, and SAVI perl module 0.25, MS 4.35.11.

Anything obvious comes to mind?

Sylvain


===========================================================
Sylvain Phaneuf --- Systems Manager   | phone : +44 (0)1865 221323
Clinical School Information Management Services Unit  (IMSU)
Medical Sciences Division
University of Oxford                                  |   email :
sylvain.phaneuf@imsu.ox.ac.uk
Room 3A25B John Radcliffe Hospital      |   fax :  +44 (0) 1865 221322
Oxford   OX3 9DU   England
===========================================================

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From david.weber at BACKBONESECURITY.COM  Mon Nov 22 14:25:45 2004
From: david.weber at BACKBONESECURITY.COM (David CM Weber)
Date: Thu Jan 12 21:27:39 2006
Subject: Foreign IP Address Rules
Message-ID: <mailman.4977.1137101259.24926.mailscanner@lists.mailscanner.info>

Just wondering if anyone out there has set up rules based on
Country-specific IP addresses.  For instance, my organization doesn't do
much (if any) work with foreign people.  So any remote server trying to
communicate from say China, would be given a particular score.

Obviously it would have to be international (depending on where you are
located (US, GB, China, etc..)).  Just looking, and hadn't found
anything.

--dw

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From alex at nkpanama.com  Mon Nov 22 14:31:31 2004
From: alex at nkpanama.com (Alex Neuman van der Hans)
Date: Thu Jan 12 21:27:39 2006
Subject: Foreign IP Address Rules
Message-ID: <mailman.4978.1137101259.24926.mailscanner@lists.mailscanner.info>

There are RBL's for that, look for "country rbl" on Google. Maybe you can
add a rule to spamassassin with a score.

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of David CM Weber
Sent: Monday, November 22, 2004 9:26 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Foreign IP Address Rules

Just wondering if anyone out there has set up rules based on
Country-specific IP addresses.  For instance, my organization doesn't do
much (if any) work with foreign people.  So any remote server trying to
communicate from say China, would be given a particular score.

Obviously it would have to be international (depending on where you are
located (US, GB, China, etc..)).  Just looking, and hadn't found anything.

--dw

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From miguelk at KONSULTEX.COM.BR  Mon Nov 22 14:52:23 2004
From: miguelk at KONSULTEX.COM.BR (Miguel Koren O'Brien de Lacy)
Date: Thu Jan 12 21:27:39 2006
Subject: Foreign IP Address Rules
Message-ID: <mailman.4979.1137101259.24926.mailscanner@lists.mailscanner.info>

David;

You might also try to use something like: 
http://ip-to-country.webhosting.info/ but I think this may be very hard 
to configure for the use you want.

Miguel

Alex Neuman van der Hans wrote:

>There are RBL's for that, look for "country rbl" on Google. Maybe you can
>add a rule to spamassassin with a score.
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
>Of David CM Weber
>Sent: Monday, November 22, 2004 9:26 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Foreign IP Address Rules
>
>Just wondering if anyone out there has set up rules based on
>Country-specific IP addresses.  For instance, my organization doesn't do
>much (if any) work with foreign people.  So any remote server trying to
>communicate from say China, would be given a particular score.
>
>Obviously it would have to be international (depending on where you are
>located (US, GB, China, etc..)).  Just looking, and hadn't found anything.
>
>--dw
>
>------------------------ MailScanner list ------------------------ To
>unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>  
>

-- 
Esta mensagem foi verificada pelo sistema de antivírus e
 acredita-se estar livre de perigo.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jaearick at COLBY.EDU  Mon Nov 22 15:04:08 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:39 2006
Subject: Foreign IP Address Rules
Message-ID: <mailman.4980.1137101259.24926.mailscanner@lists.mailscanner.info>

Hi,
    This may not be exactly what you are looking for, but see:

http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/239.html

to consider the IPBlock feature of MailScanner.  Set the block
settings to taste for your site.

Jeff Earickson
Colby College

On Mon, 22 Nov 2004, David CM Weber wrote:

> Date: Mon, 22 Nov 2004 09:25:45 -0500
> From: David CM Weber <david.weber@BACKBONESECURITY.COM>
> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Foreign IP Address Rules
>
> Just wondering if anyone out there has set up rules based on
> Country-specific IP addresses.  For instance, my organization doesn't do
> much (if any) work with foreign people.  So any remote server trying to
> communicate from say China, would be given a particular score.
>
> Obviously it would have to be international (depending on where you are
> located (US, GB, China, etc..)).  Just looking, and hadn't found
> anything.
>
> --dw
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From thorin at POLYNESIE-FR.COM  Mon Nov 22 15:07:45 2004
From: thorin at POLYNESIE-FR.COM (Thomas Rest)
Date: Thu Jan 12 21:27:39 2006
Subject: problem with new account on raq4
Message-ID: <mailman.4981.1137101259.24926.mailscanner@lists.mailscanner.info>

Hardware: Cobalt Raq4
Software: Sun Cobalt OS, Spamassassin 2.63, Mailscanner 4.29.7-1
Virus Scanners: f-prot
Volume: 300 messages/day

Hello,

I have problems with MailScanner on my Cobalt raq4:

as soon as I add new users and that I sending of the malls on those, I have
the message in the mailog &#8220;user unknow&#8221; all seems ok&#8230;
The old email accounts functions them!
If you need log or others, say to me which.
Thank you in advance for your assistance.

E.D.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Glenn.Steen at AP1.SE  Mon Nov 22 15:33:54 2004
From: Glenn.Steen at AP1.SE (Steen, Glenn)
Date: Thu Jan 12 21:27:39 2006
Subject: mailscanner with postfix startup messages
Message-ID: <mailman.4982.1137101259.24926.mailscanner@lists.mailscanner.info>

For me (when I had similar "errors" they were due to the ~postfix
directory not being writeable by the postfix user, so razor (and pyzor)
couldn't create their .razor (and .pyzor) directories respectively.
Simple fix is to do it for them with
mkdir ~postfix/.razor
mkdir ~postfix/.pyzor
chown postfix ~postfix/.razor ~postfix/.pyzor

For the SA error, if it is regarding ~postfix not being writable, it's
pretty much the same, and (as can be seen in the
/etc/MailScanner/MailScanner.conf file) can be worked around with
something like
#      mkdir /var/spool/MailScanner/spamassassin
#      chown postfix.postfix /var/spool/MailScanner/spamassassin
SpamAssassin User State Dir = /var/spool/MailScanner/spamassassin
.... (I also created a ~postfix/.spamassassin (owned by postfix too),
but that shouldn't be needed) Else you should listen to Martin et al:-).

-- Glenn

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of dave
Sent: den 22 november 2004 01:17
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: mailscanner with postfix startup messages


Hello,
    I'm trying to get mailscanner going with postfix. I have customized
mailscanner.conf and made the other changes as per the howto. I am
getting
some strange messages in the maillog:
"bogus file HOLD/razor-agent.log"
That's coming from postfix postsuper when i start postfix. Checking
/var/spool/postfix/hold there is indeed a file razor-agent.log. I do not
know how this got here and would like to know if it's something i have
to
worry about or a config problem? Next, i'm getting a message about
spamassassin whitelist functionality, not sure what this is? I'm also
getting a message "messages found but no hashed queue directories".
    I'd also like to know if postfix-style virtual domains are also
effected
by this setup?
Thanks.
Dave.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Steve.Swaney at FSL.COM  Mon Nov 22 15:37:23 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:39 2006
Subject: virtusertable...
Message-ID: <mailman.4983.1137101259.24926.mailscanner@lists.mailscanner.info>

Mark,

Can you setup a backend mail hub that will accept email for some users at
watchhog.net and I will configure the virtusertable to forward email to that
system for testing.

Is the MailWatch Database a bit smaller?

Thanks,

Steve Swaney

President

Fortress Systems Ltd.

www.fsl.com

 <mailto:steve.swaney@fsl.com> steve.swaney@fsl.com



  _____

From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Mark Pottage
Sent: Monday, November 22, 2004 6:40 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: virtusertable...



Thanks for your reply.



We have no domains on this server.  This server is purely for relaying
services.  We want certain addresses to be converted as follows.



user1@abc.com to user1@wxyz.com



So that mail arriving for user1@abc.com is converted to user1@wxyz.com and
relayed to the wxyz.com server not abc.com server.

If this is what you are doing can you send us config for configuration you
have done?

Is there any other configuration changes to make other than virtusertable?

We have checked that the below line is in the .mc file.



FEATURE(`virtusertable',`hash -o /etc/mail/virtusertable.db')dnl



The only other entry we have is user1@abc.com to user1@wxyz.com which is in
the virtusertable file.









many thanks



Mark Pottage
Systems Administrator
Tel:       0870 411 7914
Mobile:  07740 578 647
Fax:       0870 163 9001
mark.pottage@selection.co.uk



>>> Q.G.Campbell@NEWCASTLE.AC.UK 22/11/2004 07:43:50 >>>

Mark

The answer is "yes" to all your questions. I found all the information
that I needed in the O'Reilly "Sendmail" book and on the Sendmail web
site.

Our mail relays host addresses in 40+ domains and deliver to many mail
servers. Some of the domains are handled via mailertable and the rest by
virtusertable which has 94,000+ address entries. We use the version of
Sendmail distributed with RedHat AS 3.

What I did was set up a development mail relay on an on old Linux box.
It does not have to be very powerful since it will not carry a
production mail load. You can experiment with what you learn from the
book and then develop and test a production configuration on this
system.

Quentin
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own."




________________________________

        From: MailScanner mailing list

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!
From dmehler26 at WOH.RR.COM  Mon Nov 22 16:55:07 2004
From: dmehler26 at WOH.RR.COM (dave)
Date: Thu Jan 12 21:27:40 2006
Subject: mailscanner f-prot wrapper
Message-ID: <mailman.4984.1137101259.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi,
Thanks that command worked. Should i alter my startup files so that's how
they call f-prot?
Thanks.
Dave.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From prandal at HEREFORDSHIRE.GOV.UK  Mon Nov 22 17:31:31 2004
From: prandal at HEREFORDSHIRE.GOV.UK (Randal, Phil)
Date: Thu Jan 12 21:27:40 2006
Subject: .NET caught in the phish...
Message-ID: <mailman.4985.1137101260.24926.mailscanner@lists.mailscanner.info>


One of our users got this MailScanner message (and several more like it)
in an MSDN newsletter:

MailScanner has detected a possible fraud attempt from "blocked::http:"
claiming to be MailScanner has detected a possible fraud attempt from
"go.microsoft.com" claiming to be Windows Forms.NET Sample Applications:

I guess the ".NET" confuses the phishing code :-)  Running the latest
MailScanner beta.
 
Phil

----
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From clas at MAYER.SE  Mon Nov 22 17:42:35 2004
From: clas at MAYER.SE (Clas Mayer)
Date: Thu Jan 12 21:27:40 2006
Subject: mailscanner f-prot wrapper
Message-ID: <mailman.4986.1137101260.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi
I did not have to change anything for the f-prot wrapper. But i did have to
change the path to wget in the f-prot-autoupdate script to get it running
via cron and update-virus-scanners in there.

the line
$result = system("wget --output-document=$TempDir/$TmpFile --tries=3 " .

to
$result = system("/usr/local/bin/wget --output-document=$TempDir/$TmpFile --
tries=3 " .

This also on FreeBSD 5.3

/Clas

On Mon, 22 Nov 2004 11:55:07 -0500, dave wrote
> Hi,
> Thanks that command worked. Should i alter my startup files so
> that's how they call f-prot? Thanks. Dave.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!


--
Open WebMail Project (http://openwebmail.org)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From michele at BLACKNIGHTSOLUTIONS.COM  Mon Nov 22 17:48:21 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:40 2006
Subject: problem with new account on raq4
Message-ID: <mailman.4987.1137101260.24926.mailscanner@lists.mailscanner.info>

> Hardware: Cobalt Raq4
> Software: Sun Cobalt OS, Spamassassin 2.63, Mailscanner
> 4.29.7-1 Virus Scanners: f-prot
> Volume: 300 messages/day
>
> Hello,
>
> I have problems with MailScanner on my Cobalt raq4:
>
> as soon as I add new users and that I sending of the malls on
> those, I have the message in the mailog &#8220;user
> unknow&#8221; all seems ok&#8230; The old email accounts functions
> them! If you need log or others, say to me which.
> Thank you in advance for your assistance.
>

How did you install this?
Could you give us a few lines of your mail log?


Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
http://www.blacknight.ie/specialoffers.html

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jarenm at INTERWRX.COM  Mon Nov 22 17:41:45 2004
From: jarenm at INTERWRX.COM (Jaren Martineau)
Date: Thu Jan 12 21:27:40 2006
Subject: MailScannerWebBug
Message-ID: <mailman.4988.1137101260.24926.mailscanner@lists.mailscanner.info>

MailScanner is removing images that refer to scripts by rewriting the image
to the following:

<img src="MailScannerWebBug" width="1" height="1" alt="Web Bug" />

My question is this, I am using spam assassin and would like to add a rule
with a small score for all occurences of MailScannerWebBug in the rawbody
of the message. The problem is that the rule is not catching any messages.
I do know that the rule works, as I have resent the messages through
mailscanner and spamassassin a second time and spam assassin does see the
occurence of MailScannerWebBug the second time around. Is MailScanner
altering the message after it passes through spam assassin? Does anyone
have a recommendation on how I can score messages that have
MailScannerWebBug in them a little higher?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From michele at BLACKNIGHTSOLUTIONS.COM  Mon Nov 22 17:51:29 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:40 2006
Subject: .NET caught in the phish...
Message-ID: <mailman.4989.1137101260.24926.mailscanner@lists.mailscanner.info>

Randal, Phil wrote:


That's probably a good thing :)
Julian's code is protecting your users from MSDN!

Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
http://www.blacknight.ie/specialoffers.html

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From andy at TIRESWING.NET  Mon Nov 22 17:43:26 2004
From: andy at TIRESWING.NET (Andy Norris)
Date: Thu Jan 12 21:27:40 2006
Subject: Newbie! Whitelisting Newsletter
Message-ID: <mailman.4990.1137101260.24926.mailscanner@lists.mailscanner.info>

Follow-up...

Got the book last week, and have been reading it. I think I've solved the
issue we were having.

We're somewhat constrained by having Ensim on our web servers, but I'm
looking forward to learning what all we can build onto our system for
customizing per user / site regardless of the Ensim overhead. Eventually,
we plan to have a dedicated mail server machine. That day will be sweet.

Thanks very much for the pointer on the book, and I'm glad there's a book I
can turn to with a run-down of all the options!

Have a great week, all,

Andy Norris
TireSwing Systems, Inc.


At 08:19 am 2004-11-11, you wrote:
>Andy Norris wrote:
>>Thanks again. I should have the book within "1-5 business days". :-)
>
>Wow, this is the kind of attitude I like.  You'll be glad of your
>decision :).
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jd at BENTECMED.COM  Mon Nov 22 18:16:37 2004
From: jd at BENTECMED.COM (JD)
Date: Thu Jan 12 21:27:40 2006
Subject: creating rules
Message-ID: <mailman.4991.1137101260.24926.mailscanner@lists.mailscanner.info>

Can someone direct me to information on the website that explains
mailscanner rules? Im trying to block mail going to certain addresses. And
if possible allow email only to certain addresses.

-JD

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From alex at nkpanama.com  Mon Nov 22 18:12:21 2004
From: alex at nkpanama.com (Alex Neuman van der Hans)
Date: Thu Jan 12 21:27:40 2006
Subject: creating rules
Message-ID: <mailman.4992.1137101260.24926.mailscanner@lists.mailscanner.info>

http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/230.html
http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/207.html

They're both in the MAQ/FAQ, which are at the bottom of every message.

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of JD
Sent: Monday, November 22, 2004 1:17 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: creating rules

Can someone direct me to information on the website that explains
mailscanner rules? Im trying to block mail going to certain addresses. And
if possible allow email only to certain addresses.

-JD

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Kevin_Miller at CI.JUNEAU.AK.US  Mon Nov 22 18:31:36 2004
From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller)
Date: Thu Jan 12 21:27:40 2006
Subject: zip-virus problems
Message-ID: <mailman.4993.1137101260.24926.mailscanner@lists.mailscanner.info>

Julian Field wrote:
> Can you try the latest CVS build of ClamAV please. There are some
> known problems with the reporting of viruses in some archives in 0.80.
>

LOL.  I just upgraded one of my mail servers to 0.80 from .75-?  Did I just
shoot myself in the foot, or am I still better off than I was?  Haven't
played w/CVS yet.  It being a Monday, I wasn't feeling to ambitious, but if
this old dog has to learn a new trick, then I guess that's fate...


...Kevin
--
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Admin., Mail Admin.
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Denis.Beauchemin at USHERBROOKE.CA  Mon Nov 22 18:36:36 2004
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:27:40 2006
Subject: perhaps this is old news
Message-ID: <mailman.4994.1137101260.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Robin, Rob wrote:

>All,
>
>        Just would like to share this. Perhaps this is old news.
>        I have a couple of spam 'creep through'. I checked the score, it's over 20. From my outlook client, the word '{Spam?}' did not appear ib the subject (and therefore not sorted to my suspected spam folder). I set my spam to be tagged. All others are tagged just fine.
>        After looking through the header, I realized that there are 2 'Subject' headers. Only the first one is tagged '{Spam?}.
>        This has sucesfully made my Outlook client to use only the second header and ignoring the tagged one (and thus not go into junk folder).
>        Not sure this is a new trick by spammers to bypass subject spam tagging mechanism. Or it's spammers' incidental bug. Or Outlook's handling of headers.
>        Below is the header if you are interested.
>        Time to add new rules to the mail client :-). How many customers I need to call for adding new rules if things continue like this...
>  
>
The same thing happened to me this morning but the email had been moved 
to my spam folder by my Sieve rule on our Cyrus mail server.

Thunderbird 0.9 showed the 2nd Subject tag in the message list pane (the 
one without MS's spam warning) but it used the 1st Subject tag in the 
message view pane!!!

Denis

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From paddy at PANICI.NET  Mon Nov 22 18:59:15 2004
From: paddy at PANICI.NET (paddy)
Date: Thu Jan 12 21:27:40 2006
Subject: CustomFunction: WhiteListFutureSender
Message-ID: <mailman.4995.1137101260.24926.mailscanner@lists.mailscanner.info>

Hi,

I just knocked this up, and I thought maybe it might be worth sharing.
There's not a lot to it really (and what there is is largely
cut'n'paste from the existing examples).

The idea is to whitelist recipients of outgoing mail from known
(client) relays, for return mail.  When such an outgoing mail is
detected the value "<sender_ip>,<recipient>" is stored as the key in
a tied hash along with a value that can be increased by subsequent
hits, and aged by a cron job.  Probably +=1 is not what I'll end up
doing, but since I don't yet have a strategy, I've kept it simple.

No doubt, even in a snippet of code this size I've left some bugs.

!!! Caveat, Administrator !!!

That said, this is for 'Is Definitely Not Spam'.  I'm thinking
of trying to pick up the whitelist inside spamassassin for a
weighting instead.  And I can think of a lot more that could be done.

Incidentally, Julian, is there a simple way to hook a chain of
custom functions together?   Suppose there are several unrelated
CustomFunctions I wish to run at 'Always Last' can I write something
like:

Always Looked-up Last = &CF1, &CF2, &CF3

Many thanks to Steve who pointed out sender-milter to me, which
does this almost as an afterthought but also a lot of cool stuff,
and Julian for MailScanner and superhuman support.

Praise, questions, comments, corrections, flames, whatever, all welcome.

Regards,
Paddy

%><----MIME WHAT'S THAT?-----

package MailScanner::CustomConfig;

use FileHandle;
BEGIN { @AnyDBM_File::ISA = qw(DB_File GDBM_File NDBM_File SDBM_File) }
use AnyDBM_File;

my $LockFile =  '/etc/MailScanner/wlfs.lock';
my $DB =        '/etc/MailScanner/wlfs.db';
my %wlfs_senders;

sub InitWLFS {

        MailScanner::Log::InfoLog("InitWLFS");

        my $fh = new FileHandle;
        unless ($fh->open('/etc/MailScanner/wlfs_senders')) {
                MailScanner::Log::WarnLog("Could not read wlfs_senders");
                return;
        }
        while(<$fh>) {
                chomp;
                s/#.*$//;     # Remove comments
                s/\s+$//;     # and trailing whitespace
                s/^\s+//;     # and leading whitespace
                next if /^$/; # and blank lines
                # maybe check this is a valid ip address here ?
                MailScanner::Log::InfoLog("InitWLFS: %s", $_);
                $wlfs_senders{$_} = 1;
        }
}

sub EndWLFS {
        MailScanner::Log::InfoLog("EndWLFS");
}

sub WLFS {
my($message) = @_;

        my $LockFileH = new FileHandle;
        WLFSopenlock($LockFileH, ">$LockFile");

        my %List;
        unless (tie %List, "AnyDBM_File", $DB, O_RDWR|O_CREAT, 0644) {
                print "wlfs: Could not open/create %s", $DBF;
                WLFSunlockclose($LockFileH);
                return 0;
        }

        my $id = $message->{id};  # just for the logging, below
        my $ip = $message->{clientip};
        if ($wlfs_senders{$ip}) {
                # add recipients to the whitelist
                for $r (@{$message->{to}}){
                        MailScanner::Log::InfoLog("WLFS: %s : %s", $id, $r);
                        $List{"$ip,$r"} += 1 ;
                }
        }
        $f = $message->{from};
        $l = $List{"$ip,$f"};

        untie %List;
        WLFSunlockclose($LockFileH);

        return 1 if $l>1;
        return 0;
}

sub WLFSopenlock {
my($fh, $fn) = @_;

        if (open($fh, $fn)) {
                flock($fh, LOCK_EX);
        } else {
                print "Could not open file $fn: %s", $!;
        }
}

sub WLFSunlockclose {
my($fh) = @_;

        flock($fh, LOCK_UN);
        close ($fh);
}

1;
%><----

--
Perl 6 will give you the big knob. -- Larry Wall

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From andy at TIRESWING.NET  Mon Nov 22 18:50:32 2004
From: andy at TIRESWING.NET (Andy Norris)
Date: Thu Jan 12 21:27:40 2006
Subject: Releasing messages from Quarantine
Message-ID: <mailman.4996.1137101260.24926.mailscanner@lists.mailscanner.info>

Hi All,

I have looked over the book and Googled. Please let me know how to release
an email from quarantine. Is there a fancy way to do it, or do I just
forward the mail on to the user as email from me (root)? This is a
".com.pdf" file, and was caught in the filename test. I don't want to read
anyone's mail!

If it's a matter of just dropping the directory inside the quarantine
(three files -- header, body, attachment) into the outgoing queue... has
anyone build tools to help them automate this? Or even let the end user
release them? I can do that, just wanted to know if possible.

Thanks very much!

Andy Norris

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From harryh at CET.COM  Mon Nov 22 19:01:19 2004
From: harryh at CET.COM (Harry Hanson)
Date: Thu Jan 12 21:27:40 2006
Subject: mailscanner with postfix startup messages
Message-ID: <mailman.4997.1137101260.24926.mailscanner@lists.mailscanner.info>

Setup is postfix/mailscanner/sa used as a gateway. I seem to have an issue
with some messages getting a "hold: header Received:", being requeued then
basically "sitting" there, not being delivered.

Can any one explain to me what the "hold: header Received:" indicates and
what causes it?

Also, the "qmail 34926 invoked by uid 60001" entry has me perplexed. Where
did that come from?


Relevant logs below:

Nov 22 09:17:29 mx01 postfix/cleanup[26258]: DE30C84593:
message-id=<20041122171049.34917.qmail@web42001.mail.yahoo.com>

Nov 22 09:17:32 mx01 postfix/cleanup[26258]: DE30C84593: hold: header
Received: from [206.63.225.15] by web42001.mail.yahoo.com via HTTP; Mon, 22
Nov 2004 09:10:49 PST from web42001.mail.yahoo.com[66.218.93.169];
from=<ranavor@yahoo.com> to=<fco@cet.com> proto=SMTP
helo=<web42001.mail.yahoo.com>

Nov 22 09:18:08 mx01 MailScanner[15809]: Requeue: DE30C84593 to D3086840AB

Nov 22 09:25:41 mx01 postfix/qmgr[6406]: D3086840AB:
from=<ranavor@yahoo.com>, size=1713, nrcpt=1 (queue active)

Nov 22 09:17:25 mx01 postfix/cleanup[26258]: DE30C84593: hold: header
Received: (qmail 34926 invoked by uid 60001); 22 Nov 2004 17:10:49 -0000
from web42001.mail.yahoo.com[66.218.93.169]; from=<ranavor@yahoo.com>
to=<fco@cet.com> proto=SMTP helo=<web42001.mail.yahoo.com>

Nov 22 09:17:29 mx01 postfix/cleanup[26258]: DE30C84593:
message-id=<20041122171049.34917.qmail@web42001.mail.yahoo.com>

Nov 22 09:17:32 mx01 postfix/cleanup[26258]: DE30C84593: hold: header
Received: from [206.63.225.15] by web42001.mail.yahoo.com via HTTP; Mon, 22
Nov 2004 09:10:49 PST from web42001.mail.yahoo.com[66.218.93.169];
from=<ranavor@yahoo.com> to=<fco@cet.com> proto=SMTP
helo=<web42001.mail.yahoo.com>

Nov 22 09:18:08 mx01 MailScanner[15809]: Requeue: DE30C84593 to D3086840AB

Nov 22 09:25:41 mx01 postfix/qmgr[6406]: D3086840AB:
from=<ranavor@yahoo.com>, size=1713, nrcpt=1 (queue active)


---
[This E-mail scanned for viruses]

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Steve.Swaney at FSL.COM  Mon Nov 22 19:16:32 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:40 2006
Subject: creating rules
Message-ID: <mailman.4998.1137101260.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of JD
> Sent: Monday, November 22, 2004 1:17 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: creating rules
>
> Can someone direct me to information on the website that explains
> mailscanner rules? Im trying to block mail going to certain addresses. And
> if possible allow email only to certain addresses.
>

Try downloading the free MailScanner Manual;

http://www.fsl.com/support

Or better yet there is even more information in the book,

Support MailScanner development - buy the book off the website!

http://www.cafepress.com/cp/store.aspx?s=mailscanner,mailscanner2

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> Fortress Systems Ltd.
> www.fsl.com
>



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Steve.Swaney at FSL.COM  Mon Nov 22 19:36:37 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:40 2006
Subject: Releasing messages from Quarantine
Message-ID: <mailman.4999.1137101260.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Andy Norris
> Sent: Monday, November 22, 2004 1:51 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Releasing messages from Quarantine
>
> Hi All,
>
> I have looked over the book and Googled. Please let me know how to release
> an email from quarantine. Is there a fancy way to do it, or do I just
> forward the mail on to the user as email from me (root)? This is a
> ".com.pdf" file, and was caught in the filename test. I don't want to read
> anyone's mail!
>
> If it's a matter of just dropping the directory inside the quarantine
> (three files -- header, body, attachment) into the outgoing queue... has
> anyone build tools to help them automate this? Or even let the end user
> release them? I can do that, just wanted to know if possible.
>
> Thanks very much!
>
> Andy Norris
>

Andy,

You can download some skeleton example code that sends specified users a
list of the spam they have in quarantine from:

        wget http://www.fsl.com/support/QuarantineReport.tar.gz

I will show you how to setup links that view and release the messages from
quarantine.

Beware - it was designed for internal web use only and should not be used on
a webserver that is open to the outside world.

Hope this helps,

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com

> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> Fortress Systems Ltd.
> www.fsl.com
>



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From cslyon at QXZI.NET  Mon Nov 22 19:46:16 2004
From: cslyon at QXZI.NET (Chris Lyon)
Date: Thu Jan 12 21:27:40 2006
Subject: Whitelist or change the score for a specific subject
Message-ID: <mailman.5000.1137101260.24926.mailscanner@lists.mailscanner.info>

Is there any way to raise the score or absolute whitelist a given subject
for ever being tagged as SPAM?


Example:

/Resume Submit from Monster.com/

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From campbell at cnpapers.com  Mon Nov 22 19:57:40 2004
From: campbell at cnpapers.com (Steve Campbell)
Date: Thu Jan 12 21:27:40 2006
Subject: SA 3.0.1 Install failure questions
Message-ID: <mailman.5001.1137101260.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I realize this has been asked a _lot_ lately, but searching through my own
saved archives and that on the list doesn't seem to get me anywhere.

I am upgrading MS and SA today. I piddled through the MS  pretty well. I had
to force the normal MIME stuff to install and all was well there.  I then
tried the SA install using the INSTALL-rpm.sh thing. I ran into the db4
stuff, and install them as listed by Steve Swaney. I then reran the script
to install. All appeared to be going well, until the very end, when it
started saying that the install was conflicting with the 2.63 install that I
already had installed. Upon looking at my system. 2.63 is still there.

I am running on Tao Linux. Does anyone have any experience with this
happening. I have always installed from SRC rpms when installing SA. Do
these not exist anywhere any more?

Thanks for any help.

Steve Campbell
campbell@cnpapers.com
Charleston Newspapers

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Denis.Beauchemin at USHERBROOKE.CA  Mon Nov 22 20:00:03 2004
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:27:40 2006
Subject: Whitelist or change the score for a specific subject
Message-ID: <mailman.5002.1137101260.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Chris Lyon wrote:

>Is there any way to raise the score or absolute whitelist a given subject
>for ever being tagged as SPAM?
>
>
>Example:
>
>/Resume Submit from Monster.com/
>  
>
Chris,

Put the following in spam.assassin.prefs.conf:
describe QXZI_01 Don't whitelist monster.com
header   QXZI_01 Subject =~ /Resume Submit from Monster\.com/i
score    QXZI_01 -100

Then reload MS.

Denis
PS: the message still could be tagged as spam if some RBL kicks in 
inside MS (see Spam List =) in MailScanner.conf.

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From VBoulytchev at COINFOTECH.COM  Mon Nov 22 20:00:21 2004
From: VBoulytchev at COINFOTECH.COM (Vasiliy Boulytchev)
Date: Thu Jan 12 21:27:40 2006
Subject: unsubscribe
Message-ID: <mailman.5003.1137101260.24926.mailscanner@lists.mailscanner.info>

 
^@ ------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From mkettler at EVI-INC.COM  Mon Nov 22 20:04:52 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:40 2006
Subject: Whitelist or change the score for a specific subject
Message-ID: <mailman.5004.1137101260.24926.mailscanner@lists.mailscanner.info>

At 02:46 PM 11/22/2004, Chris Lyon wrote:
>Is there any way to raise the score or absolute whitelist a given subject
>for ever being tagged as SPAM?
>
>
>Example:
>
>/Resume Submit from Monster.com/

you could do a quick SA rule:

header MONSTER_RES      Subject =~ /Resume Submit from Monster\.com/i
score MONSTER_RES               -1.0

(adjust the score value to your liking after some testing).

Under MailScanner you can put it into spam.assassin.prefs.conf, but I tend
to prefer making .cf files in /etc/mail/spamassassin.

I might put the above in something like /etc/mail/spamassassin/efp_correct.cf.

Be sure to run a spamassassin --lint to check for errors, and then a
service MailScanner reload.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From campbell at cnpapers.com  Mon Nov 22 20:27:33 2004
From: campbell at cnpapers.com (Steve Campbell)
Date: Thu Jan 12 21:27:40 2006
Subject: SA 3.0.1 Install failure questions
Message-ID: <mailman.5005.1137101260.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Let me ask this question also:

It looks like the tarball might be the solution to this, as I read all of
the old "RPM-based install package for ClamAV and SA 3" thread and saw no
definite answer. I saw a lot of different questions asked, but no real
solutions.

If I "rpm -e" my old spamassassin stuff and install the tarball, what are
things I should look out for? Can I do the CPAN stuff and end up with a
working SA?

I appear to have a working system using the newest MS and the old SA 2.64,
but I'm not really sure. The output on MailWatch does not look like what I
usually see. Although this was performed on a production server (I have no
test servers, I'm lucky to have production servers), this is one of my
lightest used. So I may be OK for now.

Thanks for any help.

Steve Campbell
campbell@cnpapers.com
Charleston Newspapers

----- Original Message -----
From: "Steve Campbell" <campbell@CNPAPERS.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Monday, November 22, 2004 2:57 PM
Subject: SA 3.0.1 Install failure questions


> I realize this has been asked a _lot_ lately, but searching through my own
> saved archives and that on the list doesn't seem to get me anywhere.
>
> I am upgrading MS and SA today. I piddled through the MS  pretty well. I
had
> to force the normal MIME stuff to install and all was well there.  I then
> tried the SA install using the INSTALL-rpm.sh thing. I ran into the db4
> stuff, and install them as listed by Steve Swaney. I then reran the script
> to install. All appeared to be going well, until the very end, when it
> started saying that the install was conflicting with the 2.63 install that
I
> already had installed. Upon looking at my system. 2.63 is still there.
>
> I am running on Tao Linux. Does anyone have any experience with this
> happening. I have always installed from SRC rpms when installing SA. Do
> these not exist anywhere any more?
>
> Thanks for any help.
>
> Steve Campbell
> campbell@cnpapers.com
> Charleston Newspapers
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From andy at TIRESWING.NET  Mon Nov 22 20:28:39 2004
From: andy at TIRESWING.NET (Andy Norris)
Date: Thu Jan 12 21:27:40 2006
Subject: Releasing messages from Quarantine
Message-ID: <mailman.5006.1137101260.24926.mailscanner@lists.mailscanner.info>

Thanks very much, Steve.

We are certainly interested in doing a similar thing to what you have here
in the near (practical) future.

I know I'm looking a gift horse in the mouth, but am trying to do something
from square one...

The email is in the directory
/home/virtual/site35/fst/var/spool/mail.quarantine/20041122/iAM6A4X5001012

There are three files. Is there not a way that I can -- from the command
line, or otherwise -- just pass this email in its entirety to its intended
recipient without changing the headers?

And, if there's not, perhaps that's a future enhancment? Just a
FreeQuarantined( path) function? That would be pretty cool.

Thanks again!

Andy Norris



At 01:36 pm 2004-11-22, you wrote:
> > -----Original Message-----
> > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> > Behalf Of Andy Norris
> > Sent: Monday, November 22, 2004 1:51 PM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Releasing messages from Quarantine
> >
> > Hi All,
> >
> > I have looked over the book and Googled. Please let me know how to release
> > an email from quarantine. Is there a fancy way to do it, or do I just
> > forward the mail on to the user as email from me (root)? This is a
> > ".com.pdf" file, and was caught in the filename test. I don't want to read
> > anyone's mail!
> >
> > If it's a matter of just dropping the directory inside the quarantine
> > (three files -- header, body, attachment) into the outgoing queue... has
> > anyone build tools to help them automate this? Or even let the end user
> > release them? I can do that, just wanted to know if possible.
> >
> > Thanks very much!
> >
> > Andy Norris
> >
>
>Andy,
>
>You can download some skeleton example code that sends specified users a
>list of the spam they have in quarantine from:
>
>         wget http://www.fsl.com/support/QuarantineReport.tar.gz
>
>I will show you how to setup links that view and release the messages from
>quarantine.
>
>Beware - it was designed for internal web use only and should not be used on
>a webserver that is open to the outside world.
>
>Hope this helps,
>
>Steve
>
>Steve Swaney
>President
>Fortress Systems Ltd.
>www.fsl.com
>steve.swaney@fsl.com
>
> > ------------------------ MailScanner list ------------------------
> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> > Support MailScanner development - buy the book off the website!
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean.
> >
> > Fortress Systems Ltd.
> > www.fsl.com
> >
>
>
>
>--
>This message has been scanned for viruses and
>dangerous content by MailScanner, and is
>believed to be clean.
>
>Fortress Systems Ltd.
>www.fsl.com
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From vachanta at GMAIL.COM  Mon Nov 22 21:11:00 2004
From: vachanta at GMAIL.COM (Venkata Achanta)
Date: Thu Jan 12 21:27:40 2006
Subject: Releasing messages from Quarantine
Message-ID: <mailman.5007.1137101260.24926.mailscanner@lists.mailscanner.info>

>The email is in the directory
>/home/virtual/site35/fst/var/spool/mail.quarantine/20041122/iAM6A4X5001012
>
>There are three files. Is there not a way that I can -- from the command
>line, or otherwise -- just pass this email in its entirety to its intended
>recipient without changing the headers?


copy those to the outgoing mail queue and they will be delivered to the
intended reciepient as if it was never quarantined.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From vachanta at GMAIL.COM  Mon Nov 22 21:16:54 2004
From: vachanta at GMAIL.COM (Venkata Achanta)
Date: Thu Jan 12 21:27:40 2006
Subject: Releasing messages from Quarantine
Message-ID: <mailman.5008.1137101260.24926.mailscanner@lists.mailscanner.info>

>If it's a matter of just dropping the directory inside the quarantine
>(three files -- header, body, attachment) into the outgoing queue... has
>anyone build tools to help them automate this? Or even let the end user
>release them? I can do that, just wanted to know if possible.

We have a cgi script that takes the user input via the web interface the
date on which it was quarantined and the message id and every 15 min we run
a perl script that watches for those requests and processes them according
basically copying that message id dir the outgoing queue

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From campbell at cnpapers.com  Mon Nov 22 21:24:17 2004
From: campbell at cnpapers.com (Steve Campbell)
Date: Thu Jan 12 21:27:40 2006
Subject: SA 3.0.1 Install failure questions
Message-ID: <mailman.5009.1137101260.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Steve,

Thanks,

 I always used the SRC rpm to rebuild, but now it's not available anywhere.

So, just to clear up a few things before I destroy this machine worse than
what I may already have done:

Does unzipping the Mail-spamassassin file and installing it leave me with
the same thing as what I have.

What is this INSTALL-rpm.sh  thing Julian has supposed to do then.

Hope that doesn't come across as mean or anything. I would just like to
know.

Steve

----- Original Message -----
From: "Steve Swaney" <Steve.Swaney@fsl.com>
To: "'Steve Campbell'" <campbell@cnpapers.com>
Sent: Monday, November 22, 2004 4:10 PM
Subject: RE: SA 3.0.1 Install failure questions


>
> > -----Original Message-----
> > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> > Behalf Of Steve Campbell
> > Sent: Monday, November 22, 2004 2:58 PM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: SA 3.0.1 Install failure questions
> >
> > I realize this has been asked a _lot_ lately, but searching through my
own
> > saved archives and that on the list doesn't seem to get me anywhere.
> >
> > I am upgrading MS and SA today. I piddled through the MS  pretty well. I
> > had
> > to force the normal MIME stuff to install and all was well there.  I
then
> > tried the SA install using the INSTALL-rpm.sh thing. I ran into the db4
> > stuff, and install them as listed by Steve Swaney. I then reran the
script
> > to install. All appeared to be going well, until the very end, when it
> > started saying that the install was conflicting with the 2.63 install
that
> > I
> > already had installed. Upon looking at my system. 2.63 is still there.
> >
> > I am running on Tao Linux. Does anyone have any experience with this
> > happening. I have always installed from SRC rpms when installing SA. Do
> > these not exist anywhere any more?
> >
> > Thanks for any help.
> >
> > Steve Campbell
> > campbell@cnpapers.com
> > Charleston Newspapers
>
> Common wisdom for a long time when using MailScanner with SpamAssassin has
> been - Don't install from the RPM.
>
> Remove the existing spam assassin rpm.
>
> rpm -e spamassasin
>
> Then re-install from the tarball.
>
> Steve
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> Fortress Systems Ltd.
> www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From vasiliy at lohankin.com  Mon Nov 22 20:38:22 2004
From: vasiliy at lohankin.com (Vasiliy Boulytchev)
Date: Thu Jan 12 21:27:40 2006
Subject: f-secure wrapper question/problem
Message-ID: <mailman.5010.1137101260.24926.mailscanner@lists.mailscanner.info>

Ladies and Gents,
        I have installed the trial ver. of f-secure.  We shall use f-secure and
clam to scan for viruses (sophos increased their costs).

Anyways, I see f-secure reading the mail.  I see this in the logs,
however, the wrapper does not come back as "INFECTED".  Sample logs:


***********from syslog*************
Nov 22 14:30:34 arizona fsavd:
File /usr/local/mailscanner/mailscanner.proc/15485/./3350/message.scr
infected: I-Worm.NetSky.q [AVP].

Nov 22 14:30:41 arizona MailScanner[15547]: ClamAVModule::INFECTED::
Worm.SomeFool.P:: ./3633/doc01.doc


So as far as I can tell, the clam module is working the way it should,
it has been for months.  The f-secure module is not getting back to
Mailscanner with anything I dont think...

Where should I start?


THANKS!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!


Vasiliy Boulytchev
Colorado Information Technologies Inc.
http://www.coinfotech.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From campbell at cnpapers.com  Mon Nov 22 22:05:13 2004
From: campbell at cnpapers.com (Steve Campbell)
Date: Thu Jan 12 21:27:40 2006
Subject: SA 3.0.1 Install failure questions
Message-ID: <mailman.5011.1137101260.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Steve,

Thanks, again.

Yep, that is the file I was referring to. I tried installing as is, and just
in case there was something going on with the --noclam option. Neither
finished properly. But after reading your description of what is going on, I
think I see what is happening.

I think, though, that tomorrow I will just install the tar.gz, after
sa-learn --rebuild, and from then after.

This just seems too complicated for my little brain. It used to be a lot
easier in my younger years.

Steve


----- Original Message -----
From: "Steve Swaney" <Steve.Swaney@fsl.com>
To: "'Steve Campbell'" <campbell@cnpapers.com>
Sent: Monday, November 22, 2004 4:49 PM
Subject: RE: SA 3.0.1 Install failure questions


>
> > -----Original Message-----
> > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> > Behalf Of Steve Campbell
> > Sent: Monday, November 22, 2004 4:24 PM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Re: SA 3.0.1 Install failure questions
> >
> > Steve,
> >
> > Thanks,
> >
> >  I always used the SRC rpm to rebuild, but now it's not available
> > anywhere.
> >
> > So, just to clear up a few things before I destroy this machine worse
than
> > what I may already have done:
> >
> > Does unzipping the Mail-spamassassin file and installing it leave me
with
> > the same thing as what I have.
> >
>
> Not exactly. This method should work ;^)
>
> > What is this INSTALL-rpm.sh  thing Julian has supposed to do then.
> >
>
> Are you referring to the file at:
>
> http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/install-Clam-SA.tar.gz
>
> Julian has packaged the SpamAssassin tarball along with some modified
build
> and install instructions (it doesn't build or install spamd or spamc since
> MailScanner doesn't use them).  The package also includes ClamAV and most
if
> not all of the ClamAV and SpamAssassin perl modules dependencies.
>
> Look through the command line switches before you try it. I know there is
a
> switch to turn off installing ClamAV, and there may be others that you
might
> want to use.
>
> My experience with using this file has been good. On any given system it
> might not install everything but keep track of what it does and then use
> CPAN to install anything that might have erred in the installation. This
has
> worked well for me and typically speed up the installation process!
>
> > Hope that doesn't come across as mean or anything. I would just like to
> > know.
> >
>
> Never hurt to know  - just hope I explained it well enough.
>
> Steve
>
> Steve Swaney
> President
> Fortress Systems Ltd.
> www.fsl.com
> steve.swaney@fsl.com
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> Fortress Systems Ltd.
> www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Steve.Swaney at FSL.COM  Mon Nov 22 22:31:51 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:40 2006
Subject: SA 3.0.1 Install failure questions
Message-ID: <mailman.5012.1137101260.24926.mailscanner@lists.mailscanner.info>

Steve

No problem. Looks like your most of the way there. Drop me a line if you're
still having problems.

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Steve Campbell
> Sent: Monday, November 22, 2004 5:05 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: SA 3.0.1 Install failure questions
>
> Steve,
>
> Thanks, again.
>
> Yep, that is the file I was referring to. I tried installing as is, and
> just
> in case there was something going on with the --noclam option. Neither
> finished properly. But after reading your description of what is going on,
> I
> think I see what is happening.
>
> I think, though, that tomorrow I will just install the tar.gz, after
> sa-learn --rebuild, and from then after.
>
> This just seems too complicated for my little brain. It used to be a lot
> easier in my younger years.
>
> Steve
>
>
> ----- Original Message -----
> From: "Steve Swaney" <Steve.Swaney@fsl.com>
> To: "'Steve Campbell'" <campbell@cnpapers.com>
> Sent: Monday, November 22, 2004 4:49 PM
> Subject: RE: SA 3.0.1 Install failure questions
>
>
> >
> > > -----Original Message-----
> > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> > > Behalf Of Steve Campbell
> > > Sent: Monday, November 22, 2004 4:24 PM
> > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > Subject: Re: SA 3.0.1 Install failure questions
> > >
> > > Steve,
> > >
> > > Thanks,
> > >
> > >  I always used the SRC rpm to rebuild, but now it's not available
> > > anywhere.
> > >
> > > So, just to clear up a few things before I destroy this machine worse
> than
> > > what I may already have done:
> > >
> > > Does unzipping the Mail-spamassassin file and installing it leave me
> with
> > > the same thing as what I have.
> > >
> >
> > Not exactly. This method should work ;^)
> >
> > > What is this INSTALL-rpm.sh  thing Julian has supposed to do then.
> > >
> >
> > Are you referring to the file at:
> >
> > http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/install-Clam-
> SA.tar.gz
> >
> > Julian has packaged the SpamAssassin tarball along with some modified
> build
> > and install instructions (it doesn't build or install spamd or spamc
> since
> > MailScanner doesn't use them).  The package also includes ClamAV and
> most
> if
> > not all of the ClamAV and SpamAssassin perl modules dependencies.
> >
> > Look through the command line switches before you try it. I know there
> is
> a
> > switch to turn off installing ClamAV, and there may be others that you
> might
> > want to use.
> >
> > My experience with using this file has been good. On any given system it
> > might not install everything but keep track of what it does and then use
> > CPAN to install anything that might have erred in the installation. This
> has
> > worked well for me and typically speed up the installation process!
> >
> > > Hope that doesn't come across as mean or anything. I would just like
> to
> > > know.
> > >
> >
> > Never hurt to know  - just hope I explained it well enough.
> >
> > Steve
> >
> > Steve Swaney
> > President
> > Fortress Systems Ltd.
> > www.fsl.com
> > steve.swaney@fsl.com
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean.
> >
> > Fortress Systems Ltd.
> > www.fsl.com
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> Fortress Systems Ltd.
> www.fsl.com
>



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From William.Burns at AEROFLEX.COM  Mon Nov 22 22:55:20 2004
From: William.Burns at AEROFLEX.COM (William Burns)
Date: Thu Jan 12 21:27:40 2006
Subject: CustomFunction: WhiteListFutureSender
Message-ID: <mailman.5013.1137101260.24926.mailscanner@lists.mailscanner.info>

Paddy:

This is very cool.
I've got a similar scheme on one of my mail servers (That's not running
MailScanner)
I refer to this as an AutoWhitelist.

paddy wrote:

>The idea is to whitelist recipients of outgoing mail from known
>(client) relays, for return mail.  When such an outgoing mail is
>detected the value "<sender_ip>,<recipient>" is stored as the key in
>a tied hash along with a value that can be increased by subsequent
>hits, and aged by a cron job.
>
Have you created something to filter mail based on your database? I
don't understand how the sender_ip is used.

The mail that you trigger on is the outgoing mail, right?
In that case the sender IP is going to be the address of one of your
end-user PCs. Or... The IP address of a mail server if you're running
this on a mail gateway?

In case you're interested...
In my system (a kludge) I keep a separate database (a.k.a. text file)
for each of my users. Each database contains a list of addresses to
which that user sent mail. (There are two databases per user actually,
the other one contains domains that the user manually chose to whitelist)
When inbound mail is being delivered to a local mailbox, there's a
procmail script that checks the user's databases for the sender's
address. Any mail from a username not listed in the per-user whitelist
databases gets tagged w/ "[Unknown User]" in the subjectline.

>Praise, questions, comments, corrections, flames, whatever, all welcome.
>
>
Praise.

-Bill

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From thorin at polynesie-fr.com  Mon Nov 22 23:31:45 2004
From: thorin at polynesie-fr.com (Thorin)
Date: Thu Jan 12 21:27:40 2006
Subject: problem with new account on raq4
Message-ID: <mailman.5014.1137101260.24926.mailscanner@lists.mailscanner.info>

I followed the tutorial which is has the following address:
http://www.qitc.net/support/mailscanner/

here typical lines in the logs:

Nov 21 19:54:29 alfheim sendmail[32068]: iALIsTU32068: <communication@salondelaplongee.com>... User unknown
Nov 21 19:54:29 alfheim sendmail[32068]: iALIsTU32068: lost input channel from dyn-83-157-67-21.ppp.tiscali.fr [83.157.67.21] to MTA
 after rcpt
Nov 21 19:54:29 alfheim sendmail[32068]: iALIsTU32068: from=<infos@europain.com>, size=0, class=0, nrcpts=0, proto=SMTP, daemon=MTA,
 relay=dyn-83-157-67-21.ppp.tiscali.fr [83.157.67.21]


>> Hardware: Cobalt Raq4
>> Software: Sun Cobalt OS, Spamassassin 2.63, Mailscanner
>> 4.29.7-1 Virus Scanners: f-prot
>> Volume: 300 messages/day
>>
>> Hello,
>>
>> I have problems with MailScanner on my Cobalt raq4:
>>
>> as soon as I add new users and that I sending of the malls on
>> those, I have the message in the mailog &#8220;user
>> unknow&#8221; all seems ok&#8230; The old email accounts functions
>> them! If you need log or others, say to me which.
>> Thank you in advance for your assistance.
>>

> How did you install this?
> Could you give us a few lines of your mail log?


> Mr Michele Neylon
> Blacknight Internet Solutions Ltd
> Hosting, co-location & domains
> http://www.blacknight.ie/
> Tel. +353 59 9137101
> http://www.blacknight.ie/specialoffers.html

> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

> Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ius at IUS.RBRANA.CO.ID  Tue Nov 23 01:08:19 2004
From: ius at IUS.RBRANA.CO.ID (Ius)
Date: Thu Jan 12 21:27:40 2006
Subject: Vispan help
Message-ID: <mailman.5015.1137101260.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi,

Trying to install and running Vispan here, but i got this problem :

root@ius root]# Vispan
/usr/bin/perl: relocation error:
/usr/lib/perl5/site_perl/5.8.3/i386-linux-thread-multi/auto/GD/GD.so:
undefined symbol: gdFontGetLarge

Can anybody tellme what's wrong ?

Thx a lot
Ius

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From andy at TIRESWING.NET  Tue Nov 23 01:24:26 2004
From: andy at TIRESWING.NET (Andy Norris)
Date: Thu Jan 12 21:27:40 2006
Subject: Releasing messages from Quarantine
Message-ID: <mailman.5016.1137101260.24926.mailscanner@lists.mailscanner.info>

Thanks very much Venkata,

A couple questions for you... how is your setting for

Quarantine Whole Messages As Queue Files

? Does that matter when dropping the contents of the directory to be sent
on into the outgoing queue?

Thanks,

Andy


At 03:16 pm 2004-11-22, Venkata Achanta wrote:
> >If it's a matter of just dropping the directory inside the quarantine
> >(three files -- header, body, attachment) into the outgoing queue... has
> >anyone build tools to help them automate this? Or even let the end user
> >release them? I can do that, just wanted to know if possible.
>
>We have a cgi script that takes the user input via the web interface the
>date on which it was quarantined and the message id and every 15 min we run
>a perl script that watches for those requests and processes them according
>basically copying that message id dir the outgoing queue
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From vachanta at GMAIL.COM  Tue Nov 23 02:14:42 2004
From: vachanta at GMAIL.COM (Venkata Achanta)
Date: Thu Jan 12 21:27:40 2006
Subject: Releasing messages from Quarantine
Message-ID: <mailman.5017.1137101260.24926.mailscanner@lists.mailscanner.info>

Andy,

Yes! it does matter.For that to work you should change the following
options to yes if they are set to no.

Quarantine Whole Message = yes
Quarantine Whole Messages As Queue Files = yes

--Venkata Achanta


On Mon, 22 Nov 2004 19:24:26 -0600, Andy Norris <andy@TIRESWING.NET> wrote:

>Thanks very much Venkata,
>
>A couple questions for you... how is your setting for
>
>Quarantine Whole Messages As Queue Files
>
>? Does that matter when dropping the contents of the directory to be sent
>on into the outgoing queue?
>
>Thanks,
>
>Andy
>
>
>At 03:16 pm 2004-11-22, Venkata Achanta wrote:
>> >If it's a matter of just dropping the directory inside the quarantine
>> >(three files -- header, body, attachment) into the outgoing queue... has
>> >anyone build tools to help them automate this? Or even let the end user
>> >release them? I can do that, just wanted to know if possible.
>>
>>We have a cgi script that takes the user input via the web interface the
>>date on which it was quarantined and the message id and every 15 min we
run
>>a perl script that watches for those requests and processes them according
>>basically copying that message id dir the outgoing queue
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From andy at TIRESWING.NET  Tue Nov 23 02:31:59 2004
From: andy at TIRESWING.NET (Andy Norris)
Date: Thu Jan 12 21:27:40 2006
Subject: Releasing messages from Quarantine
Message-ID: <mailman.5018.1137101260.24926.mailscanner@lists.mailscanner.info>

Great, I think we're there, then.

Thanks again!

Andy


At 08:14 pm 2004-11-22, you wrote:
>Andy,
>
>Yes! it does matter.For that to work you should change the following
>options to yes if they are set to no.
>
>Quarantine Whole Message = yes
>Quarantine Whole Messages As Queue Files = yes
>
>--Venkata Achanta

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From gdoris at ROGERS.COM  Tue Nov 23 02:32:51 2004
From: gdoris at ROGERS.COM (Gerry Doris)
Date: Thu Jan 12 21:27:40 2006
Subject: MailScanner.conf Permission Problem
Message-ID: <mailman.5019.1137101260.24926.mailscanner@lists.mailscanner.info>

It's probably something that I did but just in case...

I installed the latest beta version of MailScanner the other day and all
seemed to work properly.  I tried to log in today using mailwatch and was
told that MailScanner.conf could not be found.

When I checked the file it had permissions of 600.  Changing it to 644
allowed mailwatch to run again.

--
Gerry

"The lyfe so short, the craft so long to learne"  Chaucer

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ronaldj at NETXACTICS.CO.ZA  Tue Nov 23 06:59:56 2004
From: ronaldj at NETXACTICS.CO.ZA (Ronald James)
Date: Thu Jan 12 21:27:40 2006
Subject: sophossavi
Message-ID: <mailman.5020.1137101260.24926.mailscanner@lists.mailscanner.info>

If all else fails, change the setting from sophossavi to sophos under virus
scanners.
This will switch it over to command line scanning. You should not get that
error.
If this still does not work, reinstall sophos.

Ronald James
NetXactics
Tel: +27 21 680-5069
Fax: +27 21 680-5011
http://www.netxactics.co.za
Sophos - protecting businesses against viruses and spam


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Sylvain Phaneuf
Sent: 22 November 2004 04:14
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: sophossavi

I already had
Allowed Sophos Error Messages = "corrupt"

Any idea about the messages that accumulate badly in mqueue.in?

Sylvain



>>> ronaldj@NETXACTICS.CO.ZA 22/11/2004 13:10:29 >>>
Sure, but if you look at the error msgs, you will see that the msg it
is
getting errors on are not pdf's. Am looking into this and trying to
find a
solution.

Ronald James
NetXactics
Tel: +27 21 680-5069
Fax: +27 21 680-5011
http://www.netxactics.co.za
Sophos - protecting businesses against viruses and spam


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf
Of Martin Hepworth
Sent: 22 November 2004 02:58
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: sophossavi

Sylvain

make sure the following is set in MailScanner.conf

Allowed Sophos Error Messages = "corrupt", "format not supported"

Certain vesions of Sophos seem to have problems with PDF's, this gets
around the issue.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Sylvain Phaneuf wrote:
> I have started using sophossavi this morning. Every now and then, I
get
> the following in the maillog file:
>
> Nov 22 11:37:26 mailscan MailScanner[29415]: SophosSAVI::ERROR::
Sweep
> could not proceed, the file was corrupted (538)::
> ./iAMBZv9T029593/letterXYZ.doc
> Nov 22 11:37:26 mailscan MailScanner[29415]: SophosSAVI::ERROR::
Sweep
> could not proceed, the file was corrupted (538)::
> ./iAMBZv9T029593/msg-29415-30.txt
> Nov 22 11:37:26 mailscan MailScanner[29415]: SophosSAVI::ERROR::
Sweep
> could not proceed, the file was corrupted (538)::
> ./iAMBZx9T029606/msg-29415-18.txt
> Nov 22 11:37:27 mailscan MailScanner[29415]: Virus Scanning:
SophosSAVI
> found 3 infections
>
> After a few minutes of starting MailScanner with sophossavi,
messages
> start accumulating in mqueue.in. They pile up there until I get very
> nervous (>2000 messages), and restart MailScaner with the regullar
> sophos. Sendmail looks OK when this happens.
>
> using Sophos version 3.87, and SAVI perl module 0.25, MS 4.35.11.
>
> Anything obvious comes to mind?
>
> Sylvain
>
>
> ===========================================================
> Sylvain Phaneuf --- Systems Manager   | phone : +44 (0)1865 221323
> Clinical School Information Management Services Unit  (IMSU)
> Medical Sciences Division
> University of Oxford                                  |   email :
> sylvain.phaneuf@imsu.ox.ac.uk
> Room 3A25B John Radcliffe Hospital      |   fax :  +44 (0) 1865
221322
> Oxford   OX3 9DU   England
> ===========================================================
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jaesquibal at MERIDIANTELEKOMS.COM  Tue Nov 23 07:05:55 2004
From: jaesquibal at MERIDIANTELEKOMS.COM (Joey Esquibal)
Date: Thu Jan 12 21:27:40 2006
Subject: warning notice to include e-mail headers
Message-ID: <mailman.5021.1137101260.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi!

How do I include the e-mail headers of the warning notices to each of
the recipient?

Thanks!

Joey

--
...Be on time.
There is one kind of robber whom the law does no strike at...
who steals what is most precious to men: TIME.
- Someone else's time is a terrible thing to waste.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From David.While at UCE.AC.UK  Tue Nov 23 10:39:57 2004
From: David.While at UCE.AC.UK (David While)
Date: Thu Jan 12 21:27:40 2006
Subject: New release of Vispan
Message-ID: <mailman.5022.1137101260.24926.mailscanner@lists.mailscanner.info>

I have just released Version 2 of Vispan. The major change in this
version is to provide the ability to block the sending IP addresses
using iptables at the firewall instead of the access file at the MTA
level. The original functionality of blocking in the access file still
remains - it is all conbfigurable from the config file.

Download as usual from http://www.while.homeunix.net/mailstats/

--------------------------------------------
David While BSc CEng MBCS CITP
Technical Development Manager
School of Computing & Information
University of Central England
Tel: 0121 331 6211
--------------------------------------------

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From prandal at HEREFORDSHIRE.GOV.UK  Tue Nov 23 10:51:30 2004
From: prandal at HEREFORDSHIRE.GOV.UK (Randal, Phil)
Date: Thu Jan 12 21:27:40 2006
Subject: New release of Vispan
Message-ID: <mailman.5023.1137101260.24926.mailscanner@lists.mailscanner.info>

Looks good here.

Phil

----
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK

> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of David While
> Sent: 23 November 2004 10:40
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: New release of Vispan
>
> I have just released Version 2 of Vispan. The major change in
> this version is to provide the ability to block the sending
> IP addresses using iptables at the firewall instead of the
> access file at the MTA level. The original functionality of
> blocking in the access file still remains - it is all
> conbfigurable from the config file.
>
> Download as usual from http://www.while.homeunix.net/mailstats/
>
> --------------------------------------------
> David While BSc CEng MBCS CITP
> Technical Development Manager
> School of Computing & Information
> University of Central England
> Tel: 0121 331 6211
> --------------------------------------------
>
> ------------------------ MailScanner list
> ------------------------ To unsubscribe, email
> jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ
> (http://www.mailscanner.biz/maq/) and the archives
> (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Glenn.Steen at AP1.SE  Tue Nov 23 10:52:29 2004
From: Glenn.Steen at AP1.SE (Steen, Glenn)
Date: Thu Jan 12 21:27:40 2006
Subject: mailscanner with postfix startup messages
Message-ID: <mailman.5024.1137101260.24926.mailscanner@lists.mailscanner.info>

Well... the "hold: header Received:" just indicate that you're running a
"one postfix installation":-).
It is that header check that arranges for the message to be placed in
the hold queue, so that is normal (and you'll probably see one "hold:
..." entry for every "Received: " line IIRC, because it'll not halt
header checking with that, just advance to the next line... Good for
your IGNORE lines;-).

So the "qmail ... " bits are just what happens to be on those "Received:
" lines... meaning the sender seems to use qmail in this case.

Now, you confuused me a bit there by having essentially the same log
entries twice in your example, but... AFAICS everything is running as it
should.

-- Glenn

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Harry Hanson
Sent: den 22 november 2004 20:01
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: mailscanner with postfix startup messages


Setup is postfix/mailscanner/sa used as a gateway. I seem to have an
issue
with some messages getting a "hold: header Received:", being requeued
then
basically "sitting" there, not being delivered.

Can any one explain to me what the "hold: header Received:" indicates
and
what causes it?

Also, the "qmail 34926 invoked by uid 60001" entry has me perplexed.
Where
did that come from?


Relevant logs below:

Nov 22 09:17:29 mx01 postfix/cleanup[26258]: DE30C84593:
message-id=<20041122171049.34917.qmail@web42001.mail.yahoo.com>

Nov 22 09:17:32 mx01 postfix/cleanup[26258]: DE30C84593: hold: header
Received: from [206.63.225.15] by web42001.mail.yahoo.com via HTTP; Mon,
22
Nov 2004 09:10:49 PST from web42001.mail.yahoo.com[66.218.93.169];
from=<ranavor@yahoo.com> to=<fco@cet.com> proto=SMTP
helo=<web42001.mail.yahoo.com>

Nov 22 09:18:08 mx01 MailScanner[15809]: Requeue: DE30C84593 to
D3086840AB

Nov 22 09:25:41 mx01 postfix/qmgr[6406]: D3086840AB:
from=<ranavor@yahoo.com>, size=1713, nrcpt=1 (queue active)

Nov 22 09:17:25 mx01 postfix/cleanup[26258]: DE30C84593: hold: header
Received: (qmail 34926 invoked by uid 60001); 22 Nov 2004 17:10:49 -0000
from web42001.mail.yahoo.com[66.218.93.169]; from=<ranavor@yahoo.com>
to=<fco@cet.com> proto=SMTP helo=<web42001.mail.yahoo.com>

Nov 22 09:17:29 mx01 postfix/cleanup[26258]: DE30C84593:
message-id=<20041122171049.34917.qmail@web42001.mail.yahoo.com>

Nov 22 09:17:32 mx01 postfix/cleanup[26258]: DE30C84593: hold: header
Received: from [206.63.225.15] by web42001.mail.yahoo.com via HTTP; Mon,
22
Nov 2004 09:10:49 PST from web42001.mail.yahoo.com[66.218.93.169];
from=<ranavor@yahoo.com> to=<fco@cet.com> proto=SMTP
helo=<web42001.mail.yahoo.com>

Nov 22 09:18:08 mx01 MailScanner[15809]: Requeue: DE30C84593 to
D3086840AB

Nov 22 09:25:41 mx01 postfix/qmgr[6406]: D3086840AB:
from=<ranavor@yahoo.com>, size=1713, nrcpt=1 (queue active)


---
[This E-mail scanned for viruses]

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Q.G.Campbell at NEWCASTLE.AC.UK  Tue Nov 23 10:58:07 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:40 2006
Subject: Suggested phishing net tuning
Message-ID: <mailman.5025.1137101260.24926.mailscanner@lists.mailscanner.info>

>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Alex Neuman 
>van der Hans
>Sent: 22 November 2004 14:03
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Suggested phishing net tuning
>
>There *is* a "Level 4" as well... Disable HTML! :D Seriously, though, I
>don't get that many phishing e-mails so I don't have your 
>experience in that
>area, but I agree with you wholeheartedly.
>

Alex

The problems with the phishing net catching non-phishing messages is a
major issue here.

When it catches real phishing spam it is fine. In fact it flagged three
delivered to my mailbox overnight.

However we get a lot of false positives flagged by the code and users
are getting increasingly angry and vocal about genuine messages being
messed up by the warnings.

It looks like I will have to disable the feature here. In a typical 24
hour period the logs show that the phishing detector flagged 17,740
"possible fraud" attempts.

I suspect the majority of these are false positives although this could
include a lot of mail that is otherwise spam but not fraudulent in the
"phishing" sense.

We also found that a lot of outgoing mail from here was being flagged
until I set up a ruleset to exempt mail from our domains. This is a
warning for other sites. We are increasingly moving users to
Outlook/Exchange and OWA which, unless the defaults are correctly set,
can mean that mail is sent as RTF by default. Users in any case will
often prefer to send e-mail in MTML. These behaviours have serious
consequences. 

The conversion that Microsoft does to change text to RTF is broken. It
can unexpectedly turn a simple line in a message signature into a
hypertext link that gets flagged by the "phishing net" code. It also
generates HTML that is simply wrong and/or redundant and can cause other
undesirable side effects. 

Quentin 
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own." 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From anders.andersson at LTKALMAR.SE  Tue Nov 23 10:54:09 2004
From: anders.andersson at LTKALMAR.SE (Anders Andersson, IT)
Date: Thu Jan 12 21:27:40 2006
Subject: New release of Vispan
Message-ID: <mailman.5026.1137101260.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list 
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of David While
> Sent: Tuesday, November 23, 2004 11:40 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: New release of Vispan
> 
> I have just released Version 2 of Vispan. The major change in 
> this version is to provide the ability to block the sending 
> IP addresses using iptables at the firewall instead of the 
> access file at the MTA level. The original functionality of 
> blocking in the access file still remains - it is all 
> conbfigurable from the config file.
> 
> Download as usual from http://www.while.homeunix.net/mailstats/

Did you include the code for retaining the old stat?

> 
> --------------------------------------------
> David While BSc CEng MBCS CITP
> Technical Development Manager
> School of Computing & Information
> University of Central England
> Tel: 0121 331 6211

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From David.While at UCE.AC.UK  Tue Nov 23 11:18:22 2004
From: David.While at UCE.AC.UK (David While)
Date: Thu Jan 12 21:27:40 2006
Subject: New release of Vispan
Message-ID: <mailman.5027.1137101260.24926.mailscanner@lists.mailscanner.info>

Yes - simply delete the vispan.dat file in /var/cache/vispan and it
should read in the old stats.
--------------------------------------------
David While BSc CEng MBCS CITP
Technical Development Manager
School of Computing & Information
University of Central England
Tel: 0121 331 6211
-------------------------------------------- 

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Anders Andersson, IT
Sent: 23 November 2004 10:54
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: New release of Vispan

> -----Original Message-----
> From: MailScanner mailing list 
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of David While
> Sent: Tuesday, November 23, 2004 11:40 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: New release of Vispan
> 
> I have just released Version 2 of Vispan. The major change in 
> this version is to provide the ability to block the sending 
> IP addresses using iptables at the firewall instead of the 
> access file at the MTA level. The original functionality of 
> blocking in the access file still remains - it is all 
> conbfigurable from the config file.
> 
> Download as usual from http://www.while.homeunix.net/mailstats/

Did you include the code for retaining the old stat?

> 
> --------------------------------------------
> David While BSc CEng MBCS CITP
> Technical Development Manager
> School of Computing & Information
> University of Central England
> Tel: 0121 331 6211

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From philipp at BASKETBALL.AG  Tue Nov 23 11:11:41 2004
From: philipp at BASKETBALL.AG (Philipp Bundschuh)
Date: Thu Jan 12 21:27:40 2006
Subject: notify recipient
Message-ID: <mailman.5028.1137101260.24926.mailscanner@lists.mailscanner.info>


Hello,

is it possible, to configure MailScanner, that the recipient of an
infected email is notified? Or that e.g. the infected attachment is just
replaced by an &#8222;.txt&#8220;-File (like a report)?

Regards,

Philipp Bundschuh

Germany

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From giulio.cervera at EDSPA.IT  Tue Nov 23 11:38:29 2004
From: giulio.cervera at EDSPA.IT (Giulio Cervera)
Date: Thu Jan 12 21:27:40 2006
Subject: SA 3.0.1 Install failure questions
Message-ID: <mailman.5029.1137101260.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-15" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I got similar problem recompiling SA 3.0.1 on rhel es 3 (tao is rhel 3
rebuild)

I had erroneously overwritte one RH perl packages with one included in
MailScanner
After reinstalling RH perl package ( perl-HTML-Parser-3.26-17 or
perl-HTML-Tagset-3.03-28 )
i have successfully recompiled SA using the origin SA tar.gz
# rpmbuild -ta Mail-SpamAssassin-3.0.1.tar.gz

also from SA 2.63 to 3.x there is 2 new dependencies

perl-DBI
perl-Digest-SHA1
*
*i hope this help

Steve Campbell ha scritto:

>I realize this has been asked a _lot_ lately, but searching through my own
>saved archives and that on the list doesn't seem to get me anywhere.
>
>I am upgrading MS and SA today. I piddled through the MS  pretty well. I had
>to force the normal MIME stuff to install and all was well there.  I then
>tried the SA install using the INSTALL-rpm.sh thing. I ran into the db4
>stuff, and install them as listed by Steve Swaney. I then reran the script
>to install. All appeared to be going well, until the very end, when it
>started saying that the install was conflicting with the 2.63 install that I
>already had installed. Upon looking at my system. 2.63 is still there.
>
>I am running on Tao Linux. Does anyone have any experience with this
>happening. I have always installed from SRC rpms when installing SA. Do
>these not exist anywhere any more?
>
>Thanks for any help.
>
>Steve Campbell
>campbell@cnpapers.com
>Charleston Newspapers
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From anders.andersson at LTKALMAR.SE  Tue Nov 23 11:52:57 2004
From: anders.andersson at LTKALMAR.SE (Anders Andersson, IT)
Date: Thu Jan 12 21:27:40 2006
Subject: New release of Vispan
Message-ID: <mailman.5030.1137101260.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list 
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of David While
> Sent: Tuesday, November 23, 2004 12:18 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: New release of Vispan
> 
> Yes - simply delete the vispan.dat file in /var/cache/vispan 
> and it should read in the old stats.

Ok, just want to make sure i do this correct.

Before upgrade from 1.4 -1.55 I took copies of /var/cache/vispan and
/var/www/html/vispan incase I needed them. Do I use those catalogs and
rename the maillog files and run Vispan to collect data or just delete
the dat files. Looking at the current /var/cache/vispan its only the
vispan.dat thats changed since I did the upgrade




> -----Original Message-----
> From: MailScanner mailing list 
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Anders Andersson, IT
> 
> > -----Original Message-----
> > From: MailScanner mailing list
> > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of David While
> > Sent: Tuesday, November 23, 2004 11:40 AM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: New release of Vispan
> > 
> > I have just released Version 2 of Vispan. The major change in this 
> > version is to provide the ability to block the sending IP addresses 
> > using iptables at the firewall instead of the access file 
> at the MTA 
> > level. The original functionality of blocking in the access 
> file still 
> > remains - it is all conbfigurable from the config file.
> > 
> > Download as usual from http://www.while.homeunix.net/mailstats/
> 
> Did you include the code for retaining the old stat?
> 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Mark.Pottage at SELECTION.CO.UK  Tue Nov 23 11:56:23 2004
From: Mark.Pottage at SELECTION.CO.UK (Mark Pottage)
Date: Thu Jan 12 21:27:40 2006
Subject: Mail delivery?
Message-ID: <mailman.5031.1137101260.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Can someone tell me how sendmail decides how to send mail?
 
we have a mailertable with entries for domains pointing to example:
 
abc.com                      esmtp[x.x.x.x]
 
Should this be used to decide where to send the mail?
 
We think our system is using DNS to decide how to route the mail out.  We
don't want to use DNS for one domain.
 
Does the resolv.conf file hold the entries for DNS used by the server OS
or for SendMail?
Is there another file used for DNS configuration of SendMail?
 
Can anyone help?
 
many thanks
 
Mark Pottage
Systems Administrator
Tel:       0870 411 7914
Mobile:  07740 578 647
Fax:       0870 163 9001
mark.pottage@selection.co.uk

--
This message has been scanned for viruses and
dangerous content by Selection Services MailScanner, and is
believed to be clean.. ------------------------ MailScanner list
------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Text/PLAIN (Name: "Mark Pottage.vcf")  20 lines. ]
    [ Unable to print this part. ]


From marco at XSSNET.COM  Tue Nov 23 12:20:06 2004
From: marco at XSSNET.COM (Marco Benton - BOFH)
Date: Thu Jan 12 21:27:40 2006
Subject: Mail delivery?
Message-ID: <mailman.5032.1137101260.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Mark Pottage wrote:
      Can someone tell me how sendmail decides how to send mail?
 
we have a mailertable with entries for domains pointing to example:
 
abc.com                      esmtp[x.x.x.x]
 
Should this be used to decide where to send the mail?
 
We think our system is using DNS to decide how to route the mail
out.  We don't want to use DNS for one domain.
 
Does the resolv.conf file hold the entries for DNS used by the
server OS or for SendMail?
Is there another file used for DNS configuration of SendMail?
 


are you using an IP addresses?  i dont think an IP address there will
work correctly, esp for the host you're sending the mail to.  by putting
the hostname in "[]" you are telling Sendmail not to lookup the MX
records.  i dont think /etc/hots will work but you can try.

try:
abc.com      relay:[relay3.blabla.com]

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From jaearick at COLBY.EDU  Tue Nov 23 12:29:07 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:40 2006
Subject: 255 retcodes in syslog
Message-ID: <mailman.5033.1137101260.24926.mailscanner@lists.mailscanner.info>

Julian,
    Yesterday's bugfix for the syslogging also cured my issue
of higher-than-normal load that I had noticed.  Last night's
sar output looked normal again.  Thanks!

Jeff Earickson
Colby College

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Mark.Pottage at SELECTION.CO.UK  Tue Nov 23 12:28:49 2004
From: Mark.Pottage at SELECTION.CO.UK (Mark Pottage)
Date: Thu Jan 12 21:27:40 2006
Subject: Mail delivery?
Message-ID: <mailman.5034.1137101260.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

i have tried etc/hosts,  but to no avail.
 
the os resolves from the host file ok,  e.g. ping.
but, the application sendmail still resolves via DNS.
 
 
many thanks
 
Mark Pottage
Systems Administrator
Tel:       0870 411 7914
Mobile:  07740 578 647
Fax:       0870 163 9001
mark.pottage@selection.co.uk

>>> marco@XSSNET.COM 23/11/2004 12:20:06 >>>
Mark Pottage wrote:
      Can someone tell me how sendmail decides how to send mail?
 
we have a mailertable with entries for domains pointing to example:
 
abc.com                      esmtp[x.x.x.x]
 
Should this be used to decide where to send the mail?
 
We think our system is using DNS to decide how to route the mail
out.  We don't want to use DNS for one domain.
 
Does the resolv.conf file hold the entries for DNS used by the
server OS or for SendMail?
Is there another file used for DNS configuration of SendMail?
 


are you using an IP addresses?  i dont think an IP address there will
work correctly, esp for the host you're sending the mail to.  by putting
the hostname in "[]" you are telling Sendmail not to lookup the MX
records.  i dont think /etc/hots will work but you can try.

try:
abc.com      relay:[relay3.blabla.com]


--
This message has been scanned for viruses and
dangerous content by Selection Services MailScanner, and is
believed to be clean.. ------------------------ MailScanner list
------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

--
This message has been scanned for viruses and
dangerous content by Selection Services MailScanner, and is
believed to be clean.. ------------------------ MailScanner list
------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Text/PLAIN (Name: "Mark Pottage.vcf")  20 lines. ]
    [ Unable to print this part. ]


From marco at XSSNET.COM  Tue Nov 23 12:35:24 2004
From: marco at XSSNET.COM (Marco Benton - BOFH)
Date: Thu Jan 12 21:27:40 2006
Subject: Mail delivery?
Message-ID: <mailman.5035.1137101260.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Mark Pottage wrote:
      i have tried etc/hosts,  but to no avail.
 
the os resolves from the host file ok,  e.g. ping.
but, the application sendmail still resolves via DNS.
 
 
many thanks


well there is a way to turn off DNS in Sendmail but as you stated, it
will break your other domains.

you might have to make a record in DNS just to relay mail, minus the MX
records.  but why *wont* you want to use DNS?


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From paddy at PANICI.NET  Tue Nov 23 12:37:16 2004
From: paddy at PANICI.NET (paddy)
Date: Thu Jan 12 21:27:40 2006
Subject: CustomFunction: WhiteListFutureSender
Message-ID: <mailman.5036.1137101260.24926.mailscanner@lists.mailscanner.info>

On Mon, Nov 22, 2004 at 05:55:20PM -0500, William Burns wrote:
> Paddy:
>
> This is very cool.
> I've got a similar scheme on one of my mail servers (That's not running
> MailScanner)
> I refer to this as an AutoWhitelist.

Yeah, I didn't know what to call this, but in the milter-sender implementation
the option is called WhiteListFutureSender, so I went with that.

Avoiding confusion with the SA AWL (AutoWhiteList) feature seemed like a
good idea too.

> paddy wrote:
>
> >The idea is to whitelist recipients of outgoing mail from known
> >(client) relays, for return mail.  When such an outgoing mail is
> >detected the value "<sender_ip>,<recipient>" is stored as the key in
> >a tied hash along with a value that can be increased by subsequent
> >hits, and aged by a cron job.
> >
> Have you created something to filter mail based on your database? I
> don't understand how the sender_ip is used.

Ah yes ... that will be because the code I posted is nonsense!

what _should_ go into the hash key (for the simplest implementation)
is the from and to address pair. So, something more like:

        my $l=0;
        my $ip = $message->{clientip};
        my $f = $message->{from};
        for $r (@{$message->{to}}){
                $List{"$f,$r"} += 1 if $wlfs_senders{$ip};
                $l += $List{"$r,$f"};
        }

Mind you, I haven't even tested this on the one machine, this time!

And this also raises the question of what to do with mail that is
whitelisted to one of multiple recipients.

> The mail that you trigger on is the outgoing mail, right?
> In that case the sender IP is going to be the address of one of your
> end-user PCs. Or... The IP address of a mail server if you're running
> this on a mail gateway?

Yes, the idea is to use the IP address of the client relay, to identify
the outgoing mail.  Of course then the implementation only works for
mail coming from that relay, but it saved me thinking about forged
from addresses ...

> In case you're interested...

Absolutely, yes.

> In my system (a kludge) I keep a separate database (a.k.a. text file)

<grins>

> for each of my users. Each database contains a list of addresses to
> which that user sent mail. (There are two databases per user actually,
> the other one contains domains that the user manually chose to whitelist)
> When inbound mail is being delivered to a local mailbox, there's a
> procmail script that checks the user's databases for the sender's
> address. Any mail from a username not listed in the per-user whitelist
> databases gets tagged w/ "[Unknown User]" in the subjectline.

We don't deliver all our mail locally, some goes out by mailertable, so a
procmail implementation is less attractive than a mailscanner one.  Although
I prefer the idea of a text file per-user - best user interface there is.
The tricky bit might be working out who you're delivering to ...

Procmail gets you delivery time, which is nice for solving the 'where is
the database' and the 'whitelisted to one of multiple recipients' problems.

A quick look sugests it may be possible to modify the subject line with
something like:

  my $newsubject = "[Unknown User]".$message->{subject};
  $global::MS->{mta}->ReplaceHeader($message, 'Subject:', $newsubject);

But, again, I haven't tested this, nor do I understand it (yet).

It strikes me that aside from 'store, deliver, bounce, ...' there is a
language of actions hiding in mailscanner along the lines of:

        modfiy header
        insert header

and probably others too.

> >Praise, questions, comments, corrections, flames, whatever, all welcome.
> >
> >
> Praise.

Excellent selection!

> -Bill

Regards,
Paddy
--
Perl 6 will give you the big knob. -- Larry Wall

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Mark.Pottage at SELECTION.CO.UK  Tue Nov 23 12:52:24 2004
From: Mark.Pottage at SELECTION.CO.UK (Mark Pottage)
Date: Thu Jan 12 21:27:40 2006
Subject: Mail delivery?
Message-ID: <mailman.5037.1137101260.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

we have another mail server behind it which does mail hosting and the
facility to relay, and uses the same DNS servers.
 
we want all mail from one domain to be sent to this second mail server.
 
this server then has the facility to do aliasing, as below.
 
abc@test.com  abc@xyz.priv
 
all entries we make in the alias fields get processed before the relaying
is carried out.
 
 
many thanks
 
Mark Pottage
Systems Administrator
Tel:       0870 411 7914
Mobile:  07740 578 647
Fax:       0870 163 9001
mark.pottage@selection.co.uk

>>> marco@XSSNET.COM 23/11/2004 12:35:24 >>>
Mark Pottage wrote:
      i have tried etc/hosts,  but to no avail.
 
the os resolves from the host file ok,  e.g. ping.
but, the application sendmail still resolves via DNS.
 
 
many thanks


well there is a way to turn off DNS in Sendmail but as you stated, it
will break your other domains.

you might have to make a record in DNS just to relay mail, minus the MX
records.  but why *wont* you want to use DNS?



--
This message has been scanned for viruses and
dangerous content by Selection Services MailScanner, and is
believed to be clean.. ------------------------ MailScanner list
------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

--
This message has been scanned for viruses and
dangerous content by Selection Services MailScanner, and is
believed to be clean.. ------------------------ MailScanner list
------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Text/PLAIN (Name: "Mark Pottage.vcf")  20 lines. ]
    [ Unable to print this part. ]


From viers at UNILIM.FR  Tue Nov 23 13:19:41 2004
From: viers at UNILIM.FR (Nicolas Viers - SCI Limoges)
Date: Thu Jan 12 21:27:40 2006
Subject: bayes database
Message-ID: <mailman.5038.1137101260.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

how to convert bayes database version 2 to version 3  for spamassassin 
version 3  ?
thanks

-- 

____________________________________________________________

Nicolas Viers               |  Service Commun Informatique
Mél: viers@unilim.fr        |  123, avenue Albert Thomas
                            |     87060 Limoges cedex
Tel: 05-55-45-77-09         |  Fax: 05-55-45-75-95
                  http://www.unilim.fr/sci  
____________________________________________________________

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From marco at XSSNET.COM  Tue Nov 23 14:02:05 2004
From: marco at XSSNET.COM (Marco Benton - BOFH)
Date: Thu Jan 12 21:27:40 2006
Subject: bayes database
Message-ID: <mailman.5039.1137101260.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Nicolas Viers - SCI Limoges wrote:

> how to convert bayes database version 2 to version 3  for spamassassin
> version 3  ?
> thanks
>

upgrade to SA 3... run "sa-learn --sync".  this can take quite a while
depending on your Bayes dB size.

read the UPGRADE doco on SA website for more information.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From shrek-m at GMX.DE  Tue Nov 23 14:08:31 2004
From: shrek-m at GMX.DE (shrek-m@gmx.de)
Date: Thu Jan 12 21:27:40 2006
Subject: Mail delivery?
Message-ID: <mailman.5040.1137101260.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Mark Pottage wrote:

> abc.com                      esmtp[x.x.x.x]


abc.com       esmtp:[12.34.56.78]

is ok.

$ grep esmtp: /usr/share/doc/sendmail/README.cf
        my.domain               esmtp:host.my.domain


--
shrek-m

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From marco at XSSNET.COM  Tue Nov 23 14:25:23 2004
From: marco at XSSNET.COM (Marco Benton - BOFH)
Date: Thu Jan 12 21:27:40 2006
Subject: Mail delivery?
Message-ID: <mailman.5041.1137101260.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

shrek-m@gmx.de wrote:

> Mark Pottage wrote:
>
>> abc.com                      esmtp[x.x.x.x]
>
>
>
> abc.com       esmtp:[12.34.56.78]
>
> is ok.
>
> $ grep esmtp: /usr/share/doc/sendmail/README.cf
>        my.domain               esmtp:host.my.domain
>

esmtp is fine, it's the IP address that might not work.  but sinces it's
in mailertable and not virtusertable it should not be a problem.
Sendmail frowns upon direct usage of IP addresses.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From campbell at cnpapers.com  Tue Nov 23 15:55:13 2004
From: campbell at cnpapers.com (Steve Campbell)
Date: Thu Jan 12 21:27:40 2006
Subject: SA 3.0.1 Install failure lessons learned
Message-ID: <mailman.5042.1137101260.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I think I have the MS-4.31.6/SA-3.0.1 upgrade running now on my Tao box. If
anyone is interested, this is what I learned during this process.

The MailScanner upgrade went very smoothly.

I downloaded *.rpm.tar.gz file. So far so good.
  # gzip -dc MailScanner-4.31-6.rpm.tar.gz | tar xf -
  # cd MailScanner-4.31-6

I upgraded the db4 libs from 4.1.25 to 4.2.52 (Thanks to Steve Freegard and
Steve Swaney).
Look in the MailScanner archives for "Re: Problem installing SpamAssassin
3.0.1"
I downloaded the rpms from
http://projects.standblue.net/rpms/subversion/1.0.2/rhes3.0/db4/
As per the suggestions:
   # rpm -e db4-devel
   # rpm -e db4-utils

This will still leave the db4 4.1.25 main rpm installed. Next install (not
upgrade) the new db4 + devel+ utils rpms.

   # rpm -ivh db4*

I rebuilt the DB_file with the new db4 library

   #perl -MCPAN
   # yes or no - what ever is applicable for your setup. I used no
   # cpan> force install DB_file

Now install MailScanner with the installation script.

   # ./install.sh

Follow all the normal stuff like updating your MailScanner.conf and search
for all of the *.rpmnew files

Now the fun begins:

I downloaded the INSTALL-rpm.sh script for installing SA and CLAM and ran
that. This failed due to dependency problems. I failed to realize that there
was a difference between the full spamassassin package and the perl module
that the script was going to install. Here Steve Swaney spoke up and made me
see the light. I just didn't recognize what he was saying at the time.

I downloaded the source and was prepared to install this. After unpacking
the source and reading the UPGRADE file, I realized that the bayes files
needed upgrading BEFORE and AFTER starting SA3. One location said to run
sa-learn --rebuild BEFORE; another said to run sa-learn --sync AFTER. One is
the old version, the other the new. So I ran the BEFORE before starting SA3

   # sa-learn --rebuild -p /etc/MailScanner/spam.assassin.prefs.conf

This ran fine, so I figured I was on the right track. I had finally realized
why the INSTALL-rpm.sh was not working, so I deleted my old spamassassin
RPMs

   # rpm -e spamassassin
   # rpm -e spamassassin-tools

I then ran the INSTALL-rpm.sh --noclam and all went well
   # ./INSTALL-rpm.sh --noclam

Then I ran the new sa-learn --sync stuff and it wouldn't update. No matter
what I tried, this kept saying that it couldn't use the db 2 format. The
only option I had was to delete my bayes files and start fresh.

I ran a spamassassin --lint on my current setup and found that some of the
old RBL rules were not valid anymore

   # spamassassin -p /etc/MailScanner/spam.assassin.prefs.conf --lint

I then commented out of my spam.assassin.prefs.conf the above erroneous
entries and added the "auto_white_list 0" flag.

I started MailScanner and all seemed well except for the bayes stuff not
being current. Hopefully this will resolve itself shortly.

I have three problems left from the above details that I need to resolve.

1)  The bayes problem. I need to find out why this happened as I have two
more servers to upgrade.
2)  The start/stop script for MailScanner does not seem to work as before
_for me_. When I run stop, I get the return that all is OK, but when I look,
the queue runners may still be cooking. I have to manually kill these
sometimes. If I don't, then obviously I get a message on restart that the
socket/port is already in use. This bothers me a little.
3)  The best way to upgrade a RH 7.3 server as this is running perl 5.6 and
SA does not support < perl 5.8

Anyway, I hope this helps someone as much as others have helped me.

Steve Campbell
campbell@cnpapers.com
Charleston Newspapers

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From William.Burns at AEROFLEX.COM  Tue Nov 23 16:46:00 2004
From: William.Burns at AEROFLEX.COM (William Burns)
Date: Thu Jan 12 21:27:40 2006
Subject: CustomFunction: WhiteListFutureSender
Message-ID: <mailman.5043.1137101260.24926.mailscanner@lists.mailscanner.info>

paddy wrote:

> Mind you, I haven't even tested this on the one machine, this time!
>
>And this also raises the question of what to do with mail that is
>whitelisted to one of multiple recipients.
>
>
>
Right, W/ The procmail (local mailbox) solution, some users would get a
tagged subject-line while others would not.
W/ a gateway solution, this may not be possible.
Or... You'd have to figure out if/when the mail needed to be split into
multiple queue files... That sounds more like the job of an MTA...
Sorry, I don't have an idea of the "right" way to do that.

>Procmail gets you delivery time, which is nice for solving the 'where is
>the database' and the 'whitelisted to one of multiple recipients' problems.
>

A related issue w/ procmail/local delivery that you might not have w/ a
gateway/MailScanner solution:
Multiple e-mail aliases per user.

Mail sent from "long.name@address.com" AND "lname@address.com" is
associated w/ a mailbox named "lname". I had to do a bunch of manual
configs to get the outbound recip. address written to the right
local-user database/file. That way, procmail could check one file for
the "lname" user at delivery time.

-Bill

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dhawal at NETMAGICSOLUTIONS.COM  Tue Nov 23 17:21:17 2004
From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy)
Date: Thu Jan 12 21:27:40 2006
Subject: Notify Sender.. doesn't work but Sys-admin notices do.
Message-ID: <mailman.5044.1137101260.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hello all,

I have the following in /etc/MailScanner/MailScanner.conf
Notify Senders = yes
Notify Senders Of Viruses = no
Notify Senders Of Blocked Filenames Or Filetypes = yes
Notify Senders Of Other Blocked Content = yes
Never Notify Senders Of Precedence = list bulk

I also have the following
Send Notices = yes
Notices Include Full Headers = yes
Hide Incoming Work Dir in Notices = no

I tried sending myself an .exe file from a yahoo account.. but never got
a notification on the yahoo account, though I did get a Sys-admin
notification for "Bad Filename Detected"

Searched the mailscanner archives to find Julian asking someone to check
the reports, the report seems fine as well

Content of /etc/MailScanner/reports/en/sender.filename.report.txt

From: "PostMaster" <$localpostmaster>
To: $from
Subject: Warning: E-mail viruses detected
X-%org-name%-MailScanner: generated

Our e-mail content detector has just been triggered by a message you sent:
   To: $to
   Subject: $subject
   Date: $date

One or more of the attachments ($filename) are on
the list of unacceptable attachments for this site and will not have
been delivered.

Consider renaming the files to avoid this constraint.

The virus detector said this about the message:
Report: $report

What am I doing wrong?

MailScanner -v output (postfix + )
Running on
Linux mx1.netmagicians.com 2.4.21-20.EL.c0smp #1 SMP Thu Sep 9 01:53:25
EDT 2004 i686 i686 i386 GNU/Linux
This is CentOS release 3.3 (final)
This is Perl version 5.008000 (5.8.0)

This is MailScanner version 4.35.11
Module versions are:
1.00    AnyDBM_File
1.14    Archive::Zip
1.01    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.04    Fcntl
2.71    File::Basename
2.05    File::Copy
2.01    FileHandle
1.05    File::Path
0.13    File::Temp
1.23    HTML::Entities
3.26    HTML::Parser
2.24    HTML::TokeParser
1.20    IO
1.09    IO::File
1.122   IO::Pipe
3.05    MIME::Base64
5.415   MIME::Decoder
5.415   MIME::Decoder::UU
5.415   MIME::Head
5.415   MIME::Parser
3.03    MIME::QuotedPrint
5.415   MIME::Tools
0.09    Net::CIDR
1.05    POSIX
1.75    Socket
0.03    Sys::Syslog
1.02    Time::localtime

Optional module versions are:
1.810   DB_File
1.08    Digest
1.01    Digest::HMAC
2.33    Digest::MD5
2.10    Digest::SHA1
0.44    Inline
0.11    Mail::ClamAV
3.000001        Mail::SpamAssassin
1.997   Mail::SPF::Query
0.15    Net::CIDR::Lite
0.48    Net::DNS
0.32    Net::LDAP
1.94    Parse::RecDescent
missing SAVI
1.2     Sys::Hostname::Long
2.26    Test::Harness
0.47    Test::Simple
1.89    Text::Balanced
1.19    URI

thanks in advance,
- dhawal

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From brendan.codykenny at REALEXPAYMENTS.COM  Tue Nov 23 17:54:31 2004
From: brendan.codykenny at REALEXPAYMENTS.COM (Brendan Cody-Kenny)
Date: Thu Jan 12 21:27:40 2006
Subject: mailscanner not calling spamassassin?
Message-ID: <mailman.5045.1137101260.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hello all,
I have been having some very annoying trouble lately with mailscanner
using spamassassin. As far as I have looked (which is pretty far) I have
correct settings for mailscanner and spamassassin. (spamassassin 2.64
and mailscanner 4.35.11)

The problem is that mailscanner does not appear to be calling
spamassassin properly but is not generating any logs to indicate the
problem. I thought mailscanner was calling spamassassin and it was
returning 0 everytime but it turned out that "Always Include
SpamAssassin Report = yes" was giving every message a score of 0. After
changing this it appears that mailscanner is not running spamassassin at
all. I used strace on mailscanner and sifted though the results but
could not find anything conclusinve. A test of spamassassin from the
command line on a message returns a reasonable result (other than 0) for
a message but mailscanner is not doing this. I have included
Mailscanner.conf and spam.assassin.prefs.conf. Can anyone help? I hope
it is something really simple that I have misssed but I have been
looking at it for so long now that its invisible to me.

thanks.

--
Brendan Cody-Kenny | brendan.codykenny@realexpayments.com
Network Administrator




------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2: "Attached Text" ]

# MailScanner
# MailScanner users, please see the comments at the bottom of this file.
# MailScanner
#
# SpamAssassin user preferences file.
#
# Format:
#
#   required_hits n
#               (how many hits are required to tag a mail as spam.)
#
#   score SYMBOLIC_TEST_NAME n
#               (if this is omitted, 1 is used as a default score.
#               Set the score to 0 to ignore the test.)
#
# # starts a comment, whitespace is not significant.
#
###########################################################################

# JKF 25/10/2002
# These next 6 lines add 2 local rules to SpamAssassin to help protect you
# from the friendlygreetings.com nasty-gram which will send lots of spam
# from your PC if you let it. Not really a virus, but you don't want your
# users all clicking on it.

#header   FRIEND_GREETINGS      Subject =~ /you have an E-Card from/i
#describe FRIEND_GREETINGS      Nasty E-card from FriendGreetings.com
#score    FRIEND_GREETINGS      100.0
#header   FRIEND_GREETINGS2     Subject =~ /you have a greeting card from/i
#describe FRIEND_GREETINGS2     Nasty E-card from FriendGreetings.com
#score    FRIEND_GREETINGS2     100.0

###########################################################################
# First of all, the generally useful stuff; thresholds and the whitelist
# of addresses which, for some reason or another, often trigger false
# positives.

# JKF 25/10/2002
# The required_hits value is now specified in the MailScanner configuration
# file, not here. Look for the word "Required" in there and you will find it.
required_hits           3.75

#
# JKF 28/04/2003
# The following settings has been pretty much superceded by the "Advanced
# SpamAssassin Settings" in MailScanner.conf.
#
# JKF 26/03/2003
# If your root filesystem is filling up because SpamAssassin is putting
# large databases in /.spamassassin or /root/.spamassassin, you can move
# them using the following lines to point to their new locations.
# The last part of the path is not a directory name, but actually the
# start of the filenames. So with the settings below, the Bayes files will
# be created as /var/spool/spamassassin/bayes_msgcount, etc.
#
auto_whitelist_path        /var/lib/MailScanner/auto-whitelist
auto_whitelist_file_mode   0600
bayes_path                 /var/lib/MailScanner/bayes/bayes
bayes_file_mode            0600

# MailScanner: When using the scheduled Bayes expiry feature, you probably
# MailScanner: want to turn off auto-expiry as it will rarely complete before
# MailScanner: it is killed for taking too long. You will just end up with
# MailScanner: big bayes_toks.new files wasting space.
 bayes_auto_expire 0

# Whitelist and blacklist addresses are now file-glob-style patterns, so
# "friend@somewhere.com", "*@isp.com", or "*.domain.net" will all work.
# Specifically, "*" and "?" are allowed, but all other metacharacters
# are not.  Regular expressions are not used for security reasons.
#
# Multiple addresses per line, separated by spaces, is OK.  Multiple
# "whitelist_from" lines is also OK.
#
# whitelist_from                monty@roscom.com

# Add your blacklist entries in the same format...
#
# blacklist_from        friend@public.com

# Mail using languages used in these country codes will not be marked
# as being possibly spam in a foreign language.
#
# ok_locales            en

# By default, SpamAssassin will run RBL checks.  If your ISP already
# does this, set this to 1.
#
skip_rbl_checks 1 #bck 22-9-04

###########################################################################
# Add your own customised scores for some tests below.  The default scores are
# read from the installed "spamassassin.cf" file, but you can override them
# here.  To see the list of tests and their default scores, go to
# http://spamassassin.taint.org/tests.html .

# MailScanner: Comment out the next line to enable DCC checking if you
#              have dcc installed (optional part of SpamAssassin)
# JKF Commented out as it no longer generates maillog warnings
#score DCC_CHECK 0.0
dcc_path /usr/local/bin/dccproc

#
# Added for MailScanner 23/5/2003
# The timeouts for blacklists and Razor are rather generous in the default
# state that SpamAssassin is shipped. Reducing these stops a lot of timeouts
# from removing SpamAssassin scores altogether.
#
rbl_timeout 1
razor_timeout 1
pyzor_timeout 1

#
# Added for MailScanner 14/6/2002
# If you specify these scores, SpamAssassin will do RBL checks as well as
# MailScanner, which just wastes CPU power and network bandwidth. Either
# do them here by uncommenting the rules below (if you have paid for them)
# or else uncomment the "skip_rbl_checks" line above and let MailScanner
# do the checks instead.
#
#score RCVD_IN_BL_SPAMCOP_NET    4
# These next 3 will cost you money, see mailscanner.conf.
#score RCVD_IN_RBL               10
#score RCVD_IN_RSS               1
#score RCVD_IN_DUL               1

# Osirusoft is dead
#score RCVD_IN_OSIRUSOFT_COM 0.0
#score X_OSIRU_OPEN_RELAY 0.0
#score X_OSIRU_DUL 0.0
#score X_OSIRU_SPAM_SRC 0.0
#score X_OSIRU_SPAMWARE_SITE 0.0
#score X_OSIRU_DUL_FH 0.0

# For spam and notspam bins
bayes_ignore_header X-MailScanner
bayes_ignore_header X-MailScanner-SpamCheck
bayes_ignore_header X-MailScanner-SpamScore
bayes_ignore_header X-MailScanner-Information
# Change according to %org-name% in /etc/MailScanner/MailScanner.conf
bayes_ignore_header X-MailScanner
bayes_ignore_header X-MailScanner-SpamCheck
bayes_ignore_header X-MailScanner-SpamScore
bayes_ignore_header X-MailScanner-Information

# By default, the Bayesian engine is used. This is a real CPU hog and uses
# a lot of system resources to work.
# On a small overloaded system, you might need to disable it.
 use_bayes 1

auto_learn 0
#bck 13-9-2004
Spam Score Number Format = %5.2f

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 3: "Attached Text" ]

# Main configuration file for the MailScanner E-Mail Virus Scanner
#
# It's good practice to check through configuration files to make sure
# they fit with your system and your needs, whatever you expect them to
# contain.
#
# Note: If your directories are symlinked (soft-linked) in any way,
#       please put their *real* location in here, not a path that
#       includes any links. You may get some very strange error
#       messages from some of the virus scanners if you don't.
#
# Note for Version 4.00 and above:
#       A lot of the settings can take a ruleset as well as just simple
#       values. These rulesets are files containing rules which are applied
#       to the current message to calculate the value of the configuration
#       option. The rules are checked in the order they appear in the ruleset.
#
# Note for Version 4.03 and above:
#       As well as rulesets, you can now include your own functions in
#       here. Look at the directory containing Config.pm and you will find
#       CustomConfig.pm. In here, you can add your own "value" function and
#       an Initvalue function to set up any global state you need such as
#       database connections. Then for a setting below, you can put:
#               Configuration Option = &ValueFunction
#       where "ValueFunction" is the name of the function you have
#       written in CustomConfig.pm.
#

#
# Definition of variables which are substituted into definitions below
#

# Set the directory containing all the reports in the required language
%report-dir% = /etc/MailScanner/reports/en

# Configuration directory containing this file
%etc-dir% = /etc/MailScanner

# Rulesets directory containing your ".rules" files
%rules-dir% = /etc/MailScanner/rules

# Enter a short identifying name for your organisation below, this is
# used to make the X-MailScanner headers unique for your organisation.
# Multiple servers within one site should use an identical value here
# to avoid adding multiple redundant headers where mail has passed
# through several servers within your organisation.
# RULE: It must not contain any spaces!
# Note: Some Symantec scanners complain (incorrectly) about "."
# ***** characters appearing in the names of headers.
#
# Note: This change has to be reflected in the 'bayes_ignore_header'
# options in /etc/MailScanner/spam.assassin.prefs.conf,
%org-name% =

#
# System settings
# ---------------
#

# How many MailScanner processes do you want to run at a time?
# There is no point increasing this figure if your MailScanner server
# is happily keeping up with your mail traffic.
# If you are running on a server with more than 1 CPU, or you have a
# high mail load (and/or slow DNS lookups) then you should see better
# performance if you increase this figure.
# If you are running on a small system with limited RAM, you should
# note that each child takes just over 20MB.
#
# As a rough guide, try 5 children per CPU. But read the notes above.
Max Children = 1  #( bck for testing spamassassin 15-11-2004 )5

# User to run as (not normally used for sendmail)
# If you want to change the ownership or permissions of the quarantine or
# temporary files created by MailScanner, please see the "Incoming Work"
# settings later in this file.
#Run As User = mail
#Run As User = postfix
Run As User = Debian-exim

# Group to run as (not normally used for sendmail)
#Run As Group = mail
#Run As Group = postfix
Run As Group = Debian-exim

# How often (in seconds) should each process check the incoming mail
# queue for new messages? If you have a quiet mail server, you might
# want to increase this value so it causes less load on your server, at
# the cost of slightly increasing the time taken for an average message
# to be processed.

Queue Scan Interval = 50

# Set location of incoming mail queue
#
# This can be any one of
# 1. A directory name
#    Example: /var/spool/exim4_incoming/input
# 2. A wildcard giving directory names
#    Example: /var/spool/mqueue.in/*
# 3. The name of a file containing a list of directory names,
#    which can in turn contain wildcards.
#    Example: /etc/MailScanner/mqueue.in.list.conf
#
Incoming Queue Dir = /var/spool/exim.in/input

# Set location of outgoing mail queue.
# This can also be the filename of a ruleset.
Outgoing Queue Dir = /var/spool/exim.out/input

# Set where to unpack incoming messages before scanning them
# This can completely safely use tmpfs or a ramdisk, which will
# give you a significant performance improvement.
# NOTE: The path given here must not include any links at all,
# NOTE: but must be the absolute path to the directory.
Incoming Work Dir = /var/spool/MailScanner/incoming

# Set where to store infected and message attachments (if they are kept)
# This can also be the filename of a ruleset.
quarantine Dir = /var/spool/MailScanner/quarantine

# Set where to store the process id number so you can stop MailScanner
PID file = /var/run/MailScanner/MailScanner.pid

# To avoid resource leaks, re-start periodically
Restart Every = 14400

# Set whether to use postfix, sendmail, exim or zmailer.
# If you are using postfix, then see the "SpamAssassin User State Dir"
# setting near the end of this file
MTA = exim

# Set how to invoke MTA when sending messages MailScanner has created
# (e.g. to sender/recipient saying "found a virus in your message")
# This can also be the filename of a ruleset.
Sendmail = /usr/sbin/exim4 -qf -C /etc/exim/configure.out

# Sendmail2 is provided for Exim users.
# It is the command used to attempt delivery of outgoing cleaned/disinfected
# messages.
# This is not usually required for sendmail.
# This can also be the filename of a ruleset.
#For Exim users: Sendmail2 = /usr/sbin/exim -C /etc/exim/exim4_outgoing.conf
#For sendmail users: Sendmail2 = /usr/lib/sendmail
Sendmail2 = /usr/sbin/exim4 -qf -C /etc/exim/configure.out #exim4_outgoing.conf
#Sendmail2 = /usr/lib/sendmail

#
# Incoming Work Dir Settings
# --------------------------
#
# You should not normally need to touch these settings at all,
# unless you are using ClamAV and need to be able to use the
# external archive unpackers instead of ClamAV's built-in ones.

# If you want to create the temporary working files so they are owned
# by a user other than the "Run As User" setting at the top of this file,
# you can change that here.
# Note: If the "Run As User" is not "root" then you cannot change the
#       user but may still be able to change the group, if the
#       "Run As User" is a member of both of the groups "Run As Group"
#       and "Incoming Work Group".
incoming Work User = Debian-exim
Incoming Work Group = Debian-exim

# If you want processes running under the same *group* as MailScanner to
# be able to read the working files (and list what is in the
# directories, of course), set to 0640. If you want *all* other users to
# be able to read them, set to 0644. For a detailed description, if
# you're not already familiar with it, refer to `man 2 chmod`.
# Typical use: external helper programs of virus scanners (notably ClamAV),
# like unpackers.
# Use with care, you may well open security holes.
Incoming Work Permissions = 0640

#
# Quarantine and Archive Settings
# -------------------------------
#
# If, for example, you are using a web interface so that users can manage
# their quarantined files, you might want to change the ownership and
# permissions of the quarantined so that they can be read and/or deleted
# by the web server.
# Don't touch this unless you know what you are doing!

# If you want to create the quarantine/archive so the files are owned
# by a user other than the "Run As User" setting at the top of this file,
# you can change that here.
# Note: If the "Run As User" is not "root" then you cannot change the
#       user but may still be able to change the group, if the
#       "Run As User" is a member of both of the groups "Run As Group"
#       and "Quarantine Group".
Quarantine User = Debian-exim
Quarantine Group = Debian-exim

# If you want processes running under the same *group* as MailScanner to
# be able to read the quarantined files (and list what is in the
# directories, of course), set to 0640. If you want *all* other users to
# be able to read them, set to 0644. For a detailed description, if
# you're not already familiar with it, refer to `man 2 chmod`.
# Typical use: let the webserver have access to the files so users can
# download them if they really want to.
# Use with care, you may well open security holes.
Quarantine Permissions = 0600

#
# Processing Incoming Mail
# ------------------------
#

# In every batch of virus-scanning, limit the maximum
# a) number of unscanned messages to deliver
# b) number of potentially infected messages to unpack and scan
# c) total size of unscanned messages to deliver
# d) total size of potentially infected messages to unpack and scan

Max Unscanned Bytes Per Scan = 100000000
Max Unsafe Bytes Per Scan = 50000000
Max Unscanned Messages Per Scan = 30
Max Unsafe Messages Per Scan = 30

# If more messages are found in the queue than this, then switch to an
# "accelerated" mode of processing messages. This will cause it to stop
# scanning messages in strict date order, but in the order it finds them
# in the queue. If your queue is bigger than this size a lot of the time,
# then some messages could be greatly delayed. So treat this option as
# "in emergency only".
Max Normal Queue Size = 800

# The maximum number of attachments allowed in a message before it is
# considered to be an error. Some email systems, if bouncing a message
# between 2 addresses repeatedly, add information about each bounce as
# an attachment, creating a message with thousands of attachments in just
# a few minutes. This can slow down or even stop MailScanner as it uses
# all available memory to unpack these thousands of attachments.
# This can also be the filename of a ruleset.
Maximum Attachments Per Message = 200

# Expand TNEF attachments using an external program (or a Perl module)?
# This should be "yes" unless the scanner you are using (Sophos, McAfee) has
# the facility built-in. However, if you set it to "no", then the filenames
# within the TNEF attachment will not be checked against the filename rules.
Expand TNEF = yes

# Some versions of Microsoft Outlook generate unparsable Rich Text
# format attachments. Do we want to deliver these bad attachments anyway?
# Setting this to yes introduces the slight risk of a virus getting through,
# but if you have a lot of troubled Outlook users you might need to do this.
# We are working on a replacement for the TNEF decoder.
# This can also be the filename of a ruleset.
Deliver Unparsable TNEF = no

# Where the MS-TNEF expander is installed.
# This is EITHER the full command (including maxsize option) that runs
# the external TNEF expander binary,
# OR the keyword "internal" which will make MailScanner use the Perl
# module that does the same job.
# They are both provided as I am unsure which one is faster and which
# one is capable of expanding more file formats (there are plenty!).
#
# The --maxsize option limits the maximum size that any expanded attachment
# may be. It helps protect against Denial Of Service attacks in TNEF files.
#TNEF Expander    = internal
# This can also be the filename of a ruleset.
TNEF Expander = /usr/bin/tnef --maxsize=100000000

# The maximum length of time the TNEF Expander is allowed to run for 1 message.
# (in seconds)
TNEF Timeout = 120

# Where the "file" command is installed.
# This is used for checking the content type of files, regardless of their
# filename.
# To disable Filetype checking, set this value to blank.
File Command = #/usr/bin/file

# The maximum length of time the "file" command is allowed to run for 1
# batch of messages (in seconds)
File Timeout = 20

# The maximum size, in bytes, of any message including the headers.
# If this is set to zero, then no size checking is done.
# This can also be the filename of a ruleset, so you can have different
# settings for different users. You might want to set this quite small for
# dialup users so their email applications don't time out downloading huge
# messages.
Maximum Message Size = 0

# The maximum size, in bytes, of any attachment in a message.
# If this is set to zero, effectively no attachments are allowed.
# If this is set less than zero, then no size checking is done.
# This can also be the filename of a ruleset, so you can have different
# settings for different users. You might want to set this quite small for
# large mailing lists so they don't get deluged by large attachments.
Maximum Attachment Size = -1

# The maximum depth to which zip archives will be unpacked, to allow for
# checking filenames and filetypes within zip archives.
# To disable this feature set this to 0.
# A common useful setting is this option = 0, and Allow Password-Protected
# Archives = no. That block password-protected archives but does not do
# any filename/filetype checks on the files within the archive.
Maximum Archive Depth = 2

# Find zip archives by filename or by file contents?
# Finding them by content is a far more reliable way of finding them, but
# it does mean that you cannot tell your users to avoid zip file checking
# by renaming the file from ".zip" to "_zip" and tricks like that.
# Only set this to no (i.e. check by filename only) if you don't want to
# reliably check the contents of zip files. Note this does not affect
# virus checking, but it will affect all the other checks done on the contents
# of the zip file.
# This can also be the filename of a ruleset.
Find Archives By Content = yes

#
# Virus Scanning and Vulnerability Testing
# ----------------------------------------
#

# Do you want to scan email for viruses?
# A few people don't have a virus scanner licence and so want to disable
# all the virus scanning.
# NOTE: This switch actually switches on/off all processing of the email
#       messages. If you just want to switch off actual virus scanning,
#       then set "Virus Scanners = none" instead.
#
# If you want to be able to switch scanning on/off for different users or
# different domains, set this to the filename of a ruleset.
# This can also be the filename of a ruleset.
Virus Scanning = yes

# Which Virus Scanning package to use:
# sophos    from www.sophos.com, or
# sophossavi (also from www.sophos.com, using the SAVI perl module), or
# mcafee    from www.mcafee.com, or
# command   from www.command.co.uk, or
# bitdefender from www.bitdefender.com, or
# drweb     from www.dials.ru/english/dsav_toolkit/drwebunix.htm, or
# kaspersky-4.5 from www.kaspersky.com, or
# kaspersky from www.kaspersky.com, or
# kavdaemonclient from www.kaspersky.com, or
# etrust    from http://www3.ca.com/Solutions/Product.asp?ID=156, or
# inoculate from www.cai.com/products/inoculateit.htm, or
# inoculan  from ftp.ca.com/pub/getbbs/linux.eng/inoctar.LINUX.Z, or
# nod32     for No32 before version 1.99 from www.nod32.com, or
# nod32-1.99 for Nod32 1.99 and later, from www.nod32.com, or
# f-secure  from www.f-secure.com, or
# f-prot    from www.f-prot.com, or
# panda     from www.pandasoftware.com, or
# rav       from www.ravantivirus.com, or
# antivir   from www.antivir.de, or
# clamav    from www.clamav.net, or
# clamavmodule (also from www.clamav.net using the ClamAV perl module), or
# trend     from www.trendmicro.com, or
# norman    from www.norman.de, or
# css       from www.symantec.com, or
# avg       from www.grisoft.com, or
# vexira    from www.centralcommand.com, or
# none      (no virus scanning at all)
#
# Note for McAfee users: do not use any symlinks with McAfee at all. It is
#                        very strange but may not detect all viruses when
#                        started from a symlink or scanning a directory path
#                        including symlinks.
#
# Note: If you want to use multiple virus scanners, then this should be a
# space-separated list of virus scanners. For example:
# Virus Scanners = sophos f-prot mcafee
#
# Note: Make sure that you check that the base installation directory in the
#       3rd column of virus.scanners.conf matches the location you have
#       installed each of your virus scanners. The supplied
#       virus.scanners.conf file assumes the default installation locations
#       recommended by each of the virus scanner installation guides.
#
# This *cannot* be the filename of a ruleset.
Virus Scanners = trend

# The maximum length of time the commercial virus scanner is allowed to run
# for 1 batch of messages (in seconds).
Virus Scanner Timeout = 300

# Should I attempt to disinfect infected attachments and then deliver
# the clean ones. "Disinfection" involves removing viruses from files
# (such as removing macro viruses from documents). "Cleaning" is the
# replacement of infected attachments with "VirusWarning.txt" text
# attachments.
# Less than 1% of viruses in the wild can be successfully disinfected,
# as macro viruses are now a rare occurrence. So the default has been
# changed to "no" as it gives a significant performance improvement.
#
# This can also be the filename of a ruleset.
Deliver Disinfected Files = yes

# Strings listed here will be searched for in the output of the virus scanners.
# It is used to list which viruses should be handled differently from other
# viruses. If a virus name is given here, then
# 1) The sender will not be warned that he sent it
# 2) No attempt at true disinfection will take place
#    (but it will still be "cleaned" by removing the nasty attachments
#     from the message)
# 3) The recipient will not receive the message,
#    unless the "Still Deliver Silent Viruses" option is set
# Other words that can be put in this list are the 5 special keywords
#    HTML-IFrame   : inserting this will stop senders being warned about
#                    HTML Iframe tags, when they are not allowed.
#    HTML-Codebase : inserting this will stop senders being warned about
#                    HTML Object Codebase/Data tags, when they are not allowed.
#    HTML-Script   : inserting this will stop senders being warned about
#                    HTML Script tags, when they are not allowed.
#    HTML-Form     : inserting this will stop senders being warned about
#                    HTML Form tags, when they are not allowed.
#    Zip-Password  : inserting this will stop senders being warned about
#                    password-protected zip files, when they are not allowed.
#                    This keyword is not needed if you include All-Viruses.
#    All-Viruses   : inserting this will stop senders being warned about
#                    any virus, while still allowing you to warn senders
#                    about HTML-based attacks. This includes Zip-Password
#                    so you don't need to include both.
#
# The default of "All-Viruses" means that no senders of viruses will be
# notified (as the sender address is always forged these days anyway),
# but anyone who sends a message that is blocked for other reasons will
# still be notified.
#
# This can also be the filename of a ruleset.
Silent Viruses = HTML-IFrame All-Viruses

# Still deliver (after cleaning) messages that contained viruses listed
# in the above option ("Silent Viruses") to the recipient?
# Setting this to "yes" is good when you are testing everything, and
# because it shows management that MailScanner is protecting them,
# but it is bad because they have to filter/delete all the incoming virus
# warnings.
#
# Note: Once you have deployed this into "production" use, you should set
# Note: this option to "no" so you don't bombard thousands of people with
# Note: useless messages they don't want!
#
# This can also be the filename of a ruleset.
Still Deliver Silent Viruses = no

# Strings listed here will be searched for in the output of the virus scanners.
# It works to achieve the opposite effect of the "Silent Viruses" listed above.
# If a string here is found in the output of the virus scanners, then the
# message will be treated as if it were not infected with a "Silent Virus".
# If a message is detected as both a silent virus and a non-forging virus,
# then the ___non-forging status will override the silent status.___
# In simple terms, you should list virus names (or parts of them) that you
# know do *not* forge the From address.
# A good example of this is a document macro virus or a Joke program.
# Another word that can be put in this list is the special keyword
#    Zip-Password  : inserting this will cause senders to be warned about
#                    password-protected zip files, when they are not allowed.
#                    This will over-ride the All-Viruses setting in the list
#                    of "Silent Viruses" above.
#
Non-Forging Viruses = Joke/ OF97/ WM97/ W97M/

# Should encrypted messages be blocked?
# This is useful if you are wary about your users sending encrypted
# messages to your competition.
# This can be a ruleset so you can block encrypted message to certain domains.
Block Encrypted Messages = no

# Should unencrypted messages be blocked?
# This could be used to ensure all your users send messages outside your
# company encrypted to avoid snooping of mail to your business partners.
# This can be a ruleset so you can just check mail to certain users/domains.
Block Unencrypted Messages = no

# Should archives which contain any password-protected files be allowed?
# Leaving this set to "no" is a good way of protecting against all the
# protected zip files used by viruses at the moment.
# This can also be the filename of a ruleset.
Allow Password-Protected Archives =  %rules-dir%/owen.obyrne.rules

#
# Options specific to Sophos Anti-Virus
# -------------------------------------
#

# Anything on the next line that appears in brackets at the end of a line
# of output from Sophos will cause the error/infection to be ignored.
# Use of this option is dangerous, and should only be used if you are having
# trouble with lots of corrupt PDF files, for example.
# If you need to specify more than 1 string to find in the error message,
# then put each string in quotes and separate them with a comma.
# For example:
#Allowed Sophos Error Messages = "corrupt", "format not supported"
Allowed Sophos Error Messages =

# The directory (or a link to it) containing all the Sophos *.ide files.
# This is only used by the "sophossavi" virus scanner, and is irrelevant
# for all other scanners.
Sophos IDE Dir = /usr/local/Sophos/ide

# The directory (or a link to it) containing all the Sophos *.so libraries.
# This is only used by the "sophossavi" virus scanner, and is irrelevant
# for all other scanners.
Sophos Lib Dir = /usr/local/Sophos/lib

# SophosSAVI only: monitor each of these files for changes in size to
# detect when a Sophos update has happened. The date of the Sophos Lib Dir
# is also monitored.
# This is only used by the "sophossavi" virus scanner, not the "sophos"
# scanner setting.
Monitors For Sophos Updates = /usr/local/Sophos/ide/*ides.zip

#
# Options specific to ClamAV Anti-Virus
# -------------------------------------
#

# ClamAVModule only: monitor each of these files for changes in size to
# detect when a ClamAV update has happened.
# This is only used by the "clamavmodule" virus scanner, not the "clamav"
# scanner setting.
Monitors for ClamAV Updates = /usr/local/share/clamav/*.cvd

#
# Removing/Logging dangerous or potentially offensive content
# -----------------------------------------------------------
#

# Do you want to scan the messages for potentially dangerous content?
# Setting this to "no" will disable all the content-based checks except
# Virus Scanning, Allow Partial Messages and Allow External Message Bodies.
# This can also be the filename of a ruleset.
Dangerous Content Scanning = yes

# Do you want to allow partial messages, which only contain a fraction of
# the attachments, not the whole thing? There is absolutely no way to
# scan these "partial messages" properly for viruses, as MailScanner never
# sees all of the attachment at the same time. Enabling this option can
# allow viruses through. You have been warned.
# This can also be the filename of a ruleset so you can, for example, allow
# them in outgoing mail but not in incoming mail.
Allow Partial Messages = no

# Do you want to allow messages whose body is stored somewhere else on the
# internet, which is downloaded separately by the user's email package?
# There is no way to guarantee that the file fetched by the user's email
# package is free from viruses, as MailScanner never sees it.
# This feature is dangerous as it can allow viruses to be fetched from
# other Internet sites by a user's email package. The user would just
# think it was a normal email attachment and would have been scanned by
# MailScanner.
# It is only currently supported by Netscape 6 anyway, and the only people
# who it are the IETF. So I would strongly advise leaving this switched off.
# This can also be the filename of a ruleset.
Allow External Message Bodies = no

# Do you want to allow <IFrame> tags in email messages? This is not a good
# idea as it allows various Microsoft Outlook security vulnerabilities to
# remain unprotected, but if you have a load of mailing lists sending them,
# then you will want to allow them to keep your users happy.
# Value: yes     => Allow these tags to be in the message
#        no      => Ban messages containing these tags
#        disarm  => Allow these tags, but stop these tags from working
# This can also be the filename of a ruleset, so you can allow them from
# known mailing lists but ban them from everywhere else.
Allow IFrame Tags = %rules-dir%/staff.rules

# Banning <IFrame> tags completely is likely to break some common HTML
# mailing lists, such as Dilbert and other important things like that.
# So before you implement any restriction on them, you can log the sender
# of any message containing an <IFrame>, so that you can set the option
# above to be a ruleset allowing IFrame tags from named "From" addresses
# and banning all others.
# This can also be the filename of a ruleset.
Log IFrame Tags = no

# Do you want to allow <Form> tags in email messages? This is a bad idea
# as these are used as scams to pursuade people to part with credit card
# information and other personal data.
# Value: yes     => Allow these tags to be in the message
#        no      => Ban messages containing these tags
#        disarm  => Allow these tags, but stop these tags from working
#                   Note: Disarming can be defeated, it is not 100% safe!
# This can also be the filename of a ruleset.
Allow Form Tags = yes

# Do you want to allow <Script> tags in email messages? This is a bad idea
# as these are used to exploit vulnerabilities in email applications and
# web browsers.
# Value: yes     => Allow these tags to be in the message
#        no      => Ban messages containing these tags
#        disarm  => Allow these tags, but stop these tags from working
#                   Note: Disarming can be defeated, it is not 100% safe!
# This can also be the filename of a ruleset.
Allow Script Tags = %rules-dir%/staff.rules

# Do you want to allow <Img> tags with very small images in email messages?
# This is a bad idea as these are used as 'web bugs' to find out if a message
# has been read. It is not dangerous, it is just used to make you give away
# information.
# Value: yes     => Allow these tags to be in the message
#        disarm  => Allow these tags, but stop these tags from working
#                   Note: Disarming can be defeated, it is not 100% safe!
# Note: You cannot block messages containing web bugs as their detection
#       is very vulnerable to false alarms.
# This can also be the filename of a ruleset.
Allow WebBugs = disarm

# Do you want to allow <Object Codebase=...> or <Object Data=...> tags
# in email messages?
# This is a bad idea as it leaves you unprotected against various
# Microsoft-specific security vulnerabilities. But if your users demand
# it, you can do it.
# Value: yes     => Allow these tags to be in the message
#        no      => Ban messages containing these tags
#        disarm  => Allow these tags, but stop these tags from working
# This can also be the filename of a ruleset, so you can allow them just
# for specific users or domains.
Allow Object Codebase Tags = no

# This option interacts with the "Allow ... Tags" options above like this:
#
# Allow...Tags    Convert Danger...    Action Taken on HTML Message
# ============    =================    ============================
#    no              no                Blocked
#    no              yes               Blocked
#    disarm          no                Specified HTML tags disarmed
#    disarm          yes               Specified HTML tags disarmed
#    yes             no                Nothing, allowed to pass
#    yes             yes               All HTML tags stripped
#
# If an "Allow ... Tags = yes" is triggered by a message, and this
# "Convert Dangerous HTML To Text" is set to "yes", then the HTML
# message will be converted to plain text.  This makes the HTML
# harmless, while still allowing your users to see the text content
# of the messages.  Note that all graphical content will be removed.
#
# This can also be the filename of a ruleset, so you can make this apply
# only to specific users or domains.
Convert Dangerous HTML To Text = no

# Do you want to convert all HTML messages into plain text?
# This is very useful for users who are children or are easily offended
# by nasty things like pornographic spam.
# This can also be the filename of a ruleset, so you can switch this
# feature on and off for particular users or domains.
Convert HTML To Text = no

#
# Attachment Filename Checking
# ----------------------------
#

# Set where to find the attachment filename ruleset.
# The structure of this file is explained elsewhere, but it is used to
# accept or reject file attachments based on their name, regardless of
# whether they are infected or not.
#
# This can also point to a ruleset, but the ruleset filename must end in
# ".rules" so that MailScanner can determine if the filename given is
# a ruleset or not!
Filename Rules = %etc-dir%/filename.rules.conf

# Set where to find the attachment filetype ruleset.
# The structure of this file is explained elsewhere, but it is used to
# accept or reject file attachments based on their content as determined
# by the "file" command, regardless of whether they are infected or not.
#
# This can also point to a ruleset, but the ruleset filename must end in
# ".rules" so that MailScanner can determine if the filename given is
# a ruleset or not!
#
# To disable this feature, set this to just "Filetype Rules =" or set
# the location of the file command to a blank string.
Filetype Rules = %etc-dir%/filetype.rules.conf

#
# Reports and Responses
# ---------------------
#

# Do you want to store copies of the infected attachments and messages?
# This can also be the filename of a ruleset.
Quarantine Infections = yes

# There is no point quarantining most viruses these days as the infected
# messages contain no useful content, so if you set this to "no" then no
# infections listed in your "Silent Viruses" setting will be quarantined,
# even if you have chosen to quarantine infections in general. This is
# currently set to "yes" so the behaviour is the same as it was in
# previous versions.
# This can also be the filename of a ruleset.
Quarantine Silent Viruses = yes

# Do you want to quarantine the original *entire* message as well as
# just the infected attachments?
# This can also be the filename of a ruleset.
Quarantine Whole Message = yes

# When you quarantine an entire message, do you want to store it as
# raw mail queue files (so you can easily send them onto users) or
# as human-readable files (header then body in 1 file)?
Quarantine Whole Messages As Queue Files = yes

# Set where to find all the strings used so they can be translated into
# your local language.
# This can also be the filename of a ruleset so you can produce different
# languages for different messages.
Language Strings = %report-dir%/languages.conf

# Set where to find the message text sent to users when one of their
# attachments has been deleted from a message.
# These can also be the filenames of rulesets.
Deleted Bad Content Message Report  = %report-dir%/deleted.content.message.txt
Deleted Bad Filename Message Report = %report-dir%/deleted.filename.message.txt
Deleted Virus Message Report        = %report-dir%/deleted.virus.message.txt

# Set where to find the message text sent to users when one of their
# attachments has been deleted from a message and stored in the quarantine.
# These can also be the filenames of rulesets.
Stored Bad Content Message Report  = %report-dir%/stored.content.message.txt
Stored Bad Filename Message Report = %report-dir%/stored.filename.message.txt
Stored Virus Message Report        = %report-dir%/stored.virus.message.txt

# Set where to find the message text sent to users explaining about the
# attached disinfected documents.
# This can also be the filename of a ruleset.
Disinfected Report = %report-dir%/disinfected.report.txt

# Set where to find the HTML and text versions that will be added to the
# end of all clean messages, if "Sign Clean Messages" is set.
# These can also be the filenames of rulesets.
Inline HTML Signature = %report-dir%/inline.sig.html
Inline Text Signature = %report-dir%/inline.sig.txt

# Set where to find the HTML and text versions that will be inserted at
# the top of messages that have had viruses removed from them.
# These can also be the filenames of rulesets.
Inline HTML Warning = %report-dir%/inline.warning.html
Inline Text Warning = %report-dir%/inline.warning.txt

# Set where to find the messages that are delivered to the sender, when they
# sent an email containing either an error, banned content, a banned filename
# or a virus infection.
# These can also be the filenames of rulesets.
Sender Content Report        = %report-dir%/sender.content.report.txt
Sender Error Report        = %report-dir%/sender.error.report.txt
Sender Bad Filename Report = %report-dir%/sender.filename.report.txt
Sender Virus Report        = %report-dir%/sender.virus.report.txt

# Hide the directory path from all virus scanner reports sent to users.
# The extra directory paths give away information about your setup, and
# tend to just confuse users.
# This can also be the filename of a ruleset.
Hide Incoming Work Dir = yes

# Include the name of the virus scanner in each of the scanner reports.
# This also includes the translation of "MailScanner" in each of the report
# lines resulting from one of MailScanner's own checks such as filename,
# filetype or dangerous HTML content. To change the name "MailScanner", look
# in reports/...../languages.conf.
#
# Very useful if you use several virus scanners, but a bad idea if you
# don't want to let your customers know which scanners you use.
Include Scanner Name In Reports = yes

#
# Changes to Message Headers
# --------------------------
#

# Add this extra header to all mail as it is processed.
# This *must* include the colon ":" at the end.
# This can also be the filename of a ruleset.
Mail Header = X-%org-name%-MailScanner:

# Add this extra header to all messages found to be spam.
# This can also be the filename of a ruleset.
Spam Header = X-%org-name%-MailScanner-SpamCheck:

# Add this extra header if "Spam Score" = yes. The header will
# contain 1 character for every point of the SpamAssassin score.
Spam Score Header = X-%org-name%-MailScanner-SpamScore:

# Add this extra header to all mail as it is processed.
# The contents is set by "Information Header Value" and is intended for
# you to be able to insert a help URL for your users.
# If you don't want an information header at all, just comment out this
# setting or set it to be blank.
# This can also be the filename of a ruleset.
#Information Header = X-%org-name%-MailScanner-Information:

# Do you want to add the Envelope-From: header?
# This is very useful for tracking where spam came from as it
# contains the envelope sender address.
# This can also be the filename of a ruleset.
Add Envelope From Header = yes

# Do you want to add the Envelope-To: header?
# This can be useful for tracking span destinations, but should be
# used with care due to possible privacy concerns with the use of
# Bcc: headers by users.
# This can also be the filename of a ruleset.
Add Envelope To Header = no

# This is the name of the Envelope From header
# controlled by the option above.
# This can also be the filename of a ruleset.
Envelope From Header = X-MailScanner-From:

# This is the name of the Envelope To header
# controlled by the option above.
# This can also be the filename of a ruleset.
Envelope To Header = X-MailScanner-To:

# The character to use in the "Spam Score Header".
# Don't use: x as a score of 3 is "xxx" which the users will think is porn,
#            # as it will cause confusion with comments in procmail as well
#              as MailScanner itself,
#            * as it will cause confusion with pattern matches in procmail,
#            . as it will cause confusion with pattern matches in procmail,
#            ? as it will cause the users to think something went wrong.
# "s" is nice and safe and stands for "spam".
Spam Score Character = s

# If this option is set to yes, you will get a spam-score header saying just
# the value of the spam score, instead of the row of characters representing
# the score.
# This can also be the filename of a ruleset.
SpamScore Number Instead Of Stars = yes

# This sets the minimum number of "Spam Score Characters" which will appear
# if a message triggered the "Spam List" setting but received a very low
# SpamAssassin score. This means that people who only filter on the "Spam
# Stars" will still be able to catch messages which receive a very low
# SpamAssassin score. Set this value to 0 to disable it.
# This can also be the filename of a ruleset.
Minimum Stars If On Spam List = 5

# Set the "Mail Header" to these values for clean/infected/disinfected messages.
# This can also be the filename of a ruleset.
Clean Header Value       = Found to be clean
Infected Header Value    = Found to be infected
Disinfected Header Value = Disinfected

# Set the "Information Header" to this value.
# This can also be the filename of a ruleset.
Information Header Value = Please contact the ISP for more information

# Do you want the full spam report, or just a simple "spam / not spam" report?
Detailed Spam Report = yes

# Do you want to include the numerical scores in the detailed SpamAssassin
# report, or just list the names of the scores
Include Scores In SpamAssassin Report = yes

# Do you want to always include the Spam Report in the SpamCheck
# header, even if the message wasn't spam?
# This can also be the filename of a ruleset.
Always Include SpamAssassin Report = yes

# What to do when you get several MailScanner headers in one message,
# from multiple MailScanner servers. Values are
#      "append"  : Append the new data to the existing header
#      "add"     : Add a new header
#      "replace" : Replace the old data with the new data
# Default is "append"
# This can also be the filename of a ruleset.
Multiple Headers = add

# Name of this host, or a name like "the MailScanner" if you want to hide
# the real hostname. It is used in the Help Desk note contained in the
# virus warnings sent to users.
# This can also be the filename of a ruleset.
Hostname = the %org-name% MailScanner

# If this is "no", then (as far as possible) messages which have already
# been processed by another MailScanner server will not have the clean
# signature added to the message. This prevents messages getting many
# copies of the signature as they flow through your site.
# This can also be the filename of a ruleset.
Sign Messages Already Processed = yes #bck 13 sept 2004

# Add the "Inline HTML Signature" or "Inline Text Signature" to the end
# of uninfected messages?
# This can also be the filename of a ruleset.
Sign Clean Messages = no

# Add the "Inline HTML Warning" or "Inline Text Warning" to the top of
# messages that have had attachments removed from them?
# This can also be the filename of a ruleset.
Mark Infected Messages = yes

# When a message is to not be virus-scanned (which may happen depending
# upon the setting of "Virus Scanning", especially if it is a ruleset),
# do you want to add the header advising the users to get their email
# virus-scanned by you?
# Very good for advertising your MailScanning service and encouraging
# users to give you some more money and sign up to virus scanning.
# This can also be the filename of a ruleset.
Mark Unscanned Messages = yes

# This is the text used by the "Mark Unscanned Messages" option above.
# This can also be the filename of a ruleset.
Unscanned Header Value = Not scanned: please contact your Internet E-Mail Service Provider for details

# Do you want to deliver messages once they have been cleaned of any
# viruses?
# By making this a ruleset, you can re-create the "Deliver From Local"
# facility of previous versions.
Deliver Cleaned Messages = yes

#
# Notifications back to the senders of blocked messages
# -----------------------------------------------------
#

# Do you want to notify the people who sent you messages containing
# viruses or badly-named filenames?
# This can also be the filename of a ruleset.
Notify Senders = no

# *If* "Notify Senders" is set to yes, do you want to notify people
# who sent you messages containing viruses?
# The default value has been changed to "no" as most viruses now fake
# sender addresses and therefore should be on the "Silent Viruses" list.
# This can also be the filename of a ruleset.
Notify Senders Of Viruses = no

# *If* "Notify Senders" is set to yes, do you want to notify people
# who sent you messages containing attachments that are blocked due to
# their filename or file contents?
# This can also be the filename of a ruleset.
Notify Senders Of Blocked Filenames Or Filetypes = no

# *If* "Notify Senders" is set to yes, do you want to notify people
# who sent you messages containing other blocked content, such as
# partial messages or messages with external bodies?
# This can also be the filename of a ruleset.
Notify Senders Of Other Blocked Content = no

# If you supply a space-separated list of message "precedence" settings,
# then senders of those messages will not be warned about anything you
# rejected. This is particularly suitable for mailing lists, so that any
# MailScanner responses do not get sent to the entire list.
Never Notify Senders Of Precedence = list bulk

#
# Changes to the Subject: line
# ----------------------------
#

# When the message has been scanned but no other subject line changes
# have happened, do you want modify the subject line?
# This can be 1 of 3 values:
#      no    = Do not modify the subject line, or
#      start = Add text to the start of the subject line, or
#      end   = Add text to the end of the subject line.
# This makes very good advertising of your MailScanning service.
# This can also be the filename of a ruleset.
Scanned Modify Subject = no # end

# This is the text to add to the start/end of the subject line if the
# "Scanned Modify Subject" option is set.
# This can also be the filename of a ruleset.
Scanned Subject Text = {Scanned}

# If the message contained a virus, do you want to modify the subject line?
# This makes filtering in Outlook very easy.
# This can also be the filename of a ruleset.
Virus Modify Subject = yes

# This is the text to add to the start of the subject if the
# "Virus Modify Subject" option is set.
# This can also be the filename of a ruleset.
Virus Subject Text = {Virus?}

# If an attachment triggered a filename check, but there was nothing
# else wrong with the message, do you want to modify the subject line?
# This makes filtering in Outlook very easy.
# This can also be the filename of a ruleset.
Filename Modify Subject = yes

# This is the text to add to the start of the subject if the
# "Filename Modify Subject" option is set.
# You might want to change this so your users can see at a glance
# whether it just was just the filename that MailScanner rejected.
# This can also be the filename of a ruleset.
Filename Subject Text = {Filename?}

# If an attachment triggered a content check, but there was nothing
# else wrong with the message, do you want to modify the subject line?
# This makes filtering in Outlook very easy.
# This can also be the filename of a ruleset.
Content Modify Subject = yes

# This is the text to add to the start of the subject if the
# "Content Modify Subject" option is set.
# You might want to change this so your users can see at a glance
# whether it just was just the content that MailScanner rejected.
# This can also be the filename of a ruleset.
Content Subject Text = {Blocked Content}

# If the message is spam, do you want to modify the subject line?
# This makes filtering in Outlook very easy.
# This can also be the filename of a ruleset.
Spam Modify Subject = no

# This is the text to add to the start of the subject if the
# "Spam Modify Subject" option is set.
# The exact string "_SCORE_" will be replaced by the numeric
# SpamAssassin score.
# This can also be the filename of a ruleset.
Spam Subject Text = {Spam?}

# This is just like the "Spam Modify Subject" option above, except that
# it applies then the score from SpamAssassin is higher than the
# "High SpamAssassin Score" value.
# This can also be the filename of a ruleset.
High Scoring Spam Modify Subject = no

# This is just like the "Spam Subject Text" option above, except that
# it applies then the score from SpamAssassin is higher than the
# "High SpamAssassin Score" value.
# The exact string "_SCORE_" will be replaced by the numeric
# SpamAssassin score.
# This can also be the filename of a ruleset.
High Scoring Spam Subject Text = {Spam?}

#
# Changes to the Message Body
# ---------------------------
#

# When a virus or attachment is replaced by a plain-text warning,
# should the warning be in an attachment? If "no" then it will be
# placed in-line. This can also be the filename of a ruleset.
Warning Is Attachment = yes

# When a virus or attachment is replaced by a plain-text warning,
# and that warning is an attachment, this is the filename of the
# new attachment.
# This can also be the filename of a ruleset.
Attachment Warning Filename = %org-name%-Attachment-Warning.txt

# What character set do you want to use for the attachment that
# replaces viruses (VirusWarning.txt)?
# The default is "us-ascii" but if you speak anything other than
# English, you will probably want "ISO-8859-1" instead.
# This can also be the filename of a ruleset.
Attachment Encoding Charset = us-ascii

#
# Mail Archiving and Monitoring
# -----------------------------
#

# Space-separated list of any combination of
# 1. email addresses to which mail should be forwarded,
# 2. directory names where you want mail to be stored,
# 3. file names (they must already exist!) to which mail will be appended
#    in "mbox" format suitable for most Unix mail systems.
#
# If you give this option a ruleset, you can control exactly whose mail
# is archived or forwarded. If you do this, beware of the legal implications
# as this could be deemed to be illegal interception unless the police have
# asked you to do this.
#Archive Mail = /var/spool/MailScanner/archive
Archive Mail =

#
# Notices to System Administrators
# --------------------------------
#

# Notify the local system administrators ("Notices To") when any infections
# are found?
# This can also be the filename of a ruleset.
Send Notices = yes

# Include the full headers of each message in the notices sent to the local
# system administrators?
# This can also be the filename of a ruleset.
Notices Include Full Headers = no

# Hide the directory path from all the system administrator notices.
# The extra directory paths give away information about your setup, and
# tend to just confuse users but are still useful for local sys admins.
# This can also be the filename of a ruleset.
Hide Incoming Work Dir in Notices = no

# What signature to add to the bottom of the notices.
# To insert a line-break in there, use the sequence "\n".
Notice Signature = -- \nMailScanner\nEmail Virus Scanner\nwww.mailscanner.info

# The visible part of the email address used in the "From:" line of the
# notices. The <user@domain> part of the email address is set to the
# "Local Postmaster" setting.
Notices From = MailScanner

# Where to send the notices.
# This can also be the filename of a ruleset.
Notices To = postmaster

# Address of the local Postmaster, which is used as the "From" address in
# virus warnings sent to users.
# This can also be the filename of a ruleset.
Local Postmaster = postmaster

#
# Spam Detection and Virus Scanner Definitions
# --------------------------------------------
#

# This is the name of the file that translates the names of the "Spam List"
# values to the real DNS names of the spam blacklists.
Spam List Definitions = %etc-dir%/spam.lists.conf

# This is the name of the file that translates the names of the virus
# scanners into the commands that have to be run to do the actual scanning.
Virus Scanner Definitions = %etc-dir%/virus.scanners.conf

#
# Spam Detection and Spam Lists (DNS blocklists)
# ----------------------------------------------
#

# Do you want to check messages to see if they are spam?
# Note: If you switch this off then *no* spam checks will be done at all.
#       This includes both MailScanner's own checks and SpamAssassin.
#       If you want to just disable the "Spam List" feature then set
#       "Spam List =" (i.e. an empty list) in the setting below.
# This can also be the filename of a ruleset.
Spam Checks = yes

# This is the list of spam blacklists (RBLs) which you are using.
# See the "Spam List Definitions" file for more information about what
# you can put here.
# This can also be the filename of a ruleset.
Spam List = # ORDB-RBL SBL+XBL # MAPS-RBL+ costs money (except .ac.uk)

# This is the list of spam domain blacklists which you are using
# (such as the "rfc-ignorant" domains). See the "Spam List Definitions"
# file for more information about what you can put here.
# This can also be the filename of a ruleset.
Spam Domain List =

# If a message appears in at least this number of "Spam Lists" (as defined
# above), then the message will be treated as "High Scoring Spam" and so
# the "High Scoring Spam Actions" will happen. You probably want to set
# this to 2 if you are actually using this feature. 5 is high enough that
# it will never happen unless you use lots of "Spam Lists".
# This can also be the filename of a ruleset.
Spam Lists To Reach High Score = 3

# If an individual "Spam List" or "Spam Domain List" check takes longer
# that this (in seconds), the check is abandoned and the timeout noted.
Spam List Timeout = 120

# The maximum number of timeouts caused by any individual "Spam List" or
# "Spam Domain List" before it is marked as "unavailable". Once marked,
# the list will be ignored until the next automatic re-start (see
# "Restart Every" for the longest time it will wait).
# This can also be the filename of a ruleset.
Max Spam List Timeouts = 7

# The total number of Spam List attempts during which "Max Spam List Timeouts"
# will cause the spam list fo be marked as "unavailable". See the previous
# comment for more information.
# The default values of 5 and 10 mean that 5 timeouts in any sequence of 10
# attempts will cause the list to be marked as "unavailable" until the next
# periodic restart (see "Restart Every").
Spam List Timeouts History = 10

# Spam Whitelist:
# Make this point to a ruleset, and anything in that ruleset whose value
# is "yes" will *never* be marked as spam.
# This can also be the filename of a ruleset.
#Is Definitely Not Spam = no
Is Definitely Not Spam = %rules-dir%/spam.whitelist.rules

# Spam Blacklist:
# Make this point to a ruleset, and anything in that ruleset whose value
# is "yes" will *always* be marked as spam.
# This can also be the filename of a ruleset.
Is Definitely Spam = %rules-dir%/spam.blacklist.rules

# Setting this to yes means that spam found in the blacklist is treated
# as "High Scoring Spam" in the "Spam Actions" section below. Setting it
# to no means that it will be treated as "normal" spam.
# This can also be the filename of a ruleset.
Definite Spam Is High Scoring = no

# Spammers have learnt that they can get their message through by sending
# a message with lots of recipients, one of which chooses to whitelist
# everything coming to them, including the spammer.
# So if a message arrives with more than this number of recipients, ignore
# the "Is Definitely Not Spam" whitelist.
Ignore Spam Whitelist If Recipients Exceed = 20

#
# SpamAssassin
# ------------
#

# Do you want to find spam using the "SpamAssassin" package?
# This can also be the filename of a ruleset.
Use SpamAssassin = yes

# SpamAssassin is not very fast when scanning huge messages, so messages
# bigger than this value will be truncated to this length for SpamAssassin
# testing. The original message will not be affected by this. This value
# is a good compromise as very few spam messages are bigger than this.
Max SpamAssassin Size = 3000000

# This replaces the SpamAssassin configuration value 'required_hits'.
# If a message achieves a SpamAssassin score higher than this value,
# it is spam. See also the High SpamAssassin Score configuration option.
# This can also be the filename of a ruleset, so the SpamAssassin
# required_hits value can be set to different values for different messages.
Required SpamAssassin Score = 4.55

# If a message achieves a SpamAssassin score higher than this value,
# then the "High Scoring Spam Actions" are used. You may want to use
# this to deliver moderate scores, while deleting very high scoring messsages.
# This can also be the filename of a ruleset.
High SpamAssassin Score = 10

# Set this option to "yes" to enable the automatic whitelisting functions
# available within SpamAssassin. This will cause addresses from which you
# get real mail, to be marked so that it will never incorrectly spam-tag
# messages from those addresses.
SpamAssassin Auto Whitelist = no

# Set the location of the SpamAssassin user_prefs file. If you want to
# stop SpamAssassin doing all the RBL checks again, then you can add
# "skip_rbl_checks = 1" to this prefs file.
SpamAssassin Prefs File = %etc-dir%/spam.assassin.prefs.conf

# If SpamAssassin takes longer than this (in seconds), the check is
# abandoned and the timeout noted.
SpamAssassin Timeout = 360
#ill be
# marked as "unavailable" until MailScanner next re-starts itself.
# This means that remote network failures causing SpamAssassin trouble will
# not mean your mail stops flowing.
Max SpamAssassin Timeouts = 20

# The total number of SpamAssassin attempts during which "Max SpamAssassin
# Timeouts" will cause SpamAssassin to be marked as "unavailable".
# See the previous comment for more information.
# The default values of 10 and 20 mean that 10 timeouts in any sequence of
# 20 attempts will trigger the behaviour described above, until the next
# periodic restart (see "Restart Every").
SpamAssassin Timeouts History = 30

# If the message sender is on any of the Spam Lists, do you still want
# to do the SpamAssassin checks? Setting this to "no" will reduce the load
# on your server, but will stop the High Scoring Spam Actions from ever
# happening.
# This can also be the filename of a ruleset.
Check SpamAssassin If On Spam List = yes

# Do you want to include the "Spam Score" header. This shows 1 character
# (Spam Score Character) for every point of the SpamAssassin score. This
# makes it very easy for users to be able to filter their mail using
# whatever SpamAssassin threshold they want. For example, they just look
# for "sssss" for every message whose score is > 5, for example.
# This can also be the filename of a ruleset.
Spam Score = yes

# If you are using the Bayesian statistics engine on a busy server,
# you may well need to force a Bayesian database rebuild and expiry
# at regular intervals. This is measures in seconds.
# 1 day = 86400 seconds.
# To disable this feature set this to 0.
Rebuild Bayes Every = 0

# The Bayesian database rebuild and expiry may take a 2 or 3 minutes
# to complete. During this time you can either wait, or simply
# disable SpamAssassin checks until it has completed.
Wait During Bayes Rebuild = no

#
# What to do with spam
# --------------------
#

# This is a list of actions to take when a message is spam.
# It can be any combination of the following:
#    deliver                 - deliver the message as normal
#    delete                  - delete the message
#    store                   - store the message in the quarantine
#    bounce                  - send a rejection message back to the sender
#    forward user@domain.com - forward a copy of the message to user@domain.com
#    striphtml               - convert all in-line HTML content to plain text.
#                              You need to specify "deliver" as well for the
#                              message to reach the original recipient.
#    attachment              - Convert the original message into an attachment
#                              of the message. This means the user has to take
#                              an extra step to open the spam, and stops "web
#                              bugs" very effectively.
#    notify                  - Send the recipients a short notification that
#                              spam addressed to them was not delivered. They
#                              can then take action to request retrieval of
#                              the original message if they think it was not
#                              spam.
#
# This can also be the filename of a ruleset.
#Spam Actions = store forward anonymous@ecs.soton.ac.uk
Spam Actions = deliver

# This is just like the "Spam Actions" option above, except that it applies
# then the score from SpamAssassin is higher than the "High SpamAssassin Score"
# value.
#    deliver                 - deliver the message as normal
#    delete                  - delete the message
#    store                   - store the message in the quarantine
#    forward user@domain.com - forward a copy of the message to user@domain.com
#    striphtml               - convert all in-line HTML content to plain text.
#                              You need to specify "deliver" as well for the
#                              message to reach the original recipient.
#    attachment              - Convert the original message into an attachment
#                              of the message. This means the user has to take
#                              an extra step to open the spam, and stops "web
#                              bugs" very effectively.
#    notify                  - Send the recipients a short notification that
#                              spam addressed to them was not delivered. They
#                              can then take action to request retrieval of
#                              the original message if they think it was not
#                              spam.
#
# This can also be the filename of a ruleset.
High Scoring Spam Actions = deliver

# This is just like the "Spam Actions" option above, except that it applies
# to messages that are *NOT* spam.
#    deliver                 - deliver the message as normal
#    delete                  - delete the message
#    store                   - store the message in the quarantine
#    forward user@domain.com - forward a copy of the message to user@domain.com
#    striphtml               - convert all in-line HTML content to plain text
#
# This can also be the filename of a ruleset.
Non Spam Actions = deliver

# There are 3 reports:
#   Sender Spam Report         -  sent when a message triggers both a Spam
#                                 List and SpamAssassin,
#   Sender Spam List Report    -  sent when a message triggers a Spam List,
#   Sender SpamAssassin Report -  sent when a message triggers SpamAssassin.
#
# These can also be the filenames of rulesets.
Sender Spam Report         = %report-dir%/sender.spam.report.txt
Sender Spam List Report    = %report-dir%/sender.spam.rbl.report.txt
Sender SpamAssassin Report = %report-dir%/sender.spam.sa.report.txt

# If you use the 'attachment' Spam Action or High Scoring Spam Action
# then this is the location of inline spam report that is inserted at
# the top of the message.
Inline Spam Warning = %report-dir%/inline.spam.warning.txt

# If you use the 'notify' Spam Action or High Scoring Spam Action then
# this is the location of the notification message that is sent to the
# original recipients of the message.
Recipient Spam Report = %report-dir%/recipient.spam.report.txt

# You can use this ruleset to enable the "bounce" Spam Action.
# You must *only* enable this for mail from sites with which you have
# agreed to bounce possible spam. Use it on low-scoring spam only (<10)
# and only to your regular customers for use in the rare case that a
# message is mis-tagged as spam when it shouldn't have been.
# Beware that many sites will automatically delete the bounce messages
# created by using this option unless you have agreed this with them in
# advance.
# If you enable this, be prepared to handle the irate responses from
# people to whom you are essentially sending more spam!
Enable Spam Bounce = %rules-dir%/bounce.rules

#
# Logging
# -------
#

# This is the syslog "facility" name that MailScanner uses. If you don't
# know what a syslog facility name is, then either don't change this value
# or else go and read "man syslog.conf". The default value of "mail" will
# cause the MailScanner logs to go into the same place as all your other
# mail logs.
Syslog Facility = mail

# Do you want to log the processing speed for each section of the code
# for a batch? This can be very useful for diagnosing speed problems,
# particularly in spam checking.
Log Speed = no

# Do you want all spam to be logged? Useful if you want to gather
# spam statistics from your logs, but can increase the system load quite
# a bit if you get a lot of spam.
Log Spam = no

# Do you want all non-spam to be logged? Useful if you want to see
# all the SpamAssassin reports of mail that was marked as non-spam.
# Note: It will generate a lot of log traffic.
Log Non Spam = no

# Log all the filenames that are allowed by the Filename Rules, or just
# the filenames that are denied?
# This can also be the filename of a ruleset.
Log Permitted Filenames = no

# Log all the filenames that are allowed by the Filetype Rules, or just
# the filetypes that are denied?
# This can also be the filename of a ruleset.
Log Permitted Filetypes = no

#
# Advanced SpamAssassin Settings
# ------------------------------
#
# If you are using Postfix you may well need to use some of the settings
# below, as the home directory for the "postfix" user cannot be written
# to by the "postfix" user.
# You may also need to use these if you have installed SpamAssassin
# somewhere other than the default location.
#

# The per-user files (bayes, auto-whitelist, user_prefs) are looked
# for here and in ~/.spamassassin/. Note the files are mutable.
# If this is unset then no extra places are searched for.
# If using Postfix, you probably want to set this as shown in the example
# line at the end of this comment, and do
#      mkdir /var/spool/MailScanner/spamassassin
#      chown postfix.postfix /var/spool/MailScanner/spamassassin
#SpamAssassin User State Dir = /var/spool/MailScanner/spamassassin
SpamAssassin User State Dir = /var/lib/MailScanner

# This setting is useful if SpamAssassin is installed in an unusual place,
# e.g. /opt/MailScanner. The install prefix is used to find some fallback
# directories if neither of the following two settings work.
# If this is set then it adds to the list of places that are searched;
# otherwise it has no effect.
#SpamAssassin Install Prefix = /opt/MailScanner
SpamAssassin Install Prefix = /etc/MailScanner

# The site rules are searched for here.
# Normal location on most systems is /etc/mail/spamassassin.
SpamAssassin Site Rules Dir = /etc/mail/spamassassin

# The site-local rules are searched for here, and in prefix/etc/spamassassin,
# prefix/etc/mail/spamassassin, /usr/local/etc/spamassassin, /etc/spamassassin,
# /etc/mail/spamassassin, and maybe others.
# If this is set then it adds to the list of places that are searched;
# otherwise it has no effect.
#SpamAssassin Local Rules Dir = /etc/MailScanner/mail/spamassassin
SpamAssassin Local Rules Dir = /etc/MailScanner/rules

# The default rules are searched for here, and in prefix/share/spamassassin,
# /usr/local/share/spamassassin, /usr/share/spamassassin, and maybe others.
# If this is set then it adds to the list of places that are searched;
# otherwise it has no effect.
#SpamAssassin Default Rules Dir = /usr/share/spamassassin
SpamAssassin Default Rules Dir = /etc/MailScanner/rules


#
# Advanced Settings
# -----------------
#
# Don't bother changing anything below this unless you really know
# what you are doing, or else if MailScanner has complained about
# your "Minimum Code Status" setting.
#

# When trying to work out the value of configuration parameters which are
# using a ruleset, this controls the behaviour when a rule is checking the
# "To:" addresses.
# If this option is set to "yes", then the following happens when checking
# the ruleset:
#   a) 1 recipient. Same behaviour as normal.
#   b) Several recipients, but all in the same domain (domain.com for example).
#      The rules are checked for one that matches the string "*@domain.com".
#   c) Several recipients, not all in the same domain.
#      The rules are checked for one that matches the string "*@*".
#
# If this option is set to "no", then some rules will use the result they
# get from the first matching rule for any of the recipients of a message,
# so the exact value cannot be predicted for messages with more than 1
# recipient.
#
# This value *cannot* be the filename of a ruleset.
Use Default Rules With Multiple Recipients = no

# When putting the value of the spam score of a message into the headers,
# how do you want to format it. If you don't know how to use sprintf() or
# printf() in C, please *do not modify* this value. A few examples for you:
# %d     ==> 12
# %5.2f  ==> 12.34
# %05.1f ==> 012.3
# This can also be the filename of a ruleset.
Spam Score Number Format = %5.2f

# Set Debug to "yes" to stop it running as a daemon and just process
# one batch of messages and then exit.
Debug = no

# Do you want to debug SpamAssassin from within MailScanner?
Debug SpamAssassin = yes

# Set Run In Foreground to "yes" if you want MailScanner to operate
# normally in foreground (and not as a background daemon).
# Use this if you are controlling the execution of MailScanner
# with a tool like DJB's 'supervise' (see http://cr.yp.to/daemontools.html).
Run In Foreground = no

# If you are using an LDAP server to read the configuration, these
# are the details required for the LDAP connection. The connection
# is anonymous.
#LDAP Server = localhost
#LDAP Base   = o=fsl
#LDAP Site   = default

# This option is intended for people who want to log more information
# about messages than what is put in syslog. It is intended to be used
# with a Custom Function which has the side-effect of logging information,
# perhaps to an SQL database, or any other processing you want to do
# after each message is processed.
# Its value is completely ignored, it is purely there to have side
# effects.
# If you want to use it, read CustomConfig.pm.
Always Looked Up Last = no

# When attempting delivery of outgoing messages, should we do it in the
# background or wait for it to complete? The danger of doing it in the
# background is that the machine load goes ever upwards while all the
# slow sendmail processes run to completion. However, running it in the
# foreground may cause the mail server to run too slowly.
Deliver In Background = yes

# Attempt immediate delivery of messages, or just place them in the outgoing
# queue for the MTA to deliver when it wants to?
#      batch -- attempt delivery of messages, in batches of up to 20 at once.
#      queue -- just place them in the queue and let the MTA find them.
# This can also be the filename of a ruleset. For example, you could use a
# ruleset here so that messages coming to you are immediately delivered,
# while messages going to any other site are just placed in the queue in
# case the remote delivery is very slow.
Delivery Method = queue

# Are you using Exim with split spool directories? If you don't understand
# this, the answer is probably "no". Refer to the Exim documentation for
# more information about split spool directories.
Split Exim Spool = no

# Where to put the virus scanning engine lock files.
# These lock files are used between MailScanner and the virus signature
# "autoupdate" scripts, to ensure that they aren't both working at the
# same time (which could cause MailScanner to let a virus through).
Lockfile Dir = /tmp

# Where to put the code for your "Custom Functions". No code in this
# directory should be over-written by the installation or upgrade process.
# All files starting with "." or ending with ".rpmnew" will be ignored,
# all other files will be compiled and may be used with Custom Functions.
Custom Functions Dir = /usr/share/MailScanner/MailScanner/CustomFunctions

# How to lock spool files.
# Don't set this unless you *know* you need to.
# For sendmail, it defaults to "flock".
# For Exim, it defaults to "posix".
# No other type is implemented.
#Lock Type = flock

# Minimum acceptable code stability status -- if we come across code
# that's not at least as stable as this, we barf.
# This is currently only used to check that you don't end up using untested
# virus scanner support code without realising it.
# Levels used are:
# none          - there may not even be any code.
# unsupported   - code may be completely untested, a contributed dirty hack,
#                 anything, really.
# alpha         - code is pretty well untested. Don't assume it will work.
# beta          - code is tested a bit. It should work.
# supported     - code *should* be reliable.
#
# Don't even *think* about setting this to anything other than "beta" or
# "supported" on a system that receives real mail until you have tested it
# yourself and are happy that it is all working as you expect it to.
# Don't set it to anything other than "supported" on a system that could
# ever receive important mail.
#
# READ and UNDERSTAND the above text BEFORE changing this.
#
Minimum Code Status = supported


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From mark at TIPPINGMAR.COM  Tue Nov 23 18:06:45 2004
From: mark at TIPPINGMAR.COM (Mark Nienberg)
Date: Thu Jan 12 21:27:40 2006
Subject: SA 3.0.1 Install failure lessons learned
Message-ID: <mailman.5046.1137101260.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Steve Campbell wrote:

>Then I ran the new sa-learn --sync stuff and it wouldn't update. No matter
>what I tried, this kept saying that it couldn't use the db 2 format. The
>only option I had was to delete my bayes files and start fresh.
>
>
I don't know why, but I can confirm that I had the same experience.  I finally resorted to the starter bayes database on the fortress website.  Since then, I read one thing in the documentation somewhere that made me think my database from version 2.63 may have already been in the correct format for use with 3.01, so if I had it to do over again I might just try running it without the --sync and see what happens.  There is nothing to lose.

Mark Nienberg

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From michele at BLACKNIGHTSOLUTIONS.COM  Tue Nov 23 18:18:15 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:40 2006
Subject: mailscanner not calling spamassassin?
Message-ID: <mailman.5047.1137101260.24926.mailscanner@lists.mailscanner.info>

Brendan

Could you provide some log output and more details of your setup?

MailScanner.conf seems ok from what I can see

Michele

PS: You'll probably find a couple of us on IRC most of the time


Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
http://www.blacknight.ie/specialoffers.html

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From michele at BLACKNIGHTSOLUTIONS.COM  Tue Nov 23 18:21:30 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:41 2006
Subject: mailscanner not calling spamassassin?
Message-ID: <mailman.5048.1137101260.24926.mailscanner@lists.mailscanner.info>

Replying to my own replies .. How sad!

I presume you removed the contents of:
%org-name% =


Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
http://www.blacknight.ie/specialoffers.html

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ugob at CAMO-ROUTE.COM  Tue Nov 23 18:15:25 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:41 2006
Subject: mailscanner not calling spamassassin?
Message-ID: <mailman.5049.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Brendan Cody-Kenny wrote:
> Hello all,
> I have been having some very annoying trouble lately with mailscanner
> using spamassassin. As far as I have looked (which is pretty far) I have
> correct settings for mailscanner and spamassassin. (spamassassin 2.64
> and mailscanner 4.35.11)
>
> The problem is that mailscanner does not appear to be calling
> spamassassin properly but is not generating any logs to indicate the
> problem. I thought mailscanner was calling spamassassin and it was
> returning 0 everytime but it turned out that "Always Include
> SpamAssassin Report = yes" was giving every message a score of 0. After
> changing this it appears that mailscanner is not running spamassassin at
> all. I used strace on mailscanner and sifted though the results but
> could not find anything conclusinve. A test of spamassassin from the
> command line on a message returns a reasonable result (other than 0) for
> a message but mailscanner is not doing this. I have included
> Mailscanner.conf and spam.assassin.prefs.conf. Can anyone help? I hope
> it is something really simple that I have misssed but I have been
> looking at it for so long now that its invisible to me.

What do you have in the headers?

What do you get when you run MailScanner in debug with "Debut
SpamaAssasin = yes"

?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From vasiliy at lohankin.com  Tue Nov 23 17:46:02 2004
From: vasiliy at lohankin.com (Vasiliy Boulytchev)
Date: Thu Jan 12 21:27:41 2006
Subject: bayes database
Message-ID: <mailman.5050.1137101261.24926.mailscanner@lists.mailscanner.info>

Nicolas,
        The answer to your question is in the SA installation manual.

On Tue, 2004-11-23 at 14:19 +0100, Nicolas Viers - SCI Limoges wrote:
> how to convert bayes database version 2 to version 3  for spamassassin
> version 3  ?
> thanks
>
--

-------------
Vasiliy Boulytchev
Colorado Information Technologies Inc.
http://www.coinfotech.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mkettler at EVI-INC.COM  Tue Nov 23 18:57:20 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:41 2006
Subject: notify recipient
Message-ID: <mailman.5051.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

At 06:11 AM 11/23/2004, Philipp Bundschuh wrote:
>is it possible, to configure MailScanner, that the recipient of an 
>infected email is notified? Or that e.g. the infected attachment is just 
>replaced by an ^Ä.txt^Ó-File (like a report)?

Yes. That's how mine is set up.

You probably have "Still Deliver Silent Viruses" set to no in your 
mailscanner.conf. Turn it on and virus notices will get passed in to your 
users.

Another way is to leave the above set to no and modify "Silent Viruses" to 
be a list shorter than "All-Viruses" if you still want to exclude notices 
for some types, but pass most on.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From acragg-lists at CTF.COM  Tue Nov 23 19:12:05 2004
From: acragg-lists at CTF.COM (Alan Cragg - Lists)
Date: Thu Jan 12 21:27:41 2006
Subject: SOBER-I
Message-ID: <mailman.5052.1137101261.24926.mailscanner@lists.mailscanner.info>

Hello All,

First time poster many time reader.

Since Friday I am getting flooded with e-mails infected with Sober-I
virus. They all seem to be from one source and they are relaying through
our secondary Mail Server (Our ISP supplies the secondary).

It seems the one user can bring our server to its knees and the inbound
queue just backs up.
As a remedy I have to reject e-mails from the secondary server using the
access file in sendmail.

Does anyone know of a better way to block this without having to block
our secondary mail server?
Is it a performance tuning issue? We are using MailScanner 4.35.11 and
Sophos AV, not SAVI, and SA 3.0.1.

The machine is running Redhat 8.0 and is a XEON 2.4GHz CPU with 1GB RAM.
Connection is only a T1.

Thanks for any assistance,

Alan Cragg


CONFIDENTIALITY NOTICE. 
The information contained in this communication is confidential and/or 
proprietary business or technical data. If you are not the intended 
recipient, you are hereby notified that any use, dissemination, copying 
or distribution of this communication is strictly prohibited. If you  
have received this communication in error, please immediately notify us by 
telephone (604) 472-2300, or electronically by return message, and 
delete or destroy all copies.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ugob at CAMO-ROUTE.COM  Tue Nov 23 19:49:37 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:41 2006
Subject: SOBER-I
Message-ID: <mailman.5053.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Alan Cragg - Lists wrote:
> Hello All,
>
> First time poster many time reader.
>
> Since Friday I am getting flooded with e-mails infected with Sober-I
> virus. They all seem to be from one source and they are relaying through
> our secondary Mail Server (Our ISP supplies the secondary).
>
> It seems the one user can bring our server to its knees and the inbound
> queue just backs up.
> As a remedy I have to reject e-mails from the secondary server using the
> access file in sendmail.
>
> Does anyone know of a better way to block this without having to block
> our secondary mail server?
> Is it a performance tuning issue? We are using MailScanner 4.35.11 and
> Sophos AV, not SAVI, and SA 3.0.1.
>
> The machine is running Redhat 8.0 and is a XEON 2.4GHz CPU with 1GB RAM.
> Connection is only a T1.
>
> Thanks for any assistance,

You'd be better off removing your secondary MX from the DNS records,
since you may loose mail this way and you are using your ISP's for
nothing.  Maybe your ISP could do something about it.

For your real problem, I don't really have an idea, sorry :(.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Kevin_Miller at CI.JUNEAU.AK.US  Tue Nov 23 20:04:48 2004
From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller)
Date: Thu Jan 12 21:27:41 2006
Subject: SOBER-I
Message-ID: <mailman.5054.1137101261.24926.mailscanner@lists.mailscanner.info>

Alan Cragg - Lists wrote:
>
> Does anyone know of a better way to block this without having to block
> our secondary mail server?
> Is it a performance tuning issue? We are using MailScanner 4.35.11 and
> Sophos AV, not SAVI, and SA 3.0.1.

Had a similar situation a while back.  Instead of blocking my secondary, I
used the access table in it's sendmail to drop inbound connections from the
offending IP.  That way, I could continue to receive valid email on the
secondary from elsewhere but not plug the queues with virus laden emails.  I
had the advantage, of course, of owning our secondary.

Do you have shell access to the secondary?  If not, I'd try to get your ISP
to block that address.

I also notified the sender's ISP so they could notify the owner of the
infected machine.

Good luck...

...Kevin
--
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Admin., Mail Admin.
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From campbell at cnpapers.com  Tue Nov 23 20:04:31 2004
From: campbell at cnpapers.com (Steve Campbell)
Date: Thu Jan 12 21:27:41 2006
Subject: bayes.mutex
Message-ID: <mailman.5055.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I seem to be having a problem with sa-learn due to a file called bayes.mutex
in my bayes directory. Can someone explain what this file is? The archives
has plenty of stuff listing it, but I didn't see anything saying what it is.


Thanks


Steve Campbell
campbell@cnpapers.com
Charleston Newspapers

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jstevens at ATHENSDISTRIBUTING.COM  Tue Nov 23 20:17:30 2004
From: jstevens at ATHENSDISTRIBUTING.COM (James R. Stevens)
Date: Thu Jan 12 21:27:41 2006
Subject: SOBER-I
Message-ID: <mailman.5056.1137101261.24926.mailscanner@lists.mailscanner.info>

Since 11/19/2004 we have seen 40+ of the Sober-I. We process around 1000
emails on any given day. They seems to come from only 3 source IP's. We
are the Primary MX for the domain and are handling the amount of Viruses
just fine.

How many messages do you process per day? 

-----Original Message-----
From: Kevin Miller [mailto:Kevin_Miller@CI.JUNEAU.AK.US] 
Sent: Tuesday, November 23, 2004 2:05 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: SOBER-I

Alan Cragg - Lists wrote:
>
> Does anyone know of a better way to block this without having to block
> our secondary mail server?
> Is it a performance tuning issue? We are using MailScanner 4.35.11 and
> Sophos AV, not SAVI, and SA 3.0.1.

Had a similar situation a while back.  Instead of blocking my secondary,
I
used the access table in it's sendmail to drop inbound connections from
the
offending IP.  That way, I could continue to receive valid email on the
secondary from elsewhere but not plug the queues with virus laden
emails.  I
had the advantage, of course, of owning our secondary.

Do you have shell access to the secondary?  If not, I'd try to get your
ISP
to block that address.

I also notified the sender's ISP so they could notify the owner of the
infected machine.

Good luck...

...Kevin
--
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Admin., Mail Admin.
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

-- 
This message has been scanned for viruses and
dangerous content by Athens Hyperion Scanner, and is
believed to be clean.




-- 
This message has been scanned for viruses and
dangerous content by Athens Hyperion Scanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From acragg-lists at CTF.COM  Tue Nov 23 20:20:56 2004
From: acragg-lists at CTF.COM (Alan Cragg - Lists)
Date: Thu Jan 12 21:27:41 2006
Subject: SOBER-I
Message-ID: <mailman.5057.1137101261.24926.mailscanner@lists.mailscanner.info>

If I don't block it I get about 5,000 infected mails/day.

 
 	  	
                 Alan Cragg	
                 I.T. Manager	
 	  	
                 9 Burbidge Street               tel:    (604) 472-2412	
                 Coquitlam BC            fax:    (604) 472-2345	
                 Canada V3K 7B2          pager:  (604) 622-3370	
                                         acragg@vsmmedtech.com	
                 http://www.vsmmedtech.com/	  	

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of James R. Stevens
Sent: Tuesday, November 23, 2004 12:18 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: SOBER-I

Since 11/19/2004 we have seen 40+ of the Sober-I. We process around 1000
emails on any given day. They seems to come from only 3 source IP's. We
are the Primary MX for the domain and are handling the amount of Viruses
just fine.

How many messages do you process per day? 

-----Original Message-----
From: Kevin Miller [mailto:Kevin_Miller@CI.JUNEAU.AK.US] 
Sent: Tuesday, November 23, 2004 2:05 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: SOBER-I

Alan Cragg - Lists wrote:
>
> Does anyone know of a better way to block this without having to block
> our secondary mail server?
> Is it a performance tuning issue? We are using MailScanner 4.35.11 and
> Sophos AV, not SAVI, and SA 3.0.1.

Had a similar situation a while back.  Instead of blocking my secondary,
I
used the access table in it's sendmail to drop inbound connections from
the
offending IP.  That way, I could continue to receive valid email on the
secondary from elsewhere but not plug the queues with virus laden
emails.  I
had the advantage, of course, of owning our secondary.

Do you have shell access to the secondary?  If not, I'd try to get your
ISP
to block that address.

I also notified the sender's ISP so they could notify the owner of the
infected machine.

Good luck...

...Kevin
--
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Admin., Mail Admin.
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

-- 
This message has been scanned for viruses and
dangerous content by Athens Hyperion Scanner, and is
believed to be clean.




-- 
This message has been scanned for viruses and
dangerous content by Athens Hyperion Scanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!





CONFIDENTIALITY NOTICE. 
The information contained in this communication is confidential and/or 
proprietary business or technical data. If you are not the intended 
recipient, you are hereby notified that any use, dissemination, copying 
or distribution of this communication is strictly prohibited. If you  
have received this communication in error, please immediately notify us by 
telephone (604) 472-2300, or electronically by return message, and 
delete or destroy all copies.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From vlad at MAZEK.COM  Tue Nov 23 20:23:52 2004
From: vlad at MAZEK.COM (Vlad Mazek)
Date: Thu Jan 12 21:27:41 2006
Subject: SOBER-I
Message-ID: <mailman.5058.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

>Does anyone know of a better way to block this without having to block
>our secondary mail server?
>Is it a performance tuning issue? We are using MailScanner 4.35.11 and
>Sophos AV, not SAVI, and SA 3.0.1.
>
>
We provide a lot of ETRN/ATRN servers and here is what we advise our
customers to do: Never place ETRN server as the lowest priority MX for
your domain. Most spammers will target the ETRN server as it usually
blindly accepts mail. Instead place the ETRN server in the middle, for
example:

in   mx   10   mail.mazek.com.
in   mx   50   etrn.myisp.com.
in   mx   100   etrn.mazek.com.

where mail.mazek.com and etrn.mazek.com are the exact same server.

This way you take the the ETRN server out of the loop unless your T1
goes down in which case mail will go to your ETRN server.

Hope that helps.

-Vlad Mazek

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From acragg-lists at CTF.COM  Tue Nov 23 20:49:21 2004
From: acragg-lists at CTF.COM (Alan Cragg - Lists)
Date: Thu Jan 12 21:27:41 2006
Subject: SOBER-I
Message-ID: <mailman.5059.1137101261.24926.mailscanner@lists.mailscanner.info>

Thanks,

That looks like a great idea. I went through this once before (Sober-G)
with our ISP and they wouldn't do anything to help us even though the
offending user/computer was on their network. 

I will give this a shot.

Alan

 
 	  	
                 Alan Cragg	
                 I.T. Manager	
 	  	
                 9 Burbidge Street               tel:    (604) 472-2412	
                 Coquitlam BC            fax:    (604) 472-2345	
                 Canada V3K 7B2          pager:  (604) 622-3370	
                                         acragg@vsmmedtech.com	
                 http://www.vsmmedtech.com/	  	

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Vlad Mazek
Sent: Tuesday, November 23, 2004 12:24 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: SOBER-I

>Does anyone know of a better way to block this without having to block
>our secondary mail server?
>Is it a performance tuning issue? We are using MailScanner 4.35.11 and
>Sophos AV, not SAVI, and SA 3.0.1.
>
>
We provide a lot of ETRN/ATRN servers and here is what we advise our
customers to do: Never place ETRN server as the lowest priority MX for
your domain. Most spammers will target the ETRN server as it usually
blindly accepts mail. Instead place the ETRN server in the middle, for
example:

in   mx   10   mail.mazek.com.
in   mx   50   etrn.myisp.com.
in   mx   100   etrn.mazek.com.

where mail.mazek.com and etrn.mazek.com are the exact same server.

This way you take the the ETRN server out of the loop unless your T1
goes down in which case mail will go to your ETRN server.

Hope that helps.

-Vlad Mazek

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!





CONFIDENTIALITY NOTICE. 
The information contained in this communication is confidential and/or 
proprietary business or technical data. If you are not the intended 
recipient, you are hereby notified that any use, dissemination, copying 
or distribution of this communication is strictly prohibited. If you  
have received this communication in error, please immediately notify us by 
telephone (604) 472-2300, or electronically by return message, and 
delete or destroy all copies.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mkettler at EVI-INC.COM  Tue Nov 23 21:13:42 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:41 2006
Subject: bayes.mutex
Message-ID: <mailman.5060.1137101261.24926.mailscanner@lists.mailscanner.info>

At 03:04 PM 11/23/2004, Steve Campbell wrote:
>I seem to be having a problem with sa-learn due to a file called bayes.mutex
>in my bayes directory. Can someone explain what this file is? The archives
>has plenty of stuff listing it, but I didn't see anything saying what it is.

It's a mutex.

Ok, perhaps that's not so helpful if you're not familar with multithreaded
programing and access locking.

In short, a mutex is a MUTual EXclusion. It's used to lock access to some
piece of data so you don't run into consistency problems where two
different threads are both trying to update the same data and one winds up
stomping on the changes of the other.

(ie: if two threads decide to increment a counter at the same time, both
read a value of 1, both increment it to 2 and then write back, you get 2.
If you have locking, then the two threads operate one after the other, and
you get the right answer of 3.)

In your case, MailScanner probably timed out on a SA when it was trying to
do an opportunistic expiry and made it leave the mutex laying around.
sa-learn refuses to update the bayes database because it sees the mutex and
thinks that SA is currently working on updating the DB. Check your mail
logs for "SpamAssassin timed out and was killed" messages. They are evil,
and should be regarded as a problem and are not a healthy thing for SA's
bayes subsystem.

In the short term, jack up your spamassassin timeout in mailscanner.conf,
stop mailscanner, wack the bayes.mutex with rm, run sa-learn --force-expire
then restart mailscanner. That should clear up the need for expiry, and
make it less likely to be killed again.

For a longer discussion of more detailed tricks to stop timeouts, here's
one of my old posts:
----------------------------

In the longer term, here's some suggestions I use on my own MailScanner
server: (I use all of these together)

1) Increase the spamassassin timeout in MailScanner.conf. Bring it to 60
seconds at least, I have mine set to 120.

2) Set the "Rebuild Bayes Every" parameter in MailScanner.conf. 86400
seconds is a good start. This makes MailScanner invoke SA's bayes
housekeeping directly, rather than during a scan of a message.

3) in /etc/mail/spamassassin/local.cf set: bayes_auto_expire 0. This will
keep SA from trying to run bayes expires (long and slow) during message
handling, but relies on #2 above to allow expiry to occur.

4) I also have a sa-learn --force-expire running as a daily cronjob. I have
tested the setup without this measure, and #2 is sufficient to cause expiry
to occur. Really this is just a fail-safe to allow expiry to occur even if
MailScanner's calls fail to run it properly for some reason.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mike at TC3NET.COM  Tue Nov 23 21:21:47 2004
From: mike at TC3NET.COM (Michael Baird)
Date: Thu Jan 12 21:27:41 2006
Subject: Phishing Detection
Message-ID: <mailman.5061.1137101261.24926.mailscanner@lists.mailscanner.info>

I just upgraded from 4.33.5 to 4.36.1, in the hopes of picking up the
phishing detection. I'm trying to determine if it is working or not. I
have not been able to find any references in any of my mailservers logs
to "Phish" or "phish", other then the Found the Phish-BankFraud.eml
trojan, which was being detected before I upgraded.

I'm wondering what specifically should be logged to my maillog, when a
Phishing attack is spotted, where it gets the verbage for this, and if
Phishing detection depends on any other features in MailScanner being
enabled, like file checks.

Regards
Michael Baird

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From campbell at cnpapers.com  Tue Nov 23 21:38:09 2004
From: campbell at cnpapers.com (Steve Campbell)
Date: Thu Jan 12 21:27:41 2006
Subject: bayes.mutex
Message-ID: <mailman.5062.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Matt,

Thanks,

Very well spoken. I did discover why I had to run "spamassassin -p ...." as
the user that normally runs spamassassin due to this problem. I had no idea
what a mutex was, but figured it was some kind of lock. It all turns our
that the permissions on this file were improper due to the --linting test I
was doing. After chmod-ding the file, all returned to normal.

Lesson learned

Thanks much

Steve Campbell

----- Original Message -----
From: "Matt Kettler" <mkettler@EVI-INC.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, November 23, 2004 4:13 PM
Subject: Re: bayes.mutex


> At 03:04 PM 11/23/2004, Steve Campbell wrote:
> >I seem to be having a problem with sa-learn due to a file called
bayes.mutex
> >in my bayes directory. Can someone explain what this file is? The
archives
> >has plenty of stuff listing it, but I didn't see anything saying what it
is.
>
> It's a mutex.
>
> Ok, perhaps that's not so helpful if you're not familar with multithreaded
> programing and access locking.
>
> In short, a mutex is a MUTual EXclusion. It's used to lock access to some
> piece of data so you don't run into consistency problems where two
> different threads are both trying to update the same data and one winds up
> stomping on the changes of the other.
>
> (ie: if two threads decide to increment a counter at the same time, both
> read a value of 1, both increment it to 2 and then write back, you get 2.
> If you have locking, then the two threads operate one after the other, and
> you get the right answer of 3.)
>
> In your case, MailScanner probably timed out on a SA when it was trying to
> do an opportunistic expiry and made it leave the mutex laying around.
> sa-learn refuses to update the bayes database because it sees the mutex
and
> thinks that SA is currently working on updating the DB. Check your mail
> logs for "SpamAssassin timed out and was killed" messages. They are evil,
> and should be regarded as a problem and are not a healthy thing for SA's
> bayes subsystem.
>
> In the short term, jack up your spamassassin timeout in mailscanner.conf,
> stop mailscanner, wack the bayes.mutex with rm, run
sa-learn --force-expire
> then restart mailscanner. That should clear up the need for expiry, and
> make it less likely to be killed again.
>
> For a longer discussion of more detailed tricks to stop timeouts, here's
> one of my old posts:
> ----------------------------
>
> In the longer term, here's some suggestions I use on my own MailScanner
> server: (I use all of these together)
>
> 1) Increase the spamassassin timeout in MailScanner.conf. Bring it to 60
> seconds at least, I have mine set to 120.
>
> 2) Set the "Rebuild Bayes Every" parameter in MailScanner.conf. 86400
> seconds is a good start. This makes MailScanner invoke SA's bayes
> housekeeping directly, rather than during a scan of a message.
>
> 3) in /etc/mail/spamassassin/local.cf set: bayes_auto_expire 0. This will
> keep SA from trying to run bayes expires (long and slow) during message
> handling, but relies on #2 above to allow expiry to occur.
>
> 4) I also have a sa-learn --force-expire running as a daily cronjob. I
have
> tested the setup without this measure, and #2 is sufficient to cause
expiry
> to occur. Really this is just a fail-safe to allow expiry to occur even if
> MailScanner's calls fail to run it properly for some reason.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From vasiliy at lohankin.com  Tue Nov 23 21:12:36 2004
From: vasiliy at lohankin.com (Vasiliy Boulytchev)
Date: Thu Jan 12 21:27:41 2006
Subject: DSPAM support
Message-ID: <mailman.5063.1137101261.24926.mailscanner@lists.mailscanner.info>

Gents,
        Does Mailscanner support DSPAM instead of , or a combination to SA?
        Thanks!

        I was not able to find much on the site.
--

-------------
Vasiliy Boulytchev
Colorado Information Technologies Inc.
http://www.coinfotech.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ugob at CAMO-ROUTE.COM  Tue Nov 23 23:04:47 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:41 2006
Subject: DSPAM support
Message-ID: <mailman.5064.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Vasiliy Boulytchev wrote:
> Gents,
>         Does Mailscanner support DSPAM instead of , or a combination to SA?
>         Thanks!
>
>         I was not able to find much on the site.

No, it doesn't support it.  There have been discussions around it though.

The idea has been discarded since the advantage of running 2 spam
filters is rather weak, compared to the resources needed.

if you want more info, search for dspam in the archives of this list.

Ugo

> --
>
> -------------
> Vasiliy Boulytchev
> Colorado Information Technologies Inc.
> http://www.coinfotech.com
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From wright at CYBERVALE.COM  Tue Nov 23 23:51:50 2004
From: wright at CYBERVALE.COM (Terran Wright)
Date: Thu Jan 12 21:27:41 2006
Subject: DSPAM support
Message-ID: <mailman.5065.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

IIRC there was some heat over this recently you should be able to find it in
the archives.


----- Original Message -----
From: "Vasiliy Boulytchev" <vasiliy@lohankin.com>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, November 23, 2004 4:12 PM
Subject: DSPAM support


> Gents,
>         Does Mailscanner support DSPAM instead of , or a combination to
SA?
>         Thanks!
>
>         I was not able to find much on the site.
> --
>
> -------------
> Vasiliy Boulytchev
> Colorado Information Technologies Inc.
> http://www.coinfotech.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From gdoris at ROGERS.COM  Wed Nov 24 00:32:43 2004
From: gdoris at ROGERS.COM (Gerry Doris)
Date: Thu Jan 12 21:27:41 2006
Subject: Phishing Detection
Message-ID: <mailman.5066.1137101261.24926.mailscanner@lists.mailscanner.info>

On Tue, 23 Nov 2004, Michael Baird wrote:

> I just upgraded from 4.33.5 to 4.36.1, in the hopes of picking up the
> phishing detection. I'm trying to determine if it is working or not. I
> have not been able to find any references in any of my mailservers logs
> to "Phish" or "phish", other then the Found the Phish-BankFraud.eml
> trojan, which was being detected before I upgraded.
>
> I'm wondering what specifically should be logged to my maillog, when a
> Phishing attack is spotted, where it gets the verbage for this, and if
> Phishing detection depends on any other features in MailScanner being
> enabled, like file checks.
>
> Regards
> Michael Baird

I just searched my /var/log/maillog and came up with several "phish"
attempts.  Actually, I believe most of them are not malicious but just
redirection to other company servers.  The New York Times is one and the
Intel news letter always trigers a phishing attempt.

--
Gerry

"The lyfe so short, the craft so long to learne"  Chaucer

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mike at TC3NET.COM  Wed Nov 24 00:46:50 2004
From: mike at TC3NET.COM (Michael Baird)
Date: Thu Jan 12 21:27:41 2006
Subject: Phishing Detection
Message-ID: <mailman.5067.1137101261.24926.mailscanner@lists.mailscanner.info>

On Tue, 2004-11-23 at 19:32 -0500, Gerry Doris wrote:
> On Tue, 23 Nov 2004, Michael Baird wrote:
>
> > I just upgraded from 4.33.5 to 4.36.1, in the hopes of picking up the
> > phishing detection. I'm trying to determine if it is working or not. I
> > have not been able to find any references in any of my mailservers logs
> > to "Phish" or "phish", other then the Found the Phish-BankFraud.eml
> > trojan, which was being detected before I upgraded.
> >
> > I'm wondering what specifically should be logged to my maillog, when a
> > Phishing attack is spotted, where it gets the verbage for this, and if
> > Phishing detection depends on any other features in MailScanner being
> > enabled, like file checks.
> >
> > Regards
> > Michael Baird
>
> I just searched my /var/log/maillog and came up with several "phish"
> attempts.  Actually, I believe most of them are not malicious but just
> redirection to other company servers.  The New York Times is one and the
> Intel news letter always trigers a phishing attempt.
>
> --
> Gerry
Yes, I have 3 inbound MX's, receive 1000+ messages every 10 minutes
each, I have not noticed any phish detections on any of them, been
running for about 6 hours on 4.36.1. This is why I'm concerned something
isn't working right with my config. I have filetype checking disabled,
is this necessary for the phishing detection to work?

Regards
Michael Baird

>
> "The lyfe so short, the craft so long to learne"  Chaucer
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
--
Michael Baird <mike@tc3net.com>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ius at IUS.RBRANA.CO.ID  Wed Nov 24 01:17:45 2004
From: ius at IUS.RBRANA.CO.ID (Ius)
Date: Thu Jan 12 21:27:41 2006
Subject: New release of Vispan
Message-ID: <mailman.5068.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Anders Andersson, IT wrote:

>>-----Original Message-----
>>From: MailScanner mailing list
>>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of David While
>>Sent: Tuesday, November 23, 2004 12:18 PM
>>To: MAILSCANNER@JISCMAIL.AC.UK
>>Subject: Re: New release of Vispan
>>
>>Yes - simply delete the vispan.dat file in /var/cache/vispan
>>and it should read in the old stats.
>>
>>
>
>Ok, just want to make sure i do this correct.
>
>Before upgrade from 1.4 -1.55 I took copies of /var/cache/vispan and
>/var/www/html/vispan incase I needed them. Do I use those catalogs and
>rename the maillog files and run Vispan to collect data or just delete
>the dat files. Looking at the current /var/cache/vispan its only the
>vispan.dat thats changed since I did the upgrade
>
>
>
>
>
>
>>-----Original Message-----
>>From: MailScanner mailing list
>>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Anders Andersson, IT
>>
>>
>>
>>>-----Original Message-----
>>>From: MailScanner mailing list
>>>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of David While
>>>Sent: Tuesday, November 23, 2004 11:40 AM
>>>To: MAILSCANNER@JISCMAIL.AC.UK
>>>Subject: New release of Vispan
>>>
>>>I have just released Version 2 of Vispan. The major change in this
>>>version is to provide the ability to block the sending IP addresses
>>>using iptables at the firewall instead of the access file
>>>
>>>
>>at the MTA
>>
>>
>>>level. The original functionality of blocking in the access
>>>
>>>
>>file still
>>
>>
>>>remains - it is all conbfigurable from the config file.
>>>
>>>Download as usual from http://www.while.homeunix.net/mailstats/
>>>
>>>
>>Did you include the code for retaining the old stat?
>>
>>
>>
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>
Talking about Vispan, i got error in my FC1 machine while running Vispan :

Vispan
/usr/bin/perl: relocation error:
/usr/lib/perl5/site_perl/5.8.3/i386-linux-thread-multi/auto/GD/GD.so:
undefined symbol: gdFontGetLarge

i've installed GD and GD::Graph properly :

cpan> install GD
CPAN: Storable loaded ok
Going to read /root/.cpan/Metadata
  Database was generated on Tue, 23 Nov 2004 04:49:17 GMT
GD is up to date.

cpan> install GD::Graph
GD::Graph is up to date.

I'm stuck here :-( , can anybody help me ?

Thanks a lot

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From john at TRADOC.FR  Wed Nov 24 08:27:02 2004
From: john at TRADOC.FR (John Wilcock)
Date: Thu Jan 12 21:27:41 2006
Subject: Phishing Detection
Message-ID: <mailman.5069.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Michael Baird a écrit :
> Yes, I have 3 inbound MX's, receive 1000+ messages every 10 minutes
> each, I have not noticed any phish detections on any of them, been
> running for about 6 hours on 4.36.1. This is why I'm concerned something
> isn't working right with my config. I have filetype checking disabled,
> is this necessary for the phishing detection to work?

Sorry if this sounds like a stupid question, but have you actually set 
Find Phishing Fraud = yes in your MailScanner.conf?

John.

-- 
-- Over 2500 webcams from ski resorts around the world - www.snoweye.com
-- Translate your technical documents and web pages    - www.tradoc.fr

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Wed Nov 24 08:37:39 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:41 2006
Subject: SOBER-I
Message-ID: <mailman.5070.1137101261.24926.mailscanner@lists.mailscanner.info>

Alan

two things that may help..

1) check on the inbound MTA for delivery to non-existant addresses.
Varies between MTA's on how to do this, but I reject 66% of email on
this alone (malware and spam covers more than 99% of the rejected stuff,
rest tends to be typo's of email addresses).

2)Someone posted a plugin for SA on the SA users email list, that adds a
new rule for email received from a secondary MX when the primary has
recieved a direct email within the last X seconds.
http://article.gmane.org/gmane.mail.spam.spamassassin.general/59589/match=plugin


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Alan Cragg - Lists wrote:
> Hello All,
>
> First time poster many time reader.
>
> Since Friday I am getting flooded with e-mails infected with Sober-I
> virus. They all seem to be from one source and they are relaying through
> our secondary Mail Server (Our ISP supplies the secondary).
>
> It seems the one user can bring our server to its knees and the inbound
> queue just backs up.
> As a remedy I have to reject e-mails from the secondary server using the
> access file in sendmail.
>
> Does anyone know of a better way to block this without having to block
> our secondary mail server?
> Is it a performance tuning issue? We are using MailScanner 4.35.11 and
> Sophos AV, not SAVI, and SA 3.0.1.
>
> The machine is running Redhat 8.0 and is a XEON 2.4GHz CPU with 1GB RAM.
> Connection is only a T1.
>
> Thanks for any assistance,
>
> Alan Cragg
>
>
> CONFIDENTIALITY NOTICE.
> The information contained in this communication is confidential and/or
> proprietary business or technical data. If you are not the intended
> recipient, you are hereby notified that any use, dissemination, copying
> or distribution of this communication is strictly prohibited. If you
> have received this communication in error, please immediately notify us by
> telephone (604) 472-2300, or electronically by return message, and
> delete or destroy all copies.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From p.g.m.peters at utwente.nl  Wed Nov 24 12:20:47 2004
From: p.g.m.peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:27:41 2006
Subject: Foreign IP Address Rules
Message-ID: <mailman.5071.1137101261.24926.mailscanner@lists.mailscanner.info>

On Mon, 22 Nov 2004 09:25:45 -0500, you wrote:

>Just wondering if anyone out there has set up rules based on
>Country-specific IP addresses.  For instance, my organization doesn't do
>much (if any) work with foreign people.  So any remote server trying to
>communicate from say China, would be given a particular score.

I use the rbl blocks countries.nerd.dk in MS to tag the messages with
the relevant information. User can then decide whether they need (or
want) to receive e-mail from those countries.

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/itbe

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From p.g.m.peters at utwente.nl  Wed Nov 24 12:24:47 2004
From: p.g.m.peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:27:41 2006
Subject: Releasing messages from Quarantine
Message-ID: <mailman.5072.1137101261.24926.mailscanner@lists.mailscanner.info>

On Mon, 22 Nov 2004 14:28:39 -0600, you wrote:

>The email is in the directory
>/home/virtual/site35/fst/var/spool/mail.quarantine/20041122/iAM6A4X5001012
>
>There are three files. Is there not a way that I can -- from the command
>line, or otherwise -- just pass this email in its entirety to its intended
>recipient without changing the headers?

If two of the files are dfiAM6A4X5001012 and qfiAM6A4X5001012 then you
can move (or copy) those to /var/spool/mqueue. If you do a
"/usr/sbin/sendmail -qIiAM6A4X5001012" you start delivery immediatly.
Else the will wait for the next queuerun.

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/itbe

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From brendan.codykenny at REALEXPAYMENTS.COM  Wed Nov 24 12:28:54 2004
From: brendan.codykenny at REALEXPAYMENTS.COM (Brendan Cody-Kenny)
Date: Thu Jan 12 21:27:41 2006
Subject: mailscanner not calling spamassassin?
Message-ID: <mailman.5073.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

The mail logs show this for a batch. I have mailscanner running on a
test server at the moment and am using mail taken from the real mail
server and copying it into the queue.
**********************************************************************************

Nov 24 13:12:45 uncledeadly MailScanner[28189]: MailScanner E-Mail Virus
Scanner version 4.35.11 starting...
Nov 24 13:12:47 uncledeadly MailScanner[28189]: lock.pl sees Config
LockType =  posix
Nov 24 13:12:47 uncledeadly MailScanner[28189]: lock.pl sees have_module
=  0
Nov 24 13:12:47 uncledeadly MailScanner[28189]: Using locktype = posix
Nov 24 13:12:47 uncledeadly MailScanner[28189]: Creating hardcoded
struct_flock subroutine for linux (Linux-type)
Nov 24 13:12:47 uncledeadly MailScanner[28189]: Apparently invalid line
in queue file!- continuing anyway.
Nov 24 13:12:47 uncledeadly MailScanner[28189]: New Batch: Scanning 4
messages, 50809 bytes
Nov 24 13:12:47 uncledeadly MailScanner[28189]: Created attachment dirs
for 4 messages
Nov 24 13:12:47 uncledeadly MailScanner[28189]: Spam Checks: Starting
Nov 24 13:12:47 uncledeadly MailScanner[28189]: SpamAssassin returned 0
Nov 24 13:12:47 uncledeadly MailScanner[28189]: Message 1CWtY9-0005JX-5v
from xxxxxx (xxxxxx@xxxxxx.ie) to xxxxxx.com is not spam, SpamAssassin
(score=0, required 4.55)
Nov 24 13:12:48 uncledeadly MailScanner[28189]: SpamAssassin returned 0
Nov 24 13:12:48 uncledeadly MailScanner[28189]: Message 1CWtZj-0005KP-8y
from xxxxxx (xxxxxx@xxxxxx.ie) to xxxxxx.com is not spam, SpamAssassin
(score=0, required 4.55)
Nov 24 13:12:48 uncledeadly MailScanner[28189]: SpamAssassin returned 0
Nov 24 13:12:48 uncledeadly MailScanner[28189]: Message 1CWtOC-0005GA-CB
from 127.0.0.1 (result: 509) to  is not spam, SpamAssassin (score=0,
required 4.55)
Nov 24 13:12:48 uncledeadly MailScanner[28189]: SpamAssassin returned 0
Nov 24 13:12:48 uncledeadly MailScanner[28189]: Message 1CWtz2-0005Ug-JF
from xxxxxx (xxxxxx@xxxxxx.ie) to xxxxxx.com is not spam, SpamAssassin
(score=0, required 4.55)
Nov 24 13:12:50 uncledeadly MailScanner[28189]: Virus and Content
Scanning: Starting
Nov 24 13:12:50 uncledeadly MailScanner[28189]: Commencing scanning by
trend...
Nov 24 13:12:50 uncledeadly MailScanner[28189]: Completed scanning by trend
Nov 24 13:12:50 uncledeadly MailScanner[28189]: About to deliver 4 messages
Nov 24 13:12:50 uncledeadly MailScanner[28189]: Uninfected: Delivered 4
messages
Nov 24 13:12:50 uncledeadly MailScanner[28189]: MailScanner child dying
of old age

This is a copy of the headers section of the mail:
**********************************************************************************

178P Received: from xxxxxx.com ([xxxxxx])
        by xxxxxx.xxxxxx.ie with esmtp (Exim 4.34)
        id 1CWtz2-0005Ug-JF
        for xxxxxx@xxxxxx.com; Wed, 24 Nov 2004 10:02:44 +0000
130  Received: (from xxxxxx@xxxxxx)
        by xxxxxx.com (xxxxxx) id iAOA6ACj098278;
        Wed, 24 Nov 2004 03:06:10 -0700 (MST)
095  X-Authentication-Warning: newsvendor.com: newsvend set sender to
xxxxxx@xxxxxx.ie using -f
197  Received: from xxxxxx.ie (xxxxxx.ie [xxxxxx])
        by xxxxxx.com (xxxxxx) with ESMTP id iAOA69LB098246
        for <xxxxxx@xxxxxx.ie>; Wed, 24 Nov 2004 03:06:09 -0700 (MST)
124  Received: from xxxxxx (xxx.xxx.xxx.xxx) by xxxxxx (NPlex 2.0.108)
for xxxxxx@xxxxxx.ie; 24 Nov 2004 10:02:35 +0000
056I Message-ID: <xxxxxx>
045F From: "xxxxxx" <xxxxxx@xxxxxx.ie>
021T To: <xxxxxx@xxxxxx.ie>
085  Subject: Blah Blah Blah Blah Blah Blah Blah Blah Blah
038  Date: Wed, 24 Nov 2004 10:05:56 -0000
018  MIME-Version: 1.0
048  Content-Type: text/plain;
        charset="iso-8859-1"
032  Content-Transfer-Encoding: 7bit
014  X-Priority: 3
026  X-MSMail-Priority: Normal
051  X-Mailer: Microsoft Outlook Express 6.00.2800.1409
057  X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409
029S Sender: xxxxxx@xxxxxx.ie
017  Precedence: bulk
025R Reply-To: xxxxxx@xxxxxx.ie
034  X--MailScanner: Found to be clean
041  X-MailScanner-From: xxxxxx@xxxxxx.ie

And heres a debug message from using spamassassin on one of the messages
individually. It gives a non zero result.
**********************************************************************************
debug: Score set 0 chosen.
debug: running in taint mode? yes
debug: Running in taint mode, removing unsafe env vars, and resetting PATH
debug: PATH included '/usr/local/sbin', keeping.
debug: PATH included '/usr/local/bin', keeping.
debug: PATH included '/usr/sbin', keeping.
debug: PATH included '/usr/bin', keeping.
debug: PATH included '/sbin', keeping.
debug: PATH included '/bin', keeping.
debug: PATH included '/usr/bin/X11', keeping.
debug: Final PATH set to:
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/bin/X11
debug: using "/usr/share/spamassassin" for default rules dir
debug: using "/etc/spamassassin" for site rules dir
debug: using "/root/.spamassassin" for user state dir
debug: using "/root/.spamassassin/user_prefs" for user prefs file
debug: Failed to parse line in SpamAssassin configuration, skipping:
Spam Score Number Format = %5.2f
debug: bayes: 29101 tie-ing to DB file R/O
/var/lib/MailScanner/bayes/bayes_toks
debug: bayes: 29101 tie-ing to DB file R/O
/var/lib/MailScanner/bayes/bayes_seen
debug: bayes: found bayes db version 2
debug: Score set 3 chosen.
debug: Initialising learner
debug: running header regexp tests; score so far=0
debug: running body-text per-line regexp tests; score so far=3.916
debug: bayes corpus size: nspam = 3105, nham = 287
debug: uri tests: Done uriRE
debug: tokenize: header tokens for X-Mail-Format-Warning = "Bad RFC2822
header formatting in 1CWtOC-0005GA-CB-D"
debug: tokenize: header tokens for Client = "xxxxxxxxxxxxxx "
debug: tokenize: header tokens for <Result = "509>"
debug: tokenize: header tokens for Message = "That"
debug: tokenize: header tokens for X-Mail-Format-Warning = "Bad RFC2822
header formatting in 1CWtOC-0005GA-CB-D Bad RFC2822 header formatting in XX"
debug: tokenize: header tokens for https =
"//xxxxxxxxxxxxxx/xxxxxxxxxxxxxx/xxxxxxxxxxxxxx?g=xxxxxxxxxxxxxx"
debug: bayes token '509' => 0.00444628099173554
debug: bayes token 'HX-Mail-Format-Warning:Bad' => 0.988731707317073
debug: bayes token 'HX-Mail-Format-Warning:formatting' => 0.988731707317073
debug: bayes token 'HX-Mail-Format-Warning:RFC2822' => 0.988731707317073
debug: bayes token 'N:HX-Mail-Format-Warning:RFCNNNN' => 0.988731707317073
debug: bayes token 'HX-Mail-Format-Warning:header' => 0.988731707317073
debug: bayes token 'sk:X-MailS' => 0.0173548387096774
debug: bayes token '032' => 0.978
debug: bayes token '034' => 0.978
debug: bayes token 'MailScanner' => 0.112757412645574
debug: bayes token 'Found' => 0.142825979212285
debug: bayes: score = 0.598227219027678
debug: Syncing Bayes journal and expiring old tokens...
debug: lock: 29101 created
/var/lib/MailScanner/bayes/bayes.lock.xxxxxxxxxxxxxx.xxxxxxxxxxxxxx.ie.29101
debug: lock: 29101 trying to get lock on
/var/lib/MailScanner/bayes/bayes with 0 retries
debug: lock: 29101 link to /var/lib/MailScanner/bayes/bayes.lock: link ok
debug: bayes: 29101 tie-ing to DB file R/W
/var/lib/MailScanner/bayes/bayes_toks
debug: bayes: 29101 tie-ing to DB file R/W
/var/lib/MailScanner/bayes/bayes_seen
debug: bayes: found bayes db version 2
debug: synced Bayes databases from journal in 0 seconds: 11 unique
entries (11 total entries)
debug: bayes: 29101 untie-ing
debug: bayes: 29101 untie-ing db_toks
debug: bayes: 29101 untie-ing db_seen
debug: bayes: files locked, now unlocking lock
debug: unlock: 29101 unlink /var/lib/MailScanner/bayes/bayes.lock
debug: Syncing complete.
debug: bayes: 29101 untie-ing
debug: bayes: 29101 untie-ing db_toks
debug: Razor2 is not available
debug: running raw-body-text per-line regexp tests; score so far=3.916
debug: running uri tests; score so far=3.916
debug: uri tests: Done uriRE
debug: running full-text regexp tests; score so far=3.916
debug: Razor2 is not available
debug: Current PATH is:
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/bin/X11
debug: Pyzor is not available: pyzor not found
debug: DCCifd is not available: no r/w dccifd socket found.
debug: DCC is not available: no executable dccproc found.
debug: all '*From' addrs:
debug: all '*To' addrs:
debug: running meta tests; score so far=3.916
debug: is spam? score=3.917 required=4.7
tests=BAYES_56,DATE_MISSING,FROM_NO_LOWER
X-Mail-Format-Warning: Bad RFC2822 header formatting in 1CWtOC-0005GA-CB-D
Client: irishnation
<Result: 509>
Message: That
X-Mail-Format-Warning: Bad RFC2822 header formatting in XX
xxxxxxxxxxxxxxxxxxxxx
X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on
        xxxxxxxxxxxxxx.xxxxxxxxxxxxxx.ie
X-Spam-Level: ***
X-Spam-Status: No, hits=3.9 required=4.7 tests=BAYES_56,DATE_MISSING,
        FROM_NO_LOWER autolearn=no version=2.64

034  X--MailScanner: Found to be clean
032  X-MailScanner-From: result: 509


Brendan Cody-Kenny | brendan.codykenny@realexpayments.com
Network Administrator
Realex Payments

The Forum, 29-32 Glasthule Rd, Glasthule, Co Dublin, Ireland
t: +353 1 2808559 | f: +353 1 2808538

This mail and any documents attached are classified as confidential and are intended for use by the addressee(s) only unless otherwise indicated. If you are not an intended recipient of this email, you must not use, disclose, copy, distribute or retain this message or any part of it. If you have received this email in error, please notify us immediately and delete all copies of this email from your computer system(s).



Ugo Bellavance wrote:

> Brendan Cody-Kenny wrote:
>
>> Hello all,
>> I have been having some very annoying trouble lately with mailscanner
>> using spamassassin. As far as I have looked (which is pretty far) I have
>> correct settings for mailscanner and spamassassin. (spamassassin 2.64
>> and mailscanner 4.35.11)
>>
>> The problem is that mailscanner does not appear to be calling
>> spamassassin properly but is not generating any logs to indicate the
>> problem. I thought mailscanner was calling spamassassin and it was
>> returning 0 everytime but it turned out that "Always Include
>> SpamAssassin Report = yes" was giving every message a score of 0. After
>> changing this it appears that mailscanner is not running spamassassin at
>> all. I used strace on mailscanner and sifted though the results but
>> could not find anything conclusinve. A test of spamassassin from the
>> command line on a message returns a reasonable result (other than 0) for
>> a message but mailscanner is not doing this. I have included
>> Mailscanner.conf and spam.assassin.prefs.conf. Can anyone help? I hope
>> it is something really simple that I have misssed but I have been
>> looking at it for so long now that its invisible to me.
>
>
> What do you have in the headers?
>
> What do you get when you run MailScanner in debug with "Debut
> SpamaAssasin = yes"
>
> ?
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mike at TC3NET.COM  Wed Nov 24 12:45:36 2004
From: mike at TC3NET.COM (Michael Baird)
Date: Thu Jan 12 21:27:41 2006
Subject: Phishing Detection
Message-ID: <mailman.5074.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Wed, 2004-11-24 at 09:27 +0100, John Wilcock wrote:
> Michael Baird a écrit :
> > Yes, I have 3 inbound MX's, receive 1000+ messages every 10 minutes
> > each, I have not noticed any phish detections on any of them, been
> > running for about 6 hours on 4.36.1. This is why I'm concerned something
> > isn't working right with my config. I have filetype checking disabled,
> > is this necessary for the phishing detection to work?
> 
> Sorry if this sounds like a stupid question, but have you actually set 
> Find Phishing Fraud = yes in your MailScanner.conf?
> 
> John.
> 
Heh, Yea I sure have, it was added by default when I upgraded. I've been
running MailScanner for quite some time, I'm not a novice with it's
config. This is why I'm concerned some setting I've changed over the
time I've been running it is conflicting or stopping it from working.

Regards
-- 
Michael Baird <mike@tc3net.com>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From michele at BLACKNIGHTSOLUTIONS.COM  Wed Nov 24 14:05:54 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:41 2006
Subject: mailscanner not calling spamassassin?
Message-ID: <mailman.5075.1137101261.24926.mailscanner@lists.mailscanner.info>

> Nov 24 13:12:47 uncledeadly MailScanner[28189]: Message
> 1CWtY9-0005JX-5v from xxxxxx (xxxxxx@xxxxxx.ie) to xxxxxx.com is not
> spam, SpamAssassin (score=0, required 4.55) Nov 24 13:12:48
> uncledeadly MailScanner[28189]: SpamAssassin
> returned 0

So it is doing something but giving you a 0 each time

> debug: Failed to parse line in SpamAssassin configuration, skipping:

That looks like it could be part of your problem

> debug: DCCifd is not available: no r/w dccifd socket found.
> debug: DCC is not available: no executable dccproc found.

I'd recommend getting that working with it as well, as it does help a lot






Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
http://www.blacknight.ie/specialoffers.html

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dan at aac-services.co.uk  Wed Nov 24 15:29:53 2004
From: dan at aac-services.co.uk (Dan Harris)
Date: Thu Jan 12 21:27:41 2006
Subject: Question arising from FAQ: Do not scan attachments for single
    domain/address
Message-ID: <mailman.5076.1137101261.24926.mailscanner@lists.mailscanner.info>

Hi,

Been looking at the FAQs while setting up a filename/type rule to allow .chm
files in from one of our suppliers who should know better and will remain
nameless......(Vodafone!) ...... Whoops!

Anyhow, in the FAQ / Configuration /  Do not scan attachments for single
domain/address (
http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/244.html), the second
example suggests a filetype.rules file containing the following:

 
# FromOrTo: *@scanme.com yes
# FromOrTo: *@dontscanme.com no
# A filename can also be used in place of yes or no for
# furthur configuration
FromOrTo: default /etc/MailScanner/filetype.rules.conf
FromOrTo:*@gooddomain.com /etc/MailScanner/filetype.allow.all

The comments in this file would seem to suggest that you can use a simple
"FromOrTo: *@dontscanme.com no" syntax to prevent the file filtering rules
from affecting mail from/to the dontscanme.com domain. This does not work
however, at least not with V4.35.11 (you get a " Cannot open filename-rules
file no, skipping" in the log). Is this a relic from some older version that
it did work with, and as I figure from the filetype.allow.all example (which
I used to make it work in this instance), it is now this way by design?

Just curious.

Dan Harris.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From suporte at SETINET.COM.BR  Wed Nov 24 16:22:15 2004
From: suporte at SETINET.COM.BR (Dennis Robert Kelbert)
Date: Thu Jan 12 21:27:41 2006
Subject: Size notify
Message-ID: <mailman.5077.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Where is the file to notify sender and recipient that the size of a
e-mail has over limit...?
 
ok i see that it matches with conted filter..
and it use inline.warning.txt
 
 
but the inline.warning.txt  do a antiovirus msg too!
and the size over limit isn´t a virus
 

--------------------------------------------
Esta mensagem foi verificada pelo sistema de
anti-virus e anti-spam.
Seti Segurança e Tecnologia na Internet
suporte@setinet.com.br ------------------------ MailScanner list
------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From vachanta at GMAIL.COM  Wed Nov 24 18:21:20 2004
From: vachanta at GMAIL.COM (Venkata Achanta)
Date: Thu Jan 12 21:27:41 2006
Subject: MailScanner to version 4.35.11.1 - upgrade - Performance Problem
Message-ID: <mailman.5078.1137101261.24926.mailscanner@lists.mailscanner.info>

We have a bunch of boxes running MS and we upgraded to MailScanner-4.35.11.1
last night. The updates were all good but unfortunately all the incoming
mail queues are unusually high,i mean they are just growing hour by hour
and in the logs.The mail is flowing very slowly.

I know there are many different factors that can influence the mail
processing speed.but We were doing just great till this upgrade.

Upgrades:
Spamassassin to version 3.0.1
MailScanner to version 4.35.11.1

Another point to be noted is we just added mailwatch also during the
upgrade,is that creating any delays in processing mail ?

Any help/pointers would be greatly appreciated.

Just out of curiosity,Any one else having the same issue ?

Thanks,

Venkata Achanta

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From richard at CROSSWIRED.CO.UK  Wed Nov 24 18:28:03 2004
From: richard at CROSSWIRED.CO.UK (Richard Curtis)
Date: Thu Jan 12 21:27:41 2006
Subject: Restarting sendmail after config change ?
Message-ID: <mailman.5079.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I am writing a script for adding hosted domains to our server.
When I add a hosted domain, I need to add it to the sendmails virtusertable
and local-host-names.

I have tried to use /etc/init.d/MailScanner reload but this does not rebuild
the virtusertable.db file.

What is the correct way to do this ?

Richard

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Steve.Swaney at FSL.COM  Wed Nov 24 18:35:47 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:41 2006
Subject: MailScanner to version 4.35.11.1 - upgrade - Performance
    Problem
Message-ID: <mailman.5080.1137101261.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Venkata Achanta
> Sent: Wednesday, November 24, 2004 1:21 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: MailScanner to version 4.35.11.1 - upgrade - Performance Problem
>
> We have a bunch of boxes running MS and we upgraded to MailScanner-
> 4.35.11.1
> last night. The updates were all good but unfortunately all the incoming
> mail queues are unusually high,i mean they are just growing hour by hour
> and in the logs.The mail is flowing very slowly.
>
> I know there are many different factors that can influence the mail
> processing speed.but We were doing just great till this upgrade.
>
> Upgrades:
> Spamassassin to version 3.0.1
> MailScanner to version 4.35.11.1
>
> Another point to be noted is we just added mailwatch also during the
> upgrade,is that creating any delays in processing mail ?
>
> Any help/pointers would be greatly appreciated.
>

Are you seeing any "time outs" in the logs?

Have you tried running:

spamassassin -D -p /etc/MailScanner/spam.assassin.prefs.conf --lint

And look for errors.

Did you update your bayes database for use with SpamAssassin 3.01?

Did you update your db4 libraries to work around the SpamAssassin 3.0 bug?

Have you tried setting

        Debug = no
        Debug SpamAssassin = no

And checking the output?

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com

> Just out of curiosity,Any one else having the same issue ?
>

We haven't seen any exceptional slowdown at any of the sites we're upgraded.

> Thanks,
>
> Venkata Achanta
>



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From paddy at PANICI.NET  Wed Nov 24 18:41:27 2004
From: paddy at PANICI.NET (paddy)
Date: Thu Jan 12 21:27:41 2006
Subject: salongreport from AlwaysLookedUpLast ?
Message-ID: <mailman.5081.1137101261.24926.mailscanner@lists.mailscanner.info>

Hi Julian,

I was trying this,

  sub MyCustomFunction {
  my $message = @_;
    MailScanner::Log::InfoLog("MyCustomFunction: %s",$message->{salongreport});
  }
  (with the init, end and 1; too)

with

  Detailed Spam Report = yes
  Include Scores In SpamAssassin Report = yes
  Always Include SpamAssassin Report = yes
  Always Looked Up Last = &MyCustomFunction

but all I get is:

  Nov 24 18:22:03 cb3 MailScanner[12912]: MyCustomFunction:

I can also see remmed out code

  #$this->{salongreport} = ""; # Reset it so we don't ever insert it twice

Is this information accessible from AlwaysLookedUpLast ?

Regards,
Paddy
--
Perl 6 will give you the big knob. -- Larry Wall

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From cconn at ABACOM.COM  Wed Nov 24 18:41:18 2004
From: cconn at ABACOM.COM (Chris Conn)
Date: Thu Jan 12 21:27:41 2006
Subject: Restarting sendmail after config change ?
Message-ID: <mailman.5082.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Richard Curtis wrote:
> I am writing a script for adding hosted domains to our server.
> When I add a hosted domain, I need to add it to the sendmails virtusertable
> and local-host-names.
>
> I have tried to use /etc/init.d/MailScanner reload but this does not
> rebuild
> the virtusertable.db file.
>
> What is the correct way to do this ?
>
on my redhats, I have a script that does this:

make -C /etc/mail
kill -HUP `head -1 /var/run/sendmail.in.pid`

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From paddy at PANICI.NET  Wed Nov 24 18:53:29 2004
From: paddy at PANICI.NET (paddy)
Date: Thu Jan 12 21:27:41 2006
Subject: Restarting sendmail after config change ?
Message-ID: <mailman.5083.1137101261.24926.mailscanner@lists.mailscanner.info>

On Wed, Nov 24, 2004 at 06:28:03PM -0000, Richard Curtis wrote:
> I am writing a script for adding hosted domains to our server.
> When I add a hosted domain, I need to add it to the sendmails virtusertable
> and local-host-names.
>
> I have tried to use /etc/init.d/MailScanner reload but this does not rebuild
> the virtusertable.db file.
>
> What is the correct way to do this ?

AFAIK MailScanner does not concern itself with virtusertable.

IIRC the /etc/init.d/MailScanner script that ships with MailScanner
does not offer a seperate reload_mta option.

I would suggest you look at your distro rc scripts for sendmail and
figure it out from there, but if you have a debian-style 1200 line
monster and you want a simple answer, then the traditional answer
*** for most programs *** would be 'HUP it', that is send the process
a HUP signal.  Typically this can be accomplished with something like:

kill -1 `head -n1 /var/run/sendmail.pid`

I imagine something like this works for sendmail too.

Regards,
Paddy
--
Perl 6 will give you the big knob. -- Larry Wall

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jstevens at ATHENSDISTRIBUTING.COM  Wed Nov 24 19:00:34 2004
From: jstevens at ATHENSDISTRIBUTING.COM (James R. Stevens)
Date: Thu Jan 12 21:27:41 2006
Subject: Restarting sendmail after config change ?
Message-ID: <mailman.5084.1137101261.24926.mailscanner@lists.mailscanner.info>

Within RedHat you will use the MAKEMAP command to reload and database
into memory without restarting Sendmail/Mailscanner.

Example:
Cli->makemap hash /etc/mail/access < /etc/mail/access 
Would reload the access table after any changes. This would be based on
a hash database. 

Something similar would be used for the virtusertable depending on the
type of database.

Hope that helps..

-----Original Message-----
From: Chris Conn [mailto:cconn@ABACOM.COM] 
Sent: Wednesday, November 24, 2004 12:41 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Restarting sendmail after config change ?

Richard Curtis wrote:
> I am writing a script for adding hosted domains to our server.
> When I add a hosted domain, I need to add it to the sendmails
virtusertable
> and local-host-names.
>
> I have tried to use /etc/init.d/MailScanner reload but this does not
> rebuild
> the virtusertable.db file.
>
> What is the correct way to do this ?
>
on my redhats, I have a script that does this:

make -C /etc/mail
kill -HUP `head -1 /var/run/sendmail.in.pid`

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

-- 
This message has been scanned for viruses and
dangerous content by Athens Hyperion Scanner, and is
believed to be clean.




-- 
This message has been scanned for viruses and
dangerous content by Athens Hyperion Scanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From sanjay.k.patel at gmail.com  Wed Nov 24 18:56:28 2004
From: sanjay.k.patel at gmail.com (Sanjay Patel)
Date: Thu Jan 12 21:27:41 2006
Subject: mail stopped being delivered
Message-ID: <mailman.5085.1137101261.24926.mailscanner@lists.mailscanner.info>

we are running MailScanner version 4.35.10 and sendmail 8.13.1

everything was working fine until today morning. NOw we have mail
stuck in both in and out queue and mail not being delivered locally or
to the internet.

I am sure a developer who was on the system did something. But as
usual I get I did nothing answer.

What could have changed?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From vachanta at GMAIL.COM  Wed Nov 24 19:11:48 2004
From: vachanta at GMAIL.COM (Venkata Achanta)
Date: Thu Jan 12 21:27:41 2006
Subject: MailScanner to version 4.35.11.1 - upgrade - Performance
    Problem
Message-ID: <mailman.5086.1137101261.24926.mailscanner@lists.mailscanner.info>

Steve,

Thanks for replying.Here is what i found

>Are you seeing any "time outs" in the logs?

Nope!

>Have you tried running:
>
>spamassassin -D -p /etc/MailScanner/spam.assassin.prefs.conf --lint
>And look for errors.
>Did you update your bayes database for use with SpamAssassin 3.01?

I have to mention here that we upgraded SpamAssasin from 2.6 to 3.01 and
some boxes had the bayes databases upgraded properly but a few of them
didnt have the updated DBs. We had to manually go in and upgrade the spam
assassin DBs.

are they know issue with this kinda of upgrade ?


>Did you update your db4 libraries to work around the SpamAssassin 3.0 bug?

Thats a SpamAssassin 3.0 bug and i am not sure if the same bug exists with
3.01.Please advise.

>Have you tried setting
>
>        Debug = no
>        Debug SpamAssassin = no
>
>And checking the output?

I am looking into it and will keep you posted.Thanks for your help.

Please advise.

















>> -----Original Message-----
>> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>> Behalf Of Venkata Achanta
>> Sent: Wednesday, November 24, 2004 1:21 PM
>> To: MAILSCANNER@JISCMAIL.AC.UK
>> Subject: MailScanner to version 4.35.11.1 - upgrade - Performance Problem
>>
>> We have a bunch of boxes running MS and we upgraded to MailScanner-
>> 4.35.11.1
>> last night. The updates were all good but unfortunately all the incoming
>> mail queues are unusually high,i mean they are just growing hour by hour
>> and in the logs.The mail is flowing very slowly.
>>
>> I know there are many different factors that can influence the mail
>> processing speed.but We were doing just great till this upgrade.
>>
>> Upgrades:
>> Spamassassin to version 3.0.1
>> MailScanner to version 4.35.11.1
>>
>> Another point to be noted is we just added mailwatch also during the
>> upgrade,is that creating any delays in processing mail ?
>>
>> Any help/pointers would be greatly appreciated.
>>
>
>Are you seeing any "time outs" in the logs?
>
>Have you tried running:
>
>spamassassin -D -p /etc/MailScanner/spam.assassin.prefs.conf --lint
>
>And look for errors.
>
>Did you update your bayes database for use with SpamAssassin 3.01?
>
>Did you update your db4 libraries to work around the SpamAssassin 3.0 bug?
>
>Have you tried setting
>
>        Debug = no
>        Debug SpamAssassin = no
>
>And checking the output?
>
>Steve
>
>Steve Swaney
>President
>Fortress Systems Ltd.
>www.fsl.com
>steve.swaney@fsl.com
>
>> Just out of curiosity,Any one else having the same issue ?
>>
>
>We haven't seen any exceptional slowdown at any of the sites we're
upgraded.
>
>> Thanks,
>>
>> Venkata Achanta
>>
>
>
>
>--
>This message has been scanned for viruses and
>dangerous content by MailScanner, and is
>believed to be clean.
>
>Fortress Systems Ltd.
>www.fsl.com
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From richard at CROSSWIRED.CO.UK  Wed Nov 24 19:13:01 2004
From: richard at CROSSWIRED.CO.UK (Richard Curtis)
Date: Thu Jan 12 21:27:41 2006
Subject: Restarting sendmail after config change ?
Message-ID: <mailman.5087.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I considered this, but it doesnt work for local-host-names which isnt a
hash.
I think the best idea so far as been from Chris Conn:
make -C /etc/mail
kill -HUP 'head -1 /var/run/sendmail.in.pid`

Thanks for all the quick responses.
It looks like this option works for me :)

Rich


> Within RedHat you will use the MAKEMAP command to reload and database
> into memory without restarting Sendmail/Mailscanner.
>
> Example:
> Cli->makemap hash /etc/mail/access < /etc/mail/access
> Would reload the access table after any changes. This would be based on
> a hash database.
>
> Something similar would be used for the virtusertable depending on the
> type of database.
>
> Hope that helps..
>
> -----Original Message-----
> From: Chris Conn [mailto:cconn@ABACOM.COM]
> Sent: Wednesday, November 24, 2004 12:41 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Restarting sendmail after config change ?
>
> Richard Curtis wrote:
>> I am writing a script for adding hosted domains to our server.
>> When I add a hosted domain, I need to add it to the sendmails
> virtusertable
>> and local-host-names.
>>
>> I have tried to use /etc/init.d/MailScanner reload but this does not
>> rebuild
>> the virtusertable.db file.
>>
>> What is the correct way to do this ?
>>
> on my redhats, I have a script that does this:
>
> make -C /etc/mail
> kill -HUP `head -1 /var/run/sendmail.in.pid`
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> --
> This message has been scanned for viruses and
> dangerous content by Athens Hyperion Scanner, and is
> believed to be clean.
>
>
>
>
> --
> This message has been scanned for viruses and
> dangerous content by Athens Hyperion Scanner, and is
> believed to be clean.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From alex at nkpanama.com  Wed Nov 24 19:23:50 2004
From: alex at nkpanama.com (Alex Neuman van der Hans)
Date: Thu Jan 12 21:27:41 2006
Subject: Restarting sendmail after config change ?
Message-ID: <mailman.5088.1137101261.24926.mailscanner@lists.mailscanner.info>

I usually do a killall -HUP sendmail; it's ugly but works like a charm... :)


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Chris Conn
Sent: Wednesday, November 24, 2004 1:41 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Restarting sendmail after config change ?

Richard Curtis wrote:
> I am writing a script for adding hosted domains to our server.
> When I add a hosted domain, I need to add it to the sendmails
> virtusertable and local-host-names.
>
> I have tried to use /etc/init.d/MailScanner reload but this does not
> rebuild the virtusertable.db file.
>
> What is the correct way to do this ?
>
on my redhats, I have a script that does this:

make -C /etc/mail
kill -HUP `head -1 /var/run/sendmail.in.pid`

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From suporte at SETINET.COM.BR  Wed Nov 24 19:36:02 2004
From: suporte at SETINET.COM.BR (Dennis Robert Kelbert)
Date: Thu Jan 12 21:27:41 2006
Subject: [iso-8859-1] MailScanner won´t check filename size and virus
Message-ID: <mailman.5089.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi!!
 
i don´t know what to do!
MailScanner dont want scan nothing... The email with virus, bad
attachment, size wrong... pass at all!
I see this logs in mail.log
 
Spam Checks completed at 0 bytes per second
Unscanned: Delivered 1 messages
 
 
Why Unscaned??  what i´m doing wrong?

--------------------------------------------
Esta mensagem foi verificada pelo sistema de
anti-virus e anti-spam.
Seti Segurança e Tecnologia na Internet
suporte@setinet.com.br ------------------------ MailScanner list
------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From michele at BLACKNIGHTSOLUTIONS.COM  Wed Nov 24 19:40:25 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:41 2006
Subject: [iso-8859-1] RE: [MAILSCANNER] MailScanner won´t check filename
    s[iso-8859-1] ize and virus
Message-ID: <mailman.5090.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Dennis Robert Kelbert wrote:
> Hi!!
> 
> i don´t know what to do!
> 
> MailScanner dont want scan nothing... The email with virus, bad
> attachment, size wrong... pass at all! 
> 
> I see this logs in mail.log
> 
> Spam Checks completed at 0 bytes per second
> 
> Unscanned: Delivered 1 messages
> 
> Why Unscaned??  what i´m doing wrong?

I don't know :)

You'll need to give us more information 



Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
http://www.blacknight.ie/specialoffers.html

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From alex at nkpanama.com  Wed Nov 24 19:51:42 2004
From: alex at nkpanama.com (Alex Neuman van der Hans)
Date: Thu Jan 12 21:27:41 2006
Subject: [iso-8859-1] RE: [MAILSCANNER] MailScanner won´t check filename
    s[iso-8859-1] ize and virus
Message-ID: <mailman.5091.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I'm usually tempted (though I've never yet succumbed to said temptation) to
answer something like:

> Why Unscaned??  what i´m doing wrong?

Because it didn't!! Something!

But seriously, maybe we should ask JF to add "How to ask questions the smart
way" by ESR (available at http://www.catb.org/~esr/faqs/smart-questions.html
) so that people check it beforehand - and maybe add it to the welcome
e-mail from the list if it's not already there...

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Michele Neylon :: Blacknight Solutions
Sent: Wednesday, November 24, 2004 2:40 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: RE: [MAILSCANNER] MailScanner won´t check filename size and virus

Dennis Robert Kelbert wrote:
> Hi!!
> 
> i don´t know what to do!
> 
> MailScanner dont want scan nothing... The email with virus, bad 
> attachment, size wrong... pass at all!
> 
> I see this logs in mail.log
> 
> Spam Checks completed at 0 bytes per second
> 
> Unscanned: Delivered 1 messages
> 
> Why Unscaned??  what i´m doing wrong?

I don't know :)

You'll need to give us more information 



Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
http://www.blacknight.ie/specialoffers.html

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mkettler at EVI-INC.COM  Wed Nov 24 19:53:48 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:41 2006
Subject: [iso-8859-1] Re: MailScanner won´t check filename size 
Message-ID: <mailman.5092.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

At 02:36 PM 11/24/2004, Dennis Robert Kelbert wrote:
>Hi!!
>
>i don´t know what to do!
>MailScanner dont want scan nothing... The email with virus, bad 
>attachment, size wrong... pass at all!
>I see this logs in mail.log
>
>Spam Checks completed at 0 bytes per second
>Unscanned: Delivered 1 messages
>
>
>Why Unscaned??  what i´m doing wrong?

It's hard to say what you're doing wrong, since you didn't tell us what you 
did, only that things aren't working as you expected.

1) In MailScanner.conf, what is "Virus Scanners =" set to?

2) what do you mean by "bad attachment, size wrong"? Be specific. It sounds 
at casual glance like you're testing with a corrupted message. If it's so 
heavily corrupted that the size is wrong, I doubt any mailclient will 
decode it, nor will MailScanner.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From suporte at SETINET.COM.BR  Wed Nov 24 20:10:47 2004
From: suporte at SETINET.COM.BR (Dennis Robert Kelbert)
Date: Thu Jan 12 21:27:41 2006
Subject: [iso-8859-1] Re: MailScanner won´t check filename size 
Message-ID: <mailman.5093.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Ok i had solved the problem..
i don´t know that if i turn Virus scanner off, then  other checks don´t 
going to work...


But I have other problem...  it´s about the size of an attach.
The values are only to explain.
When I turn Maximum Attachment Size = 204800 (200Kb)
and send a file TEST.ZIP with 50Kb, but inside have a file
with 500Kb, then the MailScanner match the size rule.

I dont want that MailScanner look the size of inside ZIP files.
That doesn´t make sense !

If I ZIP some file, it´s just to make more small....



----- Original Message ----- 
From: "Matt Kettler" <mkettler@EVI-INC.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Wednesday, November 24, 2004 5:53 PM
Subject: Re: MailScanner won´t check filename size


At 02:36 PM 11/24/2004, Dennis Robert Kelbert wrote:
>Hi!!
>
>i don´t know what to do!
>MailScanner dont want scan nothing... The email with virus, bad attachment, 
>size wrong... pass at all!
>I see this logs in mail.log
>
>Spam Checks completed at 0 bytes per second
>Unscanned: Delivered 1 messages
>
>
>Why Unscaned??  what i´m doing wrong?

It's hard to say what you're doing wrong, since you didn't tell us what you
did, only that things aren't working as you expected.

1) In MailScanner.conf, what is "Virus Scanners =" set to?

2) what do you mean by "bad attachment, size wrong"? Be specific. It sounds
at casual glance like you're testing with a corrupted message. If it's so
heavily corrupted that the size is wrong, I doubt any mailclient will
decode it, nor will MailScanner.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

--------------------------------------------
Esta mensagem foi verificada pelo sistema de
antivírus e anti-spam.
Seti Segurança e Tecnologia na Internet
suporte@setinet.com.br



--------------------------------------------
Esta mensagem foi verificada pelo sistema de 
antivírus e anti-spam.
Seti Segurança e Tecnologia na Internet
suporte@setinet.com.br

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From marco at XSSNET.COM  Wed Nov 24 20:11:12 2004
From: marco at XSSNET.COM (Marco Benton)
Date: Thu Jan 12 21:27:41 2006
Subject: MailScanner [ISO-8859-1] won´t check f[ISO-8859-1] ilename
    size and virus
Message-ID: <mailman.5094.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Alex Neuman van der Hans wrote:

| I'm usually tempted (though I've never yet succumbed to said
| temptation) to answer something like:
|
|> Why Unscaned??  what i'm doing wrong?
|
|
| Because it didn't!! Something!
|
| But seriously, maybe we should ask JF to add "How to ask questions
| the smart way" by ESR (available at
| http://www.catb.org/~esr/faqs/smart-questions.html ) so that people
| check it beforehand - and maybe add it to the welcome e-mail from
| the list if it's not already there...


for a minute there i thought i was in one of the comp.os.linux
newsgroups!  there is alot of "..Linux isnt working...why??..."

to make things worse, every post to this list has a trailer that
mentions reading the MAQ before posting, but how many times do we see
painfully obvious questions posted still?

- --

Marco Benton - BOFH, BSMFH
Network Consultant

BOFH excuse #205: The cause of the problem is: Police are examining
all internet packets in the search for a narco-net-trafficker

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBpOrg2+PYgoYkw8ERArJgAJ9d9TjOXEERlpNf/DP9OJ5nNsYPmACfU1ba
3Xg/KYs3sVHrWdSJSI2SyHk=
=y7j9
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From llasad1 at YAHOO.COM  Wed Nov 24 20:12:13 2004
From: llasad1 at YAHOO.COM (lester lasad)
Date: Thu Jan 12 21:27:41 2006
Subject: off topic:  email forwarding assistance/guidance needed
Message-ID: <mailman.5095.1137101261.24926.mailscanner@lists.mailscanner.info>

--- Bob Noordam <bno@SALVAGEBV.NL> wrote:

> > > >> the virtusertable (/etc/mail/virtusertable)
> > > enables you to map single
> > > >> users or complete domains to other
> recipients, so
> > > >> thats is the place to
> > > >> map *@xyz to *@abc.
> > > >>
> > > >> Bob.
> > > >>
> > > > Thanks for the info.  I did try to forward one
> > > > particular users email unsuccessfully and
> wanted
> > > to
> > > > give you more specifics on my setup.
> > > >
> > > > my mailertable says the following:
> > > > abc.com    esmtp:abcmailsvr.abc.com
> > > > xyz.com    esmtp:xyzmailsvr.xyz.com
> > > >
> > > > I added the following to the
> > > /etc/mail/virtusertable:
> > > > lester@xyz.com      lester@abc.com  (which
> should
> > > send
> > > > the email to lester@abc.com)
> > > >
> > > > I then tried to send an email to
> lester@xyz.com
> > > and
> > > > received the following:
> > > > ----- The following addresses had permanent
> fatal
> > > > errors -----
> > > > <lester@xyz.com>
> > > >     (reason: 553 5.3.5 system config error)
> > > >
> > > >    ----- Transcript of session follows -----
> > > > 553 5.3.5 xyzmailsvr.xyz.com. config error:
> mail
> > > loops
> > > > back to me (MX
> > > > problem?)
> > > > 554 5.3.5 Local configuration error
> > > >
> > > > I must be missing something.  thanks.
> > > >
> > >
> > > Do you have abc.com and xyz.com in your
> > > /etc/mail/local-host-names or
> > > /etc/mail/relay-domains?  They should be in
> > > relay-domains.  Also, make sure
> > > you hashed your virtusertable to db.
> > >
> > > You will need to restart sendmail to read the
> > > relay-domains after
> > > modification.
> > >
> > > Mike
> > >
> > abc.com and xyz.com are not in
> > /etc/mail/local-host-names.  But, they are in
> > /etc/mail/relay-domains
> >
> > forgive me, but I'm not sure what you mean by
> "make
> > sure you hashed your virtusertable to db"
> >
>
> sendmail does not reed the textfiles directly, is
> uses a database file you
> need to create from the textfiles.
> If you alter any file, say virtusertable, you need
> to issue the command
>
> makemap hash virtusertable.db < virtusertable
>
> With that, you create the new file sendmail will
> use.
> After that, restart sendmail and it will 'see' the
> modifications.
>
> > I have restarted sendmail as well.  When I send
> the
> > email it is still routing to the xyz.com host and
> not
> > the abc.com host.  I want to take the xyz.com host
> out
> > of the picture.  Should I remove it from my
> > mailertable and see what happens?
> >
>
> thats worth a try, if xyz is mentioned nowhere, and
> it still resolves to its
> own mx you should look further into possible dns
> issues.
>
> Bob.

I would like to explain my setup a little further.  I
have one sendmail server that relays (does not deliver
to local mail files on the server) to 2 seperate
domains/hosts.  The MX record for both domains
(abc.com and xyz.com) point to my one sendmail server
(one ip).  With that said, do you see any problems
(mail routing loops) using the virtusertable? for
example, in the virtusertable I would put:
lester@abc.com       lester@xyz.com

From michele at BLACKNIGHTSOLUTIONS.COM  Wed Nov 24 20:18:09 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:41 2006
Subject: [iso-8859-1] RE: [MAILSCANNER] Re: MailScanner won´t check
    filena[iso-8859-1] me size 
Message-ID: <mailman.5097.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> Ok i had solved the problem..
> i don´t know that if i turn Virus scanner off, then  other
> checks don´t going to work...
> 
> 
> But I have other problem...  it´s about the size of an attach.
> The values are only to explain.
> When I turn Maximum Attachment Size = 204800 (200Kb)
> and send a file TEST.ZIP with 50Kb, but inside have a file
> with 500Kb, then the MailScanner match the size rule.
> 
> I dont want that MailScanner look the size of inside ZIP files.
> That doesn´t make sense !
> 
> If I ZIP some file, it´s just to make more small....

There is an FAQ and an MAQ
Please go and read them and also read:
http://www.catb.org/~esr/faqs/smart-questions.html

Before you post any more questions

We would love to help you but you are not giving us enough information.
Put in other terms... Could you be more vague?



Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
http://www.blacknight.ie/specialoffers.html

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From William.Burns at AEROFLEX.COM  Wed Nov 24 20:22:53 2004
From: William.Burns at AEROFLEX.COM (William Burns)
Date: Thu Jan 12 21:27:41 2006
Subject: Restarting sendmail after config change ?
Message-ID: <mailman.5098.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Richard:

Watch out!
The previously posted example below looks to me like it overwrites your
access file!
A "fixed" version is here:

> makemap hash /etc/mail/access.db < /etc/mail/access



On RedHat systems all you would need to do is type:
 > cd /etc/mail
 > make access.db
or
 > make virtusertable.db

No "restart" is needed.

If you're on a non-RedHat distro and there's no Makefile in the
/etc/mail directory, here's mine.

> # These could be used by sendmail, but are not part of the default
> install.
> # To use them you will have to generate your own sendmail.cf with
> #  FEATURE('whatever')
> #
> POSSIBLE += $(shell test -f bitdomain     && echo bitdomain.db)
> POSSIBLE += $(shell test -f uudomain      && echo uudomain.db)
> POSSIBLE += $(shell test -f genericstable && echo genericstable.db)
> POSSIBLE += $(shell test -f userdb        && echo userdb.db)
> CFFILES   = sendmail.cf submit.cf
>
>
> all: ${CFFILES} ${POSSIBLE} virtusertable.db access.db domaintable.db
> mailertable.db
>
> userdb.db : userdb
>         @makemap btree $@ < $<
>
> %.db : %
>         @makemap hash $@ < $<
>
> %.cf : %.mc
>         @if test -f /usr/share/sendmail-cf/m4/cf.m4; then \
>                 mv -f $@ $@.bak; \
>                 m4 $< > $@; \
>         fi;
>
> clean:
>         rm -f *.db *~



-Bill

James R. Stevens wrote:

>Within RedHat you will use the MAKEMAP command to reload and database
>into memory without restarting Sendmail/Mailscanner.
>
>Example:
>Cli->makemap hash /etc/mail/access < /etc/mail/access
>Would reload the access table after any changes. This would be based on
>a hash database.
>
>Something similar would be used for the virtusertable depending on the
>type of database.
>
>Hope that helps..
>
>-----Original Message-----
>From: Chris Conn [mailto:cconn@ABACOM.COM]
>Sent: Wednesday, November 24, 2004 12:41 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Restarting sendmail after config change ?
>
>Richard Curtis wrote:
>
>
>>I am writing a script for adding hosted domains to our server.
>>When I add a hosted domain, I need to add it to the sendmails
>>
>>
>virtusertable
>
>
>>and local-host-names.
>>
>>I have tried to use /etc/init.d/MailScanner reload but this does not
>>rebuild
>>the virtusertable.db file.
>>
>>What is the correct way to do this ?
>>
>>
>>
>on my redhats, I have a script that does this:
>
>make -C /etc/mail
>kill -HUP `head -1 /var/run/sendmail.in.pid`
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From suporte at SETINET.COM.BR  Wed Nov 24 20:40:37 2004
From: suporte at SETINET.COM.BR (Dennis Robert Kelbert)
Date: Thu Jan 12 21:27:41 2006
Subject: [iso-8859-1] Re: [MAILSCANNER] Re: MailScanner won´t check
    filena[iso-8859-1] me size 
Message-ID: <mailman.5099.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

More explicit

---> MailScanner.conf
Maximum Attachment Size = 500Kb

---> Info about my file
ZIP FILE = test.zip  (100Kb)
INSIDE THIS ZIP = test.txt (1000Kb = 1Mb)
We can see that Zip reducing 90% about the original size.

---> Problem
When i send the email with 100Kb(test.zip).......


---> The Log, I had translated  here the Size informations
Attachment size check: 1000Kb > 500Kb (teste.sasa.txt) in 100Kb


It´s right that in the inside of my zip file I have 1Mb, but, dont make 
sense to
use this rule to check the size of inside zip files....
I really don´t want and don´t need to check the size of internal contents of 
ZIP files.

What can i do?



Really Thanks for the peoples that help me and help others friends of us.








----- Original Message ----- 
From: "Michele Neylon :: Blacknight Solutions" 
<michele@BLACKNIGHTSOLUTIONS.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Wednesday, November 24, 2004 6:18 PM
Subject: RE: [MAILSCANNER] Re: MailScanner won´t check filename size


> Ok i had solved the problem..
> i don´t know that if i turn Virus scanner off, then  other
> checks don´t going to work...
>
>
> But I have other problem...  it´s about the size of an attach.
> The values are only to explain.
> When I turn Maximum Attachment Size = 204800 (200Kb)
> and send a file TEST.ZIP with 50Kb, but inside have a file
> with 500Kb, then the MailScanner match the size rule.
>
> I dont want that MailScanner look the size of inside ZIP files.
> That doesn´t make sense !
>
> If I ZIP some file, it´s just to make more small....

There is an FAQ and an MAQ
Please go and read them and also read:
http://www.catb.org/~esr/faqs/smart-questions.html

Before you post any more questions

We would love to help you but you are not giving us enough information.
Put in other terms... Could you be more vague?



Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
http://www.blacknight.ie/specialoffers.html

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

--------------------------------------------
Esta mensagem foi verificada pelo sistema de
antivírus e anti-spam.
Seti Segurança e Tecnologia na Internet
suporte@setinet.com.br



--------------------------------------------
Esta mensagem foi verificada pelo sistema de 
antivírus e anti-spam.
Seti Segurança e Tecnologia na Internet
suporte@setinet.com.br

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From marco at XSSNET.COM  Wed Nov 24 20:39:21 2004
From: marco at XSSNET.COM (Marco Benton)
Date: Thu Jan 12 21:27:41 2006
Subject: off topic:  email forwarding assistance/guidance needed
Message-ID: <mailman.5100.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

lester lasad wrote:

| <...snip...>
|
|
| I would like to explain my setup a little further.  I have one
| sendmail server that relays (does not deliver to local mail files
| on the server) to 2 seperate domains/hosts.  The MX record for both
| domains (abc.com and xyz.com) point to my one sendmail server (one
| ip).  With that said, do you see any problems (mail routing loops)
| using the virtusertable? for example, in the virtusertable I would
| put: lester@abc.com       lester@xyz.com
|
|> From my understanding that should relay the mail to
| the server hosting the xyz.com domain.  However, I still get mail
| routing loop errors.
|
| Thanks for your assistance


urr.  you mention it doesnt deliver mail to local users.  so where
does it deliver mail to?  from your description, mail will *have* to
be delivered locally as you have both domains pointed to that one
server...so it wouldnt make sense to have a virtusertable unless you
wanted to deliver the mail somewhere else, hence the loop errors.

it might be better to use /etc/mail/domaintable for what you are
doing, simple domain remapping.

- --

Marco Benton - BOFH, BSMFH
Network Consultant

BOFH excuse #133: The cause of the problem is: because of network lag
due to too many people playing deathmatch

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBpPF52+PYgoYkw8ERAvhNAKC1eVscCgipX4cyotCXdmDH+8dFjQCgpF5m
fVOr6c4BDK9tAp6LIlvFlLQ=
=WF+u
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From alex at nkpanama.com  Wed Nov 24 20:42:19 2004
From: alex at nkpanama.com (Alex Neuman van der Hans)
Date: Thu Jan 12 21:27:41 2006
Subject: [iso-8859-1] RE: [MAILSCANNER] Re: MailScanner won´t check
    filena[iso-8859-1] me size 
Message-ID: <mailman.5101.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Perhaps you should set archive depth to 0? 

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Dennis Robert Kelbert
Sent: Wednesday, November 24, 2004 3:41 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: [MAILSCANNER] Re: MailScanner won´t check filename size 

More explicit

---> MailScanner.conf
Maximum Attachment Size = 500Kb

---> Info about my file
ZIP FILE = test.zip  (100Kb)
INSIDE THIS ZIP = test.txt (1000Kb = 1Mb) We can see that Zip reducing 90%
about the original size.

---> Problem
When i send the email with 100Kb(test.zip).......


---> The Log, I had translated  here the Size informations
Attachment size check: 1000Kb > 500Kb (teste.sasa.txt) in 100Kb


It´s right that in the inside of my zip file I have 1Mb, but, dont make
sense to use this rule to check the size of inside zip files....
I really don´t want and don´t need to check the size of internal contents of
ZIP files.

What can i do?



Really Thanks for the peoples that help me and help others friends of us.








----- Original Message -----
From: "Michele Neylon :: Blacknight Solutions" 
<michele@BLACKNIGHTSOLUTIONS.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Wednesday, November 24, 2004 6:18 PM
Subject: RE: [MAILSCANNER] Re: MailScanner won´t check filename size


> Ok i had solved the problem..
> i don´t know that if i turn Virus scanner off, then  other
> checks don´t going to work...
>
>
> But I have other problem...  it´s about the size of an attach.
> The values are only to explain.
> When I turn Maximum Attachment Size = 204800 (200Kb)
> and send a file TEST.ZIP with 50Kb, but inside have a file
> with 500Kb, then the MailScanner match the size rule.
>
> I dont want that MailScanner look the size of inside ZIP files.
> That doesn´t make sense !
>
> If I ZIP some file, it´s just to make more small....

There is an FAQ and an MAQ
Please go and read them and also read:
http://www.catb.org/~esr/faqs/smart-questions.html

Before you post any more questions

We would love to help you but you are not giving us enough information.
Put in other terms... Could you be more vague?



Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
http://www.blacknight.ie/specialoffers.html

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

--------------------------------------------
Esta mensagem foi verificada pelo sistema de
antivírus e anti-spam.
Seti Segurança e Tecnologia na Internet
suporte@setinet.com.br



--------------------------------------------
Esta mensagem foi verificada pelo sistema de 
antivírus e anti-spam.
Seti Segurança e Tecnologia na Internet
suporte@setinet.com.br

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From richard at CROSSWIRED.CO.UK  Wed Nov 24 21:07:00 2004
From: richard at CROSSWIRED.CO.UK (Richard Curtis)
Date: Thu Jan 12 21:27:41 2006
Subject: Restarting sendmail after config change ?
Message-ID: <mailman.5102.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Well spotted.
Thanks.  I am going to go with using:

make -C /etc/mail
kill -HUP 'head -1 /var/run/sendmail.in.pid`

As this seems to work well - I just tested it out and everything went as I
expected.

Thanks everyone.

Rich

> Richard:
>
> Watch out!
> The previously posted example below looks to me like it overwrites your
> access file!
> A "fixed" version is here:
>
>> makemap hash /etc/mail/access.db < /etc/mail/access
>
>
>
> On RedHat systems all you would need to do is type:
> > cd /etc/mail
> > make access.db
> or
> > make virtusertable.db
>
> No "restart" is needed.
>
> If you're on a non-RedHat distro and there's no Makefile in the
> /etc/mail directory, here's mine.
>
>> # These could be used by sendmail, but are not part of the default
>> install.
>> # To use them you will have to generate your own sendmail.cf with
>> #  FEATURE('whatever')
>> #
>> POSSIBLE += $(shell test -f bitdomain     && echo bitdomain.db)
>> POSSIBLE += $(shell test -f uudomain      && echo uudomain.db)
>> POSSIBLE += $(shell test -f genericstable && echo genericstable.db)
>> POSSIBLE += $(shell test -f userdb        && echo userdb.db)
>> CFFILES   = sendmail.cf submit.cf
>>
>>
>> all: ${CFFILES} ${POSSIBLE} virtusertable.db access.db domaintable.db
>> mailertable.db
>>
>> userdb.db : userdb
>>         @makemap btree $@ < $<
>>
>> %.db : %
>>         @makemap hash $@ < $<
>>
>> %.cf : %.mc
>>         @if test -f /usr/share/sendmail-cf/m4/cf.m4; then \
>>                 mv -f $@ $@.bak; \
>>                 m4 $< > $@; \
>>         fi;
>>
>> clean:
>>         rm -f *.db *~
>
>
>
> -Bill
>
> James R. Stevens wrote:
>
>>Within RedHat you will use the MAKEMAP command to reload and database
>>into memory without restarting Sendmail/Mailscanner.
>>
>>Example:
>>Cli->makemap hash /etc/mail/access < /etc/mail/access
>>Would reload the access table after any changes. This would be based on
>>a hash database.
>>
>>Something similar would be used for the virtusertable depending on the
>>type of database.
>>
>>Hope that helps..
>>
>>-----Original Message-----
>>From: Chris Conn [mailto:cconn@ABACOM.COM]
>>Sent: Wednesday, November 24, 2004 12:41 PM
>>To: MAILSCANNER@JISCMAIL.AC.UK
>>Subject: Re: Restarting sendmail after config change ?
>>
>>Richard Curtis wrote:
>>
>>
>>>I am writing a script for adding hosted domains to our server.
>>>When I add a hosted domain, I need to add it to the sendmails
>>>
>>>
>>virtusertable
>>
>>
>>>and local-host-names.
>>>
>>>I have tried to use /etc/init.d/MailScanner reload but this does not
>>>rebuild
>>>the virtusertable.db file.
>>>
>>>What is the correct way to do this ?
>>>
>>>
>>>
>>on my redhats, I have a script that does this:
>>
>>make -C /etc/mail
>>kill -HUP `head -1 /var/run/sendmail.in.pid`
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>
>>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mkettler at EVI-INC.COM  Wed Nov 24 21:16:11 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:41 2006
Subject: [iso-8859-1] Re: MailScanner won´t check filename size 
Message-ID: <mailman.5103.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

At 03:10 PM 11/24/2004, Dennis Robert Kelbert wrote:
>But I have other problem...  it´s about the size of an attach.
>The values are only to explain.
>When I turn Maximum Attachment Size = 204800 (200Kb)
>and send a file TEST.ZIP with 50Kb, but inside have a file
>with 500Kb, then the MailScanner match the size rule.
>
>I dont want that MailScanner look the size of inside ZIP files.
>That doesn´t make sense !

Set your Maximum Archive Depth to 0.

This doesn't affect virus scanning, but does affect how deep MS will upack 
an archive in order to check filename, filetype and filesize rules.

This unfortunately also disables filename checking inside zipfiles, but 
quite frankly I don't see the value unless your network is a "severe 
lockdown" network where no executables are allowed to be brought in at all.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From suporte at SETINET.COM.BR  Wed Nov 24 21:39:59 2004
From: suporte at SETINET.COM.BR (Dennis Robert Kelbert)
Date: Thu Jan 12 21:27:41 2006
Subject: Size subject dont be "Dangerous Content"
Message-ID: <mailman.5104.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Today, all e-mails that have the size over my limit, don´t pass.
Then, a message go at place of the original message to the recipient,
with the Subject   --> {Dangerous Content} any subject <---
 
For Filename rules,  i have a unique Subject..   {Filename}
For Spam rules,  i have a unique Subject..  (Virus)
 
but, for size rules, i can´t find it..
 
 
The {Dangerous Content}, it´s for what block at all?
 
 
 
 

--------------------------------------------
Esta mensagem foi verificada pelo sistema de
anti-virus e anti-spam.
Seti Segurança e Tecnologia na Internet
suporte@setinet.com.br ------------------------ MailScanner list
------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From sevans at FOUNDATION.SDSU.EDU  Wed Nov 24 21:41:53 2004
From: sevans at FOUNDATION.SDSU.EDU (Steve Evans)
Date: Thu Jan 12 21:27:41 2006
Subject: OT:  Delete Old Email
Message-ID: <mailman.5105.1137101261.24926.mailscanner@lists.mailscanner.info>

Currently I send all spam to a local mailbox and then I retrieve them via
pop.  What I'd like to do is have a shell script delete mail over n
days.  Anyone know how to do this?  The only thing I could think of was
to roll the mbox file like you would logs.  But that seems messy if you
ever have to retrieve something via pop3.
 
Steve Evans
SDSU Foundation
 
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From mkettler at EVI-INC.COM  Wed Nov 24 22:17:05 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:41 2006
Subject: Size subject dont be "Dangerous Content"
Message-ID: <mailman.5106.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

At 04:39 PM 11/24/2004, Dennis Robert Kelbert wrote:
>Today, all e-mails that have the size over my limit, don´t pass.
>Then, a message go at place of the original message to the recipient,
>with the Subject   --> {Dangerous Content} any subject <---
>
>For Filename rules,  i have a unique Subject..   {Filename}
>For Spam rules,  i have a unique Subject..  (Virus)
>
>but, for size rules, i can´t find it..
>
>
>The {Dangerous Content}, it´s for what block at all?

Do yourself a favor. Take some time and read your MailScanner.conf file. 
The comments in the file explain what this is about. It actually explains 
most of the questions you've asked today.

This particular part is related to the settings in the section:

         # Removing/Logging dangerous or potentially offensive content

Relevant settings in the section:

Dangerous Content Scanning = yes
Allow Partial Messages = no
Allow External Message Bodies = no
Allow IFrame Tags = no
Find Phishing Fraud = no
Allow Form Tags = yes
Allow Object Codebase Tags = no
Allow WebBugs = disarm

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Kevin_Miller at CI.JUNEAU.AK.US  Wed Nov 24 22:47:31 2004
From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller)
Date: Thu Jan 12 21:27:41 2006
Subject: Restarting sendmail after config change ?
Message-ID: <mailman.5107.1137101261.24926.mailscanner@lists.mailscanner.info>

William Burns wrote:
> Richard:
>
> Watch out!
> The previously posted example below looks to me like it overwrites
> your access file!
> A "fixed" version is here:
>
>> makemap hash /etc/mail/access.db < /etc/mail/access

Oddly, "looks like" is the operative phrase.  It actually doesn't.  The
makemap program automatically appends the .db to the target so the command:

  makemap hash /etc/mail/access < /etc/mail/access

doesn't hose you, although I usually do it from w/in the /etc/mail dir using
"makemap hash access < access"

Never tried it, but doing "makemap hash /etc/mail/access.db <
/etc/mail/access" might result in access.db.db.  Or not. <g>

Happy turkey day everyone (well, everyone that participates anyway).  One
thing I'm thankful for is guys like JF and a great support group like this
list...

...Kevin
--
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Admin., Mail Admin.
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From paddy at PANICI.NET  Wed Nov 24 23:05:40 2004
From: paddy at PANICI.NET (paddy)
Date: Thu Jan 12 21:27:41 2006
Subject: salongreport from AlwaysLookedUpLast ? (Solved!)
Message-ID: <mailman.5108.1137101261.24926.mailscanner@lists.mailscanner.info>

On Wed, Nov 24, 2004 at 06:41:27PM +0000, paddy wrote:
> Hi Julian,
>
> I was trying this,
>
>   sub MyCustomFunction {
>   my $message = @_;
>     MailScanner::Log::InfoLog("MyCustomFunction: %s",$message->{salongreport});
>   }
>   (with the init, end and 1; too)
>

Apologies.  I seem to be developing a bad habit of posting before I've thought
properly about a problem.  The code in case it's of any interest:

  sub MyCustomFunction {
  my($message)= @_;

    my $spamreport = $message->{spamreport};
    $spamreport =~ s/\n/ /g;
    $spamreport =~ s/\t//g;

    MailScanner::Log::InfoLog("MyCustomFunction: %s",$spamreport);
  }

Regards,
Paddy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From smlists at shaw.ca  Thu Nov 25 01:47:54 2004
From: smlists at shaw.ca (Steve Mason)
Date: Thu Jan 12 21:27:41 2006
Subject: Slightly OT:Can  Sendmail or Postfix do this?
Message-ID: <mailman.5109.1137101261.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I'm currently running  MailScanner, SpamAssassin, and Postfix on a
Fedora Core 2 box, and all is great, mostly...

I have my own domain, and I'm also using Fetchmail to pop some other
externally hosted accounts. Users have IMAP clients and get their mail
from the Fedora box. Depending on the account, they SMTP back through
the Fedora box, or through the ISP mail server

The problem is that my Fedora box is on a dynamic (doesn't change often
though) IP address, and more and more hosts (including the Mailscanner
list server) don't want to talk to my mail server.
My domain's  DNS is hosted externally, with the MX record pointing to my
dynamic IP. I suspect that some mail servers either don't like the fact
that my server is in a dynamic IP range, or that the reverse lookups
don't match my domain name.
I don't mind hosting my domain externally (I do for web content) but I'd
still like to run a mail server here, with MailScanner.

So what I'd like to do is --  host my own domain mail externally, and
use Fetchmail to pop it to the Fedora box. That part is easy.
I'd also like outbound mail (from the mail clients , mostly Thunderbird
users) to send via my Fedora box, and relay to the different external
mail servers.

Can either Postfix, or Sendmail relay outgoing SMTP to different hosts
based on the from: field?
For example, my computer runs Thunderbird, and I have several mail
accounts.  me@mydomain.com me@myispdomain.ca and me@3rdpartymail.com
Depending on what account I'm sending from, I'd like my Fedora box to
send outbound mail either to  externalmailserver@mydomain.com or
mail.myisp.ca or smtp.3rdpartymail.com

If it were just one domain/server smarthost and masquerade as would
likely do it? But can I do this with the multiple domains/servers?

Thanks,

Steve

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Thu Nov 25 08:59:01 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:41 2006
Subject: MailScanner to version 4.35.11.1 - upgrade - Performance
    Problem
Message-ID: <mailman.5110.1137101261.24926.mailscanner@lists.mailscanner.info>

Hi

I always do one thing at a time - makes sure each step is good before I
go on to the next stage, rather than a big bang approach.

Anyway..

Are you running extra rules in the /etc/mail/spamassassin directory and
if so which ones...

Are you running any RBL's, again which ones. Also are you running a
local cachine nameserver to help with the RBL's/

To check whether Mailwatch (or the underlyinh mysql DB) is causing
problems comment out the 'Always Looked up last' line in
MailScanner.conf and see if the performance improves.

You may also have to re-tune the number of mailScanner children and
number of messages per batch with the new SpamAssassin as it's memory
requirements can be quite different - theres some work going on for
spamd processes that eat lots of RAM going on - yes I know MS doesn't
use spamd but it may have an impact.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Venkata Achanta wrote:
> We have a bunch of boxes running MS and we upgraded to MailScanner-4.35.11.1
> last night. The updates were all good but unfortunately all the incoming
> mail queues are unusually high,i mean they are just growing hour by hour
> and in the logs.The mail is flowing very slowly.
>
> I know there are many different factors that can influence the mail
> processing speed.but We were doing just great till this upgrade.
>
> Upgrades:
> Spamassassin to version 3.0.1
> MailScanner to version 4.35.11.1
>
> Another point to be noted is we just added mailwatch also during the
> upgrade,is that creating any delays in processing mail ?
>
> Any help/pointers would be greatly appreciated.
>
> Just out of curiosity,Any one else having the same issue ?
>
> Thanks,
>
> Venkata Achanta
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From f.rotondo at TESEO.IT  Thu Nov 25 09:15:04 2004
From: f.rotondo at TESEO.IT (Francesco Rotondo)
Date: Thu Jan 12 21:27:41 2006
Subject: Bug in too many attachments?
Message-ID: <mailman.5111.1137101261.24926.mailscanner@lists.mailscanner.info>

Hi all,
I'm running MS 4.35.11-1 and have the Maximum Attachments Per Message set
to the default value of 200. Yesterday a message has been quarantined
because it had Too many attachments but watching into the message I've
found that attachments were only 65. Has anyone else experienced this?
Regards


+----------------------------------------------------------+
| Dr. Francesco Rotondo         E-mail: f.rotondo@teseo.it |
+----------------------------------------------------------+
| Teseo Internet Provider, Srl                             |
| C.so A. De Gasperi, 344       Web: http://www.teseo.it   |
| 70125 - Bari                  Tel: +39(080)5036970       |
| Italy                         Fax: +39(080)5008672       |
+----------------------------------------------------------+

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From paddy at PANICI.NET  Thu Nov 25 09:25:12 2004
From: paddy at PANICI.NET (paddy)
Date: Thu Jan 12 21:27:41 2006
Subject: Bug in too many attachments?
Message-ID: <mailman.5112.1137101261.24926.mailscanner@lists.mailscanner.info>

On Thu, Nov 25, 2004 at 10:15:04AM +0100, Francesco Rotondo wrote:
> Hi all,
> I'm running MS 4.35.11-1 and have the Maximum Attachments Per Message set
> to the default value of 200. Yesterday a message has been quarantined
> because it had Too many attachments but watching into the message I've
> found that attachments were only 65. Has anyone else experienced this?
> Regards

Just a guess, but are some of those zips or whatever, so that the total
_when unpacked_ is greater than the limit.  There is/was a very similar
thread running.

Regards,
Paddy
--
Perl 6 will give you the big knob. -- Larry Wall

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From f.rotondo at TESEO.IT  Thu Nov 25 09:36:06 2004
From: f.rotondo at TESEO.IT (Francesco Rotondo)
Date: Thu Jan 12 21:27:41 2006
Subject: Bug in too many attachments?
Message-ID: <mailman.5113.1137101261.24926.mailscanner@lists.mailscanner.info>

At 10.25 25/11/2004, you wrote:
>On Thu, Nov 25, 2004 at 10:15:04AM +0100, Francesco Rotondo wrote:
> > Hi all,
> > I'm running MS 4.35.11-1 and have the Maximum Attachments Per Message set
> > to the default value of 200. Yesterday a message has been quarantined
> > because it had Too many attachments but watching into the message I've
> > found that attachments were only 65. Has anyone else experienced this?
> > Regards
>
>Just a guess, but are some of those zips or whatever, so that the total
>_when unpacked_ is greater than the limit.  There is/was a very similar
>thread running.
>
>Regards,
>Paddy

Thanks for pointing out that. I watched the message again but there are no
zip. Attachments are only doc, pdf, txt, xls and jpg.

Regards.


+----------------------------------------------------------+
| Dr. Francesco Rotondo         E-mail: f.rotondo@teseo.it |
+----------------------------------------------------------+
| Teseo Internet Provider, Srl                             |
| C.so A. De Gasperi, 344       Web: http://www.teseo.it   |
| 70125 - Bari                  Tel: +39(080)5036970       |
| Italy                         Fax: +39(080)5008672       |
+----------------------------------------------------------+

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From paddy at PANICI.NET  Thu Nov 25 09:46:28 2004
From: paddy at PANICI.NET (paddy)
Date: Thu Jan 12 21:27:42 2006
Subject: CustomFunction: WhiteListFutureSender
Message-ID: <mailman.5114.1137101261.24926.mailscanner@lists.mailscanner.info>

On Tue, Nov 23, 2004 at 11:46:00AM -0500, William Burns wrote:
>
> Mail sent from "long.name@address.com" AND "lname@address.com" is
> associated w/ a mailbox named "lname". I had to do a bunch of manual
> configs to get the outbound recip. address written to the right
> local-user database/file. That way, procmail could check one file for
> the "lname" user at delivery time.

I'm impressed.  I have a growing list of uses for a piece of code that
does a reasonable job of mapping email address to user and vice versa,
and I suspect I would find something very useable in webmin already,
but I've not got around to it yet.  For this CF I've just tried to
do the simplest thing possible.

For this kind of whitelisting it strikes me that the desired effect
need not stop at correspondent to correspondent.  Some organisations
might wish to have returns whitelisted to the whole of their domain,
and it might be possible to have domain to domain whitelisting,
if one could avoid whitelisting domains like hotmail.com ...
This is why I was thinking about hooking the whitelisting effect in
through spamassassin scores - so that these effects could be implemented
as functions, and the weightings for parameters found by trial and error.

Whether I'll ever get that far is another matter :)

Regards,
Paddy
--
Perl 6 will give you the big knob. -- Larry Wall

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From paddy at PANICI.NET  Thu Nov 25 10:19:45 2004
From: paddy at PANICI.NET (paddy)
Date: Thu Jan 12 21:27:42 2006
Subject: Bug in too many attachments?
Message-ID: <mailman.5115.1137101262.24926.mailscanner@lists.mailscanner.info>

On Thu, Nov 25, 2004 at 10:36:06AM +0100, Francesco Rotondo wrote:
> At 10.25 25/11/2004, you wrote:
> >On Thu, Nov 25, 2004 at 10:15:04AM +0100, Francesco Rotondo wrote:
> >> Hi all,
> >> I'm running MS 4.35.11-1 and have the Maximum Attachments Per Message set
> >> to the default value of 200. Yesterday a message has been quarantined
> >> because it had Too many attachments but watching into the message I've
> >> found that attachments were only 65. Has anyone else experienced this?
> >> Regards
> >
> >Just a guess, but are some of those zips or whatever, so that the total
> >_when unpacked_ is greater than the limit.  There is/was a very similar
> >thread running.
> >
> >Regards,
> >Paddy
>
> Thanks for pointing out that. I watched the message again but there are no
> zip. Attachments are only doc, pdf, txt, xls and jpg.

I suppose it was a bit much to hope for: such a behaviour wouldn't go unnoticed
long.  I've looked at the code, but the task getting rapidly beyond my
original hit'n'run motivation ;)  Still ...

As far as I can see, the decision is made in Message::Explode on the
condition:

        if ($maxparts>0 && MIME::Entity::MailScannerCounter()>=$maxparts)

I haven't read MIME:Entity, but I would be looking for one of two things here:
(1) get MailScanner to leave the temporary files behind,
(2) log the value it counts
I can't immediately see how to get (1), but (2) is as simple as altering line
1123 just below from

  MailScanner::Log::WarnLog("Too many attachments in %s", $this->{id});

to something like:

  MailScanner::Log::WarnLog("Too many attachments in %s %s", $this->{id}, MIME::Entity::MailScannerCounter());

or better still: adding a log line that you can then simply rem out later.

I hope. If you can call that function twice.  I'll go and try !

Regards,
Paddy

--
Perl 6 will give you the big knob. -- Larry Wall

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From paddy at PANICI.NET  Thu Nov 25 10:31:43 2004
From: paddy at PANICI.NET (paddy)
Date: Thu Jan 12 21:27:42 2006
Subject: Bug in too many attachments?
Message-ID: <mailman.5116.1137101262.24926.mailscanner@lists.mailscanner.info>

On Thu, Nov 25, 2004 at 10:19:45AM +0000, paddy wrote:
>
> I hope. If you can call that function twice.  I'll go and try !

Yeah, I seem to be getting away with that.  Count seems okay to me
in a simple test.  Interesting behaviour in the way it quarantines
the message:  I see a message file and one of the attachments.
The third of six (the first is inline).

Regards,
Paddy
--
Perl 6 will give you the big knob. -- Larry Wall

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From thorin at POLYNESIE-FR.COM  Thu Nov 25 10:28:45 2004
From: thorin at POLYNESIE-FR.COM (Eric)
Date: Thu Jan 12 21:27:42 2006
Subject: SpamScore: sssssssssss   ???
Message-ID: <mailman.5117.1137101262.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-15" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hello,

I have just installed MailScanner, this one seems well to function.
But when I look at the spamscore in the headings of malls, I see
sssssssssss

what this ? it's normal ?, I forgotten to modify some parameters ?



Thank you for your helps.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From m.sapsed at BANGOR.AC.UK  Thu Nov 25 10:25:09 2004
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:27:42 2006
Subject: Phishing Detection
Message-ID: <mailman.5118.1137101262.24926.mailscanner@lists.mailscanner.info>

Michael Baird wrote:
> Yes, I have 3 inbound MX's, receive 1000+ messages every 10 minutes
> each, I have not noticed any phish detections on any of them, been
> running for about 6 hours on 4.36.1. This is why I'm concerned something
> isn't working right with my config. I have filetype checking disabled,
> is this necessary for the phishing detection to work?

Simple test is to send yourself a message like the phishers send where
the URL in the text is different to the URL in the href=.

There's something about my system which means that Julian's phishing
code doesn't work either but we haven't been able to work out what yet.

Cheers,

Martin

--
Martin Sapsed            "I've got 8 little fingers and only 2 thumbs,
Microcomputer Support                      won't you leave me in peace
Information Services                        while I get the job done?"
University of Wales, Bangor             Chris Rea, "I'm working on it"

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From satya at BAINSDIGITAL.COM  Thu Nov 25 10:33:46 2004
From: satya at BAINSDIGITAL.COM (SatyaDev Sharma)
Date: Thu Jan 12 21:27:42 2006
Subject: SpamScore: sssssssssss   ???
Message-ID: <mailman.5119.1137101262.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-15" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

See ur config file.....u can set spem score indicate cher. Ex- "sss" shows
simply urs spam score is 3.
-Satya !
----- Original Message -----
From: "Eric" <thorin@POLYNESIE-FR.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Thursday, November 25, 2004 3:58 PM
Subject: SpamScore: sssssssssss ???


Hello,

I have just installed MailScanner, this one seems well to function.
But when I look at the spamscore in the headings of malls, I see
sssssssssss

what this ? it's normal ?, I forgotten to modify some parameters ?



Thank you for your helps.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

-------------------------------------------------------------
Scanned for viruses, spam and dangerous content by DefenderMX
-------------------------------------------------------------

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Thu Nov 25 10:47:17 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:42 2006
Subject: SpamScore: sssssssssss   ???
Message-ID: <mailman.5120.1137101262.24926.mailscanner@lists.mailscanner.info>

Eric wrote:
> Hello,
>
> I have just installed MailScanner, this one seems well to function.
> But when I look at the spamscore in the headings of malls, I see
> sssssssssss
>
> what this ? it's normal ?, I forgotten to modify some parameters ?
>
>
>
> Thank you for your helps.
Hi

in MailScanner.conf make sure the following is set - by default I think
its 'no'

SpamScore Number Instead Of Stars = yes

and you might to alter the following as well so you get decimals as part
of the score, rather than a plain integer..

Spam Score Number Format = %5.2f


--
Martin Hepworth
Senior Systems Administrator
Solid State Logic Ltd
tel: +44 (0)1865 842300


**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From misterpo at IFRANCE.COM  Thu Nov 25 10:50:51 2004
From: misterpo at IFRANCE.COM (Mister PO)
Date: Thu Jan 12 21:27:42 2006
Subject: Requeue messages
Message-ID: <mailman.5121.1137101262.24926.mailscanner@lists.mailscanner.info>

Hi,

Is it possible to set a message back to the MailScanner queue ?

I have pending outgoing messages in the postfix defered queue and I would
like MailScanner to analyze them again as I have made changes to my Spam
blacklist.

Thanks in advance,

PO.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From satya at BAINSDIGITAL.COM  Thu Nov 25 11:13:40 2004
From: satya at BAINSDIGITAL.COM (SatyaDev Sharma)
Date: Thu Jan 12 21:27:42 2006
Subject: Requeue messages
Message-ID: <mailman.5122.1137101262.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

u can move ur message from outgoing dir to incoming dir !
----- Original Message -----
From: "Mister PO" <misterpo@IFRANCE.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Thursday, November 25, 2004 4:20 PM
Subject: Requeue messages


> Hi,
>
> Is it possible to set a message back to the MailScanner queue ?
>
> I have pending outgoing messages in the postfix defered queue and I would
> like MailScanner to analyze them again as I have made changes to my Spam
> blacklist.
>
> Thanks in advance,
>
> PO.
>
> -------------------------------------------------------------
> Scanned for viruses, spam and dangerous content by DefenderMX
> -------------------------------------------------------------
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From f.rotondo at TESEO.IT  Thu Nov 25 11:15:27 2004
From: f.rotondo at TESEO.IT (Francesco Rotondo)
Date: Thu Jan 12 21:27:42 2006
Subject: Bug in too many attachments? [SOLVED]
Message-ID: <mailman.5123.1137101262.24926.mailscanner@lists.mailscanner.info>

At 10.36 25/11/2004, you wrote:
>At 10.25 25/11/2004, you wrote:
>>On Thu, Nov 25, 2004 at 10:15:04AM +0100, Francesco Rotondo wrote:
>> > Hi all,
>> > I'm running MS 4.35.11-1 and have the Maximum Attachments Per Message set
>> > to the default value of 200. Yesterday a message has been quarantined
>> > because it had Too many attachments but watching into the message I've
>> > found that attachments were only 65. Has anyone else experienced this?
>> > Regards
>>
>>Just a guess, but are some of those zips or whatever, so that the total
>>_when unpacked_ is greater than the limit.  There is/was a very similar
>>thread running.
>>
>>Regards,
>>Paddy
>
>Thanks for pointing out that. I watched the message again but there are no
>zip. Attachments are only doc, pdf, txt, xls and jpg.
>
>Regards.
I watched deeper in the message and discovered it had a lot of messages
forwarded as attachments inside. That explains why hitted the maximum
attachments setting. Thanks anyway for your help and sorry for the misview.

Regards.


+----------------------------------------------------------+
| Dr. Francesco Rotondo         E-mail: f.rotondo@teseo.it |
+----------------------------------------------------------+
| Teseo Internet Provider, Srl                             |
| C.so A. De Gasperi, 344       Web: http://www.teseo.it   |
| 70125 - Bari                  Tel: +39(080)5036970       |
| Italy                         Fax: +39(080)5008672       |
+----------------------------------------------------------+

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From paddy at PANICI.NET  Thu Nov 25 11:40:44 2004
From: paddy at PANICI.NET (paddy)
Date: Thu Jan 12 21:27:42 2006
Subject: Bug in too many attachments? [SOLVED]
Message-ID: <mailman.5124.1137101262.24926.mailscanner@lists.mailscanner.info>

On Thu, Nov 25, 2004 at 12:15:27PM +0100, Francesco Rotondo wrote:
> At 10.36 25/11/2004, you wrote:
> >At 10.25 25/11/2004, you wrote:
> >>On Thu, Nov 25, 2004 at 10:15:04AM +0100, Francesco Rotondo wrote:
> >>> Hi all,
> >>> I'm running MS 4.35.11-1 and have the Maximum Attachments Per Message
> >>set
> >>> to the default value of 200. Yesterday a message has been quarantined
> >>> because it had Too many attachments but watching into the message I've
> >>> found that attachments were only 65. Has anyone else experienced this?
> >>> Regards
> >>
> >>Just a guess, but are some of those zips or whatever, so that the total
> >>_when unpacked_ is greater than the limit.  There is/was a very similar
> >>thread running.
> >>
> >>Regards,
> >>Paddy
> >
> >Thanks for pointing out that. I watched the message again but there are no
> >zip. Attachments are only doc, pdf, txt, xls and jpg.
> >
> >Regards.
> I watched deeper in the message and discovered it had a lot of messages
> forwarded as attachments inside. That explains why hitted the maximum
> attachments setting. Thanks anyway for your help and sorry for the misview.

Funny enough, the one time I've seen this Limit hit was someone sending
their mailbox home from the office, each mail as an attachment.

Does the code explode attachments of attached messages ?  I wouldn't be
surprised ... that would be like the zip idea (only in the code, zips
are handled later).

Anyway, its been fun and I've learnt a bit more about this part of MailScanner.

Regards,
Paddy
--
Perl 6 will give you the big knob. -- Larry Wall

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From brendan.codykenny at REALEXPAYMENTS.COM  Thu Nov 25 11:51:22 2004
From: brendan.codykenny at REALEXPAYMENTS.COM (Brendan Cody-Kenny)
Date: Thu Jan 12 21:27:42 2006
Subject: mailscanner not calling spamassassin?
Message-ID: <mailman.5125.1137101262.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I remedied the line in spam.assassin.prefs.conf that was causing the
debug error line. The debug error message is not shown and the behavior
of MS/SA has not changed. The use of dcc will not help explain why MS is
not getting results from SA. If Sa called from the command line is
returning a value then the same value should be returned to MS. From the
results of strace on MS I could see that MS is calling the SA perl
scripts. They dont return proper values. Is there specific configuration
files for these scripts?

Michele Neylon :: Blacknight Solutions wrote:

>>Nov 24 13:12:47 uncledeadly MailScanner[28189]: Message
>>1CWtY9-0005JX-5v from xxxxxx (xxxxxx@xxxxxx.ie) to xxxxxx.com is not
>>spam, SpamAssassin (score=0, required 4.55) Nov 24 13:12:48
>>uncledeadly MailScanner[28189]: SpamAssassin
>>returned 0
>>
>>
>
>So it is doing something but giving you a 0 each time
>
>
>
>>debug: Failed to parse line in SpamAssassin configuration, skipping:
>>
>>
>
>That looks like it could be part of your problem
>
>
>
>>debug: DCCifd is not available: no r/w dccifd socket found.
>>debug: DCC is not available: no executable dccproc found.
>>
>>
>
>I'd recommend getting that working with it as well, as it does help a lot
>
>
>
>
>
>
>Mr Michele Neylon
>Blacknight Internet Solutions Ltd
>Hosting, co-location & domains
>http://www.blacknight.ie/
>Tel. +353 59 9137101
>http://www.blacknight.ie/specialoffers.html
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Thu Nov 25 12:01:05 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:42 2006
Subject: mailscanner not calling spamassassin?
Message-ID: <mailman.5126.1137101262.24926.mailscanner@lists.mailscanner.info>

Brendan Cody-Kenny wrote:

> I remedied the line in spam.assassin.prefs.conf that was causing the
> debug error line. The debug error message is not shown and the behavior
> of MS/SA has not changed. The use of dcc will not help explain why MS is
> not getting results from SA. If Sa called from the command line is
> returning a value then the same value should be returned to MS. From the
> results of strace on MS I could see that MS is calling the SA perl
> scripts. They dont return proper values. Is there specific configuration
> files for these scripts?
>
Brendan

are you callingthe spamassassin -D --lint as the user that MailScanner
is running as???

also have you tried turning on both debug options in the
MailScanner.conf and running check_mailscanner to see if it gives you
more clues??

--
--
Martin Hepworth
Senior Systems Administrator
Solid State Logic Ltd
tel: +44 (0)1865 842300


**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From anders.andersson at LTKALMAR.SE  Thu Nov 25 13:25:35 2004
From: anders.andersson at LTKALMAR.SE (Anders Andersson, IT)
Date: Thu Jan 12 21:27:42 2006
Subject: OT: strange AWL score
Message-ID: <mailman.5127.1137101262.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi
Our dear friends at Dell have got caught in the higscore action and after looking at the logfiles I noticed the they got a score between 9-13 on AWL. What I really want is to either reset the AWL och just delete it since I dont have it turned on. It was on for a while but I really didnt need it so I took it of but now I cant figure out what to do

/Anders


Anders Andersson
Landstinget i Kalmar län
IT-service
Hus 02, Plan 7
391 85 Kalmar

anders.andersson[remove]@ltkalmar.se

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From paddy at PANICI.NET  Thu Nov 25 13:36:41 2004
From: paddy at PANICI.NET (paddy)
Date: Thu Jan 12 21:27:42 2006
Subject: CustomFunction: ArchiveSAtimeout
Message-ID: <mailman.5128.1137101262.24926.mailscanner@lists.mailscanner.info>

Hi,

# ArchiveSAtimeout
#
# This is a custom function to archive any message which happens
# to be subject to an SA timeout.  It is probably not very useful.
#
#       IF YOU HAVE PROBLEMS WITH SA TIMEOUTS,
#   THIS IS PROBABLY **NOT** THE CODE YOU ARE LOOKING FOR ...
#
# Instead see previous discussions on the mailing list which
# will direct you towards _fruitful_ investigations: bayes,
# network timeouts, how to use Debug Spamassassin, big rules, etc.
#
# This code is derived from MailScanner, Copyright Julian Field.
# Licensed under the GNU General Public License v.2 or later.
#
# I, Paddy, can confidently lay claim to all the _faults_ herein.
# In particularly, note that this CF has not been extensively tested.
# There is no waranty: you get to keep the pieces.
# But feel free to email me.  Feedback & improvements especially welcome.
#
# paddy@panici.net 2004

package MailScanner::CustomConfig;

my $ASATsatimedout;

sub InitArchiveSAtimeout {
  $ASATsatimedout = MailScanner::Config::LanguageValue($message, 'satimedout');
  MailScanner::Log::InfoLog("InitArchiveSAtimeout: looking for '%s'",$ASATsatimedout);
}

sub EndArchiveSAtimeout {
  MailScanner::Log::InfoLog("EndArchiveSAtimeout");
}

sub ArchiveSAtimeout {
my($message)= @_;

  my $spamreport = $message->{spamreport};
  $spamreport =~ s/\n/ /g;
  $spamreport =~ s/\t//g;

  #MailScanner::Log::InfoLog("ArchiveSAtimeout: %s",$spamreport);

  if ($spamreport =~ /$ASATsatimedout/){
    StoreSAtimeout($message);
    my $id = $message->{id};
    MailScanner::Log::InfoLog("ArchiveSAtimeout: %s archived",$id);
  #}else{
  #  #do nothing
  #  my $id = $message->{id};
  #   MailScanner::Log::InfoLog("ArchiveSAtimeout: %s no action",$id);
  }
  return 0;
}

sub StoreSAtimeout {
my($message)= @_;

  my($dir, $dir2, $spamdir, $uid, $gid, $changeowner);
  $uid = $global::MS->{quar}->{uid};
  $gid = $global::MS->{quar}->{gid};
  $changeowner = $global::MS->{quar}->{changeowner};
  $dir = MailScanner::Config::Value('quarantinedir', $message);
  $dir2 = $dir . '/' .  MailScanner::Quarantine::TodayDir();
  $spamdir = $dir2 . '/' . 'satimeouts';
  umask $global::MS->{quar}->{dirumask};
  unless (-d $dir) {
    mkdir $dir, 0777;
    chown $uid, $gid, $dir if $changeowner;
  }
  unless (-d $dir2) {
    mkdir $dir2, 0777;
    chown $uid, $gid, $dir2 if $changeowner;
  }
  unless (-d $spamdir) {
  mkdir $spamdir, 0777;
    chown $uid, $gid, $spamdir if $changeowner;
  }
  #print STDERR "Storing spam to $spamdir/" . $message->{id} . "\n";
  #print STDERR "uid=$uid gid=$gid changeowner=$changeowner\n";
  umask $global::MS->{quar}->{fileumask};
  $message->{store}->CopyEntireMessage($message, $spamdir, $message->{id},
                                    $uid, $gid, $changeowner);
  chown $uid, $gid, "$spamdir/" . $message->{id}; # Harmless if this fails
}

1;

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From sanjay.patel at REXWIRE.COM  Thu Nov 25 14:55:14 2004
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:27:42 2006
Subject: MailScanner stopped processing Mail
Message-ID: <mailman.5129.1137101262.24926.mailscanner@lists.mailscanner.info>

As of 10:30 am yesterday MailScanner has stopped processing mail. We have
mail in both mqueue's. Last thing we see saw in MailWatch is that panda
antivirus detected a denial of service and started tagging all e-mail's as
viruses. We removed virus cleaning from MailScanner but still no luck mail
is coming in and getting queued. But not delivered either locally or to the
internet. Nothing gets logged in the database either.

If I stop MailScanner and run sendmail than mail works without a problem.

I cant figure out what is wrong. We are running MailScanner on Redhat Es3.

-SKP

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Glenn.Steen at AP1.SE  Thu Nov 25 16:02:01 2004
From: Glenn.Steen at AP1.SE (Steen, Glenn)
Date: Thu Jan 12 21:27:42 2006
Subject: OT: Delete Old Email
Message-ID: <mailman.5130.1137101262.24926.mailscanner@lists.mailscanner.info>

Hi Steve,

> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Steve Evans

> Currently I send all spam to a local mailbox and then I retrieve them
> via pop.  What I'd like to do is have a shell script delete mail over
> n days.  Anyone know how to do this?  The only thing I could think of
> was to roll the mbox file like you would logs.  But that seems messy
if
> you ever have to retrieve something via pop3.

Hm, why do you do that? Anything wrong with storing them (employing the
"forward to /dev/null to get virus scanning too" thing) so that your
problem becomes a simple shellscript to maintain the quarantine instead?

I'm sure one could cook something up with formail/procmail too, or use
a maildir-based MUA and some not to trivial script, but it'd be simpler
to
just use the quarantine instead of reinventing it in a "pop guise";-).

-- Glenn

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From marcel-ml at IRC-ADDICTS.DE  Thu Nov 25 16:01:39 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:42 2006
Subject: New release of Vispan
Message-ID: <mailman.5131.1137101262.24926.mailscanner@lists.mailscanner.info>

Hi there,


> I have just released Version 2 of Vispan. The major change in this
> version is to provide the ability to block the sending IP addresses
> using iptables at the firewall instead of the access file at the MTA
> level. The original functionality of blocking in the access file still
> remains - it is all conbfigurable from the config file.

just downloaded the latest release and i have to admit i am using it for
the first time.

In my MS-Conf i am using the following virus-tools:

Virus Scanners = clamav antivir f-prot bitdefender

and this is my entry with Vispan.conf:

Scanner = antivir clamav bitdefender f-prot mailscanner

But..if i click on config nothing about antivir is found..might be
correct..

but the virus-mail, which i am sending to my account and which is only
catched by antivir does not get into the vispan-report.

What should i do here?

Any Ideas?

Greetings

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Thu Nov 25 15:45:38 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:42 2006
Subject: MailScanner stopped processing Mail
Message-ID: <mailman.5132.1137101262.24926.mailscanner@lists.mailscanner.info>

Sanjay K. Patel wrote:

> As of 10:30 am yesterday MailScanner has stopped processing mail. We have
> mail in both mqueue's. Last thing we see saw in MailWatch is that panda
> antivirus detected a denial of service and started tagging all e-mail's as
> viruses. We removed virus cleaning from MailScanner but still no luck mail
> is coming in and getting queued. But not delivered either locally or to the
> internet. Nothing gets logged in the database either.
>
> If I stop MailScanner and run sendmail than mail works without a problem.
>
> I cant figure out what is wrong. We are running MailScanner on Redhat Es3.
>
> -SKP
>
>
Sanjay

anything in the maillogs?

what happens if you enable both debugs in the MailScanner.conf and run
checkmailscanner?

--
Martin Hepworth
Senior Systems Administrator
Solid State Logic Ltd
tel: +44 (0)1865 842300


**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mike at TC3NET.COM  Thu Nov 25 15:20:53 2004
From: mike at TC3NET.COM (Michael Baird)
Date: Thu Jan 12 21:27:42 2006
Subject: Phishing Detection
Message-ID: <mailman.5133.1137101262.24926.mailscanner@lists.mailscanner.info>

On Thu, 2004-11-25 at 10:25 +0000, Martin Sapsed wrote:
> Michael Baird wrote:
> > Yes, I have 3 inbound MX's, receive 1000+ messages every 10 minutes
> > each, I have not noticed any phish detections on any of them, been
> > running for about 6 hours on 4.36.1. This is why I'm concerned something
> > isn't working right with my config. I have filetype checking disabled,
> > is this necessary for the phishing detection to work?
>
> Simple test is to send yourself a message like the phishers send where
> the URL in the text is different to the URL in the href=.
>
> There's something about my system which means that Julian's phishing
> code doesn't work either but we haven't been able to work out what yet.
>
> Cheers,
>
> Martin

Oh, it definitely doesn't work, I've received a few since I posted that
message. I've made sure all the source rpms were compiled and installed
properly. I think my next step will be to go to generic source package
and reinstall, since this is the first time I've used the
Redhat/Mandrake specific package (previously it failed under Mandrake).

Regards
MIKE

> --
> Martin Sapsed            "I've got 8 little fingers and only 2 thumbs,
> Microcomputer Support                      won't you leave me in peace
> Information Services                        while I get the job done?"
> University of Wales, Bangor             Chris Rea, "I'm working on it"
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
--
Michael Baird <mike@tc3net.com>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From brendan.codykenny at REALEXPAYMENTS.COM  Thu Nov 25 17:09:01 2004
From: brendan.codykenny at REALEXPAYMENTS.COM (Brendan Cody-Kenny)
Date: Thu Jan 12 21:27:42 2006
Subject: mailscanner not calling spamassassin?
Message-ID: <mailman.5134.1137101262.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

spamassassin -D --lint does not return anything interesting when run as
the mailscanner user.
both debugs are turned on in MailScanner.conf and check_mailscanner returns:

MailScanner running with pid 21667


I cannot figure out what the problem is so I am now trying to add in a
third mail directory queue. so mailscanner dumps the mail into this
"middle" queue, and then i run a cron job to run spamassassin on the
mail and dump it into the "out" queue. This is awkward and i am not sure
what format that mailscanner is expecting the mail in. the mail dumped
into the "in" queue consists of two files, a header and data file
(ending in -H and -D respectively). I am sure spamassassin is expecting
the mail in one single message. could this have anything to do with my
problem?


Martin Hepworth wrote:

> Brendan Cody-Kenny wrote:
>
>> I remedied the line in spam.assassin.prefs.conf that was causing the
>> debug error line. The debug error message is not shown and the behavior
>> of MS/SA has not changed. The use of dcc will not help explain why MS is
>> not getting results from SA. If Sa called from the command line is
>> returning a value then the same value should be returned to MS. From the
>> results of strace on MS I could see that MS is calling the SA perl
>> scripts. They dont return proper values. Is there specific configuration
>> files for these scripts?
>>
> Brendan
>
> are you callingthe spamassassin -D --lint as the user that MailScanner
> is running as???
>
> also have you tried turning on both debug options in the
> MailScanner.conf and running check_mailscanner to see if it gives you
> more clues??
>
> --
> --
> Martin Hepworth
> Senior Systems Administrator
> Solid State Logic Ltd
> tel: +44 (0)1865 842300
>
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From William.Burns at AEROFLEX.COM  Thu Nov 25 17:00:27 2004
From: William.Burns at AEROFLEX.COM (William Burns)
Date: Thu Jan 12 21:27:42 2006
Subject: CustomFunction: WhiteListFutureSender
Message-ID: <mailman.5135.1137101262.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

paddy wrote:

>On Tue, Nov 23, 2004 at 11:46:00AM -0500, William Burns wrote:
>
>
>>Mail sent from "long.name@address.com" AND "lname@address.com" is
>>associated w/ a mailbox named "lname". I had to do a bunch of manual
>>configs to get the outbound recip. address written to the right
>>local-user database/file. That way, procmail could check one file for
>>the "lname" user at delivery time.
>>
>>
>
>I'm impressed.  I have a growing list of uses for a piece of code that
>does a reasonable job of mapping email address to user and vice versa,
>and I suspect I would find something very useable in webmin already,
>but I've not got around to it yet.  For this CF I've just tried to
>do the simplest thing possible.
>
>
You mean mapping aliases to a single user, or a user to all his
correspondants?

Assuming that aliases aren't a problem, and finding correspondants is
the problem....
Parsing log files would have been nearly as effective as the technique
that I used.
My only advantage was that an address was harvested immediately, so that
if I sent a message out to a new recipient, and they replied
immediately, their address would have been in my whitelist already.
(I'm assuming that webmin would be parsing log files)

As for finding aliases, that mainly means combing the config files,
databases, maps, etc, that an MTA uses for routing and delivering local
mail.
 From the point of view of a gateway w/ no access to these files, I'm
not sure how the alias problem could be "100%" solved, or that this
problem even needs to be solved.

>For this kind of whitelisting it strikes me that the desired effect
>need not stop at correspondent to correspondent.  Some organisations
>might wish to have returns whitelisted to the whole of their domain,
>and it might be possible to have domain to domain whitelisting,
>if one could avoid whitelisting domains like hotmail.com ...
>This is why I was thinking about hooking the whitelisting effect in
>through spamassassin scores - so that these effects could be implemented
>as functions, and the weightings for parameters found by trial and error.
>
>Whether I'll ever get that far is another matter :)
>
>

You're looking to get spamassasin doing domain-to-domain whitelisting
based on historic spam scores?
Interesting... I did that w/ more manual configs. (key vendors,
customers, etc.)

W/ domains like yahoo, I've had the problem of legit. mailing lists,
where the "from" address is not consistent.
To deal w/ this, I gave users the ability to whitelist e-mail address
"suffixes". That way, in the most common case where a number is
pre-pended to an otherwise consistent address, the user can still get
this mail whitelisted.
On the other hand, users find having to manually use a seperate
"suffix"  feature to be tedious. Usage has been low.

-Bill

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Thu Nov 25 17:14:24 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:42 2006
Subject: mailscanner not calling spamassassin?
Message-ID: <mailman.5136.1137101262.24926.mailscanner@lists.mailscanner.info>

Brendon


sorry need to be more specific....

stop MailScanner

edit the MailScanner.conf

run check_mailscanner

you'll get a nice dump of what it's trying to so with each
message...preferable run check_mailscanner as the mailscanner user so
all permissions are consistent...

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Brendan Cody-Kenny wrote:
> spamassassin -D --lint does not return anything interesting when run as
> the mailscanner user.
> both debugs are turned on in MailScanner.conf and check_mailscanner
> returns:
>
> MailScanner running with pid 21667
>
>
> I cannot figure out what the problem is so I am now trying to add in a
> third mail directory queue. so mailscanner dumps the mail into this
> "middle" queue, and then i run a cron job to run spamassassin on the
> mail and dump it into the "out" queue. This is awkward and i am not sure
> what format that mailscanner is expecting the mail in. the mail dumped
> into the "in" queue consists of two files, a header and data file
> (ending in -H and -D respectively). I am sure spamassassin is expecting
> the mail in one single message. could this have anything to do with my
> problem?
>
>
> Martin Hepworth wrote:
>
>> Brendan Cody-Kenny wrote:
>>
>>> I remedied the line in spam.assassin.prefs.conf that was causing the
>>> debug error line. The debug error message is not shown and the behavior
>>> of MS/SA has not changed. The use of dcc will not help explain why MS is
>>> not getting results from SA. If Sa called from the command line is
>>> returning a value then the same value should be returned to MS. From the
>>> results of strace on MS I could see that MS is calling the SA perl
>>> scripts. They dont return proper values. Is there specific configuration
>>> files for these scripts?
>>>
>> Brendan
>>
>> are you callingthe spamassassin -D --lint as the user that MailScanner
>> is running as???
>>
>> also have you tried turning on both debug options in the
>> MailScanner.conf and running check_mailscanner to see if it gives you
>> more clues??
>>
>> --
>> --
>> Martin Hepworth
>> Senior Systems Administrator
>> Solid State Logic Ltd
>> tel: +44 (0)1865 842300
>>
>>
>> **********************************************************************
>>
>> This email and any files transmitted with it are confidential and
>> intended solely for the use of the individual or entity to whom they
>> are addressed. If you have received this email in error please notify
>> the system manager.
>>
>> This footnote confirms that this email message has been swept
>> for the presence of computer viruses and is believed to be clean.
>>
>> **********************************************************************
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>> Support MailScanner development - buy the book off the website!
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From paddy at PANICI.NET  Thu Nov 25 19:04:11 2004
From: paddy at PANICI.NET (paddy)
Date: Thu Jan 12 21:27:42 2006
Subject: CustomFunction: WhiteListFutureSender
Message-ID: <mailman.5137.1137101262.24926.mailscanner@lists.mailscanner.info>

On Thu, Nov 25, 2004 at 12:00:27PM -0500, William Burns wrote:
> paddy wrote:
>
> >On Tue, Nov 23, 2004 at 11:46:00AM -0500, William Burns wrote:
> >
> >
> >>Mail sent from "long.name@address.com" AND "lname@address.com" is
> >>associated w/ a mailbox named "lname". I had to do a bunch of manual
> >>configs to get the outbound recip. address written to the right
> >>local-user database/file. That way, procmail could check one file for
> >>the "lname" user at delivery time.
> >>
> >>
> >
> >I'm impressed.  I have a growing list of uses for a piece of code that
> >does a reasonable job of mapping email address to user and vice versa,
> >and I suspect I would find something very useable in webmin already,
> >but I've not got around to it yet.  For this CF I've just tried to
> >do the simplest thing possible.
> >
> >
> You mean mapping aliases to a single user, or a user to all his
> correspondants?

mapping aliases to a single user, and vice versa.

I have no interest in mapping correspondant to correspondant except the
present case in hand (which is a 'real-time' requirement).

> As for finding aliases, that mainly means combing the config files,
> databases, maps, etc, that an MTA uses for routing and delivering local
> mail.

Yeah, exactly.  I'm about to dig through that part of webmin on a related
mission.  Judging from the webmin philosophy, and what I've already seen
in the interface, I'm hoping to find the code I'm after, already made.

> From the point of view of a gateway w/ no access to these files, I'm
> not sure how the alias problem could be "100%" solved, or that this
> problem even needs to be solved.

Different problem, and not one I'm looking to solve immediately.
I would look towards LDAP.

> >For this kind of whitelisting it strikes me that the desired effect
> >need not stop at correspondent to correspondent.  Some organisations
> >might wish to have returns whitelisted to the whole of their domain,
> >and it might be possible to have domain to domain whitelisting,
> >if one could avoid whitelisting domains like hotmail.com ...
> >This is why I was thinking about hooking the whitelisting effect in
> >through spamassassin scores - so that these effects could be implemented
> >as functions, and the weightings for parameters found by trial and error.
> >
> >Whether I'll ever get that far is another matter :)
>
> You're looking to get spamassasin doing domain-to-domain whitelisting
> based on historic spam scores?
> Interesting... I did that w/ more manual configs. (key vendors,
> customers, etc.)

I didn't want to mention it my original posting as I didn't want the
smell of vapourware detracting from the fragrance of fresh cut code :)

I am quite enthusiastic about the idea, but if I reflect soberly for a
moment I must say that I don't know if it would improve much on a well-run
bayes system.  All it does really is change the weight given to specific
factors in the light of knowledge which (as far as I can think) the bayes
system wouldn't usually give special weight to.

> W/ domains like yahoo, I've had the problem of legit. mailing lists,
> where the "from" address is not consistent.

This is where the idea starts from - there is no reliable way to detect
all replies (other than whitelisting everything!)

> To deal w/ this, I gave users the ability to whitelist e-mail address
> "suffixes". That way, in the most common case where a number is
> pre-pended to an otherwise consistent address, the user can still get
> this mail whitelisted.

Yeah the mailscanner config language is pretty powerful, incorporating
regexes which will easily cover this requirement. But I don't immediately
imagine automating this solution for WLFS by a list of exceptions, so
much as by incorporating some fuzziness in the address matching.

> On the other hand, users find having to manually use a seperate
> "suffix"  feature to be tedious. Usage has been low.

Yeah, I've come to the conclusion that the user-interface is a critical
component of any mail filtering system.

Regards,
Paddy
--
Perl 6 will give you the big knob. -- Larry Wall

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From richard.bourque at MELLOUL.COM  Thu Nov 25 19:56:27 2004
From: richard.bourque at MELLOUL.COM (Richard Bourque)
Date: Thu Jan 12 21:27:42 2006
Subject: Allow Password-Protected Archives = no isn't working anymore
Message-ID: <mailman.5138.1137101262.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

For some reason password protected rar archives are getting through even
though I'm using 'Allow Password-Protected Archives = no'  Any ideas why?

MailScanner-4.35.11-1

RAR 3.41 (registered)

MailScanner-perl-MIME-Base64-3.05-4

NOD32 2.01
--Signatures version 1.932 (20041124) from 24-11-2004

F-Prot 4.4.7-1
--SIGN.DEF created 24 November 2004
--SIGN2.DEF created 24 November 2004
--MACRO.DEF created 22 November 2004

ClamAV 0.80
--Known viruses: 27530


--
This message has been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From peter at UCGBOOK.COM  Thu Nov 25 21:30:28 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:42 2006
Subject: Allow Password-Protected Archives = no isn't working anymore
Message-ID: <mailman.5139.1137101262.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Richard Bourque wrote:
> For some reason password protected rar archives are getting through even
> though I'm using 'Allow Password-Protected Archives = no'  Any ideas why?

Please read the comments before asking questions.

# Should archives which contain any password-protected files be allowed?
# Leaving this set to "no" is a good way of protecting against all the
# protected zip files used by viruses at the moment.
             ^^^
# This can also be the filename of a ruleset.
Allow Password-Protected Archives = no

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Q.G.Campbell at NEWCASTLE.AC.UK  Fri Nov 26 08:50:19 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:42 2006
Subject: FW: Phishing filter faulty?
Message-ID: <mailman.5140.1137101262.24926.mailscanner@lists.mailscanner.info>

Julian

Please see below an example of a hypertext link that the phishing net
should have been able to ignore.

The fact that the warning appears three times suggests that the HTML is
badly formed.

Quentin 
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own." 

>-----Original Message-----
>From: dti@rslive.co.uk [mailto:dti@rslive.co.uk]
>Sent: 25 November 2004 16:18
>To: xxx@ncl.ac.uk
>Subject: Technology Programme: Third Competition for funding - 
>Regional Information Days
>
>
>Technology Programme: Third competition for funding - Regional 
>Information Days
>
>Friday December 10th, Jury's Hotel, Newcastle upon Tyne
>
>The DTI, in collaboration with One NorthEast, the Regional 
>Development Agency for the North East of England, invite you to 
>attend our regional information road show. This follows the 
>announcement of the third competition for funding proposals on 
>Monday, 29th November 2004, at the Business Design Centre, 
>Islington, London.
>
>The road show is designed to promote awareness of the national 
>Technology Programme and showcase innovation in the region. These 
>Regional events will provide delegates with opportunities for 
>discussion and networking in different parts of the country.
>
>A DTI spokesperson will open events, co-hosted by regional industry 
>champions, and a Regional Development Agency representative will 
>share their views about the benefits funding will bring to the 
>region. The road shows will also provide a wonderful opportunity to 
>meet with industry peers, academics, and project financiers 
>including the DTI.
>
>The objective of this competition is to promote applied business 
>orientated research in key technology areas. The technology areas 
>will be announced shortly before the event but will focus on 
>addressing major challenges confronting UK business and society such 
>as; healthcare in an ageing society; an intelligent & connected 
>world and sustainable production and consumption.
>
>For further information on the event and to register please 
><https://secure.symphonyem.co.uk/dti2/default.asp?id=7>click here.
>
>To unsubscribe, email: <mailto:DTI@rslive.co.uk?subject=unsubscribe>
>
>The Newcastle MailScanner has detected a possible 'phishing fraud' 
>attempt because there is a difference between the actual link 
>"dti@rslive.co.uk" and what it claims to be
>
>The Newcastle MailScanner has detected a possible 'phishing fraud' 
>attempt because there is a difference between the actual link 
>"dti@rslive.co.uk" and what it claims to be
>
>The Newcastle MailScanner has detected a possible 'phishing fraud' 
>attempt because there is a difference between the actual link 
>"dti@rslive.co.uk" and what it claims to be 
>DTI@rslive.co.uk?subject=unsubscribe
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From David.While at UCE.AC.UK  Fri Nov 26 09:29:34 2004
From: David.While at UCE.AC.UK (David While)
Date: Thu Jan 12 21:27:42 2006
Subject: New release of Vispan
Message-ID: <mailman.5141.1137101262.24926.mailscanner@lists.mailscanner.info>

The reason AntiVir doesn't appear in the config page is that it isn't
configured to do so. I only have access to a limited number of virus
scanners. If you can provide me with the command line option to print
out the version information (usually -v or -info) and what it actually
prints - I will add in the support.

Regarding the virus not being reported - can you provide a sample of the
log entry generated by MailScanner when the virus is detected - it is
possible that AntiVir have changed the logging information string.
--------------------------------------------
David While BSc CEng MBCS CITP
Technical Development Manager
School of Computing & Information
University of Central England
Tel: 0121 331 6211
-------------------------------------------- 

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Marcel Blenkers
Sent: 25 November 2004 16:02
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: New release of Vispan

Hi there,


> I have just released Version 2 of Vispan. The major change in this
> version is to provide the ability to block the sending IP addresses
> using iptables at the firewall instead of the access file at the MTA
> level. The original functionality of blocking in the access file still
> remains - it is all conbfigurable from the config file.

just downloaded the latest release and i have to admit i am using it for
the first time.

In my MS-Conf i am using the following virus-tools:

Virus Scanners = clamav antivir f-prot bitdefender

and this is my entry with Vispan.conf:

Scanner = antivir clamav bitdefender f-prot mailscanner

But..if i click on config nothing about antivir is found..might be
correct..

but the virus-mail, which i am sending to my account and which is only
catched by antivir does not get into the vispan-report.

What should i do here?

Any Ideas?

Greetings

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From David.While at UCE.AC.UK  Fri Nov 26 09:32:10 2004
From: David.While at UCE.AC.UK (David While)
Date: Thu Jan 12 21:27:42 2006
Subject: OT: Delete Old Email
Message-ID: <mailman.5142.1137101262.24926.mailscanner@lists.mailscanner.info>

Are you looking for something like archmbox? See
http://adc-archmbox.sourceforge.net/

This allows you to delete messages from mailboxes based on certain
criteria. I use it to remove any messages over 30 days old from people's
mailboxes as they should have downloaded them by then.
--------------------------------------------
David While BSc CEng MBCS CITP
Technical Development Manager
School of Computing & Information
University of Central England
Tel: 0121 331 6211
-------------------------------------------- 

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Steen, Glenn
Sent: 25 November 2004 16:02
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: OT: Delete Old Email

Hi Steve,

> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Steve Evans

> Currently I send all spam to a local mailbox and then I retrieve them
> via pop.  What I'd like to do is have a shell script delete mail over
> n days.  Anyone know how to do this?  The only thing I could think of
> was to roll the mbox file like you would logs.  But that seems messy
if
> you ever have to retrieve something via pop3.

Hm, why do you do that? Anything wrong with storing them (employing the
"forward to /dev/null to get virus scanning too" thing) so that your
problem becomes a simple shellscript to maintain the quarantine instead?

I'm sure one could cook something up with formail/procmail too, or use
a maildir-based MUA and some not to trivial script, but it'd be simpler
to
just use the quarantine instead of reinventing it in a "pop guise";-).

-- Glenn

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From brendan.codykenny at REALEXPAYMENTS.COM  Fri Nov 26 12:02:59 2004
From: brendan.codykenny at REALEXPAYMENTS.COM (Brendan Cody-Kenny)
Date: Thu Jan 12 21:27:42 2006
Subject: mailscanner not calling spamassassin?
Message-ID: <mailman.5143.1137101262.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

ok heres what it gave me:
Its confusing as it seems to be running the learner before it checks the
message. it then continues to check each part of the message and give it
avalue of 0. Then spamassassin has a problem locking the bayes db. it
looks like its doing everything in the wrong order.

Starting MailScanner...
In Debugging mode, not forking...
debug: Score set 0 chosen.
debug: running in taint mode? no
SA bayes lock is /var/lib/MailScanner/bayes.lock
Bayes lock is at /var/lib/MailScanner/bayes.lock
debug: ignore: test message to precompile patterns and load modules
debug: using "/etc/MailScanner/rules" for default rules dir
debug: using "/etc/MailScanner/rules" for site rules dir
debug: using "/etc/MailScanner/spam.assassin.prefs.conf" for user prefs file
debug: bayes: 1117 tie-ing to DB file R/O
/var/lib/MailScanner/bayes/bayes_toks
debug: bayes: 1117 tie-ing to DB file R/O
/var/lib/MailScanner/bayes/bayes_seen
debug: bayes: found bayes db version 2
debug: Score set 3 chosen.
debug: Initialising learner
debug: running header regexp tests; score so far=0
debug: running body-text per-line regexp tests; score so far=0
debug: running raw-body-text per-line regexp tests; score so far=0
debug: running uri tests; score so far=0
debug: uri tests: Done uriRE
debug: running full-text regexp tests; score so far=0
debug: running meta tests; score so far=0
debug: is spam? score=0 required=3.75 tests=
SpamAssassin: oops! still tied/locked to bayes DBs, untie'ing
debug: bayes: 1117 untie-ing
debug: bayes: 1117 untie-ing db_toks
debug: bayes: 1117 untie-ing db_seen
debug: received-header: parsed as [ ip=67.15.36.4
rdns=server21.fastbighost.com helo=server21.fastbighost.com
by=scruffy.realex.ie ident= ]
debug: is Net::DNS::Resolver available? no
debug: is DNS available? 0
debug: received-header: cannot use DNS, do not trust any hosts from here on
debug: received-header: relay 67.15.36.4 trusted? no
debug: running header regexp tests; score so far=0
debug: running body-text per-line regexp tests; score so far=0
debug: running raw-body-text per-line regexp tests; score so far=0
debug: running uri tests; score so far=0
debug: uri tests: Done uriRE
debug: running full-text regexp tests; score so far=0
debug: running meta tests; score so far=0
debug: is spam? score=0 required=3.75 tests=
debug: received-header: parsed as [ ip=195.245.230.131
rdns=mail78.messagelabs.com helo=mail78.messagelabs.com
by=scruffy.realex.ie ident= ]
debug: received-header: parsed as [ ip=194.69.198.39 rdns=efwdb01.aib.ie
helo= by=server-6.tower-78.messagelabs.com ident= ]
debug: is Net::DNS::Resolver available? no
debug: is DNS available? 0
debug: received-header: parsed as [ ip=10.8.22.86 rdns= helo=
by=efwdb01.aib.ie ident= ]
debug: received-header: parsed as [ ip=10.32.4.76 rdns=b11127-gx270
helo= by=sims.isec.aib.ie ident= ]
debug: received-header: cannot use DNS, do not trust any hosts from here on
debug: received-header: relay 195.245.230.131 trusted? no
debug: received-header: relay 194.69.198.39 trusted? no
debug: received-header: relay 10.8.22.86 trusted? no
debug: received-header: relay 10.32.4.76 trusted? no
debug: running header regexp tests; score so far=0
debug: running body-text per-line regexp tests; score so far=0
debug: running raw-body-text per-line regexp tests; score so far=0
debug: running uri tests; score so far=0
debug: uri tests: Done uriRE
debug: running full-text regexp tests; score so far=0
debug: running meta tests; score so far=0
debug: is spam? score=0 required=3.75 tests=
debug: received-header: parsed as [ ip=161.58.229.253
rdns=newsvendor.com helo=newsvendor.com by=scruffy.realex.ie ident= ]
debug: received-header: parsed as [ ip=193.203.152.4
rdns=B-152-4.cust.iol.ie helo=webccssmtp.ccs.ie by=newsvendor.com ident= ]
debug: is Net::DNS::Resolver available? no
debug: is DNS available? 0
debug: received-header: parsed as [ ip=223.0.1.127 rdns= helo=Tonylaptop
by=webccssmtp.ccs.ie ident= ]
debug: received-header: cannot use DNS, do not trust any hosts from here on
debug: received-header: relay 161.58.229.253 trusted? no
debug: received-header: relay 193.203.152.4 trusted? no
debug: received-header: relay 223.0.1.127 trusted? no
debug: running header regexp tests; score so far=0
debug: running body-text per-line regexp tests; score so far=0
debug: running raw-body-text per-line regexp tests; score so far=0
debug: running uri tests; score so far=0
debug: uri tests: Done uriRE
debug: running full-text regexp tests; score so far=0
debug: running meta tests; score so far=0
debug: is spam? score=0 required=3.75 tests=
/etc/MailScanner/wrapper/trend-wrapper: /pack/trend/bin/vscan: No such
file or directory
/etc/MailScanner/wrapper/trend-wrapper: exec: /pack/trend/bin/vscan:
cannot execute: No such file or directory
Stopping now as you are debugging me.

Brendan Cody-Kenny | brendan.codykenny@realexpayments.com
Network Administrator
Realex Payments

The Forum, 29-32 Glasthule Rd, Glasthule, Co Dublin, Ireland
t: +353 1 2808559 | f: +353 1 2808538

This mail and any documents attached are classified as confidential and are intended for use by the addressee(s) only unless otherwise indicated. If you are not an intended recipient of this email, you must not use, disclose, copy, distribute or retain this message or any part of it. If you have received this email in error, please notify us immediately and delete all copies of this email from your computer system(s).



Martin Hepworth wrote:

> Brendon
>
>
> sorry need to be more specific....
>
> stop MailScanner
>
> edit the MailScanner.conf
>
> run check_mailscanner
>
> you'll get a nice dump of what it's trying to so with each
> message...preferable run check_mailscanner as the mailscanner user so
> all permissions are consistent...
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Brendan Cody-Kenny wrote:
>
>> spamassassin -D --lint does not return anything interesting when run as
>> the mailscanner user.
>> both debugs are turned on in MailScanner.conf and check_mailscanner
>> returns:
>>
>> MailScanner running with pid 21667
>>
>>
>> I cannot figure out what the problem is so I am now trying to add in a
>> third mail directory queue. so mailscanner dumps the mail into this
>> "middle" queue, and then i run a cron job to run spamassassin on the
>> mail and dump it into the "out" queue. This is awkward and i am not sure
>> what format that mailscanner is expecting the mail in. the mail dumped
>> into the "in" queue consists of two files, a header and data file
>> (ending in -H and -D respectively). I am sure spamassassin is expecting
>> the mail in one single message. could this have anything to do with my
>> problem?
>>
>>
>> Martin Hepworth wrote:
>>
>>> Brendan Cody-Kenny wrote:
>>>
>>>> I remedied the line in spam.assassin.prefs.conf that was causing the
>>>> debug error line. The debug error message is not shown and the
>>>> behavior
>>>> of MS/SA has not changed. The use of dcc will not help explain why
>>>> MS is
>>>> not getting results from SA. If Sa called from the command line is
>>>> returning a value then the same value should be returned to MS.
>>>> From the
>>>> results of strace on MS I could see that MS is calling the SA perl
>>>> scripts. They dont return proper values. Is there specific
>>>> configuration
>>>> files for these scripts?
>>>>
>>> Brendan
>>>
>>> are you callingthe spamassassin -D --lint as the user that MailScanner
>>> is running as???
>>>
>>> also have you tried turning on both debug options in the
>>> MailScanner.conf and running check_mailscanner to see if it gives you
>>> more clues??
>>>
>>> --
>>> --
>>> Martin Hepworth
>>> Senior Systems Administrator
>>> Solid State Logic Ltd
>>> tel: +44 (0)1865 842300
>>>
>>>
>>> **********************************************************************
>>>
>>> This email and any files transmitted with it are confidential and
>>> intended solely for the use of the individual or entity to whom they
>>> are addressed. If you have received this email in error please notify
>>> the system manager.
>>>
>>> This footnote confirms that this email message has been swept
>>> for the presence of computer viruses and is believed to be clean.
>>>
>>> **********************************************************************
>>>
>>> ------------------------ MailScanner list ------------------------
>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>> 'leave mailscanner' in the body of the email.
>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>> Support MailScanner development - buy the book off the website!
>>
>>
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>> Support MailScanner development - buy the book off the website!
>
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Fri Nov 26 12:12:54 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:42 2006
Subject: mailscanner not calling spamassassin?
Message-ID: <mailman.5144.1137101262.24926.mailscanner@lists.mailscanner.info>

Brendan

OK how did you install SpamAssassin, CPAN, RPM?

and it's 3.01 right?

Looks likes you've got the SpamAssassin rules directories pointing at
the wrong place - default rules is normall
/usr/local/share/spamassassin, site rules are usually
/etc/mail/spamassassin. check the
/etc/MailScanner/spam.assassin.prefs.conf for over-rides on these and
make sure they pount to the correct place.

Also make sure you have net::DNS installed as a perl module do RBL's and
URI RBLS work..


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Brendan Cody-Kenny wrote:
> ok heres what it gave me:
> Its confusing as it seems to be running the learner before it checks the
> message. it then continues to check each part of the message and give it
> avalue of 0. Then spamassassin has a problem locking the bayes db. it
> looks like its doing everything in the wrong order.
>
> Starting MailScanner...
> In Debugging mode, not forking...
> debug: Score set 0 chosen.
> debug: running in taint mode? no
> SA bayes lock is /var/lib/MailScanner/bayes.lock
> Bayes lock is at /var/lib/MailScanner/bayes.lock
> debug: ignore: test message to precompile patterns and load modules
> debug: using "/etc/MailScanner/rules" for default rules dir
> debug: using "/etc/MailScanner/rules" for site rules dir
> debug: using "/etc/MailScanner/spam.assassin.prefs.conf" for user prefs
> file
> debug: bayes: 1117 tie-ing to DB file R/O
> /var/lib/MailScanner/bayes/bayes_toks
> debug: bayes: 1117 tie-ing to DB file R/O
> /var/lib/MailScanner/bayes/bayes_seen
> debug: bayes: found bayes db version 2
> debug: Score set 3 chosen.
> debug: Initialising learner
> debug: running header regexp tests; score so far=0
> debug: running body-text per-line regexp tests; score so far=0
> debug: running raw-body-text per-line regexp tests; score so far=0
> debug: running uri tests; score so far=0
> debug: uri tests: Done uriRE
> debug: running full-text regexp tests; score so far=0
> debug: running meta tests; score so far=0
> debug: is spam? score=0 required=3.75 tests=
> SpamAssassin: oops! still tied/locked to bayes DBs, untie'ing
> debug: bayes: 1117 untie-ing
> debug: bayes: 1117 untie-ing db_toks
> debug: bayes: 1117 untie-ing db_seen
> debug: received-header: parsed as [ ip=67.15.36.4
> rdns=server21.fastbighost.com helo=server21.fastbighost.com
> by=scruffy.realex.ie ident= ]
> debug: is Net::DNS::Resolver available? no
> debug: is DNS available? 0
> debug: received-header: cannot use DNS, do not trust any hosts from here on
> debug: received-header: relay 67.15.36.4 trusted? no
> debug: running header regexp tests; score so far=0
> debug: running body-text per-line regexp tests; score so far=0
> debug: running raw-body-text per-line regexp tests; score so far=0
> debug: running uri tests; score so far=0
> debug: uri tests: Done uriRE
> debug: running full-text regexp tests; score so far=0
> debug: running meta tests; score so far=0
> debug: is spam? score=0 required=3.75 tests=
> debug: received-header: parsed as [ ip=195.245.230.131
> rdns=mail78.messagelabs.com helo=mail78.messagelabs.com
> by=scruffy.realex.ie ident= ]
> debug: received-header: parsed as [ ip=194.69.198.39 rdns=efwdb01.aib.ie
> helo= by=server-6.tower-78.messagelabs.com ident= ]
> debug: is Net::DNS::Resolver available? no
> debug: is DNS available? 0
> debug: received-header: parsed as [ ip=10.8.22.86 rdns= helo=
> by=efwdb01.aib.ie ident= ]
> debug: received-header: parsed as [ ip=10.32.4.76 rdns=b11127-gx270
> helo= by=sims.isec.aib.ie ident= ]
> debug: received-header: cannot use DNS, do not trust any hosts from here on
> debug: received-header: relay 195.245.230.131 trusted? no
> debug: received-header: relay 194.69.198.39 trusted? no
> debug: received-header: relay 10.8.22.86 trusted? no
> debug: received-header: relay 10.32.4.76 trusted? no
> debug: running header regexp tests; score so far=0
> debug: running body-text per-line regexp tests; score so far=0
> debug: running raw-body-text per-line regexp tests; score so far=0
> debug: running uri tests; score so far=0
> debug: uri tests: Done uriRE
> debug: running full-text regexp tests; score so far=0
> debug: running meta tests; score so far=0
> debug: is spam? score=0 required=3.75 tests=
> debug: received-header: parsed as [ ip=161.58.229.253
> rdns=newsvendor.com helo=newsvendor.com by=scruffy.realex.ie ident= ]
> debug: received-header: parsed as [ ip=193.203.152.4
> rdns=B-152-4.cust.iol.ie helo=webccssmtp.ccs.ie by=newsvendor.com ident= ]
> debug: is Net::DNS::Resolver available? no
> debug: is DNS available? 0
> debug: received-header: parsed as [ ip=223.0.1.127 rdns= helo=Tonylaptop
> by=webccssmtp.ccs.ie ident= ]
> debug: received-header: cannot use DNS, do not trust any hosts from here on
> debug: received-header: relay 161.58.229.253 trusted? no
> debug: received-header: relay 193.203.152.4 trusted? no
> debug: received-header: relay 223.0.1.127 trusted? no
> debug: running header regexp tests; score so far=0
> debug: running body-text per-line regexp tests; score so far=0
> debug: running raw-body-text per-line regexp tests; score so far=0
> debug: running uri tests; score so far=0
> debug: uri tests: Done uriRE
> debug: running full-text regexp tests; score so far=0
> debug: running meta tests; score so far=0
> debug: is spam? score=0 required=3.75 tests=
> /etc/MailScanner/wrapper/trend-wrapper: /pack/trend/bin/vscan: No such
> file or directory
> /etc/MailScanner/wrapper/trend-wrapper: exec: /pack/trend/bin/vscan:
> cannot execute: No such file or directory
> Stopping now as you are debugging me.
>
> Brendan Cody-Kenny | brendan.codykenny@realexpayments.com
> Network Administrator
> Realex Payments
>
> The Forum, 29-32 Glasthule Rd, Glasthule, Co Dublin, Ireland
> t: +353 1 2808559 | f: +353 1 2808538
>
> This mail and any documents attached are classified as confidential and
> are intended for use by the addressee(s) only unless otherwise
> indicated. If you are not an intended recipient of this email, you must
> not use, disclose, copy, distribute or retain this message or any part
> of it. If you have received this email in error, please notify us
> immediately and delete all copies of this email from your computer
> system(s).
>
>
>
> Martin Hepworth wrote:
>
>> Brendon
>>
>>
>> sorry need to be more specific....
>>
>> stop MailScanner
>>
>> edit the MailScanner.conf
>>
>> run check_mailscanner
>>
>> you'll get a nice dump of what it's trying to so with each
>> message...preferable run check_mailscanner as the mailscanner user so
>> all permissions are consistent...
>>
>> --
>> Martin Hepworth
>> Snr Systems Administrator
>> Solid State Logic
>> Tel: +44 (0)1865 842300
>>
>>
>> Brendan Cody-Kenny wrote:
>>
>>> spamassassin -D --lint does not return anything interesting when run as
>>> the mailscanner user.
>>> both debugs are turned on in MailScanner.conf and check_mailscanner
>>> returns:
>>>
>>> MailScanner running with pid 21667
>>>
>>>
>>> I cannot figure out what the problem is so I am now trying to add in a
>>> third mail directory queue. so mailscanner dumps the mail into this
>>> "middle" queue, and then i run a cron job to run spamassassin on the
>>> mail and dump it into the "out" queue. This is awkward and i am not sure
>>> what format that mailscanner is expecting the mail in. the mail dumped
>>> into the "in" queue consists of two files, a header and data file
>>> (ending in -H and -D respectively). I am sure spamassassin is expecting
>>> the mail in one single message. could this have anything to do with my
>>> problem?
>>>
>>>
>>> Martin Hepworth wrote:
>>>
>>>> Brendan Cody-Kenny wrote:
>>>>
>>>>> I remedied the line in spam.assassin.prefs.conf that was causing the
>>>>> debug error line. The debug error message is not shown and the
>>>>> behavior
>>>>> of MS/SA has not changed. The use of dcc will not help explain why
>>>>> MS is
>>>>> not getting results from SA. If Sa called from the command line is
>>>>> returning a value then the same value should be returned to MS.
>>>>> From the
>>>>> results of strace on MS I could see that MS is calling the SA perl
>>>>> scripts. They dont return proper values. Is there specific
>>>>> configuration
>>>>> files for these scripts?
>>>>>
>>>> Brendan
>>>>
>>>> are you callingthe spamassassin -D --lint as the user that MailScanner
>>>> is running as???
>>>>
>>>> also have you tried turning on both debug options in the
>>>> MailScanner.conf and running check_mailscanner to see if it gives you
>>>> more clues??
>>>>
>>>> --
>>>> --
>>>> Martin Hepworth
>>>> Senior Systems Administrator
>>>> Solid State Logic Ltd
>>>> tel: +44 (0)1865 842300
>>>>
>>>>

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From suporte at SETINET.COM.BR  Fri Nov 26 12:19:03 2004
From: suporte at SETINET.COM.BR (Dennis Robert Kelbert)
Date: Thu Jan 12 21:27:42 2006
Subject: Files hidden in very deeply nested archive in ###
Message-ID: <mailman.5145.1137101262.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

What this what to say?
----------->  Files hidden in very deeply nested archive in NUMBER
I´m trying to find some help reading for errors in google and MailScanner
but i find nothing...
 
 
Thanks

 --------------------------------------------------------------------
Esta mensagem foi verificada pelo sistema de anti-vírus e anti-spam.
Seti Segurança e Tecnologia na Internet - suporte@setinet.com.br

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From brendan.codykenny at REALEXPAYMENTS.COM  Fri Nov 26 12:43:25 2004
From: brendan.codykenny at REALEXPAYMENTS.COM (Brendan Cody-Kenny)
Date: Thu Jan 12 21:27:42 2006
Subject: mailscanner not calling spamassassin?
Message-ID: <mailman.5146.1137101262.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

its actually version 2.64 but that worked!! it was looking for the rules
in the wrong directory. Its now giving me minus scores but i assume
thats got to do with the messages and how bayes/rules are tuned.

Thanks to everyone for their help.

Brendan Cody-Kenny | brendan.codykenny@realexpayments.com
Network Administrator
Realex Payments

The Forum, 29-32 Glasthule Rd, Glasthule, Co Dublin, Ireland
t: +353 1 2808559 | f: +353 1 2808538

This mail and any documents attached are classified as confidential and are intended for use by the addressee(s) only unless otherwise indicated. If you are not an intended recipient of this email, you must not use, disclose, copy, distribute or retain this message or any part of it. If you have received this email in error, please notify us immediately and delete all copies of this email from your computer system(s).



Martin Hepworth wrote:

> Brendan
>
> OK how did you install SpamAssassin, CPAN, RPM?
>
> and it's 3.01 right?
>
> Looks likes you've got the SpamAssassin rules directories pointing at
> the wrong place - default rules is normall
> /usr/local/share/spamassassin, site rules are usually
> /etc/mail/spamassassin. check the
> /etc/MailScanner/spam.assassin.prefs.conf for over-rides on these and
> make sure they pount to the correct place.
>
> Also make sure you have net::DNS installed as a perl module do RBL's and
> URI RBLS work..
>
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Brendan Cody-Kenny wrote:
>
>> ok heres what it gave me:
>> Its confusing as it seems to be running the learner before it checks the
>> message. it then continues to check each part of the message and give it
>> avalue of 0. Then spamassassin has a problem locking the bayes db. it
>> looks like its doing everything in the wrong order.
>>
>> Starting MailScanner...
>> In Debugging mode, not forking...
>> debug: Score set 0 chosen.
>> debug: running in taint mode? no
>> SA bayes lock is /var/lib/MailScanner/bayes.lock
>> Bayes lock is at /var/lib/MailScanner/bayes.lock
>> debug: ignore: test message to precompile patterns and load modules
>> debug: using "/etc/MailScanner/rules" for default rules dir
>> debug: using "/etc/MailScanner/rules" for site rules dir
>> debug: using "/etc/MailScanner/spam.assassin.prefs.conf" for user prefs
>> file
>> debug: bayes: 1117 tie-ing to DB file R/O
>> /var/lib/MailScanner/bayes/bayes_toks
>> debug: bayes: 1117 tie-ing to DB file R/O
>> /var/lib/MailScanner/bayes/bayes_seen
>> debug: bayes: found bayes db version 2
>> debug: Score set 3 chosen.
>> debug: Initialising learner
>> debug: running header regexp tests; score so far=0
>> debug: running body-text per-line regexp tests; score so far=0
>> debug: running raw-body-text per-line regexp tests; score so far=0
>> debug: running uri tests; score so far=0
>> debug: uri tests: Done uriRE
>> debug: running full-text regexp tests; score so far=0
>> debug: running meta tests; score so far=0
>> debug: is spam? score=0 required=3.75 tests=
>> SpamAssassin: oops! still tied/locked to bayes DBs, untie'ing
>> debug: bayes: 1117 untie-ing
>> debug: bayes: 1117 untie-ing db_toks
>> debug: bayes: 1117 untie-ing db_seen
>> debug: received-header: parsed as [ ip=67.15.36.4
>> rdns=server21.fastbighost.com helo=server21.fastbighost.com
>> by=scruffy.realex.ie ident= ]
>> debug: is Net::DNS::Resolver available? no
>> debug: is DNS available? 0
>> debug: received-header: cannot use DNS, do not trust any hosts from
>> here on
>> debug: received-header: relay 67.15.36.4 trusted? no
>> debug: running header regexp tests; score so far=0
>> debug: running body-text per-line regexp tests; score so far=0
>> debug: running raw-body-text per-line regexp tests; score so far=0
>> debug: running uri tests; score so far=0
>> debug: uri tests: Done uriRE
>> debug: running full-text regexp tests; score so far=0
>> debug: running meta tests; score so far=0
>> debug: is spam? score=0 required=3.75 tests=
>> debug: received-header: parsed as [ ip=195.245.230.131
>> rdns=mail78.messagelabs.com helo=mail78.messagelabs.com
>> by=scruffy.realex.ie ident= ]
>> debug: received-header: parsed as [ ip=194.69.198.39 rdns=efwdb01.aib.ie
>> helo= by=server-6.tower-78.messagelabs.com ident= ]
>> debug: is Net::DNS::Resolver available? no
>> debug: is DNS available? 0
>> debug: received-header: parsed as [ ip=10.8.22.86 rdns= helo=
>> by=efwdb01.aib.ie ident= ]
>> debug: received-header: parsed as [ ip=10.32.4.76 rdns=b11127-gx270
>> helo= by=sims.isec.aib.ie ident= ]
>> debug: received-header: cannot use DNS, do not trust any hosts from
>> here on
>> debug: received-header: relay 195.245.230.131 trusted? no
>> debug: received-header: relay 194.69.198.39 trusted? no
>> debug: received-header: relay 10.8.22.86 trusted? no
>> debug: received-header: relay 10.32.4.76 trusted? no
>> debug: running header regexp tests; score so far=0
>> debug: running body-text per-line regexp tests; score so far=0
>> debug: running raw-body-text per-line regexp tests; score so far=0
>> debug: running uri tests; score so far=0
>> debug: uri tests: Done uriRE
>> debug: running full-text regexp tests; score so far=0
>> debug: running meta tests; score so far=0
>> debug: is spam? score=0 required=3.75 tests=
>> debug: received-header: parsed as [ ip=161.58.229.253
>> rdns=newsvendor.com helo=newsvendor.com by=scruffy.realex.ie ident= ]
>> debug: received-header: parsed as [ ip=193.203.152.4
>> rdns=B-152-4.cust.iol.ie helo=webccssmtp.ccs.ie by=newsvendor.com
>> ident= ]
>> debug: is Net::DNS::Resolver available? no
>> debug: is DNS available? 0
>> debug: received-header: parsed as [ ip=223.0.1.127 rdns= helo=Tonylaptop
>> by=webccssmtp.ccs.ie ident= ]
>> debug: received-header: cannot use DNS, do not trust any hosts from
>> here on
>> debug: received-header: relay 161.58.229.253 trusted? no
>> debug: received-header: relay 193.203.152.4 trusted? no
>> debug: received-header: relay 223.0.1.127 trusted? no
>> debug: running header regexp tests; score so far=0
>> debug: running body-text per-line regexp tests; score so far=0
>> debug: running raw-body-text per-line regexp tests; score so far=0
>> debug: running uri tests; score so far=0
>> debug: uri tests: Done uriRE
>> debug: running full-text regexp tests; score so far=0
>> debug: running meta tests; score so far=0
>> debug: is spam? score=0 required=3.75 tests=
>> /etc/MailScanner/wrapper/trend-wrapper: /pack/trend/bin/vscan: No such
>> file or directory
>> /etc/MailScanner/wrapper/trend-wrapper: exec: /pack/trend/bin/vscan:
>> cannot execute: No such file or directory
>> Stopping now as you are debugging me.
>>
>> Brendan Cody-Kenny | brendan.codykenny@realexpayments.com
>> Network Administrator
>> Realex Payments
>>
>> The Forum, 29-32 Glasthule Rd, Glasthule, Co Dublin, Ireland
>> t: +353 1 2808559 | f: +353 1 2808538
>>
>> This mail and any documents attached are classified as confidential and
>> are intended for use by the addressee(s) only unless otherwise
>> indicated. If you are not an intended recipient of this email, you must
>> not use, disclose, copy, distribute or retain this message or any part
>> of it. If you have received this email in error, please notify us
>> immediately and delete all copies of this email from your computer
>> system(s).
>>
>>
>>
>> Martin Hepworth wrote:
>>
>>> Brendon
>>>
>>>
>>> sorry need to be more specific....
>>>
>>> stop MailScanner
>>>
>>> edit the MailScanner.conf
>>>
>>> run check_mailscanner
>>>
>>> you'll get a nice dump of what it's trying to so with each
>>> message...preferable run check_mailscanner as the mailscanner user so
>>> all permissions are consistent...
>>>
>>> --
>>> Martin Hepworth
>>> Snr Systems Administrator
>>> Solid State Logic
>>> Tel: +44 (0)1865 842300
>>>
>>>
>>> Brendan Cody-Kenny wrote:
>>>
>>>> spamassassin -D --lint does not return anything interesting when
>>>> run as
>>>> the mailscanner user.
>>>> both debugs are turned on in MailScanner.conf and check_mailscanner
>>>> returns:
>>>>
>>>> MailScanner running with pid 21667
>>>>
>>>>
>>>> I cannot figure out what the problem is so I am now trying to add in a
>>>> third mail directory queue. so mailscanner dumps the mail into this
>>>> "middle" queue, and then i run a cron job to run spamassassin on the
>>>> mail and dump it into the "out" queue. This is awkward and i am not
>>>> sure
>>>> what format that mailscanner is expecting the mail in. the mail dumped
>>>> into the "in" queue consists of two files, a header and data file
>>>> (ending in -H and -D respectively). I am sure spamassassin is
>>>> expecting
>>>> the mail in one single message. could this have anything to do with my
>>>> problem?
>>>>
>>>>
>>>> Martin Hepworth wrote:
>>>>
>>>>> Brendan Cody-Kenny wrote:
>>>>>
>>>>>> I remedied the line in spam.assassin.prefs.conf that was causing the
>>>>>> debug error line. The debug error message is not shown and the
>>>>>> behavior
>>>>>> of MS/SA has not changed. The use of dcc will not help explain why
>>>>>> MS is
>>>>>> not getting results from SA. If Sa called from the command line is
>>>>>> returning a value then the same value should be returned to MS.
>>>>>> From the
>>>>>> results of strace on MS I could see that MS is calling the SA perl
>>>>>> scripts. They dont return proper values. Is there specific
>>>>>> configuration
>>>>>> files for these scripts?
>>>>>>
>>>>> Brendan
>>>>>
>>>>> are you callingthe spamassassin -D --lint as the user that
>>>>> MailScanner
>>>>> is running as???
>>>>>
>>>>> also have you tried turning on both debug options in the
>>>>> MailScanner.conf and running check_mailscanner to see if it gives you
>>>>> more clues??
>>>>>
>>>>> --
>>>>> --
>>>>> Martin Hepworth
>>>>> Senior Systems Administrator
>>>>> Solid State Logic Ltd
>>>>> tel: +44 (0)1865 842300
>>>>>
>>>>>
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From paddy at PANICI.NET  Fri Nov 26 13:27:21 2004
From: paddy at PANICI.NET (paddy)
Date: Thu Jan 12 21:27:42 2006
Subject: Files hidden in very deeply nested archive in ###
Message-ID: <mailman.5147.1137101262.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Fri, Nov 26, 2004 at 10:19:03AM -0200, Dennis Robert Kelbert wrote:
> What this what to say?
> ----------->  Files hidden in very deeply nested archive in NUMBER
> I´m trying to find some help reading for errors in google and MailScanner but i find nothing...

Mailscanner unpacks MIME, zips, etc recursively up to a limit, after
which it logs this error.  The number is the message id, it is
useful for cross-referencing this logging with other logging
related to the same message and for finding information (like
copies in quarantine, or still queued) that has been filed by
the message id. 

The limit is configurable in the parameter
'Maximum Archive Depth' found in /etc/MaliScanner/MailScanner.conf.

I would imagine the limit exists both to see off attacks, and
because it tends to indicate stuff you don't want.  I've an idea
that zip bombs have been seen in the wild before.

Regards,
Paddy
-- 
Perl 6 will give you the big knob. -- Larry Wall

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ugob at CAMO-ROUTE.COM  Fri Nov 26 14:22:47 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:42 2006
Subject: Slightly OT:Can  Sendmail or Postfix do this?
Message-ID: <mailman.5148.1137101262.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Steve Mason wrote:
> I'm currently running  MailScanner, SpamAssassin, and Postfix on a
> Fedora Core 2 box, and all is great, mostly...
>
> I have my own domain, and I'm also using Fetchmail to pop some other
> externally hosted accounts. Users have IMAP clients and get their mail
> from the Fedora box. Depending on the account, they SMTP back through
> the Fedora box, or through the ISP mail server
>
> The problem is that my Fedora box is on a dynamic (doesn't change often
> though) IP address, and more and more hosts (including the Mailscanner
> list server) don't want to talk to my mail server.
> My domain's  DNS is hosted externally, with the MX record pointing to my
> dynamic IP. I suspect that some mail servers either don't like the fact
> that my server is in a dynamic IP range, or that the reverse lookups
> don't match my domain name.
> I don't mind hosting my domain externally (I do for web content) but I'd
> still like to run a mail server here, with MailScanner.

Funny, I am doing the same thing and I don't have any problems with it.

>
> So what I'd like to do is --  host my own domain mail externally, and
> use Fetchmail to pop it to the Fedora box. That part is easy.
> I'd also like outbound mail (from the mail clients , mostly Thunderbird
> users) to send via my Fedora box, and relay to the different external
> mail servers.
>
> Can either Postfix, or Sendmail relay outgoing SMTP to different hosts
> based on the from: field?
> For example, my computer runs Thunderbird, and I have several mail
> accounts.  me@mydomain.com me@myispdomain.ca and me@3rdpartymail.com
> Depending on what account I'm sending from, I'd like my Fedora box to
> send outbound mail either to  externalmailserver@mydomain.com or
> mail.myisp.ca or smtp.3rdpartymail.com
>
> If it were just one domain/server smarthost and masquerade as would
> likely do it? But can I do this with the multiple domains/servers?
>

What I do is just send all outgoing mail through my ISP's smtp server.

> Thanks,
>
> Steve
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mbowman at UDCOM.COM  Fri Nov 26 15:32:16 2004
From: mbowman at UDCOM.COM (Matthew Bowman)
Date: Thu Jan 12 21:27:42 2006
Subject: Help! - MailScanner ceased working
Message-ID: <mailman.5149.1137101262.24926.mailscanner@lists.mailscanner.info>

Hello,

One of our 3 mailscanner servers has stopped processing e-mail.  There are
no errors in /var/log/maillog or messages that indicate and sort of
problem.  Email arrives and gets put into mqueue.in and just stays there.
Nothing has changed in MailScanner.conf or sendmail.cf.  I'm at a loss as
to how this has happened all of a sudden.  I run mailscanner and
spamassassin in debug mode and the results where fine.  What else should I
be looking at?

All 3 mailscanner servers run MS 4.35-11, SA 3.0.0 and Redhat 7.3

Please help!

Thanks

Matthew

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Fri Nov 26 14:58:26 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:42 2006
Subject: Help! - MailScanner ceased working
Message-ID: <mailman.5150.1137101262.24926.mailscanner@lists.mailscanner.info>

Matthew

if results are fine from running in debug mode then it should have
delivered that batch of emails.....

Can you drop the output of the checkmailscanner to the list?

also are you running checkmailscanner as the same user MailScanner
normally runs as?

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Matthew Bowman wrote:
> Hello,
>
> One of our 3 mailscanner servers has stopped processing e-mail.  There are
> no errors in /var/log/maillog or messages that indicate and sort of
> problem.  Email arrives and gets put into mqueue.in and just stays there.
> Nothing has changed in MailScanner.conf or sendmail.cf.  I'm at a loss as
> to how this has happened all of a sudden.  I run mailscanner and
> spamassassin in debug mode and the results where fine.  What else should I
> be looking at?
>
> All 3 mailscanner servers run MS 4.35-11, SA 3.0.0 and Redhat 7.3
>
> Please help!
>
> Thanks
>
> Matthew
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mbowman at UDCOM.COM  Fri Nov 26 16:10:17 2004
From: mbowman at UDCOM.COM (Matthew Bowman)
Date: Thu Jan 12 21:27:42 2006
Subject: Help! - MailScanner ceased working
Message-ID: <mailman.5151.1137101262.24926.mailscanner@lists.mailscanner.info>

Hello

MailScanner is running with pid 842 is the only output I get. Both are run
by the same user.

/var/log/maillog

Nov 26 10:08:09 smithers MailScanner[1503]: MailScanner E-Mail Virus
Scanner version 4.35.11 starting...
Nov 26 10:08:19 smithers MailScanner[1518]: MailScanner E-Mail Virus
Scanner version 4.35.11 starting...
Nov 26 10:08:29 smithers MailScanner[1519]: MailScanner E-Mail Virus
Scanner version 4.35.11 starting...
Nov 26 10:08:39 smithers MailScanner[1520]: MailScanner E-Mail Virus
Scanner version 4.35.11 starting...
Nov 26 10:08:49 smithers MailScanner[1521]: MailScanner E-Mail Virus
Scanner version 4.35.11 starting...
Nov 26 10:08:59 smithers MailScanner[1524]: MailScanner E-Mail Virus
Scanner version 4.35.11 starting...
Nov 26 10:09:09 smithers MailScanner[1526]: MailScanner E-Mail Virus
Scanner version 4.35.11 starting...
Nov 26 10:09:19 smithers MailScanner[1527]: MailScanner E-Mail Virus
Scanner version 4.35.11 starting...
Nov 26 10:09:29 smithers MailScanner[1528]: MailScanner E-Mail Virus
Scanner version 4.35.11 starting...
Nov 26 10:09:39 smithers MailScanner[1530]: MailScanner E-Mail Virus
Scanner version 4.35.11 starting...

ps

root       842  0.0  1.2 13908 12524 ?       S    09:32   0:00
/usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailS
root       843  0.0  0.0     0    0 ?        Z    09:32   0:01
[MailScanner <defunct>]
root      1039  0.0  0.0     0    0 ?        Z    09:32   0:01
[MailScanner <defunct>]
root      1040  0.0  0.0     0    0 ?        Z    09:32   0:01
[MailScanner <defunct>]
root      1041  0.0  0.0     0    0 ?        Z    09:32   0:01
[MailScanner <defunct>]
root      1042  0.0  0.0     0    0 ?        Z    09:33   0:01
[MailScanner <defunct>]
root      1043  0.0  0.0     0    0 ?        Z    09:33   0:01
[MailScanner <defunct>]
root      1044  0.0  0.0     0    0 ?        Z    09:33   0:01
[MailScanner <defunct>]
root      1045  0.0  0.0     0    0 ?        Z    09:33   0:01
[MailScanner <defunct>]
root      1046  0.0  0.0     0    0 ?        Z    09:33   0:01
[MailScanner <defunct>]
root      1539 34.2  0.0     0    0 ?        Z    10:10   0:01
[MailScanner <defunct>]

Thanks for your help

Matthew K Bowman
Systems Administrator
UDCom
Tel: 419-524-4330
Fax: 419-524-8757
Web: http://www.udcom.com
Email: mbowman@udcom.com
Support: techsupport@udcom.com
Sales: sales@udcom.com




Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
11/26/2004 09:58 AM
Please respond to MailScanner mailing list

        To:     MAILSCANNER@JISCMAIL.AC.UK
        cc:
        Subject:        Re: Help! - MailScanner ceased working


Matthew

if results are fine from running in debug mode then it should have
delivered that batch of emails.....

Can you drop the output of the checkmailscanner to the list?

also are you running checkmailscanner as the same user MailScanner
normally runs as?

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Matthew Bowman wrote:
> Hello,
>
> One of our 3 mailscanner servers has stopped processing e-mail.  There
are
> no errors in /var/log/maillog or messages that indicate and sort of
> problem.  Email arrives and gets put into mqueue.in and just stays
there.
> Nothing has changed in MailScanner.conf or sendmail.cf.  I'm at a loss
as
> to how this has happened all of a sudden.  I run mailscanner and
> spamassassin in debug mode and the results where fine.  What else should
I
> be looking at?
>
> All 3 mailscanner servers run MS 4.35-11, SA 3.0.0 and Redhat 7.3
>
> Please help!
>
> Thanks
>
> Matthew
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Fri Nov 26 16:06:01 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:42 2006
Subject: Help! - MailScanner ceased working
Message-ID: <mailman.5152.1137101262.24926.mailscanner@lists.mailscanner.info>

matthew

stop the mailscanner service

edit the MailScanner.conf file and turn on both lots of debug options

run checkmailscanner as the user defined in the MailScanner.conf and
drop the results back here..


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Matthew Bowman wrote:
> Hello
>
> MailScanner is running with pid 842 is the only output I get. Both are run
> by the same user.
>
> /var/log/maillog
>
> Nov 26 10:08:09 smithers MailScanner[1503]: MailScanner E-Mail Virus
> Scanner version 4.35.11 starting...
> Nov 26 10:08:19 smithers MailScanner[1518]: MailScanner E-Mail Virus
> Scanner version 4.35.11 starting...
> Nov 26 10:08:29 smithers MailScanner[1519]: MailScanner E-Mail Virus
> Scanner version 4.35.11 starting...
> Nov 26 10:08:39 smithers MailScanner[1520]: MailScanner E-Mail Virus
> Scanner version 4.35.11 starting...
> Nov 26 10:08:49 smithers MailScanner[1521]: MailScanner E-Mail Virus
> Scanner version 4.35.11 starting...
> Nov 26 10:08:59 smithers MailScanner[1524]: MailScanner E-Mail Virus
> Scanner version 4.35.11 starting...
> Nov 26 10:09:09 smithers MailScanner[1526]: MailScanner E-Mail Virus
> Scanner version 4.35.11 starting...
> Nov 26 10:09:19 smithers MailScanner[1527]: MailScanner E-Mail Virus
> Scanner version 4.35.11 starting...
> Nov 26 10:09:29 smithers MailScanner[1528]: MailScanner E-Mail Virus
> Scanner version 4.35.11 starting...
> Nov 26 10:09:39 smithers MailScanner[1530]: MailScanner E-Mail Virus
> Scanner version 4.35.11 starting...
>
> ps
>
> root       842  0.0  1.2 13908 12524 ?       S    09:32   0:00
> /usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailS
> root       843  0.0  0.0     0    0 ?        Z    09:32   0:01
> [MailScanner <defunct>]
> root      1039  0.0  0.0     0    0 ?        Z    09:32   0:01
> [MailScanner <defunct>]
> root      1040  0.0  0.0     0    0 ?        Z    09:32   0:01
> [MailScanner <defunct>]
> root      1041  0.0  0.0     0    0 ?        Z    09:32   0:01
> [MailScanner <defunct>]
> root      1042  0.0  0.0     0    0 ?        Z    09:33   0:01
> [MailScanner <defunct>]
> root      1043  0.0  0.0     0    0 ?        Z    09:33   0:01
> [MailScanner <defunct>]
> root      1044  0.0  0.0     0    0 ?        Z    09:33   0:01
> [MailScanner <defunct>]
> root      1045  0.0  0.0     0    0 ?        Z    09:33   0:01
> [MailScanner <defunct>]
> root      1046  0.0  0.0     0    0 ?        Z    09:33   0:01
> [MailScanner <defunct>]
> root      1539 34.2  0.0     0    0 ?        Z    10:10   0:01
> [MailScanner <defunct>]
>
> Thanks for your help
>
> Matthew K Bowman
> Systems Administrator
> UDCom
> Tel: 419-524-4330
> Fax: 419-524-8757
> Web: http://www.udcom.com
> Email: mbowman@udcom.com
> Support: techsupport@udcom.com
> Sales: sales@udcom.com
>
>
>
>
> Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
> Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> 11/26/2004 09:58 AM
> Please respond to MailScanner mailing list
>
>         To:     MAILSCANNER@JISCMAIL.AC.UK
>         cc:
>         Subject:        Re: Help! - MailScanner ceased working
>
>
> Matthew
>
> if results are fine from running in debug mode then it should have
> delivered that batch of emails.....
>
> Can you drop the output of the checkmailscanner to the list?
>
> also are you running checkmailscanner as the same user MailScanner
> normally runs as?
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Matthew Bowman wrote:
>
>>Hello,
>>
>>One of our 3 mailscanner servers has stopped processing e-mail.  There
>
> are
>
>>no errors in /var/log/maillog or messages that indicate and sort of
>>problem.  Email arrives and gets put into mqueue.in and just stays
>
> there.
>
>>Nothing has changed in MailScanner.conf or sendmail.cf.  I'm at a loss
>
> as
>
>>to how this has happened all of a sudden.  I run mailscanner and
>>spamassassin in debug mode and the results where fine.  What else should
>
> I
>
>>be looking at?
>>
>>All 3 mailscanner servers run MS 4.35-11, SA 3.0.0 and Redhat 7.3
>>
>>Please help!
>>
>>Thanks
>>
>>Matthew
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mbowman at UDCOM.COM  Fri Nov 26 17:16:36 2004
From: mbowman at UDCOM.COM (Matthew Bowman)
Date: Thu Jan 12 21:27:42 2006
Subject: Help! - MailScanner ceased working (debug output)
Message-ID: <mailman.5153.1137101262.24926.mailscanner@lists.mailscanner.info>

Debug output

Starting MailScanner...
In Debugging mode, not forking...
debug: SpamAssassin version 3.0.0
debug: Score set 0 chosen.
debug: running in taint mode? no
SA bayes lock is /root/.spamassassin/bayes.lock
Bayes lock is at /root/.spamassassin/bayes.lock
debug: ignore: test message to precompile patterns and load modules
debug: using "/etc/mail/spamassassin/init.pre" for site rules init.pre
debug: config: read file /etc/mail/spamassassin/init.pre
debug: using "/usr/share/spamassassin" for default rules dir
debug: config: read file /usr/share/spamassassin/10_misc.cf
debug: config: read file /usr/share/spamassassin/20_anti_ratware.cf
debug: config: read file /usr/share/spamassassin/20_body_tests.cf
debug: config: read file /usr/share/spamassassin/20_compensate.cf
debug: config: read file /usr/share/spamassassin/20_dnsbl_tests.cf
debug: config: read file /usr/share/spamassassin/20_drugs.cf
debug: config: read file /usr/share/spamassassin/20_fake_helo_tests.cf
debug: config: read file /usr/share/spamassassin/20_head_tests.cf
debug: config: read file /usr/share/spamassassin/20_html_tests.cf
debug: config: read file /usr/share/spamassassin/20_meta_tests.cf
debug: config: read file /usr/share/spamassassin/20_phrases.cf
debug: config: read file /usr/share/spamassassin/20_porn.cf
debug: config: read file /usr/share/spamassassin/20_ratware.cf
debug: config: read file /usr/share/spamassassin/20_uri_tests.cf
debug: config: read file /usr/share/spamassassin/23_bayes.cf
debug: config: read file /usr/share/spamassassin/25_body_tests_es.cf
debug: config: read file /usr/share/spamassassin/25_hashcash.cf
debug: config: read file /usr/share/spamassassin/25_spf.cf
debug: config: read file /usr/share/spamassassin/25_uribl.cf
debug: config: read file /usr/share/spamassassin/30_text_de.cf
debug: config: read file /usr/share/spamassassin/30_text_fr.cf
debug: config: read file /usr/share/spamassassin/30_text_nl.cf
debug: config: read file /usr/share/spamassassin/30_text_pl.cf
debug: config: read file /usr/share/spamassassin/50_scores.cf
debug: config: read file /usr/share/spamassassin/60_whitelist.cf
debug: using "/etc/mail/spamassassin" for site rules dir
debug: config: read file /etc/mail/spamassassin/antidrug.cf
debug: config: read file /etc/mail/spamassassin/bigevil.cf
debug: config: read file /etc/mail/spamassassin/local.cf
debug: using "/etc/MailScanner/spam.assassin.prefs.conf" for user prefs
file
debug: config: read file /etc/MailScanner/spam.assassin.prefs.conf
debug: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
debug: plugin: registered
Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
debug: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC
debug: plugin: registered
Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40)
debug: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
debug: plugin: registered Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798)
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
implements 'parse_config'
debug: plugin: Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40)
implements 'parse_config'
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
inhibited further callbacks
debug: Score set 1 chosen.
debug: ---- MIME PARSER START ----
debug: main message type: text/plain
debug: parsing normal part
debug: added part, type: text/plain
debug: ---- MIME PARSER END ----
debug: metadata: X-Spam-Relays-Trusted:
debug: metadata: X-Spam-Relays-Untrusted:
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
implements 'parsed_metadata'
debug: is Net::DNS::Resolver available? yes
debug: Net::DNS version: 0.39_01
debug: trying (3) sourceforge.net...
debug: looking up NS for 'sourceforge.net'
debug: NS lookup of sourceforge.net succeeded => Dns available (set
dns_available to hardcode)
debug: is DNS available? 1
debug: decoding: no encoding detected
debug: URIDNSBL: domains to query:
debug: all '*From' addrs: ignore@compiling.spamassassin.taint.org
debug: Running tests for priority: 0
debug: running header regexp tests; score so far=0
debug: registering glue method for check_uridnsbl
(Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810))
debug: registering glue method for check_for_spf_pass
(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
debug: SPF: message was delivered entirely via trusted relays, not
required
debug: all '*To' addrs:
debug: registering glue method for check_hashcash_value
(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40))
debug: registering glue method for check_for_spf_helo_fail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
debug: SPF: message was delivered entirely via trusted relays, not
required
debug: registering glue method for check_for_spf_helo_pass
(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
debug: registering glue method for check_hashcash_double_spend
(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40))
debug: registering glue method for check_for_spf_softfail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
debug: registering glue method for check_for_spf_helo_softfail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
debug: running body-text per-line regexp tests; score so far=-2.623
debug: running uri tests; score so far=-2.623
debug: Razor2 is available
debug: entering helper-app run mode
 Razor-Log: Computed razorhome from env: /root/.razor
 Razor-Log: Found razorhome: /root/.razor
 Razor-Log: read_file: 16 items read from /root/.razor/razor-agent.conf
Nov 26 11:15:44.875895 check[27631]: [ 1] [bootup] Logging initiated
LogDebugLevel=9 to stdout
Nov 26 11:15:44.876392 check[27631]: [ 5] computed razorhome=/root/.razor,
conf=/root/.razor/razor-agent.conf, ident=/root/.razor/identity
Nov 26 11:15:44.876648 check[27631]: [ 8] Client supported_engines: 1 2 3
4
Nov 26 11:15:44.877247 check[27631]: [ 8]  prep_mail done: mail 1
headers=102, mime0=1376
Nov 26 11:15:44.877704 check[27631]: [ 5] read_file: 8 items read from
/root/.razor/servers.discovery.lst
Nov 26 11:15:44.878063 check[27631]: [ 5] read_file: 2 items read from
/root/.razor/servers.nomination.lst
Nov 26 11:15:44.878331 check[27631]: [ 5] read_file: 3 items read from
/root/.razor/servers.catalogue.lst
Nov 26 11:15:44.878740 check[27631]: [ 9] Assigning defaults to
joy.cloudmark.com
Nov 26 11:15:44.878926 check[27631]: [ 9] Assigning defaults to
folly.cloudmark.com
Nov 26 11:15:44.879179 check[27631]: [ 9] Assigning defaults to
pride.cloudmark.com
Nov 26 11:15:44.879383 check[27631]: [ 9] Assigning defaults to
wonder.cloudmark.com
Nov 26 11:15:44.879559 check[27631]: [ 9] Assigning defaults to
thrill.cloudmark.com
Nov 26 11:15:44.880412 check[27631]: [ 5] read_file: 14 items read from
/root/.razor/server.truth.cloudmark.com.conf
Nov 26 11:15:44.881004 check[27631]: [ 5] read_file: 14 items read from
/root/.razor/server.stress.cloudmark.com.conf
Nov 26 11:15:44.881542 check[27631]: [ 5] read_file: 12 items read from
/root/.razor/server.folly.cloudmark.com.conf
Nov 26 11:15:44.882114 check[27631]: [ 5] read_file: 14 items read from
/root/.razor/server.rancor.cloudmark.com.conf
Nov 26 11:15:44.882702 check[27631]: [ 5] read_file: 16 items read from
/root/.razor/server.pride.cloudmark.com.conf
Nov 26 11:15:44.883256 check[27631]: [ 5] read_file: 14 items read from
/root/.razor/server.prejudice.cloudmark.com.conf
Nov 26 11:15:44.883832 check[27631]: [ 5] read_file: 16 items read from
/root/.razor/server.wonder.cloudmark.com.conf
Nov 26 11:15:44.884384 check[27631]: [ 5] read_file: 14 items read from
/root/.razor/server.anxiety.cloudmark.com.conf
Nov 26 11:15:44.884946 check[27631]: [ 5] read_file: 14 items read from
/root/.razor/server.tension.cloudmark.com.conf
Nov 26 11:15:44.885523 check[27631]: [ 5] read_file: 16 items read from
/root/.razor/server.thrill.cloudmark.com.conf
Nov 26 11:15:44.886150 check[27631]: [ 5] read_file: 14 items read from
/root/.razor/server.malice.cloudmark.com.conf
Nov 26 11:15:44.886757 check[27631]: [ 5] read_file: 14 items read from
/root/.razor/server.shock.cloudmark.com.conf
Nov 26 11:15:44.887082 check[27631]: [ 5] 154361 seconds before closest
server discovery
Nov 26 11:15:44.887338 check[27631]: [ 6] pride.cloudmark.com is a
Catalogue Server srl 5048; computed min_cf=6, Server se: C8
Nov 26 11:15:44.887597 check[27631]: [ 8] Computed supported_engines: 4
Nov 26 11:15:44.887759 check[27631]: [ 8] Using next closest server
pride.cloudmark.com:2703, cached info srl 5048
Nov 26 11:15:44.887892 check[27631]: [ 8] mail 1 has no subject
Nov 26 11:15:44.889464 check[27631]: [ 6] preproc: mail 1.0 went from 1376
bytes to 1339
Nov 26 11:15:44.889655 check[27631]: [ 6] computing sigs for mail 1.0, len
1339
Nov 26 11:15:44.891458 check[27631]: [ 6] skipping whitelist file
(empty?): /root/.razor/razor-whitelist
Nov 26 11:15:44.891659 check[27631]: [ 5] Connecting to
pride.cloudmark.com ...
Nov 26 11:15:44.956354 check[27631]: [ 3] Unable to connect to
pride.cloudmark.com:2703; Reason: Connection refused.
Nov 26 11:15:44.956634 check[27631]: [ 5] 161663 seconds before closest
server discovery
Nov 26 11:15:44.956874 check[27631]: [ 6] wonder.cloudmark.com is a
Catalogue Server srl 5048; computed min_cf=6, Server se: C8
Nov 26 11:15:44.957085 check[27631]: [ 8] Computed supported_engines: 4
Nov 26 11:15:44.957231 check[27631]: [ 8] Using next closest server
wonder.cloudmark.com:2703, cached info srl 5048
Nov 26 11:15:44.957392 check[27631]: [ 5] Connecting to
wonder.cloudmark.com ...
Nov 26 11:15:45.077689 check[27631]: [ 8] Connection established
Nov 26 11:15:45.077888 check[27631]: [ 4] wonder.cloudmark.com >> 36
server greeting: sn=C&srl=5048&a=l&a=cg&ep4=7542-10
Nov 26 11:15:45.078283 check[27631]: [ 4] wonder.cloudmark.com << 25
Nov 26 11:15:45.078369 check[27631]: [ 6] cn=razor-agents&cv=2.36
Nov 26 11:15:45.078670 check[27631]: [ 6] wonder.cloudmark.com is a
Catalogue Server srl 5048; computed min_cf=6, Server se: C8
Nov 26 11:15:45.078891 check[27631]: [ 8] Computed supported_engines: 4
Nov 26 11:15:45.079110 check[27631]: [ 8] mail 1.0 e4 sig:
xFaZIZUVHk90OQfARnenjx5BZTMA
Nov 26 11:15:45.079296 check[27631]: [ 8] preparing 1 queries
Nov 26 11:15:45.079546 check[27631]: [ 8] sending 1 batches
Nov 26 11:15:45.079745 check[27631]: [ 4] wonder.cloudmark.com << 52
Nov 26 11:15:45.079820 check[27631]: [ 6]
a=c&e=4&ep4=7542-10&s=xFaZIZUVHk90OQfARnenjx5BZTMA
Nov 26 11:15:45.351281 check[27631]: [ 4] wonder.cloudmark.com >> 5
Nov 26 11:15:45.351376 check[27631]: [ 6] response to sent.2
p=0
Nov 26 11:15:45.351792 check[27631]: [ 6] mail 1.0 e=4
sig=xFaZIZUVHk90OQfARnenjx5BZTMA: sig not found.
Nov 26 11:15:45.351954 check[27631]: [ 7] method 4: mail 1.0:
no-contention part, spam=0
Nov 26 11:15:45.352034 check[27631]: [ 7] method 4: mail 1: all
non-contention parts not spam, mail not spam
Nov 26 11:15:45.352111 check[27631]: [ 3] mail 1 is not known spam.
Nov 26 11:15:45.352208 check[27631]: [ 5] disconnecting from server
wonder.cloudmark.com
Nov 26 11:15:45.352409 check[27631]: [ 4] wonder.cloudmark.com << 5
Nov 26 11:15:45.352482 check[27631]: [ 6] a=q
debug: Using results from Razor v2.36
debug: Found Razor2 part: part=0 engine=4 ct=0 cf=0
debug: leaving helper-app run mode
debug: Razor2 results: spam? 0  highest cf score: 0
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
implements 'check_tick'
debug: running raw-body-text per-line regexp tests; score so far=-2.623
debug: running full-text regexp tests; score so far=-2.623
debug: Razor2 is available
debug: Current PATH is: /sbin:/bin:/usr/sbin:/usr/bin
debug: Pyzor is not available: pyzor not found
debug: Running tests for priority: 500
debug: RBL: success for 1 of 1 queries
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
implements 'check_post_dnsbl'
debug: running meta tests; score so far=-2.623
debug: running header regexp tests; score so far=-1.053
debug: running body-text per-line regexp tests; score so far=-1.053
debug: running uri tests; score so far=-1.053
debug: running raw-body-text per-line regexp tests; score so far=-1.053
debug: running full-text regexp tests; score so far=-1.053
debug: Running tests for priority: 1000
debug: running meta tests; score so far=-1.053
debug: running header regexp tests; score so far=-1.053
debug: lock: 27631 created
/root/.spamassassin/auto-whitelist.lock.smithers.vbcomm.net.27631
debug: lock: 27631 trying to get lock on
/root/.spamassassin/auto-whitelist with 0 retries
debug: lock: 27631 link to /root/.spamassassin/auto-whitelist.lock: link
ok
debug: Tie-ing to DB file R/W in /root/.spamassassin/auto-whitelist
debug: auto-whitelist (db-based):
ignore@compiling.spamassassin.taint.org|ip=none scores 0/0
debug: AWL active, pre-score: -1.053, autolearn score: -1.053, mean:
undef, IP: undef
debug: DB addr list: untie-ing and unlocking.
debug: DB addr list: file locked, breaking lock.
debug: unlock: 27631 unlink /root/.spamassassin/auto-whitelist.lock
debug: Post AWL score: -1.053
debug: running body-text per-line regexp tests; score so far=-1.053
debug: running uri tests; score so far=-1.053
debug: running raw-body-text per-line regexp tests; score so far=-1.053
debug: running full-text regexp tests; score so far=-1.053
debug: is spam? score=-1.053 required=3.8
debug: tests=ALL_TRUSTED,MISSING_DATE,MISSING_SUBJECT,NO_REAL_NAME
debug:
subtests=__HAS_MSGID,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__SANE_MSGID,__UNUSABLE_MSGID




Matthew K Bowman
Systems Administrator
UDCom
Tel: 419-524-4330
Fax: 419-524-8757
Web: http://www.udcom.com
Email: mbowman@udcom.com
Support: techsupport@udcom.com
Sales: sales@udcom.com




Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
11/26/2004 11:06 AM
Please respond to MailScanner mailing list

        To:     MAILSCANNER@JISCMAIL.AC.UK
        cc:
        Subject:        Re: Help! - MailScanner ceased working


matthew

stop the mailscanner service

edit the MailScanner.conf file and turn on both lots of debug options

run checkmailscanner as the user defined in the MailScanner.conf and
drop the results back here..


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Matthew Bowman wrote:
> Hello
>
> MailScanner is running with pid 842 is the only output I get. Both are
run
> by the same user.
>
> /var/log/maillog
>
> Nov 26 10:08:09 smithers MailScanner[1503]: MailScanner E-Mail Virus
> Scanner version 4.35.11 starting...
> Nov 26 10:08:19 smithers MailScanner[1518]: MailScanner E-Mail Virus
> Scanner version 4.35.11 starting...
> Nov 26 10:08:29 smithers MailScanner[1519]: MailScanner E-Mail Virus
> Scanner version 4.35.11 starting...
> Nov 26 10:08:39 smithers MailScanner[1520]: MailScanner E-Mail Virus
> Scanner version 4.35.11 starting...
> Nov 26 10:08:49 smithers MailScanner[1521]: MailScanner E-Mail Virus
> Scanner version 4.35.11 starting...
> Nov 26 10:08:59 smithers MailScanner[1524]: MailScanner E-Mail Virus
> Scanner version 4.35.11 starting...
> Nov 26 10:09:09 smithers MailScanner[1526]: MailScanner E-Mail Virus
> Scanner version 4.35.11 starting...
> Nov 26 10:09:19 smithers MailScanner[1527]: MailScanner E-Mail Virus
> Scanner version 4.35.11 starting...
> Nov 26 10:09:29 smithers MailScanner[1528]: MailScanner E-Mail Virus
> Scanner version 4.35.11 starting...
> Nov 26 10:09:39 smithers MailScanner[1530]: MailScanner E-Mail Virus
> Scanner version 4.35.11 starting...
>
> ps
>
> root       842  0.0  1.2 13908 12524 ?       S    09:32   0:00
> /usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailS
> root       843  0.0  0.0     0    0 ?        Z    09:32   0:01
> [MailScanner <defunct>]
> root      1039  0.0  0.0     0    0 ?        Z    09:32   0:01
> [MailScanner <defunct>]
> root      1040  0.0  0.0     0    0 ?        Z    09:32   0:01
> [MailScanner <defunct>]
> root      1041  0.0  0.0     0    0 ?        Z    09:32   0:01
> [MailScanner <defunct>]
> root      1042  0.0  0.0     0    0 ?        Z    09:33   0:01
> [MailScanner <defunct>]
> root      1043  0.0  0.0     0    0 ?        Z    09:33   0:01
> [MailScanner <defunct>]
> root      1044  0.0  0.0     0    0 ?        Z    09:33   0:01
> [MailScanner <defunct>]
> root      1045  0.0  0.0     0    0 ?        Z    09:33   0:01
> [MailScanner <defunct>]
> root      1046  0.0  0.0     0    0 ?        Z    09:33   0:01
> [MailScanner <defunct>]
> root      1539 34.2  0.0     0    0 ?        Z    10:10   0:01
> [MailScanner <defunct>]
>
> Thanks for your help
>
> Matthew K Bowman
> Systems Administrator
> UDCom
> Tel: 419-524-4330
> Fax: 419-524-8757
> Web: http://www.udcom.com
> Email: mbowman@udcom.com
> Support: techsupport@udcom.com
> Sales: sales@udcom.com
>
>
>
>
> Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
> Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> 11/26/2004 09:58 AM
> Please respond to MailScanner mailing list
>
>         To:     MAILSCANNER@JISCMAIL.AC.UK
>         cc:
>         Subject:        Re: Help! - MailScanner ceased working
>
>
> Matthew
>
> if results are fine from running in debug mode then it should have
> delivered that batch of emails.....
>
> Can you drop the output of the checkmailscanner to the list?
>
> also are you running checkmailscanner as the same user MailScanner
> normally runs as?
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Matthew Bowman wrote:
>
>>Hello,
>>
>>One of our 3 mailscanner servers has stopped processing e-mail.  There
>
> are
>
>>no errors in /var/log/maillog or messages that indicate and sort of
>>problem.  Email arrives and gets put into mqueue.in and just stays
>
> there.
>
>>Nothing has changed in MailScanner.conf or sendmail.cf.  I'm at a loss
>
> as
>
>>to how this has happened all of a sudden.  I run mailscanner and
>>spamassassin in debug mode and the results where fine.  What else should
>
> I
>
>>be looking at?
>>
>>All 3 mailscanner servers run MS 4.35-11, SA 3.0.0 and Redhat 7.3
>>
>>Please help!
>>
>>Thanks
>>
>>Matthew
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Fri Nov 26 16:34:56 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:42 2006
Subject: Help! - MailScanner ceased working (debug output)
Message-ID: <mailman.5154.1137101262.24926.mailscanner@lists.mailscanner.info>

matthew

Looks fine - I presume stuff hit the outgoing MTA queue?


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Matthew Bowman wrote:
> Debug output
>
> Starting MailScanner...
> In Debugging mode, not forking...
> debug: SpamAssassin version 3.0.0
> debug: Score set 0 chosen.
> debug: running in taint mode? no
> SA bayes lock is /root/.spamassassin/bayes.lock
> Bayes lock is at /root/.spamassassin/bayes.lock
> debug: ignore: test message to precompile patterns and load modules
> debug: using "/etc/mail/spamassassin/init.pre" for site rules init.pre
> debug: config: read file /etc/mail/spamassassin/init.pre
> debug: using "/usr/share/spamassassin" for default rules dir
> debug: config: read file /usr/share/spamassassin/10_misc.cf
> debug: config: read file /usr/share/spamassassin/20_anti_ratware.cf
> debug: config: read file /usr/share/spamassassin/20_body_tests.cf
> debug: config: read file /usr/share/spamassassin/20_compensate.cf
> debug: config: read file /usr/share/spamassassin/20_dnsbl_tests.cf
> debug: config: read file /usr/share/spamassassin/20_drugs.cf
> debug: config: read file /usr/share/spamassassin/20_fake_helo_tests.cf
> debug: config: read file /usr/share/spamassassin/20_head_tests.cf
> debug: config: read file /usr/share/spamassassin/20_html_tests.cf
> debug: config: read file /usr/share/spamassassin/20_meta_tests.cf
> debug: config: read file /usr/share/spamassassin/20_phrases.cf
> debug: config: read file /usr/share/spamassassin/20_porn.cf
> debug: config: read file /usr/share/spamassassin/20_ratware.cf
> debug: config: read file /usr/share/spamassassin/20_uri_tests.cf
> debug: config: read file /usr/share/spamassassin/23_bayes.cf
> debug: config: read file /usr/share/spamassassin/25_body_tests_es.cf
> debug: config: read file /usr/share/spamassassin/25_hashcash.cf
> debug: config: read file /usr/share/spamassassin/25_spf.cf
> debug: config: read file /usr/share/spamassassin/25_uribl.cf
> debug: config: read file /usr/share/spamassassin/30_text_de.cf
> debug: config: read file /usr/share/spamassassin/30_text_fr.cf
> debug: config: read file /usr/share/spamassassin/30_text_nl.cf
> debug: config: read file /usr/share/spamassassin/30_text_pl.cf
> debug: config: read file /usr/share/spamassassin/50_scores.cf
> debug: config: read file /usr/share/spamassassin/60_whitelist.cf
> debug: using "/etc/mail/spamassassin" for site rules dir
> debug: config: read file /etc/mail/spamassassin/antidrug.cf
> debug: config: read file /etc/mail/spamassassin/bigevil.cf
> debug: config: read file /etc/mail/spamassassin/local.cf
> debug: using "/etc/MailScanner/spam.assassin.prefs.conf" for user prefs
> file
> debug: config: read file /etc/MailScanner/spam.assassin.prefs.conf
> debug: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
> debug: plugin: registered
> Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
> debug: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC
> debug: plugin: registered
> Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40)
> debug: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
> debug: plugin: registered Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798)
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
> implements 'parse_config'
> debug: plugin: Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40)
> implements 'parse_config'
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
> inhibited further callbacks
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
> inhibited further callbacks
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
> inhibited further callbacks
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
> inhibited further callbacks
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
> inhibited further callbacks
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
> inhibited further callbacks
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
> inhibited further callbacks
> debug: Score set 1 chosen.
> debug: ---- MIME PARSER START ----
> debug: main message type: text/plain
> debug: parsing normal part
> debug: added part, type: text/plain
> debug: ---- MIME PARSER END ----
> debug: metadata: X-Spam-Relays-Trusted:
> debug: metadata: X-Spam-Relays-Untrusted:
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
> implements 'parsed_metadata'
> debug: is Net::DNS::Resolver available? yes
> debug: Net::DNS version: 0.39_01
> debug: trying (3) sourceforge.net...
> debug: looking up NS for 'sourceforge.net'
> debug: NS lookup of sourceforge.net succeeded => Dns available (set
> dns_available to hardcode)
> debug: is DNS available? 1
> debug: decoding: no encoding detected
> debug: URIDNSBL: domains to query:
> debug: all '*From' addrs: ignore@compiling.spamassassin.taint.org
> debug: Running tests for priority: 0
> debug: running header regexp tests; score so far=0
> debug: registering glue method for check_uridnsbl
> (Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810))
> debug: registering glue method for check_for_spf_pass
> (Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
> debug: SPF: message was delivered entirely via trusted relays, not
> required
> debug: all '*To' addrs:
> debug: registering glue method for check_hashcash_value
> (Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40))
> debug: registering glue method for check_for_spf_helo_fail
> (Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
> debug: SPF: message was delivered entirely via trusted relays, not
> required
> debug: registering glue method for check_for_spf_helo_pass
> (Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
> debug: registering glue method for check_hashcash_double_spend
> (Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40))
> debug: registering glue method for check_for_spf_softfail
> (Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
> debug: registering glue method for check_for_spf_helo_softfail
> (Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
> debug: running body-text per-line regexp tests; score so far=-2.623
> debug: running uri tests; score so far=-2.623
> debug: Razor2 is available
> debug: entering helper-app run mode
>  Razor-Log: Computed razorhome from env: /root/.razor
>  Razor-Log: Found razorhome: /root/.razor
>  Razor-Log: read_file: 16 items read from /root/.razor/razor-agent.conf
> Nov 26 11:15:44.875895 check[27631]: [ 1] [bootup] Logging initiated
> LogDebugLevel=9 to stdout
> Nov 26 11:15:44.876392 check[27631]: [ 5] computed razorhome=/root/.razor,
> conf=/root/.razor/razor-agent.conf, ident=/root/.razor/identity
> Nov 26 11:15:44.876648 check[27631]: [ 8] Client supported_engines: 1 2 3
> 4
> Nov 26 11:15:44.877247 check[27631]: [ 8]  prep_mail done: mail 1
> headers=102, mime0=1376
> Nov 26 11:15:44.877704 check[27631]: [ 5] read_file: 8 items read from
> /root/.razor/servers.discovery.lst
> Nov 26 11:15:44.878063 check[27631]: [ 5] read_file: 2 items read from
> /root/.razor/servers.nomination.lst
> Nov 26 11:15:44.878331 check[27631]: [ 5] read_file: 3 items read from
> /root/.razor/servers.catalogue.lst
> Nov 26 11:15:44.878740 check[27631]: [ 9] Assigning defaults to
> joy.cloudmark.com
> Nov 26 11:15:44.878926 check[27631]: [ 9] Assigning defaults to
> folly.cloudmark.com
> Nov 26 11:15:44.879179 check[27631]: [ 9] Assigning defaults to
> pride.cloudmark.com
> Nov 26 11:15:44.879383 check[27631]: [ 9] Assigning defaults to
> wonder.cloudmark.com
> Nov 26 11:15:44.879559 check[27631]: [ 9] Assigning defaults to
> thrill.cloudmark.com
> Nov 26 11:15:44.880412 check[27631]: [ 5] read_file: 14 items read from
> /root/.razor/server.truth.cloudmark.com.conf
> Nov 26 11:15:44.881004 check[27631]: [ 5] read_file: 14 items read from
> /root/.razor/server.stress.cloudmark.com.conf
> Nov 26 11:15:44.881542 check[27631]: [ 5] read_file: 12 items read from
> /root/.razor/server.folly.cloudmark.com.conf
> Nov 26 11:15:44.882114 check[27631]: [ 5] read_file: 14 items read from
> /root/.razor/server.rancor.cloudmark.com.conf
> Nov 26 11:15:44.882702 check[27631]: [ 5] read_file: 16 items read from
> /root/.razor/server.pride.cloudmark.com.conf
> Nov 26 11:15:44.883256 check[27631]: [ 5] read_file: 14 items read from
> /root/.razor/server.prejudice.cloudmark.com.conf
> Nov 26 11:15:44.883832 check[27631]: [ 5] read_file: 16 items read from
> /root/.razor/server.wonder.cloudmark.com.conf
> Nov 26 11:15:44.884384 check[27631]: [ 5] read_file: 14 items read from
> /root/.razor/server.anxiety.cloudmark.com.conf
> Nov 26 11:15:44.884946 check[27631]: [ 5] read_file: 14 items read from
> /root/.razor/server.tension.cloudmark.com.conf
> Nov 26 11:15:44.885523 check[27631]: [ 5] read_file: 16 items read from
> /root/.razor/server.thrill.cloudmark.com.conf
> Nov 26 11:15:44.886150 check[27631]: [ 5] read_file: 14 items read from
> /root/.razor/server.malice.cloudmark.com.conf
> Nov 26 11:15:44.886757 check[27631]: [ 5] read_file: 14 items read from
> /root/.razor/server.shock.cloudmark.com.conf
> Nov 26 11:15:44.887082 check[27631]: [ 5] 154361 seconds before closest
> server discovery
> Nov 26 11:15:44.887338 check[27631]: [ 6] pride.cloudmark.com is a
> Catalogue Server srl 5048; computed min_cf=6, Server se: C8
> Nov 26 11:15:44.887597 check[27631]: [ 8] Computed supported_engines: 4
> Nov 26 11:15:44.887759 check[27631]: [ 8] Using next closest server
> pride.cloudmark.com:2703, cached info srl 5048
> Nov 26 11:15:44.887892 check[27631]: [ 8] mail 1 has no subject
> Nov 26 11:15:44.889464 check[27631]: [ 6] preproc: mail 1.0 went from 1376
> bytes to 1339
> Nov 26 11:15:44.889655 check[27631]: [ 6] computing sigs for mail 1.0, len
> 1339
> Nov 26 11:15:44.891458 check[27631]: [ 6] skipping whitelist file
> (empty?): /root/.razor/razor-whitelist
> Nov 26 11:15:44.891659 check[27631]: [ 5] Connecting to
> pride.cloudmark.com ...
> Nov 26 11:15:44.956354 check[27631]: [ 3] Unable to connect to
> pride.cloudmark.com:2703; Reason: Connection refused.
> Nov 26 11:15:44.956634 check[27631]: [ 5] 161663 seconds before closest
> server discovery
> Nov 26 11:15:44.956874 check[27631]: [ 6] wonder.cloudmark.com is a
> Catalogue Server srl 5048; computed min_cf=6, Server se: C8
> Nov 26 11:15:44.957085 check[27631]: [ 8] Computed supported_engines: 4
> Nov 26 11:15:44.957231 check[27631]: [ 8] Using next closest server
> wonder.cloudmark.com:2703, cached info srl 5048
> Nov 26 11:15:44.957392 check[27631]: [ 5] Connecting to
> wonder.cloudmark.com ...
> Nov 26 11:15:45.077689 check[27631]: [ 8] Connection established
> Nov 26 11:15:45.077888 check[27631]: [ 4] wonder.cloudmark.com >> 36
> server greeting: sn=C&srl=5048&a=l&a=cg&ep4=7542-10
> Nov 26 11:15:45.078283 check[27631]: [ 4] wonder.cloudmark.com << 25
> Nov 26 11:15:45.078369 check[27631]: [ 6] cn=razor-agents&cv=2.36
> Nov 26 11:15:45.078670 check[27631]: [ 6] wonder.cloudmark.com is a
> Catalogue Server srl 5048; computed min_cf=6, Server se: C8
> Nov 26 11:15:45.078891 check[27631]: [ 8] Computed supported_engines: 4
> Nov 26 11:15:45.079110 check[27631]: [ 8] mail 1.0 e4 sig:
> xFaZIZUVHk90OQfARnenjx5BZTMA
> Nov 26 11:15:45.079296 check[27631]: [ 8] preparing 1 queries
> Nov 26 11:15:45.079546 check[27631]: [ 8] sending 1 batches
> Nov 26 11:15:45.079745 check[27631]: [ 4] wonder.cloudmark.com << 52
> Nov 26 11:15:45.079820 check[27631]: [ 6]
> a=c&e=4&ep4=7542-10&s=xFaZIZUVHk90OQfARnenjx5BZTMA
> Nov 26 11:15:45.351281 check[27631]: [ 4] wonder.cloudmark.com >> 5
> Nov 26 11:15:45.351376 check[27631]: [ 6] response to sent.2
> p=0
> Nov 26 11:15:45.351792 check[27631]: [ 6] mail 1.0 e=4
> sig=xFaZIZUVHk90OQfARnenjx5BZTMA: sig not found.
> Nov 26 11:15:45.351954 check[27631]: [ 7] method 4: mail 1.0:
> no-contention part, spam=0
> Nov 26 11:15:45.352034 check[27631]: [ 7] method 4: mail 1: all
> non-contention parts not spam, mail not spam
> Nov 26 11:15:45.352111 check[27631]: [ 3] mail 1 is not known spam.
> Nov 26 11:15:45.352208 check[27631]: [ 5] disconnecting from server
> wonder.cloudmark.com
> Nov 26 11:15:45.352409 check[27631]: [ 4] wonder.cloudmark.com << 5
> Nov 26 11:15:45.352482 check[27631]: [ 6] a=q
> debug: Using results from Razor v2.36
> debug: Found Razor2 part: part=0 engine=4 ct=0 cf=0
> debug: leaving helper-app run mode
> debug: Razor2 results: spam? 0  highest cf score: 0
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
> implements 'check_tick'
> debug: running raw-body-text per-line regexp tests; score so far=-2.623
> debug: running full-text regexp tests; score so far=-2.623
> debug: Razor2 is available
> debug: Current PATH is: /sbin:/bin:/usr/sbin:/usr/bin
> debug: Pyzor is not available: pyzor not found
> debug: Running tests for priority: 500
> debug: RBL: success for 1 of 1 queries
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
> implements 'check_post_dnsbl'
> debug: running meta tests; score so far=-2.623
> debug: running header regexp tests; score so far=-1.053
> debug: running body-text per-line regexp tests; score so far=-1.053
> debug: running uri tests; score so far=-1.053
> debug: running raw-body-text per-line regexp tests; score so far=-1.053
> debug: running full-text regexp tests; score so far=-1.053
> debug: Running tests for priority: 1000
> debug: running meta tests; score so far=-1.053
> debug: running header regexp tests; score so far=-1.053
> debug: lock: 27631 created
> /root/.spamassassin/auto-whitelist.lock.smithers.vbcomm.net.27631
> debug: lock: 27631 trying to get lock on
> /root/.spamassassin/auto-whitelist with 0 retries
> debug: lock: 27631 link to /root/.spamassassin/auto-whitelist.lock: link
> ok
> debug: Tie-ing to DB file R/W in /root/.spamassassin/auto-whitelist
> debug: auto-whitelist (db-based):
> ignore@compiling.spamassassin.taint.org|ip=none scores 0/0
> debug: AWL active, pre-score: -1.053, autolearn score: -1.053, mean:
> undef, IP: undef
> debug: DB addr list: untie-ing and unlocking.
> debug: DB addr list: file locked, breaking lock.
> debug: unlock: 27631 unlink /root/.spamassassin/auto-whitelist.lock
> debug: Post AWL score: -1.053
> debug: running body-text per-line regexp tests; score so far=-1.053
> debug: running uri tests; score so far=-1.053
> debug: running raw-body-text per-line regexp tests; score so far=-1.053
> debug: running full-text regexp tests; score so far=-1.053
> debug: is spam? score=-1.053 required=3.8
> debug: tests=ALL_TRUSTED,MISSING_DATE,MISSING_SUBJECT,NO_REAL_NAME
> debug:
> subtests=__HAS_MSGID,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__SANE_MSGID,__UNUSABLE_MSGID
>
>
>
>
> Matthew K Bowman
> Systems Administrator
> UDCom
> Tel: 419-524-4330
> Fax: 419-524-8757
> Web: http://www.udcom.com
> Email: mbowman@udcom.com
> Support: techsupport@udcom.com
> Sales: sales@udcom.com
>
>
>
>
> Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
> Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> 11/26/2004 11:06 AM
> Please respond to MailScanner mailing list
>
>         To:     MAILSCANNER@JISCMAIL.AC.UK
>         cc:
>         Subject:        Re: Help! - MailScanner ceased working
>
>
> matthew
>
> stop the mailscanner service
>
> edit the MailScanner.conf file and turn on both lots of debug options
>
> run checkmailscanner as the user defined in the MailScanner.conf and
> drop the results back here..
>
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Matthew Bowman wrote:
>
>>Hello
>>
>>MailScanner is running with pid 842 is the only output I get. Both are
>
> run
>
>>by the same user.
>>
>>/var/log/maillog
>>
>>Nov 26 10:08:09 smithers MailScanner[1503]: MailScanner E-Mail Virus
>>Scanner version 4.35.11 starting...
>>Nov 26 10:08:19 smithers MailScanner[1518]: MailScanner E-Mail Virus
>>Scanner version 4.35.11 starting...
>>Nov 26 10:08:29 smithers MailScanner[1519]: MailScanner E-Mail Virus
>>Scanner version 4.35.11 starting...
>>Nov 26 10:08:39 smithers MailScanner[1520]: MailScanner E-Mail Virus
>>Scanner version 4.35.11 starting...
>>Nov 26 10:08:49 smithers MailScanner[1521]: MailScanner E-Mail Virus
>>Scanner version 4.35.11 starting...
>>Nov 26 10:08:59 smithers MailScanner[1524]: MailScanner E-Mail Virus
>>Scanner version 4.35.11 starting...
>>Nov 26 10:09:09 smithers MailScanner[1526]: MailScanner E-Mail Virus
>>Scanner version 4.35.11 starting...
>>Nov 26 10:09:19 smithers MailScanner[1527]: MailScanner E-Mail Virus
>>Scanner version 4.35.11 starting...
>>Nov 26 10:09:29 smithers MailScanner[1528]: MailScanner E-Mail Virus
>>Scanner version 4.35.11 starting...
>>Nov 26 10:09:39 smithers MailScanner[1530]: MailScanner E-Mail Virus
>>Scanner version 4.35.11 starting...
>>
>>ps
>>
>>root       842  0.0  1.2 13908 12524 ?       S    09:32   0:00
>>/usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailS
>>root       843  0.0  0.0     0    0 ?        Z    09:32   0:01
>>[MailScanner <defunct>]
>>root      1039  0.0  0.0     0    0 ?        Z    09:32   0:01
>>[MailScanner <defunct>]
>>root      1040  0.0  0.0     0    0 ?        Z    09:32   0:01
>>[MailScanner <defunct>]
>>root      1041  0.0  0.0     0    0 ?        Z    09:32   0:01
>>[MailScanner <defunct>]
>>root      1042  0.0  0.0     0    0 ?        Z    09:33   0:01
>>[MailScanner <defunct>]
>>root      1043  0.0  0.0     0    0 ?        Z    09:33   0:01
>>[MailScanner <defunct>]
>>root      1044  0.0  0.0     0    0 ?        Z    09:33   0:01
>>[MailScanner <defunct>]
>>root      1045  0.0  0.0     0    0 ?        Z    09:33   0:01
>>[MailScanner <defunct>]
>>root      1046  0.0  0.0     0    0 ?        Z    09:33   0:01
>>[MailScanner <defunct>]
>>root      1539 34.2  0.0     0    0 ?        Z    10:10   0:01
>>[MailScanner <defunct>]
>>
>>Thanks for your help
>>
>>Matthew K Bowman
>>Systems Administrator
>>UDCom
>>Tel: 419-524-4330
>>Fax: 419-524-8757
>>Web: http://www.udcom.com
>>Email: mbowman@udcom.com
>>Support: techsupport@udcom.com
>>Sales: sales@udcom.com
>>
>>
>>
>>
>>Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
>>Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>11/26/2004 09:58 AM
>>Please respond to MailScanner mailing list
>>
>>        To:     MAILSCANNER@JISCMAIL.AC.UK
>>        cc:
>>        Subject:        Re: Help! - MailScanner ceased working
>>
>>
>>Matthew
>>
>>if results are fine from running in debug mode then it should have
>>delivered that batch of emails.....
>>
>>Can you drop the output of the checkmailscanner to the list?
>>
>>also are you running checkmailscanner as the same user MailScanner
>>normally runs as?
>>
>>--
>>Martin Hepworth
>>Snr Systems Administrator
>>Solid State Logic
>>Tel: +44 (0)1865 842300
>>
>>
>>Matthew Bowman wrote:
>>
>>
>>>Hello,
>>>
>>>One of our 3 mailscanner servers has stopped processing e-mail.  There
>>
>>are
>>
>>
>>>no errors in /var/log/maillog or messages that indicate and sort of
>>>problem.  Email arrives and gets put into mqueue.in and just stays
>>
>>there.
>>
>>
>>>Nothing has changed in MailScanner.conf or sendmail.cf.  I'm at a loss
>>
>>as
>>
>>
>>>to how this has happened all of a sudden.  I run mailscanner and
>>>spamassassin in debug mode and the results where fine.  What else should
>>
>>I
>>
>>
>>>be looking at?
>>>
>>>All 3 mailscanner servers run MS 4.35-11, SA 3.0.0 and Redhat 7.3
>>>
>>>Please help!
>>>
>>>Thanks
>>>
>>>Matthew
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>
>>
>>**********************************************************************
>>
>>This email and any files transmitted with it are confidential and
>>intended solely for the use of the individual or entity to whom they
>>are addressed. If you have received this email in error please notify
>>the system manager.
>>
>>This footnote confirms that this email message has been swept
>>for the presence of computer viruses and is believed to be clean.
>>
>>**********************************************************************
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mbowman at UDCOM.COM  Fri Nov 26 17:34:16 2004
From: mbowman at UDCOM.COM (Matthew Bowman)
Date: Thu Jan 12 21:27:42 2006
Subject: Help! - MailScanner ceased working (debug output)
Message-ID: <mailman.5155.1137101262.24926.mailscanner@lists.mailscanner.info>

Not at all, everything goes to mqueue.in, mailscanner (according to
maillog) doesn't scan the email thus its not delivered.

I should be seeing something like:

MailScanner[29593]: New Batch: Found 4 messages waiting
MailScanner[29593]: New Batch: Scanning 1 messages, 4568 bytes
MailScanner[29593]: Virus and Content Scanning: Starting

But dont.

Matthew K Bowman
Systems Administrator
UDCom
Tel: 419-524-4330
Fax: 419-524-8757
Web: http://www.udcom.com
Email: mbowman@udcom.com
Support: techsupport@udcom.com
Sales: sales@udcom.com




Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
11/26/2004 11:34 AM
Please respond to MailScanner mailing list

        To:     MAILSCANNER@JISCMAIL.AC.UK
        cc:
        Subject:        Re: Help! - MailScanner ceased working (debug
output)


matthew

Looks fine - I presume stuff hit the outgoing MTA queue?


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Matthew Bowman wrote:
> Debug output
>
> Starting MailScanner...
> In Debugging mode, not forking...
> debug: SpamAssassin version 3.0.0
> debug: Score set 0 chosen.
> debug: running in taint mode? no
> SA bayes lock is /root/.spamassassin/bayes.lock
> Bayes lock is at /root/.spamassassin/bayes.lock
> debug: ignore: test message to precompile patterns and load modules
> debug: using "/etc/mail/spamassassin/init.pre" for site rules init.pre
> debug: config: read file /etc/mail/spamassassin/init.pre
> debug: using "/usr/share/spamassassin" for default rules dir
> debug: config: read file /usr/share/spamassassin/10_misc.cf
> debug: config: read file /usr/share/spamassassin/20_anti_ratware.cf
> debug: config: read file /usr/share/spamassassin/20_body_tests.cf
> debug: config: read file /usr/share/spamassassin/20_compensate.cf
> debug: config: read file /usr/share/spamassassin/20_dnsbl_tests.cf
> debug: config: read file /usr/share/spamassassin/20_drugs.cf
> debug: config: read file /usr/share/spamassassin/20_fake_helo_tests.cf
> debug: config: read file /usr/share/spamassassin/20_head_tests.cf
> debug: config: read file /usr/share/spamassassin/20_html_tests.cf
> debug: config: read file /usr/share/spamassassin/20_meta_tests.cf
> debug: config: read file /usr/share/spamassassin/20_phrases.cf
> debug: config: read file /usr/share/spamassassin/20_porn.cf
> debug: config: read file /usr/share/spamassassin/20_ratware.cf
> debug: config: read file /usr/share/spamassassin/20_uri_tests.cf
> debug: config: read file /usr/share/spamassassin/23_bayes.cf
> debug: config: read file /usr/share/spamassassin/25_body_tests_es.cf
> debug: config: read file /usr/share/spamassassin/25_hashcash.cf
> debug: config: read file /usr/share/spamassassin/25_spf.cf
> debug: config: read file /usr/share/spamassassin/25_uribl.cf
> debug: config: read file /usr/share/spamassassin/30_text_de.cf
> debug: config: read file /usr/share/spamassassin/30_text_fr.cf
> debug: config: read file /usr/share/spamassassin/30_text_nl.cf
> debug: config: read file /usr/share/spamassassin/30_text_pl.cf
> debug: config: read file /usr/share/spamassassin/50_scores.cf
> debug: config: read file /usr/share/spamassassin/60_whitelist.cf
> debug: using "/etc/mail/spamassassin" for site rules dir
> debug: config: read file /etc/mail/spamassassin/antidrug.cf
> debug: config: read file /etc/mail/spamassassin/bigevil.cf
> debug: config: read file /etc/mail/spamassassin/local.cf
> debug: using "/etc/MailScanner/spam.assassin.prefs.conf" for user prefs
> file
> debug: config: read file /etc/MailScanner/spam.assassin.prefs.conf
> debug: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
> debug: plugin: registered
> Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
> debug: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC
> debug: plugin: registered
> Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40)
> debug: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
> debug: plugin: registered
Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798)
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
> implements 'parse_config'
> debug: plugin: Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40)
> implements 'parse_config'
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
> inhibited further callbacks
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
> inhibited further callbacks
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
> inhibited further callbacks
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
> inhibited further callbacks
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
> inhibited further callbacks
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
> inhibited further callbacks
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
> inhibited further callbacks
> debug: Score set 1 chosen.
> debug: ---- MIME PARSER START ----
> debug: main message type: text/plain
> debug: parsing normal part
> debug: added part, type: text/plain
> debug: ---- MIME PARSER END ----
> debug: metadata: X-Spam-Relays-Trusted:
> debug: metadata: X-Spam-Relays-Untrusted:
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
> implements 'parsed_metadata'
> debug: is Net::DNS::Resolver available? yes
> debug: Net::DNS version: 0.39_01
> debug: trying (3) sourceforge.net...
> debug: looking up NS for 'sourceforge.net'
> debug: NS lookup of sourceforge.net succeeded => Dns available (set
> dns_available to hardcode)
> debug: is DNS available? 1
> debug: decoding: no encoding detected
> debug: URIDNSBL: domains to query:
> debug: all '*From' addrs: ignore@compiling.spamassassin.taint.org
> debug: Running tests for priority: 0
> debug: running header regexp tests; score so far=0
> debug: registering glue method for check_uridnsbl
> (Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810))
> debug: registering glue method for check_for_spf_pass
> (Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
> debug: SPF: message was delivered entirely via trusted relays, not
> required
> debug: all '*To' addrs:
> debug: registering glue method for check_hashcash_value
> (Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40))
> debug: registering glue method for check_for_spf_helo_fail
> (Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
> debug: SPF: message was delivered entirely via trusted relays, not
> required
> debug: registering glue method for check_for_spf_helo_pass
> (Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
> debug: registering glue method for check_hashcash_double_spend
> (Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40))
> debug: registering glue method for check_for_spf_softfail
> (Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
> debug: registering glue method for check_for_spf_helo_softfail
> (Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
> debug: running body-text per-line regexp tests; score so far=-2.623
> debug: running uri tests; score so far=-2.623
> debug: Razor2 is available
> debug: entering helper-app run mode
>  Razor-Log: Computed razorhome from env: /root/.razor
>  Razor-Log: Found razorhome: /root/.razor
>  Razor-Log: read_file: 16 items read from /root/.razor/razor-agent.conf
> Nov 26 11:15:44.875895 check[27631]: [ 1] [bootup] Logging initiated
> LogDebugLevel=9 to stdout
> Nov 26 11:15:44.876392 check[27631]: [ 5] computed
razorhome=/root/.razor,
> conf=/root/.razor/razor-agent.conf, ident=/root/.razor/identity
> Nov 26 11:15:44.876648 check[27631]: [ 8] Client supported_engines: 1 2
3
> 4
> Nov 26 11:15:44.877247 check[27631]: [ 8]  prep_mail done: mail 1
> headers=102, mime0=1376
> Nov 26 11:15:44.877704 check[27631]: [ 5] read_file: 8 items read from
> /root/.razor/servers.discovery.lst
> Nov 26 11:15:44.878063 check[27631]: [ 5] read_file: 2 items read from
> /root/.razor/servers.nomination.lst
> Nov 26 11:15:44.878331 check[27631]: [ 5] read_file: 3 items read from
> /root/.razor/servers.catalogue.lst
> Nov 26 11:15:44.878740 check[27631]: [ 9] Assigning defaults to
> joy.cloudmark.com
> Nov 26 11:15:44.878926 check[27631]: [ 9] Assigning defaults to
> folly.cloudmark.com
> Nov 26 11:15:44.879179 check[27631]: [ 9] Assigning defaults to
> pride.cloudmark.com
> Nov 26 11:15:44.879383 check[27631]: [ 9] Assigning defaults to
> wonder.cloudmark.com
> Nov 26 11:15:44.879559 check[27631]: [ 9] Assigning defaults to
> thrill.cloudmark.com
> Nov 26 11:15:44.880412 check[27631]: [ 5] read_file: 14 items read from
> /root/.razor/server.truth.cloudmark.com.conf
> Nov 26 11:15:44.881004 check[27631]: [ 5] read_file: 14 items read from
> /root/.razor/server.stress.cloudmark.com.conf
> Nov 26 11:15:44.881542 check[27631]: [ 5] read_file: 12 items read from
> /root/.razor/server.folly.cloudmark.com.conf
> Nov 26 11:15:44.882114 check[27631]: [ 5] read_file: 14 items read from
> /root/.razor/server.rancor.cloudmark.com.conf
> Nov 26 11:15:44.882702 check[27631]: [ 5] read_file: 16 items read from
> /root/.razor/server.pride.cloudmark.com.conf
> Nov 26 11:15:44.883256 check[27631]: [ 5] read_file: 14 items read from
> /root/.razor/server.prejudice.cloudmark.com.conf
> Nov 26 11:15:44.883832 check[27631]: [ 5] read_file: 16 items read from
> /root/.razor/server.wonder.cloudmark.com.conf
> Nov 26 11:15:44.884384 check[27631]: [ 5] read_file: 14 items read from
> /root/.razor/server.anxiety.cloudmark.com.conf
> Nov 26 11:15:44.884946 check[27631]: [ 5] read_file: 14 items read from
> /root/.razor/server.tension.cloudmark.com.conf
> Nov 26 11:15:44.885523 check[27631]: [ 5] read_file: 16 items read from
> /root/.razor/server.thrill.cloudmark.com.conf
> Nov 26 11:15:44.886150 check[27631]: [ 5] read_file: 14 items read from
> /root/.razor/server.malice.cloudmark.com.conf
> Nov 26 11:15:44.886757 check[27631]: [ 5] read_file: 14 items read from
> /root/.razor/server.shock.cloudmark.com.conf
> Nov 26 11:15:44.887082 check[27631]: [ 5] 154361 seconds before closest
> server discovery
> Nov 26 11:15:44.887338 check[27631]: [ 6] pride.cloudmark.com is a
> Catalogue Server srl 5048; computed min_cf=6, Server se: C8
> Nov 26 11:15:44.887597 check[27631]: [ 8] Computed supported_engines: 4
> Nov 26 11:15:44.887759 check[27631]: [ 8] Using next closest server
> pride.cloudmark.com:2703, cached info srl 5048
> Nov 26 11:15:44.887892 check[27631]: [ 8] mail 1 has no subject
> Nov 26 11:15:44.889464 check[27631]: [ 6] preproc: mail 1.0 went from
1376
> bytes to 1339
> Nov 26 11:15:44.889655 check[27631]: [ 6] computing sigs for mail 1.0,
len
> 1339
> Nov 26 11:15:44.891458 check[27631]: [ 6] skipping whitelist file
> (empty?): /root/.razor/razor-whitelist
> Nov 26 11:15:44.891659 check[27631]: [ 5] Connecting to
> pride.cloudmark.com ...
> Nov 26 11:15:44.956354 check[27631]: [ 3] Unable to connect to
> pride.cloudmark.com:2703; Reason: Connection refused.
> Nov 26 11:15:44.956634 check[27631]: [ 5] 161663 seconds before closest
> server discovery
> Nov 26 11:15:44.956874 check[27631]: [ 6] wonder.cloudmark.com is a
> Catalogue Server srl 5048; computed min_cf=6, Server se: C8
> Nov 26 11:15:44.957085 check[27631]: [ 8] Computed supported_engines: 4
> Nov 26 11:15:44.957231 check[27631]: [ 8] Using next closest server
> wonder.cloudmark.com:2703, cached info srl 5048
> Nov 26 11:15:44.957392 check[27631]: [ 5] Connecting to
> wonder.cloudmark.com ...
> Nov 26 11:15:45.077689 check[27631]: [ 8] Connection established
> Nov 26 11:15:45.077888 check[27631]: [ 4] wonder.cloudmark.com >> 36
> server greeting: sn=C&srl=5048&a=l&a=cg&ep4=7542-10
> Nov 26 11:15:45.078283 check[27631]: [ 4] wonder.cloudmark.com << 25
> Nov 26 11:15:45.078369 check[27631]: [ 6] cn=razor-agents&cv=2.36
> Nov 26 11:15:45.078670 check[27631]: [ 6] wonder.cloudmark.com is a
> Catalogue Server srl 5048; computed min_cf=6, Server se: C8
> Nov 26 11:15:45.078891 check[27631]: [ 8] Computed supported_engines: 4
> Nov 26 11:15:45.079110 check[27631]: [ 8] mail 1.0 e4 sig:
> xFaZIZUVHk90OQfARnenjx5BZTMA
> Nov 26 11:15:45.079296 check[27631]: [ 8] preparing 1 queries
> Nov 26 11:15:45.079546 check[27631]: [ 8] sending 1 batches
> Nov 26 11:15:45.079745 check[27631]: [ 4] wonder.cloudmark.com << 52
> Nov 26 11:15:45.079820 check[27631]: [ 6]
> a=c&e=4&ep4=7542-10&s=xFaZIZUVHk90OQfARnenjx5BZTMA
> Nov 26 11:15:45.351281 check[27631]: [ 4] wonder.cloudmark.com >> 5
> Nov 26 11:15:45.351376 check[27631]: [ 6] response to sent.2
> p=0
> Nov 26 11:15:45.351792 check[27631]: [ 6] mail 1.0 e=4
> sig=xFaZIZUVHk90OQfARnenjx5BZTMA: sig not found.
> Nov 26 11:15:45.351954 check[27631]: [ 7] method 4: mail 1.0:
> no-contention part, spam=0
> Nov 26 11:15:45.352034 check[27631]: [ 7] method 4: mail 1: all
> non-contention parts not spam, mail not spam
> Nov 26 11:15:45.352111 check[27631]: [ 3] mail 1 is not known spam.
> Nov 26 11:15:45.352208 check[27631]: [ 5] disconnecting from server
> wonder.cloudmark.com
> Nov 26 11:15:45.352409 check[27631]: [ 4] wonder.cloudmark.com << 5
> Nov 26 11:15:45.352482 check[27631]: [ 6] a=q
> debug: Using results from Razor v2.36
> debug: Found Razor2 part: part=0 engine=4 ct=0 cf=0
> debug: leaving helper-app run mode
> debug: Razor2 results: spam? 0  highest cf score: 0
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
> implements 'check_tick'
> debug: running raw-body-text per-line regexp tests; score so far=-2.623
> debug: running full-text regexp tests; score so far=-2.623
> debug: Razor2 is available
> debug: Current PATH is: /sbin:/bin:/usr/sbin:/usr/bin
> debug: Pyzor is not available: pyzor not found
> debug: Running tests for priority: 500
> debug: RBL: success for 1 of 1 queries
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
> implements 'check_post_dnsbl'
> debug: running meta tests; score so far=-2.623
> debug: running header regexp tests; score so far=-1.053
> debug: running body-text per-line regexp tests; score so far=-1.053
> debug: running uri tests; score so far=-1.053
> debug: running raw-body-text per-line regexp tests; score so far=-1.053
> debug: running full-text regexp tests; score so far=-1.053
> debug: Running tests for priority: 1000
> debug: running meta tests; score so far=-1.053
> debug: running header regexp tests; score so far=-1.053
> debug: lock: 27631 created
> /root/.spamassassin/auto-whitelist.lock.smithers.vbcomm.net.27631
> debug: lock: 27631 trying to get lock on
> /root/.spamassassin/auto-whitelist with 0 retries
> debug: lock: 27631 link to /root/.spamassassin/auto-whitelist.lock: link
> ok
> debug: Tie-ing to DB file R/W in /root/.spamassassin/auto-whitelist
> debug: auto-whitelist (db-based):
> ignore@compiling.spamassassin.taint.org|ip=none scores 0/0
> debug: AWL active, pre-score: -1.053, autolearn score: -1.053, mean:
> undef, IP: undef
> debug: DB addr list: untie-ing and unlocking.
> debug: DB addr list: file locked, breaking lock.
> debug: unlock: 27631 unlink /root/.spamassassin/auto-whitelist.lock
> debug: Post AWL score: -1.053
> debug: running body-text per-line regexp tests; score so far=-1.053
> debug: running uri tests; score so far=-1.053
> debug: running raw-body-text per-line regexp tests; score so far=-1.053
> debug: running full-text regexp tests; score so far=-1.053
> debug: is spam? score=-1.053 required=3.8
> debug: tests=ALL_TRUSTED,MISSING_DATE,MISSING_SUBJECT,NO_REAL_NAME
> debug:
>
subtests=__HAS_MSGID,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__SANE_MSGID,__UNUSABLE_MSGID
>
>
>
>
> Matthew K Bowman
> Systems Administrator
> UDCom
> Tel: 419-524-4330
> Fax: 419-524-8757
> Web: http://www.udcom.com
> Email: mbowman@udcom.com
> Support: techsupport@udcom.com
> Sales: sales@udcom.com
>
>
>
>
> Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
> Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> 11/26/2004 11:06 AM
> Please respond to MailScanner mailing list
>
>         To:     MAILSCANNER@JISCMAIL.AC.UK
>         cc:
>         Subject:        Re: Help! - MailScanner ceased working
>
>
> matthew
>
> stop the mailscanner service
>
> edit the MailScanner.conf file and turn on both lots of debug options
>
> run checkmailscanner as the user defined in the MailScanner.conf and
> drop the results back here..
>
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Matthew Bowman wrote:
>
>>Hello
>>
>>MailScanner is running with pid 842 is the only output I get. Both are
>
> run
>
>>by the same user.
>>
>>/var/log/maillog
>>
>>Nov 26 10:08:09 smithers MailScanner[1503]: MailScanner E-Mail Virus
>>Scanner version 4.35.11 starting...
>>Nov 26 10:08:19 smithers MailScanner[1518]: MailScanner E-Mail Virus
>>Scanner version 4.35.11 starting...
>>Nov 26 10:08:29 smithers MailScanner[1519]: MailScanner E-Mail Virus
>>Scanner version 4.35.11 starting...
>>Nov 26 10:08:39 smithers MailScanner[1520]: MailScanner E-Mail Virus
>>Scanner version 4.35.11 starting...
>>Nov 26 10:08:49 smithers MailScanner[1521]: MailScanner E-Mail Virus
>>Scanner version 4.35.11 starting...
>>Nov 26 10:08:59 smithers MailScanner[1524]: MailScanner E-Mail Virus
>>Scanner version 4.35.11 starting...
>>Nov 26 10:09:09 smithers MailScanner[1526]: MailScanner E-Mail Virus
>>Scanner version 4.35.11 starting...
>>Nov 26 10:09:19 smithers MailScanner[1527]: MailScanner E-Mail Virus
>>Scanner version 4.35.11 starting...
>>Nov 26 10:09:29 smithers MailScanner[1528]: MailScanner E-Mail Virus
>>Scanner version 4.35.11 starting...
>>Nov 26 10:09:39 smithers MailScanner[1530]: MailScanner E-Mail Virus
>>Scanner version 4.35.11 starting...
>>
>>ps
>>
>>root       842  0.0  1.2 13908 12524 ?       S    09:32   0:00
>>/usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailS
>>root       843  0.0  0.0     0    0 ?        Z    09:32   0:01
>>[MailScanner <defunct>]
>>root      1039  0.0  0.0     0    0 ?        Z    09:32   0:01
>>[MailScanner <defunct>]
>>root      1040  0.0  0.0     0    0 ?        Z    09:32   0:01
>>[MailScanner <defunct>]
>>root      1041  0.0  0.0     0    0 ?        Z    09:32   0:01
>>[MailScanner <defunct>]
>>root      1042  0.0  0.0     0    0 ?        Z    09:33   0:01
>>[MailScanner <defunct>]
>>root      1043  0.0  0.0     0    0 ?        Z    09:33   0:01
>>[MailScanner <defunct>]
>>root      1044  0.0  0.0     0    0 ?        Z    09:33   0:01
>>[MailScanner <defunct>]
>>root      1045  0.0  0.0     0    0 ?        Z    09:33   0:01
>>[MailScanner <defunct>]
>>root      1046  0.0  0.0     0    0 ?        Z    09:33   0:01
>>[MailScanner <defunct>]
>>root      1539 34.2  0.0     0    0 ?        Z    10:10   0:01
>>[MailScanner <defunct>]
>>
>>Thanks for your help
>>
>>Matthew K Bowman
>>Systems Administrator
>>UDCom
>>Tel: 419-524-4330
>>Fax: 419-524-8757
>>Web: http://www.udcom.com
>>Email: mbowman@udcom.com
>>Support: techsupport@udcom.com
>>Sales: sales@udcom.com
>>
>>
>>
>>
>>Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
>>Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>11/26/2004 09:58 AM
>>Please respond to MailScanner mailing list
>>
>>        To:     MAILSCANNER@JISCMAIL.AC.UK
>>        cc:
>>        Subject:        Re: Help! - MailScanner ceased working
>>
>>
>>Matthew
>>
>>if results are fine from running in debug mode then it should have
>>delivered that batch of emails.....
>>
>>Can you drop the output of the checkmailscanner to the list?
>>
>>also are you running checkmailscanner as the same user MailScanner
>>normally runs as?
>>
>>--
>>Martin Hepworth
>>Snr Systems Administrator
>>Solid State Logic
>>Tel: +44 (0)1865 842300
>>
>>
>>Matthew Bowman wrote:
>>
>>
>>>Hello,
>>>
>>>One of our 3 mailscanner servers has stopped processing e-mail.  There
>>
>>are
>>
>>
>>>no errors in /var/log/maillog or messages that indicate and sort of
>>>problem.  Email arrives and gets put into mqueue.in and just stays
>>
>>there.
>>
>>
>>>Nothing has changed in MailScanner.conf or sendmail.cf.  I'm at a loss
>>
>>as
>>
>>
>>>to how this has happened all of a sudden.  I run mailscanner and
>>>spamassassin in debug mode and the results where fine.  What else
should
>>
>>I
>>
>>
>>>be looking at?
>>>
>>>All 3 mailscanner servers run MS 4.35-11, SA 3.0.0 and Redhat 7.3
>>>
>>>Please help!
>>>
>>>Thanks
>>>
>>>Matthew
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>
>>
>>**********************************************************************
>>
>>This email and any files transmitted with it are confidential and
>>intended solely for the use of the individual or entity to whom they
>>are addressed. If you have received this email in error please notify
>>the system manager.
>>
>>This footnote confirms that this email message has been swept
>>for the presence of computer viruses and is believed to be clean.
>>
>>**********************************************************************
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Fri Nov 26 16:42:18 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:42 2006
Subject: Help! - MailScanner ceased working (debug output)
Message-ID: <mailman.5156.1137101262.24926.mailscanner@lists.mailscanner.info>

Matthew

that'll be normal. the other '3' are already being scanned by other
MailScanner children.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Matthew Bowman wrote:
> Not at all, everything goes to mqueue.in, mailscanner (according to
> maillog) doesn't scan the email thus its not delivered.
>
> I should be seeing something like:
>
> MailScanner[29593]: New Batch: Found 4 messages waiting
> MailScanner[29593]: New Batch: Scanning 1 messages, 4568 bytes
> MailScanner[29593]: Virus and Content Scanning: Starting
>
> But dont.
>
> Matthew K Bowman
> Systems Administrator
> UDCom
> Tel: 419-524-4330
> Fax: 419-524-8757
> Web: http://www.udcom.com
> Email: mbowman@udcom.com
> Support: techsupport@udcom.com
> Sales: sales@udcom.com
>
>
>
>
> Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
> Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> 11/26/2004 11:34 AM
> Please respond to MailScanner mailing list
>
>         To:     MAILSCANNER@JISCMAIL.AC.UK
>         cc:
>         Subject:        Re: Help! - MailScanner ceased working (debug
> output)
>
>
> matthew
>
> Looks fine - I presume stuff hit the outgoing MTA queue?
>
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Matthew Bowman wrote:
>
>>Debug output
>>
>>Starting MailScanner...
>>In Debugging mode, not forking...
>>debug: SpamAssassin version 3.0.0
>>debug: Score set 0 chosen.
>>debug: running in taint mode? no
>>SA bayes lock is /root/.spamassassin/bayes.lock
>>Bayes lock is at /root/.spamassassin/bayes.lock
>>debug: ignore: test message to precompile patterns and load modules
>>debug: using "/etc/mail/spamassassin/init.pre" for site rules init.pre
>>debug: config: read file /etc/mail/spamassassin/init.pre
>>debug: using "/usr/share/spamassassin" for default rules dir
>>debug: config: read file /usr/share/spamassassin/10_misc.cf
>>debug: config: read file /usr/share/spamassassin/20_anti_ratware.cf
>>debug: config: read file /usr/share/spamassassin/20_body_tests.cf
>>debug: config: read file /usr/share/spamassassin/20_compensate.cf
>>debug: config: read file /usr/share/spamassassin/20_dnsbl_tests.cf
>>debug: config: read file /usr/share/spamassassin/20_drugs.cf
>>debug: config: read file /usr/share/spamassassin/20_fake_helo_tests.cf
>>debug: config: read file /usr/share/spamassassin/20_head_tests.cf
>>debug: config: read file /usr/share/spamassassin/20_html_tests.cf
>>debug: config: read file /usr/share/spamassassin/20_meta_tests.cf
>>debug: config: read file /usr/share/spamassassin/20_phrases.cf
>>debug: config: read file /usr/share/spamassassin/20_porn.cf
>>debug: config: read file /usr/share/spamassassin/20_ratware.cf
>>debug: config: read file /usr/share/spamassassin/20_uri_tests.cf
>>debug: config: read file /usr/share/spamassassin/23_bayes.cf
>>debug: config: read file /usr/share/spamassassin/25_body_tests_es.cf
>>debug: config: read file /usr/share/spamassassin/25_hashcash.cf
>>debug: config: read file /usr/share/spamassassin/25_spf.cf
>>debug: config: read file /usr/share/spamassassin/25_uribl.cf
>>debug: config: read file /usr/share/spamassassin/30_text_de.cf
>>debug: config: read file /usr/share/spamassassin/30_text_fr.cf
>>debug: config: read file /usr/share/spamassassin/30_text_nl.cf
>>debug: config: read file /usr/share/spamassassin/30_text_pl.cf
>>debug: config: read file /usr/share/spamassassin/50_scores.cf
>>debug: config: read file /usr/share/spamassassin/60_whitelist.cf
>>debug: using "/etc/mail/spamassassin" for site rules dir
>>debug: config: read file /etc/mail/spamassassin/antidrug.cf
>>debug: config: read file /etc/mail/spamassassin/bigevil.cf
>>debug: config: read file /etc/mail/spamassassin/local.cf
>>debug: using "/etc/MailScanner/spam.assassin.prefs.conf" for user prefs
>>file
>>debug: config: read file /etc/MailScanner/spam.assassin.prefs.conf
>>debug: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
>>debug: plugin: registered
>>Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>debug: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC
>>debug: plugin: registered
>>Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40)
>>debug: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
>>debug: plugin: registered
>
> Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798)
>
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>implements 'parse_config'
>>debug: plugin: Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40)
>>implements 'parse_config'
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: Score set 1 chosen.
>>debug: ---- MIME PARSER START ----
>>debug: main message type: text/plain
>>debug: parsing normal part
>>debug: added part, type: text/plain
>>debug: ---- MIME PARSER END ----
>>debug: metadata: X-Spam-Relays-Trusted:
>>debug: metadata: X-Spam-Relays-Untrusted:
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>implements 'parsed_metadata'
>>debug: is Net::DNS::Resolver available? yes
>>debug: Net::DNS version: 0.39_01
>>debug: trying (3) sourceforge.net...
>>debug: looking up NS for 'sourceforge.net'
>>debug: NS lookup of sourceforge.net succeeded => Dns available (set
>>dns_available to hardcode)
>>debug: is DNS available? 1
>>debug: decoding: no encoding detected
>>debug: URIDNSBL: domains to query:
>>debug: all '*From' addrs: ignore@compiling.spamassassin.taint.org
>>debug: Running tests for priority: 0
>>debug: running header regexp tests; score so far=0
>>debug: registering glue method for check_uridnsbl
>>(Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810))
>>debug: registering glue method for check_for_spf_pass
>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>debug: SPF: message was delivered entirely via trusted relays, not
>>required
>>debug: all '*To' addrs:
>>debug: registering glue method for check_hashcash_value
>>(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40))
>>debug: registering glue method for check_for_spf_helo_fail
>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>debug: SPF: message was delivered entirely via trusted relays, not
>>required
>>debug: registering glue method for check_for_spf_helo_pass
>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>debug: registering glue method for check_hashcash_double_spend
>>(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40))
>>debug: registering glue method for check_for_spf_softfail
>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>debug: registering glue method for check_for_spf_helo_softfail
>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>debug: running body-text per-line regexp tests; score so far=-2.623
>>debug: running uri tests; score so far=-2.623
>>debug: Razor2 is available
>>debug: entering helper-app run mode
>> Razor-Log: Computed razorhome from env: /root/.razor
>> Razor-Log: Found razorhome: /root/.razor
>> Razor-Log: read_file: 16 items read from /root/.razor/razor-agent.conf
>>Nov 26 11:15:44.875895 check[27631]: [ 1] [bootup] Logging initiated
>>LogDebugLevel=9 to stdout
>>Nov 26 11:15:44.876392 check[27631]: [ 5] computed
>
> razorhome=/root/.razor,
>
>>conf=/root/.razor/razor-agent.conf, ident=/root/.razor/identity
>>Nov 26 11:15:44.876648 check[27631]: [ 8] Client supported_engines: 1 2
>
> 3
>
>>4
>>Nov 26 11:15:44.877247 check[27631]: [ 8]  prep_mail done: mail 1
>>headers=102, mime0=1376
>>Nov 26 11:15:44.877704 check[27631]: [ 5] read_file: 8 items read from
>>/root/.razor/servers.discovery.lst
>>Nov 26 11:15:44.878063 check[27631]: [ 5] read_file: 2 items read from
>>/root/.razor/servers.nomination.lst
>>Nov 26 11:15:44.878331 check[27631]: [ 5] read_file: 3 items read from
>>/root/.razor/servers.catalogue.lst
>>Nov 26 11:15:44.878740 check[27631]: [ 9] Assigning defaults to
>>joy.cloudmark.com
>>Nov 26 11:15:44.878926 check[27631]: [ 9] Assigning defaults to
>>folly.cloudmark.com
>>Nov 26 11:15:44.879179 check[27631]: [ 9] Assigning defaults to
>>pride.cloudmark.com
>>Nov 26 11:15:44.879383 check[27631]: [ 9] Assigning defaults to
>>wonder.cloudmark.com
>>Nov 26 11:15:44.879559 check[27631]: [ 9] Assigning defaults to
>>thrill.cloudmark.com
>>Nov 26 11:15:44.880412 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.truth.cloudmark.com.conf
>>Nov 26 11:15:44.881004 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.stress.cloudmark.com.conf
>>Nov 26 11:15:44.881542 check[27631]: [ 5] read_file: 12 items read from
>>/root/.razor/server.folly.cloudmark.com.conf
>>Nov 26 11:15:44.882114 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.rancor.cloudmark.com.conf
>>Nov 26 11:15:44.882702 check[27631]: [ 5] read_file: 16 items read from
>>/root/.razor/server.pride.cloudmark.com.conf
>>Nov 26 11:15:44.883256 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.prejudice.cloudmark.com.conf
>>Nov 26 11:15:44.883832 check[27631]: [ 5] read_file: 16 items read from
>>/root/.razor/server.wonder.cloudmark.com.conf
>>Nov 26 11:15:44.884384 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.anxiety.cloudmark.com.conf
>>Nov 26 11:15:44.884946 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.tension.cloudmark.com.conf
>>Nov 26 11:15:44.885523 check[27631]: [ 5] read_file: 16 items read from
>>/root/.razor/server.thrill.cloudmark.com.conf
>>Nov 26 11:15:44.886150 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.malice.cloudmark.com.conf
>>Nov 26 11:15:44.886757 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.shock.cloudmark.com.conf
>>Nov 26 11:15:44.887082 check[27631]: [ 5] 154361 seconds before closest
>>server discovery
>>Nov 26 11:15:44.887338 check[27631]: [ 6] pride.cloudmark.com is a
>>Catalogue Server srl 5048; computed min_cf=6, Server se: C8
>>Nov 26 11:15:44.887597 check[27631]: [ 8] Computed supported_engines: 4
>>Nov 26 11:15:44.887759 check[27631]: [ 8] Using next closest server
>>pride.cloudmark.com:2703, cached info srl 5048
>>Nov 26 11:15:44.887892 check[27631]: [ 8] mail 1 has no subject
>>Nov 26 11:15:44.889464 check[27631]: [ 6] preproc: mail 1.0 went from
>
> 1376
>
>>bytes to 1339
>>Nov 26 11:15:44.889655 check[27631]: [ 6] computing sigs for mail 1.0,
>
> len
>
>>1339
>>Nov 26 11:15:44.891458 check[27631]: [ 6] skipping whitelist file
>>(empty?): /root/.razor/razor-whitelist
>>Nov 26 11:15:44.891659 check[27631]: [ 5] Connecting to
>>pride.cloudmark.com ...
>>Nov 26 11:15:44.956354 check[27631]: [ 3] Unable to connect to
>>pride.cloudmark.com:2703; Reason: Connection refused.
>>Nov 26 11:15:44.956634 check[27631]: [ 5] 161663 seconds before closest
>>server discovery
>>Nov 26 11:15:44.956874 check[27631]: [ 6] wonder.cloudmark.com is a
>>Catalogue Server srl 5048; computed min_cf=6, Server se: C8
>>Nov 26 11:15:44.957085 check[27631]: [ 8] Computed supported_engines: 4
>>Nov 26 11:15:44.957231 check[27631]: [ 8] Using next closest server
>>wonder.cloudmark.com:2703, cached info srl 5048
>>Nov 26 11:15:44.957392 check[27631]: [ 5] Connecting to
>>wonder.cloudmark.com ...
>>Nov 26 11:15:45.077689 check[27631]: [ 8] Connection established
>>Nov 26 11:15:45.077888 check[27631]: [ 4] wonder.cloudmark.com >> 36
>>server greeting: sn=C&srl=5048&a=l&a=cg&ep4=7542-10
>>Nov 26 11:15:45.078283 check[27631]: [ 4] wonder.cloudmark.com << 25
>>Nov 26 11:15:45.078369 check[27631]: [ 6] cn=razor-agents&cv=2.36
>>Nov 26 11:15:45.078670 check[27631]: [ 6] wonder.cloudmark.com is a
>>Catalogue Server srl 5048; computed min_cf=6, Server se: C8
>>Nov 26 11:15:45.078891 check[27631]: [ 8] Computed supported_engines: 4
>>Nov 26 11:15:45.079110 check[27631]: [ 8] mail 1.0 e4 sig:
>>xFaZIZUVHk90OQfARnenjx5BZTMA
>>Nov 26 11:15:45.079296 check[27631]: [ 8] preparing 1 queries
>>Nov 26 11:15:45.079546 check[27631]: [ 8] sending 1 batches
>>Nov 26 11:15:45.079745 check[27631]: [ 4] wonder.cloudmark.com << 52
>>Nov 26 11:15:45.079820 check[27631]: [ 6]
>>a=c&e=4&ep4=7542-10&s=xFaZIZUVHk90OQfARnenjx5BZTMA
>>Nov 26 11:15:45.351281 check[27631]: [ 4] wonder.cloudmark.com >> 5
>>Nov 26 11:15:45.351376 check[27631]: [ 6] response to sent.2
>>p=0
>>Nov 26 11:15:45.351792 check[27631]: [ 6] mail 1.0 e=4
>>sig=xFaZIZUVHk90OQfARnenjx5BZTMA: sig not found.
>>Nov 26 11:15:45.351954 check[27631]: [ 7] method 4: mail 1.0:
>>no-contention part, spam=0
>>Nov 26 11:15:45.352034 check[27631]: [ 7] method 4: mail 1: all
>>non-contention parts not spam, mail not spam
>>Nov 26 11:15:45.352111 check[27631]: [ 3] mail 1 is not known spam.
>>Nov 26 11:15:45.352208 check[27631]: [ 5] disconnecting from server
>>wonder.cloudmark.com
>>Nov 26 11:15:45.352409 check[27631]: [ 4] wonder.cloudmark.com << 5
>>Nov 26 11:15:45.352482 check[27631]: [ 6] a=q
>>debug: Using results from Razor v2.36
>>debug: Found Razor2 part: part=0 engine=4 ct=0 cf=0
>>debug: leaving helper-app run mode
>>debug: Razor2 results: spam? 0  highest cf score: 0
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>implements 'check_tick'
>>debug: running raw-body-text per-line regexp tests; score so far=-2.623
>>debug: running full-text regexp tests; score so far=-2.623
>>debug: Razor2 is available
>>debug: Current PATH is: /sbin:/bin:/usr/sbin:/usr/bin
>>debug: Pyzor is not available: pyzor not found
>>debug: Running tests for priority: 500
>>debug: RBL: success for 1 of 1 queries
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>implements 'check_post_dnsbl'
>>debug: running meta tests; score so far=-2.623
>>debug: running header regexp tests; score so far=-1.053
>>debug: running body-text per-line regexp tests; score so far=-1.053
>>debug: running uri tests; score so far=-1.053
>>debug: running raw-body-text per-line regexp tests; score so far=-1.053
>>debug: running full-text regexp tests; score so far=-1.053
>>debug: Running tests for priority: 1000
>>debug: running meta tests; score so far=-1.053
>>debug: running header regexp tests; score so far=-1.053
>>debug: lock: 27631 created
>>/root/.spamassassin/auto-whitelist.lock.smithers.vbcomm.net.27631
>>debug: lock: 27631 trying to get lock on
>>/root/.spamassassin/auto-whitelist with 0 retries
>>debug: lock: 27631 link to /root/.spamassassin/auto-whitelist.lock: link
>>ok
>>debug: Tie-ing to DB file R/W in /root/.spamassassin/auto-whitelist
>>debug: auto-whitelist (db-based):
>>ignore@compiling.spamassassin.taint.org|ip=none scores 0/0
>>debug: AWL active, pre-score: -1.053, autolearn score: -1.053, mean:
>>undef, IP: undef
>>debug: DB addr list: untie-ing and unlocking.
>>debug: DB addr list: file locked, breaking lock.
>>debug: unlock: 27631 unlink /root/.spamassassin/auto-whitelist.lock
>>debug: Post AWL score: -1.053
>>debug: running body-text per-line regexp tests; score so far=-1.053
>>debug: running uri tests; score so far=-1.053
>>debug: running raw-body-text per-line regexp tests; score so far=-1.053
>>debug: running full-text regexp tests; score so far=-1.053
>>debug: is spam? score=-1.053 required=3.8
>>debug: tests=ALL_TRUSTED,MISSING_DATE,MISSING_SUBJECT,NO_REAL_NAME
>>debug:
>>
>
> subtests=__HAS_MSGID,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__SANE_MSGID,__UNUSABLE_MSGID
>
>>
>>
>>
>>Matthew K Bowman
>>Systems Administrator
>>UDCom
>>Tel: 419-524-4330
>>Fax: 419-524-8757
>>Web: http://www.udcom.com
>>Email: mbowman@udcom.com
>>Support: techsupport@udcom.com
>>Sales: sales@udcom.com
>>
>>
>>
>>
>>Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
>>Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>11/26/2004 11:06 AM
>>Please respond to MailScanner mailing list
>>
>>        To:     MAILSCANNER@JISCMAIL.AC.UK
>>        cc:
>>        Subject:        Re: Help! - MailScanner ceased working
>>
>>
>>matthew
>>
>>stop the mailscanner service
>>
>>edit the MailScanner.conf file and turn on both lots of debug options
>>
>>run checkmailscanner as the user defined in the MailScanner.conf and
>>drop the results back here..
>>
>>
>>--
>>Martin Hepworth
>>Snr Systems Administrator
>>Solid State Logic
>>Tel: +44 (0)1865 842300
>>
>>
>>Matthew Bowman wrote:
>>
>>
>>>Hello
>>>
>>>MailScanner is running with pid 842 is the only output I get. Both are
>>
>>run
>>
>>
>>>by the same user.
>>>
>>>/var/log/maillog
>>>
>>>Nov 26 10:08:09 smithers MailScanner[1503]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:08:19 smithers MailScanner[1518]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:08:29 smithers MailScanner[1519]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:08:39 smithers MailScanner[1520]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:08:49 smithers MailScanner[1521]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:08:59 smithers MailScanner[1524]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:09:09 smithers MailScanner[1526]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:09:19 smithers MailScanner[1527]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:09:29 smithers MailScanner[1528]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:09:39 smithers MailScanner[1530]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>
>>>ps
>>>
>>>root       842  0.0  1.2 13908 12524 ?       S    09:32   0:00
>>>/usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailS
>>>root       843  0.0  0.0     0    0 ?        Z    09:32   0:01
>>>[MailScanner <defunct>]
>>>root      1039  0.0  0.0     0    0 ?        Z    09:32   0:01
>>>[MailScanner <defunct>]
>>>root      1040  0.0  0.0     0    0 ?        Z    09:32   0:01
>>>[MailScanner <defunct>]
>>>root      1041  0.0  0.0     0    0 ?        Z    09:32   0:01
>>>[MailScanner <defunct>]
>>>root      1042  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>[MailScanner <defunct>]
>>>root      1043  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>[MailScanner <defunct>]
>>>root      1044  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>[MailScanner <defunct>]
>>>root      1045  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>[MailScanner <defunct>]
>>>root      1046  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>[MailScanner <defunct>]
>>>root      1539 34.2  0.0     0    0 ?        Z    10:10   0:01
>>>[MailScanner <defunct>]
>>>
>>>Thanks for your help
>>>
>>>Matthew K Bowman
>>>Systems Administrator
>>>UDCom
>>>Tel: 419-524-4330
>>>Fax: 419-524-8757
>>>Web: http://www.udcom.com
>>>Email: mbowman@udcom.com
>>>Support: techsupport@udcom.com
>>>Sales: sales@udcom.com
>>>
>>>
>>>
>>>
>>>Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
>>>Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>>11/26/2004 09:58 AM
>>>Please respond to MailScanner mailing list
>>>
>>>       To:     MAILSCANNER@JISCMAIL.AC.UK
>>>       cc:
>>>       Subject:        Re: Help! - MailScanner ceased working
>>>
>>>
>>>Matthew
>>>
>>>if results are fine from running in debug mode then it should have
>>>delivered that batch of emails.....
>>>
>>>Can you drop the output of the checkmailscanner to the list?
>>>
>>>also are you running checkmailscanner as the same user MailScanner
>>>normally runs as?
>>>
>>>--
>>>Martin Hepworth
>>>Snr Systems Administrator
>>>Solid State Logic
>>>Tel: +44 (0)1865 842300
>>>
>>>
>>>Matthew Bowman wrote:
>>>
>>>
>>>
>>>>Hello,
>>>>
>>>>One of our 3 mailscanner servers has stopped processing e-mail.  There
>>>
>>>are
>>>
>>>
>>>
>>>>no errors in /var/log/maillog or messages that indicate and sort of
>>>>problem.  Email arrives and gets put into mqueue.in and just stays
>>>
>>>there.
>>>
>>>
>>>
>>>>Nothing has changed in MailScanner.conf or sendmail.cf.  I'm at a loss
>>>
>>>as
>>>
>>>
>>>
>>>>to how this has happened all of a sudden.  I run mailscanner and
>>>>spamassassin in debug mode and the results where fine.  What else
>
> should
>
>>>I
>>>
>>>
>>>
>>>>be looking at?
>>>>
>>>>All 3 mailscanner servers run MS 4.35-11, SA 3.0.0 and Redhat 7.3
>>>>
>>>>Please help!
>>>>
>>>>Thanks
>>>>
>>>>Matthew
>>>>
>>>>------------------------ MailScanner list ------------------------
>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>>'leave mailscanner' in the body of the email.
>>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>
>>>>Support MailScanner development - buy the book off the website!
>>>
>>>
>>>**********************************************************************
>>>
>>>This email and any files transmitted with it are confidential and
>>>intended solely for the use of the individual or entity to whom they
>>>are addressed. If you have received this email in error please notify
>>>the system manager.
>>>
>>>This footnote confirms that this email message has been swept
>>>for the presence of computer viruses and is believed to be clean.
>>>
>>>**********************************************************************
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>
>>
>>**********************************************************************
>>
>>This email and any files transmitted with it are confidential and
>>intended solely for the use of the individual or entity to whom they
>>are addressed. If you have received this email in error please notify
>>the system manager.
>>
>>This footnote confirms that this email message has been swept
>>for the presence of computer viruses and is believed to be clean.
>>
>>**********************************************************************
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mbowman at UDCOM.COM  Fri Nov 26 17:40:18 2004
From: mbowman at UDCOM.COM (Matthew Bowman)
Date: Thu Jan 12 21:27:42 2006
Subject: Help! - MailScanner ceased working (debug output)
Message-ID: <mailman.5157.1137101262.24926.mailscanner@lists.mailscanner.info>

Nothing hits the outbound queue (/var/spool/mqueue). All inbound email
stays put in /var/spool/mqueue.in

Matthew K Bowman
Systems Administrator
UDCom
Tel: 419-524-4330
Fax: 419-524-8757
Web: http://www.udcom.com
Email: mbowman@udcom.com
Support: techsupport@udcom.com
Sales: sales@udcom.com




Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
11/26/2004 11:42 AM
Please respond to MailScanner mailing list

        To:     MAILSCANNER@JISCMAIL.AC.UK
        cc:
        Subject:        Re: Help! - MailScanner ceased working (debug
output)


Matthew

that'll be normal. the other '3' are already being scanned by other
MailScanner children.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Matthew Bowman wrote:
> Not at all, everything goes to mqueue.in, mailscanner (according to
> maillog) doesn't scan the email thus its not delivered.
>
> I should be seeing something like:
>
> MailScanner[29593]: New Batch: Found 4 messages waiting
> MailScanner[29593]: New Batch: Scanning 1 messages, 4568 bytes
> MailScanner[29593]: Virus and Content Scanning: Starting
>
> But dont.
>
> Matthew K Bowman
> Systems Administrator
> UDCom
> Tel: 419-524-4330
> Fax: 419-524-8757
> Web: http://www.udcom.com
> Email: mbowman@udcom.com
> Support: techsupport@udcom.com
> Sales: sales@udcom.com
>
>
>
>
> Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
> Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> 11/26/2004 11:34 AM
> Please respond to MailScanner mailing list
>
>         To:     MAILSCANNER@JISCMAIL.AC.UK
>         cc:
>         Subject:        Re: Help! - MailScanner ceased working (debug
> output)
>
>
> matthew
>
> Looks fine - I presume stuff hit the outgoing MTA queue?
>
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Matthew Bowman wrote:
>
>>Debug output
>>
>>Starting MailScanner...
>>In Debugging mode, not forking...
>>debug: SpamAssassin version 3.0.0
>>debug: Score set 0 chosen.
>>debug: running in taint mode? no
>>SA bayes lock is /root/.spamassassin/bayes.lock
>>Bayes lock is at /root/.spamassassin/bayes.lock
>>debug: ignore: test message to precompile patterns and load modules
>>debug: using "/etc/mail/spamassassin/init.pre" for site rules init.pre
>>debug: config: read file /etc/mail/spamassassin/init.pre
>>debug: using "/usr/share/spamassassin" for default rules dir
>>debug: config: read file /usr/share/spamassassin/10_misc.cf
>>debug: config: read file /usr/share/spamassassin/20_anti_ratware.cf
>>debug: config: read file /usr/share/spamassassin/20_body_tests.cf
>>debug: config: read file /usr/share/spamassassin/20_compensate.cf
>>debug: config: read file /usr/share/spamassassin/20_dnsbl_tests.cf
>>debug: config: read file /usr/share/spamassassin/20_drugs.cf
>>debug: config: read file /usr/share/spamassassin/20_fake_helo_tests.cf
>>debug: config: read file /usr/share/spamassassin/20_head_tests.cf
>>debug: config: read file /usr/share/spamassassin/20_html_tests.cf
>>debug: config: read file /usr/share/spamassassin/20_meta_tests.cf
>>debug: config: read file /usr/share/spamassassin/20_phrases.cf
>>debug: config: read file /usr/share/spamassassin/20_porn.cf
>>debug: config: read file /usr/share/spamassassin/20_ratware.cf
>>debug: config: read file /usr/share/spamassassin/20_uri_tests.cf
>>debug: config: read file /usr/share/spamassassin/23_bayes.cf
>>debug: config: read file /usr/share/spamassassin/25_body_tests_es.cf
>>debug: config: read file /usr/share/spamassassin/25_hashcash.cf
>>debug: config: read file /usr/share/spamassassin/25_spf.cf
>>debug: config: read file /usr/share/spamassassin/25_uribl.cf
>>debug: config: read file /usr/share/spamassassin/30_text_de.cf
>>debug: config: read file /usr/share/spamassassin/30_text_fr.cf
>>debug: config: read file /usr/share/spamassassin/30_text_nl.cf
>>debug: config: read file /usr/share/spamassassin/30_text_pl.cf
>>debug: config: read file /usr/share/spamassassin/50_scores.cf
>>debug: config: read file /usr/share/spamassassin/60_whitelist.cf
>>debug: using "/etc/mail/spamassassin" for site rules dir
>>debug: config: read file /etc/mail/spamassassin/antidrug.cf
>>debug: config: read file /etc/mail/spamassassin/bigevil.cf
>>debug: config: read file /etc/mail/spamassassin/local.cf
>>debug: using "/etc/MailScanner/spam.assassin.prefs.conf" for user prefs
>>file
>>debug: config: read file /etc/MailScanner/spam.assassin.prefs.conf
>>debug: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
>>debug: plugin: registered
>>Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>debug: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC
>>debug: plugin: registered
>>Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40)
>>debug: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
>>debug: plugin: registered
>
> Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798)
>
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>implements 'parse_config'
>>debug: plugin: Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40)
>>implements 'parse_config'
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: Score set 1 chosen.
>>debug: ---- MIME PARSER START ----
>>debug: main message type: text/plain
>>debug: parsing normal part
>>debug: added part, type: text/plain
>>debug: ---- MIME PARSER END ----
>>debug: metadata: X-Spam-Relays-Trusted:
>>debug: metadata: X-Spam-Relays-Untrusted:
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>implements 'parsed_metadata'
>>debug: is Net::DNS::Resolver available? yes
>>debug: Net::DNS version: 0.39_01
>>debug: trying (3) sourceforge.net...
>>debug: looking up NS for 'sourceforge.net'
>>debug: NS lookup of sourceforge.net succeeded => Dns available (set
>>dns_available to hardcode)
>>debug: is DNS available? 1
>>debug: decoding: no encoding detected
>>debug: URIDNSBL: domains to query:
>>debug: all '*From' addrs: ignore@compiling.spamassassin.taint.org
>>debug: Running tests for priority: 0
>>debug: running header regexp tests; score so far=0
>>debug: registering glue method for check_uridnsbl
>>(Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810))
>>debug: registering glue method for check_for_spf_pass
>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>debug: SPF: message was delivered entirely via trusted relays, not
>>required
>>debug: all '*To' addrs:
>>debug: registering glue method for check_hashcash_value
>>(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40))
>>debug: registering glue method for check_for_spf_helo_fail
>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>debug: SPF: message was delivered entirely via trusted relays, not
>>required
>>debug: registering glue method for check_for_spf_helo_pass
>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>debug: registering glue method for check_hashcash_double_spend
>>(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40))
>>debug: registering glue method for check_for_spf_softfail
>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>debug: registering glue method for check_for_spf_helo_softfail
>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>debug: running body-text per-line regexp tests; score so far=-2.623
>>debug: running uri tests; score so far=-2.623
>>debug: Razor2 is available
>>debug: entering helper-app run mode
>> Razor-Log: Computed razorhome from env: /root/.razor
>> Razor-Log: Found razorhome: /root/.razor
>> Razor-Log: read_file: 16 items read from /root/.razor/razor-agent.conf
>>Nov 26 11:15:44.875895 check[27631]: [ 1] [bootup] Logging initiated
>>LogDebugLevel=9 to stdout
>>Nov 26 11:15:44.876392 check[27631]: [ 5] computed
>
> razorhome=/root/.razor,
>
>>conf=/root/.razor/razor-agent.conf, ident=/root/.razor/identity
>>Nov 26 11:15:44.876648 check[27631]: [ 8] Client supported_engines: 1 2
>
> 3
>
>>4
>>Nov 26 11:15:44.877247 check[27631]: [ 8]  prep_mail done: mail 1
>>headers=102, mime0=1376
>>Nov 26 11:15:44.877704 check[27631]: [ 5] read_file: 8 items read from
>>/root/.razor/servers.discovery.lst
>>Nov 26 11:15:44.878063 check[27631]: [ 5] read_file: 2 items read from
>>/root/.razor/servers.nomination.lst
>>Nov 26 11:15:44.878331 check[27631]: [ 5] read_file: 3 items read from
>>/root/.razor/servers.catalogue.lst
>>Nov 26 11:15:44.878740 check[27631]: [ 9] Assigning defaults to
>>joy.cloudmark.com
>>Nov 26 11:15:44.878926 check[27631]: [ 9] Assigning defaults to
>>folly.cloudmark.com
>>Nov 26 11:15:44.879179 check[27631]: [ 9] Assigning defaults to
>>pride.cloudmark.com
>>Nov 26 11:15:44.879383 check[27631]: [ 9] Assigning defaults to
>>wonder.cloudmark.com
>>Nov 26 11:15:44.879559 check[27631]: [ 9] Assigning defaults to
>>thrill.cloudmark.com
>>Nov 26 11:15:44.880412 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.truth.cloudmark.com.conf
>>Nov 26 11:15:44.881004 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.stress.cloudmark.com.conf
>>Nov 26 11:15:44.881542 check[27631]: [ 5] read_file: 12 items read from
>>/root/.razor/server.folly.cloudmark.com.conf
>>Nov 26 11:15:44.882114 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.rancor.cloudmark.com.conf
>>Nov 26 11:15:44.882702 check[27631]: [ 5] read_file: 16 items read from
>>/root/.razor/server.pride.cloudmark.com.conf
>>Nov 26 11:15:44.883256 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.prejudice.cloudmark.com.conf
>>Nov 26 11:15:44.883832 check[27631]: [ 5] read_file: 16 items read from
>>/root/.razor/server.wonder.cloudmark.com.conf
>>Nov 26 11:15:44.884384 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.anxiety.cloudmark.com.conf
>>Nov 26 11:15:44.884946 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.tension.cloudmark.com.conf
>>Nov 26 11:15:44.885523 check[27631]: [ 5] read_file: 16 items read from
>>/root/.razor/server.thrill.cloudmark.com.conf
>>Nov 26 11:15:44.886150 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.malice.cloudmark.com.conf
>>Nov 26 11:15:44.886757 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.shock.cloudmark.com.conf
>>Nov 26 11:15:44.887082 check[27631]: [ 5] 154361 seconds before closest
>>server discovery
>>Nov 26 11:15:44.887338 check[27631]: [ 6] pride.cloudmark.com is a
>>Catalogue Server srl 5048; computed min_cf=6, Server se: C8
>>Nov 26 11:15:44.887597 check[27631]: [ 8] Computed supported_engines: 4
>>Nov 26 11:15:44.887759 check[27631]: [ 8] Using next closest server
>>pride.cloudmark.com:2703, cached info srl 5048
>>Nov 26 11:15:44.887892 check[27631]: [ 8] mail 1 has no subject
>>Nov 26 11:15:44.889464 check[27631]: [ 6] preproc: mail 1.0 went from
>
> 1376
>
>>bytes to 1339
>>Nov 26 11:15:44.889655 check[27631]: [ 6] computing sigs for mail 1.0,
>
> len
>
>>1339
>>Nov 26 11:15:44.891458 check[27631]: [ 6] skipping whitelist file
>>(empty?): /root/.razor/razor-whitelist
>>Nov 26 11:15:44.891659 check[27631]: [ 5] Connecting to
>>pride.cloudmark.com ...
>>Nov 26 11:15:44.956354 check[27631]: [ 3] Unable to connect to
>>pride.cloudmark.com:2703; Reason: Connection refused.
>>Nov 26 11:15:44.956634 check[27631]: [ 5] 161663 seconds before closest
>>server discovery
>>Nov 26 11:15:44.956874 check[27631]: [ 6] wonder.cloudmark.com is a
>>Catalogue Server srl 5048; computed min_cf=6, Server se: C8
>>Nov 26 11:15:44.957085 check[27631]: [ 8] Computed supported_engines: 4
>>Nov 26 11:15:44.957231 check[27631]: [ 8] Using next closest server
>>wonder.cloudmark.com:2703, cached info srl 5048
>>Nov 26 11:15:44.957392 check[27631]: [ 5] Connecting to
>>wonder.cloudmark.com ...
>>Nov 26 11:15:45.077689 check[27631]: [ 8] Connection established
>>Nov 26 11:15:45.077888 check[27631]: [ 4] wonder.cloudmark.com >> 36
>>server greeting: sn=C&srl=5048&a=l&a=cg&ep4=7542-10
>>Nov 26 11:15:45.078283 check[27631]: [ 4] wonder.cloudmark.com << 25
>>Nov 26 11:15:45.078369 check[27631]: [ 6] cn=razor-agents&cv=2.36
>>Nov 26 11:15:45.078670 check[27631]: [ 6] wonder.cloudmark.com is a
>>Catalogue Server srl 5048; computed min_cf=6, Server se: C8
>>Nov 26 11:15:45.078891 check[27631]: [ 8] Computed supported_engines: 4
>>Nov 26 11:15:45.079110 check[27631]: [ 8] mail 1.0 e4 sig:
>>xFaZIZUVHk90OQfARnenjx5BZTMA
>>Nov 26 11:15:45.079296 check[27631]: [ 8] preparing 1 queries
>>Nov 26 11:15:45.079546 check[27631]: [ 8] sending 1 batches
>>Nov 26 11:15:45.079745 check[27631]: [ 4] wonder.cloudmark.com << 52
>>Nov 26 11:15:45.079820 check[27631]: [ 6]
>>a=c&e=4&ep4=7542-10&s=xFaZIZUVHk90OQfARnenjx5BZTMA
>>Nov 26 11:15:45.351281 check[27631]: [ 4] wonder.cloudmark.com >> 5
>>Nov 26 11:15:45.351376 check[27631]: [ 6] response to sent.2
>>p=0
>>Nov 26 11:15:45.351792 check[27631]: [ 6] mail 1.0 e=4
>>sig=xFaZIZUVHk90OQfARnenjx5BZTMA: sig not found.
>>Nov 26 11:15:45.351954 check[27631]: [ 7] method 4: mail 1.0:
>>no-contention part, spam=0
>>Nov 26 11:15:45.352034 check[27631]: [ 7] method 4: mail 1: all
>>non-contention parts not spam, mail not spam
>>Nov 26 11:15:45.352111 check[27631]: [ 3] mail 1 is not known spam.
>>Nov 26 11:15:45.352208 check[27631]: [ 5] disconnecting from server
>>wonder.cloudmark.com
>>Nov 26 11:15:45.352409 check[27631]: [ 4] wonder.cloudmark.com << 5
>>Nov 26 11:15:45.352482 check[27631]: [ 6] a=q
>>debug: Using results from Razor v2.36
>>debug: Found Razor2 part: part=0 engine=4 ct=0 cf=0
>>debug: leaving helper-app run mode
>>debug: Razor2 results: spam? 0  highest cf score: 0
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>implements 'check_tick'
>>debug: running raw-body-text per-line regexp tests; score so far=-2.623
>>debug: running full-text regexp tests; score so far=-2.623
>>debug: Razor2 is available
>>debug: Current PATH is: /sbin:/bin:/usr/sbin:/usr/bin
>>debug: Pyzor is not available: pyzor not found
>>debug: Running tests for priority: 500
>>debug: RBL: success for 1 of 1 queries
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>implements 'check_post_dnsbl'
>>debug: running meta tests; score so far=-2.623
>>debug: running header regexp tests; score so far=-1.053
>>debug: running body-text per-line regexp tests; score so far=-1.053
>>debug: running uri tests; score so far=-1.053
>>debug: running raw-body-text per-line regexp tests; score so far=-1.053
>>debug: running full-text regexp tests; score so far=-1.053
>>debug: Running tests for priority: 1000
>>debug: running meta tests; score so far=-1.053
>>debug: running header regexp tests; score so far=-1.053
>>debug: lock: 27631 created
>>/root/.spamassassin/auto-whitelist.lock.smithers.vbcomm.net.27631
>>debug: lock: 27631 trying to get lock on
>>/root/.spamassassin/auto-whitelist with 0 retries
>>debug: lock: 27631 link to /root/.spamassassin/auto-whitelist.lock: link
>>ok
>>debug: Tie-ing to DB file R/W in /root/.spamassassin/auto-whitelist
>>debug: auto-whitelist (db-based):
>>ignore@compiling.spamassassin.taint.org|ip=none scores 0/0
>>debug: AWL active, pre-score: -1.053, autolearn score: -1.053, mean:
>>undef, IP: undef
>>debug: DB addr list: untie-ing and unlocking.
>>debug: DB addr list: file locked, breaking lock.
>>debug: unlock: 27631 unlink /root/.spamassassin/auto-whitelist.lock
>>debug: Post AWL score: -1.053
>>debug: running body-text per-line regexp tests; score so far=-1.053
>>debug: running uri tests; score so far=-1.053
>>debug: running raw-body-text per-line regexp tests; score so far=-1.053
>>debug: running full-text regexp tests; score so far=-1.053
>>debug: is spam? score=-1.053 required=3.8
>>debug: tests=ALL_TRUSTED,MISSING_DATE,MISSING_SUBJECT,NO_REAL_NAME
>>debug:
>>
>
>
subtests=__HAS_MSGID,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__SANE_MSGID,__UNUSABLE_MSGID
>
>>
>>
>>
>>Matthew K Bowman
>>Systems Administrator
>>UDCom
>>Tel: 419-524-4330
>>Fax: 419-524-8757
>>Web: http://www.udcom.com
>>Email: mbowman@udcom.com
>>Support: techsupport@udcom.com
>>Sales: sales@udcom.com
>>
>>
>>
>>
>>Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
>>Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>11/26/2004 11:06 AM
>>Please respond to MailScanner mailing list
>>
>>        To:     MAILSCANNER@JISCMAIL.AC.UK
>>        cc:
>>        Subject:        Re: Help! - MailScanner ceased working
>>
>>
>>matthew
>>
>>stop the mailscanner service
>>
>>edit the MailScanner.conf file and turn on both lots of debug options
>>
>>run checkmailscanner as the user defined in the MailScanner.conf and
>>drop the results back here..
>>
>>
>>--
>>Martin Hepworth
>>Snr Systems Administrator
>>Solid State Logic
>>Tel: +44 (0)1865 842300
>>
>>
>>Matthew Bowman wrote:
>>
>>
>>>Hello
>>>
>>>MailScanner is running with pid 842 is the only output I get. Both are
>>
>>run
>>
>>
>>>by the same user.
>>>
>>>/var/log/maillog
>>>
>>>Nov 26 10:08:09 smithers MailScanner[1503]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:08:19 smithers MailScanner[1518]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:08:29 smithers MailScanner[1519]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:08:39 smithers MailScanner[1520]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:08:49 smithers MailScanner[1521]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:08:59 smithers MailScanner[1524]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:09:09 smithers MailScanner[1526]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:09:19 smithers MailScanner[1527]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:09:29 smithers MailScanner[1528]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:09:39 smithers MailScanner[1530]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>
>>>ps
>>>
>>>root       842  0.0  1.2 13908 12524 ?       S    09:32   0:00
>>>/usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailS
>>>root       843  0.0  0.0     0    0 ?        Z    09:32   0:01
>>>[MailScanner <defunct>]
>>>root      1039  0.0  0.0     0    0 ?        Z    09:32   0:01
>>>[MailScanner <defunct>]
>>>root      1040  0.0  0.0     0    0 ?        Z    09:32   0:01
>>>[MailScanner <defunct>]
>>>root      1041  0.0  0.0     0    0 ?        Z    09:32   0:01
>>>[MailScanner <defunct>]
>>>root      1042  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>[MailScanner <defunct>]
>>>root      1043  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>[MailScanner <defunct>]
>>>root      1044  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>[MailScanner <defunct>]
>>>root      1045  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>[MailScanner <defunct>]
>>>root      1046  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>[MailScanner <defunct>]
>>>root      1539 34.2  0.0     0    0 ?        Z    10:10   0:01
>>>[MailScanner <defunct>]
>>>
>>>Thanks for your help
>>>
>>>Matthew K Bowman
>>>Systems Administrator
>>>UDCom
>>>Tel: 419-524-4330
>>>Fax: 419-524-8757
>>>Web: http://www.udcom.com
>>>Email: mbowman@udcom.com
>>>Support: techsupport@udcom.com
>>>Sales: sales@udcom.com
>>>
>>>
>>>
>>>
>>>Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
>>>Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>>11/26/2004 09:58 AM
>>>Please respond to MailScanner mailing list
>>>
>>>       To:     MAILSCANNER@JISCMAIL.AC.UK
>>>       cc:
>>>       Subject:        Re: Help! - MailScanner ceased working
>>>
>>>
>>>Matthew
>>>
>>>if results are fine from running in debug mode then it should have
>>>delivered that batch of emails.....
>>>
>>>Can you drop the output of the checkmailscanner to the list?
>>>
>>>also are you running checkmailscanner as the same user MailScanner
>>>normally runs as?
>>>
>>>--
>>>Martin Hepworth
>>>Snr Systems Administrator
>>>Solid State Logic
>>>Tel: +44 (0)1865 842300
>>>
>>>
>>>Matthew Bowman wrote:
>>>
>>>
>>>
>>>>Hello,
>>>>
>>>>One of our 3 mailscanner servers has stopped processing e-mail.  There
>>>
>>>are
>>>
>>>
>>>
>>>>no errors in /var/log/maillog or messages that indicate and sort of
>>>>problem.  Email arrives and gets put into mqueue.in and just stays
>>>
>>>there.
>>>
>>>
>>>
>>>>Nothing has changed in MailScanner.conf or sendmail.cf.  I'm at a loss
>>>
>>>as
>>>
>>>
>>>
>>>>to how this has happened all of a sudden.  I run mailscanner and
>>>>spamassassin in debug mode and the results where fine.  What else
>
> should
>
>>>I
>>>
>>>
>>>
>>>>be looking at?
>>>>
>>>>All 3 mailscanner servers run MS 4.35-11, SA 3.0.0 and Redhat 7.3
>>>>
>>>>Please help!
>>>>
>>>>Thanks
>>>>
>>>>Matthew
>>>>
>>>>------------------------ MailScanner list ------------------------
>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>>'leave mailscanner' in the body of the email.
>>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>
>>>>Support MailScanner development - buy the book off the website!
>>>
>>>
>>>**********************************************************************
>>>
>>>This email and any files transmitted with it are confidential and
>>>intended solely for the use of the individual or entity to whom they
>>>are addressed. If you have received this email in error please notify
>>>the system manager.
>>>
>>>This footnote confirms that this email message has been swept
>>>for the presence of computer viruses and is believed to be clean.
>>>
>>>**********************************************************************
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>
>>
>>**********************************************************************
>>
>>This email and any files transmitted with it are confidential and
>>intended solely for the use of the individual or entity to whom they
>>are addressed. If you have received this email in error please notify
>>the system manager.
>>
>>This footnote confirms that this email message has been swept
>>for the presence of computer viruses and is believed to be clean.
>>
>>**********************************************************************
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Fri Nov 26 16:45:25 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:43 2006
Subject: Help! - MailScanner ceased working (debug output)
Message-ID: <mailman.5158.1137101262.24926.mailscanner@lists.mailscanner.info>

matt

sorry - caffiene level dropping.... I'll start again..

what are you seeing then...just the MS restarting all the time?

I presume the debug was done as the MS user defined in MailScanner.conf?
Which by the looks of your debug is root...


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Matthew Bowman wrote:
> Not at all, everything goes to mqueue.in, mailscanner (according to
> maillog) doesn't scan the email thus its not delivered.
>
> I should be seeing something like:
>
> MailScanner[29593]: New Batch: Found 4 messages waiting
> MailScanner[29593]: New Batch: Scanning 1 messages, 4568 bytes
> MailScanner[29593]: Virus and Content Scanning: Starting
>
> But dont.
>
> Matthew K Bowman
> Systems Administrator
> UDCom
> Tel: 419-524-4330
> Fax: 419-524-8757
> Web: http://www.udcom.com
> Email: mbowman@udcom.com
> Support: techsupport@udcom.com
> Sales: sales@udcom.com
>
>
>
>
> Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
> Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> 11/26/2004 11:34 AM
> Please respond to MailScanner mailing list
>
>         To:     MAILSCANNER@JISCMAIL.AC.UK
>         cc:
>         Subject:        Re: Help! - MailScanner ceased working (debug
> output)
>
>
> matthew
>
> Looks fine - I presume stuff hit the outgoing MTA queue?
>
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Matthew Bowman wrote:
>
>>Debug output
>>
>>Starting MailScanner...
>>In Debugging mode, not forking...
>>debug: SpamAssassin version 3.0.0
>>debug: Score set 0 chosen.
>>debug: running in taint mode? no
>>SA bayes lock is /root/.spamassassin/bayes.lock
>>Bayes lock is at /root/.spamassassin/bayes.lock
>>debug: ignore: test message to precompile patterns and load modules
>>debug: using "/etc/mail/spamassassin/init.pre" for site rules init.pre
>>debug: config: read file /etc/mail/spamassassin/init.pre
>>debug: using "/usr/share/spamassassin" for default rules dir
>>debug: config: read file /usr/share/spamassassin/10_misc.cf
>>debug: config: read file /usr/share/spamassassin/20_anti_ratware.cf
>>debug: config: read file /usr/share/spamassassin/20_body_tests.cf
>>debug: config: read file /usr/share/spamassassin/20_compensate.cf
>>debug: config: read file /usr/share/spamassassin/20_dnsbl_tests.cf
>>debug: config: read file /usr/share/spamassassin/20_drugs.cf
>>debug: config: read file /usr/share/spamassassin/20_fake_helo_tests.cf
>>debug: config: read file /usr/share/spamassassin/20_head_tests.cf
>>debug: config: read file /usr/share/spamassassin/20_html_tests.cf
>>debug: config: read file /usr/share/spamassassin/20_meta_tests.cf
>>debug: config: read file /usr/share/spamassassin/20_phrases.cf
>>debug: config: read file /usr/share/spamassassin/20_porn.cf
>>debug: config: read file /usr/share/spamassassin/20_ratware.cf
>>debug: config: read file /usr/share/spamassassin/20_uri_tests.cf
>>debug: config: read file /usr/share/spamassassin/23_bayes.cf
>>debug: config: read file /usr/share/spamassassin/25_body_tests_es.cf
>>debug: config: read file /usr/share/spamassassin/25_hashcash.cf
>>debug: config: read file /usr/share/spamassassin/25_spf.cf
>>debug: config: read file /usr/share/spamassassin/25_uribl.cf
>>debug: config: read file /usr/share/spamassassin/30_text_de.cf
>>debug: config: read file /usr/share/spamassassin/30_text_fr.cf
>>debug: config: read file /usr/share/spamassassin/30_text_nl.cf
>>debug: config: read file /usr/share/spamassassin/30_text_pl.cf
>>debug: config: read file /usr/share/spamassassin/50_scores.cf
>>debug: config: read file /usr/share/spamassassin/60_whitelist.cf
>>debug: using "/etc/mail/spamassassin" for site rules dir
>>debug: config: read file /etc/mail/spamassassin/antidrug.cf
>>debug: config: read file /etc/mail/spamassassin/bigevil.cf
>>debug: config: read file /etc/mail/spamassassin/local.cf
>>debug: using "/etc/MailScanner/spam.assassin.prefs.conf" for user prefs
>>file
>>debug: config: read file /etc/MailScanner/spam.assassin.prefs.conf
>>debug: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
>>debug: plugin: registered
>>Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>debug: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC
>>debug: plugin: registered
>>Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40)
>>debug: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
>>debug: plugin: registered
>
> Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798)
>
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>implements 'parse_config'
>>debug: plugin: Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40)
>>implements 'parse_config'
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: Score set 1 chosen.
>>debug: ---- MIME PARSER START ----
>>debug: main message type: text/plain
>>debug: parsing normal part
>>debug: added part, type: text/plain
>>debug: ---- MIME PARSER END ----
>>debug: metadata: X-Spam-Relays-Trusted:
>>debug: metadata: X-Spam-Relays-Untrusted:
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>implements 'parsed_metadata'
>>debug: is Net::DNS::Resolver available? yes
>>debug: Net::DNS version: 0.39_01
>>debug: trying (3) sourceforge.net...
>>debug: looking up NS for 'sourceforge.net'
>>debug: NS lookup of sourceforge.net succeeded => Dns available (set
>>dns_available to hardcode)
>>debug: is DNS available? 1
>>debug: decoding: no encoding detected
>>debug: URIDNSBL: domains to query:
>>debug: all '*From' addrs: ignore@compiling.spamassassin.taint.org
>>debug: Running tests for priority: 0
>>debug: running header regexp tests; score so far=0
>>debug: registering glue method for check_uridnsbl
>>(Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810))
>>debug: registering glue method for check_for_spf_pass
>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>debug: SPF: message was delivered entirely via trusted relays, not
>>required
>>debug: all '*To' addrs:
>>debug: registering glue method for check_hashcash_value
>>(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40))
>>debug: registering glue method for check_for_spf_helo_fail
>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>debug: SPF: message was delivered entirely via trusted relays, not
>>required
>>debug: registering glue method for check_for_spf_helo_pass
>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>debug: registering glue method for check_hashcash_double_spend
>>(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40))
>>debug: registering glue method for check_for_spf_softfail
>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>debug: registering glue method for check_for_spf_helo_softfail
>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>debug: running body-text per-line regexp tests; score so far=-2.623
>>debug: running uri tests; score so far=-2.623
>>debug: Razor2 is available
>>debug: entering helper-app run mode
>> Razor-Log: Computed razorhome from env: /root/.razor
>> Razor-Log: Found razorhome: /root/.razor
>> Razor-Log: read_file: 16 items read from /root/.razor/razor-agent.conf
>>Nov 26 11:15:44.875895 check[27631]: [ 1] [bootup] Logging initiated
>>LogDebugLevel=9 to stdout
>>Nov 26 11:15:44.876392 check[27631]: [ 5] computed
>
> razorhome=/root/.razor,
>
>>conf=/root/.razor/razor-agent.conf, ident=/root/.razor/identity
>>Nov 26 11:15:44.876648 check[27631]: [ 8] Client supported_engines: 1 2
>
> 3
>
>>4
>>Nov 26 11:15:44.877247 check[27631]: [ 8]  prep_mail done: mail 1
>>headers=102, mime0=1376
>>Nov 26 11:15:44.877704 check[27631]: [ 5] read_file: 8 items read from
>>/root/.razor/servers.discovery.lst
>>Nov 26 11:15:44.878063 check[27631]: [ 5] read_file: 2 items read from
>>/root/.razor/servers.nomination.lst
>>Nov 26 11:15:44.878331 check[27631]: [ 5] read_file: 3 items read from
>>/root/.razor/servers.catalogue.lst
>>Nov 26 11:15:44.878740 check[27631]: [ 9] Assigning defaults to
>>joy.cloudmark.com
>>Nov 26 11:15:44.878926 check[27631]: [ 9] Assigning defaults to
>>folly.cloudmark.com
>>Nov 26 11:15:44.879179 check[27631]: [ 9] Assigning defaults to
>>pride.cloudmark.com
>>Nov 26 11:15:44.879383 check[27631]: [ 9] Assigning defaults to
>>wonder.cloudmark.com
>>Nov 26 11:15:44.879559 check[27631]: [ 9] Assigning defaults to
>>thrill.cloudmark.com
>>Nov 26 11:15:44.880412 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.truth.cloudmark.com.conf
>>Nov 26 11:15:44.881004 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.stress.cloudmark.com.conf
>>Nov 26 11:15:44.881542 check[27631]: [ 5] read_file: 12 items read from
>>/root/.razor/server.folly.cloudmark.com.conf
>>Nov 26 11:15:44.882114 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.rancor.cloudmark.com.conf
>>Nov 26 11:15:44.882702 check[27631]: [ 5] read_file: 16 items read from
>>/root/.razor/server.pride.cloudmark.com.conf
>>Nov 26 11:15:44.883256 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.prejudice.cloudmark.com.conf
>>Nov 26 11:15:44.883832 check[27631]: [ 5] read_file: 16 items read from
>>/root/.razor/server.wonder.cloudmark.com.conf
>>Nov 26 11:15:44.884384 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.anxiety.cloudmark.com.conf
>>Nov 26 11:15:44.884946 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.tension.cloudmark.com.conf
>>Nov 26 11:15:44.885523 check[27631]: [ 5] read_file: 16 items read from
>>/root/.razor/server.thrill.cloudmark.com.conf
>>Nov 26 11:15:44.886150 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.malice.cloudmark.com.conf
>>Nov 26 11:15:44.886757 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.shock.cloudmark.com.conf
>>Nov 26 11:15:44.887082 check[27631]: [ 5] 154361 seconds before closest
>>server discovery
>>Nov 26 11:15:44.887338 check[27631]: [ 6] pride.cloudmark.com is a
>>Catalogue Server srl 5048; computed min_cf=6, Server se: C8
>>Nov 26 11:15:44.887597 check[27631]: [ 8] Computed supported_engines: 4
>>Nov 26 11:15:44.887759 check[27631]: [ 8] Using next closest server
>>pride.cloudmark.com:2703, cached info srl 5048
>>Nov 26 11:15:44.887892 check[27631]: [ 8] mail 1 has no subject
>>Nov 26 11:15:44.889464 check[27631]: [ 6] preproc: mail 1.0 went from
>
> 1376
>
>>bytes to 1339
>>Nov 26 11:15:44.889655 check[27631]: [ 6] computing sigs for mail 1.0,
>
> len
>
>>1339
>>Nov 26 11:15:44.891458 check[27631]: [ 6] skipping whitelist file
>>(empty?): /root/.razor/razor-whitelist
>>Nov 26 11:15:44.891659 check[27631]: [ 5] Connecting to
>>pride.cloudmark.com ...
>>Nov 26 11:15:44.956354 check[27631]: [ 3] Unable to connect to
>>pride.cloudmark.com:2703; Reason: Connection refused.
>>Nov 26 11:15:44.956634 check[27631]: [ 5] 161663 seconds before closest
>>server discovery
>>Nov 26 11:15:44.956874 check[27631]: [ 6] wonder.cloudmark.com is a
>>Catalogue Server srl 5048; computed min_cf=6, Server se: C8
>>Nov 26 11:15:44.957085 check[27631]: [ 8] Computed supported_engines: 4
>>Nov 26 11:15:44.957231 check[27631]: [ 8] Using next closest server
>>wonder.cloudmark.com:2703, cached info srl 5048
>>Nov 26 11:15:44.957392 check[27631]: [ 5] Connecting to
>>wonder.cloudmark.com ...
>>Nov 26 11:15:45.077689 check[27631]: [ 8] Connection established
>>Nov 26 11:15:45.077888 check[27631]: [ 4] wonder.cloudmark.com >> 36
>>server greeting: sn=C&srl=5048&a=l&a=cg&ep4=7542-10
>>Nov 26 11:15:45.078283 check[27631]: [ 4] wonder.cloudmark.com << 25
>>Nov 26 11:15:45.078369 check[27631]: [ 6] cn=razor-agents&cv=2.36
>>Nov 26 11:15:45.078670 check[27631]: [ 6] wonder.cloudmark.com is a
>>Catalogue Server srl 5048; computed min_cf=6, Server se: C8
>>Nov 26 11:15:45.078891 check[27631]: [ 8] Computed supported_engines: 4
>>Nov 26 11:15:45.079110 check[27631]: [ 8] mail 1.0 e4 sig:
>>xFaZIZUVHk90OQfARnenjx5BZTMA
>>Nov 26 11:15:45.079296 check[27631]: [ 8] preparing 1 queries
>>Nov 26 11:15:45.079546 check[27631]: [ 8] sending 1 batches
>>Nov 26 11:15:45.079745 check[27631]: [ 4] wonder.cloudmark.com << 52
>>Nov 26 11:15:45.079820 check[27631]: [ 6]
>>a=c&e=4&ep4=7542-10&s=xFaZIZUVHk90OQfARnenjx5BZTMA
>>Nov 26 11:15:45.351281 check[27631]: [ 4] wonder.cloudmark.com >> 5
>>Nov 26 11:15:45.351376 check[27631]: [ 6] response to sent.2
>>p=0
>>Nov 26 11:15:45.351792 check[27631]: [ 6] mail 1.0 e=4
>>sig=xFaZIZUVHk90OQfARnenjx5BZTMA: sig not found.
>>Nov 26 11:15:45.351954 check[27631]: [ 7] method 4: mail 1.0:
>>no-contention part, spam=0
>>Nov 26 11:15:45.352034 check[27631]: [ 7] method 4: mail 1: all
>>non-contention parts not spam, mail not spam
>>Nov 26 11:15:45.352111 check[27631]: [ 3] mail 1 is not known spam.
>>Nov 26 11:15:45.352208 check[27631]: [ 5] disconnecting from server
>>wonder.cloudmark.com
>>Nov 26 11:15:45.352409 check[27631]: [ 4] wonder.cloudmark.com << 5
>>Nov 26 11:15:45.352482 check[27631]: [ 6] a=q
>>debug: Using results from Razor v2.36
>>debug: Found Razor2 part: part=0 engine=4 ct=0 cf=0
>>debug: leaving helper-app run mode
>>debug: Razor2 results: spam? 0  highest cf score: 0
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>implements 'check_tick'
>>debug: running raw-body-text per-line regexp tests; score so far=-2.623
>>debug: running full-text regexp tests; score so far=-2.623
>>debug: Razor2 is available
>>debug: Current PATH is: /sbin:/bin:/usr/sbin:/usr/bin
>>debug: Pyzor is not available: pyzor not found
>>debug: Running tests for priority: 500
>>debug: RBL: success for 1 of 1 queries
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>implements 'check_post_dnsbl'
>>debug: running meta tests; score so far=-2.623
>>debug: running header regexp tests; score so far=-1.053
>>debug: running body-text per-line regexp tests; score so far=-1.053
>>debug: running uri tests; score so far=-1.053
>>debug: running raw-body-text per-line regexp tests; score so far=-1.053
>>debug: running full-text regexp tests; score so far=-1.053
>>debug: Running tests for priority: 1000
>>debug: running meta tests; score so far=-1.053
>>debug: running header regexp tests; score so far=-1.053
>>debug: lock: 27631 created
>>/root/.spamassassin/auto-whitelist.lock.smithers.vbcomm.net.27631
>>debug: lock: 27631 trying to get lock on
>>/root/.spamassassin/auto-whitelist with 0 retries
>>debug: lock: 27631 link to /root/.spamassassin/auto-whitelist.lock: link
>>ok
>>debug: Tie-ing to DB file R/W in /root/.spamassassin/auto-whitelist
>>debug: auto-whitelist (db-based):
>>ignore@compiling.spamassassin.taint.org|ip=none scores 0/0
>>debug: AWL active, pre-score: -1.053, autolearn score: -1.053, mean:
>>undef, IP: undef
>>debug: DB addr list: untie-ing and unlocking.
>>debug: DB addr list: file locked, breaking lock.
>>debug: unlock: 27631 unlink /root/.spamassassin/auto-whitelist.lock
>>debug: Post AWL score: -1.053
>>debug: running body-text per-line regexp tests; score so far=-1.053
>>debug: running uri tests; score so far=-1.053
>>debug: running raw-body-text per-line regexp tests; score so far=-1.053
>>debug: running full-text regexp tests; score so far=-1.053
>>debug: is spam? score=-1.053 required=3.8
>>debug: tests=ALL_TRUSTED,MISSING_DATE,MISSING_SUBJECT,NO_REAL_NAME
>>debug:
>>
>
> subtests=__HAS_MSGID,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__SANE_MSGID,__UNUSABLE_MSGID
>
>>
>>
>>
>>Matthew K Bowman
>>Systems Administrator
>>UDCom
>>Tel: 419-524-4330
>>Fax: 419-524-8757
>>Web: http://www.udcom.com
>>Email: mbowman@udcom.com
>>Support: techsupport@udcom.com
>>Sales: sales@udcom.com
>>
>>
>>
>>
>>Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
>>Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>11/26/2004 11:06 AM
>>Please respond to MailScanner mailing list
>>
>>        To:     MAILSCANNER@JISCMAIL.AC.UK
>>        cc:
>>        Subject:        Re: Help! - MailScanner ceased working
>>
>>
>>matthew
>>
>>stop the mailscanner service
>>
>>edit the MailScanner.conf file and turn on both lots of debug options
>>
>>run checkmailscanner as the user defined in the MailScanner.conf and
>>drop the results back here..
>>
>>
>>--
>>Martin Hepworth
>>Snr Systems Administrator
>>Solid State Logic
>>Tel: +44 (0)1865 842300
>>
>>
>>Matthew Bowman wrote:
>>
>>
>>>Hello
>>>
>>>MailScanner is running with pid 842 is the only output I get. Both are
>>
>>run
>>
>>
>>>by the same user.
>>>
>>>/var/log/maillog
>>>
>>>Nov 26 10:08:09 smithers MailScanner[1503]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:08:19 smithers MailScanner[1518]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:08:29 smithers MailScanner[1519]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:08:39 smithers MailScanner[1520]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:08:49 smithers MailScanner[1521]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:08:59 smithers MailScanner[1524]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:09:09 smithers MailScanner[1526]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:09:19 smithers MailScanner[1527]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:09:29 smithers MailScanner[1528]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:09:39 smithers MailScanner[1530]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>
>>>ps
>>>
>>>root       842  0.0  1.2 13908 12524 ?       S    09:32   0:00
>>>/usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailS
>>>root       843  0.0  0.0     0    0 ?        Z    09:32   0:01
>>>[MailScanner <defunct>]
>>>root      1039  0.0  0.0     0    0 ?        Z    09:32   0:01
>>>[MailScanner <defunct>]
>>>root      1040  0.0  0.0     0    0 ?        Z    09:32   0:01
>>>[MailScanner <defunct>]
>>>root      1041  0.0  0.0     0    0 ?        Z    09:32   0:01
>>>[MailScanner <defunct>]
>>>root      1042  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>[MailScanner <defunct>]
>>>root      1043  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>[MailScanner <defunct>]
>>>root      1044  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>[MailScanner <defunct>]
>>>root      1045  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>[MailScanner <defunct>]
>>>root      1046  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>[MailScanner <defunct>]
>>>root      1539 34.2  0.0     0    0 ?        Z    10:10   0:01
>>>[MailScanner <defunct>]
>>>
>>>Thanks for your help
>>>
>>>Matthew K Bowman
>>>Systems Administrator
>>>UDCom
>>>Tel: 419-524-4330
>>>Fax: 419-524-8757
>>>Web: http://www.udcom.com
>>>Email: mbowman@udcom.com
>>>Support: techsupport@udcom.com
>>>Sales: sales@udcom.com
>>>
>>>
>>>
>>>
>>>Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
>>>Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>>11/26/2004 09:58 AM
>>>Please respond to MailScanner mailing list
>>>
>>>       To:     MAILSCANNER@JISCMAIL.AC.UK
>>>       cc:
>>>       Subject:        Re: Help! - MailScanner ceased working
>>>
>>>
>>>Matthew
>>>
>>>if results are fine from running in debug mode then it should have
>>>delivered that batch of emails.....
>>>
>>>Can you drop the output of the checkmailscanner to the list?
>>>
>>>also are you running checkmailscanner as the same user MailScanner
>>>normally runs as?
>>>
>>>--
>>>Martin Hepworth
>>>Snr Systems Administrator
>>>Solid State Logic
>>>Tel: +44 (0)1865 842300
>>>
>>>
>>>Matthew Bowman wrote:
>>>
>>>
>>>
>>>>Hello,
>>>>
>>>>One of our 3 mailscanner servers has stopped processing e-mail.  There
>>>
>>>are
>>>
>>>
>>>
>>>>no errors in /var/log/maillog or messages that indicate and sort of
>>>>problem.  Email arrives and gets put into mqueue.in and just stays
>>>
>>>there.
>>>
>>>
>>>
>>>>Nothing has changed in MailScanner.conf or sendmail.cf.  I'm at a loss
>>>
>>>as
>>>
>>>
>>>
>>>>to how this has happened all of a sudden.  I run mailscanner and
>>>>spamassassin in debug mode and the results where fine.  What else
>
> should
>
>>>I
>>>
>>>
>>>
>>>>be looking at?
>>>>
>>>>All 3 mailscanner servers run MS 4.35-11, SA 3.0.0 and Redhat 7.3
>>>>
>>>>Please help!
>>>>
>>>>Thanks
>>>>
>>>>Matthew

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Fri Nov 26 16:50:38 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:43 2006
Subject: Help! - MailScanner ceased working (debug output)
Message-ID: <mailman.5159.1137101263.24926.mailscanner@lists.mailscanner.info>

matthew

even when you ran in debug mode???


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Matthew Bowman wrote:
> Nothing hits the outbound queue (/var/spool/mqueue). All inbound email
> stays put in /var/spool/mqueue.in
>
> Matthew K Bowman
> Systems Administrator
> UDCom
> Tel: 419-524-4330
> Fax: 419-524-8757
> Web: http://www.udcom.com
> Email: mbowman@udcom.com
> Support: techsupport@udcom.com
> Sales: sales@udcom.com
>
>
>
>
> Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
> Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> 11/26/2004 11:42 AM
> Please respond to MailScanner mailing list
>
>         To:     MAILSCANNER@JISCMAIL.AC.UK
>         cc:
>         Subject:        Re: Help! - MailScanner ceased working (debug
> output)
>
>
> Matthew
>
> that'll be normal. the other '3' are already being scanned by other
> MailScanner children.
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Matthew Bowman wrote:
>
>>Not at all, everything goes to mqueue.in, mailscanner (according to
>>maillog) doesn't scan the email thus its not delivered.
>>
>>I should be seeing something like:
>>
>>MailScanner[29593]: New Batch: Found 4 messages waiting
>>MailScanner[29593]: New Batch: Scanning 1 messages, 4568 bytes
>>MailScanner[29593]: Virus and Content Scanning: Starting
>>
>>But dont.
>>
>>Matthew K Bowman
>>Systems Administrator
>>UDCom
>>Tel: 419-524-4330
>>Fax: 419-524-8757
>>Web: http://www.udcom.com
>>Email: mbowman@udcom.com
>>Support: techsupport@udcom.com
>>Sales: sales@udcom.com
>>
>>
>>
>>
>>Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
>>Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>11/26/2004 11:34 AM
>>Please respond to MailScanner mailing list
>>
>>        To:     MAILSCANNER@JISCMAIL.AC.UK
>>        cc:
>>        Subject:        Re: Help! - MailScanner ceased working (debug
>>output)
>>
>>
>>matthew
>>
>>Looks fine - I presume stuff hit the outgoing MTA queue?
>>
>>
>>--
>>Martin Hepworth
>>Snr Systems Administrator
>>Solid State Logic
>>Tel: +44 (0)1865 842300
>>
>>
>>Matthew Bowman wrote:
>>
>>
>>>Debug output
>>>
>>>Starting MailScanner...
>>>In Debugging mode, not forking...
>>>debug: SpamAssassin version 3.0.0
>>>debug: Score set 0 chosen.
>>>debug: running in taint mode? no
>>>SA bayes lock is /root/.spamassassin/bayes.lock
>>>Bayes lock is at /root/.spamassassin/bayes.lock
>>>debug: ignore: test message to precompile patterns and load modules
>>>debug: using "/etc/mail/spamassassin/init.pre" for site rules init.pre
>>>debug: config: read file /etc/mail/spamassassin/init.pre
>>>debug: using "/usr/share/spamassassin" for default rules dir
>>>debug: config: read file /usr/share/spamassassin/10_misc.cf
>>>debug: config: read file /usr/share/spamassassin/20_anti_ratware.cf
>>>debug: config: read file /usr/share/spamassassin/20_body_tests.cf
>>>debug: config: read file /usr/share/spamassassin/20_compensate.cf
>>>debug: config: read file /usr/share/spamassassin/20_dnsbl_tests.cf
>>>debug: config: read file /usr/share/spamassassin/20_drugs.cf
>>>debug: config: read file /usr/share/spamassassin/20_fake_helo_tests.cf
>>>debug: config: read file /usr/share/spamassassin/20_head_tests.cf
>>>debug: config: read file /usr/share/spamassassin/20_html_tests.cf
>>>debug: config: read file /usr/share/spamassassin/20_meta_tests.cf
>>>debug: config: read file /usr/share/spamassassin/20_phrases.cf
>>>debug: config: read file /usr/share/spamassassin/20_porn.cf
>>>debug: config: read file /usr/share/spamassassin/20_ratware.cf
>>>debug: config: read file /usr/share/spamassassin/20_uri_tests.cf
>>>debug: config: read file /usr/share/spamassassin/23_bayes.cf
>>>debug: config: read file /usr/share/spamassassin/25_body_tests_es.cf
>>>debug: config: read file /usr/share/spamassassin/25_hashcash.cf
>>>debug: config: read file /usr/share/spamassassin/25_spf.cf
>>>debug: config: read file /usr/share/spamassassin/25_uribl.cf
>>>debug: config: read file /usr/share/spamassassin/30_text_de.cf
>>>debug: config: read file /usr/share/spamassassin/30_text_fr.cf
>>>debug: config: read file /usr/share/spamassassin/30_text_nl.cf
>>>debug: config: read file /usr/share/spamassassin/30_text_pl.cf
>>>debug: config: read file /usr/share/spamassassin/50_scores.cf
>>>debug: config: read file /usr/share/spamassassin/60_whitelist.cf
>>>debug: using "/etc/mail/spamassassin" for site rules dir
>>>debug: config: read file /etc/mail/spamassassin/antidrug.cf
>>>debug: config: read file /etc/mail/spamassassin/bigevil.cf
>>>debug: config: read file /etc/mail/spamassassin/local.cf
>>>debug: using "/etc/MailScanner/spam.assassin.prefs.conf" for user prefs
>>>file
>>>debug: config: read file /etc/MailScanner/spam.assassin.prefs.conf
>>>debug: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
>>>debug: plugin: registered
>>>Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>>debug: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC
>>>debug: plugin: registered
>>>Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40)
>>>debug: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
>>>debug: plugin: registered
>>
>>Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798)
>>
>>
>>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>>implements 'parse_config'
>>>debug: plugin: Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40)
>>>implements 'parse_config'
>>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>>inhibited further callbacks
>>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>>inhibited further callbacks
>>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>>inhibited further callbacks
>>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>>inhibited further callbacks
>>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>>inhibited further callbacks
>>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>>inhibited further callbacks
>>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>>inhibited further callbacks
>>>debug: Score set 1 chosen.
>>>debug: ---- MIME PARSER START ----
>>>debug: main message type: text/plain
>>>debug: parsing normal part
>>>debug: added part, type: text/plain
>>>debug: ---- MIME PARSER END ----
>>>debug: metadata: X-Spam-Relays-Trusted:
>>>debug: metadata: X-Spam-Relays-Untrusted:
>>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>>implements 'parsed_metadata'
>>>debug: is Net::DNS::Resolver available? yes
>>>debug: Net::DNS version: 0.39_01
>>>debug: trying (3) sourceforge.net...
>>>debug: looking up NS for 'sourceforge.net'
>>>debug: NS lookup of sourceforge.net succeeded => Dns available (set
>>>dns_available to hardcode)
>>>debug: is DNS available? 1
>>>debug: decoding: no encoding detected
>>>debug: URIDNSBL: domains to query:
>>>debug: all '*From' addrs: ignore@compiling.spamassassin.taint.org
>>>debug: Running tests for priority: 0
>>>debug: running header regexp tests; score so far=0
>>>debug: registering glue method for check_uridnsbl
>>>(Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810))
>>>debug: registering glue method for check_for_spf_pass
>>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>>debug: SPF: message was delivered entirely via trusted relays, not
>>>required
>>>debug: all '*To' addrs:
>>>debug: registering glue method for check_hashcash_value
>>>(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40))
>>>debug: registering glue method for check_for_spf_helo_fail
>>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>>debug: SPF: message was delivered entirely via trusted relays, not
>>>required
>>>debug: registering glue method for check_for_spf_helo_pass
>>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>>debug: registering glue method for check_hashcash_double_spend
>>>(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40))
>>>debug: registering glue method for check_for_spf_softfail
>>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>>debug: registering glue method for check_for_spf_helo_softfail
>>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>>debug: running body-text per-line regexp tests; score so far=-2.623
>>>debug: running uri tests; score so far=-2.623
>>>debug: Razor2 is available
>>>debug: entering helper-app run mode
>>>Razor-Log: Computed razorhome from env: /root/.razor
>>>Razor-Log: Found razorhome: /root/.razor
>>>Razor-Log: read_file: 16 items read from /root/.razor/razor-agent.conf
>>>Nov 26 11:15:44.875895 check[27631]: [ 1] [bootup] Logging initiated
>>>LogDebugLevel=9 to stdout
>>>Nov 26 11:15:44.876392 check[27631]: [ 5] computed
>>
>>razorhome=/root/.razor,
>>
>>
>>>conf=/root/.razor/razor-agent.conf, ident=/root/.razor/identity
>>>Nov 26 11:15:44.876648 check[27631]: [ 8] Client supported_engines: 1 2
>>
>>3
>>
>>
>>>4
>>>Nov 26 11:15:44.877247 check[27631]: [ 8]  prep_mail done: mail 1
>>>headers=102, mime0=1376
>>>Nov 26 11:15:44.877704 check[27631]: [ 5] read_file: 8 items read from
>>>/root/.razor/servers.discovery.lst
>>>Nov 26 11:15:44.878063 check[27631]: [ 5] read_file: 2 items read from
>>>/root/.razor/servers.nomination.lst
>>>Nov 26 11:15:44.878331 check[27631]: [ 5] read_file: 3 items read from
>>>/root/.razor/servers.catalogue.lst
>>>Nov 26 11:15:44.878740 check[27631]: [ 9] Assigning defaults to
>>>joy.cloudmark.com
>>>Nov 26 11:15:44.878926 check[27631]: [ 9] Assigning defaults to
>>>folly.cloudmark.com
>>>Nov 26 11:15:44.879179 check[27631]: [ 9] Assigning defaults to
>>>pride.cloudmark.com
>>>Nov 26 11:15:44.879383 check[27631]: [ 9] Assigning defaults to
>>>wonder.cloudmark.com
>>>Nov 26 11:15:44.879559 check[27631]: [ 9] Assigning defaults to
>>>thrill.cloudmark.com
>>>Nov 26 11:15:44.880412 check[27631]: [ 5] read_file: 14 items read from
>>>/root/.razor/server.truth.cloudmark.com.conf
>>>Nov 26 11:15:44.881004 check[27631]: [ 5] read_file: 14 items read from
>>>/root/.razor/server.stress.cloudmark.com.conf
>>>Nov 26 11:15:44.881542 check[27631]: [ 5] read_file: 12 items read from
>>>/root/.razor/server.folly.cloudmark.com.conf
>>>Nov 26 11:15:44.882114 check[27631]: [ 5] read_file: 14 items read from
>>>/root/.razor/server.rancor.cloudmark.com.conf
>>>Nov 26 11:15:44.882702 check[27631]: [ 5] read_file: 16 items read from
>>>/root/.razor/server.pride.cloudmark.com.conf
>>>Nov 26 11:15:44.883256 check[27631]: [ 5] read_file: 14 items read from
>>>/root/.razor/server.prejudice.cloudmark.com.conf
>>>Nov 26 11:15:44.883832 check[27631]: [ 5] read_file: 16 items read from
>>>/root/.razor/server.wonder.cloudmark.com.conf
>>>Nov 26 11:15:44.884384 check[27631]: [ 5] read_file: 14 items read from
>>>/root/.razor/server.anxiety.cloudmark.com.conf
>>>Nov 26 11:15:44.884946 check[27631]: [ 5] read_file: 14 items read from
>>>/root/.razor/server.tension.cloudmark.com.conf
>>>Nov 26 11:15:44.885523 check[27631]: [ 5] read_file: 16 items read from
>>>/root/.razor/server.thrill.cloudmark.com.conf
>>>Nov 26 11:15:44.886150 check[27631]: [ 5] read_file: 14 items read from
>>>/root/.razor/server.malice.cloudmark.com.conf
>>>Nov 26 11:15:44.886757 check[27631]: [ 5] read_file: 14 items read from
>>>/root/.razor/server.shock.cloudmark.com.conf
>>>Nov 26 11:15:44.887082 check[27631]: [ 5] 154361 seconds before closest
>>>server discovery
>>>Nov 26 11:15:44.887338 check[27631]: [ 6] pride.cloudmark.com is a
>>>Catalogue Server srl 5048; computed min_cf=6, Server se: C8
>>>Nov 26 11:15:44.887597 check[27631]: [ 8] Computed supported_engines: 4
>>>Nov 26 11:15:44.887759 check[27631]: [ 8] Using next closest server
>>>pride.cloudmark.com:2703, cached info srl 5048
>>>Nov 26 11:15:44.887892 check[27631]: [ 8] mail 1 has no subject
>>>Nov 26 11:15:44.889464 check[27631]: [ 6] preproc: mail 1.0 went from
>>
>>1376
>>
>>
>>>bytes to 1339
>>>Nov 26 11:15:44.889655 check[27631]: [ 6] computing sigs for mail 1.0,
>>
>>len
>>
>>
>>>1339
>>>Nov 26 11:15:44.891458 check[27631]: [ 6] skipping whitelist file
>>>(empty?): /root/.razor/razor-whitelist
>>>Nov 26 11:15:44.891659 check[27631]: [ 5] Connecting to
>>>pride.cloudmark.com ...
>>>Nov 26 11:15:44.956354 check[27631]: [ 3] Unable to connect to
>>>pride.cloudmark.com:2703; Reason: Connection refused.
>>>Nov 26 11:15:44.956634 check[27631]: [ 5] 161663 seconds before closest
>>>server discovery
>>>Nov 26 11:15:44.956874 check[27631]: [ 6] wonder.cloudmark.com is a
>>>Catalogue Server srl 5048; computed min_cf=6, Server se: C8
>>>Nov 26 11:15:44.957085 check[27631]: [ 8] Computed supported_engines: 4
>>>Nov 26 11:15:44.957231 check[27631]: [ 8] Using next closest server
>>>wonder.cloudmark.com:2703, cached info srl 5048
>>>Nov 26 11:15:44.957392 check[27631]: [ 5] Connecting to
>>>wonder.cloudmark.com ...
>>>Nov 26 11:15:45.077689 check[27631]: [ 8] Connection established
>>>Nov 26 11:15:45.077888 check[27631]: [ 4] wonder.cloudmark.com >> 36
>>>server greeting: sn=C&srl=5048&a=l&a=cg&ep4=7542-10
>>>Nov 26 11:15:45.078283 check[27631]: [ 4] wonder.cloudmark.com << 25
>>>Nov 26 11:15:45.078369 check[27631]: [ 6] cn=razor-agents&cv=2.36
>>>Nov 26 11:15:45.078670 check[27631]: [ 6] wonder.cloudmark.com is a
>>>Catalogue Server srl 5048; computed min_cf=6, Server se: C8
>>>Nov 26 11:15:45.078891 check[27631]: [ 8] Computed supported_engines: 4
>>>Nov 26 11:15:45.079110 check[27631]: [ 8] mail 1.0 e4 sig:
>>>xFaZIZUVHk90OQfARnenjx5BZTMA
>>>Nov 26 11:15:45.079296 check[27631]: [ 8] preparing 1 queries
>>>Nov 26 11:15:45.079546 check[27631]: [ 8] sending 1 batches
>>>Nov 26 11:15:45.079745 check[27631]: [ 4] wonder.cloudmark.com << 52
>>>Nov 26 11:15:45.079820 check[27631]: [ 6]
>>>a=c&e=4&ep4=7542-10&s=xFaZIZUVHk90OQfARnenjx5BZTMA
>>>Nov 26 11:15:45.351281 check[27631]: [ 4] wonder.cloudmark.com >> 5
>>>Nov 26 11:15:45.351376 check[27631]: [ 6] response to sent.2
>>>p=0
>>>Nov 26 11:15:45.351792 check[27631]: [ 6] mail 1.0 e=4
>>>sig=xFaZIZUVHk90OQfARnenjx5BZTMA: sig not found.
>>>Nov 26 11:15:45.351954 check[27631]: [ 7] method 4: mail 1.0:
>>>no-contention part, spam=0
>>>Nov 26 11:15:45.352034 check[27631]: [ 7] method 4: mail 1: all
>>>non-contention parts not spam, mail not spam
>>>Nov 26 11:15:45.352111 check[27631]: [ 3] mail 1 is not known spam.
>>>Nov 26 11:15:45.352208 check[27631]: [ 5] disconnecting from server
>>>wonder.cloudmark.com
>>>Nov 26 11:15:45.352409 check[27631]: [ 4] wonder.cloudmark.com << 5
>>>Nov 26 11:15:45.352482 check[27631]: [ 6] a=q
>>>debug: Using results from Razor v2.36
>>>debug: Found Razor2 part: part=0 engine=4 ct=0 cf=0
>>>debug: leaving helper-app run mode
>>>debug: Razor2 results: spam? 0  highest cf score: 0
>>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>>implements 'check_tick'
>>>debug: running raw-body-text per-line regexp tests; score so far=-2.623
>>>debug: running full-text regexp tests; score so far=-2.623
>>>debug: Razor2 is available
>>>debug: Current PATH is: /sbin:/bin:/usr/sbin:/usr/bin
>>>debug: Pyzor is not available: pyzor not found
>>>debug: Running tests for priority: 500
>>>debug: RBL: success for 1 of 1 queries
>>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>>implements 'check_post_dnsbl'
>>>debug: running meta tests; score so far=-2.623
>>>debug: running header regexp tests; score so far=-1.053
>>>debug: running body-text per-line regexp tests; score so far=-1.053
>>>debug: running uri tests; score so far=-1.053
>>>debug: running raw-body-text per-line regexp tests; score so far=-1.053
>>>debug: running full-text regexp tests; score so far=-1.053
>>>debug: Running tests for priority: 1000
>>>debug: running meta tests; score so far=-1.053
>>>debug: running header regexp tests; score so far=-1.053
>>>debug: lock: 27631 created
>>>/root/.spamassassin/auto-whitelist.lock.smithers.vbcomm.net.27631
>>>debug: lock: 27631 trying to get lock on
>>>/root/.spamassassin/auto-whitelist with 0 retries
>>>debug: lock: 27631 link to /root/.spamassassin/auto-whitelist.lock: link
>>>ok
>>>debug: Tie-ing to DB file R/W in /root/.spamassassin/auto-whitelist
>>>debug: auto-whitelist (db-based):
>>>ignore@compiling.spamassassin.taint.org|ip=none scores 0/0
>>>debug: AWL active, pre-score: -1.053, autolearn score: -1.053, mean:
>>>undef, IP: undef
>>>debug: DB addr list: untie-ing and unlocking.
>>>debug: DB addr list: file locked, breaking lock.
>>>debug: unlock: 27631 unlink /root/.spamassassin/auto-whitelist.lock
>>>debug: Post AWL score: -1.053
>>>debug: running body-text per-line regexp tests; score so far=-1.053
>>>debug: running uri tests; score so far=-1.053
>>>debug: running raw-body-text per-line regexp tests; score so far=-1.053
>>>debug: running full-text regexp tests; score so far=-1.053
>>>debug: is spam? score=-1.053 required=3.8
>>>debug: tests=ALL_TRUSTED,MISSING_DATE,MISSING_SUBJECT,NO_REAL_NAME
>>>debug:
>>>
>>
>>
> subtests=__HAS_MSGID,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__SANE_MSGID,__UNUSABLE_MSGID
>
>>>
>>>
>>>Matthew K Bowman
>>>Systems Administrator
>>>UDCom
>>>Tel: 419-524-4330
>>>Fax: 419-524-8757
>>>Web: http://www.udcom.com
>>>Email: mbowman@udcom.com
>>>Support: techsupport@udcom.com
>>>Sales: sales@udcom.com
>>>
>>>
>>>
>>>
>>>Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
>>>Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>>11/26/2004 11:06 AM
>>>Please respond to MailScanner mailing list
>>>
>>>       To:     MAILSCANNER@JISCMAIL.AC.UK
>>>       cc:
>>>       Subject:        Re: Help! - MailScanner ceased working
>>>
>>>
>>>matthew
>>>
>>>stop the mailscanner service
>>>
>>>edit the MailScanner.conf file and turn on both lots of debug options
>>>
>>>run checkmailscanner as the user defined in the MailScanner.conf and
>>>drop the results back here..
>>>
>>>
>>>--
>>>Martin Hepworth
>>>Snr Systems Administrator
>>>Solid State Logic
>>>Tel: +44 (0)1865 842300
>>>
>>>
>>>Matthew Bowman wrote:
>>>
>>>
>>>
>>>>Hello
>>>>
>>>>MailScanner is running with pid 842 is the only output I get. Both are
>>>
>>>run
>>>
>>>
>>>
>>>>by the same user.
>>>>
>>>>/var/log/maillog
>>>>
>>>>Nov 26 10:08:09 smithers MailScanner[1503]: MailScanner E-Mail Virus
>>>>Scanner version 4.35.11 starting...
>>>>Nov 26 10:08:19 smithers MailScanner[1518]: MailScanner E-Mail Virus
>>>>Scanner version 4.35.11 starting...
>>>>Nov 26 10:08:29 smithers MailScanner[1519]: MailScanner E-Mail Virus
>>>>Scanner version 4.35.11 starting...
>>>>Nov 26 10:08:39 smithers MailScanner[1520]: MailScanner E-Mail Virus
>>>>Scanner version 4.35.11 starting...
>>>>Nov 26 10:08:49 smithers MailScanner[1521]: MailScanner E-Mail Virus
>>>>Scanner version 4.35.11 starting...
>>>>Nov 26 10:08:59 smithers MailScanner[1524]: MailScanner E-Mail Virus
>>>>Scanner version 4.35.11 starting...
>>>>Nov 26 10:09:09 smithers MailScanner[1526]: MailScanner E-Mail Virus
>>>>Scanner version 4.35.11 starting...
>>>>Nov 26 10:09:19 smithers MailScanner[1527]: MailScanner E-Mail Virus
>>>>Scanner version 4.35.11 starting...
>>>>Nov 26 10:09:29 smithers MailScanner[1528]: MailScanner E-Mail Virus
>>>>Scanner version 4.35.11 starting...
>>>>Nov 26 10:09:39 smithers MailScanner[1530]: MailScanner E-Mail Virus
>>>>Scanner version 4.35.11 starting...
>>>>
>>>>ps
>>>>
>>>>root       842  0.0  1.2 13908 12524 ?       S    09:32   0:00
>>>>/usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailS
>>>>root       843  0.0  0.0     0    0 ?        Z    09:32   0:01
>>>>[MailScanner <defunct>]
>>>>root      1039  0.0  0.0     0    0 ?        Z    09:32   0:01
>>>>[MailScanner <defunct>]
>>>>root      1040  0.0  0.0     0    0 ?        Z    09:32   0:01
>>>>[MailScanner <defunct>]
>>>>root      1041  0.0  0.0     0    0 ?        Z    09:32   0:01
>>>>[MailScanner <defunct>]
>>>>root      1042  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>>[MailScanner <defunct>]
>>>>root      1043  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>>[MailScanner <defunct>]
>>>>root      1044  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>>[MailScanner <defunct>]
>>>>root      1045  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>>[MailScanner <defunct>]
>>>>root      1046  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>>[MailScanner <defunct>]
>>>>root      1539 34.2  0.0     0    0 ?        Z    10:10   0:01
>>>>[MailScanner <defunct>]
>>>>
>>>>Thanks for your help
>>>>
>>>>Matthew K Bowman
>>>>Systems Administrator
>>>>UDCom
>>>>Tel: 419-524-4330
>>>>Fax: 419-524-8757
>>>>Web: http://www.udcom.com
>>>>Email: mbowman@udcom.com
>>>>Support: techsupport@udcom.com
>>>>Sales: sales@udcom.com
>>>>
>>>>
>>>>
>>>>
>>>>Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
>>>>Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>>>11/26/2004 09:58 AM
>>>>Please respond to MailScanner mailing list
>>>>
>>>>      To:     MAILSCANNER@JISCMAIL.AC.UK
>>>>      cc:
>>>>      Subject:        Re: Help! - MailScanner ceased working
>>>>
>>>>
>>>>Matthew
>>>>
>>>>if results are fine from running in debug mode then it should have
>>>>delivered that batch of emails.....
>>>>
>>>>Can you drop the output of the checkmailscanner to the list?
>>>>
>>>>also are you running checkmailscanner as the same user MailScanner
>>>>normally runs as?
>>>>
>>>>--
>>>>Martin Hepworth
>>>>Snr Systems Administrator
>>>>Solid State Logic
>>>>Tel: +44 (0)1865 842300
>>>>
>>>>
>>>>Matthew Bowman wrote:
>>>>
>>>>
>>>>
>>>>
>>>>>Hello,
>>>>>
>>>>>One of our 3 mailscanner servers has stopped processing e-mail.  There
>>>>
>>>>are
>>>>
>>>>
>>>>
>>>>
>>>>>no errors in /var/log/maillog or messages that indicate and sort of
>>>>>problem.  Email arrives and gets put into mqueue.in and just stays
>>>>
>>>>there.
>>>>
>>>>
>>>>
>>>>
>>>>>Nothing has changed in MailScanner.conf or sendmail.cf.  I'm at a loss
>>>>
>>>>as
>>>>
>>>>
>>>>
>>>>
>>>>>to how this has happened all of a sudden.  I run mailscanner and
>>>>>spamassassin in debug mode and the results where fine.  What else
>>
>>should
>>
>>
>>>>I
>>>>
>>>>
>>>>
>>>>
>>>>>be looking at?
>>>>>
>>>>>All 3 mailscanner servers run MS 4.35-11, SA 3.0.0 and Redhat 7.3
>>>>>
>>>>>Please help!
>>>>>
>>>>>Thanks
>>>>>
>>>>>Matthew
>>>>>
>>>>>------------------------ MailScanner list ------------------------
>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>>>'leave mailscanner' in the body of the email.
>>>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>>
>>>>>Support MailScanner development - buy the book off the website!
>>>>
>>>>
>>>>**********************************************************************
>>>>
>>>>This email and any files transmitted with it are confidential and
>>>>intended solely for the use of the individual or entity to whom they
>>>>are addressed. If you have received this email in error please notify
>>>>the system manager.
>>>>
>>>>This footnote confirms that this email message has been swept
>>>>for the presence of computer viruses and is believed to be clean.
>>>>
>>>>**********************************************************************
>>>>
>>>>------------------------ MailScanner list ------------------------
>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>>'leave mailscanner' in the body of the email.
>>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>
>>>>Support MailScanner development - buy the book off the website!
>>>>
>>>>------------------------ MailScanner list ------------------------
>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>>'leave mailscanner' in the body of the email.
>>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>
>>>>Support MailScanner development - buy the book off the website!
>>>
>>>
>>>**********************************************************************
>>>
>>>This email and any files transmitted with it are confidential and
>>>intended solely for the use of the individual or entity to whom they
>>>are addressed. If you have received this email in error please notify
>>>the system manager.
>>>
>>>This footnote confirms that this email message has been swept
>>>for the presence of computer viruses and is believed to be clean.
>>>
>>>**********************************************************************
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>
>>
>>**********************************************************************
>>
>>This email and any files transmitted with it are confidential and
>>intended solely for the use of the individual or entity to whom they
>>are addressed. If you have received this email in error please notify
>>the system manager.
>>
>>This footnote confirms that this email message has been swept
>>for the presence of computer viruses and is believed to be clean.
>>
>>**********************************************************************
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From marco at XSSNET.COM  Fri Nov 26 16:50:41 2004
From: marco at XSSNET.COM (Marco Benton)
Date: Thu Jan 12 21:27:43 2006
Subject: Help! - MailScanner ceased working (debug output)
Message-ID: <mailman.5160.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Matthew Bowman wrote:

| Nothing hits the outbound queue (/var/spool/mqueue). All inbound
| email stays put in /var/spool/mqueue.in


how about trying to turn off most things in MailScanner.conf like SA
and virus checks.  then run debug.  there seems to be something
missing at the end of the debug...  like untieing bayes and other stuff.

- --

Marco Benton - BOFH, BSMFH
Network Consultant

BOFH excuse #366: The cause of the problem is: Webmasters kidnapped by
evil cult.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBp1602+PYgoYkw8ERAuoeAJ0fEKXm7t8g+95+Wc/rkLwT7MdJNQCeOASU
EYvc78f7CM4+FGV9xxih50E=
=2mRo
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mbowman at UDCOM.COM  Fri Nov 26 17:49:19 2004
From: mbowman at UDCOM.COM (Matthew Bowman)
Date: Thu Jan 12 21:27:43 2006
Subject: Help! - MailScanner ceased working (debug output)
Message-ID: <mailman.5161.1137101263.24926.mailscanner@lists.mailscanner.info>

I'm just seeing MailScanner starting all the time

Matthew K Bowman
Systems Administrator
UDCom
Tel: 419-524-4330
Fax: 419-524-8757
Web: http://www.udcom.com
Email: mbowman@udcom.com
Support: techsupport@udcom.com
Sales: sales@udcom.com




Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
11/26/2004 11:45 AM
Please respond to MailScanner mailing list

        To:     MAILSCANNER@JISCMAIL.AC.UK
        cc:
        Subject:        Re: Help! - MailScanner ceased working (debug
output)


matt

sorry - caffiene level dropping.... I'll start again..

what are you seeing then...just the MS restarting all the time?

I presume the debug was done as the MS user defined in MailScanner.conf?
Which by the looks of your debug is root...


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Matthew Bowman wrote:
> Not at all, everything goes to mqueue.in, mailscanner (according to
> maillog) doesn't scan the email thus its not delivered.
>
> I should be seeing something like:
>
> MailScanner[29593]: New Batch: Found 4 messages waiting
> MailScanner[29593]: New Batch: Scanning 1 messages, 4568 bytes
> MailScanner[29593]: Virus and Content Scanning: Starting
>
> But dont.
>
> Matthew K Bowman
> Systems Administrator
> UDCom
> Tel: 419-524-4330
> Fax: 419-524-8757
> Web: http://www.udcom.com
> Email: mbowman@udcom.com
> Support: techsupport@udcom.com
> Sales: sales@udcom.com
>
>
>
>
> Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
> Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> 11/26/2004 11:34 AM
> Please respond to MailScanner mailing list
>
>         To:     MAILSCANNER@JISCMAIL.AC.UK
>         cc:
>         Subject:        Re: Help! - MailScanner ceased working (debug
> output)
>
>
> matthew
>
> Looks fine - I presume stuff hit the outgoing MTA queue?
>
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Matthew Bowman wrote:
>
>>Debug output
>>
>>Starting MailScanner...
>>In Debugging mode, not forking...
>>debug: SpamAssassin version 3.0.0
>>debug: Score set 0 chosen.
>>debug: running in taint mode? no
>>SA bayes lock is /root/.spamassassin/bayes.lock
>>Bayes lock is at /root/.spamassassin/bayes.lock
>>debug: ignore: test message to precompile patterns and load modules
>>debug: using "/etc/mail/spamassassin/init.pre" for site rules init.pre
>>debug: config: read file /etc/mail/spamassassin/init.pre
>>debug: using "/usr/share/spamassassin" for default rules dir
>>debug: config: read file /usr/share/spamassassin/10_misc.cf
>>debug: config: read file /usr/share/spamassassin/20_anti_ratware.cf
>>debug: config: read file /usr/share/spamassassin/20_body_tests.cf
>>debug: config: read file /usr/share/spamassassin/20_compensate.cf
>>debug: config: read file /usr/share/spamassassin/20_dnsbl_tests.cf
>>debug: config: read file /usr/share/spamassassin/20_drugs.cf
>>debug: config: read file /usr/share/spamassassin/20_fake_helo_tests.cf
>>debug: config: read file /usr/share/spamassassin/20_head_tests.cf
>>debug: config: read file /usr/share/spamassassin/20_html_tests.cf
>>debug: config: read file /usr/share/spamassassin/20_meta_tests.cf
>>debug: config: read file /usr/share/spamassassin/20_phrases.cf
>>debug: config: read file /usr/share/spamassassin/20_porn.cf
>>debug: config: read file /usr/share/spamassassin/20_ratware.cf
>>debug: config: read file /usr/share/spamassassin/20_uri_tests.cf
>>debug: config: read file /usr/share/spamassassin/23_bayes.cf
>>debug: config: read file /usr/share/spamassassin/25_body_tests_es.cf
>>debug: config: read file /usr/share/spamassassin/25_hashcash.cf
>>debug: config: read file /usr/share/spamassassin/25_spf.cf
>>debug: config: read file /usr/share/spamassassin/25_uribl.cf
>>debug: config: read file /usr/share/spamassassin/30_text_de.cf
>>debug: config: read file /usr/share/spamassassin/30_text_fr.cf
>>debug: config: read file /usr/share/spamassassin/30_text_nl.cf
>>debug: config: read file /usr/share/spamassassin/30_text_pl.cf
>>debug: config: read file /usr/share/spamassassin/50_scores.cf
>>debug: config: read file /usr/share/spamassassin/60_whitelist.cf
>>debug: using "/etc/mail/spamassassin" for site rules dir
>>debug: config: read file /etc/mail/spamassassin/antidrug.cf
>>debug: config: read file /etc/mail/spamassassin/bigevil.cf
>>debug: config: read file /etc/mail/spamassassin/local.cf
>>debug: using "/etc/MailScanner/spam.assassin.prefs.conf" for user prefs
>>file
>>debug: config: read file /etc/MailScanner/spam.assassin.prefs.conf
>>debug: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
>>debug: plugin: registered
>>Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>debug: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC
>>debug: plugin: registered
>>Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40)
>>debug: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
>>debug: plugin: registered
>
> Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798)
>
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>implements 'parse_config'
>>debug: plugin: Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40)
>>implements 'parse_config'
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>inhibited further callbacks
>>debug: Score set 1 chosen.
>>debug: ---- MIME PARSER START ----
>>debug: main message type: text/plain
>>debug: parsing normal part
>>debug: added part, type: text/plain
>>debug: ---- MIME PARSER END ----
>>debug: metadata: X-Spam-Relays-Trusted:
>>debug: metadata: X-Spam-Relays-Untrusted:
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>implements 'parsed_metadata'
>>debug: is Net::DNS::Resolver available? yes
>>debug: Net::DNS version: 0.39_01
>>debug: trying (3) sourceforge.net...
>>debug: looking up NS for 'sourceforge.net'
>>debug: NS lookup of sourceforge.net succeeded => Dns available (set
>>dns_available to hardcode)
>>debug: is DNS available? 1
>>debug: decoding: no encoding detected
>>debug: URIDNSBL: domains to query:
>>debug: all '*From' addrs: ignore@compiling.spamassassin.taint.org
>>debug: Running tests for priority: 0
>>debug: running header regexp tests; score so far=0
>>debug: registering glue method for check_uridnsbl
>>(Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810))
>>debug: registering glue method for check_for_spf_pass
>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>debug: SPF: message was delivered entirely via trusted relays, not
>>required
>>debug: all '*To' addrs:
>>debug: registering glue method for check_hashcash_value
>>(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40))
>>debug: registering glue method for check_for_spf_helo_fail
>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>debug: SPF: message was delivered entirely via trusted relays, not
>>required
>>debug: registering glue method for check_for_spf_helo_pass
>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>debug: registering glue method for check_hashcash_double_spend
>>(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40))
>>debug: registering glue method for check_for_spf_softfail
>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>debug: registering glue method for check_for_spf_helo_softfail
>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>debug: running body-text per-line regexp tests; score so far=-2.623
>>debug: running uri tests; score so far=-2.623
>>debug: Razor2 is available
>>debug: entering helper-app run mode
>> Razor-Log: Computed razorhome from env: /root/.razor
>> Razor-Log: Found razorhome: /root/.razor
>> Razor-Log: read_file: 16 items read from /root/.razor/razor-agent.conf
>>Nov 26 11:15:44.875895 check[27631]: [ 1] [bootup] Logging initiated
>>LogDebugLevel=9 to stdout
>>Nov 26 11:15:44.876392 check[27631]: [ 5] computed
>
> razorhome=/root/.razor,
>
>>conf=/root/.razor/razor-agent.conf, ident=/root/.razor/identity
>>Nov 26 11:15:44.876648 check[27631]: [ 8] Client supported_engines: 1 2
>
> 3
>
>>4
>>Nov 26 11:15:44.877247 check[27631]: [ 8]  prep_mail done: mail 1
>>headers=102, mime0=1376
>>Nov 26 11:15:44.877704 check[27631]: [ 5] read_file: 8 items read from
>>/root/.razor/servers.discovery.lst
>>Nov 26 11:15:44.878063 check[27631]: [ 5] read_file: 2 items read from
>>/root/.razor/servers.nomination.lst
>>Nov 26 11:15:44.878331 check[27631]: [ 5] read_file: 3 items read from
>>/root/.razor/servers.catalogue.lst
>>Nov 26 11:15:44.878740 check[27631]: [ 9] Assigning defaults to
>>joy.cloudmark.com
>>Nov 26 11:15:44.878926 check[27631]: [ 9] Assigning defaults to
>>folly.cloudmark.com
>>Nov 26 11:15:44.879179 check[27631]: [ 9] Assigning defaults to
>>pride.cloudmark.com
>>Nov 26 11:15:44.879383 check[27631]: [ 9] Assigning defaults to
>>wonder.cloudmark.com
>>Nov 26 11:15:44.879559 check[27631]: [ 9] Assigning defaults to
>>thrill.cloudmark.com
>>Nov 26 11:15:44.880412 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.truth.cloudmark.com.conf
>>Nov 26 11:15:44.881004 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.stress.cloudmark.com.conf
>>Nov 26 11:15:44.881542 check[27631]: [ 5] read_file: 12 items read from
>>/root/.razor/server.folly.cloudmark.com.conf
>>Nov 26 11:15:44.882114 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.rancor.cloudmark.com.conf
>>Nov 26 11:15:44.882702 check[27631]: [ 5] read_file: 16 items read from
>>/root/.razor/server.pride.cloudmark.com.conf
>>Nov 26 11:15:44.883256 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.prejudice.cloudmark.com.conf
>>Nov 26 11:15:44.883832 check[27631]: [ 5] read_file: 16 items read from
>>/root/.razor/server.wonder.cloudmark.com.conf
>>Nov 26 11:15:44.884384 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.anxiety.cloudmark.com.conf
>>Nov 26 11:15:44.884946 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.tension.cloudmark.com.conf
>>Nov 26 11:15:44.885523 check[27631]: [ 5] read_file: 16 items read from
>>/root/.razor/server.thrill.cloudmark.com.conf
>>Nov 26 11:15:44.886150 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.malice.cloudmark.com.conf
>>Nov 26 11:15:44.886757 check[27631]: [ 5] read_file: 14 items read from
>>/root/.razor/server.shock.cloudmark.com.conf
>>Nov 26 11:15:44.887082 check[27631]: [ 5] 154361 seconds before closest
>>server discovery
>>Nov 26 11:15:44.887338 check[27631]: [ 6] pride.cloudmark.com is a
>>Catalogue Server srl 5048; computed min_cf=6, Server se: C8
>>Nov 26 11:15:44.887597 check[27631]: [ 8] Computed supported_engines: 4
>>Nov 26 11:15:44.887759 check[27631]: [ 8] Using next closest server
>>pride.cloudmark.com:2703, cached info srl 5048
>>Nov 26 11:15:44.887892 check[27631]: [ 8] mail 1 has no subject
>>Nov 26 11:15:44.889464 check[27631]: [ 6] preproc: mail 1.0 went from
>
> 1376
>
>>bytes to 1339
>>Nov 26 11:15:44.889655 check[27631]: [ 6] computing sigs for mail 1.0,
>
> len
>
>>1339
>>Nov 26 11:15:44.891458 check[27631]: [ 6] skipping whitelist file
>>(empty?): /root/.razor/razor-whitelist
>>Nov 26 11:15:44.891659 check[27631]: [ 5] Connecting to
>>pride.cloudmark.com ...
>>Nov 26 11:15:44.956354 check[27631]: [ 3] Unable to connect to
>>pride.cloudmark.com:2703; Reason: Connection refused.
>>Nov 26 11:15:44.956634 check[27631]: [ 5] 161663 seconds before closest
>>server discovery
>>Nov 26 11:15:44.956874 check[27631]: [ 6] wonder.cloudmark.com is a
>>Catalogue Server srl 5048; computed min_cf=6, Server se: C8
>>Nov 26 11:15:44.957085 check[27631]: [ 8] Computed supported_engines: 4
>>Nov 26 11:15:44.957231 check[27631]: [ 8] Using next closest server
>>wonder.cloudmark.com:2703, cached info srl 5048
>>Nov 26 11:15:44.957392 check[27631]: [ 5] Connecting to
>>wonder.cloudmark.com ...
>>Nov 26 11:15:45.077689 check[27631]: [ 8] Connection established
>>Nov 26 11:15:45.077888 check[27631]: [ 4] wonder.cloudmark.com >> 36
>>server greeting: sn=C&srl=5048&a=l&a=cg&ep4=7542-10
>>Nov 26 11:15:45.078283 check[27631]: [ 4] wonder.cloudmark.com << 25
>>Nov 26 11:15:45.078369 check[27631]: [ 6] cn=razor-agents&cv=2.36
>>Nov 26 11:15:45.078670 check[27631]: [ 6] wonder.cloudmark.com is a
>>Catalogue Server srl 5048; computed min_cf=6, Server se: C8
>>Nov 26 11:15:45.078891 check[27631]: [ 8] Computed supported_engines: 4
>>Nov 26 11:15:45.079110 check[27631]: [ 8] mail 1.0 e4 sig:
>>xFaZIZUVHk90OQfARnenjx5BZTMA
>>Nov 26 11:15:45.079296 check[27631]: [ 8] preparing 1 queries
>>Nov 26 11:15:45.079546 check[27631]: [ 8] sending 1 batches
>>Nov 26 11:15:45.079745 check[27631]: [ 4] wonder.cloudmark.com << 52
>>Nov 26 11:15:45.079820 check[27631]: [ 6]
>>a=c&e=4&ep4=7542-10&s=xFaZIZUVHk90OQfARnenjx5BZTMA
>>Nov 26 11:15:45.351281 check[27631]: [ 4] wonder.cloudmark.com >> 5
>>Nov 26 11:15:45.351376 check[27631]: [ 6] response to sent.2
>>p=0
>>Nov 26 11:15:45.351792 check[27631]: [ 6] mail 1.0 e=4
>>sig=xFaZIZUVHk90OQfARnenjx5BZTMA: sig not found.
>>Nov 26 11:15:45.351954 check[27631]: [ 7] method 4: mail 1.0:
>>no-contention part, spam=0
>>Nov 26 11:15:45.352034 check[27631]: [ 7] method 4: mail 1: all
>>non-contention parts not spam, mail not spam
>>Nov 26 11:15:45.352111 check[27631]: [ 3] mail 1 is not known spam.
>>Nov 26 11:15:45.352208 check[27631]: [ 5] disconnecting from server
>>wonder.cloudmark.com
>>Nov 26 11:15:45.352409 check[27631]: [ 4] wonder.cloudmark.com << 5
>>Nov 26 11:15:45.352482 check[27631]: [ 6] a=q
>>debug: Using results from Razor v2.36
>>debug: Found Razor2 part: part=0 engine=4 ct=0 cf=0
>>debug: leaving helper-app run mode
>>debug: Razor2 results: spam? 0  highest cf score: 0
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>implements 'check_tick'
>>debug: running raw-body-text per-line regexp tests; score so far=-2.623
>>debug: running full-text regexp tests; score so far=-2.623
>>debug: Razor2 is available
>>debug: Current PATH is: /sbin:/bin:/usr/sbin:/usr/bin
>>debug: Pyzor is not available: pyzor not found
>>debug: Running tests for priority: 500
>>debug: RBL: success for 1 of 1 queries
>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>implements 'check_post_dnsbl'
>>debug: running meta tests; score so far=-2.623
>>debug: running header regexp tests; score so far=-1.053
>>debug: running body-text per-line regexp tests; score so far=-1.053
>>debug: running uri tests; score so far=-1.053
>>debug: running raw-body-text per-line regexp tests; score so far=-1.053
>>debug: running full-text regexp tests; score so far=-1.053
>>debug: Running tests for priority: 1000
>>debug: running meta tests; score so far=-1.053
>>debug: running header regexp tests; score so far=-1.053
>>debug: lock: 27631 created
>>/root/.spamassassin/auto-whitelist.lock.smithers.vbcomm.net.27631
>>debug: lock: 27631 trying to get lock on
>>/root/.spamassassin/auto-whitelist with 0 retries
>>debug: lock: 27631 link to /root/.spamassassin/auto-whitelist.lock: link
>>ok
>>debug: Tie-ing to DB file R/W in /root/.spamassassin/auto-whitelist
>>debug: auto-whitelist (db-based):
>>ignore@compiling.spamassassin.taint.org|ip=none scores 0/0
>>debug: AWL active, pre-score: -1.053, autolearn score: -1.053, mean:
>>undef, IP: undef
>>debug: DB addr list: untie-ing and unlocking.
>>debug: DB addr list: file locked, breaking lock.
>>debug: unlock: 27631 unlink /root/.spamassassin/auto-whitelist.lock
>>debug: Post AWL score: -1.053
>>debug: running body-text per-line regexp tests; score so far=-1.053
>>debug: running uri tests; score so far=-1.053
>>debug: running raw-body-text per-line regexp tests; score so far=-1.053
>>debug: running full-text regexp tests; score so far=-1.053
>>debug: is spam? score=-1.053 required=3.8
>>debug: tests=ALL_TRUSTED,MISSING_DATE,MISSING_SUBJECT,NO_REAL_NAME
>>debug:
>>
>
>
subtests=__HAS_MSGID,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__SANE_MSGID,__UNUSABLE_MSGID
>
>>
>>
>>
>>Matthew K Bowman
>>Systems Administrator
>>UDCom
>>Tel: 419-524-4330
>>Fax: 419-524-8757
>>Web: http://www.udcom.com
>>Email: mbowman@udcom.com
>>Support: techsupport@udcom.com
>>Sales: sales@udcom.com
>>
>>
>>
>>
>>Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
>>Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>11/26/2004 11:06 AM
>>Please respond to MailScanner mailing list
>>
>>        To:     MAILSCANNER@JISCMAIL.AC.UK
>>        cc:
>>        Subject:        Re: Help! - MailScanner ceased working
>>
>>
>>matthew
>>
>>stop the mailscanner service
>>
>>edit the MailScanner.conf file and turn on both lots of debug options
>>
>>run checkmailscanner as the user defined in the MailScanner.conf and
>>drop the results back here..
>>
>>
>>--
>>Martin Hepworth
>>Snr Systems Administrator
>>Solid State Logic
>>Tel: +44 (0)1865 842300
>>
>>
>>Matthew Bowman wrote:
>>
>>
>>>Hello
>>>
>>>MailScanner is running with pid 842 is the only output I get. Both are
>>
>>run
>>
>>
>>>by the same user.
>>>
>>>/var/log/maillog
>>>
>>>Nov 26 10:08:09 smithers MailScanner[1503]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:08:19 smithers MailScanner[1518]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:08:29 smithers MailScanner[1519]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:08:39 smithers MailScanner[1520]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:08:49 smithers MailScanner[1521]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:08:59 smithers MailScanner[1524]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:09:09 smithers MailScanner[1526]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:09:19 smithers MailScanner[1527]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:09:29 smithers MailScanner[1528]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 26 10:09:39 smithers MailScanner[1530]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>
>>>ps
>>>
>>>root       842  0.0  1.2 13908 12524 ?       S    09:32   0:00
>>>/usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailS
>>>root       843  0.0  0.0     0    0 ?        Z    09:32   0:01
>>>[MailScanner <defunct>]
>>>root      1039  0.0  0.0     0    0 ?        Z    09:32   0:01
>>>[MailScanner <defunct>]
>>>root      1040  0.0  0.0     0    0 ?        Z    09:32   0:01
>>>[MailScanner <defunct>]
>>>root      1041  0.0  0.0     0    0 ?        Z    09:32   0:01
>>>[MailScanner <defunct>]
>>>root      1042  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>[MailScanner <defunct>]
>>>root      1043  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>[MailScanner <defunct>]
>>>root      1044  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>[MailScanner <defunct>]
>>>root      1045  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>[MailScanner <defunct>]
>>>root      1046  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>[MailScanner <defunct>]
>>>root      1539 34.2  0.0     0    0 ?        Z    10:10   0:01
>>>[MailScanner <defunct>]
>>>
>>>Thanks for your help
>>>
>>>Matthew K Bowman
>>>Systems Administrator
>>>UDCom
>>>Tel: 419-524-4330
>>>Fax: 419-524-8757
>>>Web: http://www.udcom.com
>>>Email: mbowman@udcom.com
>>>Support: techsupport@udcom.com
>>>Sales: sales@udcom.com
>>>
>>>
>>>
>>>
>>>Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
>>>Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>>11/26/2004 09:58 AM
>>>Please respond to MailScanner mailing list
>>>
>>>       To:     MAILSCANNER@JISCMAIL.AC.UK
>>>       cc:
>>>       Subject:        Re: Help! - MailScanner ceased working
>>>
>>>
>>>Matthew
>>>
>>>if results are fine from running in debug mode then it should have
>>>delivered that batch of emails.....
>>>
>>>Can you drop the output of the checkmailscanner to the list?
>>>
>>>also are you running checkmailscanner as the same user MailScanner
>>>normally runs as?
>>>
>>>--
>>>Martin Hepworth
>>>Snr Systems Administrator
>>>Solid State Logic
>>>Tel: +44 (0)1865 842300
>>>
>>>
>>>Matthew Bowman wrote:
>>>
>>>
>>>
>>>>Hello,
>>>>
>>>>One of our 3 mailscanner servers has stopped processing e-mail.  There
>>>
>>>are
>>>
>>>
>>>
>>>>no errors in /var/log/maillog or messages that indicate and sort of
>>>>problem.  Email arrives and gets put into mqueue.in and just stays
>>>
>>>there.
>>>
>>>
>>>
>>>>Nothing has changed in MailScanner.conf or sendmail.cf.  I'm at a loss
>>>
>>>as
>>>
>>>
>>>
>>>>to how this has happened all of a sudden.  I run mailscanner and
>>>>spamassassin in debug mode and the results where fine.  What else
>
> should
>
>>>I
>>>
>>>
>>>
>>>>be looking at?
>>>>
>>>>All 3 mailscanner servers run MS 4.35-11, SA 3.0.0 and Redhat 7.3
>>>>
>>>>Please help!
>>>>
>>>>Thanks
>>>>
>>>>Matthew

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Denis.Beauchemin at USHERBROOKE.CA  Fri Nov 26 17:01:17 2004
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:27:43 2006
Subject: Help! - MailScanner ceased working (debug output)
Message-ID: <mailman.5162.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Matthew Bowman wrote:

>I'm just seeing MailScanner starting all the time
>
>  
>

Then you probably have some syntax error in one of your configuration files.

Denis
PS: you shouldn't use bigevil anymore and you should also drop AWL.

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Fri Nov 26 17:00:50 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:43 2006
Subject: Help! - MailScanner ceased working (debug output)
Message-ID: <mailman.5163.1137101263.24926.mailscanner@lists.mailscanner.info>

matthew

checked permissions on out bound queue??

next thing to do is start turning off items in the MailScanner.conf, SA,
virus scanners to see if you can find something that makes the thing
work - as someone else just suggested...

On thing I just noticed is that your clock is about 50 minutes
fast....dunno if rest of network time is out as well....

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Matthew Bowman wrote:
> I'm just seeing MailScanner starting all the time
>
> Matthew K Bowman
> Systems Administrator
> UDCom
> Tel: 419-524-4330
> Fax: 419-524-8757
> Web: http://www.udcom.com
> Email: mbowman@udcom.com
> Support: techsupport@udcom.com
> Sales: sales@udcom.com
>
>
>
>
> Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
> Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> 11/26/2004 11:45 AM
> Please respond to MailScanner mailing list
>
>         To:     MAILSCANNER@JISCMAIL.AC.UK
>         cc:
>         Subject:        Re: Help! - MailScanner ceased working (debug
> output)
>
>
> matt
>
> sorry - caffiene level dropping.... I'll start again..
>
> what are you seeing then...just the MS restarting all the time?
>
> I presume the debug was done as the MS user defined in MailScanner.conf?
> Which by the looks of your debug is root...
>
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Matthew Bowman wrote:
>
>>Not at all, everything goes to mqueue.in, mailscanner (according to
>>maillog) doesn't scan the email thus its not delivered.
>>
>>I should be seeing something like:
>>
>>MailScanner[29593]: New Batch: Found 4 messages waiting
>>MailScanner[29593]: New Batch: Scanning 1 messages, 4568 bytes
>>MailScanner[29593]: Virus and Content Scanning: Starting
>>
>>But dont.
>>
>>Matthew K Bowman
>>Systems Administrator
>>UDCom
>>Tel: 419-524-4330
>>Fax: 419-524-8757
>>Web: http://www.udcom.com
>>Email: mbowman@udcom.com
>>Support: techsupport@udcom.com
>>Sales: sales@udcom.com
>>
>>
>>
>>
>>Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
>>Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>11/26/2004 11:34 AM
>>Please respond to MailScanner mailing list
>>
>>        To:     MAILSCANNER@JISCMAIL.AC.UK
>>        cc:
>>        Subject:        Re: Help! - MailScanner ceased working (debug
>>output)
>>
>>
>>matthew
>>
>>Looks fine - I presume stuff hit the outgoing MTA queue?
>>
>>
>>--
>>Martin Hepworth
>>Snr Systems Administrator
>>Solid State Logic
>>Tel: +44 (0)1865 842300
>>
>>
>>Matthew Bowman wrote:
>>
>>
>>>Debug output
>>>
>>>Starting MailScanner...
>>>In Debugging mode, not forking...
>>>debug: SpamAssassin version 3.0.0
>>>debug: Score set 0 chosen.
>>>debug: running in taint mode? no
>>>SA bayes lock is /root/.spamassassin/bayes.lock
>>>Bayes lock is at /root/.spamassassin/bayes.lock
>>>debug: ignore: test message to precompile patterns and load modules
>>>debug: using "/etc/mail/spamassassin/init.pre" for site rules init.pre
>>>debug: config: read file /etc/mail/spamassassin/init.pre
>>>debug: using "/usr/share/spamassassin" for default rules dir
>>>debug: config: read file /usr/share/spamassassin/10_misc.cf
>>>debug: config: read file /usr/share/spamassassin/20_anti_ratware.cf
>>>debug: config: read file /usr/share/spamassassin/20_body_tests.cf
>>>debug: config: read file /usr/share/spamassassin/20_compensate.cf
>>>debug: config: read file /usr/share/spamassassin/20_dnsbl_tests.cf
>>>debug: config: read file /usr/share/spamassassin/20_drugs.cf
>>>debug: config: read file /usr/share/spamassassin/20_fake_helo_tests.cf
>>>debug: config: read file /usr/share/spamassassin/20_head_tests.cf
>>>debug: config: read file /usr/share/spamassassin/20_html_tests.cf
>>>debug: config: read file /usr/share/spamassassin/20_meta_tests.cf
>>>debug: config: read file /usr/share/spamassassin/20_phrases.cf
>>>debug: config: read file /usr/share/spamassassin/20_porn.cf
>>>debug: config: read file /usr/share/spamassassin/20_ratware.cf
>>>debug: config: read file /usr/share/spamassassin/20_uri_tests.cf
>>>debug: config: read file /usr/share/spamassassin/23_bayes.cf
>>>debug: config: read file /usr/share/spamassassin/25_body_tests_es.cf
>>>debug: config: read file /usr/share/spamassassin/25_hashcash.cf
>>>debug: config: read file /usr/share/spamassassin/25_spf.cf
>>>debug: config: read file /usr/share/spamassassin/25_uribl.cf
>>>debug: config: read file /usr/share/spamassassin/30_text_de.cf
>>>debug: config: read file /usr/share/spamassassin/30_text_fr.cf
>>>debug: config: read file /usr/share/spamassassin/30_text_nl.cf
>>>debug: config: read file /usr/share/spamassassin/30_text_pl.cf
>>>debug: config: read file /usr/share/spamassassin/50_scores.cf
>>>debug: config: read file /usr/share/spamassassin/60_whitelist.cf
>>>debug: using "/etc/mail/spamassassin" for site rules dir
>>>debug: config: read file /etc/mail/spamassassin/antidrug.cf
>>>debug: config: read file /etc/mail/spamassassin/bigevil.cf
>>>debug: config: read file /etc/mail/spamassassin/local.cf
>>>debug: using "/etc/MailScanner/spam.assassin.prefs.conf" for user prefs
>>>file
>>>debug: config: read file /etc/MailScanner/spam.assassin.prefs.conf
>>>debug: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
>>>debug: plugin: registered
>>>Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>>debug: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC
>>>debug: plugin: registered
>>>Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40)
>>>debug: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
>>>debug: plugin: registered
>>
>>Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798)
>>
>>
>>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>>implements 'parse_config'
>>>debug: plugin: Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40)
>>>implements 'parse_config'
>>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>>inhibited further callbacks
>>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>>inhibited further callbacks
>>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>>inhibited further callbacks
>>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>>inhibited further callbacks
>>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>>inhibited further callbacks
>>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>>inhibited further callbacks
>>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>>inhibited further callbacks
>>>debug: Score set 1 chosen.
>>>debug: ---- MIME PARSER START ----
>>>debug: main message type: text/plain
>>>debug: parsing normal part
>>>debug: added part, type: text/plain
>>>debug: ---- MIME PARSER END ----
>>>debug: metadata: X-Spam-Relays-Trusted:
>>>debug: metadata: X-Spam-Relays-Untrusted:
>>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>>implements 'parsed_metadata'
>>>debug: is Net::DNS::Resolver available? yes
>>>debug: Net::DNS version: 0.39_01
>>>debug: trying (3) sourceforge.net...
>>>debug: looking up NS for 'sourceforge.net'
>>>debug: NS lookup of sourceforge.net succeeded => Dns available (set
>>>dns_available to hardcode)
>>>debug: is DNS available? 1
>>>debug: decoding: no encoding detected
>>>debug: URIDNSBL: domains to query:
>>>debug: all '*From' addrs: ignore@compiling.spamassassin.taint.org
>>>debug: Running tests for priority: 0
>>>debug: running header regexp tests; score so far=0
>>>debug: registering glue method for check_uridnsbl
>>>(Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810))
>>>debug: registering glue method for check_for_spf_pass
>>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>>debug: SPF: message was delivered entirely via trusted relays, not
>>>required
>>>debug: all '*To' addrs:
>>>debug: registering glue method for check_hashcash_value
>>>(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40))
>>>debug: registering glue method for check_for_spf_helo_fail
>>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>>debug: SPF: message was delivered entirely via trusted relays, not
>>>required
>>>debug: registering glue method for check_for_spf_helo_pass
>>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>>debug: registering glue method for check_hashcash_double_spend
>>>(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x92feb40))
>>>debug: registering glue method for check_for_spf_softfail
>>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>>debug: registering glue method for check_for_spf_helo_softfail
>>>(Mail::SpamAssassin::Plugin::SPF=HASH(0x92e4798))
>>>debug: running body-text per-line regexp tests; score so far=-2.623
>>>debug: running uri tests; score so far=-2.623
>>>debug: Razor2 is available
>>>debug: entering helper-app run mode
>>>Razor-Log: Computed razorhome from env: /root/.razor
>>>Razor-Log: Found razorhome: /root/.razor
>>>Razor-Log: read_file: 16 items read from /root/.razor/razor-agent.conf
>>>Nov 26 11:15:44.875895 check[27631]: [ 1] [bootup] Logging initiated
>>>LogDebugLevel=9 to stdout
>>>Nov 26 11:15:44.876392 check[27631]: [ 5] computed
>>
>>razorhome=/root/.razor,
>>
>>
>>>conf=/root/.razor/razor-agent.conf, ident=/root/.razor/identity
>>>Nov 26 11:15:44.876648 check[27631]: [ 8] Client supported_engines: 1 2
>>
>>3
>>
>>
>>>4
>>>Nov 26 11:15:44.877247 check[27631]: [ 8]  prep_mail done: mail 1
>>>headers=102, mime0=1376
>>>Nov 26 11:15:44.877704 check[27631]: [ 5] read_file: 8 items read from
>>>/root/.razor/servers.discovery.lst
>>>Nov 26 11:15:44.878063 check[27631]: [ 5] read_file: 2 items read from
>>>/root/.razor/servers.nomination.lst
>>>Nov 26 11:15:44.878331 check[27631]: [ 5] read_file: 3 items read from
>>>/root/.razor/servers.catalogue.lst
>>>Nov 26 11:15:44.878740 check[27631]: [ 9] Assigning defaults to
>>>joy.cloudmark.com
>>>Nov 26 11:15:44.878926 check[27631]: [ 9] Assigning defaults to
>>>folly.cloudmark.com
>>>Nov 26 11:15:44.879179 check[27631]: [ 9] Assigning defaults to
>>>pride.cloudmark.com
>>>Nov 26 11:15:44.879383 check[27631]: [ 9] Assigning defaults to
>>>wonder.cloudmark.com
>>>Nov 26 11:15:44.879559 check[27631]: [ 9] Assigning defaults to
>>>thrill.cloudmark.com
>>>Nov 26 11:15:44.880412 check[27631]: [ 5] read_file: 14 items read from
>>>/root/.razor/server.truth.cloudmark.com.conf
>>>Nov 26 11:15:44.881004 check[27631]: [ 5] read_file: 14 items read from
>>>/root/.razor/server.stress.cloudmark.com.conf
>>>Nov 26 11:15:44.881542 check[27631]: [ 5] read_file: 12 items read from
>>>/root/.razor/server.folly.cloudmark.com.conf
>>>Nov 26 11:15:44.882114 check[27631]: [ 5] read_file: 14 items read from
>>>/root/.razor/server.rancor.cloudmark.com.conf
>>>Nov 26 11:15:44.882702 check[27631]: [ 5] read_file: 16 items read from
>>>/root/.razor/server.pride.cloudmark.com.conf
>>>Nov 26 11:15:44.883256 check[27631]: [ 5] read_file: 14 items read from
>>>/root/.razor/server.prejudice.cloudmark.com.conf
>>>Nov 26 11:15:44.883832 check[27631]: [ 5] read_file: 16 items read from
>>>/root/.razor/server.wonder.cloudmark.com.conf
>>>Nov 26 11:15:44.884384 check[27631]: [ 5] read_file: 14 items read from
>>>/root/.razor/server.anxiety.cloudmark.com.conf
>>>Nov 26 11:15:44.884946 check[27631]: [ 5] read_file: 14 items read from
>>>/root/.razor/server.tension.cloudmark.com.conf
>>>Nov 26 11:15:44.885523 check[27631]: [ 5] read_file: 16 items read from
>>>/root/.razor/server.thrill.cloudmark.com.conf
>>>Nov 26 11:15:44.886150 check[27631]: [ 5] read_file: 14 items read from
>>>/root/.razor/server.malice.cloudmark.com.conf
>>>Nov 26 11:15:44.886757 check[27631]: [ 5] read_file: 14 items read from
>>>/root/.razor/server.shock.cloudmark.com.conf
>>>Nov 26 11:15:44.887082 check[27631]: [ 5] 154361 seconds before closest
>>>server discovery
>>>Nov 26 11:15:44.887338 check[27631]: [ 6] pride.cloudmark.com is a
>>>Catalogue Server srl 5048; computed min_cf=6, Server se: C8
>>>Nov 26 11:15:44.887597 check[27631]: [ 8] Computed supported_engines: 4
>>>Nov 26 11:15:44.887759 check[27631]: [ 8] Using next closest server
>>>pride.cloudmark.com:2703, cached info srl 5048
>>>Nov 26 11:15:44.887892 check[27631]: [ 8] mail 1 has no subject
>>>Nov 26 11:15:44.889464 check[27631]: [ 6] preproc: mail 1.0 went from
>>
>>1376
>>
>>
>>>bytes to 1339
>>>Nov 26 11:15:44.889655 check[27631]: [ 6] computing sigs for mail 1.0,
>>
>>len
>>
>>
>>>1339
>>>Nov 26 11:15:44.891458 check[27631]: [ 6] skipping whitelist file
>>>(empty?): /root/.razor/razor-whitelist
>>>Nov 26 11:15:44.891659 check[27631]: [ 5] Connecting to
>>>pride.cloudmark.com ...
>>>Nov 26 11:15:44.956354 check[27631]: [ 3] Unable to connect to
>>>pride.cloudmark.com:2703; Reason: Connection refused.
>>>Nov 26 11:15:44.956634 check[27631]: [ 5] 161663 seconds before closest
>>>server discovery
>>>Nov 26 11:15:44.956874 check[27631]: [ 6] wonder.cloudmark.com is a
>>>Catalogue Server srl 5048; computed min_cf=6, Server se: C8
>>>Nov 26 11:15:44.957085 check[27631]: [ 8] Computed supported_engines: 4
>>>Nov 26 11:15:44.957231 check[27631]: [ 8] Using next closest server
>>>wonder.cloudmark.com:2703, cached info srl 5048
>>>Nov 26 11:15:44.957392 check[27631]: [ 5] Connecting to
>>>wonder.cloudmark.com ...
>>>Nov 26 11:15:45.077689 check[27631]: [ 8] Connection established
>>>Nov 26 11:15:45.077888 check[27631]: [ 4] wonder.cloudmark.com >> 36
>>>server greeting: sn=C&srl=5048&a=l&a=cg&ep4=7542-10
>>>Nov 26 11:15:45.078283 check[27631]: [ 4] wonder.cloudmark.com << 25
>>>Nov 26 11:15:45.078369 check[27631]: [ 6] cn=razor-agents&cv=2.36
>>>Nov 26 11:15:45.078670 check[27631]: [ 6] wonder.cloudmark.com is a
>>>Catalogue Server srl 5048; computed min_cf=6, Server se: C8
>>>Nov 26 11:15:45.078891 check[27631]: [ 8] Computed supported_engines: 4
>>>Nov 26 11:15:45.079110 check[27631]: [ 8] mail 1.0 e4 sig:
>>>xFaZIZUVHk90OQfARnenjx5BZTMA
>>>Nov 26 11:15:45.079296 check[27631]: [ 8] preparing 1 queries
>>>Nov 26 11:15:45.079546 check[27631]: [ 8] sending 1 batches
>>>Nov 26 11:15:45.079745 check[27631]: [ 4] wonder.cloudmark.com << 52
>>>Nov 26 11:15:45.079820 check[27631]: [ 6]
>>>a=c&e=4&ep4=7542-10&s=xFaZIZUVHk90OQfARnenjx5BZTMA
>>>Nov 26 11:15:45.351281 check[27631]: [ 4] wonder.cloudmark.com >> 5
>>>Nov 26 11:15:45.351376 check[27631]: [ 6] response to sent.2
>>>p=0
>>>Nov 26 11:15:45.351792 check[27631]: [ 6] mail 1.0 e=4
>>>sig=xFaZIZUVHk90OQfARnenjx5BZTMA: sig not found.
>>>Nov 26 11:15:45.351954 check[27631]: [ 7] method 4: mail 1.0:
>>>no-contention part, spam=0
>>>Nov 26 11:15:45.352034 check[27631]: [ 7] method 4: mail 1: all
>>>non-contention parts not spam, mail not spam
>>>Nov 26 11:15:45.352111 check[27631]: [ 3] mail 1 is not known spam.
>>>Nov 26 11:15:45.352208 check[27631]: [ 5] disconnecting from server
>>>wonder.cloudmark.com
>>>Nov 26 11:15:45.352409 check[27631]: [ 4] wonder.cloudmark.com << 5
>>>Nov 26 11:15:45.352482 check[27631]: [ 6] a=q
>>>debug: Using results from Razor v2.36
>>>debug: Found Razor2 part: part=0 engine=4 ct=0 cf=0
>>>debug: leaving helper-app run mode
>>>debug: Razor2 results: spam? 0  highest cf score: 0
>>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>>implements 'check_tick'
>>>debug: running raw-body-text per-line regexp tests; score so far=-2.623
>>>debug: running full-text regexp tests; score so far=-2.623
>>>debug: Razor2 is available
>>>debug: Current PATH is: /sbin:/bin:/usr/sbin:/usr/bin
>>>debug: Pyzor is not available: pyzor not found
>>>debug: Running tests for priority: 500
>>>debug: RBL: success for 1 of 1 queries
>>>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8152810)
>>>implements 'check_post_dnsbl'
>>>debug: running meta tests; score so far=-2.623
>>>debug: running header regexp tests; score so far=-1.053
>>>debug: running body-text per-line regexp tests; score so far=-1.053
>>>debug: running uri tests; score so far=-1.053
>>>debug: running raw-body-text per-line regexp tests; score so far=-1.053
>>>debug: running full-text regexp tests; score so far=-1.053
>>>debug: Running tests for priority: 1000
>>>debug: running meta tests; score so far=-1.053
>>>debug: running header regexp tests; score so far=-1.053
>>>debug: lock: 27631 created
>>>/root/.spamassassin/auto-whitelist.lock.smithers.vbcomm.net.27631
>>>debug: lock: 27631 trying to get lock on
>>>/root/.spamassassin/auto-whitelist with 0 retries
>>>debug: lock: 27631 link to /root/.spamassassin/auto-whitelist.lock: link
>>>ok
>>>debug: Tie-ing to DB file R/W in /root/.spamassassin/auto-whitelist
>>>debug: auto-whitelist (db-based):
>>>ignore@compiling.spamassassin.taint.org|ip=none scores 0/0
>>>debug: AWL active, pre-score: -1.053, autolearn score: -1.053, mean:
>>>undef, IP: undef
>>>debug: DB addr list: untie-ing and unlocking.
>>>debug: DB addr list: file locked, breaking lock.
>>>debug: unlock: 27631 unlink /root/.spamassassin/auto-whitelist.lock
>>>debug: Post AWL score: -1.053
>>>debug: running body-text per-line regexp tests; score so far=-1.053
>>>debug: running uri tests; score so far=-1.053
>>>debug: running raw-body-text per-line regexp tests; score so far=-1.053
>>>debug: running full-text regexp tests; score so far=-1.053
>>>debug: is spam? score=-1.053 required=3.8
>>>debug: tests=ALL_TRUSTED,MISSING_DATE,MISSING_SUBJECT,NO_REAL_NAME
>>>debug:
>>>
>>
>>
> subtests=__HAS_MSGID,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__SANE_MSGID,__UNUSABLE_MSGID
>
>>>
>>>
>>>Matthew K Bowman
>>>Systems Administrator
>>>UDCom
>>>Tel: 419-524-4330
>>>Fax: 419-524-8757
>>>Web: http://www.udcom.com
>>>Email: mbowman@udcom.com
>>>Support: techsupport@udcom.com
>>>Sales: sales@udcom.com
>>>
>>>
>>>
>>>
>>>Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
>>>Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>>11/26/2004 11:06 AM
>>>Please respond to MailScanner mailing list
>>>
>>>       To:     MAILSCANNER@JISCMAIL.AC.UK
>>>       cc:
>>>       Subject:        Re: Help! - MailScanner ceased working
>>>
>>>
>>>matthew
>>>
>>>stop the mailscanner service
>>>
>>>edit the MailScanner.conf file and turn on both lots of debug options
>>>
>>>run checkmailscanner as the user defined in the MailScanner.conf and
>>>drop the results back here..
>>>
>>>
>>>--
>>>Martin Hepworth
>>>Snr Systems Administrator
>>>Solid State Logic
>>>Tel: +44 (0)1865 842300
>>>
>>>
>>>Matthew Bowman wrote:
>>>
>>>
>>>
>>>>Hello
>>>>
>>>>MailScanner is running with pid 842 is the only output I get. Both are
>>>
>>>run
>>>
>>>
>>>
>>>>by the same user.
>>>>
>>>>/var/log/maillog
>>>>
>>>>Nov 26 10:08:09 smithers MailScanner[1503]: MailScanner E-Mail Virus
>>>>Scanner version 4.35.11 starting...
>>>>Nov 26 10:08:19 smithers MailScanner[1518]: MailScanner E-Mail Virus
>>>>Scanner version 4.35.11 starting...
>>>>Nov 26 10:08:29 smithers MailScanner[1519]: MailScanner E-Mail Virus
>>>>Scanner version 4.35.11 starting...
>>>>Nov 26 10:08:39 smithers MailScanner[1520]: MailScanner E-Mail Virus
>>>>Scanner version 4.35.11 starting...
>>>>Nov 26 10:08:49 smithers MailScanner[1521]: MailScanner E-Mail Virus
>>>>Scanner version 4.35.11 starting...
>>>>Nov 26 10:08:59 smithers MailScanner[1524]: MailScanner E-Mail Virus
>>>>Scanner version 4.35.11 starting...
>>>>Nov 26 10:09:09 smithers MailScanner[1526]: MailScanner E-Mail Virus
>>>>Scanner version 4.35.11 starting...
>>>>Nov 26 10:09:19 smithers MailScanner[1527]: MailScanner E-Mail Virus
>>>>Scanner version 4.35.11 starting...
>>>>Nov 26 10:09:29 smithers MailScanner[1528]: MailScanner E-Mail Virus
>>>>Scanner version 4.35.11 starting...
>>>>Nov 26 10:09:39 smithers MailScanner[1530]: MailScanner E-Mail Virus
>>>>Scanner version 4.35.11 starting...
>>>>
>>>>ps
>>>>
>>>>root       842  0.0  1.2 13908 12524 ?       S    09:32   0:00
>>>>/usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailS
>>>>root       843  0.0  0.0     0    0 ?        Z    09:32   0:01
>>>>[MailScanner <defunct>]
>>>>root      1039  0.0  0.0     0    0 ?        Z    09:32   0:01
>>>>[MailScanner <defunct>]
>>>>root      1040  0.0  0.0     0    0 ?        Z    09:32   0:01
>>>>[MailScanner <defunct>]
>>>>root      1041  0.0  0.0     0    0 ?        Z    09:32   0:01
>>>>[MailScanner <defunct>]
>>>>root      1042  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>>[MailScanner <defunct>]
>>>>root      1043  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>>[MailScanner <defunct>]
>>>>root      1044  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>>[MailScanner <defunct>]
>>>>root      1045  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>>[MailScanner <defunct>]
>>>>root      1046  0.0  0.0     0    0 ?        Z    09:33   0:01
>>>>[MailScanner <defunct>]
>>>>root      1539 34.2  0.0     0    0 ?        Z    10:10   0:01
>>>>[MailScanner <defunct>]
>>>>
>>>>Thanks for your help
>>>>
>>>>Matthew K Bowman
>>>>Systems Administrator
>>>>UDCom
>>>>Tel: 419-524-4330
>>>>Fax: 419-524-8757
>>>>Web: http://www.udcom.com
>>>>Email: mbowman@udcom.com
>>>>Support: techsupport@udcom.com
>>>>Sales: sales@udcom.com
>>>>
>>>>
>>>>
>>>>
>>>>Martin Hepworth <martinh@SOLID-STATE-LOGIC.COM>
>>>>Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>>>11/26/2004 09:58 AM
>>>>Please respond to MailScanner mailing list
>>>>
>>>>      To:     MAILSCANNER@JISCMAIL.AC.UK
>>>>      cc:
>>>>      Subject:        Re: Help! - MailScanner ceased working
>>>>
>>>>
>>>>Matthew
>>>>
>>>>if results are fine from running in debug mode then it should have
>>>>delivered that batch of emails.....
>>>>
>>>>Can you drop the output of the checkmailscanner to the list?
>>>>
>>>>also are you running checkmailscanner as the same user MailScanner
>>>>normally runs as?
>>>>
>>>>--
>>>>Martin Hepworth
>>>>Snr Systems Administrator
>>>>Solid State Logic
>>>>Tel: +44 (0)1865 842300
>>>>
>>>>
>>>>Matthew Bowman wrote:
>>>>
>>>>
>>>>
>>>>
>>>>>Hello,
>>>>>
>>>>>One of our 3 mailscanner servers has stopped processing e-mail.  There
>>>>
>>>>are
>>>>
>>>>
>>>>
>>>>
>>>>>no errors in /var/log/maillog or messages that indicate and sort of
>>>>>problem.  Email arrives and gets put into mqueue.in and just stays
>>>>
>>>>there.
>>>>
>>>>
>>>>
>>>>
>>>>>Nothing has changed in MailScanner.conf or sendmail.cf.  I'm at a loss
>>>>
>>>>as
>>>>
>>>>
>>>>
>>>>
>>>>>to how this has happened all of a sudden.  I run mailscanner and
>>>>>spamassassin in debug mode and the results where fine.  What else
>>
>>should
>>
>>
>>>>I
>>>>
>>>>
>>>>
>>>>
>>>>>be looking at?
>>>>>
>>>>>All 3 mailscanner servers run MS 4.35-11, SA 3.0.0 and Redhat 7.3
>>>>>
>>>>>Please help!
>>>>>
>>>>>Thanks
>>>>>
>>>>>Matthew
>
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From peter at UCGBOOK.COM  Fri Nov 26 17:48:19 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:43 2006
Subject: Help! - MailScanner ceased working (debug output)
Message-ID: <mailman.5164.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Matthew Bowman wrote:
> debug: config: read file /etc/mail/spamassassin/antidrug.cf
> debug: config: read file /etc/mail/spamassassin/bigevil.cf

Don't use the above, antidrug is built into SA3 and bigevil should be
used through SURBL, the cf-file is huge and affects performance a lot.

> debug: Net::DNS version: 0.39_01

This is old, upgrade to 0.48.

> /root/.spamassassin/auto-whitelist.lock.smithers.vbcomm.net.27631

Disable AWL with "use_auto_whitelist 0" in local.cf (or
spamassassin.prefs.conf if that local.cf is symlinked to it) and remove
the related files where you store your Bayes db (/root/.spamassassin,
/var/spool/spamassassin). By the way, didn't see any info about Bayes,
it helps a lot.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From drew at THEMARSHALLS.CO.UK  Fri Nov 26 18:18:54 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:43 2006
Subject: Help! - MailScanner ceased working (debug output)
Message-ID: <mailman.5165.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Peter Bonivart wrote:

> Disable AWL with "use_auto_whitelist 0" in local.cf

Just out of interest, why? I had it disabled in SA2.6x but I have used
it SA3.x (Just 'cause it was on).

Drew

--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From peter at UCGBOOK.COM  Fri Nov 26 18:31:49 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:43 2006
Subject: Help! - MailScanner ceased working (debug output)
Message-ID: <mailman.5166.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Drew Marshall wrote:
> Peter Bonivart wrote:
>
>> Disable AWL with "use_auto_whitelist 0" in local.cf
>
> Just out of interest, why? I had it disabled in SA2.6x but I have used
> it SA3.x (Just 'cause it was on).

I was under the impression that it was designed to be run by separate
users, like with procmail and that running all mail with a single user
(root)  would mess it up. I may be completely wrong about that but I
read several times about not using it with SA2 so I didn't think any
different about SA3. When I upgraded to SA3 it was on from the beginning
and it immediately started giving negative scores to spam so I disabled
it and never looked back.

How is it working for you? Are the results what you expect?

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From drew at THEMARSHALLS.CO.UK  Fri Nov 26 18:52:05 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:43 2006
Subject: Help! - MailScanner ceased working (debug output)
Message-ID: <mailman.5167.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Peter Bonivart wrote:

> Drew Marshall wrote:
>
>> Peter Bonivart wrote:
>>
>>> Disable AWL with "use_auto_whitelist 0" in local.cf
>>
>>
>> Just out of interest, why? I had it disabled in SA2.6x but I have used
>> it SA3.x (Just 'cause it was on).
>
>
> I was under the impression that it was designed to be run by separate
> users, like with procmail and that running all mail with a single user
> (root)  would mess it up. I may be completely wrong about that but I
> read several times about not using it with SA2 so I didn't think any
> different about SA3. When I upgraded to SA3 it was on from the beginning
> and it immediately started giving negative scores to spam so I disabled
> it and never looked back.
>
> How is it working for you? Are the results what you expect?

I've had no problems with it at all. I too read several times about not
using it in SA2 so turned it off. When SA3 came out I *thought* I saw a
post from Julian suggesting that the code had been 'fixed' and he was
going to try it. Being the sheep that I am I too thought that I would
give it a go. Does it make much/ any difference? Well I'm not sure.
Certainly spam is not caught any more or less effectively than
previously. The only thing I do notice is that AWL locking seems to be
by auto-whitelist.mutex which concerns me as I don't want auto expiry to
fail because of it. Be interesting to see if any one else has an opinions.

Drew

--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From itdept at FRACTALWEB.COM  Fri Nov 26 20:06:35 2004
From: itdept at FRACTALWEB.COM (Fractal IT Dept.)
Date: Thu Jan 12 21:27:43 2006
Subject: Oversized zip?
Message-ID: <mailman.5168.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi everyone,

One of our clients is complaining that when they zip documents and send
them through our server, the file never arrives. After doing some
investigation on my end, I see that the file is quarantined with a
message saying "Report v11.zip contains Oversized Zip" and has been
identified as "infected". According to the company, it looks like the
file is just a quark document that has been zipped, so it's unlikely it's
actually infected with anything.

Any ideas?

Thanks,
Chris
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From peter at UCGBOOK.COM  Fri Nov 26 20:18:09 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:43 2006
Subject: Oversized zip?
Message-ID: <mailman.5169.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Fractal IT Dept. wrote:
> Hi everyone,
>
> One of our clients is complaining that when they zip documents and send
> them through our server, the file never arrives. After doing some
> investigation on my end, I see that the file is quarantined with a
> message saying "Report v11.zip contains Oversized Zip" and has been
> identified as "infected". According to the company, it looks like the
> file is just a quark document that has been zipped, so it's unlikely
> it's actually infected with anything.

Are you using Clam? Most virus scanners protect themselves from the "zip
of death", an archive that unpacks to a huge size. Clam calls it
Oversized.Zip but it's not actually a virus but a DOS attempt.

Some clean files can trigger this, like BMP image files compress very
well and it's usually the compression ratio that is used to determine this.


--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From michele at BLACKNIGHTSOLUTIONS.COM  Fri Nov 26 20:27:50 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele)
Date: Thu Jan 12 21:27:43 2006
Subject: Oversized zip?
Message-ID: <mailman.5170.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Peter Bonivart wrote:

> Fractal IT Dept. wrote:
>
>> Hi everyone,
>>
>> One of our clients is complaining that when they zip documents and send
>> them through our server, the file never arrives. After doing some
>> investigation on my end, I see that the file is quarantined with a
>> message saying "Report v11.zip contains Oversized Zip" and has been
>> identified as "infected". According to the company, it looks like the
>> file is just a quark document that has been zipped, so it's unlikely
>> it's actually infected with anything.
>
>
> Are you using Clam? Most virus scanners protect themselves from the "zip
> of death", an archive that unpacks to a huge size. Clam calls it
> Oversized.Zip but it's not actually a virus but a DOS attempt.
>
> Some clean files can trigger this, like BMP image files compress very
> well and it's usually the compression ratio that is used to determine
> this.
>
Which version of clam? If I remember correctly this was an issue with
some of the older versions of clam

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From srs-list at SRS-CONSULTING.BIZ  Sat Nov 27 01:33:58 2004
From: srs-list at SRS-CONSULTING.BIZ (Mikael Chambon)
Date: Thu Jan 12 21:27:43 2006
Subject: Mailscanner installation
Message-ID: <mailman.5171.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Dear All,

I've not installed Mailscanner since a long time and
as I am not a perl specialist I wish to get your
advices on the following facts:

MailScanner-install-4.35.11-1.tar.gz
perl v5.6.1
Linux kernel 2.4.27SMP i686

1) Can you confirm me that the MIME-tools perl
package included in the Mailscanner archive is already
patched ?

2) The Mailscanner archive include two MIME-Base64
package:

MIME-Base64-3.03.tar.gz
MIME-Base64-3.05.tar.gz

I've used 3.05, is that okay ?

3) When I did a make test for MIME-Base64-3.05, one test
was skipped:

t/bad-sv............skipped: Perl::API needed for this test

Is that a problem ?

4) For File-Spec-0.82 I get the following output

[root||mx] make test
PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e"
"test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
t/filefunc..........ok
t/filespec..........ok, 53/246 skipped: various reasons
All tests successful, 53 subtests skipped.
Files=2, Tests=247,  0 wallclock secs ( 0.06 cusr +  0.00 csys =  0.06 CPU)

A lot of test were skipped, can it be a problem for Mailscanner ?

5) For Compress-Zlib-1.33, one test was skipped because encode was not
available, may it be a problem for Mailscanner ?


Thanks a lot for your anwsers, I really appreciate.
Regards,
--
Mikael

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From peter at UCGBOOK.COM  Sat Nov 27 02:00:56 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:43 2006
Subject: Mailscanner installation
Message-ID: <mailman.5172.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Mikael Chambon wrote:
> 1) Can you confirm me that the MIME-tools perl
> package included in the Mailscanner archive is already
> patched ?

Yes, the patches are included now, they worked against 5.411 and we're
at 5.415 now I think.

> 2) The Mailscanner archive include two MIME-Base64
> package:
>
> MIME-Base64-3.03.tar.gz
> MIME-Base64-3.05.tar.gz
>
> I've used 3.05, is that okay ?

Yes.

> 3) When I did a make test for MIME-Base64-3.05, one test
> was skipped:
>
> t/bad-sv............skipped: Perl::API needed for this test
>
> Is that a problem ?
>
> 4) For File-Spec-0.82 I get the following output
>
> [root||mx] make test
> PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e"
> "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
> t/filefunc..........ok
> t/filespec..........ok, 53/246 skipped: various reasons
> All tests successful, 53 subtests skipped.
> Files=2, Tests=247,  0 wallclock secs ( 0.06 cusr +  0.00 csys =  0.06 CPU)
>
> A lot of test were skipped, can it be a problem for Mailscanner ?
>
> 5) For Compress-Zlib-1.33, one test was skipped because encode was not
> available, may it be a problem for Mailscanner ?

It's common that one or more tests are skipped for various reasons, skip
does not mean fail. As long as it still says "All tests successful", the
important ones are ok. If it continues with a successful "make install"
it's ok.

After the install.sh script has finished, scroll back and look at
everything carefully. I guess you didn't have install.sh the last time
you installed, it sure makes it easier to install all Perl modules needed.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From srs-list at SRS-CONSULTING.BIZ  Sat Nov 27 02:35:54 2004
From: srs-list at SRS-CONSULTING.BIZ (Mikael Chambon)
Date: Thu Jan 12 21:27:43 2006
Subject: Mailscanner installation
Message-ID: <mailman.5173.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Thanks for your answer Peter.
Now I am running my first real problem
with Mailscanner, if someone have an idear:

-MailScanner-install-4.35.11
-postfix-2.1.5
-clamav-0.80

I've configure Postfix to move all messages
in the hold directory:

header_checks = regexp:/etc/postfix/header_checks
[root||mx] cat header_checks
/^Received:/ HOLD

I sent a light testing message with the eicar
virus as an attachment. This message is correctly
put in the hold directory and MailScanner seems to
detect it but don't process it correctly and keep
saying this message:

=======
Nov 27 04:17:13 mx MailScanner[6734]: MailScanner E-Mail Virus Scanner
version 4.35.11 starting...
Nov 27 04:17:13 mx MailScanner[6734]: Using locktype = flock
Nov 27 04:17:13 mx MailScanner[6734]: New Batch: Scanning 1 messages,
2811 bytes
Nov 27 04:17:13 mx MailScanner[6734]: Virus and Content Scanning: Starting
Nov 27 04:17:23 mx MailScanner[6742]: MailScanner E-Mail Virus Scanner
version 4.35.11 starting...
Nov 27 04:17:23 mx MailScanner[6742]: Using locktype = flock
Nov 27 04:17:23 mx MailScanner[6742]: New Batch: Scanning 1 messages,
2811 bytes
=========

After 5 minutes, this message is still in the hold directory.

I've checked directories permissions but everything seems to be okay:

[root||mx] cd /var/spool/
[root||mx] ls
total 36
drwxr-xr-x    9 root     root         4096 Nov 19 02:56 .
drwxr-xr-x   17 root     root         4096 Nov 16 23:40 ..
drwxr-xr-x    4 root     root         4096 Nov 19 02:56 MailScanner
drwxr-xr-x    2 root     root         4096 Nov 16 06:05 anacron
drwx------    2 root     root         4096 Nov 19 04:55 cron
drwxr-xr-x    2 root     root         4096 Jun  1  2000 lpd
drwxrwxr-x    2 root     mail         4096 Nov 27 03:46 mail
drwxr-x---    2 root     root         4096 Nov 19 02:56 mqueue.in
drwxr-xr-x   16 root     root         4096 Nov 18 07:59 postfix

[root||mx] cd MailScanner/
[root||mx] ls
total 16
drwxr-xr-x    4 root     root         4096 Nov 19 02:56 .
drwxr-xr-x    9 root     root         4096 Nov 19 02:56 ..
drwx------   12 postfix  root         4096 Nov 27 04:24 incoming
drwx------    2 postfix  root         4096 Nov 19 02:56 quarantine

And from MailScanner.conf

Run As User = postfix
Run As Group = postfix


Someone has an idea where I should look for an error ?
Is there a way to start MailScanner in debug mode ?

Thanks for your help.
--
Mikael


Peter Bonivart wrote:
> Mikael Chambon wrote:
>
>> 1) Can you confirm me that the MIME-tools perl
>> package included in the Mailscanner archive is already
>> patched ?
>
>
> Yes, the patches are included now, they worked against 5.411 and we're
> at 5.415 now I think.
>
>> 2) The Mailscanner archive include two MIME-Base64
>> package:
>>
>> MIME-Base64-3.03.tar.gz
>> MIME-Base64-3.05.tar.gz
>>
>> I've used 3.05, is that okay ?
>
>
> Yes.
>
>> 3) When I did a make test for MIME-Base64-3.05, one test
>> was skipped:
>>
>> t/bad-sv............skipped: Perl::API needed for this test
>>
>> Is that a problem ?
>>
>> 4) For File-Spec-0.82 I get the following output
>>
>> [root||mx] make test
>> PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e"
>> "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
>> t/filefunc..........ok
>> t/filespec..........ok, 53/246 skipped: various reasons
>> All tests successful, 53 subtests skipped.
>> Files=2, Tests=247,  0 wallclock secs ( 0.06 cusr +  0.00 csys =  0.06
>> CPU)
>>
>> A lot of test were skipped, can it be a problem for Mailscanner ?
>>
>> 5) For Compress-Zlib-1.33, one test was skipped because encode was not
>> available, may it be a problem for Mailscanner ?
>
>
> It's common that one or more tests are skipped for various reasons, skip
> does not mean fail. As long as it still says "All tests successful", the
> important ones are ok. If it continues with a successful "make install"
> it's ok.
>
> After the install.sh script has finished, scroll back and look at
> everything carefully. I guess you didn't have install.sh the last time
> you installed, it sure makes it easier to install all Perl modules needed.
>
> --
> /Peter Bonivart
>
> --Unix lovers do it in the Sun
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From peter at UCGBOOK.COM  Sat Nov 27 02:37:59 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:43 2006
Subject: Mailscanner installation
Message-ID: <mailman.5174.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Mikael Chambon wrote:
> Someone has an idea where I should look for an error ?
> Is there a way to start MailScanner in debug mode ?

Sorry, I run Sendmail and don't know anything about Postfix but MS can
be run in debug mode, look at the end of MailScanner.conf for "Debug = no".

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From srs-list at SRS-CONSULTING.BIZ  Sat Nov 27 03:58:36 2004
From: srs-list at SRS-CONSULTING.BIZ (Mikael Chambon)
Date: Thu Jan 12 21:27:43 2006
Subject: Mailscanner installation
Message-ID: <mailman.5175.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Okay thanks Peter,

Regards,
--
Mikael

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From srs-list at SRS-CONSULTING.BIZ  Sat Nov 27 04:12:04 2004
From: srs-list at SRS-CONSULTING.BIZ (Mikael Chambon)
Date: Thu Jan 12 21:27:43 2006
Subject: Mailscanner installation
Message-ID: <mailman.5176.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Here is my output when starting MailScanner:


[root||mx] /opt/MailScanner/bin/check_mailscanner
Starting MailScanner...
In Debugging mode, not forking...
ack! no binary decoder! at /usr/lib/perl5/site_perl/5.6.1/MIME/Entity.pm
line 1851

I tried to resintall MIME-tools with the same result:


[root||mx] make test
PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e"
"test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
t/Body..............ok
t/Decoder...........ok
t/Entity............ok
t/Gauntlet..........ok
t/Head..............ok
t/Misc..............ok
t/Parser............ok
t/Ref...............ok
t/WordDecoder.......ok
t/Words.............ok
All tests successful.
Files=10, Tests=229,  2 wallclock secs ( 1.27 cusr +  0.13 csys =  1.40 CPU)
[root||mx] make install
Writing /usr/lib/perl5/site_perl/5.6.1/i386-linux/auto/MIME-tools/.packlist
Appending installation info to
/usr/lib/perl5/site_perl/5.6.1/i386-linux/perllocal.pod

Someone has an idea ?
Maybe we are not talking about the same decoder ?

Regards,
--
Mikael

Mikael Chambon wrote:
> Okay thanks Peter,
>
> Regards,
> --
> Mikael
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dhawal at NETMAGICSOLUTIONS.COM  Sat Nov 27 06:42:25 2004
From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy)
Date: Thu Jan 12 21:27:43 2006
Subject: New release of Vispan
Message-ID: <mailman.5177.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

David While wrote:
> The reason AntiVir doesn't appear in the config page is that it isn't
> configured to do so. I only have access to a limited number of virus
> scanners. If you can provide me with the command line option to print
> out the version information (usually -v or -info) and what it actually
> prints - I will add in the support.
>
> Regarding the virus not being reported - can you provide a sample of the
> log entry generated by MailScanner when the virus is detected - it is
> possible that AntiVir have changed the logging information string.
> --------------------------------------------
> David While BSc CEng MBCS CITP

For McAfee's uvscan (command line scanner for unix)
uvscan --version OR /usr/local/uvscan/uvscan --version
will give you the following..

[root@root]# uvscan --version
Virus Scan for Linux v4.40.0
Copyright (c) 1992-2004 Networks Associates Technology Inc. All rights
reserved.
(408) 988-3832  LICENSED COPY - Sep 23 2004

Scan engine v4.4.00 for Linux.
Virus data file v4410 created Nov 24 2004
Scanning for 108973 viruses, trojans and variants.

kindly add support for mcafee's uvscan at your convenience.

- dhawal

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Sun Nov 28 11:41:38 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:43 2006
Subject: Testing Message.pm.041121
Message-ID: <mailman.5178.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I've fixed that one now.
Patch for Message.pm.041121 is this:

4060c4060
<         unless $squashedtext =~ /^w+|ft+p|fpt+|mailto/;
---
 >         unless $squashedtext =~ /^ww+|ft+p|fpt+|mailto/;

Quentin Campbell wrote:

>Julian
>
>With the latest Message.pm the HTML tag
>
><a
>href=3D"http://www.worldonaplate.com/session.html">worldonaplate.com</a>
>
>is caught thus:
>
>The Newcastle MailScanner has detected a possible 'phishing fraud'
>attempt because there is a difference between the actual link
>"www.worldonaplate.com" and what it claims to be worldonaplate.com
>
>The HTML tag
>
><a
>href=3D"http://worldonaplate.com/session.html">www.worldonaplate.com</a>
>
>is not flagged.
>
>As I understood your comments that accompanied the latest Message.pm,
>the first tag should also have been passed unflagged. The example to
>which you responded and said you had fixed was of the first type of tag.
>
>
>
--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Sun Nov 28 11:42:59 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:43 2006
Subject: Messages sent with header only, SYSERR(root): readqf: cannot open
Message-ID: <mailman.5179.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Do a
/usr/sbin/sendmail -d0.1 -bt </dev/null
and see if the output contains HASFLOCK. If it doesn't then set "Lock
Type = posix" in MailScanner.conf.

Dawson, Alan wrote:

>I'm seeing a few messages that seem to get sent twice, the first time with
>only the header, then the full message later.
>
>/var/log/mail shows entries like
>
>Nov 22 12:20:28 charon sendmail[16998]: iAMCKBqG016952: SYSERR(root):
>readqf: cannot open ./dfiAMCKBqG016952: No such file or directory
>
>
>I've googled for this and found
>
>http://www.talkroot.com/archivee/index.php/t-3023__SYSERR(root):_readqf:_can
>not_open.html
>
>which suggests some file locking issues
>
>I'm running
>Sendmail 8.12.10 from SuSE Linux 9.0
>
>with MailScanner 4.35.11
>
>I notice in the depths of the MailScanner.conf
>
># How to lock spool files.
># Don't set this unless you *know* you need to.
># For sendmail, it defaults to "flock".
># For sendmail 8.13 onwards, you will probably need to change it to posix.
># For Exim, it defaults to "posix".
># No other type is implemented.
>Lock Type =
>
>
>Do i "need to"  and how would I know ?
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Sun Nov 28 11:57:14 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:43 2006
Subject: Bug in too many attachments?
Message-ID: <mailman.5180.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I have added a patch to do this for you. It will be in the next release.

paddy wrote:

>On Thu, Nov 25, 2004 at 10:36:06AM +0100, Francesco Rotondo wrote:
>
>
>>At 10.25 25/11/2004, you wrote:
>>
>>
>>>On Thu, Nov 25, 2004 at 10:15:04AM +0100, Francesco Rotondo wrote:
>>>
>>>
>>>>Hi all,
>>>>I'm running MS 4.35.11-1 and have the Maximum Attachments Per Message set
>>>>to the default value of 200. Yesterday a message has been quarantined
>>>>because it had Too many attachments but watching into the message I've
>>>>found that attachments were only 65. Has anyone else experienced this?
>>>>Regards
>>>>
>>>>
>>>Just a guess, but are some of those zips or whatever, so that the total
>>>_when unpacked_ is greater than the limit.  There is/was a very similar
>>>thread running.
>>>
>>>Regards,
>>>Paddy
>>>
>>>
>>Thanks for pointing out that. I watched the message again but there are no
>>zip. Attachments are only doc, pdf, txt, xls and jpg.
>>
>>
>
>I suppose it was a bit much to hope for: such a behaviour wouldn't go unnoticed
>long.  I've looked at the code, but the task getting rapidly beyond my
>original hit'n'run motivation ;)  Still ...
>
>As far as I can see, the decision is made in Message::Explode on the
>condition:
>
>        if ($maxparts>0 && MIME::Entity::MailScannerCounter()>=$maxparts)
>
>I haven't read MIME:Entity, but I would be looking for one of two things here:
>(1) get MailScanner to leave the temporary files behind,
>(2) log the value it counts
>I can't immediately see how to get (1), but (2) is as simple as altering line
>1123 just below from
>
>  MailScanner::Log::WarnLog("Too many attachments in %s", $this->{id});
>
>to something like:
>
>  MailScanner::Log::WarnLog("Too many attachments in %s %s", $this->{id}, MIME::Entity::MailScannerCounter());
>
>or better still: adding a log line that you can then simply rem out later.
>
>I hope. If you can call that function twice.  I'll go and try !
>
>Regards,
>Paddy
>
>--
>Perl 6 will give you the big knob. -- Larry Wall
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From alex at nkpanama.com  Sun Nov 28 15:34:20 2004
From: alex at nkpanama.com (Alex Neuman van der Hans)
Date: Thu Jan 12 21:27:43 2006
Subject: Messages sent with header only, SYSERR(root): readqf: cannot open
Message-ID: <mailman.5181.1137101263.24926.mailscanner@lists.mailscanner.info>

I just realized my sendmail doesn't have flock (installed from RPM on
Fedora)... Can there be any dire consequences if it was set for flock
(probably an inherited setting from an older installation)? I just set it to
posix now.

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Sunday, November 28, 2004 6:43 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Messages sent with header only, SYSERR(root): readqf: cannot
open

Do a
/usr/sbin/sendmail -d0.1 -bt </dev/null
and see if the output contains HASFLOCK. If it doesn't then set "Lock Type =
posix" in MailScanner.conf.

Dawson, Alan wrote:

>I'm seeing a few messages that seem to get sent twice, the first time
>with only the header, then the full message later.
>
>/var/log/mail shows entries like
>
>Nov 22 12:20:28 charon sendmail[16998]: iAMCKBqG016952: SYSERR(root):
>readqf: cannot open ./dfiAMCKBqG016952: No such file or directory
>
>
>I've googled for this and found
>
>http://www.talkroot.com/archivee/index.php/t-3023__SYSERR(root):_readqf
>:_can
>not_open.html
>
>which suggests some file locking issues
>
>I'm running
>Sendmail 8.12.10 from SuSE Linux 9.0
>
>with MailScanner 4.35.11
>
>I notice in the depths of the MailScanner.conf
>
># How to lock spool files.
># Don't set this unless you *know* you need to.
># For sendmail, it defaults to "flock".
># For sendmail 8.13 onwards, you will probably need to change it to posix.
># For Exim, it defaults to "posix".
># No other type is implemented.
>Lock Type =
>
>
>Do i "need to"  and how would I know ?
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store Professional Support
Services at www.MailScanner.biz MailScanner thanks transtec Computers for
their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Sun Nov 28 16:12:18 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:43 2006
Subject: Messages sent with header only, SYSERR(root): readqf: cannot open
Message-ID: <mailman.5182.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

If it is set wrong, your users will have been getting mail messages that
didn't have any message body in them, or were missing all their attachments.

Alex Neuman van der Hans wrote:

>I just realized my sendmail doesn't have flock (installed from RPM on
>Fedora)... Can there be any dire consequences if it was set for flock
>(probably an inherited setting from an older installation)? I just set it to
>posix now.
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
>Of Julian Field
>Sent: Sunday, November 28, 2004 6:43 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Messages sent with header only, SYSERR(root): readqf: cannot
>open
>
>Do a
>/usr/sbin/sendmail -d0.1 -bt </dev/null
>and see if the output contains HASFLOCK. If it doesn't then set "Lock Type =
>posix" in MailScanner.conf.
>
>Dawson, Alan wrote:
>
>
>
>>I'm seeing a few messages that seem to get sent twice, the first time
>>with only the header, then the full message later.
>>
>>/var/log/mail shows entries like
>>
>>Nov 22 12:20:28 charon sendmail[16998]: iAMCKBqG016952: SYSERR(root):
>>readqf: cannot open ./dfiAMCKBqG016952: No such file or directory
>>
>>
>>I've googled for this and found
>>
>>http://www.talkroot.com/archivee/index.php/t-3023__SYSERR(root):_readqf
>>:_can
>>not_open.html
>>
>>which suggests some file locking issues
>>
>>I'm running
>>Sendmail 8.12.10 from SuSE Linux 9.0
>>
>>with MailScanner 4.35.11
>>
>>I notice in the depths of the MailScanner.conf
>>
>># How to lock spool files.
>># Don't set this unless you *know* you need to.
>># For sendmail, it defaults to "flock".
>># For sendmail 8.13 onwards, you will probably need to change it to posix.
>># For Exim, it defaults to "posix".
>># No other type is implemented.
>>Lock Type =
>>
>>
>>Do i "need to"  and how would I know ?
>>
>>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From itdept at FRACTALWEB.COM  Sun Nov 28 20:33:16 2004
From: itdept at FRACTALWEB.COM (Fractal IT Dept.)
Date: Thu Jan 12 21:27:43 2006
Subject: upgraded SpamAssassin to 3.0.1 from 2.63...bayes trouble
Message-ID: <mailman.5183.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi everyone,

I just upgraded SpamAssassin to 3.0.1 from 2.6.3, and most things seem
alright. One problem is that Bayes doesn't seem to be working though. If
I type "sa-learn --import" or "sa-learn --rebuild" I get an error that
says "bayes: bayes db version 2 is not able to be used, aborting! at
/usr/libperl5/site_perl/5.8.1/Mail/SpamAssassin/BayesStore/DBM.pm line
160.

Obviously, something is not quite right, or I missed a step somewhere.
Help!

Thanks,
Chris
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From michele at BLACKNIGHTSOLUTIONS.COM  Sun Nov 28 20:46:34 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:43 2006
Subject: upgraded SpamAssassin to 3.0.1 from 2.63...bayes trouble
Message-ID: <mailman.5184.1137101263.24926.mailscanner@lists.mailscanner.info>

Fractal IT Dept. wrote:
> Hi everyone,
>
> I just upgraded SpamAssassin to 3.0.1 from 2.6.3, and most things
> seem alright. One problem is that Bayes doesn't seem to be working
> though. If I type "sa-learn --import" or "sa-learn --rebuild" I get
> an error that says "bayes: bayes db version 2 is not able to be used,
> aborting! at
> /usr/libperl5/site_perl/5.8.1/Mail/SpamAssassin/BayesStore/DBM.pm
> line 160.
>
> Obviously, something is not quite right, or I missed a step
> somewhere. Help!
>
> Thanks,
> Chris

You didn't read the documentation :)
Have a look at the docs that come with SA 3.*

Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
http://www.blacknight.ie/specialoffers.html

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Steve.Swaney at FSL.COM  Sun Nov 28 20:48:30 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:43 2006
Subject: upgraded SpamAssassin to 3.0.1 from 2.63...bayes trouble
Message-ID: <mailman.5185.1137101263.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Fractal IT Dept.
> Sent: Sunday, November 28, 2004 3:33 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: upgraded SpamAssassin to 3.0.1 from 2.63...bayes trouble
>
> Hi everyone,
>
> I just upgraded SpamAssassin to 3.0.1 from 2.6.3, and most things seem
> alright. One problem is that Bayes doesn't seem to be working though. If I
> type "sa-learn --import" or "sa-learn --rebuild" I get an error that says
> "bayes: bayes db version 2 is not able to be used, aborting! at
> /usr/libperl5/site_perl/5.8.1/Mail/SpamAssassin/BayesStore/DBM.pm line
> 160.
>
> Obviously, something is not quite right, or I missed a step somewhere.
> Help!
>

Read the instructions in the UPGRADE file in the SpamAssassin Install
directory

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From peter at UCGBOOK.COM  Sun Nov 28 22:00:54 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:43 2006
Subject: upgraded SpamAssassin to 3.0.1 from 2.63...bayes trouble
Message-ID: <mailman.5186.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Fractal IT Dept. wrote:
> Hi everyone,
>
> I just upgraded SpamAssassin to 3.0.1 from 2.6.3, and most things seem
> alright. One problem is that Bayes doesn't seem to be working though. If
> I type "sa-learn --import" or "sa-learn --rebuild" I get an error that
> says "bayes: bayes db version 2 is not able to be used, aborting! at
> /usr/libperl5/site_perl/5.8.1/Mail/SpamAssassin/BayesStore/DBM.pm line 160.
>
> Obviously, something is not quite right, or I missed a step somewhere.
> Help!

SA3 uses bayes db version 3 so you need to upgrade it. That doesn't
always work so the easiest thing would be to delete the files and it
will start over using version 3. It will soon be trained again.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mbneto at gmail.com  Sun Nov 28 23:11:44 2004
From: mbneto at gmail.com (Mario Bittencourt)
Date: Thu Jan 12 21:27:43 2006
Subject: Looked up unknown string archivetoodeep in language translation
    file ?
Message-ID: <mailman.5187.1137101263.24926.mailscanner@lists.mailscanner.info>

Hi,

My log file keeps showing lines like this

Looked up unknown string archivetoodeep in language translation file
/etc/MailScanner/reports/pt_br/languages.conf

Any ideas ?

- mb

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner-user at NELAND.DK  Sun Nov 28 23:24:52 2004
From: mailscanner-user at NELAND.DK (Leif Neland)
Date: Thu Jan 12 21:27:43 2006
Subject: Looked up unknown string archivetoodeep in language
    translation file ?
Message-ID: <mailman.5188.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

----- Original Message -----
From: "Mario Bittencourt" <mbneto@gmail.com>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Monday, November 29, 2004 12:11 AM
Subject: Looked up unknown string archivetoodeep in language translation
file ?


> Hi,
>
> My log file keeps showing lines like this
>
> Looked up unknown string archivetoodeep in language translation file
> /etc/MailScanner/reports/pt_br/languages.conf
>
> Any ideas ?

Seems clear to me.

The term archivetoodeep is not in the portugese/brasillian translation.
You need to add it, if it is not in the newest version.

A part of my .../reports/pt_br/languages.conf:
# Used in passworded-archives checks
UnreadableArchive = A mensagem contem um anexo comprimido que nco pode ser
lido
PasswordedArchive = A menssagem contem um anexo comprimido protegido com
senha
ArchiveTooDeep = Message contained archive nested too deeply
# Used in Postmaster notices


So it is not translated. You need to to that.

Leif

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dmehler26 at woh.rr.com  Mon Nov 29 01:18:12 2004
From: dmehler26 at woh.rr.com (dave)
Date: Thu Jan 12 21:27:43 2006
Subject: mailscanner and razor logfile hashed directories
Message-ID: <mailman.5189.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hello,
    I've installed and configured postfix and mailscanner on a freebsd 5.3
box. Whenever mailscanner starts i get errors about files found in the HOLD
queue but no messages and to enable hashed directories with a depth of 1 or
2. This appears to be due to the fact that razor when ms calls sa which
calls it, places it's log file in the ms queue. I've added a logfile entry
to my /root/razor-agent.conf as well as /etc/razor/razor-agent.conf and
/usr/local/etc/razor/razor-agent.conf but the message persists. How would i
disable it without disabling razor or changing my postfix config?
Thanks.
Dave.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From kevins at BMRB.CO.UK  Mon Nov 29 08:21:14 2004
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:27:43 2006
Subject: mailscanner and razor logfile hashed directories
Message-ID: <mailman.5190.1137101263.24926.mailscanner@lists.mailscanner.info>

On Mon, 2004-11-29 at 01:18, dave wrote:
> Hello,
>     I've installed and configured postfix and mailscanner on a freebsd 5.3
> box. Whenever mailscanner starts i get errors about files found in the HOLD
> queue but no messages and to enable hashed directories with a depth of 1 or
> 2. This appears to be due to the fact that razor when ms calls sa which
> calls it, places it's log file in the ms queue. I've added a logfile entry
> to my /root/razor-agent.conf as well as /etc/razor/razor-agent.conf and
> /usr/local/etc/razor/razor-agent.conf but the message persists. How would i
> disable it without disabling razor or changing my postfix config?

I suspect the key is that razor will be running as the same user MS runs
as, which will be the same user as postfix (i.e. not root).  So its that
users home directory you need to look at.




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From MHewryk at SYMCOR.COM  Mon Nov 29 08:29:32 2004
From: MHewryk at SYMCOR.COM (Magda Hewryk)
Date: Thu Jan 12 21:27:43 2006
Subject: MS 4.35.11 and Notification about bad file name (bad attchment)
Message-ID: <mailman.5191.1137101263.24926.mailscanner@lists.mailscanner.info>

 Hi,

I've upgraded MS from 4.31.6 to the newest 4.35.11 and all work fine except
the Notification to the user about the bad attachment (bad file name).
This is not sent out at all.

I've checked the maillog log and I can say that the mail is scanned, the
zip/jpeg file is detected (we deny them) and the attachment is quarantined.
All works OK as usual.

However, no message is sent to the user about the attachment removal.   The
notification message is sent to the Postmaster with a great/new  Subject
line but I can't get anything to be sent to the recipient.

I have to try to re-compile v. 4.31.6 again and cross my fingers for no
errors.   I need to put into the production again.

I know that this is not a problem with the MailScanner.conf file because I
stopped a daemon and started running with the old one and got the same
results.  It must be something else I'm missing here.

Any hints?

Many thanks.
Magda

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Q.G.Campbell at NEWCASTLE.AC.UK  Mon Nov 29 09:02:45 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:43 2006
Subject: Messages sent with header only, SYSERR(root): readqf: cannot open
Message-ID: <mailman.5192.1137101263.24926.mailscanner@lists.mailscanner.info>

>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>Sent: 28 November 2004 11:43
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Messages sent with header only, SYSERR(root): 
>readqf: cannot open
>
>
>Do a
>/usr/sbin/sendmail -d0.1 -bt </dev/null
>and see if the output contains HASFLOCK. If it doesn't then set "Lock
>Type = posix" in MailScanner.conf.
>
Julian

The advice above might be a little confusing. At least it has confused
me!

I run bog standard RedHat AS 3 systems [Red Hat Enterprise Linux AS
release 3 (Taroon Update 2)] which have Sendmail 8.12.11/8.12.10.

Because of this I do not set "Lock Type" in MailScanner.conf and let it
default as "flock" as advised by your MailScanner.conf comments
(4.35.11-1).

Running Sendmail as above at that debug level says nothing about
"HASFLOCK" on RH AS 3 systems. 

Also I have seen just two "readqf" message in more than a week and that
is amongst a million+ messages received.

If I am supposed to ignore the MailScanner.conf advice and follow the
new advice above, could I ask that the comments in MailScanner.conf be
updated as well?

Thanks

Quentin

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dh at UPTIME.AT  Mon Nov 29 09:08:23 2004
From: dh at UPTIME.AT ([ISO-8859-1] David Höhn)
Date: Thu Jan 12 21:27:43 2006
Subject: Messages sent with header only, SYSERR(root): readqf: cannot open
Message-ID: <mailman.5193.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

Quentin Campbell wrote:
|>-----Original Message-----
|>From: MailScanner mailing list
|>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
|>Sent: 28 November 2004 11:43
|>To: MAILSCANNER@JISCMAIL.AC.UK
|>Subject: Re: Messages sent with header only, SYSERR(root):
|>readqf: cannot open
|>
|>
|>Do a
|>/usr/sbin/sendmail -d0.1 -bt </dev/null
|>and see if the output contains HASFLOCK. If it doesn't then set "Lock
|>Type = posix" in MailScanner.conf.
|>
|
| Julian
|
| The advice above might be a little confusing. At least it has confused
| me!
|
| I run bog standard RedHat AS 3 systems [Red Hat Enterprise Linux AS
| release 3 (Taroon Update 2)] which have Sendmail 8.12.11/8.12.10.
|
<snip>

Sendmail prior to 8.13.* is always compiled with FLOCK enabled on Linux
based systems as far as I can recall. That is why you are most likely
not seeing it as an explicit , enabled Macro.

- -d

- --
nee anata wo mitsukete soshite nidoto wasurezu
~      donna ni munega itakutemo soba ni iru no
~                         zutto...zutto...zutto
Key fingerprint = FD77 F0B7 5C65 F546 EB08  A4EC 3CCA 1A32 7E24 291E
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (Darwin)

iD8DBQFBqucHPMoaMn4kKR4RA334AJ9KKHTjyLvWqgWbEMxDNod+VsW2YACfSI49
hqm8cn91mKyGvtHnEtIgyPI=
=ivY+
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Mon Nov 29 09:24:09 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:43 2006
Subject: Mailscanner installation
Message-ID: <mailman.5194.1137101263.24926.mailscanner@lists.mailscanner.info>

Mikael

looks like a probel with Perl modules and RPM versions of the modules to me.

What happens if you use CPAN to install the module???

Use 'perl -MCPAN -eshell' to start then

force install MIME::Tools


should install that and all the pre-requites for you..


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Mikael Chambon wrote:
> Here is my output when starting MailScanner:
>
>
> [root||mx] /opt/MailScanner/bin/check_mailscanner
> Starting MailScanner...
> In Debugging mode, not forking...
> ack! no binary decoder! at /usr/lib/perl5/site_perl/5.6.1/MIME/Entity.pm
> line 1851
>
> I tried to resintall MIME-tools with the same result:
>
>
> [root||mx] make test
> PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e"
> "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
> t/Body..............ok
> t/Decoder...........ok
> t/Entity............ok
> t/Gauntlet..........ok
> t/Head..............ok
> t/Misc..............ok
> t/Parser............ok
> t/Ref...............ok
> t/WordDecoder.......ok
> t/Words.............ok
> All tests successful.
> Files=10, Tests=229,  2 wallclock secs ( 1.27 cusr +  0.13 csys =  1.40
> CPU)
> [root||mx] make install
> Writing /usr/lib/perl5/site_perl/5.6.1/i386-linux/auto/MIME-tools/.packlist
> Appending installation info to
> /usr/lib/perl5/site_perl/5.6.1/i386-linux/perllocal.pod
>
> Someone has an idea ?
> Maybe we are not talking about the same decoder ?
>
> Regards,
> --
> Mikael
>
> Mikael Chambon wrote:
>
>> Okay thanks Peter,
>>
>> Regards,
>> --
>> Mikael
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>> Support MailScanner development - buy the book off the website!
>>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From MHewryk at SYMCOR.COM  Mon Nov 29 09:43:00 2004
From: MHewryk at SYMCOR.COM (Magda Hewryk)
Date: Thu Jan 12 21:27:43 2006
Subject: MS 4.35.11 - need a help with Deliver Cleaned Messages after MS
    upgrade
Message-ID: <mailman.5195.1137101263.24926.mailscanner@lists.mailscanner.info>

 Hi,

I couldn't uninstall MS 4.35.11 and go back to my previous version 4.31.6.
I'm stack here trying to get the report about the Bad File Name working.
For some reason it stopped working after the MS upgrade.

The notification to the Postmaster work OK though.

Any help,
Magda

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Mon Nov 29 09:52:13 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:43 2006
Subject: MS 4.35.11 - need a help with Deliver Cleaned Messages after
    MS upgrade
Message-ID: <mailman.5196.1137101263.24926.mailscanner@lists.mailscanner.info>

Magda

where about's are you stuck. What have you tried and what's not
happening. Also remind of the O/S and how you've installed MS - RPM or
tar,gz version..


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Magda Hewryk wrote:
>  Hi,
>
> I couldn't uninstall MS 4.35.11 and go back to my previous version 4.31.6.
> I'm stack here trying to get the report about the Bad File Name working.
> For some reason it stopped working after the MS upgrade.
>
> The notification to the Postmaster work OK though.
>
> Any help,
> Magda
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From MHewryk at SYMCOR.COM  Mon Nov 29 10:04:52 2004
From: MHewryk at SYMCOR.COM (Magda Hewryk)
Date: Thu Jan 12 21:27:43 2006
Subject: MS 4.35.11 - need a help with Deliver Cleaned Messages after
    MS upgrade
Message-ID: <mailman.5197.1137101263.24926.mailscanner@lists.mailscanner.info>

Hi Martin,
Thanks for getting back to me!

I've upgraded MS:  version 4.31.6 to 4.35.11
OS:  Fedora 1
Download file:  MailScanner-4.35.11-1.rpm.tar.gzip

I can't get the Notification to be sent to the user about the attachment
being stripped.
I've got the zip attachment in the quarantine directory but the message is
not forward to the user.  It is treated like a virus  (Still Deliver Silent
Viruses = no ).
I don't know why?  The postmaster however gets the message "Bad Filename
Detected".

What is wrong that MS can't send the notification about the attachment
stripped to the user?
All work before the upgrade (last night).

Nov 29 04:47:29  xxxxx MailScanner[24695]: Filename Checks: Possible
Microsoft Exchange Shortcut attack (iAT9lAUC026333 Copyofbb-lnxraid.zip)
Nov 29 04:47:29 xxxxx   MailScanner[24695]: Saved infected
"Copyofbb-lnxraid.zip" to
/var/spool/MailScanner/quarantine/20041129/iAT9lAUC026333

Thanks,

Magda Hewryk
--------------------------------
Mid-Range Systems
905-273-1637 (Office)
416-554-0743 (Cell)

MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK> wrote on 11/29/2004
04:52:13 AM:

> Magda
>
> where about's are you stuck. What have you tried and what's not
> happening. Also remind of the O/S and how you've installed MS - RPM or
> tar,gz version..
>
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Magda Hewryk wrote:
> >  Hi,
> >
> > I couldn't uninstall MS 4.35.11 and go back to my previous version
4.31.6.
> > I'm stack here trying to get the report about the Bad File Name
working.
> > For some reason it stopped working after the MS upgrade.
> >
> > The notification to the Postmaster work OK though.
> >
> > Any help,
> > Magda
> >
> > ------------------------ MailScanner list ------------------------
> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> > Support MailScanner development - buy the book off the website!
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Mon Nov 29 10:09:57 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:43 2006
Subject: MS 4.35.11 - need a help with Deliver Cleaned Messages after
    MS upgrade
Message-ID: <mailman.5198.1137101263.24926.mailscanner@lists.mailscanner.info>

Magda

Ok, what are the relevent bits of the MailScanner.conf and any rules..


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Magda Hewryk wrote:
> Hi Martin,
> Thanks for getting back to me!
>
> I've upgraded MS:  version 4.31.6 to 4.35.11
> OS:  Fedora 1
> Download file:  MailScanner-4.35.11-1.rpm.tar.gzip
>
> I can't get the Notification to be sent to the user about the attachment
> being stripped.
> I've got the zip attachment in the quarantine directory but the message is
> not forward to the user.  It is treated like a virus  (Still Deliver Silent
> Viruses = no ).
> I don't know why?  The postmaster however gets the message "Bad Filename
> Detected".
>
> What is wrong that MS can't send the notification about the attachment
> stripped to the user?
> All work before the upgrade (last night).
>
> Nov 29 04:47:29  xxxxx MailScanner[24695]: Filename Checks: Possible
> Microsoft Exchange Shortcut attack (iAT9lAUC026333 Copyofbb-lnxraid.zip)
> Nov 29 04:47:29 xxxxx   MailScanner[24695]: Saved infected
> "Copyofbb-lnxraid.zip" to
> /var/spool/MailScanner/quarantine/20041129/iAT9lAUC026333
>
> Thanks,
>
> Magda Hewryk
> --------------------------------
> Mid-Range Systems
> 905-273-1637 (Office)
> 416-554-0743 (Cell)
>
> MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK> wrote on 11/29/2004
> 04:52:13 AM:
>
>
>>Magda
>>
>>where about's are you stuck. What have you tried and what's not
>>happening. Also remind of the O/S and how you've installed MS - RPM or
>>tar,gz version..
>>
>>
>>--
>>Martin Hepworth
>>Snr Systems Administrator
>>Solid State Logic
>>Tel: +44 (0)1865 842300
>>
>>
>>Magda Hewryk wrote:
>>
>>> Hi,
>>>
>>>I couldn't uninstall MS 4.35.11 and go back to my previous version
>
> 4.31.6.
>
>>>I'm stack here trying to get the report about the Bad File Name
>
> working.
>
>>>For some reason it stopped working after the MS upgrade.
>>>
>>>The notification to the Postmaster work OK though.
>>>
>>>Any help,
>>>Magda
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>
>>**********************************************************************
>>
>>This email and any files transmitted with it are confidential and
>>intended solely for the use of the individual or entity to whom they
>>are addressed. If you have received this email in error please notify
>>the system manager.
>>
>>This footnote confirms that this email message has been swept
>>for the presence of computer viruses and is believed to be clean.
>>
>>**********************************************************************
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From MHewryk at SYMCOR.COM  Mon Nov 29 10:19:40 2004
From: MHewryk at SYMCOR.COM (Magda Hewryk)
Date: Thu Jan 12 21:27:43 2006
Subject: MS 4.35.11 - need a help with Deliver Cleaned Messages after
    MS upgrade
Message-ID: <mailman.5199.1137101263.24926.mailscanner@lists.mailscanner.info>

Hi  Martin,

I have not changed any rules and the config file is almost the same.  After
upgrade I've run upgrade_MailScanner_conf  command and then I differed the
new file with the existing .config.  Nothing is really changed except MCP &
Advanced setting which is new for 4.35.11.

Rules are the same:
to deny zip/gifs/jpegs and other attachments.

I'm testing any attachments, and all attachments are quarantined correctly,
notification is sent to Postmaster correctly but the recipient gets
nothing. Either notification nor original message with the stripped
attachments is passed to recipient.

Any thoughts?

Magda







             Martin Hepworth
             <martinh@SOLID-ST
             ATE-LOGIC.COM>                                             To
             Sent by:                  MAILSCANNER@JISCMAIL.AC.UK
             MailScanner                                                cc
             mailing list
             <MAILSCANNER@JISC                                     Subject
             MAIL.AC.UK>               Re: MS 4.35.11 - need a help with
                                       Deliver Cleaned Messages after MS
                                       upgrade
             11/29/2004 05:09
             AM


             Please respond to
                MailScanner
               mailing list
             <MAILSCANNER@JISC
                MAIL.AC.UK>






Magda

Ok, what are the relevent bits of the MailScanner.conf and any rules..


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Magda Hewryk wrote:
> Hi Martin,
> Thanks for getting back to me!
>
> I've upgraded MS:  version 4.31.6 to 4.35.11
> OS:  Fedora 1
> Download file:  MailScanner-4.35.11-1.rpm.tar.gzip
>
> I can't get the Notification to be sent to the user about the attachment
> being stripped.
> I've got the zip attachment in the quarantine directory but the message
is
> not forward to the user.  It is treated like a virus  (Still Deliver
Silent
> Viruses = no ).
> I don't know why?  The postmaster however gets the message "Bad Filename
> Detected".
>
> What is wrong that MS can't send the notification about the attachment
> stripped to the user?
> All work before the upgrade (last night).
>
> Nov 29 04:47:29  xxxxx MailScanner[24695]: Filename Checks: Possible
> Microsoft Exchange Shortcut attack (iAT9lAUC026333 Copyofbb-lnxraid.zip)
> Nov 29 04:47:29 xxxxx   MailScanner[24695]: Saved infected
> "Copyofbb-lnxraid.zip" to
> /var/spool/MailScanner/quarantine/20041129/iAT9lAUC026333
>
> Thanks,
>
> Magda Hewryk
> --------------------------------
> Mid-Range Systems
> 905-273-1637 (Office)
> 416-554-0743 (Cell)
>
> MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK> wrote on 11/29/2004
> 04:52:13 AM:
>
>
>>Magda
>>
>>where about's are you stuck. What have you tried and what's not
>>happening. Also remind of the O/S and how you've installed MS - RPM or
>>tar,gz version..
>>
>>
>>--
>>Martin Hepworth
>>Snr Systems Administrator
>>Solid State Logic
>>Tel: +44 (0)1865 842300
>>
>>
>>Magda Hewryk wrote:
>>
>>> Hi,
>>>
>>>I couldn't uninstall MS 4.35.11 and go back to my previous version
>
> 4.31.6.
>
>>>I'm stack here trying to get the report about the Bad File Name
>
> working.
>
>>>For some reason it stopped working after the MS upgrade.
>>>
>>>The notification to the Postmaster work OK though.
>>>
>>>Any help,
>>>Magda
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>
>>**********************************************************************
>>
>>This email and any files transmitted with it are confidential and
>>intended solely for the use of the individual or entity to whom they
>>are addressed. If you have received this email in error please notify
>>the system manager.
>>
>>This footnote confirms that this email message has been swept
>>for the presence of computer viruses and is believed to be clean.
>>
>>**********************************************************************
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From MHewryk at SYMCOR.COM  Mon Nov 29 10:26:47 2004
From: MHewryk at SYMCOR.COM (Magda Hewryk)
Date: Thu Jan 12 21:27:43 2006
Subject: MS 4.35.11 - need a help with Deliver Cleaned Messages after
    MS upgrade
Message-ID: <mailman.5200.1137101263.24926.mailscanner@lists.mailscanner.info>

 Martin,

Here are some relevant or new entries in my MailScanner.conf file:

Deliver Cleaned Messages = yes
Max Normal Queue Size = 1000
Maximum Attachments Per Message = 200
Expand TNEF = yes
Deliver Unparsable TNEF = no
TNEF Expander = /usr/bin/tnef --maxsize=100000000
TNEF Timeout = 120
File Command = #/usr/bin/file
File Timeout = 20
Maximum Message Size = 0
Maximum Attachment Size = -1
Minimum Attachment Size = -1
Maximum Archive Depth = 2
Find Archives By Content = yes


Stored Bad Content Message Report = %report-dir%/stored.content.message.txt
Stored Bad Filename Message Report =
%report-dir%/stored.filename.message.txt  #mnh T122
Stored Virus Message Report = %report-dir%/stored.virus.message.txt
#mnh T122-mcafee

Inline HTML Warning = %report-dir%/inline.warning.html
#mnh T122
Inline Text Warning = %report-dir%/inline.warning.txt




             Magda Hewryk
             <MHewryk@SYMCOR.C
             OM>                                                        To
             Sent by:                  MAILSCANNER@JISCMAIL.AC.UK
             MailScanner                                                cc
             mailing list
             <MAILSCANNER@JISC                                     Subject
             MAIL.AC.UK>               Re: MS 4.35.11 - need a help with
                                       Deliver Cleaned Messages after MS
                                       upgrade
             11/29/2004 05:19
             AM


             Please respond to
                MailScanner
               mailing list
             <MAILSCANNER@JISC
                MAIL.AC.UK>






Hi  Martin,

I have not changed any rules and the config file is almost the same.  After
upgrade I've run upgrade_MailScanner_conf  command and then I differed the
new file with the existing .config.  Nothing is really changed except MCP &
Advanced setting which is new for 4.35.11.

Rules are the same:
to deny zip/gifs/jpegs and other attachments.

I'm testing any attachments, and all attachments are quarantined correctly,
notification is sent to Postmaster correctly but the recipient gets
nothing. Either notification nor original message with the stripped
attachments is passed to recipient.

Any thoughts?

Magda







             Martin Hepworth
             <martinh@SOLID-ST
             ATE-LOGIC.COM>                                             To
             Sent by:                  MAILSCANNER@JISCMAIL.AC.UK
             MailScanner                                                cc
             mailing list
             <MAILSCANNER@JISC                                     Subject
             MAIL.AC.UK>               Re: MS 4.35.11 - need a help with
                                       Deliver Cleaned Messages after MS
                                       upgrade
             11/29/2004 05:09
             AM


             Please respond to
                MailScanner
               mailing list
             <MAILSCANNER@JISC
                MAIL.AC.UK>






Magda

Ok, what are the relevent bits of the MailScanner.conf and any rules..


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Magda Hewryk wrote:
> Hi Martin,
> Thanks for getting back to me!
>
> I've upgraded MS:  version 4.31.6 to 4.35.11
> OS:  Fedora 1
> Download file:  MailScanner-4.35.11-1.rpm.tar.gzip
>
> I can't get the Notification to be sent to the user about the attachment
> being stripped.
> I've got the zip attachment in the quarantine directory but the message
is
> not forward to the user.  It is treated like a virus  (Still Deliver
Silent
> Viruses = no ).
> I don't know why?  The postmaster however gets the message "Bad Filename
> Detected".
>
> What is wrong that MS can't send the notification about the attachment
> stripped to the user?
> All work before the upgrade (last night).
>
> Nov 29 04:47:29  xxxxx MailScanner[24695]: Filename Checks: Possible
> Microsoft Exchange Shortcut attack (iAT9lAUC026333 Copyofbb-lnxraid.zip)
> Nov 29 04:47:29 xxxxx   MailScanner[24695]: Saved infected
> "Copyofbb-lnxraid.zip" to
> /var/spool/MailScanner/quarantine/20041129/iAT9lAUC026333
>
> Thanks,
>
> Magda Hewryk
> --------------------------------
> Mid-Range Systems
> 905-273-1637 (Office)
> 416-554-0743 (Cell)
>
> MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK> wrote on 11/29/2004
> 04:52:13 AM:
>
>
>>Magda
>>
>>where about's are you stuck. What have you tried and what's not
>>happening. Also remind of the O/S and how you've installed MS - RPM or
>>tar,gz version..
>>
>>
>>--
>>Martin Hepworth
>>Snr Systems Administrator
>>Solid State Logic
>>Tel: +44 (0)1865 842300
>>
>>
>>Magda Hewryk wrote:
>>
>>> Hi,
>>>
>>>I couldn't uninstall MS 4.35.11 and go back to my previous version
>
> 4.31.6.
>
>>>I'm stack here trying to get the report about the Bad File Name
>
> working.
>
>>>For some reason it stopped working after the MS upgrade.
>>>
>>>The notification to the Postmaster work OK though.
>>>
>>>Any help,
>>>Magda
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>
>>**********************************************************************
>>
>>This email and any files transmitted with it are confidential and
>>intended solely for the use of the individual or entity to whom they
>>are addressed. If you have received this email in error please notify
>>the system manager.
>>
>>This footnote confirms that this email message has been swept
>>for the presence of computer viruses and is believed to be clean.
>>
>>**********************************************************************
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Mon Nov 29 10:36:30 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:43 2006
Subject: MS 4.35.11 - need a help with Deliver Cleaned Messages after
    MS upgrade
Message-ID: <mailman.5201.1137101263.24926.mailscanner@lists.mailscanner.info>

Magda

what about the 'old' entries in the MailScanner.conf that do all the
message notication and any rules they call??

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Magda Hewryk wrote:
>  Martin,
>
> Here are some relevant or new entries in my MailScanner.conf file:
>
> Deliver Cleaned Messages = yes
> Max Normal Queue Size = 1000
> Maximum Attachments Per Message = 200
> Expand TNEF = yes
> Deliver Unparsable TNEF = no
> TNEF Expander = /usr/bin/tnef --maxsize=100000000
> TNEF Timeout = 120
> File Command = #/usr/bin/file
> File Timeout = 20
> Maximum Message Size = 0
> Maximum Attachment Size = -1
> Minimum Attachment Size = -1
> Maximum Archive Depth = 2
> Find Archives By Content = yes
>
>
> Stored Bad Content Message Report = %report-dir%/stored.content.message.txt
> Stored Bad Filename Message Report =
> %report-dir%/stored.filename.message.txt  #mnh T122
> Stored Virus Message Report = %report-dir%/stored.virus.message.txt
> #mnh T122-mcafee
>
> Inline HTML Warning = %report-dir%/inline.warning.html
> #mnh T122
> Inline Text Warning = %report-dir%/inline.warning.txt
>
>
>
>
>              Magda Hewryk
>              <MHewryk@SYMCOR.C
>              OM>                                                        To
>              Sent by:                  MAILSCANNER@JISCMAIL.AC.UK
>              MailScanner                                                cc
>              mailing list
>              <MAILSCANNER@JISC                                     Subject
>              MAIL.AC.UK>               Re: MS 4.35.11 - need a help with
>                                        Deliver Cleaned Messages after MS
>                                        upgrade
>              11/29/2004 05:19
>              AM
>
>
>              Please respond to
>                 MailScanner
>                mailing list
>              <MAILSCANNER@JISC
>                 MAIL.AC.UK>
>
>
>
>
>
>
> Hi  Martin,
>
> I have not changed any rules and the config file is almost the same.  After
> upgrade I've run upgrade_MailScanner_conf  command and then I differed the
> new file with the existing .config.  Nothing is really changed except MCP &
> Advanced setting which is new for 4.35.11.
>
> Rules are the same:
> to deny zip/gifs/jpegs and other attachments.
>
> I'm testing any attachments, and all attachments are quarantined correctly,
> notification is sent to Postmaster correctly but the recipient gets
> nothing. Either notification nor original message with the stripped
> attachments is passed to recipient.
>
> Any thoughts?
>
> Magda
>
>
>
>
>
>
>
>              Martin Hepworth
>              <martinh@SOLID-ST
>              ATE-LOGIC.COM>                                             To
>              Sent by:                  MAILSCANNER@JISCMAIL.AC.UK
>              MailScanner                                                cc
>              mailing list
>              <MAILSCANNER@JISC                                     Subject
>              MAIL.AC.UK>               Re: MS 4.35.11 - need a help with
>                                        Deliver Cleaned Messages after MS
>                                        upgrade
>              11/29/2004 05:09
>              AM
>
>
>              Please respond to
>                 MailScanner
>                mailing list
>              <MAILSCANNER@JISC
>                 MAIL.AC.UK>
>
>
>
>
>
>
> Magda
>
> Ok, what are the relevent bits of the MailScanner.conf and any rules..
>
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Magda Hewryk wrote:
>
>>Hi Martin,
>>Thanks for getting back to me!
>>
>>I've upgraded MS:  version 4.31.6 to 4.35.11
>>OS:  Fedora 1
>>Download file:  MailScanner-4.35.11-1.rpm.tar.gzip
>>
>>I can't get the Notification to be sent to the user about the attachment
>>being stripped.
>>I've got the zip attachment in the quarantine directory but the message
>
> is
>
>>not forward to the user.  It is treated like a virus  (Still Deliver
>
> Silent
>
>>Viruses = no ).
>>I don't know why?  The postmaster however gets the message "Bad Filename
>>Detected".
>>
>>What is wrong that MS can't send the notification about the attachment
>>stripped to the user?
>>All work before the upgrade (last night).
>>
>>Nov 29 04:47:29  xxxxx MailScanner[24695]: Filename Checks: Possible
>>Microsoft Exchange Shortcut attack (iAT9lAUC026333 Copyofbb-lnxraid.zip)
>>Nov 29 04:47:29 xxxxx   MailScanner[24695]: Saved infected
>>"Copyofbb-lnxraid.zip" to
>>/var/spool/MailScanner/quarantine/20041129/iAT9lAUC026333
>>
>>Thanks,
>>
>>Magda Hewryk
>>--------------------------------
>>Mid-Range Systems
>>905-273-1637 (Office)
>>416-554-0743 (Cell)
>>
>>MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK> wrote on 11/29/2004
>>04:52:13 AM:
>>
>>
>>
>>>Magda
>>>
>>>where about's are you stuck. What have you tried and what's not
>>>happening. Also remind of the O/S and how you've installed MS - RPM or
>>>tar,gz version..
>>>
>>>
>>>--
>>>Martin Hepworth
>>>Snr Systems Administrator
>>>Solid State Logic
>>>Tel: +44 (0)1865 842300
>>>
>>>
>>>Magda Hewryk wrote:
>>>
>>>
>>>>Hi,
>>>>
>>>>I couldn't uninstall MS 4.35.11 and go back to my previous version
>>
>>4.31.6.
>>
>>
>>>>I'm stack here trying to get the report about the Bad File Name
>>
>>working.
>>
>>
>>>>For some reason it stopped working after the MS upgrade.
>>>>
>>>>The notification to the Postmaster work OK though.
>>>>
>>>>Any help,
>>>>Magda
>>>>
>>>>------------------------ MailScanner list ------------------------
>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>>'leave mailscanner' in the body of the email.
>>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>
>>>>Support MailScanner development - buy the book off the website!
>>>
>>>**********************************************************************
>>>
>>>This email and any files transmitted with it are confidential and
>>>intended solely for the use of the individual or entity to whom they
>>>are addressed. If you have received this email in error please notify
>>>the system manager.
>>>
>>>This footnote confirms that this email message has been swept
>>>for the presence of computer viruses and is believed to be clean.
>>>
>>>**********************************************************************
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From alan at ESSEX.AC.UK  Mon Nov 29 10:27:08 2004
From: alan at ESSEX.AC.UK (Stanier, Alan M)
Date: Thu Jan 12 21:27:43 2006
Subject: Sudden problem with MailScanner 4.36.1
Message-ID: <mailman.5202.1137101263.24926.mailscanner@lists.mailscanner.info>

Hi

We are running MailScanner 4.36.1 on three SMTP servers. At 08:50 today,
one server stopped delievering mail, logging messages like:-

Cannot parse
/var/spool/MailScanner/incoming/29863/1CYiZb-0000Xg-LK.header and ,
write-open
/var/spool/MailScanner/incoming/29863/1CYiZb-0000Xg-LK/msg-29863-4.txt:
No such file or directory at /usr/share/perl5/MIME/Body.pm line 414,
<_GEN_3> line 1159.

Nothing obvious happened to trigger the fault, there is no evidence of
disk problems, lots of freespace on the disks. Everything seems the same
on the machine that is failing as on those that are working.

Does anyone have any idea where I should be looking for the problem?

Thanks

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From MHewryk at SYMCOR.COM  Mon Nov 29 10:46:25 2004
From: MHewryk at SYMCOR.COM (Magda Hewryk)
Date: Thu Jan 12 21:27:43 2006
Subject: MS 4.35.11 - need a help with Deliver Cleaned Messages after
    MS upgrade
Message-ID: <mailman.5203.1137101263.24926.mailscanner@lists.mailscanner.info>

Martin,

Is it save to remove rpm -e  mailscanner-4.35.11-1; and install  back my
old version using install.sh script?
Can I manually remove current rpm and proceed with the lower version
install?


Thanks,

Magda Hewryk
--------------------------------
Mid-Range Systems
905-273-1637 (Office)
416-554-0743 (Cell)



             Martin Hepworth
             <martinh@SOLID-ST
             ATE-LOGIC.COM>                                             To
             Sent by:                  MAILSCANNER@JISCMAIL.AC.UK
             MailScanner                                                cc
             mailing list
             <MAILSCANNER@JISC                                     Subject
             MAIL.AC.UK>               Re: MS 4.35.11 - need a help with
                                       Deliver Cleaned Messages after MS
                                       upgrade
             11/29/2004 05:36
             AM


             Please respond to
                MailScanner
               mailing list
             <MAILSCANNER@JISC
                MAIL.AC.UK>






Magda

what about the 'old' entries in the MailScanner.conf that do all the
message notication and any rules they call??

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Magda Hewryk wrote:
>  Martin,
>
> Here are some relevant or new entries in my MailScanner.conf file:
>
> Deliver Cleaned Messages = yes
> Max Normal Queue Size = 1000
> Maximum Attachments Per Message = 200
> Expand TNEF = yes
> Deliver Unparsable TNEF = no
> TNEF Expander = /usr/bin/tnef --maxsize=100000000
> TNEF Timeout = 120
> File Command = #/usr/bin/file
> File Timeout = 20
> Maximum Message Size = 0
> Maximum Attachment Size = -1
> Minimum Attachment Size = -1
> Maximum Archive Depth = 2
> Find Archives By Content = yes
>
>
> Stored Bad Content Message Report =
%report-dir%/stored.content.message.txt
> Stored Bad Filename Message Report =
> %report-dir%/stored.filename.message.txt  #mnh T122
> Stored Virus Message Report = %report-dir%/stored.virus.message.txt
> #mnh T122-mcafee
>
> Inline HTML Warning = %report-dir%/inline.warning.html
> #mnh T122
> Inline Text Warning = %report-dir%/inline.warning.txt
>
>
>
>
>              Magda Hewryk
>              <MHewryk@SYMCOR.C
>              OM>
To
>              Sent by:                  MAILSCANNER@JISCMAIL.AC.UK
>              MailScanner
cc
>              mailing list
>              <MAILSCANNER@JISC
Subject
>              MAIL.AC.UK>               Re: MS 4.35.11 - need a help with
>                                        Deliver Cleaned Messages after MS
>                                        upgrade
>              11/29/2004 05:19
>              AM
>
>
>              Please respond to
>                 MailScanner
>                mailing list
>              <MAILSCANNER@JISC
>                 MAIL.AC.UK>
>
>
>
>
>
>
> Hi  Martin,
>
> I have not changed any rules and the config file is almost the same.
After
> upgrade I've run upgrade_MailScanner_conf  command and then I differed
the
> new file with the existing .config.  Nothing is really changed except MCP
&
> Advanced setting which is new for 4.35.11.
>
> Rules are the same:
> to deny zip/gifs/jpegs and other attachments.
>
> I'm testing any attachments, and all attachments are quarantined
correctly,
> notification is sent to Postmaster correctly but the recipient gets
> nothing. Either notification nor original message with the stripped
> attachments is passed to recipient.
>
> Any thoughts?
>
> Magda
>
>
>
>
>
>
>
>              Martin Hepworth
>              <martinh@SOLID-ST
>              ATE-LOGIC.COM>
To
>              Sent by:                  MAILSCANNER@JISCMAIL.AC.UK
>              MailScanner
cc
>              mailing list
>              <MAILSCANNER@JISC
Subject
>              MAIL.AC.UK>               Re: MS 4.35.11 - need a help with
>                                        Deliver Cleaned Messages after MS
>                                        upgrade
>              11/29/2004 05:09
>              AM
>
>
>              Please respond to
>                 MailScanner
>                mailing list
>              <MAILSCANNER@JISC
>                 MAIL.AC.UK>
>
>
>
>
>
>
> Magda
>
> Ok, what are the relevent bits of the MailScanner.conf and any rules..
>
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Magda Hewryk wrote:
>
>>Hi Martin,
>>Thanks for getting back to me!
>>
>>I've upgraded MS:  version 4.31.6 to 4.35.11
>>OS:  Fedora 1
>>Download file:  MailScanner-4.35.11-1.rpm.tar.gzip
>>
>>I can't get the Notification to be sent to the user about the attachment
>>being stripped.
>>I've got the zip attachment in the quarantine directory but the message
>
> is
>
>>not forward to the user.  It is treated like a virus  (Still Deliver
>
> Silent
>
>>Viruses = no ).
>>I don't know why?  The postmaster however gets the message "Bad Filename
>>Detected".
>>
>>What is wrong that MS can't send the notification about the attachment
>>stripped to the user?
>>All work before the upgrade (last night).
>>
>>Nov 29 04:47:29  xxxxx MailScanner[24695]: Filename Checks: Possible
>>Microsoft Exchange Shortcut attack (iAT9lAUC026333 Copyofbb-lnxraid.zip)
>>Nov 29 04:47:29 xxxxx   MailScanner[24695]: Saved infected
>>"Copyofbb-lnxraid.zip" to
>>/var/spool/MailScanner/quarantine/20041129/iAT9lAUC026333
>>
>>Thanks,
>>
>>Magda Hewryk
>>--------------------------------
>>Mid-Range Systems
>>905-273-1637 (Office)
>>416-554-0743 (Cell)
>>
>>MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK> wrote on 11/29/2004
>>04:52:13 AM:
>>
>>
>>
>>>Magda
>>>
>>>where about's are you stuck. What have you tried and what's not
>>>happening. Also remind of the O/S and how you've installed MS - RPM or
>>>tar,gz version..
>>>
>>>
>>>--
>>>Martin Hepworth
>>>Snr Systems Administrator
>>>Solid State Logic
>>>Tel: +44 (0)1865 842300
>>>
>>>
>>>Magda Hewryk wrote:
>>>
>>>
>>>>Hi,
>>>>
>>>>I couldn't uninstall MS 4.35.11 and go back to my previous version
>>
>>4.31.6.
>>
>>
>>>>I'm stack here trying to get the report about the Bad File Name
>>
>>working.
>>
>>
>>>>For some reason it stopped working after the MS upgrade.
>>>>
>>>>The notification to the Postmaster work OK though.
>>>>
>>>>Any help,
>>>>Magda
>>>>
>>>>------------------------ MailScanner list ------------------------
>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>>'leave mailscanner' in the body of the email.
>>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>
>>>>Support MailScanner development - buy the book off the website!
>>>
>>>**********************************************************************
>>>
>>>This email and any files transmitted with it are confidential and
>>>intended solely for the use of the individual or entity to whom they
>>>are addressed. If you have received this email in error please notify
>>>the system manager.
>>>
>>>This footnote confirms that this email message has been swept
>>>for the presence of computer viruses and is believed to be clean.
>>>
>>>**********************************************************************
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dhawal at NETMAGICSOLUTIONS.COM  Mon Nov 29 10:47:45 2004
From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy)
Date: Thu Jan 12 21:27:43 2006
Subject: MS 4.35.11 - need a help with Deliver Cleaned Messages after
    MS upgrade
Message-ID: <mailman.5204.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Martin Hepworth wrote:
> Magda
>
> what about the 'old' entries in the MailScanner.conf that do all the
> message notication and any rules they call??
>
> --
> Martin Hepworth

I am facing the same problem with my setup, unfortunately I can't claim
that it's not working since I never tested it till sometime back.

I have the following in /etc/MailScanner/MailScanner.conf
Notify Senders = yes
Notify Senders Of Viruses = no
Notify Senders Of Blocked Filenames Or Filetypes = yes
Notify Senders Of Other Blocked Content = yes
Never Notify Senders Of Precedence = list bulk

I also have the following
Send Notices = yes
Notices Include Full Headers = yes
Hide Incoming Work Dir in Notices = no

The only relevant rule that I see is /etc/MailScanner/rules/bounce.rules
that contains..
FromOrTo:       default                 no

I tried sending myself an .exe file from a yahoo account.. but never got
a notification on the yahoo account, though I did get a Sys-admin
notification for "Bad Filename Detected"

Searched the mailscanner archives to find Julian asking someone to check
the reports, the report file
'/etc/MailScanner/reports/en/sender.filename.report.txt' seems fine as well

What am I doing wrong?

MailScanner -v output (postfix single instance)
Running on
Linux mx1.netmagicians.com 2.4.21-20.EL.c0smp #1 SMP Thu Sep 9 01:53:25
EDT 2004 i686 i686 i386 GNU/Linux
This is CentOS release 3.3 (final)
This is Perl version 5.008000 (5.8.0)

This is MailScanner version 4.35.11
Module versions are:
1.00    AnyDBM_File
1.14    Archive::Zip
1.01    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.04    Fcntl
2.71    File::Basename
2.05    File::Copy
2.01    FileHandle
1.05    File::Path
0.13    File::Temp
1.23    HTML::Entities
3.26    HTML::Parser
2.24    HTML::TokeParser
1.20    IO
1.09    IO::File
1.122   IO::Pipe
3.05    MIME::Base64
5.415   MIME::Decoder
5.415   MIME::Decoder::UU
5.415   MIME::Head
5.415   MIME::Parser
3.03    MIME::QuotedPrint
5.415   MIME::Tools
0.09    Net::CIDR
1.05    POSIX
1.75    Socket
0.03    Sys::Syslog
1.02    Time::localtime

Optional module versions are:
1.810   DB_File
1.08    Digest
1.01    Digest::HMAC
2.33    Digest::MD5
2.10    Digest::SHA1
0.44    Inline
0.11    Mail::ClamAV
3.000001        Mail::SpamAssassin
1.997   Mail::SPF::Query
0.15    Net::CIDR::Lite
0.48    Net::DNS
0.32    Net::LDAP
1.94    Parse::RecDescent
missing SAVI
1.2     Sys::Hostname::Long
2.26    Test::Harness
0.47    Test::Simple
1.89    Text::Balanced
1.19    URI

thanks,
- dhawal

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From MHewryk at SYMCOR.COM  Mon Nov 29 10:57:36 2004
From: MHewryk at SYMCOR.COM (Magda Hewryk)
Date: Thu Jan 12 21:27:43 2006
Subject: MS 4.35.11 - need a help with Deliver Cleaned Messages after
    MS upgrade
Message-ID: <mailman.5205.1137101263.24926.mailscanner@lists.mailscanner.info>

Hi Dhawal,
The sender part is something else I think.  The recipient is not getting an
email with the stripped attachment and she/he should.
Actually we blocked the notification to the sender for many reasons so I
can't be wrong about the sender report or the new bounce roule I guess.

Thanks,

Magda




             Dhawal Doshy
             <dhawal@NETMAGICS
             OLUTIONS.COM>                                              To
             Sent by:                  MAILSCANNER@JISCMAIL.AC.UK
             MailScanner                                                cc
             mailing list
             <MAILSCANNER@JISC                                     Subject
             MAIL.AC.UK>               Re: MS 4.35.11 - need a help with
                                       Deliver Cleaned Messages after MS
                                       upgrade
             11/29/2004 05:47
             AM


             Please respond to
                MailScanner
               mailing list
             <MAILSCANNER@JISC
                MAIL.AC.UK>






Martin Hepworth wrote:
> Magda
>
> what about the 'old' entries in the MailScanner.conf that do all the
> message notication and any rules they call??
>
> --
> Martin Hepworth

I am facing the same problem with my setup, unfortunately I can't claim
that it's not working since I never tested it till sometime back.

I have the following in /etc/MailScanner/MailScanner.conf
Notify Senders = yes
Notify Senders Of Viruses = no
Notify Senders Of Blocked Filenames Or Filetypes = yes
Notify Senders Of Other Blocked Content = yes
Never Notify Senders Of Precedence = list bulk

I also have the following
Send Notices = yes
Notices Include Full Headers = yes
Hide Incoming Work Dir in Notices = no

The only relevant rule that I see is /etc/MailScanner/rules/bounce.rules
that contains..
FromOrTo:       default                 no

I tried sending myself an .exe file from a yahoo account.. but never got
a notification on the yahoo account, though I did get a Sys-admin
notification for "Bad Filename Detected"

Searched the mailscanner archives to find Julian asking someone to check
the reports, the report file
'/etc/MailScanner/reports/en/sender.filename.report.txt' seems fine as well

What am I doing wrong?

MailScanner -v output (postfix single instance)
Running on
Linux mx1.netmagicians.com 2.4.21-20.EL.c0smp #1 SMP Thu Sep 9 01:53:25
EDT 2004 i686 i686 i386 GNU/Linux
This is CentOS release 3.3 (final)
This is Perl version 5.008000 (5.8.0)

This is MailScanner version 4.35.11
Module versions are:
1.00    AnyDBM_File
1.14    Archive::Zip
1.01    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.04    Fcntl
2.71    File::Basename
2.05    File::Copy
2.01    FileHandle
1.05    File::Path
0.13    File::Temp
1.23    HTML::Entities
3.26    HTML::Parser
2.24    HTML::TokeParser
1.20    IO
1.09    IO::File
1.122   IO::Pipe
3.05    MIME::Base64
5.415   MIME::Decoder
5.415   MIME::Decoder::UU
5.415   MIME::Head
5.415   MIME::Parser
3.03    MIME::QuotedPrint
5.415   MIME::Tools
0.09    Net::CIDR
1.05    POSIX
1.75    Socket
0.03    Sys::Syslog
1.02    Time::localtime

Optional module versions are:
1.810   DB_File
1.08    Digest
1.01    Digest::HMAC
2.33    Digest::MD5
2.10    Digest::SHA1
0.44    Inline
0.11    Mail::ClamAV
3.000001        Mail::SpamAssassin
1.997   Mail::SPF::Query
0.15    Net::CIDR::Lite
0.48    Net::DNS
0.32    Net::LDAP
1.94    Parse::RecDescent
missing SAVI
1.2     Sys::Hostname::Long
2.26    Test::Harness
0.47    Test::Simple
1.89    Text::Balanced
1.19    URI

thanks,
- dhawal

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From MHewryk at SYMCOR.COM  Mon Nov 29 11:16:19 2004
From: MHewryk at SYMCOR.COM (Magda Hewryk)
Date: Thu Jan 12 21:27:43 2006
Subject: A recipient is not getting the original email & report  after the
    incoming attachment is stripped and quarantined   - MS 4.35.11
Message-ID: <mailman.5206.1137101263.24926.mailscanner@lists.mailscanner.info>

Hi,
I need a help to figure out why the recipient is not getting the original
email and the report after the bad attachment has been stripped out.
This is not an infected email by virus.  This is a bad file name email.
The Postmaster however gets the notification with the "Bad Filename
Detected" in the subject line.

Thanks,

Magda

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dmehler26 at woh.rr.com  Mon Nov 29 12:44:11 2004
From: dmehler26 at woh.rr.com (dave)
Date: Thu Jan 12 21:27:43 2006
Subject: mailscanner and razor logfile hashed directories
Message-ID: <mailman.5207.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi,
    Thanks, i added a razor directory with a razor-agent.conf file in it,
still no go. I think your right, it's just a matter of putting the file in
the right place within the postfix chroot.
Thanks.
Dave.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dmehler26 at woh.rr.com  Mon Nov 29 13:23:40 2004
From: dmehler26 at woh.rr.com (dave)
Date: Thu Jan 12 21:27:43 2006
Subject: solved was Re: mailscanner and razor logfile hashed directories
Message-ID: <mailman.5208.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi,
    Ok just fixed it. If you've got postfix going chroot and a single queue
setup using header_checks copy /root/.razor to /var/spool/postfix that does
it.
HTH someone.
Dave.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From d.santos at barcelohotels.com.do  Mon Nov 29 13:45:31 2004
From: d.santos at barcelohotels.com.do (Dywer Santos)
Date: Thu Jan 12 21:27:44 2006
Subject: spam check exception
Message-ID: <mailman.5209.1137101263.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi all.

Im trying to make an exception in the spam checking. I need to allow some
users to have all their email to be bypassed from spam checking. I see in
the MailScanner.conf that you can have a file ruleset and specify as

# Spam Whitelist:
# Make this point to a ruleset, and anything in that ruleset whose value
# is "yes" will *never* be marked as spam.
# This can also be the filename of a ruleset.
#Is Definitely Not Spam = no
Is Definitely Not Spam = %rules-dir%/spam.whitelist.rules

In this file (spam.whitelist.rules) I made the following entries but it is
not working.

# This is where you can build a Spam WhiteList
# Addresses matching in here, with the value
# "yes" will never be marked as spam.
#From:          152.78.         yes
#From:          130.246.        yes

To              someone@somedomain.com.               yes
FromOrTo:       default                                         no


Any help will be appreciated.

Dywer Santos

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Mon Nov 29 13:56:16 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:44 2006
Subject: spam check exception
Message-ID: <mailman.5210.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Why the extra dot on the end of
    someone@somedomain.com.
? Lose the extra dot and it should work okay.
You need to reload MailScanner ("service MailScanner reload" or HUP the
MailScanner process group) to force it to re-read its configuration.

Dywer Santos wrote:

>Hi all.
>
>Im trying to make an exception in the spam checking. I need to allow some
>users to have all their email to be bypassed from spam checking. I see in
>the MailScanner.conf that you can have a file ruleset and specify as
>
># Spam Whitelist:
># Make this point to a ruleset, and anything in that ruleset whose value
># is "yes" will *never* be marked as spam.
># This can also be the filename of a ruleset.
>#Is Definitely Not Spam = no
>Is Definitely Not Spam = %rules-dir%/spam.whitelist.rules
>
>In this file (spam.whitelist.rules) I made the following entries but it is
>not working.
>
># This is where you can build a Spam WhiteList
># Addresses matching in here, with the value
># "yes" will never be marked as spam.
>#From:          152.78.         yes
>#From:          130.246.        yes
>
>To              someone@somedomain.com.               yes
>FromOrTo:       default                                         no
>
>
>Any help will be appreciated.
>
>Dywer Santos
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From MHewryk at SYMCOR.COM  Mon Nov 29 14:00:36 2004
From: MHewryk at SYMCOR.COM (Magda Hewryk)
Date: Thu Jan 12 21:27:44 2006
Subject: 4.35.11 and the mail notification
Message-ID: <mailman.5211.1137101264.24926.mailscanner@lists.mailscanner.info>

Any help on 4.35.11 and the mail notification?
I'm getting the attachments removed correctly but the original email nor
the report is send to the recipient.

Thanks,

Magda

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From marcel-ml at IRC-ADDICTS.DE  Mon Nov 29 14:06:24 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:44 2006
Subject: New release of Vispan
Message-ID: <mailman.5212.1137101264.24926.mailscanner@lists.mailscanner.info>

Hi and sorry for my late Answer..

and please check my question below everything ;)

Thanks in advance

> The reason AntiVir doesn't appear in the config page is that it isn't
> configured to do so. I only have access to a limited number of virus
> scanners. If you can provide me with the command line option to print
> out the version information (usually -v or -info) and what it actually
> prints - I will add in the support.
>
ok..

here we go:

First the Version-Info

The Command seems to be

antivir --version

The output is as follows:

marcel@marcel:~> antivir --version
6.28.0.19
operating system: Linux (glibc 2.0)
product version:  2.1.2-15
engine version:   6.28.0.19
packlib version:  2.0.3.17 (supports 24 formats)
vdf version:      6.28.0.95

product:          AntiVir Workstation
key file:         hbedv.key
registered user:  Marcel Blenkers, Berlin
serial number:    1001061079
key expires:      31 Mar 2005
run mode:         PERSONAL

product:          AntiVir MailGate
key file:         hbedv.key
registered user:  Marcel Blenkers, Berlin
serial number:    1001061079
key expires:      31 Mar 2005
run mode:         PERSONAL

product:          AntiVir (command line scanner)
key file:         hbedv.key
registered user:  Marcel Blenkers, Berlin
serial number:    1001061079
key expires:      31 Mar 2005
run mode:         PERSONAL



Now the Logfile-Entry for the Virus called TR/Pish.Telekom.A




Nov 29 14:59:45 marcel sendmail[17691]: iATDxiEK017689:
to=<marcel@aqua-europe.c
om>, delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=120358,
relay=localhost.
netfinish.de. [127.0.0.1], dsn=2.0.0, stat=Sent (iATDxiV3017692 Message
accepted
 for delivery)
Nov 29 14:59:47 marcel MailScanner[14419]: New Batch: Scanning 1 messages,
4314
bytes
Nov 29 14:59:47 marcel MailScanner[14419]: Spam Checks: Starting
Nov 29 14:59:57 marcel MailScanner[14419]: Virus and Content Scanning:
Starting
Nov 29 14:59:59 marcel MailScanner[14419]: ALERT: [TR/Pish.Telekom.A
virus] ./iATDxiV3017692/Viren.zip --> dfiAFJ8M9V013462 <<< The Trojan
horse TR/Pish.Telekom.A
Nov 29 14:59:59 marcel MailScanner[14419]: ALERT: [TR/Pish.Telekom.A
virus] ./iATDxiV3017692/Viren.zip --> msg-10870-14.txt <<< The Trojan
horse TR/Pish.Telekom.A
Nov 29 14:59:59 marcel MailScanner[14419]: ALERT: [TR/Pish.Telekom.A
virus] ./iATDxiV3017692/dfiAFJ8M9V013462 <<< The Trojan horse
TR/Pish.Telekom.A
Nov 29 14:59:59 marcel MailScanner[14419]: ALERT: [TR/Pish.Telekom.A
virus] ./iATDxiV3017692/msg-10870-14.txt <<< The Trojan horse
TR/Pish.Telekom.A
Nov 29 14:59:59 marcel MailScanner[14419]: Virus Scanning: AntiVir found 4
infections
Nov 29 15:00:01 marcel MailScanner[14419]: Infected message iATDxiV3017692
came from 127.0.0.1
Nov 29 15:00:01 marcel MailScanner[14419]: Saved entire message to
/var/spool/MailScanner/quarantine/20041129/iATDxiV3017692
Nov 29 15:00:01 marcel MailScanner[14419]: Saved infected
"msg-10870-14.txt" to
/var/spool/MailScanner/quarantine/20041129/iATDxiV3017692
Nov 29 15:00:01 marcel MailScanner[14419]: Saved infected
"dfiAFJ8M9V013462" to
/var/spool/MailScanner/quarantine/20041129/iATDxiV3017692
Nov 29 15:00:01 marcel MailScanner[14419]: Saved infected "Viren.zip" to
/var/spool/MailScanner/quarantine/20041129/iATDxiV3017692
Nov 29 15:00:02 marcel MailScanner[14419]: Silent: Delivered 1 messages
containing silent viruses

Now some other Question

On the Index.html created with vispan and the cronjob there is the
table called

Top Viruses

is this table only for the current day or for all viruses found together?

as this table is empty again :(

To see the current Vispan on my site check

http://www.irc-addicts.de/vispan/

maybe i missconfigured something..

Thanks in advance and i hope i was of some help

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From MHewryk at SYMCOR.COM  Mon Nov 29 14:06:37 2004
From: MHewryk at SYMCOR.COM (Magda Hewryk)
Date: Thu Jan 12 21:27:44 2006
Subject: Sudden problem with MailScanner 4.36.1
Message-ID: <mailman.5213.1137101264.24926.mailscanner@lists.mailscanner.info>

Yes, I'm getting the same error on 4.36.1 but I know why ...

I've installed 4.35.11 and had to uninstall it.  I've removed
MailScanner.rpm (rpm -e - -nodeps) and I re-installed the old  4.36.1
again.
That was not a good idea ..  .  I'm getting  the parse messages and the
postmaster gets the message that "Report: Could not analyze message"


Nov 29 08:16:04 xxx  MailScanner[26140]: Cannot parse
/var/spool/MailScanner/incoming/26140/iATDFocq026169.header and , Can't
locate object method "init" via package "MIME::Decoder::QuotedPrint" at
/usr/lib/perl5/site_perl/5.8.3/MIME/Decoder.pm line 179.


Thanks,

Magda Hewryk
--------------------------------
Mid-Range Systems
905-273-1637 (Office)
416-554-0743 (Cell)



             "Stanier, Alan M"
             <alan@ESSEX.AC.UK
             >                                                          To
             Sent by:                  MAILSCANNER@JISCMAIL.AC.UK
             MailScanner                                                cc
             mailing list
             <MAILSCANNER@JISC                                     Subject
             MAIL.AC.UK>               Sudden problem with MailScanner
                                       4.36.1

             11/29/2004 05:27
             AM


             Please respond to
                MailScanner
               mailing list
             <MAILSCANNER@JISC
                MAIL.AC.UK>






Hi

We are running MailScanner 4.36.1 on three SMTP servers. At 08:50 today,
one server stopped delievering mail, logging messages like:-

Cannot parse
/var/spool/MailScanner/incoming/29863/1CYiZb-0000Xg-LK.header and ,
write-open
/var/spool/MailScanner/incoming/29863/1CYiZb-0000Xg-LK/msg-29863-4.txt:
No such file or directory at /usr/share/perl5/MIME/Body.pm line 414,
<_GEN_3> line 1159.

Nothing obvious happened to trigger the fault, there is no evidence of
disk problems, lots of freespace on the disks. Everything seems the same
on the machine that is failing as on those that are working.

Does anyone have any idea where I should be looking for the problem?

Thanks

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From MHewryk at SYMCOR.COM  Mon Nov 29 14:19:21 2004
From: MHewryk at SYMCOR.COM (Magda Hewryk)
Date: Thu Jan 12 21:27:44 2006
Subject: What next:  v.4.35.11 removed (rolled  back) and v. 4.31.6 give
    parse errors
Message-ID: <mailman.5214.1137101264.24926.mailscanner@lists.mailscanner.info>

 Hi ,

Because I couldn't get the message to be delivered once its been cleaned of
the bad attachments for v. 4.35.11 I've reinstalled MS.
I've rpm -e - - nodeps mailscannerxx.rpm and I've reinstall v. 4.31.6
(instal.sh) on Fedora 1.

I'm getting perl error that it can't analyze the report, I don't know what
would be the fix instead of re-installing from scrach?

Nov 29 08:16:04 xxx MailScanner[26140]: Cannot parse
/var/spool/MailScanner/incoming/26140/iATDFocq026169.header and , Can't
locate object method "init" via package "MIME::Decoder::QuotedPrint" at
/usr/lib/perl5/site_perl/5.8.3/MIME/Decoder.pm line 179.
* mailgw02 * /var/log/ #root#

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ugob at CAMO-ROUTE.COM  Mon Nov 29 14:45:45 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:44 2006
Subject: A recipient is not getting the original email & report  after
    the incoming attachment is stripped and quarantined   - MS 4.35.11
Message-ID: <mailman.5215.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Magda Hewryk wrote:
> Hi,
> I need a help to figure out why the recipient is not getting the original
> email and the report after the bad attachment has been stripped out.
> This is not an infected email by virus.  This is a bad file name email.
> The Postmaster however gets the notification with the "Bad Filename
> Detected" in the subject line.

Any errors in your logs?


>
> Thanks,
>
> Magda
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ugob at CAMO-ROUTE.COM  Mon Nov 29 14:47:38 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:44 2006
Subject: Looked up unknown string archivetoodeep in language
    translation file ?
Message-ID: <mailman.5216.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Mario Bittencourt wrote:
> Hi,
>
> My log file keeps showing lines like this
>
> Looked up unknown string archivetoodeep in language translation file
> /etc/MailScanner/reports/pt_br/languages.conf

Look for a language.conf.rpmnew file...  if there is one, copy it over
language.conf

>
> Any ideas ?
>
> - mb
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Mon Nov 29 15:06:40 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:44 2006
Subject: Sudden problem with MailScanner 4.36.1
Message-ID: <mailman.5217.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Did you run the ./install.sh script to install 4.36.1? If not, you
should have done.

Magda Hewryk wrote:

>Yes, I'm getting the same error on 4.36.1 but I know why ...
>
>I've installed 4.35.11 and had to uninstall it.  I've removed
>MailScanner.rpm (rpm -e - -nodeps) and I re-installed the old  4.36.1
>again.
>That was not a good idea ..  .  I'm getting  the parse messages and the
>postmaster gets the message that "Report: Could not analyze message"
>
>
>Nov 29 08:16:04 xxx  MailScanner[26140]: Cannot parse
>/var/spool/MailScanner/incoming/26140/iATDFocq026169.header and , Can't
>locate object method "init" via package "MIME::Decoder::QuotedPrint" at
>/usr/lib/perl5/site_perl/5.8.3/MIME/Decoder.pm line 179.
>
>
>Thanks,
>
>Magda Hewryk
>--------------------------------
>Mid-Range Systems
>905-273-1637 (Office)
>416-554-0743 (Cell)
>
>
>
>             "Stanier, Alan M"
>             <alan@ESSEX.AC.UK
>             >                                                          To
>             Sent by:                  MAILSCANNER@JISCMAIL.AC.UK
>             MailScanner                                                cc
>             mailing list
>             <MAILSCANNER@JISC                                     Subject
>             MAIL.AC.UK>               Sudden problem with MailScanner
>                                       4.36.1
>
>             11/29/2004 05:27
>             AM
>
>
>             Please respond to
>                MailScanner
>               mailing list
>             <MAILSCANNER@JISC
>                MAIL.AC.UK>
>
>
>
>
>
>
>Hi
>
>We are running MailScanner 4.36.1 on three SMTP servers. At 08:50 today,
>one server stopped delievering mail, logging messages like:-
>
>Cannot parse
>/var/spool/MailScanner/incoming/29863/1CYiZb-0000Xg-LK.header and ,
>write-open
>/var/spool/MailScanner/incoming/29863/1CYiZb-0000Xg-LK/msg-29863-4.txt:
>No such file or directory at /usr/share/perl5/MIME/Body.pm line 414,
><_GEN_3> line 1159.
>
>Nothing obvious happened to trigger the fault, there is no evidence of
>disk problems, lots of freespace on the disks. Everything seems the same
>on the machine that is failing as on those that are working.
>
>Does anyone have any idea where I should be looking for the problem?
>
>Thanks
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From MHewryk at SYMCOR.COM  Mon Nov 29 15:07:06 2004
From: MHewryk at SYMCOR.COM (Magda Hewryk)
Date: Thu Jan 12 21:27:44 2006
Subject: A recipient is not getting the original email & report  after
    the incoming attachment is stripped and quarantined   - MS 4.35.11
Message-ID: <mailman.5218.1137101264.24926.mailscanner@lists.mailscanner.info>

No errors at all.  All is clean.
The message is never delivered to the recipient once its attachment is
quarantined.  It acts like Still Deliver Silent Viruses but this is about
bad file name (the attachment), not about a virus.
Besides, the postmaster gets a proper notification with "Bad Filename
Detected" subject line.

Thanks,

Magda



             Ugo Bellavance
             <ugob@CAMO-ROUTE.
             COM>                                                       To
             Sent by:                  MAILSCANNER@JISCMAIL.AC.UK
             MailScanner                                                cc
             mailing list
             <MAILSCANNER@JISC                                     Subject
             MAIL.AC.UK>               Re: A recipient is not getting the
                                       original email & report  after the
                                       incoming attachment is stripped and
             11/29/2004 09:45          quarantined   - MS 4.35.11
             AM


             Please respond to
                MailScanner
               mailing list
             <MAILSCANNER@JISC
                MAIL.AC.UK>






Magda Hewryk wrote:
> Hi,
> I need a help to figure out why the recipient is not getting the original
> email and the report after the bad attachment has been stripped out.
> This is not an infected email by virus.  This is a bad file name email.
> The Postmaster however gets the notification with the "Bad Filename
> Detected" in the subject line.

Any errors in your logs?


>
> Thanks,
>
> Magda
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From d.santos at barcelohotels.com.do  Mon Nov 29 15:13:27 2004
From: d.santos at barcelohotels.com.do (Dywer Santos)
Date: Thu Jan 12 21:27:44 2006
Subject: spam check exception
Message-ID: <mailman.5219.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Sorry, it was a mistake when I was writting the e-mail.  Actualy, it does
not have it at the end. But it is not working.



-----Mensaje original-----
De: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]En
nombre de Julian Field
Enviado el: Monday, November 29, 2004 9:56 AM
Para: MAILSCANNER@JISCMAIL.AC.UK
Asunto: Re: spam check exception


Why the extra dot on the end of
    someone@somedomain.com.
? Lose the extra dot and it should work okay.
You need to reload MailScanner ("service MailScanner reload" or HUP the
MailScanner process group) to force it to re-read its configuration.

Dywer Santos wrote:

>Hi all.
>
>Im trying to make an exception in the spam checking. I need to allow some
>users to have all their email to be bypassed from spam checking. I see in
>the MailScanner.conf that you can have a file ruleset and specify as
>
># Spam Whitelist:
># Make this point to a ruleset, and anything in that ruleset whose value
># is "yes" will *never* be marked as spam.
># This can also be the filename of a ruleset.
>#Is Definitely Not Spam = no
>Is Definitely Not Spam = %rules-dir%/spam.whitelist.rules
>
>In this file (spam.whitelist.rules) I made the following entries but it is
>not working.
>
># This is where you can build a Spam WhiteList
># Addresses matching in here, with the value
># "yes" will never be marked as spam.
>#From:          152.78.         yes
>#From:          130.246.        yes
>
>To              someone@somedomain.com.               yes
>FromOrTo:       default                                         no
>
>
>Any help will be appreciated.
>
>Dywer Santos
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Mon Nov 29 15:13:38 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:44 2006
Subject: IRC support
Message-ID: <mailman.5220.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I have just installed a browser-based IRC client so you can get onto the
#mailscanner channel without needing any software on your
PC/Mac/whatever, just a Java-capable web browser.

Go to
    www.mailscanner.info/irc
and get straight on.

Please note this is an unofficial support channel, but there are usually
a few knowledgeable people on there.

If you would rather use your own IRC client, then it's #mailscanner at
irc.freenode.net.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Mon Nov 29 15:16:11 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:44 2006
Subject: spam check exception
Message-ID: <mailman.5221.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

In which case, look for "Envelope" in MailScanner.conf and set the
option to add the real recipient address, which may not be the same as
the header's To: address. That's the most likely cause of what is going
wrong.

Dywer Santos wrote:

>Sorry, it was a mistake when I was writting the e-mail.  Actualy, it does
>not have it at the end. But it is not working.
>
>
>
>-----Mensaje original-----
>De: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]En
>nombre de Julian Field
>Enviado el: Monday, November 29, 2004 9:56 AM
>Para: MAILSCANNER@JISCMAIL.AC.UK
>Asunto: Re: spam check exception
>
>
>Why the extra dot on the end of
>    someone@somedomain.com.
>? Lose the extra dot and it should work okay.
>You need to reload MailScanner ("service MailScanner reload" or HUP the
>MailScanner process group) to force it to re-read its configuration.
>
>Dywer Santos wrote:
>
>
>
>>Hi all.
>>
>>Im trying to make an exception in the spam checking. I need to allow some
>>users to have all their email to be bypassed from spam checking. I see in
>>the MailScanner.conf that you can have a file ruleset and specify as
>>
>># Spam Whitelist:
>># Make this point to a ruleset, and anything in that ruleset whose value
>># is "yes" will *never* be marked as spam.
>># This can also be the filename of a ruleset.
>>#Is Definitely Not Spam = no
>>Is Definitely Not Spam = %rules-dir%/spam.whitelist.rules
>>
>>In this file (spam.whitelist.rules) I made the following entries but it is
>>not working.
>>
>># This is where you can build a Spam WhiteList
>># Addresses matching in here, with the value
>># "yes" will never be marked as spam.
>>#From:          152.78.         yes
>>#From:          130.246.        yes
>>
>>To              someone@somedomain.com.               yes
>>FromOrTo:       default                                         no
>>
>>
>>Any help will be appreciated.
>>
>>Dywer Santos
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>
>>
>>
>>
>
>--
>Julian Field
>www.MailScanner.info
>Buy the MailScanner book at www.MailScanner.info/store
>Professional Support Services at www.MailScanner.biz
>MailScanner thanks transtec Computers for their support
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From MHewryk at SYMCOR.COM  Mon Nov 29 15:17:22 2004
From: MHewryk at SYMCOR.COM (Magda Hewryk)
Date: Thu Jan 12 21:27:44 2006
Subject: Sudden problem with MailScanner 4.31.6
Message-ID: <mailman.5222.1137101264.24926.mailscanner@lists.mailscanner.info>

Sure, I've done it.  But first I installed v. 4.35.11, than removed it's
rmp and then re-install v. 4.31.6 (./install.sh).


Julian,
If you can help me with the message not being sent to the recipient after
its attachments is removed and quarantined on v. 4.35.11 I would not worry
about the v. 4.31.6 errors.
Basically after  the upgrade from v. 4.31.6 to v. 4.35.11 all looks OK but
the messages is never delivered to the recipient once its attachments is
quarantined.
All worked before.


Thanks,

Magda



             Julian Field
             <mailscanner@ECS.
             SOTON.AC.UK>                                               To
             Sent by:                  MAILSCANNER@JISCMAIL.AC.UK
             MailScanner                                                cc
             mailing list
             <MAILSCANNER@JISC                                     Subject
             MAIL.AC.UK>               Re: Sudden problem with MailScanner
                                       4.36.1

             11/29/2004 10:06
             AM


             Please respond to
                MailScanner
               mailing list
             <MAILSCANNER@JISC
                MAIL.AC.UK>






Did you run the ./install.sh script to install 4.36.1? If not, you
should have done.

Magda Hewryk wrote:

>Yes, I'm getting the same error on 4.36.1 but I know why ...
>
>I've installed 4.35.11 and had to uninstall it.  I've removed
>MailScanner.rpm (rpm -e - -nodeps) and I re-installed the old  4.36.1
>again.
>That was not a good idea ..  .  I'm getting  the parse messages and the
>postmaster gets the message that "Report: Could not analyze message"
>
>
>Nov 29 08:16:04 xxx  MailScanner[26140]: Cannot parse
>/var/spool/MailScanner/incoming/26140/iATDFocq026169.header and , Can't
>locate object method "init" via package "MIME::Decoder::QuotedPrint" at
>/usr/lib/perl5/site_perl/5.8.3/MIME/Decoder.pm line 179.
>
>
>Thanks,
>
>Magda Hewryk
>--------------------------------
>Mid-Range Systems
>905-273-1637 (Office)
>416-554-0743 (Cell)
>
>
>
>             "Stanier, Alan M"
>             <alan@ESSEX.AC.UK
>             >                                                          To
>             Sent by:                  MAILSCANNER@JISCMAIL.AC.UK
>             MailScanner                                                cc
>             mailing list
>             <MAILSCANNER@JISC                                     Subject
>             MAIL.AC.UK>               Sudden problem with MailScanner
>                                       4.36.1
>
>             11/29/2004 05:27
>             AM
>
>
>             Please respond to
>                MailScanner
>               mailing list
>             <MAILSCANNER@JISC
>                MAIL.AC.UK>
>
>
>
>
>
>
>Hi
>
>We are running MailScanner 4.36.1 on three SMTP servers. At 08:50 today,
>one server stopped delievering mail, logging messages like:-
>
>Cannot parse
>/var/spool/MailScanner/incoming/29863/1CYiZb-0000Xg-LK.header and ,
>write-open
>/var/spool/MailScanner/incoming/29863/1CYiZb-0000Xg-LK/msg-29863-4.txt:
>No such file or directory at /usr/share/perl5/MIME/Body.pm line 414,
><_GEN_3> line 1159.
>
>Nothing obvious happened to trigger the fault, there is no evidence of
>disk problems, lots of freespace on the disks. Everything seems the same
>on the machine that is failing as on those that are working.
>
>Does anyone have any idea where I should be looking for the problem?
>
>Thanks
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From MHewryk at SYMCOR.COM  Mon Nov 29 15:25:19 2004
From: MHewryk at SYMCOR.COM (Magda Hewryk)
Date: Thu Jan 12 21:27:44 2006
Subject: IRC support
Message-ID: <mailman.5223.1137101264.24926.mailscanner@lists.mailscanner.info>

Sorry, I can't connect .

Thanks,

Magda



             Julian Field
             <mailscanner@ECS.
             SOTON.AC.UK>                                               To
             Sent by:                  MAILSCANNER@JISCMAIL.AC.UK
             MailScanner                                                cc
             mailing list
             <MAILSCANNER@JISC                                     Subject
             MAIL.AC.UK>               IRC support


             11/29/2004 10:13
             AM


             Please respond to
                MailScanner
               mailing list
             <MAILSCANNER@JISC
                MAIL.AC.UK>






I have just installed a browser-based IRC client so you can get onto the
#mailscanner channel without needing any software on your
PC/Mac/whatever, just a Java-capable web browser.

Go to
    www.mailscanner.info/irc
and get straight on.

Please note this is an unofficial support channel, but there are usually
a few knowledgeable people on there.

If you would rather use your own IRC client, then it's #mailscanner at
irc.freenode.net.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From billy at PLANETGEEK.BIZ  Mon Nov 29 15:36:38 2004
From: billy at PLANETGEEK.BIZ (Billy Pumphrey)
Date: Thu Jan 12 21:27:44 2006
Subject: IRC support
Message-ID: <mailman.5224.1137101264.24926.mailscanner@lists.mailscanner.info>

I was able to connect to it :)

-----Original Message-----
From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK]
Sent: Monday, November 29, 2004 10:14 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: IRC support

I have just installed a browser-based IRC client so you can get onto the
#mailscanner channel without needing any software on your
PC/Mac/whatever, just a Java-capable web browser.

Go to
    www.mailscanner.info/irc
and get straight on.

Please note this is an unofficial support channel, but there are usually
a few knowledgeable people on there.

If you would rather use your own IRC client, then it's #mailscanner at
irc.freenode.net.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Glenn.Steen at AP1.SE  Mon Nov 29 16:32:40 2004
From: Glenn.Steen at AP1.SE (Steen, Glenn)
Date: Thu Jan 12 21:27:44 2006
Subject: Postfix, mailwatch and queue IDs (and  of course mailscanner:-)
Message-ID: <mailman.5225.1137101264.24926.mailscanner@lists.mailscanner.info>

Hi Julian (& all:),

I decommissioned the old server on friday, so now I've got a more
"normal" server setup... Meaning I should see a lot less of the
duplicates that was bothering me. To be completely sure I'll never see
any, I'll continue to use the patch (still rock solid) on the "new"
server.

Final count shows that during the week it was in effect on the
"slightly missconfigured" server it protected me from 141 new
duplicates (in 8941 messages... Yeah, things have been pretty slow,
especially since we've started blocking the worst offenders at the
firewall:-).

Many thanks.

Perhaps time for others to enjoy it too?

-- Glenn

> -----Original Message-----
> From: MailScanner mailing list 
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Steen, Glenn
> Sent: den 22 november 2004 17:40
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Postfix, mailwatch and queue IDs (and of course 
> mailscanner:-)
> 
(snip)
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Julian Field
> Sent: den 18 november 2004 22:58
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Postfix, mailwatch and queue IDs (and of course
> mailscanner:-)
> 
> 
> Steen, Glenn wrote:
> 
(snip)
> >Should perhaps go into the beta? I can see no real drawbacks with it.
> >
> >
> Let's leave it running for a few days first. If it behaves 
> itself (which
> it should) then it will go in the main distribution, as it is A Good
> Thing(tm). As you say it is transparent to MailWatch, then if it works
> at all it should be fine.
> 
> --
> Julian Field
(snip)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From sw at INTERNETX.DE  Mon Nov 29 16:49:51 2004
From: sw at INTERNETX.DE (Sebastian Wiesinger)
Date: Thu Jan 12 21:27:44 2006
Subject: Problem Wit Silent Viruses: All-Viruses
Message-ID: <mailman.5226.1137101264.24926.mailscanner@lists.mailscanner.info>

Hi,

If I use All-Viruses for the Silent setting I also get no reports for
Blocked Filenames/Filetypes. Is there a way to just report *real*
viruses as silent?

Regards,

Sebastian

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mbowman at UDCOM.COM  Mon Nov 29 17:44:17 2004
From: mbowman at UDCOM.COM (Matthew Bowman)
Date: Thu Jan 12 21:27:44 2006
Subject: Help! - MailScanner ceased working (not fixed)
Message-ID: <mailman.5227.1137101264.24926.mailscanner@lists.mailscanner.info>

Hello,

Without SA or Virus Scanners on all the debug I get is

In Debugging mode, not forking...

From jstuart at EDENPR.K12.MN.US  Mon Nov 29 16:53:27 2004
From: jstuart at EDENPR.K12.MN.US (Joe Stuart)
Date: Thu Jan 12 21:27:44 2006
Subject: upgrade
Message-ID: <mailman.5229.1137101264.24926.mailscanner@lists.mailscanner.info>

After upgrading to mailscanner-4.34.8-4 I noticed after looking at some
mail headers my server is no longer using bayes.  I've tried putting
use_bayes 1 in spam.assassin.prefs.conf, but nothing changed and after
that I do not know what else to try. Any help is appreciated.

Thanks

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From nmeverde at NP.K12.MN.US  Mon Nov 29 17:15:22 2004
From: nmeverde at NP.K12.MN.US (Nick Meverden)
Date: Thu Jan 12 21:27:44 2006
Subject: upgrade
Message-ID: <mailman.5230.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> After upgrading to mailscanner-4.34.8-4 I noticed after looking at some
> mail headers my server is no longer using bayes.  I've tried putting
> use_bayes 1 in spam.assassin.prefs.conf, but nothing changed and after
> that I do not know what else to try. Any help is appreciated.

check the permissions on the bayes_* files to make sure that the pid owner
of MailScanner has access to them.

  - Nick

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From G.Pentland at SOTON.AC.UK  Mon Nov 29 17:15:13 2004
From: G.Pentland at SOTON.AC.UK (Pentland G.)
Date: Thu Jan 12 21:27:44 2006
Subject: Perl Modules versions - useful info
Message-ID: <mailman.5231.1137101264.24926.mailscanner@lists.mailscanner.info>

All,

I've been trying to remember for a while the easy way to see what perl
modules you have installed...

If you don't already know this is how

#!/usr/bin/perl

use ExtUtils::Installed;

my $inst = ExtUtils::Installed->new();
my @modules = $inst->modules();

foreach (@modules) {
  my $version = $inst->version($_);
  print "$_ $version\n";
}

gives...

Archive::Zip 1.10
Compress::Zlib 1.33
Convert::BinHex 1.119 
Convert::TNEF 0.17
DBD::Oracle 1.16
DBI 1.46
DB_File 1.810
Digest 1.00
Digest::HMAC 1.01
Digest::SHA1 2.10
File::Spec 0.83
File::Temp 0.13
HTML::Parser 3.26
HTML::Tagset 3.03
IO-stringy 
MIME-tools 
MIME::Base64 2.12
Mail 
Mail::SPF::Query 1.997
Mail::SpamAssassin 3.000000
Net::CIDR 0.09
Net::CIDR::Lite 0.15
Net::DNS 0.47
Perl 5.8.0
Pod::Parser 1.13
Sys::Hostname::Long 1.2

on one of my servers

Gary

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Mon Nov 29 17:35:13 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:44 2006
Subject: Problem Wit Silent Viruses: All-Viruses
Message-ID: <mailman.5232.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Please see the thread "Sudden problem with MailScanner 4.31.6".

Sebastian Wiesinger wrote:

>Hi,
>
>If I use All-Viruses for the Silent setting I also get no reports for
>Blocked Filenames/Filetypes. Is there a way to just report *real*
>viruses as silent?
>
>
>
--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Mon Nov 29 17:34:31 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:44 2006
Subject: Sudden problem with MailScanner 4.31.6
Message-ID: <mailman.5233.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Please try the attached Message.pm file.

Magda Hewryk wrote:

>Sure, I've done it.  But first I installed v. 4.35.11, than removed it's
>rmp and then re-install v. 4.31.6 (./install.sh).
>
>
>Julian,
>If you can help me with the message not being sent to the recipient after
>its attachments is removed and quarantined on v. 4.35.11 I would not worry
>about the v. 4.31.6 errors.
>Basically after  the upgrade from v. 4.31.6 to v. 4.35.11 all looks OK but
>the messages is never delivered to the recipient once its attachments is
>quarantined.
>All worked before.
>
>
>Thanks,
>
>Magda
>
>
>
>             Julian Field
>             <mailscanner@ECS.
>             SOTON.AC.UK>                                               To
>             Sent by:                  MAILSCANNER@JISCMAIL.AC.UK
>             MailScanner                                                cc
>             mailing list
>             <MAILSCANNER@JISC                                     Subject
>             MAIL.AC.UK>               Re: Sudden problem with MailScanner
>                                       4.36.1
>
>             11/29/2004 10:06
>             AM
>
>
>             Please respond to
>                MailScanner
>               mailing list
>             <MAILSCANNER@JISC
>                MAIL.AC.UK>
>
>
>
>
>
>
>Did you run the ./install.sh script to install 4.36.1? If not, you
>should have done.
>
>Magda Hewryk wrote:
>
>
>
>>Yes, I'm getting the same error on 4.36.1 but I know why ...
>>
>>I've installed 4.35.11 and had to uninstall it.  I've removed
>>MailScanner.rpm (rpm -e - -nodeps) and I re-installed the old  4.36.1
>>again.
>>That was not a good idea ..  .  I'm getting  the parse messages and the
>>postmaster gets the message that "Report: Could not analyze message"
>>
>>
>>Nov 29 08:16:04 xxx  MailScanner[26140]: Cannot parse
>>/var/spool/MailScanner/incoming/26140/iATDFocq026169.header and , Can't
>>locate object method "init" via package "MIME::Decoder::QuotedPrint" at
>>/usr/lib/perl5/site_perl/5.8.3/MIME/Decoder.pm line 179.
>>
>>
>>Thanks,
>>
>>Magda Hewryk
>>--------------------------------
>>Mid-Range Systems
>>905-273-1637 (Office)
>>416-554-0743 (Cell)
>>
>>
>>
>>            "Stanier, Alan M"
>>            <alan@ESSEX.AC.UK
>>            >                                                          To
>>            Sent by:                  MAILSCANNER@JISCMAIL.AC.UK
>>            MailScanner                                                cc
>>            mailing list
>>            <MAILSCANNER@JISC                                     Subject
>>            MAIL.AC.UK>               Sudden problem with MailScanner
>>                                      4.36.1
>>
>>            11/29/2004 05:27
>>            AM
>>
>>
>>            Please respond to
>>               MailScanner
>>              mailing list
>>            <MAILSCANNER@JISC
>>               MAIL.AC.UK>
>>
>>
>>
>>
>>
>>
>>Hi
>>
>>We are running MailScanner 4.36.1 on three SMTP servers. At 08:50 today,
>>one server stopped delievering mail, logging messages like:-
>>
>>Cannot parse
>>/var/spool/MailScanner/incoming/29863/1CYiZb-0000Xg-LK.header and ,
>>write-open
>>/var/spool/MailScanner/incoming/29863/1CYiZb-0000Xg-LK/msg-29863-4.txt:
>>No such file or directory at /usr/share/perl5/MIME/Body.pm line 414,
>><_GEN_3> line 1159.
>>
>>Nothing obvious happened to trigger the fault, there is no evidence of
>>disk problems, lots of freespace on the disks. Everything seems the same
>>on the machine that is failing as on those that are working.
>>
>>Does anyone have any idea where I should be looking for the problem?
>>
>>Thanks
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>
>>
>>
>>
>
>--
>Julian Field
>www.MailScanner.info
>Buy the MailScanner book at www.MailScanner.info/store
>Professional Support Services at www.MailScanner.biz
>MailScanner thanks transtec Computers for their support
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Application/X-ZIP-COMPRESSED  54KB. ]
    [ Unable to print this part. ]


From chuck.foster at STREAMSHIELD.COM  Mon Nov 29 17:44:44 2004
From: chuck.foster at STREAMSHIELD.COM (Chuck Foster)
Date: Thu Jan 12 21:27:44 2006
Subject: quoted-printable octet-stream issues
Message-ID: <mailman.5234.1137101264.24926.mailscanner@lists.mailscanner.info>

Hi,

I've been looking at a problem with some PDF messages that were being
corrupted on arrival; looking at it more closely I can see that our
Exchange server is sending out the attachments as quoted-printable and by
the time they've been through MailScanner the content has been changed,
specifically the midline =0As have now become physical newlines and (I
guess) are being mangled through the MTA (sendmail).

I noted that there is some code to 'massage' quoted-printable in
Message.pm, and the file on disk seems to be fine, so I would think the
problem is in re-encoding the content back to quoted-printable on the way
out.

Is this a common problem that has now been fixed (I couldn't find any
reference on a net trawl)? Obviously this doesn't occur for BASE64-encoded
messages.

Regards,
Chuck

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jstuart at EDENPR.K12.MN.US  Mon Nov 29 17:55:13 2004
From: jstuart at EDENPR.K12.MN.US (Joe Stuart)
Date: Thu Jan 12 21:27:44 2006
Subject: upgrade
Message-ID: <mailman.5235.1137101264.24926.mailscanner@lists.mailscanner.info>

>>> nmeverde@NP.K12.MN.US 11/29/04 11:15AM >>>
> After upgrading to mailscanner-4.34.8-4 I noticed after looking at
some
> mail headers my server is no longer using bayes.  I've tried putting
> use_bayes 1 in spam.assassin.prefs.conf, but nothing changed and
after
> that I do not know what else to try. Any help is appreciated.

>>check the permissions on the bayes_* files to make sure that the pid
owner
>>of MailScanner has access to them.

>>  - Nick


Thanks, I just checked that I'm running Mailscanner with postfix and
the run as user and group are set to postfix and the directory which the
bayes_* resides is owned by postfix and writable.  The thing though is
that the bayes_tokes file was last written to today, so the database
seems to be getting updated. It is just when I look at the header of an
email it does not have a score or listing for bayes(e.g. Bayes_00) ever
since the upgrade.

Thanks,
Joe

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From sw at INTERNETX.DE  Mon Nov 29 17:59:31 2004
From: sw at INTERNETX.DE (Sebastian Wiesinger)
Date: Thu Jan 12 21:27:44 2006
Subject: Problem Wit Silent Viruses: All-Viruses
Message-ID: <mailman.5236.1137101264.24926.mailscanner@lists.mailscanner.info>

* Julian Field <mailscanner@ECS.SOTON.AC.UK> [2004-11-29 18:37]:
> Please see the thread "Sudden problem with MailScanner 4.31.6".

I used the attached Message.pm with MailScanner 4.35.9, it works fine
now...

Regards,

Sebastian

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dhawal at NETMAGICSOLUTIONS.COM  Mon Nov 29 18:01:04 2004
From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy)
Date: Thu Jan 12 21:27:44 2006
Subject: Sudden problem with MailScanner 4.31.6
Message-ID: <mailman.5237.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian Field wrote:
> Please try the attached Message.pm file.
>

Great, the new Message.pm seems to have fixed my problem as well.. for
sender notifications (yeah, I know I shouldn't be doing this)

Thanks Julian..

regards,
- dhawal

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Mon Nov 29 18:00:17 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:44 2006
Subject: quoted-printable octet-stream issues
Message-ID: <mailman.5238.1137101264.24926.mailscanner@lists.mailscanner.info>

Chuck

what version of MS are you using. I think 4.35 has a fix for this issue,
the problem is Outleek, rather than exchange. Anyway upgrading to
4.35-11 fixed the issue for the one person affected here..

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Chuck Foster wrote:
> Hi,
>
> I've been looking at a problem with some PDF messages that were being
> corrupted on arrival; looking at it more closely I can see that our
> Exchange server is sending out the attachments as quoted-printable and by
> the time they've been through MailScanner the content has been changed,
> specifically the midline =0As have now become physical newlines and (I
> guess) are being mangled through the MTA (sendmail).
>
> I noted that there is some code to 'massage' quoted-printable in
> Message.pm, and the file on disk seems to be fine, so I would think the
> problem is in re-encoding the content back to quoted-printable on the way
> out.
>
> Is this a common problem that has now been fixed (I couldn't find any
> reference on a net trawl)? Obviously this doesn't occur for BASE64-encoded
> messages.
>
> Regards,
> Chuck
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Mon Nov 29 18:02:07 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:44 2006
Subject: Sudden problem with MailScanner 4.31.6
Message-ID: <mailman.5239.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Dhawal Doshy wrote:

> Julian Field wrote:
>
>> Please try the attached Message.pm file.
>>
>
> Great, the new Message.pm seems to have fixed my problem as well.. for
> sender notifications (yeah, I know I shouldn't be doing this)
>
Yay!

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From nmeverde at NP.K12.MN.US  Mon Nov 29 18:22:10 2004
From: nmeverde at NP.K12.MN.US (Nick Meverden)
Date: Thu Jan 12 21:27:44 2006
Subject: upgrade
Message-ID: <mailman.5240.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

>>>> nmeverde@NP.K12.MN.US 11/29/04 11:15AM >>>
>> After upgrading to mailscanner-4.34.8-4 I noticed after looking at
> some
>> mail headers my server is no longer using bayes.  I've tried putting
>> use_bayes 1 in spam.assassin.prefs.conf, but nothing changed and
> after
>> that I do not know what else to try. Any help is appreciated.
>
>>>check the permissions on the bayes_* files to make sure that the pid
> owner
>>>of MailScanner has access to them.
>
>>>  - Nick
>
>
> Thanks, I just checked that I'm running Mailscanner with postfix and
> the run as user and group are set to postfix and the directory which the
> bayes_* resides is owned by postfix and writable.  The thing though is
> that the bayes_tokes file was last written to today, so the database
> seems to be getting updated. It is just when I look at the header of an
> email it does not have a score or listing for bayes(e.g. Bayes_00) ever
> since the upgrade.
>

manually call spamassassin and look for errors when it tries to use the
bayesdb.  Set the path for the bayesdb in spam.assassin.prefs.conf and run

spamassassin -D --lint --prefs-file=/path/to/spam.assassin.prefs.conf >
/tmp/log 2>&1

that will redirect the debug output to /tmp/log

debug information will show which files its looking to for bayes db and if
there are any errors and will try to use bayes to score the test message.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From llasad1 at YAHOO.COM  Mon Nov 29 18:14:41 2004
From: llasad1 at YAHOO.COM (lester lasad)
Date: Thu Jan 12 21:27:44 2006
Subject: off topic:  email forwarding assistance/guidance needed
Message-ID: <mailman.5241.1137101264.24926.mailscanner@lists.mailscanner.info>

--- Marco Benton <marco@XSSNET.COM> wrote:
>
> lester lasad wrote:
>
> | <...snip...>
> |
> |
> | I would like to explain my setup a little further.
>  I have one
> | sendmail server that relays (does not deliver to
> local mail files
> | on the server) to 2 seperate domains/hosts.  The
> MX record for both
> | domains (abc.com and xyz.com) point to my one
> sendmail server (one
> | ip).  With that said, do you see any problems
> (mail routing loops)
> | using the virtusertable? for example, in the
> virtusertable I would
> | put: lester@abc.com       lester@xyz.com
> |
> |> From my understanding that should relay the mail
> to
> | the server hosting the xyz.com domain.  However, I
> still get mail
> | routing loop errors.
> |
> | Thanks for your assistance
>
>
> urr.  you mention it doesnt deliver mail to local
> users.  so where does it deliver mail to?

Mail is not delivered locally because it is acting as
a relay server.  the mx records for both the abc.com
and xyz.com domains point to my sendmail server.  From
there I am using /etc/mail/mailertable to relay the
mail to 2 seperate servers (one server is for abc.com
and the other is for xyz.com).

>from your description, mail will *have* to
> be delivered locally as you have both domains
> pointed to that one
> server...so it wouldnt make sense to have a
> virtusertable unless you
> wanted to deliver the mail somewhere else, hence the
> loop errors.
>
> it might be better to use /etc/mail/domaintable for
> what you are
> doing, simple domain remapping.

I am using webmin to administer my server.  When I
clicked on the domaintable option, I received the
following:  "Your sendmail configuration does not have
the domain mapping (domaintable) feature enabled"
Click here to eable it.  It took me to the sendmail m4
and I do not see an option to enable the domaintable.
Where can I enable this option?

>
> - --
>
> Marco Benton - BOFH, BSMFH
> Network Consultant



__________________________________
Do you Yahoo!?
Meet the all-new My Yahoo! - Try it today!
http://my.yahoo.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jaearick at COLBY.EDU  Mon Nov 29 18:18:08 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:44 2006
Subject: custom anti-phishing message?
Message-ID: <mailman.5242.1137101264.24926.mailscanner@lists.mailscanner.info>

Julian,

I'll just throw this out, feel free to say no...  The pointy-haired boss
has wanted to have our own custom anti-phishing warning, instead of the
MailScanner default (he wanted a whole paragraph there with a URL to our
own site explaining phishing etc, way too long -- I told him no, it was
hardwired).  But the pointy-haired boss DID thing that the warning was cool,
instead of telling me to turn the feature off.

Others want the thing shorter, eg "Fraud attempt from abc.com as xyz.com".
Aaaargh.

And I sure wish the msgid was in the phishing syslog, grumble, grumble.
Maybe in the next design of this feature?

Jeff Earickson
Colby College

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jstevens at ATHENSDISTRIBUTING.COM  Mon Nov 29 18:36:00 2004
From: jstevens at ATHENSDISTRIBUTING.COM (James R. Stevens)
Date: Thu Jan 12 21:27:44 2006
Subject: off topic:  email forwarding assistance/guidance needed
Message-ID: <mailman.5243.1137101264.24926.mailscanner@lists.mailscanner.info>

Please read this short explanation.

http://www.sendmail.org/virtual-hosting.html

What your trying to do is pretty simple and very stable (In my
experience)

*** NOTE: make sure you have each domain name and sub-domain (Name-space
listed in your local-host-names file.
If not you will see MX loops. (File maybe located in /etc/mail) 

-----Original Message-----
From: lester lasad [mailto:llasad1@YAHOO.COM] 
Sent: Monday, November 29, 2004 12:15 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: off topic: email forwarding assistance/guidance needed

--- Marco Benton <marco@XSSNET.COM> wrote:
>
> lester lasad wrote:
>
> | <...snip...>
> |
> |
> | I would like to explain my setup a little further.
>  I have one
> | sendmail server that relays (does not deliver to
> local mail files
> | on the server) to 2 seperate domains/hosts.  The
> MX record for both
> | domains (abc.com and xyz.com) point to my one
> sendmail server (one
> | ip).  With that said, do you see any problems
> (mail routing loops)
> | using the virtusertable? for example, in the
> virtusertable I would
> | put: lester@abc.com       lester@xyz.com
> |
> |> From my understanding that should relay the mail
> to
> | the server hosting the xyz.com domain.  However, I
> still get mail
> | routing loop errors.
> |
> | Thanks for your assistance
>
>
> urr.  you mention it doesnt deliver mail to local
> users.  so where does it deliver mail to?

Mail is not delivered locally because it is acting as
a relay server.  the mx records for both the abc.com
and xyz.com domains point to my sendmail server.  From
there I am using /etc/mail/mailertable to relay the
mail to 2 seperate servers (one server is for abc.com
and the other is for xyz.com).

>from your description, mail will *have* to
> be delivered locally as you have both domains
> pointed to that one
> server...so it wouldnt make sense to have a
> virtusertable unless you
> wanted to deliver the mail somewhere else, hence the
> loop errors.
>
> it might be better to use /etc/mail/domaintable for
> what you are
> doing, simple domain remapping.

I am using webmin to administer my server.  When I
clicked on the domaintable option, I received the
following:  "Your sendmail configuration does not have
the domain mapping (domaintable) feature enabled"
Click here to eable it.  It took me to the sendmail m4
and I do not see an option to enable the domaintable.
Where can I enable this option?

>
> - --
>
> Marco Benton - BOFH, BSMFH
> Network Consultant



__________________________________
Do you Yahoo!?
Meet the all-new My Yahoo! - Try it today!
http://my.yahoo.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

-- 
This message has been scanned for viruses and
dangerous content by Athens Hyperion Scanner, and is
believed to be clean.




-- 
This message has been scanned for viruses and
dangerous content by Athens Hyperion Scanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Mon Nov 29 18:44:55 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:44 2006
Subject: custom anti-phishing message?
Message-ID: <mailman.5244.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Jeff A. Earickson wrote:

> Julian,
>
> I'll just throw this out, feel free to say no...  The pointy-haired boss
> has wanted to have our own custom anti-phishing warning, instead of the
> MailScanner default (he wanted a whole paragraph there with a URL to our
> own site explaining phishing etc, way too long -- I told him no, it was
> hardwired).  But the pointy-haired boss DID thing that the warning was
> cool,
> instead of telling me to turn the feature off.
>
> Others want the thing shorter, eg "Fraud attempt from abc.com as
> xyz.com".
> Aaaargh.

See languages.conf. It is already there:
PossibleFraudStart = <font color="red"><b>MailScanner has detected a
possible fraud attempt from
PossibleFraudEnd = claiming to be </b></font>

> And I sure wish the msgid was in the phishing syslog, grumble, grumble.
> Maybe in the next design of this feature?

Done. See the attached Message.pm.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Application/X-ZIP-COMPRESSED  54KB. ]
    [ Unable to print this part. ]


From marco at XSSNET.COM  Mon Nov 29 18:45:17 2004
From: marco at XSSNET.COM (Marco Benton - BOFH)
Date: Thu Jan 12 21:27:44 2006
Subject: Help! - MailScanner ceased working (not fixed)
Message-ID: <mailman.5245.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Matthew Bowman wrote:

>Hello,
>
>Without SA or Virus Scanners on all the debug I get is
>
>In Debugging mode, not forking...
>
>>From maillog:
>
>Nov 29 11:41:51 smithers MailScanner[2682]: MailScanner E-Mail Virus
>Scanner version 4.35.11 starting...
>Nov 29 11:41:51 smithers MailScanner[2682]: lock.pl sees Config  LockType
>=  flock
>Nov 29 11:41:51 smithers MailScanner[2682]: lock.pl sees have_module =  0
>
>

is the hostname correct? is you do a "hostname" does it come back with
the hostname or does it come back with "--fqdn"?  ive seen this problem
on Solaris, dont know about Linux.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Mon Nov 29 18:51:35 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:44 2006
Subject: Help! - MailScanner ceased working (not fixed)
Message-ID: <mailman.5246.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Marco Benton - BOFH wrote:

> Matthew Bowman wrote:
>
>> Hello,
>>
>> Without SA or Virus Scanners on all the debug I get is
>>
>> In Debugging mode, not forking...
>>
>>> From maillog:
>>
>>
>> Nov 29 11:41:51 smithers MailScanner[2682]: MailScanner E-Mail Virus
>> Scanner version 4.35.11 starting...
>> Nov 29 11:41:51 smithers MailScanner[2682]: lock.pl sees Config
>> LockType
>> =  flock
>> Nov 29 11:41:51 smithers MailScanner[2682]: lock.pl sees have_module
>> =  0
>>
>>
>
> is the hostname correct? is you do a "hostname" does it come back with
> the hostname or does it come back with "--fqdn"?  ive seen this problem
> on Solaris, dont know about Linux.

For the archive, this is caused by a bad bug in Sys::Hostname::Long.
This module only works on GNU systems (including Linux), and has to be
hacked by hand (or just not installed) on Solaris and other non-GNU
systems. Search the code for "--fqdn" and you will see that it is wrong.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mbowman at UDCOM.COM  Mon Nov 29 19:58:23 2004
From: mbowman at UDCOM.COM (Matthew Bowman)
Date: Thu Jan 12 21:27:44 2006
Subject: Help! - MailScanner ceased working (not fixed)
Message-ID: <mailman.5247.1137101264.24926.mailscanner@lists.mailscanner.info>

hostname returns the correct hostname.   I just can't to seem to figure
out why MailScanner won't read the mqueue.in folder. The permissions are
fine.

SA is enabled
Bayes is disabled (for the moment)
AWL is disabled
f-prot is enabled



Matthew K Bowman
Systems Administrator
UDCom
Tel: 419-524-4330
Fax: 419-524-8757
Web: http://www.udcom.com
Email: mbowman@udcom.com
Support: techsupport@udcom.com
Sales: sales@udcom.com




Julian Field <mailscanner@ECS.SOTON.AC.UK>
Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
11/29/2004 01:51 PM
Please respond to MailScanner mailing list

        To:     MAILSCANNER@JISCMAIL.AC.UK
        cc:
        Subject:        Re: Help! - MailScanner ceased working (not fixed)


Marco Benton - BOFH wrote:

> Matthew Bowman wrote:
>
>> Hello,
>>
>> Without SA or Virus Scanners on all the debug I get is
>>
>> In Debugging mode, not forking...
>>
>>> From maillog:
>>
>>
>> Nov 29 11:41:51 smithers MailScanner[2682]: MailScanner E-Mail Virus
>> Scanner version 4.35.11 starting...
>> Nov 29 11:41:51 smithers MailScanner[2682]: lock.pl sees Config
>> LockType
>> =  flock
>> Nov 29 11:41:51 smithers MailScanner[2682]: lock.pl sees have_module
>> =  0
>>
>>
>
> is the hostname correct? is you do a "hostname" does it come back with
> the hostname or does it come back with "--fqdn"?  ive seen this problem
> on Solaris, dont know about Linux.

For the archive, this is caused by a bad bug in Sys::Hostname::Long.
This module only works on GNU systems (including Linux), and has to be
hacked by hand (or just not installed) on Solaris and other non-GNU
systems. Search the code for "--fqdn" and you will see that it is wrong.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Mon Nov 29 19:10:15 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:44 2006
Subject: Help! - MailScanner ceased working (not fixed)
Message-ID: <mailman.5248.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

You have set the "MTA" setting in MailScanner.conf haven't you? That's
one I often forget to set, and it just sits there doing nowt.

Matthew Bowman wrote:

>hostname returns the correct hostname.   I just can't to seem to figure
>out why MailScanner won't read the mqueue.in folder. The permissions are
>fine.
>
>SA is enabled
>Bayes is disabled (for the moment)
>AWL is disabled
>f-prot is enabled
>Marco Benton - BOFH wrote:
>
>
>
>>Matthew Bowman wrote:
>>
>>
>>
>>>Hello,
>>>
>>>Without SA or Virus Scanners on all the debug I get is
>>>
>>>In Debugging mode, not forking...
>>>
>>>
>>>
>>>>From maillog:
>>>>
>>>>
>>>Nov 29 11:41:51 smithers MailScanner[2682]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 29 11:41:51 smithers MailScanner[2682]: lock.pl sees Config
>>>LockType
>>>=  flock
>>>Nov 29 11:41:51 smithers MailScanner[2682]: lock.pl sees have_module
>>>=  0
>>>
>>>
>>>
>>>
>>is the hostname correct? is you do a "hostname" does it come back with
>>the hostname or does it come back with "--fqdn"?  ive seen this problem
>>on Solaris, dont know about Linux.
>>
>>
>
>For the archive, this is caused by a bad bug in Sys::Hostname::Long.
>This module only works on GNU systems (including Linux), and has to be
>hacked by hand (or just not installed) on Solaris and other non-GNU
>systems. Search the code for "--fqdn" and you will see that it is wrong.
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mbowman at UDCOM.COM  Mon Nov 29 20:12:22 2004
From: mbowman at UDCOM.COM (Matthew Bowman)
Date: Thu Jan 12 21:27:44 2006
Subject: Help! - MailScanner ceased working (not fixed)
Message-ID: <mailman.5249.1137101264.24926.mailscanner@lists.mailscanner.info>

Hello,

Yes they are set
mta = sendmail
Sendmail = /usr/sbin/sendmail

This isn't a new install, it just stopped working. New mail just arrived
and sat in mqueue.in w/o being looked at by MailScanner.  We have 2 other
servers functionally well with the same OS and MS versions. I need to get
this 3rd server backup and running though.

Thank you

Matthew K Bowman
Systems Administrator
UDCom
Tel: 419-524-4330
Fax: 419-524-8757
Web: http://www.udcom.com
Email: mbowman@udcom.com
Support: techsupport@udcom.com
Sales: sales@udcom.com




Julian Field <mailscanner@ECS.SOTON.AC.UK>
Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
11/29/2004 02:10 PM
Please respond to MailScanner mailing list

        To:     MAILSCANNER@JISCMAIL.AC.UK
        cc:
        Subject:        Re: Help! - MailScanner ceased working (not fixed)


You have set the "MTA" setting in MailScanner.conf haven't you? That's
one I often forget to set, and it just sits there doing nowt.

Matthew Bowman wrote:

>hostname returns the correct hostname.   I just can't to seem to figure
>out why MailScanner won't read the mqueue.in folder. The permissions are
>fine.
>
>SA is enabled
>Bayes is disabled (for the moment)
>AWL is disabled
>f-prot is enabled
>Marco Benton - BOFH wrote:
>
>
>
>>Matthew Bowman wrote:
>>
>>
>>
>>>Hello,
>>>
>>>Without SA or Virus Scanners on all the debug I get is
>>>
>>>In Debugging mode, not forking...
>>>
>>>
>>>
>>>>From maillog:
>>>>
>>>>
>>>Nov 29 11:41:51 smithers MailScanner[2682]: MailScanner E-Mail Virus
>>>Scanner version 4.35.11 starting...
>>>Nov 29 11:41:51 smithers MailScanner[2682]: lock.pl sees Config
>>>LockType
>>>=  flock
>>>Nov 29 11:41:51 smithers MailScanner[2682]: lock.pl sees have_module
>>>=  0
>>>
>>>
>>>
>>>
>>is the hostname correct? is you do a "hostname" does it come back with
>>the hostname or does it come back with "--fqdn"?  ive seen this problem
>>on Solaris, dont know about Linux.
>>
>>
>
>For the archive, this is caused by a bad bug in Sys::Hostname::Long.
>This module only works on GNU systems (including Linux), and has to be
>hacked by hand (or just not installed) on Solaris and other non-GNU
>systems. Search the code for "--fqdn" and you will see that it is wrong.
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From David.While at UCE.AC.UK  Mon Nov 29 19:18:33 2004
From: David.While at UCE.AC.UK (David While)
Date: Thu Jan 12 21:27:44 2006
Subject: New release of Vispan
Message-ID: <mailman.5250.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "utf-8" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Thanks - I have incorporated into the next version. Also I have found why it wasn't detecting the log entry for the virus - this has also been fixed.
 
The virus list on the front page is the daily list.
 
David While

	-----Original Message----- 
	From: MailScanner mailing list on behalf of Marcel Blenkers 
	Sent: Mon 29/11/2004 14:06 
	To: MAILSCANNER@JISCMAIL.AC.UK 
	Cc: 
	Subject: Re: New release of Vispan
	
	

	Hi and sorry for my late Answer..
	
	and please check my question below everything ;)
	
	Thanks in advance
	
	> The reason AntiVir doesn't appear in the config page is that it isn't
	> configured to do so. I only have access to a limited number of virus
	> scanners. If you can provide me with the command line option to print
	> out the version information (usually -v or -info) and what it actually
	> prints - I will add in the support.
	>
	ok..
	
	here we go:
	
	First the Version-Info
	
	The Command seems to be
	
	antivir --version
	
	The output is as follows:
	
	marcel@marcel:~> antivir --version
	6.28.0.19
	operating system: Linux (glibc 2.0)
	product version:  2.1.2-15
	engine version:   6.28.0.19
	packlib version:  2.0.3.17 (supports 24 formats)
	vdf version:      6.28.0.95
	
	product:          AntiVir Workstation
	key file:         hbedv.key
	registered user:  Marcel Blenkers, Berlin
	serial number:    1001061079
	key expires:      31 Mar 2005
	run mode:         PERSONAL
	
	product:          AntiVir MailGate
	key file:         hbedv.key
	registered user:  Marcel Blenkers, Berlin
	serial number:    1001061079
	key expires:      31 Mar 2005
	run mode:         PERSONAL
	
	product:          AntiVir (command line scanner)
	key file:         hbedv.key
	registered user:  Marcel Blenkers, Berlin
	serial number:    1001061079
	key expires:      31 Mar 2005
	run mode:         PERSONAL
	
	
	
	Now the Logfile-Entry for the Virus called TR/Pish.Telekom.A
	
	
	
	
	Nov 29 14:59:45 marcel sendmail[17691]: iATDxiEK017689:
	to=<marcel@aqua-europe.c
	om>, delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=120358,
	relay=localhost.
	netfinish.de. [127.0.0.1], dsn=2.0.0, stat=Sent (iATDxiV3017692 Message
	accepted
	 for delivery)
	Nov 29 14:59:47 marcel MailScanner[14419]: New Batch: Scanning 1 messages,
	4314
	bytes
	Nov 29 14:59:47 marcel MailScanner[14419]: Spam Checks: Starting
	Nov 29 14:59:57 marcel MailScanner[14419]: Virus and Content Scanning:
	Starting
	Nov 29 14:59:59 marcel MailScanner[14419]: ALERT: [TR/Pish.Telekom.A
	virus] ./iATDxiV3017692/Viren.zip --> dfiAFJ8M9V013462 <<< The Trojan
	horse TR/Pish.Telekom.A
	Nov 29 14:59:59 marcel MailScanner[14419]: ALERT: [TR/Pish.Telekom.A
	virus] ./iATDxiV3017692/Viren.zip --> msg-10870-14.txt <<< The Trojan
	horse TR/Pish.Telekom.A
	Nov 29 14:59:59 marcel MailScanner[14419]: ALERT: [TR/Pish.Telekom.A
	virus] ./iATDxiV3017692/dfiAFJ8M9V013462 <<< The Trojan horse
	TR/Pish.Telekom.A
	Nov 29 14:59:59 marcel MailScanner[14419]: ALERT: [TR/Pish.Telekom.A
	virus] ./iATDxiV3017692/msg-10870-14.txt <<< The Trojan horse
	TR/Pish.Telekom.A
	Nov 29 14:59:59 marcel MailScanner[14419]: Virus Scanning: AntiVir found 4
	infections
	Nov 29 15:00:01 marcel MailScanner[14419]: Infected message iATDxiV3017692
	came from 127.0.0.1
	Nov 29 15:00:01 marcel MailScanner[14419]: Saved entire message to
	/var/spool/MailScanner/quarantine/20041129/iATDxiV3017692
	Nov 29 15:00:01 marcel MailScanner[14419]: Saved infected
	"msg-10870-14.txt" to
	/var/spool/MailScanner/quarantine/20041129/iATDxiV3017692
	Nov 29 15:00:01 marcel MailScanner[14419]: Saved infected
	"dfiAFJ8M9V013462" to
	/var/spool/MailScanner/quarantine/20041129/iATDxiV3017692
	Nov 29 15:00:01 marcel MailScanner[14419]: Saved infected "Viren.zip" to
	/var/spool/MailScanner/quarantine/20041129/iATDxiV3017692
	Nov 29 15:00:02 marcel MailScanner[14419]: Silent: Delivered 1 messages
	containing silent viruses
	
	Now some other Question
	
	On the Index.html created with vispan and the cronjob there is the
	table called
	
	Top Viruses
	
	is this table only for the current day or for all viruses found together?
	
	as this table is empty again :(
	
	To see the current Vispan on my site check
	
	http://www.irc-addicts.de/vispan/
	
	maybe i missconfigured something..
	
	Thanks in advance and i hope i was of some help
	
	Marcel
	
	------------------------ MailScanner list ------------------------
	To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
	'leave mailscanner' in the body of the email.
	Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
	the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
	
	Support MailScanner development - buy the book off the website!
	
	


From jaearick at COLBY.EDU  Mon Nov 29 19:36:49 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:44 2006
Subject: custom anti-phishing message?
Message-ID: <mailman.5251.1137101264.24926.mailscanner@lists.mailscanner.info>

Excellent!  Thanks!  Free lobster dinner if you ever get to Maine, New
England, or South-East Canada!

Jeff Earickson
Colby College

On Mon, 29 Nov 2004, Julian Field wrote:

> Date: Mon, 29 Nov 2004 18:44:55 +0000
> From: Julian Field <mailscanner@ECS.SOTON.AC.UK>
> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: custom anti-phishing message?
>
> Jeff A. Earickson wrote:
>
>> Julian,
>>
>> I'll just throw this out, feel free to say no...  The pointy-haired boss
>> has wanted to have our own custom anti-phishing warning, instead of the
>> MailScanner default (he wanted a whole paragraph there with a URL to our
>> own site explaining phishing etc, way too long -- I told him no, it was
>> hardwired).  But the pointy-haired boss DID thing that the warning was
>> cool,
>> instead of telling me to turn the feature off.
>>
>> Others want the thing shorter, eg "Fraud attempt from abc.com as
>> xyz.com".
>> Aaaargh.
>
> See languages.conf. It is already there:
> PossibleFraudStart = <font color="red"><b>MailScanner has detected a
> possible fraud attempt from
> PossibleFraudEnd = claiming to be </b></font>
>
>> And I sure wish the msgid was in the phishing syslog, grumble, grumble.
>> Maybe in the next design of this feature?
>
> Done. See the attached Message.pm.
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From victor at PIXELMAGICFX.COM  Mon Nov 29 20:31:58 2004
From: victor at PIXELMAGICFX.COM (Victor DiMichina)
Date: Thu Jan 12 21:27:44 2006
Subject: Panda broken in 4.35.11
Message-ID: <mailman.5252.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian,   upon updating to the latest MailScanner,   I found that Panda
no longer works.   When I attempt to  run the panda-wrapper script to
test it out,  per the instructions in
/etc/MailScanner/virus_scanners.conf,  I get the following error message:
NOTE:  I had to change the virus_scanners.conf from /usr to /usr/bin
next to the panda line.

command is #/usr/lib/MailScanner/panda-wrapper /usr/bin
/var/spool/MailScanner/quarantine

output from that command:

ls:  invalid option  -- e
try "ls --help"  for more information
Virus: 0

I run this on a directory that is full of eicar tests.    The f-secure
wrapper works fine.    A diff between my old virus_scanners.conf and my
new one showed no difference except the generic-wrapper line.    My old
and new panda-wrappers are the same.

System is  RH 8.0,  I have SA 3.0.1 with DCC installed.   Panda was
broken before SA 3.0.1 and DCC were installed.

Any clues where I should be looking for this problem?

Thanks!
Vic

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From victor at PIXELMAGICFX.COM  Mon Nov 29 20:33:38 2004
From: victor at PIXELMAGICFX.COM (Victor DiMichina)
Date: Thu Jan 12 21:27:44 2006
Subject: Panda update script
Message-ID: <mailman.5253.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I've seen a few posts over the last few months in the archives
requesting a Panda  auto-update script.    I've posted this a couple of
times in the past,  here it is again for anyone interested.
Obviously,  replace the "username" and "password" with your own.   ;)
Add it to your cron script,  and make sure your firewall allows port
8003 to be accessed.

vic


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2: "Attached Text" ]

#!/bin/bash

#
# Panda Antivirus Linux PAV.SIG downloading script
# ------------------------------------------------
# pavupdate.sh ----------------------- version 1.0
# 
# This script takes care of downloading and installing 
# the antivirus signature file (pav.sig). It is very suitable
# to be set as a daily cron job on your PAV Linux server.
# It should not be world/group readable as it contains
# your update username/password in cleartext. Read the
# "README" file for more details on dependencies and such.
#
# (c) Copyright Daniel Nyström <dny@pcmint.se>, 
#               PCM International AB, Sweden.


# Configuration section. Set the user and pass variables. You should not
# need to touch the path var...

USER="<username>"
PASS="<password>"
PATHTOPAVSIG="/usr/lib/panda/pav.sig"

# Preparing other variables... Do not modify if you don't know what
# you are doing...

DATE=`date +%m%d`
GETSTRING="http://updates.pandasoftware.com:8003/software/basevirus/pav$DATE.zip"
TEMPDIR="/tmp"
STARTDIR=`pwd`

# Doing it.
clear
echo ""
echo "======= PCM INTERNATIONAL ======="
echo "================================="
echo "= Panda Antivirus Linux Updater ="
echo "================================="
echo "===================== version 1.0"
echo ""
echo "Starting..."

# Changing dir and downloading...
cd $TEMPDIR
echo "Downloading..."
wget --http-user=$USER --http-passwd=$PASS $GETSTRING


# Checking for errors... Then unzipping...
if [ -f pav$DATE.zip ] 
then
        echo ""
        echo "File download successful! unzipping.."
        unzip pav$DATE.zip
else
        echo ""
        echo "File download _not_ successful!"
        echo "Check your configuration..."
        exit
fi


# Checking for errors... Then installing...
if [ -f PAV.SIG ]
then
        echo "Unzipping successful! Installing..."
        rm -f pav$DATE.zip
        mv PAV.SIG $PATHTOPAVSIG
else
        echo "Unzipping _not_ successful!"
        echo 'Check that your system has the "unzip" util...'
        exit
fi

# All the action is over :) 

echo ""
echo "Update complete. Have a nice day!"
echo ""

# EOF pavupdate.sh, version 1.0
#
# (c) Copyright Daniel Nyström <dny@pcmint.se>, 
#               PCM International AB, Sweden.



------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From mailscanner at ecs.soton.ac.uk  Mon Nov 29 20:27:17 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:44 2006
Subject: Panda broken in 4.35.11
Message-ID: <mailman.5254.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

What does this produce?
/usr/lib/MailScanner/panda-wrapper /usr -AEX -CMP -AUT -NSO -ESP -HEU .
(don't forget the . on the end). It should scan the current directory
and just report any nasties. This is the command used by MailScanner.

Victor DiMichina wrote:

> Julian,   upon updating to the latest MailScanner,   I found that Panda
> no longer works.   When I attempt to  run the panda-wrapper script to
> test it out,  per the instructions in
> /etc/MailScanner/virus_scanners.conf,  I get the following error message:
> NOTE:  I had to change the virus_scanners.conf from /usr to /usr/bin
> next to the panda line.
>
> command is #/usr/lib/MailScanner/panda-wrapper /usr/bin
> /var/spool/MailScanner/quarantine
>
> output from that command:
>
> ls:  invalid option  -- e
> try "ls --help"  for more information
> Virus: 0
>
> I run this on a directory that is full of eicar tests.    The f-secure
> wrapper works fine.    A diff between my old virus_scanners.conf and my
> new one showed no difference except the generic-wrapper line.    My old
> and new panda-wrappers are the same.
>
> System is  RH 8.0,  I have SA 3.0.1 with DCC installed.   Panda was
> broken before SA 3.0.1 and DCC were installed.
>
--

Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ssilva at SGVWATER.COM  Mon Nov 29 20:36:01 2004
From: ssilva at SGVWATER.COM (Scott Silva)
Date: Thu Jan 12 21:27:44 2006
Subject: Help! - MailScanner ceased working (debug output)
Message-ID: <mailman.5255.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

| debug: config: read file /usr/share/spamassassin/50_scores.cf
| debug: config: read file /usr/share/spamassassin/60_whitelist.cf
| debug: using "/etc/mail/spamassassin" for site rules dir
| debug: config: read file /etc/mail/spamassassin/antidrug.cf
| debug: config: read file /etc/mail/spamassassin/bigevil.cf
Try and remove /etc/mail/spamassassin/bigevil.cf and restart and see if
things get better
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBq4gxRADw9lziUqQRAvwvAKCBXZd42l1zbjy3K08niVDf/3JpiwCfdP/j
nrTSsIAhxw9mQSU8+wOB9dU=
=0/AV
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From victor at PIXELMAGICFX.COM  Mon Nov 29 22:54:00 2004
From: victor at PIXELMAGICFX.COM (Victor DiMichina)
Date: Thu Jan 12 21:27:44 2006
Subject: Panda broken in 4.35.11
Message-ID: <mailman.5256.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian Field wrote:

>
> What does this produce?
> /usr/lib/MailScanner/panda-wrapper /usr -AEX -CMP -AUT -NSO -ESP -HEU .
> (don't forget the . on the end). It should scan the current directory
> and just report any nasties. This is the command used by MailScanner.


First off,  I changed the virus_scanners.conf back to default with /usr
instead of /bin on the panda line.  Originally I changed it because I
thought it wasn't working,  but it was working...just SLOWLY.    Results:

/usr/lib/MailScanner/panda-wrapper /usr -AEX -CMP -AUT -NSO -HEU .
Virus: 23##Base: /var/spool/MailScanner/quarantine/20041129##1:
'1096/location_message.scr' => W32/Netsky##2: '11610/eicar.com' =>
EICAR-AV-TEST-FILE##3:
...and so on

I also ran it default with the same results:
[root@hoshi 20041129]# /usr/lib/MailScanner/panda-wrapper /usr .
Virus: 23##Base: /var/spool/MailScanner/quarantine/20041129##1:
'1096/location_message.scr' => W32/Netsky##2: '11610/eicar.com' =>
EICAR-AV-TEST-FILE##3:
...and so on.

However,  that directory,  with roughly 75 files in it, took over 3
minutes to scan with the wrapper.   When I did a command line pavcl scan
with the same parameters, it scanned in a fraction of a second.   I
suspect we're timing out somewhere.
FYI,  the f-secure wrapper scans the same directory in a second or less.

Vic

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From billy at PLANETGEEK.BIZ  Mon Nov 29 22:43:10 2004
From: billy at PLANETGEEK.BIZ (Billy Pumphrey)
Date: Thu Jan 12 21:27:44 2006
Subject: Mailscanner Spamassassin timing out
Message-ID: <mailman.5257.1137101264.24926.mailscanner@lists.mailscanner.info>


I searched the archive and found plenty about the errors of it timing
out, but I just cannot find out what the problem is.

 

Did I change anything?

Yes.  I added a few entries in the access file for REJECT.  I received no
errors on this file after I edited it.

 

What are the errors in the maillog.  Something like this:

0:15:00

Nov 29 17:24:56 MailScanner sendmail[2880]: alias database /etc/aliases
rebuilt

by bpumphrey

Nov 29 17:24:56 MailScanner sendmail[2880]: /etc/aliases: 64 aliases,
longest 28

 bytes, 657 bytes total

Nov 29 17:24:56 MailScanner sendmail[2889]: starting daemon (8.12.8):
SMTP

Nov 29 17:24:56 MailScanner sm-msp-queue[2894]: starting daemon (8.12.8):
queuei

ng@00:15:00

Nov 29 17:24:56 MailScanner sendmail[2900]: starting daemon (8.12.8):
queueing@0

0:15:00

Nov 29 17:25:04 MailScanner MailScanner[2925]: MailScanner E-Mail Virus
Scanner

version 4.25-14 starting...

Nov 29 17:25:13 MailScanner MailScanner[2957]: MailScanner E-Mail Virus
Scanner

version 4.25-14 starting...

Nov 29 17:25:23 MailScanner MailScanner[2960]: MailScanner E-Mail Virus
Scanner

version 4.25-14 starting...

Nov 29 17:25:34 MailScanner MailScanner[2961]: MailScanner E-Mail Virus
Scanner

version 4.25-14 starting...

Nov 29 17:25:44 MailScanner MailScanner[2962]: MailScanner E-Mail Virus
Scanner

version 4.25-14 starting...

Nov 29 17:25:53 MailScanner MailScanner[2925]: Using locktype = flock

Nov 29 17:25:54 MailScanner MailScanner[2925]: New Batch: Found 692
messages wai

ting

Nov 29 17:25:56 MailScanner MailScanner[2925]: New Batch: Scanning 30
messages,

123697 bytes

Nov 29 17:25:56 MailScanner MailScanner[2925]: Spam Checks: Starting

Nov 29 17:26:22 MailScanner MailScanner[2957]: Using locktype = flock

Nov 29 17:26:27 MailScanner MailScanner[2957]: New Batch: Found 692
messages wai

ting

Nov 29 17:26:27 MailScanner MailScanner[2957]: New Batch: Scanning 30
messages,

82308 bytes

Nov 29 17:26:29 MailScanner MailScanner[2957]: Spam Checks: Starting

Nov 29 17:27:10 MailScanner MailScanner[2925]: SpamAssassin timed out and
was ki

lled, consecutive failure 1 of 20

Nov 29 17:27:13 MailScanner MailScanner[2962]: Using locktype = flock

Nov 29 17:27:18 MailScanner MailScanner[2962]: New Batch: Found 692
messages wai

ting

Nov 29 17:27:18 MailScanner MailScanner[2962]: New Batch: Scanning 30
messages,

370968 bytes

Nov 29 17:27:20 MailScanner MailScanner[2962]: Spam Checks: Starting

Nov 29 17:27:24 MailScanner MailScanner[2961]: Using locktype = flock

Nov 29 17:27:24 MailScanner MailScanner[2961]: New Batch: Found 692
messages wai

ting

Nov 29 17:27:24 MailScanner MailScanner[2961]: New Batch: Scanning 30
messages,

402914 bytes

Nov 29 17:27:25 MailScanner MailScanner[2961]: Spam Checks: Starting

Nov 29 17:27:44 MailScanner MailScanner[2957]: SpamAssassin timed out and
was ki

lled, consecutive failure 1 of 20

Nov 29 17:28:27 MailScanner MailScanner[2961]: SpamAssassin timed out and
was ki

lled, consecutive failure 1 of 20

 

For the full log, go here a http://www.indysmash.com/downloads/maillog

 

My spamassassin timeout was at the default of 10, then I rose it to
eventually 40 and the timeouts still happen.  The first things that were
appearing in the log were the spamassassin timeout, but first there were
RBL timeouts.  The log has the entries in there.  I then commented out
the RBL list in the MailScanner.conf and that did not help.  I also
restart the whole machine and that didn&#8217;t help.

 

Please let me know what more information that you need.

 

Thank you for your help.

 

Billy Pumphrey

IT Manager

Wooden & McLaughlin

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From Leonard.Hermens at POTLATCHCORP.COM  Mon Nov 29 22:44:57 2004
From: Leonard.Hermens at POTLATCHCORP.COM (Leonard Hermens)
Date: Thu Jan 12 21:27:44 2006
Subject: Phishing version and mailto: tag
Message-ID: <mailman.5258.1137101264.24926.mailscanner@lists.mailscanner.info>

Hello,

I am running MailScanner version 4.35.11 and Message.pm version 1.126.2.172
(2004/11/29) on Red Hat Linux 9, Perl 5.8.0

I am still getting phishing fraud notices when the mailto: doesn't match
the URL text, for example:

Nov 29 14:24:48 lxclk0100 MailScanner[29724]: Found phishing fraud from
xxxxx.yyyyy@domain.com claiming to be mailto:xxxxx.yyyyy@domain.com in
iATMOTr29939

I seem to recall that Message.pm was patched to allow this to pass.

Do I need to run 4.36.1-1 for mailto: to check correctly with the latest
Message.pm? Or should 4.35.11 be okay? I'm just a bit versioning confused
right now. :)

-- Leonard


--
Leonard Hermens
Manager, Information Systems Security
Potlatch Corporation
805 Mill Road, Lewiston, ID 83501
Voice:  208.799.2031
Leonard.Hermens@potlatchcorp.com
http://www.potlatchcorp.com/

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From billy at PLANETGEEK.BIZ  Mon Nov 29 22:53:43 2004
From: billy at PLANETGEEK.BIZ (Billy Pumphrey)
Date: Thu Jan 12 21:27:44 2006
Subject: Mailscanner Spamassassin timing out
Message-ID: <mailman.5259.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "utf-8" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I let it run for a bit and it seems to be at least processing some messages now and then before it times out again.  I had this problem before but I increase the timeout and it worked last time.  Maybe it is just too slow of a machine and is just getting killed right now?

500mhz
384mb RAM
Average messages per day        2,462

The logwatch that returns usually shows that there were load volumes of around 12 about 4-5 times.

________________________________________
From: Billy Pumphrey [mailto:billy@PLANETGEEK.BIZ] 
Sent: Monday, November 29, 2004 5:43 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Mailscanner Spamassassin timing out

I searched the archive and found plenty about the errors of it timing out, but I just cannot find out what the problem is.

Did I change anything?
Yes.  I added a few entries in the access file for REJECT.  I received no errors on this file after I edited it.

What are the errors in the maillog.  Something like this:
0:15:00
Nov 29 17:24:56 MailScanner sendmail[2880]: alias database /etc/aliases rebuilt
by bpumphrey
Nov 29 17:24:56 MailScanner sendmail[2880]: /etc/aliases: 64 aliases, longest 28
 bytes, 657 bytes total
Nov 29 17:24:56 MailScanner sendmail[2889]: starting daemon (8.12.8): SMTP
Nov 29 17:24:56 MailScanner sm-msp-queue[2894]: starting daemon (8.12.8): queuei
ng@00:15:00
Nov 29 17:24:56 MailScanner sendmail[2900]: starting daemon (8.12.8): queueing@0
0:15:00
Nov 29 17:25:04 MailScanner MailScanner[2925]: MailScanner E-Mail Virus Scanner
version 4.25-14 starting...
Nov 29 17:25:13 MailScanner MailScanner[2957]: MailScanner E-Mail Virus Scanner
version 4.25-14 starting...
Nov 29 17:25:23 MailScanner MailScanner[2960]: MailScanner E-Mail Virus Scanner
version 4.25-14 starting...
Nov 29 17:25:34 MailScanner MailScanner[2961]: MailScanner E-Mail Virus Scanner
version 4.25-14 starting...
Nov 29 17:25:44 MailScanner MailScanner[2962]: MailScanner E-Mail Virus Scanner
version 4.25-14 starting...
Nov 29 17:25:53 MailScanner MailScanner[2925]: Using locktype = flock
Nov 29 17:25:54 MailScanner MailScanner[2925]: New Batch: Found 692 messages wai
ting
Nov 29 17:25:56 MailScanner MailScanner[2925]: New Batch: Scanning 30 messages,
123697 bytes
Nov 29 17:25:56 MailScanner MailScanner[2925]: Spam Checks: Starting
Nov 29 17:26:22 MailScanner MailScanner[2957]: Using locktype = flock
Nov 29 17:26:27 MailScanner MailScanner[2957]: New Batch: Found 692 messages wai
ting
Nov 29 17:26:27 MailScanner MailScanner[2957]: New Batch: Scanning 30 messages,
82308 bytes
Nov 29 17:26:29 MailScanner MailScanner[2957]: Spam Checks: Starting
Nov 29 17:27:10 MailScanner MailScanner[2925]: SpamAssassin timed out and was ki
lled, consecutive failure 1 of 20
Nov 29 17:27:13 MailScanner MailScanner[2962]: Using locktype = flock
Nov 29 17:27:18 MailScanner MailScanner[2962]: New Batch: Found 692 messages wai
ting
Nov 29 17:27:18 MailScanner MailScanner[2962]: New Batch: Scanning 30 messages,
370968 bytes
Nov 29 17:27:20 MailScanner MailScanner[2962]: Spam Checks: Starting
Nov 29 17:27:24 MailScanner MailScanner[2961]: Using locktype = flock
Nov 29 17:27:24 MailScanner MailScanner[2961]: New Batch: Found 692 messages wai
ting
Nov 29 17:27:24 MailScanner MailScanner[2961]: New Batch: Scanning 30 messages,
402914 bytes
Nov 29 17:27:25 MailScanner MailScanner[2961]: Spam Checks: Starting
Nov 29 17:27:44 MailScanner MailScanner[2957]: SpamAssassin timed out and was ki
lled, consecutive failure 1 of 20
Nov 29 17:28:27 MailScanner MailScanner[2961]: SpamAssassin timed out and was ki
lled, consecutive failure 1 of 20

For the full log, go here â^Ć^Ň http://www.indysmash.com/downloads/maillog

My spamassassin timeout was at the default of 10, then I rose it to eventually 40 and the timeouts still happen.  The first things that were appearing in the log were the spamassassin timeout, but first there were RBL timeouts.  The log has the entries in there.  I then commented out the RBL list in the MailScanner.conf and that did not help.  I also restart the whole machine and that didnâ^Ŕ^Ůt help.

Please let me know what more information that you need.

Thank you for your help.

Billy Pumphrey
IT Manager
Wooden & McLaughlin

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From victor at PIXELMAGICFX.COM  Mon Nov 29 23:06:17 2004
From: victor at PIXELMAGICFX.COM (Victor DiMichina)
Date: Thu Jan 12 21:27:44 2006
Subject: Mailscanner Spamassassin timing out
Message-ID: <mailman.5260.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "windows-1252" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Billy Pumphrey wrote:

> I searched the archive and found plenty about the errors of it timing 
> out, but I just cannot find out what the problem is.
>
> Did I change anything?
>
> Yes. I added a few entries in the access file for REJECT. I received 
> no errors on this file after I edited it.
>
>
> For the full log, go here ŕ http://www.indysmash.com/downloads/maillog
>
> My spamassassin timeout was at the default of 10, then I rose it to 
> eventually 40 and the timeouts still happen. The first things that 
> were appearing in the log were the spamassassin timeout, but first 
> there were RBL timeouts. The log has the entries in there. I then 
> commented out the RBL list in the MailScanner.conf and that did not 
> help. I also restart the whole machine and that didn^Ňt help.
>

Where was this parameter set? I remember my default spamassassin timeout 
being 30, never 10. I upped it to 90. Are you in MailScanner.conf 
editing this entry? Check out the FAQ:

http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/210.html

I was getting the exact same problems before upping my timeout value.

Vic

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From vachanta at GMAIL.COM  Mon Nov 29 22:56:11 2004
From: vachanta at GMAIL.COM (Venkata Achanta)
Date: Thu Jan 12 21:27:44 2006
Subject: Mailscanner Spamassassin timing out
Message-ID: <mailman.5261.1137101264.24926.mailscanner@lists.mailscanner.info>

Billy,

What version of spamassasin are you running ?

Did you recently upgrade SA and MS ?

Try to bump timeout to 60-80 and see what happens.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From marco at XSSNET.COM  Mon Nov 29 22:58:04 2004
From: marco at XSSNET.COM (Marco Benton)
Date: Thu Jan 12 21:27:44 2006
Subject: Mailscanner Spamassassin timing out
Message-ID: <mailman.5262.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Billy Pumphrey wrote:

| I let it run for a bit and it seems to be at least processing some
| messages now and then before it times out again.  I had this
| problem before but I increase the timeout and it worked last time.
| Maybe it is just too slow of a machine and is just getting killed
| right now?
|
| 500mhz 384mb RAM Average messages per day        2,462
|
| The logwatch that returns usually shows that there were load
| volumes of around 12 about 4-5 times.
|

you need more memory.  try decreasing the Max Children to 1 or 2 and
see how that works.  processor speed is fine.

- --

Marco Benton - BOFH, BSMFH
Network Consultant


BOFH excuse #293: The cause of the problem is: PCMCIA slave driver

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBq6l72+PYgoYkw8ERAvWNAKDL3NTP5iDwYk8TnTUGerEYWYS+5gCfRF48
+yPdTQJle3AXl7/HOLA8efM=
=auk8
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From billy at PLANETGEEK.BIZ  Mon Nov 29 23:04:15 2004
From: billy at PLANETGEEK.BIZ (Billy Pumphrey)
Date: Thu Jan 12 21:27:44 2006
Subject: Mailscanner Spamassassin timing out
Message-ID: <mailman.5263.1137101264.24926.mailscanner@lists.mailscanner.info>

I have not upgraded to the recent version just because I don't want to screw
it up.  I plan on rebuilding the machine in the beginning of the year
though.

Here is my entry in the conf file:
Spam List = # ORDB-RBL spamcop.net spamhaus.org # MAPS-RBL+ costs money
(except
.ac.uk)

# If an individual "Spam List" or "Spam Domain List" check takes longer
# that this (in seconds), the check is abandoned and the timeout noted.
Spam List Timeout = 40 # was 10

# The maximum number of timeouts caused by any individual "Spam List" or
# "Spam Domain List" before it is marked as "unavailable". Once marked,
# the list will be ignored until the next automatic re-start (see
# "Restart Every" for the longest time it will wait).
# This can also be the filename of a ruleset.
Max Spam List Timeouts = 7


Is that the correct one?
-----Original Message-----
From: Venkata Achanta [mailto:vachanta@GMAIL.COM]
Sent: Monday, November 29, 2004 5:56 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Mailscanner Spamassassin timing out

Billy,

What version of spamassasin are you running ?

Did you recently upgrade SA and MS ?

Try to bump timeout to 60-80 and see what happens.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From billy at PLANETGEEK.BIZ  Mon Nov 29 23:09:12 2004
From: billy at PLANETGEEK.BIZ (Billy Pumphrey)
Date: Thu Jan 12 21:27:44 2006
Subject: Mailscanner Spamassassin timing out
Message-ID: <mailman.5264.1137101264.24926.mailscanner@lists.mailscanner.info>

According to the maillog I am running version 4.25-14.

The time outs cause it to turn of RBL checking so I will have to turn that
back on, don't know where that is right off hand.

I turned the Max Children to 3 ( one more than what Marco suggested ).

I turned the timeout on 80.  I'll see how that does.

-----Original Message-----
From: Venkata Achanta [mailto:vachanta@GMAIL.COM]
Sent: Monday, November 29, 2004 5:56 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Mailscanner Spamassassin timing out

Billy,

What version of spamassasin are you running ?

Did you recently upgrade SA and MS ?

Try to bump timeout to 60-80 and see what happens.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From vachanta at GMAIL.COM  Mon Nov 29 23:28:49 2004
From: vachanta at GMAIL.COM (Venkata Achanta)
Date: Thu Jan 12 21:27:44 2006
Subject: Mailscanner Spamassassin timing out
Message-ID: <mailman.5265.1137101264.24926.mailscanner@lists.mailscanner.info>

SpamAssassin Timeout =
Max SpamAssassin Timeouts =
What are these set to in your conf file ?



On Mon, 29 Nov 2004 18:04:15 -0500, Billy Pumphrey <billy@PLANETGEEK.BIZ>
wrote:

>I have not upgraded to the recent version just because I don't want to
screw
>it up.  I plan on rebuilding the machine in the beginning of the year
>though.
>
>Here is my entry in the conf file:
>Spam List = # ORDB-RBL spamcop.net spamhaus.org # MAPS-RBL+ costs money
>(except
>.ac.uk)
>
># If an individual "Spam List" or "Spam Domain List" check takes longer
># that this (in seconds), the check is abandoned and the timeout noted.
>Spam List Timeout = 40 # was 10
>
># The maximum number of timeouts caused by any individual "Spam List" or
># "Spam Domain List" before it is marked as "unavailable". Once marked,
># the list will be ignored until the next automatic re-start (see
># "Restart Every" for the longest time it will wait).
># This can also be the filename of a ruleset.
>Max Spam List Timeouts = 7
>
>
>Is that the correct one?
>-----Original Message-----
>From: Venkata Achanta [mailto:vachanta@GMAIL.COM]
>Sent: Monday, November 29, 2004 5:56 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Mailscanner Spamassassin timing out
>
>Billy,
>
>What version of spamassasin are you running ?
>
>Did you recently upgrade SA and MS ?
>
>Try to bump timeout to 60-80 and see what happens.
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!

SpamAssassin Timeout = 120

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ugob at CAMO-ROUTE.COM  Mon Nov 29 23:39:52 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:44 2006
Subject: Mailscanner Spamassassin timing out
Message-ID: <mailman.5266.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Marco Benton wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Billy Pumphrey wrote:
>
> | I let it run for a bit and it seems to be at least processing some
> | messages now and then before it times out again.  I had this
> | problem before but I increase the timeout and it worked last time.
> | Maybe it is just too slow of a machine and is just getting killed
> | right now?
> |
> | 500mhz 384mb RAM Average messages per day        2,462
> |
> | The logwatch that returns usually shows that there were load
> | volumes of around 12 about 4-5 times.
> |
>
> you need more memory.  try decreasing the Max Children to 1 or 2 and
> see how that works.  processor speed is fine.

Please run 'free' to see if you have lots of swap used.  And then
'vmstat 2' and see if you have lots of page ins/page outs.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mkettler at EVI-INC.COM  Tue Nov 30 00:25:53 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:44 2006
Subject: Mailscanner Spamassassin timing out
Message-ID: <mailman.5267.1137101264.24926.mailscanner@lists.mailscanner.info>

At 05:43 PM 11/29/2004, Billy Pumphrey wrote:
>I searched the archive and found plenty about the errors of it timing out,
>but I just cannot find out what the problem is.
>
>Did I change anything?


Version of SA?
Is bayes used?

If bayes is used, check for bayes "expire" files laying next to your bayes
db files.

If you have those disable bayes_auto_expire in
/etc/mail/spamassassin/local.cf and set "Rebuild Bayes Every" in
MailScanner.conf.

Might also want to make a cron job run sa-learn --force-expire daily.

MailScanner isn't very tolerant of SA's default tendency to spend 2-3
minutes doing housekeeping on the bayes DB once in a rare while (once a day
or so, depending on how many tokens enter the DB)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ugob at CAMO-ROUTE.COM  Tue Nov 30 02:28:18 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:44 2006
Subject: Tagging virus
Message-ID: <mailman.5268.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Robin, Rob wrote:
> All,
>
>         I search the archive w/ 'tag virus' 'virus tag', don't really find anything relevant.
>
>         I read through the .conf file, couldn't find anything. Chances are the answer is 'no', I am asking for the
> confirmation here. Or perhaps, I missed something in the config file.
>
>         Since virus scanner is not without false positive rate, however small it may be, it would be nice for me to simply tag the mails w/ just the subject line "{Virus?}" w/ the attachment intact. I am aware that there is a potential risk of software email client bug that can make such tagging ineffectual, I just would like to offer it to the customers. I am also very aware that some people just couldn't resist opening up the attachment :-) and need to protect themselves from themselves.
>
>         Right now, I have 'silently discard', 'tag and remove the attachment' option. I would like to add the option of 'tag while leaving the attachment intact'. I am extremely conservative in not losing any potential emails or benign attachments and thus see that the third choice might be preferable to some customers.
>
>         Is 'tagging w/o removing the attachment' supported in MailScanner ?

It is not in a stock install.  They can all be quarantined, though.

>
>         Please take my question as a strictly technical one not a policy one :-).
>
> Thanks,
> ------------------------
> Rob Robin
> Network Analyst
> Green Apple, Inc.
> 740-653-9890
> rrobin@greenapple.com
> www.greenapple.com
> Internet access, hosting and development solutions since 1995.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From llasad1 at YAHOO.COM  Tue Nov 30 02:59:07 2004
From: llasad1 at YAHOO.COM (lester lasad)
Date: Thu Jan 12 21:27:44 2006
Subject: off topic:  email forwarding assistance/guidance needed
    RESOLVED
Message-ID: <mailman.5269.1137101264.24926.mailscanner@lists.mailscanner.info>

--- "James R. Stevens"
<jstevens@ATHENSDISTRIBUTING.COM> wrote:

> Please read this short explanation.
>
> http://www.sendmail.org/virtual-hosting.html
>
> What your trying to do is pretty simple and very
> stable (In my
> experience)
>
> *** NOTE: make sure you have each domain name and
> sub-domain (Name-space
> listed in your local-host-names file.
> If not you will see MX loops. (File maybe located in
> /etc/mail)
>
> -----Original Message-----
> From: lester lasad [mailto:llasad1@YAHOO.COM]
> Sent: Monday, November 29, 2004 12:15 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: off topic: email forwarding
> assistance/guidance needed
>
> --- Marco Benton <marco@XSSNET.COM> wrote:
> >
> > lester lasad wrote:
> >
> > | <...snip...>
> > |
> > |
> > | I would like to explain my setup a little
> further.
> >  I have one
> > | sendmail server that relays (does not deliver to
> > local mail files
> > | on the server) to 2 seperate domains/hosts.  The
> > MX record for both
> > | domains (abc.com and xyz.com) point to my one
> > sendmail server (one
> > | ip).  With that said, do you see any problems
> > (mail routing loops)
> > | using the virtusertable? for example, in the
> > virtusertable I would
> > | put: lester@abc.com       lester@xyz.com
> > |
> > |> From my understanding that should relay the
> mail
> > to
> > | the server hosting the xyz.com domain.  However,
> I
> > still get mail
> > | routing loop errors.
> > |
> > | Thanks for your assistance
> >
> >
> > urr.  you mention it doesnt deliver mail to local
> > users.  so where does it deliver mail to?
>
> Mail is not delivered locally because it is acting
> as
> a relay server.  the mx records for both the abc.com
> and xyz.com domains point to my sendmail server.
> From
> there I am using /etc/mail/mailertable to relay the
> mail to 2 seperate servers (one server is for
> abc.com
> and the other is for xyz.com).
>
> >from your description, mail will *have* to
> > be delivered locally as you have both domains
> > pointed to that one
> > server...so it wouldnt make sense to have a
> > virtusertable unless you
> > wanted to deliver the mail somewhere else, hence
> the
> > loop errors.
> >
> > it might be better to use /etc/mail/domaintable
> for
> > what you are
> > doing, simple domain remapping.
>
> I am using webmin to administer my server.  When I
> clicked on the domaintable option, I received the
> following:  "Your sendmail configuration does not
> have
> the domain mapping (domaintable) feature enabled"
> Click here to eable it.  It took me to the sendmail
> m4
> and I do not see an option to enable the
> domaintable.
> Where can I enable this option?
>
> >
> > - --
> >
> > Marco Benton - BOFH, BSMFH
> > Network Consultant
>
>
Thanks for info, the problem was the local-host-names,
I seemed to have everything setup except for that. I
added the xyz.com domain and the virtusertable worked
as described.  Thanks again for all of the suggestions.

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dfilchak at sympatico.ca  Tue Nov 30 03:31:44 2004
From: dfilchak at sympatico.ca (Dave Filchak)
Date: Thu Jan 12 21:27:44 2006
Subject: quoted-printable octet-stream issues
Message-ID: <mailman.5270.1137101264.24926.mailscanner@lists.mailscanner.info>

This problem does not always manifest itself with Outlook as everyone
thinks. In our case, any PDF we make out of Acrobat is fine, even if sending
it with Outlook. We run into problems with PDFs created in other
applications, for instance, the Quickbooks accounting system. In this case,
we need to save the PDF that is created from QB, then open it in Acrobat and
re-save it. Then we can send it with Outlook and the PDF arrives in fine
condition. It has nothing to do with Outlook, at least in our case.

Dave

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Martin Hepworth
Sent: Monday, November 29, 2004 1:00 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: [MAILSCANNER] quoted-printable octet-stream issues

Chuck

what version of MS are you using. I think 4.35 has a fix for this issue, the
problem is Outleek, rather than exchange. Anyway upgrading to
4.35-11 fixed the issue for the one person affected here..

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Chuck Foster wrote:
> Hi,
>
> I've been looking at a problem with some PDF messages that were being
> corrupted on arrival; looking at it more closely I can see that our
> Exchange server is sending out the attachments as quoted-printable and
> by the time they've been through MailScanner the content has been
> changed, specifically the midline =0As have now become physical
> newlines and (I
> guess) are being mangled through the MTA (sendmail).
>
> I noted that there is some code to 'massage' quoted-printable in
> Message.pm, and the file on disk seems to be fine, so I would think
> the problem is in re-encoding the content back to quoted-printable on
> the way out.
>
> Is this a common problem that has now been fixed (I couldn't find any
> reference on a net trawl)? Obviously this doesn't occur for
> BASE64-encoded messages.
>
> Regards,
> Chuck
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
> archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the system manager.

This footnote confirms that this email message has been swept for the
presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From clicknow at SWIFTDSL.COM.AU  Tue Nov 30 04:03:07 2004
From: clicknow at SWIFTDSL.COM.AU (Brian Parish)
Date: Thu Jan 12 21:27:44 2006
Subject: What does this mean? MailScanner: Could not analyze message
Message-ID: <mailman.5271.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Today with no changes in configuration, senders to accounts hosted here
started getting messages like this:

---------------------

X-Univex Systems Pty Ltd-MailScanner: generated

Our virus detector failed to completely analyse a message you sent:-
  To: brian@univexsystems.com
  Subject: The Application for Network Technician
  Date: Tue Nov 30 07:08:13 2004
Any parts of the message that could not be analysed will not have been
delivered.

If you are using Microsoft Outlook, we strongly recommend you change your
outgoing message format from "Rich Text" to "HTML" or "Plain Text".

1) Click on the "Tools" menu and choose "Options..."
2) Got to the "Mail Format" tab
3) For message format, select "HTML" or "Plain text"
4) Click OK

The virus detector said this about the message:
Report: MailScanner: Could not analyze message


--
MailScanner
Email Virus Scanner
www.mailscanner.info
MailScanner thanks transtec Computers for their support

---------------------

What gives?  Any pointers on what to look at?

TIA
Brian

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From clicknow at SWIFTDSL.COM.AU  Tue Nov 30 04:33:40 2004
From: clicknow at SWIFTDSL.COM.AU (Brian Parish)
Date: Thu Jan 12 21:27:45 2006
Subject: What does this mean? MailScanner: Could not analyze message
Message-ID: <mailman.5272.1137101264.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Tue, 30 Nov 2004 03:03 pm, Brian Parish wrote:
> Today with no changes in configuration, senders to accounts hosted here
> started getting messages like this:
>
> ---------------------
>
> X-Univex Systems Pty Ltd-MailScanner: generated
>
> Our virus detector failed to completely analyse a message you sent:-
>   To: brian@univexsystems.com
>   Subject: The Application for Network Technician
>   Date: Tue Nov 30 07:08:13 2004
> Any parts of the message that could not be analysed will not have been
> delivered.
>
> If you are using Microsoft Outlook, we strongly recommend you change your
> outgoing message format from "Rich Text" to "HTML" or "Plain Text".
>
> 1) Click on the "Tools" menu and choose "Options..."
> 2) Got to the "Mail Format" tab
> 3) For message format, select "HTML" or "Plain text"
> 4) Click OK
>
> The virus detector said this about the message:
> Report: MailScanner: Could not analyze message
>
>
> --
> MailScanner
> Email Virus Scanner
> www.mailscanner.info
> MailScanner thanks transtec Computers for their support
>
> ---------------------
>
Looking further at this, I see

Cannot parse /var/spool/MailScanner/incoming/19497/5FA2B6715.header and ,
Can't locate object method "init" via package "MIME::Decoder::QuotedPrint"
at /usr/lib/perl5/vendor_perl/5.8.3/MIME/Decoder.pm line 173.

messages in the log as well as:

Compilation failed in require
at /usr/lib/perl5/vendor_perl/5.8.3/MIME/Decoder.pm line 171.

then lots of postfix messages warning of corrupt messages.

Looks like something has gone horribly wrong with my MailScanner install, but
without any known changes to the system.  I see similar messages reported in
another thread: "Sudden problem..."

Julian supplied a Message.pm file in response to this.  Should I install this
as well?  I am concerned about all these corrupt messages.

thanks again in advance
Brian

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From clicknow at SWIFTDSL.COM.AU  Tue Nov 30 05:21:20 2004
From: clicknow at SWIFTDSL.COM.AU (Brian Parish)
Date: Thu Jan 12 21:27:45 2006
Subject: What does this mean? MailScanner: Could not analyze message
Message-ID: <mailman.5273.1137101265.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Tue, 30 Nov 2004 03:33 pm, Brian Parish wrote:
> On Tue, 30 Nov 2004 03:03 pm, Brian Parish wrote:
> > Today with no changes in configuration, senders to accounts hosted here
> > started getting messages like this:
> >
> > ---------------------
> >
> > X-Univex Systems Pty Ltd-MailScanner: generated
> >
> > Our virus detector failed to completely analyse a message you sent:-
> >   To: brian@univexsystems.com
> >   Subject: The Application for Network Technician
> >   Date: Tue Nov 30 07:08:13 2004
> > Any parts of the message that could not be analysed will not have been
> > delivered.
> >
> > If you are using Microsoft Outlook, we strongly recommend you change your
> > outgoing message format from "Rich Text" to "HTML" or "Plain Text".
> >
> > 1) Click on the "Tools" menu and choose "Options..."
> > 2) Got to the "Mail Format" tab
> > 3) For message format, select "HTML" or "Plain text"
> > 4) Click OK
> >
> > The virus detector said this about the message:
> > Report: MailScanner: Could not analyze message
> >
> >
> > --
> > MailScanner
> > Email Virus Scanner
> > www.mailscanner.info
> > MailScanner thanks transtec Computers for their support
> >
> > ---------------------
>
> Looking further at this, I see
>
> Cannot parse /var/spool/MailScanner/incoming/19497/5FA2B6715.header and ,
> Can't locate object method "init" via package "MIME::Decoder::QuotedPrint"
> at /usr/lib/perl5/vendor_perl/5.8.3/MIME/Decoder.pm line 173.
>
> messages in the log as well as:
>
> Compilation failed in require
> at /usr/lib/perl5/vendor_perl/5.8.3/MIME/Decoder.pm line 171.
>
> then lots of postfix messages warning of corrupt messages.
>
> Looks like something has gone horribly wrong with my MailScanner install,
> but without any known changes to the system.  I see similar messages
> reported in another thread: "Sudden problem..."
>
> Julian supplied a Message.pm file in response to this.  Should I install
> this as well?  I am concerned about all these corrupt messages.
>
> thanks again in advance
> Brian
>
Sorry to keep talking to myself, but as I look more at this new info emerges.
In the absence of any othe ideas, I restarted MailScanner.  This appears to
have resolved the issue - at least for the moment.  No more messages in the
log and so far no bounces reported.  Still hunting for a cause though.

thanks again
Brian

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From chuck.foster at STREAMSHIELD.COM  Tue Nov 30 08:34:15 2004
From: chuck.foster at STREAMSHIELD.COM (Chuck Foster)
Date: Thu Jan 12 21:27:45 2006
Subject: quoted-printable octet-stream issues
Message-ID: <mailman.5274.1137101265.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]


MailScanner reports back 4.32.5 (I didn't think it was quite that old,
hmm!).
Time to upgrade ...

This problem actually cropped up because of someone using Lotus Notes,
which also preferred quoted-printable over base64 encoding for PDF
attachments (and Excel). Ho hum.

Thanks!
Chuck


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
Behalf Of Martin Hepworth
Sent: 29 November 2004 18:00
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: quoted-printable octet-stream issues


Chuck

what version of MS are you using. I think 4.35 has a fix for this issue,
the problem is Outleek, rather than exchange. Anyway upgrading to
4.35-11 fixed the issue for the one person affected here..

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300



This message should be regarded as confidential. If you have received
this
email in error please notify the sender and destroy it immediately.
Statements of intent shall only become binding when confirmed in hard
copy
by an authorized signatory.
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From martinh at SOLID-STATE-LOGIC.COM  Tue Nov 30 09:10:52 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:45 2006
Subject: quoted-printable octet-stream issues
Message-ID: <mailman.5275.1137101265.24926.mailscanner@lists.mailscanner.info>

DAve

So does 4.35-11 fix the issue???

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Dave Filchak wrote:
> This problem does not always manifest itself with Outlook as everyone
> thinks. In our case, any PDF we make out of Acrobat is fine, even if sending
> it with Outlook. We run into problems with PDFs created in other
> applications, for instance, the Quickbooks accounting system. In this case,
> we need to save the PDF that is created from QB, then open it in Acrobat and
> re-save it. Then we can send it with Outlook and the PDF arrives in fine
> condition. It has nothing to do with Outlook, at least in our case.
>
> Dave
>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
> Of Martin Hepworth
> Sent: Monday, November 29, 2004 1:00 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: [MAILSCANNER] quoted-printable octet-stream issues
>
> Chuck
>
> what version of MS are you using. I think 4.35 has a fix for this issue, the
> problem is Outleek, rather than exchange. Anyway upgrading to
> 4.35-11 fixed the issue for the one person affected here..
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Chuck Foster wrote:
>
>>Hi,
>>
>>I've been looking at a problem with some PDF messages that were being
>>corrupted on arrival; looking at it more closely I can see that our
>>Exchange server is sending out the attachments as quoted-printable and
>>by the time they've been through MailScanner the content has been
>>changed, specifically the midline =0As have now become physical
>>newlines and (I
>>guess) are being mangled through the MTA (sendmail).
>>
>>I noted that there is some code to 'massage' quoted-printable in
>>Message.pm, and the file on disk seems to be fine, so I would think
>>the problem is in re-encoding the content back to quoted-printable on
>>the way out.
>>
>>Is this a common problem that has now been fixed (I couldn't find any
>>reference on a net trawl)? Obviously this doesn't occur for
>>BASE64-encoded messages.
>>
>>Regards,
>>Chuck
>>
>>------------------------ MailScanner list ------------------------ To
>>unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
>>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and intended
> solely for the use of the individual or entity to whom they are addressed.
> If you have received this email in error please notify the system manager.
>
> This footnote confirms that this email message has been swept for the
> presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
> archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Tue Nov 30 09:13:11 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:45 2006
Subject: What does this mean? MailScanner: Could not analyze message
Message-ID: <mailman.5276.1137101265.24926.mailscanner@lists.mailscanner.info>

Brian

what version of MailScanner and what version of the perl modules

"MailScanner -v" will give you the info..


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Brian Parish wrote:
> On Tue, 30 Nov 2004 03:33 pm, Brian Parish wrote:
>
>>On Tue, 30 Nov 2004 03:03 pm, Brian Parish wrote:
>>
>>>Today with no changes in configuration, senders to accounts hosted here
>>>started getting messages like this:
>>>
>>>---------------------
>>>
>>>X-Univex Systems Pty Ltd-MailScanner: generated
>>>
>>>Our virus detector failed to completely analyse a message you sent:-
>>>  To: brian@univexsystems.com
>>>  Subject: The Application for Network Technician
>>>  Date: Tue Nov 30 07:08:13 2004
>>>Any parts of the message that could not be analysed will not have been
>>>delivered.
>>>
>>>If you are using Microsoft Outlook, we strongly recommend you change your
>>>outgoing message format from "Rich Text" to "HTML" or "Plain Text".
>>>
>>>1) Click on the "Tools" menu and choose "Options..."
>>>2) Got to the "Mail Format" tab
>>>3) For message format, select "HTML" or "Plain text"
>>>4) Click OK
>>>
>>>The virus detector said this about the message:
>>>Report: MailScanner: Could not analyze message
>>>
>>>
>>>--
>>>MailScanner
>>>Email Virus Scanner
>>>www.mailscanner.info
>>>MailScanner thanks transtec Computers for their support
>>>
>>>---------------------
>>
>>Looking further at this, I see
>>
>>Cannot parse /var/spool/MailScanner/incoming/19497/5FA2B6715.header and ,
>>Can't locate object method "init" via package "MIME::Decoder::QuotedPrint"
>>at /usr/lib/perl5/vendor_perl/5.8.3/MIME/Decoder.pm line 173.
>>
>>messages in the log as well as:
>>
>>Compilation failed in require
>>at /usr/lib/perl5/vendor_perl/5.8.3/MIME/Decoder.pm line 171.
>>
>>then lots of postfix messages warning of corrupt messages.
>>
>>Looks like something has gone horribly wrong with my MailScanner install,
>>but without any known changes to the system.  I see similar messages
>>reported in another thread: "Sudden problem..."
>>
>>Julian supplied a Message.pm file in response to this.  Should I install
>>this as well?  I am concerned about all these corrupt messages.
>>
>>thanks again in advance
>>Brian
>>
>
> Sorry to keep talking to myself, but as I look more at this new info emerges.
> In the absence of any othe ideas, I restarted MailScanner.  This appears to
> have resolved the issue - at least for the moment.  No more messages in the
> log and so far no bounces reported.  Still hunting for a cause though.
>
> thanks again
> Brian
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From m.sapsed at BANGOR.AC.UK  Tue Nov 30 09:24:05 2004
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:27:45 2006
Subject: IRC support
Message-ID: <mailman.5277.1137101265.24926.mailscanner@lists.mailscanner.info>

Julian Field wrote:
> I have just installed a browser-based IRC client so you can get onto the
> #mailscanner channel without needing any software on your
> PC/Mac/whatever, just a Java-capable web browser.
>
> Go to
>    www.mailscanner.info/irc
> and get straight on.

Would I be right in spotting that this requires outbound access to
thunder.stealer.net on port 6667? (or was that something else lurking on
my pc?!) In which case people having trouble connecting might have
firewall issues?

Cheers,

Martin

--
Martin Sapsed            "I've got 8 little fingers and only 2 thumbs,
Microcomputer Support                      won't you leave me in peace
Information Services                        while I get the job done?"
University of Wales, Bangor             Chris Rea, "I'm working on it"

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Anjana.Patel at CRANFIELD.AC.UK  Tue Nov 30 09:32:59 2004
From: Anjana.Patel at CRANFIELD.AC.UK (Patel, Anjana)
Date: Thu Jan 12 21:27:45 2006
Subject: What does this mean? MailScanner: Could not analyze message
Message-ID: <mailman.5278.1137101265.24926.mailscanner@lists.mailscanner.info>

Brian Parish wrote:

> > Looking further at this, I see
> >
> > Cannot parse /var/spool/MailScanner/incoming/19497/5FA2B6715.header
and
> ,
> > Can't locate object method "init" via package
> "MIME::Decoder::QuotedPrint"
> > at /usr/lib/perl5/vendor_perl/5.8.3/MIME/Decoder.pm line 173.

I got similar messages in my logs after I installed the latest Perl
modules (using CPAN) on a RedHat 9 system in preparation for upgrading
mailscanner to the latest stable.  Forcing a reinstall of MIME::Base64
and MIME::Tools solved the problem.  I suspect that there may be a
specific order in which these modules need to be installed.

Anjana

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave
mailscanner' in the body of the email. Before posting, read the MAQ
(http://www.mailscanner.biz/maq/) and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From clicknow at SWIFTDSL.COM.AU  Tue Nov 30 12:10:39 2004
From: clicknow at SWIFTDSL.COM.AU (Brian Parish)
Date: Thu Jan 12 21:27:45 2006
Subject: What does this mean? MailScanner: Could not analyze message
Message-ID: <mailman.5279.1137101265.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hmmm.  Maybe this symptomatic of another problem?

# MailScanner -v
Cannot open config file -v, No such file or directory
at /usr/lib/MailScanner/MailScanner/Config.pm line 575.
[root@server root]# rpm -qa | grep mailsc
mailscanner-4.31.6-1

Probably time I upgraded, but I am still at a loss to know why this started
without any changes and why restarting MailScanner seems to have fixed it.

cheers
Brian

On Tue, 30 Nov 2004 08:13 pm, Martin Hepworth wrote:
> Brian
>
> what version of MailScanner and what version of the perl modules
>
> "MailScanner -v" will give you the info..
>
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
> Brian Parish wrote:
> > On Tue, 30 Nov 2004 03:33 pm, Brian Parish wrote:
> >>On Tue, 30 Nov 2004 03:03 pm, Brian Parish wrote:
> >>>Today with no changes in configuration, senders to accounts hosted here
> >>>started getting messages like this:
> >>>
> >>>---------------------
> >>>
> >>>X-Univex Systems Pty Ltd-MailScanner: generated
> >>>
> >>>Our virus detector failed to completely analyse a message you sent:-
> >>>  To: brian@univexsystems.com
> >>>  Subject: The Application for Network Technician
> >>>  Date: Tue Nov 30 07:08:13 2004
> >>>Any parts of the message that could not be analysed will not have been
> >>>delivered.
> >>>
> >>>If you are using Microsoft Outlook, we strongly recommend you change
> >>> your outgoing message format from "Rich Text" to "HTML" or "Plain
> >>> Text".
> >>>
> >>>1) Click on the "Tools" menu and choose "Options..."
> >>>2) Got to the "Mail Format" tab
> >>>3) For message format, select "HTML" or "Plain text"
> >>>4) Click OK
> >>>
> >>>The virus detector said this about the message:
> >>>Report: MailScanner: Could not analyze message
> >>>
> >>>
> >>>--
> >>>MailScanner
> >>>Email Virus Scanner
> >>>www.mailscanner.info
> >>>MailScanner thanks transtec Computers for their support
> >>>
> >>>---------------------
> >>
> >>Looking further at this, I see
> >>
> >>Cannot parse /var/spool/MailScanner/incoming/19497/5FA2B6715.header and ,
> >>Can't locate object method "init" via package
> >> "MIME::Decoder::QuotedPrint" at
> >> /usr/lib/perl5/vendor_perl/5.8.3/MIME/Decoder.pm line 173.
> >>
> >>messages in the log as well as:
> >>
> >>Compilation failed in require
> >>at /usr/lib/perl5/vendor_perl/5.8.3/MIME/Decoder.pm line 171.
> >>
> >>then lots of postfix messages warning of corrupt messages.
> >>
> >>Looks like something has gone horribly wrong with my MailScanner install,
> >>but without any known changes to the system.  I see similar messages
> >>reported in another thread: "Sudden problem..."
> >>
> >>Julian supplied a Message.pm file in response to this.  Should I install
> >>this as well?  I am concerned about all these corrupt messages.
> >>
> >>thanks again in advance
> >>Brian
> >
> > Sorry to keep talking to myself, but as I look more at this new info
> > emerges. In the absence of any othe ideas, I restarted MailScanner.  This
> > appears to have resolved the issue - at least for the moment.  No more
> > messages in the log and so far no bounces reported.  Still hunting for a
> > cause though.
> >
> > thanks again
> > Brian
> >
> > ------------------------ MailScanner list ------------------------
> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> > Support MailScanner development - buy the book off the website!
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Tue Nov 30 12:16:29 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:45 2006
Subject: What does this mean? MailScanner: Could not analyze message
Message-ID: <mailman.5280.1137101265.24926.mailscanner@lists.mailscanner.info>

Brian

nope, the -v flag first appeared in 4.32.....

the sudden problem was to an issue with 4.35-11 and recipient
notifications....

Might be worth making sure you are running the latest versions of
MIME::base64 etc...

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Brian Parish wrote:
> Hmmm.  Maybe this symptomatic of another problem?
>
> # MailScanner -v
> Cannot open config file -v, No such file or directory
> at /usr/lib/MailScanner/MailScanner/Config.pm line 575.
> [root@server root]# rpm -qa | grep mailsc
> mailscanner-4.31.6-1
>
> Probably time I upgraded, but I am still at a loss to know why this started
> without any changes and why restarting MailScanner seems to have fixed it.
>
> cheers
> Brian
>
> On Tue, 30 Nov 2004 08:13 pm, Martin Hepworth wrote:
>
>>Brian
>>
>>what version of MailScanner and what version of the perl modules
>>
>>"MailScanner -v" will give you the info..
>>
>>
>>--
>>Martin Hepworth
>>Snr Systems Administrator
>>Solid State Logic
>>Tel: +44 (0)1865 842300
>>
>>Brian Parish wrote:
>>
>>>On Tue, 30 Nov 2004 03:33 pm, Brian Parish wrote:
>>>
>>>>On Tue, 30 Nov 2004 03:03 pm, Brian Parish wrote:
>>>>
>>>>>Today with no changes in configuration, senders to accounts hosted here
>>>>>started getting messages like this:
>>>>>
>>>>>---------------------
>>>>>
>>>>>X-Univex Systems Pty Ltd-MailScanner: generated
>>>>>
>>>>>Our virus detector failed to completely analyse a message you sent:-
>>>>> To: brian@univexsystems.com
>>>>> Subject: The Application for Network Technician
>>>>> Date: Tue Nov 30 07:08:13 2004
>>>>>Any parts of the message that could not be analysed will not have been
>>>>>delivered.
>>>>>
>>>>>If you are using Microsoft Outlook, we strongly recommend you change
>>>>>your outgoing message format from "Rich Text" to "HTML" or "Plain
>>>>>Text".
>>>>>
>>>>>1) Click on the "Tools" menu and choose "Options..."
>>>>>2) Got to the "Mail Format" tab
>>>>>3) For message format, select "HTML" or "Plain text"
>>>>>4) Click OK
>>>>>
>>>>>The virus detector said this about the message:
>>>>>Report: MailScanner: Could not analyze message
>>>>>
>>>>>
>>>>>--
>>>>>MailScanner
>>>>>Email Virus Scanner
>>>>>www.mailscanner.info
>>>>>MailScanner thanks transtec Computers for their support
>>>>>
>>>>>---------------------
>>>>
>>>>Looking further at this, I see
>>>>http://news.bbc.co.uk/
>>>>Cannot parse /var/spool/MailScanner/incoming/19497/5FA2B6715.header and ,
>>>>Can't locate object method "init" via package
>>>>"MIME::Decoder::QuotedPrint" at
>>>>/usr/lib/perl5/vendor_perl/5.8.3/MIME/Decoder.pm line 173.
>>>>
>>>>messages in the log as well as:
>>>>
>>>>Compilation failed in require
>>>>at /usr/lib/perl5/vendor_perl/5.8.3/MIME/Decoder.pm line 171.
>>>>
>>>>then lots of postfix messages warning of corrupt messages.
>>>>
>>>>Looks like something has gone horribly wrong with my MailScanner install,
>>>>but without any known changes to the system.  I see similar messages
>>>>reported in another thread: "Sudden problem..."
>>>>
>>>>Julian supplied a Message.pm file in response to this.  Should I install
>>>>this as well?  I am concerned about all these corrupt messages.
>>>>
>>>>thanks again in advance
>>>>Brian
>>>
>>>Sorry to keep talking to myself, but as I look more at this new info
>>>emerges. In the absence of any othe ideas, I restarted MailScanner.  This
>>>appears to have resolved the issue - at least for the moment.  No more
>>>messages in the log and so far no bounces reported.  Still hunting for a
>>>cause though.
>>>
>>>thanks again
>>>Brian
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>
>>**********************************************************************
>>
>>This email and any files transmitted with it are confidential and
>>intended solely for the use of the individual or entity to whom they
>>are addressed. If you have received this email in error please notify
>>the system manager.
>>
>>This footnote confirms that this email message has been swept
>>for the presence of computer viruses and is believed to be clean.
>>
>>**********************************************************************
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Tue Nov 30 12:22:56 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:45 2006
Subject: Phishing version and mailto: tag
Message-ID: <mailman.5281.1137101265.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Interesting one that, I had already put in some code to handle mailto
links. However, I have added some more so that it doesn't bother
checking mailto links at all, as sending an email to one address instead
of another is (a) obvious and (b) relatively harmless.

Leonard Hermens wrote:

> Hello,
>
> I am running MailScanner version 4.35.11 and Message.pm version
> 1.126.2.172
> (2004/11/29) on Red Hat Linux 9, Perl 5.8.0
>
> I am still getting phishing fraud notices when the mailto: doesn't match
> the URL text, for example:
>
> Nov 29 14:24:48 lxclk0100 MailScanner[29724]: Found phishing fraud from
> xxxxx.yyyyy@domain.com claiming to be mailto:xxxxx.yyyyy@domain.com in
> iATMOTr29939
>
> I seem to recall that Message.pm was patched to allow this to pass.
>
> Do I need to run 4.36.1-1 for mailto: to check correctly with the latest
> Message.pm? Or should 4.35.11 be okay? I'm just a bit versioning confused
> right now. :)


--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Application/X-ZIP-COMPRESSED  54KB. ]
    [ Unable to print this part. ]


From mailscanner at ecs.soton.ac.uk  Tue Nov 30 12:24:00 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:45 2006
Subject: Tagging virus
Message-ID: <mailman.5282.1137101265.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

No it is not possible, sorry.

Robin, Rob wrote:

>All,
>
>        I search the archive w/ 'tag virus' 'virus tag', don't really find anything relevant.
>
>        I read through the .conf file, couldn't find anything. Chances are the answer is 'no', I am asking for the
>confirmation here. Or perhaps, I missed something in the config file.
>
>        Since virus scanner is not without false positive rate, however small it may be, it would be nice for me to simply tag the mails w/ just the subject line "{Virus?}" w/ the attachment intact. I am aware that there is a potential risk of software email client bug that can make such tagging ineffectual, I just would like to offer it to the customers. I am also very aware that some people just couldn't resist opening up the attachment :-) and need to protect themselves from themselves.
>
>        Right now, I have 'silently discard', 'tag and remove the attachment' option. I would like to add the option of 'tag while leaving the attachment intact'. I am extremely conservative in not losing any potential emails or benign attachments and thus see that the third choice might be preferable to some customers.
>
>        Is 'tagging w/o removing the attachment' supported in MailScanner ?
>
>        Please take my question as a strictly technical one not a policy one :-).
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Tue Nov 30 12:26:17 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:45 2006
Subject: What does this mean? MailScanner: Could not analyze message
Message-ID: <mailman.5283.1137101265.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

To start with, remove the spaces from your %org-name%. As it clearly
says in MailScanner.conf, you are NOT allowed spaces in this.

Brian Parish wrote:

>Today with no changes in configuration, senders to accounts hosted here
>started getting messages like this:
>
>---------------------
>
>X-Univex Systems Pty Ltd-MailScanner: generated
>
>Our virus detector failed to completely analyse a message you sent:-
>  To: brian@univexsystems.com
>  Subject: The Application for Network Technician
>  Date: Tue Nov 30 07:08:13 2004
>Any parts of the message that could not be analysed will not have been
>delivered.
>
>If you are using Microsoft Outlook, we strongly recommend you change your
>outgoing message format from "Rich Text" to "HTML" or "Plain Text".
>
>1) Click on the "Tools" menu and choose "Options..."
>2) Got to the "Mail Format" tab
>3) For message format, select "HTML" or "Plain text"
>4) Click OK
>
>The virus detector said this about the message:
>Report: MailScanner: Could not analyze message
>
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From fashberg at ETKN.DE  Tue Nov 30 12:18:44 2004
From: fashberg at ETKN.DE (Folke Ashberg)
Date: Thu Jan 12 21:27:45 2006
Subject: How not to match filename rules for archive contents?
Message-ID: <mailman.5284.1137101265.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-15" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi!

rules defined in filename.rules.conf also apply to filenames of archives
(MailScanner-4.35.11). So the complete archive gots deleted.

What can i do to allow everything but viruses in archiv-attachments?

Kind regards

Folke Ashberg

-- 
ETK networks
Karl-Hammerschmidt-Str. 38
85609 Dornach/München
Tel: +49 (89) 90936 - 0
Fax: +49 (89) 90936 - 1834
Web: http://www.etkn.de
Mail: fashberg@etkn.de

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Tue Nov 30 12:33:40 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:45 2006
Subject: How not to match filename rules for archive contents?
Message-ID: <mailman.5285.1137101265.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-15" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Set "Maximum Archive Depth = 0" in MailScanner.conf.

Folke Ashberg wrote:

>Hi!
>
>rules defined in filename.rules.conf also apply to filenames of archives
>(MailScanner-4.35.11). So the complete archive gots deleted.
>
>What can i do to allow everything but viruses in archiv-attachments?
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From fashberg at ETKN.DE  Tue Nov 30 12:45:42 2004
From: fashberg at ETKN.DE (Folke Ashberg)
Date: Thu Jan 12 21:27:45 2006
Subject: How not to match filename rules for archive contents?
Message-ID: <mailman.5286.1137101265.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-15" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi!

thanks for your swift relpy. it works, but with one big limitation:
My virus-scanner doens't support archive-extraction, so it will not find
viruses in archives now :(

An option like "Extract Archives Before Virusscanning" would be great.

Kind Regards

Folke

Am Di, den 30.11.2004 schrieb Julian Field um 13:33:
> Set "Maximum Archive Depth = 0" in MailScanner.conf.
> 
> Folke Ashberg wrote:
> 
> >Hi!
> >
> >rules defined in filename.rules.conf also apply to filenames of archives
> >(MailScanner-4.35.11). So the complete archive gots deleted.
> >
> >What can i do to allow everything but viruses in archiv-attachments?
> >
> >
> 
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
> 
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> 
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 
> Support MailScanner development - buy the book off the website!
-- 
ETK networks
Karl-Hammerschmidt-Str. 38
85609 Dornach/München
Tel: +49 (89) 90936 - 0
Fax: +49 (89) 90936 - 1834
Web: http://www.etkn.de
Mail: fashberg@etkn.de

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Tue Nov 30 12:49:31 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:45 2006
Subject: How not to match filename rules for archive contents?
Message-ID: <mailman.5287.1137101265.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-15" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

In which case use a decent virus scanner!
ClamAV is very good and very free.

Folke Ashberg wrote:

>Hi!
>
>thanks for your swift relpy. it works, but with one big limitation:
>My virus-scanner doens't support archive-extraction, so it will not find
>viruses in archives now :(
>
>An option like "Extract Archives Before Virusscanning" would be great.
>
>Kind Regards
>
>Folke
>
>Am Di, den 30.11.2004 schrieb Julian Field um 13:33:
>
>
>>Set "Maximum Archive Depth = 0" in MailScanner.conf.
>>
>>Folke Ashberg wrote:
>>
>>
>>
>>>Hi!
>>>
>>>rules defined in filename.rules.conf also apply to filenames of archives
>>>(MailScanner-4.35.11). So the complete archive gots deleted.
>>>
>>>What can i do to allow everything but viruses in archiv-attachments?
>>>
>>>
>>>
>>>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From alan at ESSEX.AC.UK  Tue Nov 30 13:00:04 2004
From: alan at ESSEX.AC.UK (Stanier, Alan M)
Date: Thu Jan 12 21:27:45 2006
Subject: Sudden problem with MailScanner 4.31.6
Message-ID: <mailman.5288.1137101265.24926.mailscanner@lists.mailscanner.info>

Julien

That worked, thanks

Alan


> -----Original Message-----
> From: MailScanner mailing list 
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
> Sent: 29 November 2004 17:35
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: {SPAM?} Re: Sudden problem with MailScanner 4.31.6
> 
> 
> Please try the attached Message.pm file.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From fashberg at ETKN.DE  Tue Nov 30 13:03:35 2004
From: fashberg at ETKN.DE (Folke Ashberg)
Date: Thu Jan 12 21:27:45 2006
Subject: How not to match filename rules for archive contents?
Message-ID: <mailman.5289.1137101265.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-15" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I have ClamAV already as second scanner and will kick the first one
now...

thank you very much!!!

bye

Folke

Am Di, den 30.11.2004 schrieb Julian Field um 13:49:
> In which case use a decent virus scanner!
> ClamAV is very good and very free.
> 
> Folke Ashberg wrote:
> 
> >Hi!
> >
> >thanks for your swift relpy. it works, but with one big limitation:
> >My virus-scanner doens't support archive-extraction, so it will not find
> >viruses in archives now :(
> >
> >An option like "Extract Archives Before Virusscanning" would be great.
> >
> >Kind Regards
> >
> >Folke
> >
> >Am Di, den 30.11.2004 schrieb Julian Field um 13:33:
> >
> >
> >>Set "Maximum Archive Depth = 0" in MailScanner.conf.
> >>
> >>Folke Ashberg wrote:
> >>
> >>
> >>
> >>>Hi!
> >>>
> >>>rules defined in filename.rules.conf also apply to filenames of archives
> >>>(MailScanner-4.35.11). So the complete archive gots deleted.
> >>>
> >>>What can i do to allow everything but viruses in archiv-attachments?
> >>>
> >>>
> >>>
> >>>
> 
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
> 
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> 
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 
> Support MailScanner development - buy the book off the website!
-- 
ETK networks
Karl-Hammerschmidt-Str. 38
85609 Dornach/München
Tel: +49 (89) 90936 - 0
Fax: +49 (89) 90936 - 1834
Web: http://www.etkn.de
Mail: fashberg@etkn.de

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dhawal at NETMAGICSOLUTIONS.COM  Tue Nov 30 13:30:44 2004
From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy)
Date: Thu Jan 12 21:27:45 2006
Subject: Increase spaminess for a set of domains
Message-ID: <mailman.5290.1137101265.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hello,

How do I increase (or decrease) the spaminess (pardon me if thats not
the right word) for a domain or a set of domains.

What I am trying to achieve is to add an additional score if the
sender's domains is in this list. Something like

yahoo.co.in:+2
sourceforge.net:-1

Yup there are whitelists and blacklists but that will explicity allow or
deny the sender's domain, I just need an additional score. Any ideas?

- dhawal

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From marcel-ml at IRC-ADDICTS.DE  Tue Nov 30 13:53:13 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:45 2006
Subject: New release of Vispan
Message-ID: <mailman.5291.1137101265.24926.mailscanner@lists.mailscanner.info>

Hi there again.. :)


> Thanks - I have incorporated into the next version. Also I have found
> why it wasn't detecting the log entry for the virus - this has also been
> fixed.
>  The virus list on the front page is the daily list.
>  David While
>
might be only an idea of mine..

but i would be happy to see such table with the most viruses and spams
with all data collected.. :) or for a month or something..

maybe..if i click on monthy or yearly report just a table with the viruses
and the spam-triggers.

Because, as i am using a lot of virus-tools the output is a little bit
much information :) and i should calculate a lot ;)

Just an idea..

Greetings

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Tue Nov 30 14:24:47 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:45 2006
Subject: Increase spaminess for a set of domains
Message-ID: <mailman.5292.1137101265.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Do this in SpamAssassin by writing a couple of extra rules. Read "man
Mail::SpamAssassin::Conf".

Dhawal Doshy wrote:

> Hello,
>
> How do I increase (or decrease) the spaminess (pardon me if thats not
> the right word) for a domain or a set of domains.
>
> What I am trying to achieve is to add an additional score if the
> sender's domains is in this list. Something like
>
> yahoo.co.in:+2
> sourceforge.net:-1
>
> Yup there are whitelists and blacklists but that will explicity allow or
> deny the sender's domain, I just need an additional score. Any ideas?
>
--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From marcin.rozek at IOS.EDU.PL  Tue Nov 30 14:35:33 2004
From: marcin.rozek at IOS.EDU.PL ([ISO-8859-2] Marcin Rożek)
Date: Thu Jan 12 21:27:45 2006
Subject: Increase spaminess for a set of domains
Message-ID: <mailman.5293.1137101265.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-2" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Dhawal Doshy wrote:
> Hello,
>
> How do I increase (or decrease) the spaminess (pardon me if thats not
> the right word) for a domain or a set of domains.
>
> What I am trying to achieve is to add an additional score if the
> sender's domains is in this list. Something like
>
> yahoo.co.in:+2
> sourceforge.net:-1
add to /etc/MailScanner/spam.assassin.prefs.conf

header MAIL_FROM_YAHOO_CO_IN From =~ /yahoo\.co\.in/i
score MAIL_FROM_YAHOO_CO_IN 5 5 5 5


btw - somebody can explain me, why i do need put 5 5 5 5, not a single 5?
There's not a word about it here: http://wiki.apache.org/spamassassin/WritingRules

Regards,
Marcin

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Tue Nov 30 14:31:10 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:45 2006
Subject: Increase spaminess for a set of domains
Message-ID: <mailman.5294.1137101265.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-2" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Marcin Rożek wrote:

> Dhawal Doshy wrote:
>
>> Hello,
>>
>> How do I increase (or decrease) the spaminess (pardon me if thats not
>> the right word) for a domain or a set of domains.
>>
>> What I am trying to achieve is to add an additional score if the
>> sender's domains is in this list. Something like
>>
>> yahoo.co.in:+2
>> sourceforge.net:-1
>
> add to /etc/MailScanner/spam.assassin.prefs.conf
>
> header MAIL_FROM_YAHOO_CO_IN From =~ /yahoo\.co\.in/i
> score MAIL_FROM_YAHOO_CO_IN 5 5 5 5
>
>
> btw - somebody can explain me, why i do need put 5 5 5 5, not a single 5?
> There's not a word about it here: 
> http://wiki.apache.org/spamassassin/WritingRules

A single 5 should work as well. There are a total of 4 different score 
sets for all the combinations of network checks = true/false and using 
bayes = true/false. It's usually the last one that will be actually used 
in normal operation.

If you only specify a single number, that number will be used for all 4 
possibilities.

-- 
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From marcin.rozek at IOS.EDU.PL  Tue Nov 30 15:07:24 2004
From: marcin.rozek at IOS.EDU.PL ([ISO-8859-2] Marcin Rożek)
Date: Thu Jan 12 21:27:45 2006
Subject: Increase spaminess for a set of domains
Message-ID: <mailman.5295.1137101265.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-2" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian Field wrote:
>> btw - somebody can explain me, why i do need put 5 5 5 5, not a single 5?
>> There's not a word about it here:
>> http://wiki.apache.org/spamassassin/WritingRules
>
>
> A single 5 should work as well. There are a total of 4 different score
> sets for all the combinations of network checks = true/false and using
> bayes = true/false. It's usually the last one that will be actually used
> in normal operation.
>
> If you only specify a single number, that number will be used for all 4
> possibilities.
>

Thank you!

--
Regards,
Marcin

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From dhawal at NETMAGICSOLUTIONS.COM  Tue Nov 30 15:19:34 2004
From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy)
Date: Thu Jan 12 21:27:45 2006
Subject: Increase spaminess for a set of domains
Message-ID: <mailman.5296.1137101265.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-2" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Thanks Julian and Marcin,

I tried fooling around with a sub in
/usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/EvalTests.pm but failed
miserably.. the lint test failed to recognize my rules.. will try again
at leisure.

sub in EvalTests.pm:
--------------------
sub check_to_in_mylist {
   my ($self) = @_;
   local ($_);
   foreach $_ ($self->all_to_addrs()) {
     if ($self->_check_whitelist ($self->{conf}->{mylist_to}, $_)) {
       return 1;
     }
   }
}

my 70_something.cf file:
------------
header USER_IN_MYLIST   eval:check_from_in_mylist()
describe USER_IN_MYLIST From: address is in the user's my-list
tflags USER_IN_MYLIST   userconf noautolearn

SCORE   USER_IN_MYLIST  -1.000
mylist_from     *@yahoo.co.in

Error:
------
config: SpamAssassin failed to parse line, skipping: mylist_from
*@yahoo.co.in

Anyways thanks again.. the spam.assassin.prefs.conf hack worked.

cheers,
- dhawal

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From billy at PLANETGEEK.BIZ  Tue Nov 30 15:29:25 2004
From: billy at PLANETGEEK.BIZ (Billy Pumphrey)
Date: Thu Jan 12 21:27:45 2006
Subject: Mailscanner Spamassassin timing out
Message-ID: <mailman.5297.1137101265.24926.mailscanner@lists.mailscanner.info>

Note:  I am a novice at Linux.

SpamAssassin Timeout = 60
Max SpamAssassin Timeouts = 20

Version of Spamassassin = Looks like 2.61

I am running RulesDuJour

I don't really know if my bayes is working.  I tried to get it working a
while back and I got lost in the mist of bayes somewhere along the
line.  So I'll have to go back again and read about Bayes.

I upgraded the RAM just now to 768 so hopefully that will help.

I could have swore that somewhere in the log it timed out so much that it
said that it disable RBL checks.  Would have this happened?  Where do   I
check?

Sample of load average (before I upgraded the RAM)
Connections Rejected due to load average::
    Load Avg 12: 5 Times(s)
    Load Avg 13: 1 Times(s)
    Load Avg 14: 1 Times(s)

Here is the spam list in my mailscanner.conf if it helps any:
Spam List = ORDB-RBL spamcop.net spamhaus.org

I bypassed the MailScanner machine yesterday.  After increasing the RAM and
letting it run through the 6xx messages that it had, it seems to be running
ok now and I put it back into production.  Its average number of emails in a
batch usually is around 6.  Could it have been that a few particular
messages were sent to the machine that were just big or something?

"If you have those disable bayes_auto_expire in
/etc/mail/spamassassin/local.cf and set "Rebuild Bayes Every" in
MailScanner.conf."

I checked my local.cf file and there are nothing in there but comments.  I
looked in my MailScanner.conf for a Rebuild Bayes setting and there was
none.  I am guessing that this is because my MailScanner version is older,
4.25-14.

The command free returns this (remember I just put more ram in it)
[root@MailScanner root]# free
             total       used       free     shared    buffers     cached
Mem:        772408     361576     410832          0      23948      52856
-/+ buffers/cache:     284772     487636
Swap:       393112          0     393112

So It looks like it was probably defiantly out of ram.  I look at free even
before it was processing any mail and the machine was using 26x megs of RAM.




-----Original Message-----
From: Venkata Achanta [mailto:vachanta@GMAIL.COM]
Sent: Monday, November 29, 2004 6:29 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Mailscanner Spamassassin timing out

SpamAssassin Timeout =
Max SpamAssassin Timeouts =
What are these set to in your conf file ?



On Mon, 29 Nov 2004 18:04:15 -0500, Billy Pumphrey <billy@PLANETGEEK.BIZ>
wrote:

>I have not upgraded to the recent version just because I don't want to
screw
>it up.  I plan on rebuilding the machine in the beginning of the year
>though.
>
>Here is my entry in the conf file:
>Spam List = # ORDB-RBL spamcop.net spamhaus.org # MAPS-RBL+ costs money
>(except
>.ac.uk)
>
># If an individual "Spam List" or "Spam Domain List" check takes longer
># that this (in seconds), the check is abandoned and the timeout noted.
>Spam List Timeout = 40 # was 10
>
># The maximum number of timeouts caused by any individual "Spam List" or
># "Spam Domain List" before it is marked as "unavailable". Once marked,
># the list will be ignored until the next automatic re-start (see
># "Restart Every" for the longest time it will wait).
># This can also be the filename of a ruleset.
>Max Spam List Timeouts = 7
>
>
>Is that the correct one?
>-----Original Message-----
>From: Venkata Achanta [mailto:vachanta@GMAIL.COM]
>Sent: Monday, November 29, 2004 5:56 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Mailscanner Spamassassin timing out
>
>Billy,
>
>What version of spamassasin are you running ?
>
>Did you recently upgrade SA and MS ?
>
>Try to bump timeout to 60-80 and see what happens.
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!

SpamAssassin Timeout = 120

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Tue Nov 30 15:43:15 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:45 2006
Subject: Mailscanner Spamassassin timing out
Message-ID: <mailman.5298.1137101265.24926.mailscanner@lists.mailscanner.info>

Billy

I'd run the sa timeout setting at least 80, prob more if you are using
RBL's and not running a local copy of the RBL DNS info.

If you are running RulesDujour take out bigevil.cf etc as it's a massive
load on RAM. use the surbl.org pluging instead.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Billy Pumphrey wrote:
> Note:  I am a novice at Linux.
>
> SpamAssassin Timeout = 60
> Max SpamAssassin Timeouts = 20
>
> Version of Spamassassin = Looks like 2.61
>
> I am running RulesDuJour
>
> I don't really know if my bayes is working.  I tried to get it working a
> while back and I got lost in the mist of bayes somewhere along the
> line.  So I'll have to go back again and read about Bayes.
>
> I upgraded the RAM just now to 768 so hopefully that will help.
>
> I could have swore that somewhere in the log it timed out so much that it
> said that it disable RBL checks.  Would have this happened?  Where do   I
> check?
>
> Sample of load average (before I upgraded the RAM)
> Connections Rejected due to load average::
>     Load Avg 12: 5 Times(s)
>     Load Avg 13: 1 Times(s)
>     Load Avg 14: 1 Times(s)
>
> Here is the spam list in my mailscanner.conf if it helps any:
> Spam List = ORDB-RBL spamcop.net spamhaus.org
>
> I bypassed the MailScanner machine yesterday.  After increasing the RAM and
> letting it run through the 6xx messages that it had, it seems to be running
> ok now and I put it back into production.  Its average number of emails in a
> batch usually is around 6.  Could it have been that a few particular
> messages were sent to the machine that were just big or something?
>
> "If you have those disable bayes_auto_expire in
> /etc/mail/spamassassin/local.cf and set "Rebuild Bayes Every" in
> MailScanner.conf."
>
> I checked my local.cf file and there are nothing in there but comments.  I
> looked in my MailScanner.conf for a Rebuild Bayes setting and there was
> none.  I am guessing that this is because my MailScanner version is older,
> 4.25-14.
>
> The command free returns this (remember I just put more ram in it)
> [root@MailScanner root]# free
>              total       used       free     shared    buffers     cached
> Mem:        772408     361576     410832          0      23948      52856
> -/+ buffers/cache:     284772     487636
> Swap:       393112          0     393112
>
> So It looks like it was probably defiantly out of ram.  I look at free even
> before it was processing any mail and the machine was using 26x megs of RAM.
>
>
>
>
> -----Original Message-----
> From: Venkata Achanta [mailto:vachanta@GMAIL.COM]
> Sent: Monday, November 29, 2004 6:29 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Mailscanner Spamassassin timing out
>
> SpamAssassin Timeout =
> Max SpamAssassin Timeouts =
> What are these set to in your conf file ?
>
>
>
> On Mon, 29 Nov 2004 18:04:15 -0500, Billy Pumphrey <billy@PLANETGEEK.BIZ>
> wrote:
>
>
>>I have not upgraded to the recent version just because I don't want to
>
> screw
>
>>it up.  I plan on rebuilding the machine in the beginning of the year
>>though.
>>
>>Here is my entry in the conf file:
>>Spam List = # ORDB-RBL spamcop.net spamhaus.org # MAPS-RBL+ costs money
>>(except
>>.ac.uk)
>>
>># If an individual "Spam List" or "Spam Domain List" check takes longer
>># that this (in seconds), the check is abandoned and the timeout noted.
>>Spam List Timeout = 40 # was 10
>>
>># The maximum number of timeouts caused by any individual "Spam List" or
>># "Spam Domain List" before it is marked as "unavailable". Once marked,
>># the list will be ignored until the next automatic re-start (see
>># "Restart Every" for the longest time it will wait).
>># This can also be the filename of a ruleset.
>>Max Spam List Timeouts = 7
>>
>>
>>Is that the correct one?
>>-----Original Message-----
>>From: Venkata Achanta [mailto:vachanta@GMAIL.COM]
>>Sent: Monday, November 29, 2004 5:56 PM
>>To: MAILSCANNER@JISCMAIL.AC.UK
>>Subject: Re: Mailscanner Spamassassin timing out
>>
>>Billy,
>>
>>What version of spamassasin are you running ?
>>
>>Did you recently upgrade SA and MS ?
>>
>>Try to bump timeout to 60-80 and see what happens.
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>
>
> SpamAssassin Timeout = 120
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From billy at PLANETGEEK.BIZ  Tue Nov 30 16:08:37 2004
From: billy at PLANETGEEK.BIZ (Billy Pumphrey)
Date: Thu Jan 12 21:27:45 2006
Subject: Mailscanner Spamassassin timing out
Message-ID: <mailman.5299.1137101265.24926.mailscanner@lists.mailscanner.info>

Ok, I put it at 80.

Now that I am digging into this again.  I am confused on the spamassassin
configuration file.  Is /etc/mail/spamassassin/local.cf the right place to
put all of the options that are listed on
http://spamassassin.apache.org/full/3.0.x/dist/doc/Mail_SpamAssassin_Conf.ht
ml

????

This is confusing possibly because the local.cf file is just empty.

Does this mean that my Bayes is working?

[root@MailScanner spamassassin]# ls -l
total 164604
-rw-------    1 root     root        72850 Nov 30 10:47 bayes_journal
-rw-------    1 root     root           18 Nov 23 04:42
bayes.lock.MailScanner.1
0301
-rw-------    1 root     root           18 Nov 15 12:16
bayes.lock.MailScanner.1
1285
-rw-------    1 root     root          108 Nov 15 12:36
bayes.lock.MailScanner.1
1677
-rw-------    1 root     root           18 Nov 15 12:48
bayes.lock.MailScanner.1
1925
-rw-------    1 root     root           18 Nov 15 12:50
bayes.lock.MailScanner.1
1943
-rw-------    1 root     root          162 Nov 15 12:53
bayes.lock.MailScanner.1
2044
-rw-------    1 root     root          144 Jul  1 05:07
bayes.lock.MailScanner.1
2162
-rw-------    1 root     root          162 Nov 15 13:27
bayes.lock.MailScanner.1
2875
-rw-------    1 root     root          108 Nov 15 13:30
bayes.lock.MailScanner.1
2947
-rw-------    1 root     root           90 Nov 15 13:32
bayes.lock.MailScanner.1
3037
-rw-------    1 root     root          108 Nov 15 13:59
bayes.lock.MailScanner.1
3617
-rw-------    1 root     root           36 Nov 15 14:25
bayes.lock.MailScanner.1
4282
-rw-------    1 root     root          126 Nov 15 14:26
bayes.lock.MailScanner.1
4330
-rw-------    1 root     root           72 Nov 26 15:56
bayes.lock.MailScanner.1
4857
-rw-------    1 root     root          108 Nov 26 15:59
bayes.lock.MailScanner.1
4894
-rw-------    1 root     root          126 Nov 15 15:04
bayes.lock.MailScanner.1
5225
-rw-------    1 root     root           18 Nov 17 10:12
bayes.lock.MailScanner.1
5297
-rw-------    1 root     root           54 Jun  8 05:09
bayes.lock.MailScanner.1
8139
-rw-------    1 root     root           72 Jun  8 05:09
bayes.lock.MailScanner.1
8142
-rw-------    1 root     root           72 Nov 15 16:57
bayes.lock.MailScanner.2
0046
-rw-------    1 root     root           18 Nov 29 09:47
bayes.lock.MailScanner.2
0212
-rw-------    1 root     root           18 Nov 15 17:21
bayes.lock.MailScanner.2
0851
-rw-------    1 root     root          126 Nov 15 17:24
bayes.lock.MailScanner.2
0921
-rw-------    1 root     root          144 Nov 15 17:30
bayes.lock.MailScanner.2
1026
-rw-------    1 root     root           90 Nov 15 17:35
bayes.lock.MailScanner.2
1228
-rw-------    1 root     root          126 Nov 15 17:49
bayes.lock.MailScanner.2
1559
-rw-------    1 root     root           54 Nov 15 18:48
bayes.lock.MailScanner.2
2942
-rw-------    1 root     root          162 Nov 15 19:49
bayes.lock.MailScanner.2
4144
-rw-------    1 root     root          144 Nov 15 19:49
bayes.lock.MailScanner.2
4157
-rw-------    1 root     root          108 Nov 15 20:23
bayes.lock.MailScanner.2
4887
-rw-------    1 root     root          126 Nov 15 20:43
bayes.lock.MailScanner.2
5255
-rw-------    1 root     root          144 Nov 18 13:34
bayes.lock.MailScanner.2
5430
-rw-------    1 root     root          144 Nov 15 20:53
bayes.lock.MailScanner.2
5461
-rw-------    1 root     root          126 Nov 15 21:15
bayes.lock.MailScanner.2
6224
-rw-------    1 root     root           90 Nov 15 21:16
bayes.lock.MailScanner.2
6244
-rw-------    1 root     root          108 Nov 15 21:23
bayes.lock.MailScanner.2
6401
-rw-------    1 root     root           72 Nov 15 21:26
bayes.lock.MailScanner.2
6446
-rw-------    1 root     root           90 Nov 15 22:01
bayes.lock.MailScanner.2
7316
-rw-------    1 root     root          126 Nov 15 22:01
bayes.lock.MailScanner.2
7329
-rw-------    1 root     root          162 Nov 15 22:04
bayes.lock.MailScanner.2
7476
-rw-------    1 root     root           90 Nov 15 23:32
bayes.lock.MailScanner.2
9191
-rw-------    1 root     root          162 Nov 29 14:48
bayes.lock.MailScanner.2
9519
-rw-------    1 root     root           36 Nov 16 00:07
bayes.lock.MailScanner.3
0011
-rw-------    1 root     root           90 Nov 16 00:19
bayes.lock.MailScanner.3
0238
-rw-------    1 root     root           72 Nov 16 00:55
bayes.lock.MailScanner.3
0829
-rw-------    1 root     root          126 Nov 16 01:11
bayes.lock.MailScanner.3
1283
-rw-------    1 root     root          144 Nov 24 16:47
bayes.lock.MailScanner.3
2535
-rw-------    1 root     root           17 Sep 23 11:35
bayes.lock.MailScanner.8
041
-rw-------    1 root     root           17 Nov 22 08:33
bayes.lock.MailScanner.9
862
-rw-------    1 root     root      5201920 Nov 30 10:43 bayes_seen
-rw-------    1 root     root     214482944 Nov 30 10:43 bayes_toks

-----Original Message-----
From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM]
Sent: Tuesday, November 30, 2004 10:43 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Mailscanner Spamassassin timing out

Billy

I'd run the sa timeout setting at least 80, prob more if you are using
RBL's and not running a local copy of the RBL DNS info.

If you are running RulesDujour take out bigevil.cf etc as it's a massive
load on RAM. use the surbl.org pluging instead.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Billy Pumphrey wrote:
> Note:  I am a novice at Linux.
>
> SpamAssassin Timeout = 60
> Max SpamAssassin Timeouts = 20
>
> Version of Spamassassin = Looks like 2.61
>
> I am running RulesDuJour
>
> I don't really know if my bayes is working.  I tried to get it working a
> while back and I got lost in the mist of bayes somewhere along the
> line.  So I'll have to go back again and read about Bayes.
>
> I upgraded the RAM just now to 768 so hopefully that will help.
>
> I could have swore that somewhere in the log it timed out so much that it
> said that it disable RBL checks.  Would have this happened?  Where do   I
> check?
>
> Sample of load average (before I upgraded the RAM)
> Connections Rejected due to load average::
>     Load Avg 12: 5 Times(s)
>     Load Avg 13: 1 Times(s)
>     Load Avg 14: 1 Times(s)
>
> Here is the spam list in my mailscanner.conf if it helps any:
> Spam List = ORDB-RBL spamcop.net spamhaus.org
>
> I bypassed the MailScanner machine yesterday.  After increasing the RAM
and
> letting it run through the 6xx messages that it had, it seems to be
running
> ok now and I put it back into production.  Its average number of emails in
a
> batch usually is around 6.  Could it have been that a few particular
> messages were sent to the machine that were just big or something?
>
> "If you have those disable bayes_auto_expire in
> /etc/mail/spamassassin/local.cf and set "Rebuild Bayes Every" in
> MailScanner.conf."
>
> I checked my local.cf file and there are nothing in there but comments.  I
> looked in my MailScanner.conf for a Rebuild Bayes setting and there was
> none.  I am guessing that this is because my MailScanner version is older,
> 4.25-14.
>
> The command free returns this (remember I just put more ram in it)
> [root@MailScanner root]# free
>              total       used       free     shared    buffers     cached
> Mem:        772408     361576     410832          0      23948      52856
> -/+ buffers/cache:     284772     487636
> Swap:       393112          0     393112
>
> So It looks like it was probably defiantly out of ram.  I look at free
even
> before it was processing any mail and the machine was using 26x megs of
RAM.
>
>
>
>
> -----Original Message-----
> From: Venkata Achanta [mailto:vachanta@GMAIL.COM]
> Sent: Monday, November 29, 2004 6:29 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Mailscanner Spamassassin timing out
>
> SpamAssassin Timeout =
> Max SpamAssassin Timeouts =
> What are these set to in your conf file ?
>
>
>
> On Mon, 29 Nov 2004 18:04:15 -0500, Billy Pumphrey <billy@PLANETGEEK.BIZ>
> wrote:
>
>
>>I have not upgraded to the recent version just because I don't want to
>
> screw
>
>>it up.  I plan on rebuilding the machine in the beginning of the year
>>though.
>>
>>Here is my entry in the conf file:
>>Spam List = # ORDB-RBL spamcop.net spamhaus.org # MAPS-RBL+ costs money
>>(except
>>.ac.uk)
>>
>># If an individual "Spam List" or "Spam Domain List" check takes longer
>># that this (in seconds), the check is abandoned and the timeout noted.
>>Spam List Timeout = 40 # was 10
>>
>># The maximum number of timeouts caused by any individual "Spam List" or
>># "Spam Domain List" before it is marked as "unavailable". Once marked,
>># the list will be ignored until the next automatic re-start (see
>># "Restart Every" for the longest time it will wait).
>># This can also be the filename of a ruleset.
>>Max Spam List Timeouts = 7
>>
>>
>>Is that the correct one?
>>-----Original Message-----
>>From: Venkata Achanta [mailto:vachanta@GMAIL.COM]
>>Sent: Monday, November 29, 2004 5:56 PM
>>To: MAILSCANNER@JISCMAIL.AC.UK
>>Subject: Re: Mailscanner Spamassassin timing out
>>
>>Billy,
>>
>>What version of spamassasin are you running ?
>>
>>Did you recently upgrade SA and MS ?
>>
>>Try to bump timeout to 60-80 and see what happens.
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>
>
> SpamAssassin Timeout = 120
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From billy at PLANETGEEK.BIZ  Tue Nov 30 16:13:19 2004
From: billy at PLANETGEEK.BIZ (Billy Pumphrey)
Date: Thu Jan 12 21:27:45 2006
Subject: Mailscanner Spamassassin timing out
Message-ID: <mailman.5300.1137101265.24926.mailscanner@lists.mailscanner.info>

Accrding to the web site of surbl:
Unlike SpamAssassin 3, earlier SpamAssassin versions 2.63 and 2.64 don't
have built-in support for SURBLs, but you can add it with Eric Kolve's
SpamCopURI patch. The sample rules included with the distribution use the
latest and greatest combined list multi.surbl.org.

I have 2.61 of spamassassin, so I think I might hold off until I upgrade the
whole box before I do installing of some stuff (remember I am a novice and
good at messing it up).  Unless you think that the machine is just not fit
for using the BigEvil I will take it out.

You say remove the bigevil.cf etc.  Does that simply mean to delete the
files that begin with begevil?

Thank you for all of your help.

-----Original Message-----
From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM]
Sent: Tuesday, November 30, 2004 10:43 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Mailscanner Spamassassin timing out

Billy

I'd run the sa timeout setting at least 80, prob more if you are using
RBL's and not running a local copy of the RBL DNS info.

If you are running RulesDujour take out bigevil.cf etc as it's a massive
load on RAM. use the surbl.org pluging instead.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Billy Pumphrey wrote:
> Note:  I am a novice at Linux.
>
> SpamAssassin Timeout = 60
> Max SpamAssassin Timeouts = 20
>
> Version of Spamassassin = Looks like 2.61
>
> I am running RulesDuJour
>
> I don't really know if my bayes is working.  I tried to get it working a
> while back and I got lost in the mist of bayes somewhere along the
> line.  So I'll have to go back again and read about Bayes.
>
> I upgraded the RAM just now to 768 so hopefully that will help.
>
> I could have swore that somewhere in the log it timed out so much that it
> said that it disable RBL checks.  Would have this happened?  Where do   I
> check?
>
> Sample of load average (before I upgraded the RAM)
> Connections Rejected due to load average::
>     Load Avg 12: 5 Times(s)
>     Load Avg 13: 1 Times(s)
>     Load Avg 14: 1 Times(s)
>
> Here is the spam list in my mailscanner.conf if it helps any:
> Spam List = ORDB-RBL spamcop.net spamhaus.org
>
> I bypassed the MailScanner machine yesterday.  After increasing the RAM
and
> letting it run through the 6xx messages that it had, it seems to be
running
> ok now and I put it back into production.  Its average number of emails in
a
> batch usually is around 6.  Could it have been that a few particular
> messages were sent to the machine that were just big or something?
>
> "If you have those disable bayes_auto_expire in
> /etc/mail/spamassassin/local.cf and set "Rebuild Bayes Every" in
> MailScanner.conf."
>
> I checked my local.cf file and there are nothing in there but comments.  I
> looked in my MailScanner.conf for a Rebuild Bayes setting and there was
> none.  I am guessing that this is because my MailScanner version is older,
> 4.25-14.
>
> The command free returns this (remember I just put more ram in it)
> [root@MailScanner root]# free
>              total       used       free     shared    buffers     cached
> Mem:        772408     361576     410832          0      23948      52856
> -/+ buffers/cache:     284772     487636
> Swap:       393112          0     393112
>
> So It looks like it was probably defiantly out of ram.  I look at free
even
> before it was processing any mail and the machine was using 26x megs of
RAM.
>
>
>
>
> -----Original Message-----
> From: Venkata Achanta [mailto:vachanta@GMAIL.COM]
> Sent: Monday, November 29, 2004 6:29 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Mailscanner Spamassassin timing out
>
> SpamAssassin Timeout =
> Max SpamAssassin Timeouts =
> What are these set to in your conf file ?
>
>
>
> On Mon, 29 Nov 2004 18:04:15 -0500, Billy Pumphrey <billy@PLANETGEEK.BIZ>
> wrote:
>
>
>>I have not upgraded to the recent version just because I don't want to
>
> screw
>
>>it up.  I plan on rebuilding the machine in the beginning of the year
>>though.
>>
>>Here is my entry in the conf file:
>>Spam List = # ORDB-RBL spamcop.net spamhaus.org # MAPS-RBL+ costs money
>>(except
>>.ac.uk)
>>
>># If an individual "Spam List" or "Spam Domain List" check takes longer
>># that this (in seconds), the check is abandoned and the timeout noted.
>>Spam List Timeout = 40 # was 10
>>
>># The maximum number of timeouts caused by any individual "Spam List" or
>># "Spam Domain List" before it is marked as "unavailable". Once marked,
>># the list will be ignored until the next automatic re-start (see
>># "Restart Every" for the longest time it will wait).
>># This can also be the filename of a ruleset.
>>Max Spam List Timeouts = 7
>>
>>
>>Is that the correct one?
>>-----Original Message-----
>>From: Venkata Achanta [mailto:vachanta@GMAIL.COM]
>>Sent: Monday, November 29, 2004 5:56 PM
>>To: MAILSCANNER@JISCMAIL.AC.UK
>>Subject: Re: Mailscanner Spamassassin timing out
>>
>>Billy,
>>
>>What version of spamassasin are you running ?
>>
>>Did you recently upgrade SA and MS ?
>>
>>Try to bump timeout to 60-80 and see what happens.
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>
>
> SpamAssassin Timeout = 120
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Tue Nov 30 16:14:15 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:45 2006
Subject: Mailscanner Spamassassin timing out
Message-ID: <mailman.5301.1137101265.24926.mailscanner@lists.mailscanner.info>

Billy

the doc you mention is 3.0 not the 2.6x version you are running.

In order to check bayes is running see if its adding to the scores...but
from t he fact you've got various lock files left around it looks like
it is working.

most of youre settings are prob in the spam.assassin.prefs.conf in the
same dir as the MailScanner.conf.


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Billy Pumphrey wrote:
> Ok, I put it at 80.
>
> Now that I am digging into this again.  I am confused on the spamassassin
> configuration file.  Is /etc/mail/spamassassin/local.cf the right place to
> put all of the options that are listed on
> http://spamassassin.apache.org/full/3.0.x/dist/doc/Mail_SpamAssassin_Conf.ht
> ml
>
> ????
>
> This is confusing possibly because the local.cf file is just empty.
>
> Does this mean that my Bayes is working?
>
> [root@MailScanner spamassassin]# ls -l
> total 164604
> -rw-------    1 root     root        72850 Nov 30 10:47 bayes_journal
> -rw-------    1 root     root           18 Nov 23 04:42
> bayes.lock.MailScanner.1
> 0301
> -rw-------    1 root     root           18 Nov 15 12:16
> bayes.lock.MailScanner.1
> 1285
> -rw-------    1 root     root          108 Nov 15 12:36
> bayes.lock.MailScanner.1
> 1677
> -rw-------    1 root     root           18 Nov 15 12:48
> bayes.lock.MailScanner.1
> 1925
> -rw-------    1 root     root           18 Nov 15 12:50
> bayes.lock.MailScanner.1
> 1943
> -rw-------    1 root     root          162 Nov 15 12:53
> bayes.lock.MailScanner.1
> 2044
> -rw-------    1 root     root          144 Jul  1 05:07
> bayes.lock.MailScanner.1
> 2162
> -rw-------    1 root     root          162 Nov 15 13:27
> bayes.lock.MailScanner.1
> 2875
> -rw-------    1 root     root          108 Nov 15 13:30
> bayes.lock.MailScanner.1
> 2947
> -rw-------    1 root     root           90 Nov 15 13:32
> bayes.lock.MailScanner.1
> 3037
> -rw-------    1 root     root          108 Nov 15 13:59
> bayes.lock.MailScanner.1
> 3617
> -rw-------    1 root     root           36 Nov 15 14:25
> bayes.lock.MailScanner.1
> 4282
> -rw-------    1 root     root          126 Nov 15 14:26
> bayes.lock.MailScanner.1
> 4330
> -rw-------    1 root     root           72 Nov 26 15:56
> bayes.lock.MailScanner.1
> 4857
> -rw-------    1 root     root          108 Nov 26 15:59
> bayes.lock.MailScanner.1
> 4894
> -rw-------    1 root     root          126 Nov 15 15:04
> bayes.lock.MailScanner.1
> 5225
> -rw-------    1 root     root           18 Nov 17 10:12
> bayes.lock.MailScanner.1
> 5297
> -rw-------    1 root     root           54 Jun  8 05:09
> bayes.lock.MailScanner.1
> 8139
> -rw-------    1 root     root           72 Jun  8 05:09
> bayes.lock.MailScanner.1
> 8142
> -rw-------    1 root     root           72 Nov 15 16:57
> bayes.lock.MailScanner.2
> 0046
> -rw-------    1 root     root           18 Nov 29 09:47
> bayes.lock.MailScanner.2
> 0212
> -rw-------    1 root     root           18 Nov 15 17:21
> bayes.lock.MailScanner.2
> 0851
> -rw-------    1 root     root          126 Nov 15 17:24
> bayes.lock.MailScanner.2
> 0921
> -rw-------    1 root     root          144 Nov 15 17:30
> bayes.lock.MailScanner.2
> 1026
> -rw-------    1 root     root           90 Nov 15 17:35
> bayes.lock.MailScanner.2
> 1228
> -rw-------    1 root     root          126 Nov 15 17:49
> bayes.lock.MailScanner.2
> 1559
> -rw-------    1 root     root           54 Nov 15 18:48
> bayes.lock.MailScanner.2
> 2942
> -rw-------    1 root     root          162 Nov 15 19:49
> bayes.lock.MailScanner.2
> 4144
> -rw-------    1 root     root          144 Nov 15 19:49
> bayes.lock.MailScanner.2
> 4157
> -rw-------    1 root     root          108 Nov 15 20:23
> bayes.lock.MailScanner.2
> 4887
> -rw-------    1 root     root          126 Nov 15 20:43
> bayes.lock.MailScanner.2
> 5255
> -rw-------    1 root     root          144 Nov 18 13:34
> bayes.lock.MailScanner.2
> 5430
> -rw-------    1 root     root          144 Nov 15 20:53
> bayes.lock.MailScanner.2
> 5461
> -rw-------    1 root     root          126 Nov 15 21:15
> bayes.lock.MailScanner.2
> 6224
> -rw-------    1 root     root           90 Nov 15 21:16
> bayes.lock.MailScanner.2
> 6244
> -rw-------    1 root     root          108 Nov 15 21:23
> bayes.lock.MailScanner.2
> 6401
> -rw-------    1 root     root           72 Nov 15 21:26
> bayes.lock.MailScanner.2
> 6446
> -rw-------    1 root     root           90 Nov 15 22:01
> bayes.lock.MailScanner.2
> 7316
> -rw-------    1 root     root          126 Nov 15 22:01
> bayes.lock.MailScanner.2
> 7329
> -rw-------    1 root     root          162 Nov 15 22:04
> bayes.lock.MailScanner.2
> 7476
> -rw-------    1 root     root           90 Nov 15 23:32
> bayes.lock.MailScanner.2
> 9191
> -rw-------    1 root     root          162 Nov 29 14:48
> bayes.lock.MailScanner.2
> 9519
> -rw-------    1 root     root           36 Nov 16 00:07
> bayes.lock.MailScanner.3
> 0011
> -rw-------    1 root     root           90 Nov 16 00:19
> bayes.lock.MailScanner.3
> 0238
> -rw-------    1 root     root           72 Nov 16 00:55
> bayes.lock.MailScanner.3
> 0829
> -rw-------    1 root     root          126 Nov 16 01:11
> bayes.lock.MailScanner.3
> 1283
> -rw-------    1 root     root          144 Nov 24 16:47
> bayes.lock.MailScanner.3
> 2535
> -rw-------    1 root     root           17 Sep 23 11:35
> bayes.lock.MailScanner.8
> 041
> -rw-------    1 root     root           17 Nov 22 08:33
> bayes.lock.MailScanner.9
> 862
> -rw-------    1 root     root      5201920 Nov 30 10:43 bayes_seen
> -rw-------    1 root     root     214482944 Nov 30 10:43 bayes_toks
>
> -----Original Message-----
> From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM]
> Sent: Tuesday, November 30, 2004 10:43 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Mailscanner Spamassassin timing out
>
> Billy
>
> I'd run the sa timeout setting at least 80, prob more if you are using
> RBL's and not running a local copy of the RBL DNS info.
>
> If you are running RulesDujour take out bigevil.cf etc as it's a massive
> load on RAM. use the surbl.org pluging instead.
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Billy Pumphrey wrote:
>
>>Note:  I am a novice at Linux.
>>
>>SpamAssassin Timeout = 60
>>Max SpamAssassin Timeouts = 20
>>
>>Version of Spamassassin = Looks like 2.61
>>
>>I am running RulesDuJour
>>
>>I don't really know if my bayes is working.  I tried to get it working a
>>while back and I got lost in the mist of bayes somewhere along the
>>line.  So I'll have to go back again and read about Bayes.
>>
>>I upgraded the RAM just now to 768 so hopefully that will help.
>>
>>I could have swore that somewhere in the log it timed out so much that it
>>said that it disable RBL checks.  Would have this happened?  Where do   I
>>check?
>>
>>Sample of load average (before I upgraded the RAM)
>>Connections Rejected due to load average::
>>    Load Avg 12: 5 Times(s)
>>    Load Avg 13: 1 Times(s)
>>    Load Avg 14: 1 Times(s)
>>
>>Here is the spam list in my mailscanner.conf if it helps any:
>>Spam List = ORDB-RBL spamcop.net spamhaus.org
>>
>>I bypassed the MailScanner machine yesterday.  After increasing the RAM
>
> and
>
>>letting it run through the 6xx messages that it had, it seems to be
>
> running
>
>>ok now and I put it back into production.  Its average number of emails in
>
> a
>
>>batch usually is around 6.  Could it have been that a few particular
>>messages were sent to the machine that were just big or something?
>>
>>"If you have those disable bayes_auto_expire in
>>/etc/mail/spamassassin/local.cf and set "Rebuild Bayes Every" in
>>MailScanner.conf."
>>
>>I checked my local.cf file and there are nothing in there but comments.  I
>>looked in my MailScanner.conf for a Rebuild Bayes setting and there was
>>none.  I am guessing that this is because my MailScanner version is older,
>>4.25-14.
>>
>>The command free returns this (remember I just put more ram in it)
>>[root@MailScanner root]# free
>>             total       used       free     shared    buffers     cached
>>Mem:        772408     361576     410832          0      23948      52856
>>-/+ buffers/cache:     284772     487636
>>Swap:       393112          0     393112
>>
>>So It looks like it was probably defiantly out of ram.  I look at free
>
> even
>
>>before it was processing any mail and the machine was using 26x megs of
>
> RAM.
>
>>
>>
>>
>>-----Original Message-----
>>From: Venkata Achanta [mailto:vachanta@GMAIL.COM]
>>Sent: Monday, November 29, 2004 6:29 PM
>>To: MAILSCANNER@JISCMAIL.AC.UK
>>Subject: Re: Mailscanner Spamassassin timing out
>>
>>SpamAssassin Timeout =
>>Max SpamAssassin Timeouts =
>>What are these set to in your conf file ?
>>
>>
>>
>>On Mon, 29 Nov 2004 18:04:15 -0500, Billy Pumphrey <billy@PLANETGEEK.BIZ>
>>wrote:
>>
>>
>>
>>>I have not upgraded to the recent version just because I don't want to
>>
>>screw
>>
>>
>>>it up.  I plan on rebuilding the machine in the beginning of the year
>>>though.
>>>
>>>Here is my entry in the conf file:
>>>Spam List = # ORDB-RBL spamcop.net spamhaus.org # MAPS-RBL+ costs money
>>>(except
>>>.ac.uk)
>>>
>>># If an individual "Spam List" or "Spam Domain List" check takes longer
>>># that this (in seconds), the check is abandoned and the timeout noted.
>>>Spam List Timeout = 40 # was 10
>>>
>>># The maximum number of timeouts caused by any individual "Spam List" or
>>># "Spam Domain List" before it is marked as "unavailable". Once marked,
>>># the list will be ignored until the next automatic re-start (see
>>># "Restart Every" for the longest time it will wait).
>>># This can also be the filename of a ruleset.
>>>Max Spam List Timeouts = 7
>>>
>>>
>>>Is that the correct one?
>>>-----Original Message-----
>>>From: Venkata Achanta [mailto:vachanta@GMAIL.COM]
>>>Sent: Monday, November 29, 2004 5:56 PM
>>>To: MAILSCANNER@JISCMAIL.AC.UK
>>>Subject: Re: Mailscanner Spamassassin timing out
>>>
>>>Billy,
>>>
>>>What version of spamassasin are you running ?
>>>
>>>Did you recently upgrade SA and MS ?
>>>
>>>Try to bump timeout to 60-80 and see what happens.
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>
>>
>>SpamAssassin Timeout = 120
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From billy at PLANETGEEK.BIZ  Tue Nov 30 16:21:51 2004
From: billy at PLANETGEEK.BIZ (Billy Pumphrey)
Date: Thu Jan 12 21:27:45 2006
Subject: Mailscanner Spamassassin timing out
Message-ID: <mailman.5302.1137101265.24926.mailscanner@lists.mailscanner.info>

Like this?

X-Mailer: 3.1.138-34 [Jul 29 2004, 19:47:13]
Content-type: multipart/report; boundary="======4028==95378======"
X-WoodMacLaw-MailScanner-Information: Please contact the ISP for more
information
X-WoodMacLaw-MailScanner: Found to be uninfected
X-WoodMacLaw-MailScanner-SpamCheck: spam, spamhaus.org,
        SpamAssassin (score=17.901, required 6, BAYES_99 5.40,
        BigEvilList_1451 3.00, BigEvilList_1877 3.00, BigEvilList_3021 3.00,
        HTML_FONT_INVISIBLE 0.60, HTML_IMAGE_ONLY_02 1.23,
        HTML_IMAGE_RATIO_04 1.05, HTML_MESSAGE 0.10,
        HTTP_WITH_EMAIL_IN_URL 0.20, MIME_HTML_ONLY 0.32)
X-WoodMacLaw-MailScanner-SpamScore: sssssssssssssssss
Return-Path: 3-1438081-woodmaclaw.com?csharrer@stderr.efficientimpacte.com
X-OriginalArrivalTime: 30 Nov 2004 16:19:57.0013 (UTC)
FILETIME=[6EAAB050:01C4D6F8]

--======4028==95378======
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

--======4028==95378======
Content-Type: message/rfc822
Content-Disposition: attachment
Content-Transfer-Encoding: binary

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Tue Nov 30 16:22:18 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:45 2006
Subject: Mailscanner Spamassassin timing out
Message-ID: <mailman.5303.1137101265.24926.mailscanner@lists.mailscanner.info>

Billy

correct, there's plug-in for surbl.org at..

http://sourceforge.net/projects/spamcopuri/

but it mentions 2.63/4 so it might not work with 2.61

also the bigevil.cf hasn't been maintained for weeks and is absolutely
huge which may be the cause of your problems.

an upgrade to 2.64 should be trivial and then add in the Spamcopuri code
and you can get rid of the massive bigevil.cf (1.5 MB file compare this
with the other rules..)

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Billy Pumphrey wrote:
> Accrding to the web site of surbl:
> Unlike SpamAssassin 3, earlier SpamAssassin versions 2.63 and 2.64 don't
> have built-in support for SURBLs, but you can add it with Eric Kolve's
> SpamCopURI patch. The sample rules included with the distribution use the
> latest and greatest combined list multi.surbl.org.
>
> I have 2.61 of spamassassin, so I think I might hold off until I upgrade the
> whole box before I do installing of some stuff (remember I am a novice and
> good at messing it up).  Unless you think that the machine is just not fit
> for using the BigEvil I will take it out.1637876
>
> You say remove the bigevil.cf etc.  Does that simply mean to delete the
> files that begin with begevil?
>
> Thank you for all of your help.
>
> -----Original Message-----
> From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM]
> Sent: Tuesday, November 30, 2004 10:43 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Mailscanner Spamassassin timing out
>
> Billy
>
> I'd run the sa timeout setting at least 80, prob more if you are using
> RBL's and not running a local copy of the RBL DNS info.
>
> If you are running RulesDujour take out bigevil.cf etc as it's a massive
> load on RAM. use the surbl.org pluging instead.
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Billy Pumphrey wrote:
>
>>Note:  I am a novice at Linux.
>>
>>SpamAssassin Timeout = 60
>>Max SpamAssassin Timeouts = 20
>>
>>Version of Spamassassin = Looks like 2.61
>>
>>I am running RulesDuJour
>>
>>I don't really know if my bayes is working.  I tried to get it working a
>>while back and I got lost in the mist of bayes somewhere along the
>>line.  So I'll have to go back again and read about Bayes.
>>
>>I upgraded the RAM just now to 768 so hopefully that will help.
>>
>>I could have swore that somewhere in the log it timed out so much that it
>>said that it disable RBL checks.  Would have this happened?  Where do   I
>>check?
>>
>>Sample of load average (before I upgraded the RAM)
>>Connections Rejected due to load average::
>>    Load Avg 12: 5 Times(s)
>>    Load Avg 13: 1 Times(s)
>>    Load Avg 14: 1 Times(s)
>>
>>Here is the spam list in my mailscanner.conf if it helps any:
>>Spam List = ORDB-RBL spamcop.net spamhaus.org
>>
>>I bypassed the MailScanner machine yesterday.  After increasing the RAM
>
> and
>
>>letting it run through the 6xx messages that it had, it seems to be
>
> running
>
>>ok now and I put it back into production.  Its average number of emails in
>
> a
>
>>batch usually is around 6.  Could it have been that a few particular
>>messages were sent to the machine that were just big or something?
>>
>>"If you have those disable bayes_auto_expire in
>>/etc/mail/spamassassin/local.cf and set "Rebuild Bayes Every" in
>>MailScanner.conf."
>>
>>I checked my local.cf file and there are nothing in there but comments.  I
>>looked in my MailScanner.conf for a Rebuild Bayes setting and there was
>>none.  I am guessing that this is because my MailScanner version is older,
>>4.25-14.
>>
>>The command free returns this (remember I just put more ram in it)
>>[root@MailScanner root]# free
>>             total       used       free     shared    buffers     cached
>>Mem:        772408     361576     410832          0      23948      52856
>>-/+ buffers/cache:     284772     487636
>>Swap:       393112          0     393112
>>
>>So It looks like it was probably defiantly out of ram.  I look at free
>
> even
>
>>before it was processing any mail and the machine was using 26x megs of
>
> RAM.
>
>>
>>
>>
>>-----Original Message-----
>>From: Venkata Achanta [mailto:vachanta@GMAIL.COM]
>>Sent: Monday, November 29, 2004 6:29 PM
>>To: MAILSCANNER@JISCMAIL.AC.UK
>>Subject: Re: Mailscanner Spamassassin timing out
>>
>>SpamAssassin Timeout =
>>Max SpamAssassin Timeouts =
>>What are these set to in your conf file ?
>>
>>
>>
>>On Mon, 29 Nov 2004 18:04:15 -0500, Billy Pumphrey <billy@PLANETGEEK.BIZ>
>>wrote:
>>
>>
>>
>>>I have not upgraded to the recent version just because I don't want to
>>
>>screw
>>
>>
>>>it up.  I plan on rebuilding the machine in the beginning of the year
>>>though.
>>>
>>>Here is my entry in the conf file:
>>>Spam List = # ORDB-RBL spamcop.net spamhaus.org # MAPS-RBL+ costs money
>>>(except
>>>.ac.uk)
>>>
>>># If an individual "Spam List" or "Spam Domain List" check takes longer
>>># that this (in seconds), the check is abandoned and the timeout noted.
>>>Spam List Timeout = 40 # was 10
>>>
>>># The maximum number of timeouts caused by any individual "Spam List" or
>>># "Spam Domain List" before it is marked as "unavailable". Once marked,
>>># the list will be ignored until the next automatic re-start (see
>>># "Restart Every" for the longest time it will wait).
>>># This can also be the filename of a ruleset.
>>>Max Spam List Timeouts = 7
>>>
>>>
>>>Is that the correct one?
>>>-----Original Message-----
>>>From: Venkata Achanta [mailto:vachanta@GMAIL.COM]
>>>Sent: Monday, November 29, 2004 5:56 PM
>>>To: MAILSCANNER@JISCMAIL.AC.UK
>>>Subject: Re: Mailscanner Spamassassin timing out
>>>
>>>Billy,
>>>
>>>What version of spamassasin are you running ?
>>>
>>>Did you recently upgrade SA and MS ?
>>>
>>>Try to bump timeout to 60-80 and see what happens.
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>
>>
>>SpamAssassin Timeout = 120
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From martinh at SOLID-STATE-LOGIC.COM  Tue Nov 30 16:26:48 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:45 2006
Subject: Mailscanner Spamassassin timing out
Message-ID: <mailman.5304.1137101265.24926.mailscanner@lists.mailscanner.info>

Billy

yes
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Billy Pumphrey wrote:
> Like this?
>
> X-Mailer: 3.1.138-34 [Jul 29 2004, 19:47:13]
> Content-type: multipart/report; boundary="======4028==95378======"
> X-WoodMacLaw-MailScanner-Information: Please contact the ISP for more
> information
> X-WoodMacLaw-MailScanner: Found to be uninfected
> X-WoodMacLaw-MailScanner-SpamCheck: spam, spamhaus.org,
>         SpamAssassin (score=17.901, required 6, BAYES_99 5.40,
>         BigEvilList_1451 3.00, BigEvilList_1877 3.00, BigEvilList_3021 3.00,
>         HTML_FONT_INVISIBLE 0.60, HTML_IMAGE_ONLY_02 1.23,
>         HTML_IMAGE_RATIO_04 1.05, HTML_MESSAGE 0.10,
>         HTTP_WITH_EMAIL_IN_URL 0.20, MIME_HTML_ONLY 0.32)
> X-WoodMacLaw-MailScanner-SpamScore: sssssssssssssssss
> Return-Path: 3-1438081-woodmaclaw.com?csharrer@stderr.efficientimpacte.com
> X-OriginalArrivalTime: 30 Nov 2004 16:19:57.0013 (UTC)
> FILETIME=[6EAAB050:01C4D6F8]
>
> --======4028==95378======
> Content-Type: text/plain; charset="us-ascii"
> Content-Disposition: inline
> Content-Transfer-Encoding: quoted-printable
>
> --======4028==95378======
> Content-Type: message/rfc822
> Content-Disposition: attachment
> Content-Transfer-Encoding: binary
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From marcel-ml at IRC-ADDICTS.DE  Tue Nov 30 16:52:51 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:45 2006
Subject: Question about Logfile-Analyzer
Message-ID: <mailman.5305.1137101265.24926.mailscanner@lists.mailscanner.info>

Hi there,

i am using sendmail and of course MS.

But now i would check the Mail-Logs for some Stats..

like what Mail-User is the big one..and so on..

i would prefer a grafical output..like vispan or something like that..

is there a free programm for linux which could run through my mail-logs
and generate some kind of report?

Any ideas would be helpfull..

thanks in advance

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mspieth at NEOD.NET  Tue Nov 30 17:00:52 2004
From: mspieth at NEOD.NET (Mark Spieth)
Date: Thu Jan 12 21:27:45 2006
Subject: Question about Logfile-Analyzer
Message-ID: <mailman.5306.1137101265.24926.mailscanner@lists.mailscanner.info>

Its not graphical but it will tell you which domains and which users
send and receive the most mail.

http://www.enderunix.org/isoqlog/



Mark Spieth - Director of Internet Services

Northeast Ohio Digital Inc.

http://www.neod.net

mspieth@neod.net

330-830-6551

 

CONFIDENTIALITY NOTICE: The materials attached hereto are confidential
and the property of the sender. The information contained in the
attached materials is privileged and/or confidential and is intended
only for the use of the above-named individual(s) or entity(ies). If you
are not the intended recipient, be advised that any unauthorized
disclosure, copying, distribution or the taking of any action in
reliance on the contents of the attached information is strictly
prohibited. If you have received this transmission in error, please
discard the information immediately


-----Original Message-----
From: Marcel Blenkers [mailto:marcel-ml@IRC-ADDICTS.DE] 
Sent: Tuesday, November 30, 2004 11:53 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Question about Logfile-Analyzer

Hi there,

i am using sendmail and of course MS.

But now i would check the Mail-Logs for some Stats..

like what Mail-User is the big one..and so on..

i would prefer a grafical output..like vispan or something like that..

is there a free programm for linux which could run through my mail-logs
and generate some kind of report?

Any ideas would be helpfull..

thanks in advance

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mkettler at EVI-INC.COM  Tue Nov 30 17:06:49 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:45 2006
Subject: Increase spaminess for a set of domains
Message-ID: <mailman.5307.1137101265.24926.mailscanner@lists.mailscanner.info>

At 08:30 AM 11/30/2004, Dhawal Doshy wrote:

>yahoo.co.in:+2
>sourceforge.net:-1
>
>Yup there are whitelists and blacklists but that will explicity allow or
>deny the sender's domain, I just need an additional score. Any ideas

Short custom rules added to local.cf or spam.assassin.prefs.conf should do it:

header FROM_YAHOO_IN    From =~ /\byahoo\.co\.in\b/i
score FROM_YAHOO_IN     2.0

header FROM_SF_NET      From =~ /\bsourceforge\.net\b/i
score FROM_SF_NET       -1.0

For reference:

the \b's force a zero-width word-boundary, so there must be a
non-alphanumeric or an end of line before "yahoo" and after "in".

a . is normally a wildcard in regex, so you have to use \. to force a
literal . to be the string match.

/i makes the string case insensitive.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Mark.Pottage at SELECTION.CO.UK  Tue Nov 30 17:28:24 2004
From: Mark.Pottage at SELECTION.CO.UK (Mark Pottage)
Date: Thu Jan 12 21:27:45 2006
Subject: SendMail Queue...
Message-ID: <mailman.5308.1137101265.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

How can I increase the queue time on sendmail.
 
We are relaying mail for a customer who's exchange server has gone down. 
Can you advise how to increase the queue length so that their mail
doesn't get bounced back?  I think its set to 5 days at the moment.
 
many thanks
 
Mark Pottage
Systems Administrator
Tel:       0870 411 7914
Mobile:  07740 578 647
Fax:       0870 163 9001
mark.pottage@selection.co.uk

--
This message has been scanned for viruses and
dangerous content by Selection Services MailScanner, and is
believed to be clean.. ------------------------ MailScanner list
------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Text/PLAIN (Name: "Mark Pottage.vcf")  20 lines. ]
    [ Unable to print this part. ]


From mspieth at NEOD.NET  Tue Nov 30 17:34:54 2004
From: mspieth at NEOD.NET (Mark Spieth)
Date: Thu Jan 12 21:27:45 2006
Subject: SendMail Queue...
Message-ID: <mailman.5309.1137101265.24926.mailscanner@lists.mailscanner.info>


http://www.neod.net

mspieth@neod.net

330-830-6551

 

CONFIDENTIALITY NOTICE: The materials attached hereto are confidential
and the property of the sender. The information contained in the attached
materials is privileged and/or confidential and is intended only for the
use of the above-named individual(s) or entity(ies). If you are not the
intended recipient, be advised that any unauthorized disclosure, copying,
distribution or the taking of any action in reliance on the contents of
the attached information is strictly prohibited. If you have received
this transmission in error, please discard the information immediately

-----Original Message-----
From: Mark Pottage [mailto:Mark.Pottage@SELECTION.CO.UK]
Sent: Tuesday, November 30, 2004 12:28 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: SendMail Queue...

 

How can I increase the queue time on sendmail.

 

We are relaying mail for a customer who's exchange server has gone down. 
Can you advise how to increase the queue length so that their mail
doesn't get bounced back?  I think its set to 5 days at the moment.

 

many thanks

 

Mark Pottage
Systems Administrator
Tel:       0870 411 7914
Mobile:  07740 578 647
Fax:       0870 163 9001
mark.pottage@selection.co.uk


--
This message has been scanned for viruses and
dangerous content by Selection Services MailScanner, and is
believed to be clean.. ------------------------ MailScanner list
------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the
website!^@------------------------ MailScanner list
------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From itdept at FRACTALWEB.COM  Tue Nov 30 18:00:40 2004
From: itdept at FRACTALWEB.COM (Fractal IT Dept.)
Date: Thu Jan 12 21:27:46 2006
Subject: upgraded to latest version,
     now getting "possible fraud attempt" on legit email
Message-ID: <mailman.5310.1137101265.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi everyone,

We upgraded MailScanner over the weekend, and are now having legitimate
email being marked with "MailScanner has detected a possible fraud
attempt from MailScanner has detected a possible fraud attempt from
"user@domain_x.com" claiming to be MailScanner has detected a possible
fraud attempt from "user@domain_x.com" claiming to be "user@domain_x.com"
claiming to be MailScanner has detected a possible fraud attempt from
MailScanner has detected a possible fraud attempt from
"user@domain_x.com" claiming to be MailScanner has detected a possible
fraud attempt from "user@domain_x.com" claiming to be "user@domain_x.com"
claiming to be @domain_x.com". How do I fix?

Thanks.
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

From mike at CAMAROSS.NET  Tue Nov 30 18:35:43 2004
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:27:46 2006
Subject: SendMail Queue...
Message-ID: <mailman.5311.1137101266.24926.mailscanner@lists.mailscanner.info>

Mark Pottage wrote:
> How can I increase the queue time on sendmail.
>
>
>
> We are relaying mail for a customer who's exchange server has gone
> down.  Can you advise how to increase the queue length so that their
> mail doesn't get bounced back?  I think its set to 5 days at the
> moment.
>
>
>
> many thanks
>
>
>
> Mark Pottage
> Systems Administrator
> Tel:       0870 411 7914
> Mobile:  07740 578 647
> Fax:       0870 163 9001
> mark.pottage@selection.co.uk


________________________________

From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Mark Spieth Sent: Tuesday, November 30, 2004 11:35 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: SendMail Queue...



Look in your sendmail.cf file for O Timeout.queuereturn=8d



Set that to how long you want items to stay in your queue. Also look at
O Timeout.queuewarn=8d change this if you don't want users emailed that
the message was undeliverable but that the system will keep trying.



Mark Spieth - Director of Internet Services


________________________________



Make sure you RESTART MailScanner so that the sendmail processes read
the .cf again after your changes.

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Tue Nov 30 18:36:46 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:46 2006
Subject: upgraded to latest version,
     now getting "possible fraud attempt" on legit email
Message-ID: <mailman.5312.1137101266.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

You can either turn off the Phishing Fraud detector completely, or else
see my last post in the thread "Re: Phishing version and mailto: tag"
which has a replacement Message.pm file attached, which you should drop
into /usr/lib/MailScanner/MailScanner/Message.pm and then stop and
restart MailScanner.

The phishing net has been under fairly rapid development recently, and
has greatly improved.

Fractal IT Dept. wrote:

> Hi everyone,
>
> We upgraded MailScanner over the weekend, and are now having
> legitimate email being marked with "MailScanner has detected a
> possible fraud attempt from *MailScanner has detected a possible fraud
> attempt from "user@domain_x.com" claiming to be * *MailScanner has
> detected a possible fraud attempt from "user@domain_x.com" claiming to
> be "user@domain_x.com"** claiming to be MailScanner has detected a
> possible fraud attempt from **MailScanner has detected a possible
> fraud attempt from "user@domain_x.com" claiming to be * *MailScanner
> has detected a possible fraud attempt from "user@domain_x.com"
> claiming to be "user@domain_x.com"** claiming to be @domain_x.com".
> How do I fix?*


--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From campbell at cnpapers.com  Tue Nov 30 18:37:23 2004
From: campbell at cnpapers.com (Steve Campbell)
Date: Thu Jan 12 21:27:46 2006
Subject: Generic virus scanner found
Message-ID: <mailman.5313.1137101266.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Ever since upgrading to the latest release of MailScanner, I am seeing in my
logs:

update_virus_scanners: Found generic installed
update_virus_scanners: Running autoupdate for generic

I only list clamav in my conf file as a Virus Scanner.

What might it be autoupdating and why is it even looking for a "generic"
virus scanner if I don't specifiy I am using one?

Steve Campbell
campbell@cnpapers.com
Charleston Newspapers

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Tue Nov 30 18:56:01 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:46 2006
Subject: Generic virus scanner found
Message-ID: <mailman.5314.1137101266.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

It upgrades all the scanners you have installed, not just the ones you
happen to be using at the moment. That way, if you change which scanners
you want to use, you can be safe in the knowledge that they will already
be up to date when you first use them.

The "generic" scanner is one that you can write yourself to do whatever
you want it to. Allows for much more customisation.

Steve Campbell wrote:

>Ever since upgrading to the latest release of MailScanner, I am seeing in my
>logs:
>
>update_virus_scanners: Found generic installed
>update_virus_scanners: Running autoupdate for generic
>
>I only list clamav in my conf file as a Virus Scanner.
>
>What might it be autoupdating and why is it even looking for a "generic"
>virus scanner if I don't specifiy I am using one?
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ugob at CAMO-ROUTE.COM  Tue Nov 30 18:59:51 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:46 2006
Subject: Question about Logfile-Analyzer
Message-ID: <mailman.5315.1137101266.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Marcel Blenkers wrote:
> Hi there,
>
> i am using sendmail and of course MS.
>
> But now i would check the Mail-Logs for some Stats..
>
> like what Mail-User is the big one..and so on..
>
> i would prefer a grafical output..like vispan or something like that..
>
> is there a free programm for linux which could run through my mail-logs
> and generate some kind of report?
>
> Any ideas would be helpfull..
>
> thanks in advance

You can use awstats.

>
> Marcel
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at LISTS.COM.AR  Tue Nov 30 19:01:55 2004
From: mailscanner at LISTS.COM.AR (Leonardo Helman)
Date: Thu Jan 12 21:27:46 2006
Subject: Spanish translation
Message-ID: <mailman.5316.1137101266.24926.mailscanner@lists.mailscanner.info>

Hi

Two little things:

In the file:
  reports/es/sender.content.report.txt

where it says
  Subject: Mensaje potencialmente peligros rechazado

It should say Mensaje potencialmente peligroso rechazado


And the plural form of "virus" is not "viruses", it's
also "virus"

This appears in: deleted.content.message.txt and stored.content.message.txt



Thank you very much
Saludos
--
Leonardo Helman
Pert Consultores
Argentina

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From campbell at cnpapers.com  Tue Nov 30 19:13:26 2004
From: campbell at cnpapers.com (Steve Campbell)
Date: Thu Jan 12 21:27:46 2006
Subject: Generic virus scanner found
Message-ID: <mailman.5317.1137101266.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Mr. Field,

Would you care to take a guess at which one it might think I have installed,
though. I have clamav installed on one server, and clavav and bitdefender on
another. Both of these are listed properly in the logs. I have never
installed any other - unless you count the clam module with the latest
upgrade.

I just find it curious that it is upgrading something.

Thanks

Steve Campbell


----- Original Message -----
From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, November 30, 2004 1:56 PM
Subject: Re: Generic virus scanner found


> It upgrades all the scanners you have installed, not just the ones you
> happen to be using at the moment. That way, if you change which scanners
> you want to use, you can be safe in the knowledge that they will already
> be up to date when you first use them.
>
> The "generic" scanner is one that you can write yourself to do whatever
> you want it to. Allows for much more customisation.
>
> Steve Campbell wrote:
>
> >Ever since upgrading to the latest release of MailScanner, I am seeing in
my
> >logs:
> >
> >update_virus_scanners: Found generic installed
> >update_virus_scanners: Running autoupdate for generic
> >
> >I only list clamav in my conf file as a Virus Scanner.
> >
> >What might it be autoupdating and why is it even looking for a "generic"
> >virus scanner if I don't specifiy I am using one?
> >
> >
>
> --

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From peter at UCGBOOK.COM  Tue Nov 30 19:19:21 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:46 2006
Subject: Generic virus scanner found
Message-ID: <mailman.5318.1137101266.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Steve Campbell wrote:
> Mr. Field,
>
> Would you care to take a guess at which one it might think I have installed,
> though. I have clamav installed on one server, and clavav and bitdefender on
> another. Both of these are listed properly in the logs. I have never
> installed any other - unless you count the clam module with the latest
> upgrade.
>
> I just find it curious that it is upgrading something.

You should read both your logs and Julians answer more carefully. It's
all there.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ugob at CAMO-ROUTE.COM  Tue Nov 30 19:01:23 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:46 2006
Subject: New section in the FAQ : Troubleshooting
Message-ID: <mailman.5319.1137101266.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi,

        I just created a new section in the FAQ: Troubleshooting.  I also
created an "answer": Troubleshooting slow server.  It gives a lot of
info on how to find the bottleneck on a seemingly slow server.

        Comments + additions welcome!

Regards,

Ugo

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From campbell at cnpapers.com  Tue Nov 30 19:41:56 2004
From: campbell at cnpapers.com (Steve Campbell)
Date: Thu Jan 12 21:27:46 2006
Subject: Generic virus scanner found
Message-ID: <mailman.5320.1137101266.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Mr. Bonivart,

Sorry to be so dense today, but I can't see what it's telling me.

Mr. Field's reply indicated "generic" was something I could write myself,
but I haven't written anything. "generic" is also an option to Virus
Scanners if I want to actually use it to scan with. I understand that it
will update anything I have installed, whether I use it or not - but I don't
have anything installed other than what I have specified.

Help me understand, please. I'm sure it's just the frame of mind that I'm
seeing this with.

Steve Campbell


----- Original Message -----
From: "Peter Bonivart" <peter@UCGBOOK.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, November 30, 2004 2:19 PM
Subject: Re: Generic virus scanner found


> Steve Campbell wrote:
> > Mr. Field,
> >
> > Would you care to take a guess at which one it might think I have
installed,
> > though. I have clamav installed on one server, and clavav and
bitdefender on
> > another. Both of these are listed properly in the logs. I have never
> > installed any other - unless you count the clam module with the latest
> > upgrade.
> >
> > I just find it curious that it is upgrading something.
>
> You should read both your logs and Julians answer more carefully. It's
> all there.
>
> --
> /Peter Bonivart
>
> --Unix lovers do it in the Sun
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From peter at UCGBOOK.COM  Tue Nov 30 20:09:36 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:46 2006
Subject: Generic virus scanner found
Message-ID: <mailman.5321.1137101266.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Steve Campbell wrote:
> Mr. Field's reply indicated "generic" was something I could write myself,
> but I haven't written anything. "generic" is also an option to Virus
> Scanners if I want to actually use it to scan with. I understand that it
> will update anything I have installed, whether I use it or not - but I don't
> have anything installed other than what I have specified.
>
> Help me understand, please. I'm sure it's just the frame of mind that I'm
> seeing this with.

Some time ago someone wanted to tackle some problem (I'm being very
vague since I don't remember it well but a search for generic scanner in
the archives should find it) by using their own perl scripts as a
scanner of sorts. They needed some way of plugging it into MailScanner
and Julian provided it with the generic scanner. If you check your lib
files you should find a wrapper and update script like the rest of the
scanners. Fill the wrapper script with your own code if you need to and
set Virus Scanners to include generic if you want to use it. As with all
scanners it will update regardless of whether it is used or not, if it's
installed it should be updated is Julians philosophy. That's why you see
two lines for it running the update script but that doesn't mean it's
actually updating something, if you look at your normal scanners they
add a third line with something like "Clam was updated/did not need
updating". There's nothing you need to do, everything is OK.

Read more about it in MailScanner.conf (Virus Scanners) and check the
generic-wrapper and generic-autoupdate scripts, they are also commented.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From vachanta at GMAIL.COM  Tue Nov 30 20:21:21 2004
From: vachanta at GMAIL.COM (Venkata Achanta)
Date: Thu Jan 12 21:27:46 2006
Subject: Mqueue getting huge - MailScanner problem
Message-ID: <mailman.5322.1137101266.24926.mailscanner@lists.mailscanner.info>

Here are the debug logs, when i restarted MailScanner with debugging on it
hug at this point......Any pointers for troubleshooting this problem ?

Running:
MailScanner 4.35.11.1
Spamassassin 3.0.1

Another point to add recently added mailwatch


Debug log:

debug: lock: 10027 trying to get lock on /etc/MailScanner/bayes/bayes with
0 retries

debug: lock: 10027 trying to get lock on /etc/MailScanner/bayes/bayes with
1 retries

debug: lock: 10027 trying to get lock on /etc/MailScanner/bayes/bayes with
2 retries

debug: lock: 10027 trying to get lock on /etc/MailScanner/bayes/bayes with
3 retries

debug: lock: 10027 trying to get lock on /etc/MailScanner/bayes/bayes with
4 retries

debug: lock: 10027 trying to get lock on /etc/MailScanner/bayes/bayes with
5 retries

debug: lock: 10027 trying to get lock on /etc/MailScanner/bayes/bayes with
6 retries

debug: lock: 10027 trying to get lock on /etc/MailScanner/bayes/bayes with
7 retries

debug: lock: 10027 trying to get lock on /etc/MailScanner/bayes/bayes with
8 retries

debug: lock: 10027 trying to get lock on /etc/MailScanner/bayes/bayes with
9 retries

Cannot open bayes databases /etc/MailScanner/bayes/bayes_* R/W: lock
failed: File exists

debug: lock: 10027 created /etc/MailScanner/bayes/bayes.lock.hostname.10027

debug: lock: 10027 trying to get lock on /etc/MailScanner/bayes/bayes with
0 retries

debug: lock: 10027 trying to get lock on /etc/MailScanner/bayes/bayes with
1 retries

debug: lock: 10027 trying to get lock on /etc/MailScanner/bayes/bayes with
2 retries

debug: lock: 10027 trying to get lock on /etc/MailScanner/bayes/bayes with
3 retries

debug: lock: 10027 trying to get lock on /etc/MailScanner/bayes/bayes with
4 retries

debug: lock: 10027 trying to get lock on /etc/MailScanner/bayes/bayes with
5 retries

debug: lock: 10027 trying to get lock on /etc/MailScanner/bayes/bayes with
6 retries

debug: lock: 10027 trying to get lock on /etc/MailScanner/bayes/bayes with
7 retries

debug: lock: 10027 breaking stale /etc/MailScanner/bayes/bayes.lock:
age=1101844188 now=1101844790

debug: lock: 10027 trying to get lock on /etc/MailScanner/bayes/bayes with
8 retries

debug: lock: 10027 link to /etc/MailScanner/bayes/bayes.lock: link ok

debug: bayes: 10027 tie-ing to DB file R/W /etc/MailScanner/bayes/bayes_toks

debug: bayes: 10027 tie-ing to DB file R/W /etc/MailScanner/bayes/bayes_seen

debug: bayes: found bayes db version 3

debug: refresh: 10027 refresh /etc/MailScanner/bayes/bayes.lock

debug: bayes: expiry check keep size, 0.75 * max: 112500

debug: bayes: token count: 366104, final goal reduction size: 253604

debug: bayes: First pass?  Current: 1101844790, Last: 1101725158, atime:
43200, count: 121600, newdelta: 20713, ratio: 2.08555921052632, period:
43200

debug: bayes: Can't use estimation method for expiry, something fishy,
calculating optimal atime delta (first pass)

debug: bayes: expiry max exponent: 9

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Tue Nov 30 20:35:07 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:46 2006
Subject: MailScanner 4.36.3 unstable released
Message-ID: <mailman.5323.1137101266.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I have just released MailScanner unstable version 4.36.3.

I have just added support for %variables% in output messages and
reports, so that you can configure your email "signature" in each of
these reports centrally, so I should have less people around the world
thinking I personally reject their mail! :-)

Many phishing fraud detector improvements since the last beta release
too, this should be a lot more reliable now.

Download it as usual from www.mailscanner.info.

Please try it out and let me know how you get on. Stable release due
very soon!
The full Change Log is here:

* New Features and Improvements *
- Improved URL trimming in phishing net.
- Various improvements and fixes in phishing net.
- Added support for RedHat Enterprise Linux 4.
- Added check for Password-Protected Archives setting when using
clamavmodule.
- Added support for "fast" parameter to all installation scripts.
- Improved logging when there are too many attachments.
- Added message ID to log of phishing attempts.
- Added autoupdater for Panda.
- Added %variables% to text and HTML report messages, so the email
"signature"
  added to the end of each report is customised centrally from
  MailScanner.conf. This currently uses %org-long-name% and %web-site%.

* Fixes *
- Fixed outstanding problem in bitdefender-autoupdate, so that it works
  properly on new installations.
- Fixed logging problem with phishing net on a few malformed messages.
- Removed /var/tmp files from MailScanner-MIME-Base64 rpm build.
- Fixed problem in Vexira parser.
- Fixed problem where All-Viruses would cause every problem to be silent.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From campbell at cnpapers.com  Tue Nov 30 20:42:18 2004
From: campbell at cnpapers.com (Steve Campbell)
Date: Thu Jan 12 21:27:46 2006
Subject: Generic virus scanner found
Message-ID: <mailman.5324.1137101266.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Mr. Bonivart,

Thank you very much.

I do recall the "generic" philosophy when it was invented, and had looked
throught both the wrapper and autoupdate scripts for generic. I am no perl
coder and not a very proficient shell coder, and thought that the "exit 0"
at the top would exit with nothing in the logs. I guess the logging is done
prior to calling the generic scheme.

Sorry for so much bother.

Steve Campbell

----- Original Message -----
From: "Peter Bonivart" <peter@UCGBOOK.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, November 30, 2004 3:09 PM
Subject: Re: Generic virus scanner found


> Steve Campbell wrote:
> > Mr. Field's reply indicated "generic" was something I could write
myself,
> > but I haven't written anything. "generic" is also an option to Virus
> > Scanners if I want to actually use it to scan with. I understand that it
> > will update anything I have installed, whether I use it or not - but I
don't
> > have anything installed other than what I have specified.
> >
> > Help me understand, please. I'm sure it's just the frame of mind that
I'm
> > seeing this with.
>
> Some time ago someone wanted to tackle some problem (I'm being very
> vague since I don't remember it well but a search for generic scanner in
> the archives should find it) by using their own perl scripts as a
> scanner of sorts. They needed some way of plugging it into MailScanner
> and Julian provided it with the generic scanner. If you check your lib
> files you should find a wrapper and update script like the rest of the
> scanners. Fill the wrapper script with your own code if you need to and
> set Virus Scanners to include generic if you want to use it. As with all
> scanners it will update regardless of whether it is used or not, if it's
> installed it should be updated is Julians philosophy. That's why you see
> two lines for it running the update script but that doesn't mean it's
> actually updating something, if you look at your normal scanners they
> add a third line with something like "Clam was updated/did not need
> updating". There's nothing you need to do, everything is OK.
>
> Read more about it in MailScanner.conf (Virus Scanners) and check the
> generic-wrapper and generic-autoupdate scripts, they are also commented.
>
> --
> /Peter Bonivart
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From john.crossan at valleypres.org  Tue Nov 30 20:38:25 2004
From: john.crossan at valleypres.org (John Crossan)
Date: Thu Jan 12 21:27:46 2006
Subject: MailScanner 4.36.3 unstable released
Message-ID: <mailman.5325.1137101266.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I'll try it when the Stable release is out. Looking forward to it.
Thanks
John Crossan

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
Behalf Of Julian Field
Sent: Tuesday, November 30, 2004 12:35 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: MailScanner 4.36.3 unstable released


I have just released MailScanner unstable version 4.36.3.

I have just added support for %variables% in output messages and
reports, so that you can configure your email "signature" in each of
these reports centrally, so I should have less people around the world
thinking I personally reject their mail! :-)

Many phishing fraud detector improvements since the last beta release
too, this should be a lot more reliable now.

Download it as usual from www.mailscanner.info.

Please try it out and let me know how you get on. Stable release due
very soon!
The full Change Log is here:

* New Features and Improvements *
- Improved URL trimming in phishing net.
- Various improvements and fixes in phishing net.
- Added support for RedHat Enterprise Linux 4.
- Added check for Password-Protected Archives setting when using
clamavmodule.
- Added support for "fast" parameter to all installation scripts.
- Improved logging when there are too many attachments.
- Added message ID to log of phishing attempts.
- Added autoupdater for Panda.
- Added %variables% to text and HTML report messages, so the email
"signature"
  added to the end of each report is customised centrally from
  MailScanner.conf. This currently uses %org-long-name% and %web-site%.

* Fixes *
- Fixed outstanding problem in bitdefender-autoupdate, so that it works
  properly on new installations.
- Fixed logging problem with phishing net on a few malformed messages.
- Removed /var/tmp files from MailScanner-MIME-Base64 rpm build.
- Fixed problem in Vexira parser.
- Fixed problem where All-Viruses would cause every problem to be silent.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mkettler at EVI-INC.COM  Tue Nov 30 20:56:22 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:46 2006
Subject: Mqueue getting huge - MailScanner problem
Message-ID: <mailman.5326.1137101266.24926.mailscanner@lists.mailscanner.info>

At 03:21 PM 11/30/2004, Venkata Achanta wrote:
>Here are the debug logs, when i restarted MailScanner with debugging on it
>hug at this point......Any pointers for troubleshooting this problem ?
>
>Running:
>MailScanner 4.35.11.1
>Spamassassin 3.0.1
>
>Another point to add recently added mailwatch
>
>
>Debug log:
>
>debug: lock: 10027 trying to get lock on /etc/MailScanner/bayes/bayes with
>0 retries

1) what is your bayes_path set to (I'd assume in spam.assassin.prefs.conf).

2) ls -l /etc/Mailscanner/ | grep bayes

3) ls -l /etc/MailScanner/bayes/

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Leonard.Hermens at POTLATCHCORP.COM  Tue Nov 30 20:58:05 2004
From: Leonard.Hermens at POTLATCHCORP.COM (Leonard Hermens)
Date: Thu Jan 12 21:27:46 2006
Subject: MailScanner 4.36.3 unstable released
Message-ID: <mailman.5327.1137101266.24926.mailscanner@lists.mailscanner.info>

At 12:35 PM 11/30/2004, Julian Field wrote:
>I have just released MailScanner unstable version 4.36.3.
>[...]
>Many phishing fraud detector improvements since the last beta release
>too, this should be a lot more reliable now.

Julian,

I concur. I agree with the removal of the mailto: detection, too, that was
a good solution for that tag.

Kudos and thanks.

-- Leonard

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From itdept at FRACTALWEB.COM  Tue Nov 30 21:04:12 2004
From: itdept at FRACTALWEB.COM (Fractal IT Dept.)
Date: Thu Jan 12 21:27:46 2006
Subject: upgraded to latest version,
     now getting "possible fraud attempt" on legit email
Message-ID: <mailman.5328.1137101266.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian Field wrote:

> You can either turn off the Phishing Fraud detector completely, or else
> see my last post in the thread "Re: Phishing version and mailto: tag"
> which has a replacement Message.pm file attached, which you should drop
> into /usr/lib/MailScanner/MailScanner/Message.pm and then stop and
> restart MailScanner.
>
> The phishing net has been under fairly rapid development recently, and
> has greatly improved.

Thanks Julian. Again, MailScanner continues to prove to be the poster
child of what an open source project should be.

Keep up the good work.

Cheers,
Chris

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From vachanta at GMAIL.COM  Tue Nov 30 21:09:31 2004
From: vachanta at GMAIL.COM (Venkata Achanta)
Date: Thu Jan 12 21:27:46 2006
Subject: Mqueue getting huge - MailScanner problem
Message-ID: <mailman.5329.1137101266.24926.mailscanner@lists.mailscanner.info>

1) what is your bayes_path set to (I'd assume in spam.assassin.prefs.conf).

bayes_path  /etc/MailScanner/bayes/bayes

2) ls -l /etc/MailScanner/ | grep bayes
drwxrwsr-x    2 root     apache      12288 Nov 30 13:05 bayes

3) ls -l /etc/MailScanner/bayes/

total 162748
-rw-------    1 root     apache        217 Nov 30 13:00 bayes.lock
-rw-------    1 root     apache        192 Nov 30 09:59
bayes.lock.host.10489
-rw-------    1 root     apache        128 Nov 30 13:04
bayes.lock.host.11919
-rw-------    1 root     apache         32 Nov 30 11:21
bayes.lock.host.16401
-rw-------    1 root     apache         32 Nov 30 09:59
bayes.lock.host.16649
-rw-------    1 root     apache        128 Nov 30 11:41
bayes.lock.host.16992
-rw-------    1 root     apache        160 Nov 30 11:21
bayes.lock.host.17390
-rw-------    1 root     apache        128 Nov 30 09:59
bayes.lock.host.19125
-rw-------    1 root     apache        288 Nov 30 11:56
bayes.lock.host.21598
-rw-------    1 root     apache         32 Nov 30 13:04
bayes.lock.host.23474
-rw-------    1 root     apache        217 Nov 30 11:51 bayes.lock.host.2353
-rw-------    1 root     apache         96 Nov 30 11:56
bayes.lock.host.24141
-rw-------    1 root     apache        192 Nov 30 13:04
bayes.lock.host.25992
-rw-------    1 root     apache         93 Nov 30 11:41 bayes.lock.host.2779
-rw-------    1 root     apache        288 Nov 30 11:51
bayes.lock.host.28571
-rw-------    1 root     apache        288 Nov 30 09:59
bayes.lock.host.29698
-rw-------    1 root     apache         62 Nov 30 11:56 bayes.lock.host.3096
-rw-------    1 root     apache         64 Nov 30 11:41
bayes.lock.host.31386
-rw-------    1 root     apache        128 Nov 30 11:56
bayes.lock.host.31595
-rw-------    1 root     apache        124 Nov 30 09:59 bayes.lock.host.5129
-rw-------    1 root     apache         62 Nov 30 11:41 bayes.lock.host.7721
-rw-rw----    1 root     apache     276048 Nov 30 13:04 bayes_journal
-rw-rw----    1 root     apache    5226496 Nov 30 12:43 bayes_seen
-rw-rw----    1 root     apache   10231808 Nov 30 12:57 bayes_toks
-rw-rw----    1 root     apache    4923392 Nov 27 10:49
bayes_toks.expire10006
-rw-rw----    1 root     apache    2781184 Nov 27 09:56
bayes_toks.expire11318
-rw-rw----    1 root     apache    4390912 Nov 27 11:29
bayes_toks.expire11567
-rw-rw----    1 root     apache    1449984 Nov 30 07:10
bayes_toks.expire12993
-rw-rw----    1 root     apache    2560000 Nov 30 00:51
bayes_toks.expire13261
-rw-rw----    1 root     apache    2752512 Nov 27 09:42 bayes_toks.expire133
-rw-rw----    1 root     apache    5337088 Nov 27 09:02
bayes_toks.expire13471
-rw-rw----    1 root     apache    3059712 Nov 27 09:29
bayes_toks.expire14351
-rw-rw----    1 root     apache      12288 Nov 30 12:33
bayes_toks.expire14793
-rw-rw----    1 root     apache    2142208 Nov 30 04:11
bayes_toks.expire15432
-rw-rw----    1 root     apache     274432 Nov 30 11:08
bayes_toks.expire15436
-rw-rw----    1 root     apache    4927488 Nov 29 01:12
bayes_toks.expire15914
-rw-rw----    1 root     apache    2355200 Nov 29 02:06
bayes_toks.expire15974
-rw-rw----    1 root     apache    2699264 Nov 29 22:53
bayes_toks.expire16419
-rw-rw----    1 root     apache     163840 Nov 29 15:40
bayes_toks.expire16507
-rw-rw----    1 root     apache    4653056 Nov 30 05:39
bayes_toks.expire16517
-rw-rw----    1 root     apache    4935680 Nov 29 00:58
bayes_toks.expire1711
-rw-rw----    1 root     apache    5029888 Nov 29 00:45
bayes_toks.expire17414
-rw-rw----    1 root     apache    1122304 Nov 30 08:32
bayes_toks.expire17539
-rw-rw----    1 root     apache    5148672 Nov 27 10:36
bayes_toks.expire18943
-rw-rw----    1 root     apache    5357568 Nov 30 08:05
bayes_toks.expire1969
-rw-rw----    1 root     apache    1056768 Nov 30 09:26
bayes_toks.expire20392
-rw-rw----    1 root     apache     544768 Nov 30 00:25
bayes_toks.expire2084
-rw-rw----    1 root     apache    2461696 Nov 29 01:26
bayes_toks.expire21259
-rw-rw----    1 root     apache    4739072 Nov 27 11:16
bayes_toks.expire22344
-rw-rw----    1 root     apache    2510848 Nov 29 21:53
bayes_toks.expire2275
-rw-rw----    1 root     apache    2551808 Nov 30 08:18
bayes_toks.expire23256
-rw-rw----    1 root     apache     569344 Nov 30 05:52
bayes_toks.expire24113
-rw-rw----    1 root     apache    2351104 Nov 27 10:23
bayes_toks.expire24319
-rw-rw----    1 root     apache    2310144 Nov 29 23:07
bayes_toks.expire24365
-rw-rw----    1 root     apache    2363392 Nov 29 01:52
bayes_toks.expire24667
-rw-rw----    1 root     apache    2170880 Nov 27 11:43
bayes_toks.expire25214
-rw-rw----    1 root     apache    2211840 Nov 27 12:10
bayes_toks.expire25267
-rw-rw----    1 root     apache    1093632 Nov 30 00:38
bayes_toks.expire26364
-rw-rw----    1 root     apache    5324800 Nov 27 08:09
bayes_toks.expire26535
-rw-rw----    1 root     apache    4608000 Nov 29 02:19
bayes_toks.expire28737
-rw-rw----    1 root     apache    4771840 Nov 30 12:46
bayes_toks.expire28786
-rw-rw----    1 root     apache    5132288 Nov 27 10:09
bayes_toks.expire28875
-rw-rw----    1 root     apache    5341184 Nov 27 08:35
bayes_toks.expire29113
-rw-rw----    1 root     apache     303104 Nov 29 22:30
bayes_toks.expire29845
-rw-rw----    1 root     apache    2658304 Nov 29 23:20 bayes_toks.expire305
-rw-rw----    1 root     apache    5296128 Nov 27 09:16
bayes_toks.expire31065
-rw-rw----    1 root     apache    2486272 Nov 30 10:55
bayes_toks.expire31238
-rw-rw----    1 root     apache    4923392 Nov 27 11:03
bayes_toks.expire31526
-rw-rw----    1 root     apache    1085440 Nov 29 22:06
bayes_toks.expire31582
-rw-rw----    1 root     apache    5062656 Nov 29 00:31
bayes_toks.expire32174
-rw-rw----    1 root     apache    1093632 Nov 30 10:41
bayes_toks.expire32193
-rw-rw----    1 root     apache    2199552 Nov 30 11:21
bayes_toks.expire32422
-rw-rw----    1 root     apache    4739072 Nov 29 02:32
bayes_toks.expire5172
-rw-rw----    1 root     apache    2396160 Nov 30 09:39
bayes_toks.expire5634
-rw-rw----    1 root     apache    4751360 Nov 30 13:00
bayes_toks.expire6021
-rw-rw----    1 root     apache    4325376 Nov 27 11:56 bayes_toks.expire604
-rw-rw----    1 root     apache    2351104 Nov 29 21:39
bayes_toks.expire6040
-rw-rw----    1 root     apache    4632576 Nov 29 01:39
bayes_toks.expire6310
-rw-rw----    1 root     apache    4734976 Nov 30 05:26
bayes_toks.expire6626
-rw-rw----    1 root     apache    2588672 Nov 27 08:49 bayes_toks.expire674
-rw-rw----    1 root     apache    2691072 Nov 30 11:39
bayes_toks.expire6846
-rw-rw----    1 root     apache    4751360 Nov 30 02:30
bayes_toks.expire8590
-rw-rw----    1 root     apache    4526080 Nov 30 02:16
bayes_toks.expire8627
-rw-rw----    1 root     apache    5353472 Nov 27 08:22
bayes_toks.expire8718
-rw-rw----    1 root     apache    5570560 Nov 30 03:58
bayes_toks.expire9099
-rw-rw----    1 root     apache    3006464 Nov 30 06:57 bayes_toks.expire922
-rw-rw----    1 root     apache    5242880 Nov 30 10:07
bayes_toks.expire9426
-rw-rw----    1 root     apache    5341184 Nov 30 02:43 bayes_toks.expire958



i replace my fqdn with host here for anonymity. Let me know if you need any
other info

Thanks for responding,

Venkata Achanta

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From james_gray at ocs.com  Tue Nov 30 22:16:06 2004
From: james_gray at ocs.com (James Gray)
Date: Thu Jan 12 21:27:46 2006
Subject: Dont send virus alerts, but DO send bad file name/type etc.
Message-ID: <mailman.5330.1137101266.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi All,

Our site is being hammered with Sober.j and Netsky.p (mostly) to the tune of
several hundred an hour at times.  Understandably, users are getting a little
peeved at the amount "[** VIRUS **]" alerts they're getting.  I've hinted to
the powers that be, there may be a way to dump virus alerts, but still send
notices to users about bad filenames and bad filetypes.  Spam will be handled
by attaching the original (action=attachment deliver).

So the actions would be:
Virus = delete, don't send notice to user, notify admin.
Bad Filname = quarantine, notify user, notify admin.
Bad Filetype = quarantine, notify user, notify admin.
Spam = deliver as attachment (actually these are handled by a bunch of
rulesets to enable per-user hi/lo spam thresholds and spam actions, but the
default is "deliver attachment")

So does anyone know the magic combination of options in mailscanner.conf to
achieve what I'm trying to do??  I've RTFMAQ, and FAQ and the archives, and
the conf file, but haven't found anything _exactly_ what I'm after.  Feel
free to beat beat me with a clue bat if I've missed something.

Thanks in advance.  BTW - thanks to Julian for saving our Windows users from
themselves :P  Have to admit how smug I felt during that in-between period of
virus outbreak and signature update, where MailScanner dutifully quarantined
all the nasty attachments even though NAI-VirusScan didn't detect them :)

Cheers,

James
--
I.T. Manager - Asia Region
Open Channel Solutions
Sydney, Australia
Web:    http://www.ocs.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From peter at UCGBOOK.COM  Tue Nov 30 22:17:32 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:46 2006
Subject: Generic virus scanner found
Message-ID: <mailman.5331.1137101266.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Steve Campbell wrote:
> I do recall the "generic" philosophy when it was invented, and had looked
> throught both the wrapper and autoupdate scripts for generic. I am no perl
> coder and not a very proficient shell coder, and thought that the "exit 0"
> at the top would exit with nothing in the logs. I guess the logging is done
> prior to calling the generic scheme.

You're right, the log lines you see come from update_virus_scanners. In
the beginning the generic-autoupdate script actually logged a line of
its own like the others but some objected to that and Julian removed it.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From mailscanner at ecs.soton.ac.uk  Tue Nov 30 22:27:20 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:46 2006
Subject: Dont send virus alerts, but DO send bad file name/type etc.
Message-ID: <mailman.5332.1137101266.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

James Gray wrote:

>Hi All,
>
>Our site is being hammered with Sober.j and Netsky.p (mostly) to the tune of
>several hundred an hour at times.  Understandably, users are getting a little
>peeved at the amount "[** VIRUS **]" alerts they're getting.  I've hinted to
>the powers that be, there may be a way to dump virus alerts, but still send
>notices to users about bad filenames and bad filetypes.  Spam will be handled
>by attaching the original (action=attachment deliver).
>
>So the actions would be:
>Virus = delete, don't send notice to user, notify admin.
>
>
Silent Viruses = All-Viruses
Still Deliver Silent Viruses = no

>Bad Filname = quarantine, notify user, notify admin.
>Bad Filetype = quarantine, notify user, notify admin.
>Spam = deliver as attachment (actually these are handled by a bunch of
>rulesets to enable per-user hi/lo spam thresholds and spam actions, but the
>default is "deliver attachment")
>
>So does anyone know the magic combination of options in mailscanner.conf to
>achieve what I'm trying to do??  I've RTFMAQ, and FAQ and the archives, and
>the conf file, but haven't found anything _exactly_ what I'm after.  Feel
>free to beat beat me with a clue bat if I've missed something.
>
>Thanks in advance.  BTW - thanks to Julian for saving our Windows users from
>themselves :P  Have to admit how smug I felt during that in-between period of
>virus outbreak and signature update, where MailScanner dutifully quarantined
>all the nasty attachments even though NAI-VirusScan didn't detect them :)
>
>
Handy, isn't it!

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From jstevens at ATHENSDISTRIBUTING.COM  Tue Nov 30 22:41:06 2004
From: jstevens at ATHENSDISTRIBUTING.COM (James R. Stevens)
Date: Thu Jan 12 21:27:46 2006
Subject: SendMail Queue...
Message-ID: <mailman.5333.1137101266.24926.mailscanner@lists.mailscanner.info>

Does anyone know the M4 macro for these functions.

O Timeout.queuereturn=8d

 
O Timeout.queuewarn=8d 

 

-----Original Message-----
From: Robin, Rob [mailto:rrobin@GREENAPPLE.COM] 
Sent: Tuesday, November 30, 2004 12:37 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: FW: SendMail Queue...

--

> How can I increase the queue time on sendmail.

> We are relaying mail for a customer who's exchange server has gone
down.  Can you advise how to increase the >>queue length so that their
mail doesn't get bounced back?  I think its set to 5 days at the moment.

> many thanks
----

Mark,

If their mail server is down, to save unnecessary processing time, you
may want to move them to a separate queue.

You can possibly do it 2 ways:
1) At the MailScanner.conf, you can specify a ruleset file for Outgoing
Queue to make sure their mail gets to the 
  backup dir (say /var/spool/mailbackup).

2) Use qtool.pl (if memory serves me right, it's under sendmail contrib
dir, but a google search will get you there) to move it to a separate
queue say /var/spool/mailbackup

   Once their exchange is up, you can run 
   /usr/sbin/sendmail -q -OQueueDirectory=/var/spool/mailbackup
-OTimeout.queuereturn=10d {depends how long they are down)
-OTimeout.queuewarn=10d

   You can also, by your own preference, generate the warning message to
the sender by running the queue on /var/spool/mailbackup and tune
Timeout.queuewarn to which ever you like..  Some people expect their
mails to be as fast as IM :-)..
 

Thanks,
------------------------
Rob Robin 
Network Analyst
Green Apple, Inc.
740-653-9890
rrobin@greenapple.com
www.greenapple.com
Internet access, hosting and development solutions since 1995.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

-- 
This message has been scanned for viruses and
dangerous content by Athens Hyperion Scanner, and is
believed to be clean.




-- 
This message has been scanned for viruses and
dangerous content by Athens Hyperion Scanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From marco at XSSNET.COM  Tue Nov 30 22:45:15 2004
From: marco at XSSNET.COM (Marco Benton)
Date: Thu Jan 12 21:27:46 2006
Subject: SendMail Queue...
Message-ID: <mailman.5334.1137101266.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

James R. Stevens wrote:

| Does anyone know the M4 macro for these functions.
|
| O Timeout.queuereturn=8d
|
|
| O Timeout.queuewarn=8d
|


define(`confTO_QUEUERETURN',`8d')
define(`confTO_QUEUEWARN',`8h')

- --

Marco Benton - BOFH, BSMFH
Network Consultant
Phone: (774) 808-4051
Fax  : (508) 519-6033

BOFH excuse #357: The cause of the problem is: struck by the Good
Times virus

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBrPf72+PYgoYkw8ERAi4jAKC/p8NbrnYr5XB2uImqMdtS2hw6jgCdEFmR
kGZVxUGe5Yi/MZ0O93J/4fs=
=EwD5
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From Kevin_Miller at CI.JUNEAU.AK.US  Tue Nov 30 23:13:46 2004
From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller)
Date: Thu Jan 12 21:27:46 2006
Subject: quoted-printable octet-stream issues
Message-ID: <mailman.5335.1137101266.24926.mailscanner@lists.mailscanner.info>

Martin Hepworth wrote:
> Chuck
>
> what version of MS are you using. I think 4.35 has a fix for this
> issue, the problem is Outleek, rather than exchange. Anyway upgrading
> to
> 4.35-11 fixed the issue for the one person affected here..
>
>
> Chuck Foster wrote:
>> Hi,
>>
>> I've been looking at a problem with some PDF messages that were being
>> corrupted on arrival; looking at it more closely I can see that our
>> Exchange server is sending out the attachments as quoted-printable
>> and by the time they've been through MailScanner the content has
>> been changed, specifically the midline =0As have now become physical
>> newlines and (I guess) are being mangled through the MTA (sendmail).
>>
>> I noted that there is some code to 'massage' quoted-printable in
>> Message.pm, and the file on disk seems to be fine, so I would think
>> the problem is in re-encoding the content back to quoted-printable
>> on the way out.
>>
>> Is this a common problem that has now been fixed (I couldn't find any
>> reference on a net trawl)? Obviously this doesn't occur for
>> BASE64-encoded messages.
>>
>> Regards,
>> Chuck

Also, you can change the way Exchange sends out MIME attachments.  Check the
archives around 10/13 for a message w/subject 'Re: trouble with exchange
servers'.

That may help...

...Kevin
--
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Admin., Mail Admin.
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ssilva at SGVWATER.COM  Tue Nov 30 23:54:13 2004
From: ssilva at SGVWATER.COM (Scott Silva)
Date: Thu Jan 12 21:27:46 2006
Subject: MailScanner 4.36.3 unstable released
Message-ID: <mailman.5336.1137101266.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

John Crossan wrote:
| I'll try it when the Stable release is out. Looking forward to it.
| Thanks
| John Crossan
|
Since tomorrow is the 1st, that shouldn't be too far away (depending, of
course on Julian's schedule).
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBrQgkRADw9lziUqQRAo2zAJ0TxfzPShbM8+k3Wz1B7LDz9lR3bwCfeqO4
odEXqRdAvy70ltsKVJoaWy4=
=FBr9
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From ssilva at SGVWATER.COM  Tue Nov 30 23:58:34 2004
From: ssilva at SGVWATER.COM (Scott Silva)
Date: Thu Jan 12 21:27:46 2006
Subject: SendMail Queue...
Message-ID: <mailman.5337.1137101266.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

James R. Stevens wrote:
| Does anyone know the M4 macro for these functions.
|
| O Timeout.queuereturn=8d
|

define(`confTO_QUEUERETURN', `8d')
|
| O Timeout.queuewarn=8d
|
|
define(`confTO_QUEUEWARN', `8d')

(from my sendmail.mc, adjusted to your requested times)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBrQkqRADw9lziUqQRAqBhAJ9qlXR1av80EeqKsr3zQ618jh1abACcCnVV
oemLUXe9fBtXA/fA0blT5iM=
=zHhc
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!