Why the messages virus are not stopped by MailScanner?

[Ricardo Luis CaXavate]

Hi friends!!

Since one month more or less i does not scan virusses in messages. Some
users tell me that they are receiving virus and i do not believe them.

Looking for scanning messages in the maillog i see this:

Oct 15 09:47:37 servnozar sendmail[9419]: i9F7laxR009419:
from=<r_canavate at terra.es>, size=49430, class=0, nrcpts=1,
msgid=<HGELIJHMDHKAIELLJFMMMEDIDJAA.r_canavate at terra.es>, proto=ESMTP,
daemon=Daemon0, relay=smtp.terra.es [213.4.129.129]
Oct 15 09:47:48 servnozar MailScanner[9034]: Expanding TNEF archive at
/var/spool/MailScanner/incoming/9034/i9F7laxR009419/winmail.dat
Oct 15 09:47:49 servnozar MailScanner[9034]:
/home/spool.mailscanner/incoming/9034/i9F7laxR009419/winmail.dat/letter43.zi
p        Found the W32/Netsky.p at MM!zip virus !!!
Oct 15 09:47:49 servnozar MailScanner[9034]:
/home/spool.mailscanner/incoming/9034/i9F7laxR009419/letter43.zip
Found the W32/Netsky.p at MM!zip virus !!!
Oct 15 09:47:50 servnozar sendmail[9447]: i9F7laxR009419:
to=<informatica at nozar.es>, delay=00:00:13, xdelay=00:00:00, mailer=local,
pri=120811, dsn=2.0.0, stat=Sent

THE MESSAGE ARE SCAN AND THE VIRUS FOUND IT!!.

But then I receive the message and the messages are signing as clean in
MailWatch .

5/10/04 09:47:49        r_canavate at terra.es     informatica at nozar.es    RV: I love
you!    48.7Kb          5.86    Clean

From:   r_canavate at terra.es
To:     informatica at nozar.es
Subject:        RV: I love you!
Size:   48.7Kb
Virus:   N
Blocked File:    N
Other Infection:         N
Report:
Spam:    N   Action(s): deliver
High Scoring Spam:       N
Listed in RBL:   N
Whitelisted:     N
Blacklisted:     N
SpamAssassin Spam:       N
SpamAssassin Score:     5.86
Spam Report:
        Score   Matching Rule   Description2.25 AWL
-1.52   BAYES_01
1.33    SARE_FREE_WEBM_EsTerra
3.81    USERPASS
Archive:


In this last month i do not remember what i have installed.

Thanks in advanced.


Ricardo Luis Cañavate García
Dpto. Informática
NOZAR Grupo Inmobiliario
Tel: 91 758 96 30 | Fax: 91 559 85 82
www.nozar.es


=========================================================================
Usted recibe este mensaje porque su dirección e-mail se encuentra en 
nuestra base de datos al haber tenido contactos anteriores con nosotros, 
por lo que entendemos que contamos con su autorización para enviarle 
información profesional. No obstante, si no desea seguir recibiéndola 
basta con hacérnoslo saber.
Este mensaje se dirige exclusivamente a su destinatario y puede contener 
información privilegiada o confidencial. Si no es vd. el destinatario 
indicado, queda notificado de que la utilización, divulgación y/o copia 
sin autorización está prohibida en virtud de la legislación vigente. 
Si ha recibido este mensaje por error, le rogamos que nos lo comunique 
inmediatamente por esta misma vía y proceda a su destrucción.


You are receiving this message because your e-mail address is listed in 
our database due to previous communications with us, 
so we have assumed that we have your permission to send you professional 
information. However, if you do not wish to continue to receive such 
information then please let us know.
This message is intended exclusively for its addressee and may contain 
information that is CONFIDENTIAL and protected by professional privilege. 
If you are not the intended recipient you are hereby notified that any 
dissemination, copy or disclosure of this communication is strictly 
prohibited by law. If this message has been received in error, please 
immediately notify us via e-mail and delete it.
=======================================================================

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).