Mailscanner seems not scanning forwarding mails

Gustavo Flamerich gflamerich at MODULOSEMPRESARIOS.NET
Mon Jul 4 16:41:13 IST 2005

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

We have problems with mailscannes because some emails that arrives to
our box and are forwarded to another address seems to be infected and
mailscanner doesn't stop them.
Our mailscanner is config to scan every message for virus, so don't
undersatand why a message received is not scanned even is not for a pop
account, just an alias to forward to a address outside our box.
Here is a record from our exim_mainlog were we notice the problem, some
other ISP blocked us because they found the virus.

2005-07-04 06:10:52 1DpNtu-00014d-3I **
<> R=lookuphost T=remote_smtp: SMTP error from remote
mailer after end of data: host [##.##.###.###]: 554
5.7.1 virus HTML.Phishing.Bank-1 detected by ClamAV -
root at delta [/var/log]# grep "1DpNtu-00014d-3I" exim_mainlog
address1 is outside our box, address2 is a forwarding address, doesn't
have a pop account.

We are using mailscanner with clamav, the same antivirus that blocked
the message at the ISP. Also looked at the virus database and found the
HTML.Phishing.Bank-1 as virus, so we understand that clamav actually
found on that email a visrus, not a phishing.
We are running exim-4.44-0, mailscanner version 4.42.9, ClamAV 0.86.1
with clamavmodule on a Cpanel RH 9 server.

Gustavo Flamerich
Soluciones Profesionales de Alojamiento Web
email: gflamerich at

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki ( and
the archives (

Support MailScanner development - buy the book off the website!

More information about the MailScanner mailing list