Emails get stuck in the incoming queue (mqueue.in)

[Scott Silva]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Stefan Rapp wrote:
> I think i now have a single message reproducing the problem
> (ClamAV says it is infected by HTML.Phishing.Bank-87).
>
> Only this message mqueue.in and Mailscanner in debug mode,
> the message is scanned and quaratined, but then the process
> exits with an error message and the queue files remain in
> mqueue.in.
>
> syslog:
>
> MailScanner E-Mail Virus Scanner version 4.40.6 starting...
> Enabling SpamAssassin auto-whitelist functionality...
> SophosSAVI 3.91 (engine 2.28) recognizing 101594 viruses
> SophosSAVI using 110 IDE files
> lock.pl sees Config  LockType =  flock
> lock.pl sees have_module =  0
> Using locktype = flock
> New Batch: Scanning 1 messages, 9634 bytes
> Created attachment dirs for 1 messages
> Spam Checks: Starting
> SpamAssassin returned 0
> Virus and Content Scanning: Starting
> Commencing scanning by sophossavi...
> Completed scanning by sophossavi
> Commencing scanning by clamavmodule...
> ClamAVModule::INFECTED:: HTML.Phishing.Bank-87:: ./j2L5c6It018505/msg-6796-2.html
> Completed scanning by clamavmodule
> Virus Scanning: ClamAV Module found 1 infections
> Infected message j2L5c6It018505 came from ...
> Virus Scanning: Found 1 viruses
> Saved entire message to /var/spool/MailScanner/quarantine/20050322/j2L5c6It018505
> Saved infected "msg-6796-2.html" to /var/spool/MailScanner/quarantine/20050322/j2L5c6It018505
>
> debug log:
>
> ...
> debug: auto-learn: currently using scoreset 3, recomputing score based on scoreset 1.
> debug: auto-learn: message score: -2.591, computed score for autolearn: 0.179
> debug: auto-learn? ham=0.1, spam=12, body-points=0.001, head-points=0.178, learned-points=-2.599
> debug: auto-learn? no: inside auto-learn thresholds, not considered ham or spam
> debug: is spam? score=-2.591 required=5
> debug: tests=BAYES_00,HTML_MESSAGE,HTML_NONELEMENT_00_10,NO_REAL_NAME,SPF_HELO_PASS
> debug: subtests=__COMMENT_EXISTS,__CT,__CTYPE_HAS_BOUNDARY,__HAS_MSGID,__HAS_SUBJECT,__MAILMAN_21,__MIME_HTML,__MIME_VERSION,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__RFC_IGNORANT_ENVFROM,__SANE_MSGID,__TAG_EXISTS_HTML
> debug: auto-learn: currently using scoreset 3, recomputing score based on scoreset 1.
> debug: auto-learn: message score: -2.591, computed score for autolearn: 0.179
> debug: auto-learn? ham=0.1, spam=12, body-points=0.001, head-points=0.178, learned-points=-2.599
> debug: auto-learn? no: inside auto-learn thresholds, not considered ham or spam
> Can't call method "print" on an undefined value at /sw/sun4_59/cyrus-2.2.10/lib/perl5/site_perl/5.8.6/MIME/Entity.pm line 1824.
>
I wonder where it is getting the path for entity.pm in the debug log
above. That is 8 levels deep and seems a strange place to have perl
installed. Something is hosed in the perl configuration.

--
"If you have ever eaten crow,
It don't taste like chicken!!"

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!