Emails get stuck in the incoming queue (mqueue.in)

[Julian Field]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Found and fixed.

New Message.pm attached (gzipped).

Scott Silva wrote:

>Stefan Rapp wrote:
>
>
>>I think i now have a single message reproducing the problem
>>(ClamAV says it is infected by HTML.Phishing.Bank-87).
>>
>>Only this message mqueue.in and Mailscanner in debug mode,
>>the message is scanned and quaratined, but then the process
>>exits with an error message and the queue files remain in
>>mqueue.in.
>>
>>syslog:
>>
>>MailScanner E-Mail Virus Scanner version 4.40.6 starting...
>>Enabling SpamAssassin auto-whitelist functionality...
>>SophosSAVI 3.91 (engine 2.28) recognizing 101594 viruses
>>SophosSAVI using 110 IDE files
>>lock.pl sees Config  LockType =  flock
>>lock.pl sees have_module =  0
>>Using locktype = flock
>>New Batch: Scanning 1 messages, 9634 bytes
>>Created attachment dirs for 1 messages
>>Spam Checks: Starting
>>SpamAssassin returned 0
>>Virus and Content Scanning: Starting
>>Commencing scanning by sophossavi...
>>Completed scanning by sophossavi
>>Commencing scanning by clamavmodule...
>>ClamAVModule::INFECTED:: HTML.Phishing.Bank-87:: ./j2L5c6It018505/msg-6796-2.html
>>Completed scanning by clamavmodule
>>Virus Scanning: ClamAV Module found 1 infections
>>Infected message j2L5c6It018505 came from ...
>>Virus Scanning: Found 1 viruses
>>Saved entire message to /var/spool/MailScanner/quarantine/20050322/j2L5c6It018505
>>Saved infected "msg-6796-2.html" to /var/spool/MailScanner/quarantine/20050322/j2L5c6It018505
>>
>>debug log:
>>
>>...
>>debug: auto-learn: currently using scoreset 3, recomputing score based on scoreset 1.
>>debug: auto-learn: message score: -2.591, computed score for autolearn: 0.179
>>debug: auto-learn? ham=0.1, spam=12, body-points=0.001, head-points=0.178, learned-points=-2.599
>>debug: auto-learn? no: inside auto-learn thresholds, not considered ham or spam
>>debug: is spam? score=-2.591 required=5
>>debug: tests=BAYES_00,HTML_MESSAGE,HTML_NONELEMENT_00_10,NO_REAL_NAME,SPF_HELO_PASS
>>debug: subtests=__COMMENT_EXISTS,__CT,__CTYPE_HAS_BOUNDARY,__HAS_MSGID,__HAS_SUBJECT,__MAILMAN_21,__MIME_HTML,__MIME_VERSION,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__RFC_IGNORANT_ENVFROM,__SANE_MSGID,__TAG_EXISTS_HTML
>>debug: auto-learn: currently using scoreset 3, recomputing score based on scoreset 1.
>>debug: auto-learn: message score: -2.591, computed score for autolearn: 0.179
>>debug: auto-learn? ham=0.1, spam=12, body-points=0.001, head-points=0.178, learned-points=-2.599
>>debug: auto-learn? no: inside auto-learn thresholds, not considered ham or spam
>>Can't call method "print" on an undefined value at /sw/sun4_59/cyrus-2.2.10/lib/perl5/site_perl/5.8.6/MIME/Entity.pm line 1824.
>>
>>
>>
>I wonder where it is getting the path for entity.pm in the debug log
>above. That is 8 levels deep and seems a strange place to have perl
>installed. Something is hosed in the perl configuration.
>
>--
>"If you have ever eaten crow,
>It don't taste like chicken!!"
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Application/X-GZIP  65KB. ]
    [ Unable to print this part. ]