MS started crashing ...

Thu Nov 16 18:51:04 GMT 2006

Ugo Bellavance wrote:
> Garry Glendown wrote:
>> Today, MS started piling up messages - checking the system, I noticed
>> continuous zombie-MS, running it with --debug/--debug-sa, I found that
>> MS keeps crashing, probably caused by a message ... how can I find what
>> is causing this?
>>
>> Here's the last couple lines, the "format error" lines repeated
>> something like 50 times ...
>>
>> format error: can't find EOCD signature
>>  at /usr/sbin/MailScanner line 820
>> format error: can't find EOCD signature
>>  at /usr/sbin/MailScanner line 820
>> Reference to nonexistent group in regex; marked by <-- HERE in
>> m/ï¿½è>Mxï¿½jmï¿½Bï¿½\6 <-- HERE
>> wÔ¿ï¿½Qï¿½ï¿½ï¿½ï¿½ï¿½Ä©ï¿½#ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½Dï¿½-rï¿½hï¿½ï¿½ï¿½\.ï¿½ï¿½ï¿½H!ï¿½ï¿½dï¿½ï¿½Dï¿½Uï¿½IWWï¿½ï¿½ï¿½ï¿½ï¿½ï¿½U\[eB4ï¿½ï¿½Tï¿½ï¿½mÒ«ï¿½hï¿½bï¿½1D×ï¿½ï¿½ï¿½ï¿½~iË©ï¿½=ï¿½ï¿½|4ï¿½ï¿½ï¿½ï¿½Rke3ï¿½ï¿½Gjï¿½\.ï¿½3\^ï¿½ï¿½bi/Nï¿½ï¿½ï¿½/ï¿½\ï¿½/ï¿½ï¿½ï¿½ï¿½~Dï¿½ï¿½Vï¿½ï¿½ï¿½Í·ï¿½ï¿½ï¿½\]ï¿½ï¿½rpï¿½\?ï¿½uï¿½/ï¿½\^:/
>>
>> at /usr/lib/MailScanner/MailScanner/Message.pm line 3304, <GEN250>
>> line 2.
>>
>> WTF?
> 
> Check in the logs first to see if there is one message that keeps on
> coming over and over again.
> 
> Another idea would be to stop your MTA then let MailScanner run for a
> while and see what remains in the incoming queue.  If you can't tell,
> move all queue files to another directory and re-move them one by one.
> 
> Ugo
> 

Had that idea, too ... I've located multiple spam messages that cause
this ... here's the mail.log:

Nov 16 19:41:19 mr-01 MailScanner[11412]: MailScanner E-Mail Virus
Scanner version 4.56.7 starting...
Nov 16 19:41:21 mr-01 MailScanner[11412]: Using SpamAssassin results cache
Nov 16 19:41:21 mr-01 MailScanner[11412]: Connected to SpamAssassin
cache database
Nov 16 19:41:23 mr-01 MailScanner[11412]: ClamAV scanner using unrar
command /usr/bin/unrar
Nov 16 19:41:23 mr-01 MailScanner[11412]: Using locktype = posix
Nov 16 19:41:23 mr-01 MailScanner[11412]: Creating hardcoded
struct_flock subroutine for linux (Linux-type)
Nov 16 19:41:23 mr-01 MailScanner[11412]: New Batch: Scanning 1
messages, 52528 bytes
Nov 16 19:41:23 mr-01 MailScanner[11412]: Spam Checks: Starting
Nov 16 19:41:25 mr-01 MailScanner[11412]: SpamAssassin cache hit for
message kAGHiHlV016647
Nov 16 19:41:25 mr-01 MailScanner[11412]: Spam Checks completed at 20666
bytes per second
Nov 16 19:41:25 mr-01 MailScanner[11412]: Virus and Content Scanning:
Starting
Nov 16 19:41:27 mr-01 MailScanner[11412]: HTML-Form tag found in message
kAGHiHlV016647 from bounce-epzgisiswhzcyz at send.smartbrief.com
Nov 16 19:41:27 mr-01 MailScanner[11412]: HTML Img tag found in message
kAGHiHlV016647 from bounce-epzgisiswhzcyz at send.smartbrief.com
Nov 16 19:41:27 mr-01 MailScanner[11412]: Content Checks: Detected
HTML-specific exploits in kAGHiHlV016647
Nov 16 19:41:27 mr-01 MailScanner[11412]: Content Checks: Found 1 problems
Nov 16 19:41:27 mr-01 MailScanner[11412]: Virus Scanning completed at
25384 bytes per second
Nov 16 19:41:27 mr-01 MailScanner[11412]: Content Checks: Detected and
have disarmed web bug tags in HTML message in kAGHiHlV016647 from
bounce-epzgisiswhzcyz at send.smartbrief.com
Nov 16 19:41:27 mr-01 MailScanner[11412]: Saved entire message to
/var/spool/MailScanner/quarantine/20061116/kAGHiHlV016647
Nov 16 19:41:28 mr-01 MailScanner[11412]: Saved infected
"msg-11412-1.html" to
/var/spool/MailScanner/quarantine/20061116/kAGHiHlV016647

---------------------------------------------
Debug-Output:

mr-01:~ # MailScanner --debug --debug-sa
In Debugging mode, not forking...
[12080] dbg: logger: adding facilities: all
[12080] dbg: logger: logging level is DBG
[12080] dbg: generic: SpamAssassin version 3.1.0
[12080] dbg: config: score set 0 chosen.
[12080] dbg: util: running in taint mode? no
[12080] dbg: dns: is Net::DNS::Resolver available? yes
[12080] dbg: dns: Net::DNS version: 0.48
[12080] dbg: dns: name server: 195.158.60.24, family: 2, ipv6: 0
[12080] dbg: ignore: test message to precompile patterns and load modules
[12080] dbg: config: using "/etc/mail/spamassassin" for site rules pre files
[12080] dbg: config: read file /etc/mail/spamassassin/init.pre
[12080] dbg: config: read file /etc/mail/spamassassin/v310.pre
[12080] dbg: config: read file /etc/mail/spamassassin/v312.pre
[12080] dbg: config: using "/usr/share/spamassassin" for sys rules pre files
[12080] dbg: config: using "/usr/share/spamassassin" for default rules dir
[12080] dbg: config: read file /usr/share/spamassassin/10_misc.cf
[12080] dbg: config: read file /usr/share/spamassassin/20_advance_fee.cf
[12080] dbg: config: read file /usr/share/spamassassin/20_anti_ratware.cf
[12080] dbg: config: read file /usr/share/spamassassin/20_body_tests.cf
[12080] dbg: config: read file /usr/share/spamassassin/20_compensate.cf
[12080] dbg: config: read file /usr/share/spamassassin/20_dnsbl_tests.cf
[12080] dbg: config: read file /usr/share/spamassassin/20_drugs.cf
[12080] dbg: config: read file /usr/share/spamassassin/20_fake_helo_tests.cf
[12080] dbg: config: read file /usr/share/spamassassin/20_head_tests.cf
[12080] dbg: config: read file /usr/share/spamassassin/20_html_tests.cf
[12080] dbg: config: read file /usr/share/spamassassin/20_meta_tests.cf
[12080] dbg: config: read file /usr/share/spamassassin/20_net_tests.cf
[12080] dbg: config: read file /usr/share/spamassassin/20_phrases.cf
[12080] dbg: config: read file /usr/share/spamassassin/20_porn.cf
[12080] dbg: config: read file /usr/share/spamassassin/20_ratware.cf
[12080] dbg: config: read file /usr/share/spamassassin/20_uri_tests.cf
[12080] dbg: config: read file /usr/share/spamassassin/23_bayes.cf
[12080] dbg: config: read file /usr/share/spamassassin/25_accessdb.cf
[12080] dbg: config: read file /usr/share/spamassassin/25_antivirus.cf
[12080] dbg: config: read file /usr/share/spamassassin/25_body_tests_es.cf
[12080] dbg: config: read file /usr/share/spamassassin/25_body_tests_pl.cf
[12080] dbg: config: read file /usr/share/spamassassin/25_dcc.cf
[12080] dbg: config: read file /usr/share/spamassassin/25_domainkeys.cf
[12080] dbg: config: read file /usr/share/spamassassin/25_hashcash.cf
[12080] dbg: config: read file /usr/share/spamassassin/25_pyzor.cf
[12080] dbg: config: read file /usr/share/spamassassin/25_razor2.cf
[12080] dbg: config: read file /usr/share/spamassassin/25_replace.cf
[12080] dbg: config: read file /usr/share/spamassassin/25_spf.cf
[12080] dbg: config: read file /usr/share/spamassassin/25_textcat.cf
[12080] dbg: config: read file /usr/share/spamassassin/30_text_de.cf
[12080] dbg: config: read file /usr/share/spamassassin/30_text_fr.cf
[12080] dbg: config: read file /usr/share/spamassassin/30_text_it.cf
[12080] dbg: config: read file /usr/share/spamassassin/30_text_nl.cf
[12080] dbg: config: read file /usr/share/spamassassin/30_text_pl.cf
[12080] dbg: config: read file /usr/share/spamassassin/30_text_pt_br.cf
[12080] dbg: config: read file /usr/share/spamassassin/50_scores.cf
[12080] dbg: config: read file /usr/share/spamassassin/60_awl.cf
[12080] dbg: config: read file /usr/share/spamassassin/60_whitelist.cf
[12080] dbg: config: read file /usr/share/spamassassin/60_whitelist_spf.cf
[12080] dbg: config: read file
/usr/share/spamassassin/60_whitelist_subject.cf
[12080] dbg: config: using "/etc/mail/spamassassin" for site rules dir
[12080] dbg: config: read file /etc/mail/spamassassin/10_local_report.cf
[12080] dbg: config: read file /etc/mail/spamassassin/70_sare_adult.cf
[12080] dbg: config: read file
/etc/mail/spamassassin/70_sare_bayes_poison_nxm.cf
[12080] dbg: config: read file /etc/mail/spamassassin/70_sare_evilnum0.cf
[12080] dbg: config: read file /etc/mail/spamassassin/70_sare_genlsubj0.cf
[12080] dbg: config: read file /etc/mail/spamassassin/70_sare_genlsubj1.cf
[12080] dbg: config: read file /etc/mail/spamassassin/70_sare_genlsubj2.cf
[12080] dbg: config: read file /etc/mail/spamassassin/70_sare_genlsubj3.cf
[12080] dbg: config: read file /etc/mail/spamassassin/70_sare_html.cf
[12080] dbg: config: read file /etc/mail/spamassassin/70_sare_html0.cf
[12080] dbg: config: read file /etc/mail/spamassassin/70_sare_html1.cf
[12080] dbg: config: read file /etc/mail/spamassassin/70_sare_html2.cf
[12080] dbg: config: read file /etc/mail/spamassassin/70_sare_html3.cf
[12080] dbg: config: read file /etc/mail/spamassassin/70_sare_oem.cf
[12080] dbg: config: read file /etc/mail/spamassassin/70_sare_random.cf
[12080] dbg: config: read file /etc/mail/spamassassin/70_sare_specific.cf
[12080] dbg: config: read file /etc/mail/spamassassin/70_sare_spoof.cf
[12080] dbg: config: read file /etc/mail/spamassassin/70_sare_stocks.cf
[12080] dbg: config: read file /etc/mail/spamassassin/70_sare_unsub.cf
[12080] dbg: config: read file /etc/mail/spamassassin/70_sare_uri0.cf
[12080] dbg: config: read file /etc/mail/spamassassin/70_sare_uri1.cf
[12080] dbg: config: read file /etc/mail/spamassassin/70_sare_uri3.cf
[12080] dbg: config: read file
/etc/mail/spamassassin/70_sare_whitelist_rcvd.cf
[12080] dbg: config: read file
/etc/mail/spamassassin/70_sare_whitelist_spf.cf
[12080] dbg: config: read file /etc/mail/spamassassin/70_zmi_german.cf
[12080] dbg: config: read file /etc/mail/spamassassin/72_sare_bml_post25x.cf
[12080] dbg: config: read file
/etc/mail/spamassassin/72_sare_redirect_post3.0.0.cf
[12080] dbg: config: read file /etc/mail/spamassassin/88_mangled.cf
[12080] dbg: config: read file /etc/mail/spamassassin/88_weeds.cf
[12080] dbg: config: read file
/etc/mail/spamassassin/99_sare_fraud_post25x.cf
[12080] dbg: config: read file /etc/mail/spamassassin/local.cf
[12080] dbg: config: read file /etc/mail/spamassassin/mailscanner.cf
[12080] dbg: config: read file /etc/mail/spamassassin/nazi.cf
[12080] dbg: config: read file /etc/mail/spamassassin/tripwire.cf
[12080] dbg: config: using "/root/.spamassassin/user_prefs" for user
prefs file
[12080] dbg: config: read file /root/.spamassassin/user_prefs
[12080] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
[12080] dbg: plugin: registered
Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x9aeacb8)
[12080] dbg: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC
[12080] dbg: plugin: registered
Mail::SpamAssassin::Plugin::Hashcash=HASH(0x9afad04)
[12080] dbg: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
[12080] dbg: plugin: registered
Mail::SpamAssassin::Plugin::SPF=HASH(0x9ad2410)
[12080] dbg: plugin: loading Mail::SpamAssassin::Plugin::Pyzor from @INC
[12080] dbg: pyzor: network tests on, attempting Pyzor
[12080] dbg: plugin: registered
Mail::SpamAssassin::Plugin::Pyzor=HASH(0x9b27420)
[12080] dbg: plugin: loading Mail::SpamAssassin::Plugin::SpamCop from @INC
[12080] dbg: reporter: network tests on, attempting SpamCop
[12080] dbg: plugin: registered
Mail::SpamAssassin::Plugin::SpamCop=HASH(0x9b88c2c)
[12080] dbg: plugin: loading Mail::SpamAssassin::Plugin::AWL from @INC
[12080] dbg: plugin: registered
Mail::SpamAssassin::Plugin::AWL=HASH(0x9ba164c)
[12080] dbg: plugin: loading
Mail::SpamAssassin::Plugin::AutoLearnThreshold from @INC
[12080] dbg: plugin: registered
Mail::SpamAssassin::Plugin::AutoLearnThreshold=HASH(0x9b4e498)
[12080] dbg: plugin: loading
Mail::SpamAssassin::Plugin::WhiteListSubject from @INC
[12080] dbg: plugin: registered
Mail::SpamAssassin::Plugin::WhiteListSubject=HASH(0x9b4ef0c)
[12080] dbg: plugin: loading Mail::SpamAssassin::Plugin::MIMEHeader from
@INC
[12080] dbg: plugin: registered
Mail::SpamAssassin::Plugin::MIMEHeader=HASH(0x9b4fbb4)
[12080] dbg: plugin: loading Mail::SpamAssassin::Plugin::ReplaceTags
from @INC
[12080] dbg: plugin: registered
Mail::SpamAssassin::Plugin::ReplaceTags=HASH(0x9b50c40)
[12080] dbg: config: adding redirector regex:
/^http:\/\/chkpt\.zdnet\.com\/chkpt\/\w+\/(.*)$/i
[12080] dbg: config: adding redirector regex:
/^http:\/\/www(?:\d+)?\.nate\.com\/r\/\w+\/(.*)$/i
[12080] dbg: config: adding redirector regex:
/^http:\/\/.+\.gov\/(?:.*\/)?externalLink\.jhtml\?.*url=(.*?)(?:&.*)?$/i
[12080] dbg: config: adding redirector regex:
/^http:\/\/redir\.internet\.com\/.+?\/.+?\/(.*)$/i
[12080] dbg: config: adding redirector regex:
/^http:\/\/(?:.*?\.)?adtech\.de\/.*(?:;|\|)link=(.*?)(?:;|$)/i
[12080] dbg: config: adding redirector regex:
m'^http.*?/redirect\.php\?.*(?<=[?&])goto=(.*?)(?:$|[&\#])'i
[12080] dbg: config: adding redirector regex:
m'^https?:/*(?:[^/]+\.)?emf\d\.com/r\.cfm.*?&r=(.*)'i
[12080] info: config: failed to parse, now a plugin, skipping:
ok_languages            all
[12080] dbg: plugin:
Mail::SpamAssassin::Plugin::ReplaceTags=HASH(0x9b50c40) implements
'finish_parsing_end'
[12080] dbg: replacetags: replacing tags
[12080] dbg: replacetags: done replacing tags
[12080] dbg: bayes: tie-ing to DB file R/O /etc/MailScanner/bayes/bayes_toks
[12080] dbg: bayes: tie-ing to DB file R/O /etc/MailScanner/bayes/bayes_seen
[12080] dbg: bayes: found bayes db version 3
[12080] dbg: bayes: DB journal sync: last sync: 1163701803
[12080] dbg: config: score set 3 chosen.
[12080] dbg: message: ---- MIME PARSER START ----
[12080] dbg: message: main message type: text/plain
[12080] dbg: message: parsing normal part
[12080] dbg: message: added part, type: text/plain
[12080] dbg: message: ---- MIME PARSER END ----
[12080] dbg: dns: dns_available set to yes in config file, skipping test
[12080] dbg: metadata: X-Spam-Relays-Trusted:
[12080] dbg: metadata: X-Spam-Relays-Untrusted:
[12080] dbg: message: no encoding detected
[12080] dbg: plugin:
Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x9aeacb8) implements
'parsed_metadata'
[12080] dbg: uridnsbl: domains to query:
[12080] dbg: check: running tests for priority: 0
[12080] dbg: rules: running header regexp tests; score so far=0
[12080] dbg: rules: ran header rule __HAS_MSGID ======> got hit: "<"
[12080] dbg: rules: ran header rule __SARE_WHITELIST_FLAG ======> got
hit: "i"
[12080] dbg: rules: ran header rule __SANE_MSGID ======> got hit:
"<1163702653.21238 at spamassassin_spamd_init>
[12080] dbg: rules: "
[12080] dbg: rules: ran header rule __MSGID_OK_HOST ======> got hit:
"@spamassassin_spamd_init>"
[12080] dbg: rules: ran header rule __ZMISOBER_P_MSGID ======> got hit:
"<1163702653.21238@"
[12080] dbg: rules: ran header rule NO_REAL_NAME ======> got hit:
"ignore at compiling.spamassassin.taint.org
[12080] dbg: rules: "
[12080] dbg: rules: ran header rule __MSGID_OK_DIGITS ======> got hit:
"1163702653"
[12080] dbg: plugin: registering glue method for
check_hashcash_double_spend
(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x9afad04))
[12080] dbg: plugin: registering glue method for check_for_spf_helo_pass
(Mail::SpamAssassin::Plugin::SPF=HASH(0x9ad2410))
[12080] dbg: spf: message was delivered entirely via trusted relays, not
required
[12080] dbg: eval: all '*From' addrs:
ignore at compiling.spamassassin.taint.org
[12080] dbg: plugin: registering glue method for
check_subject_in_blacklist
(Mail::SpamAssassin::Plugin::WhiteListSubject=HASH(0x9b4ef0c))
[12080] dbg: plugin: registering glue method for check_hashcash_value
(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x9afad04))
[12080] dbg: eval: all '*To' addrs:
[12080] dbg: plugin: registering glue method for check_for_spf_neutral
(Mail::SpamAssassin::Plugin::SPF=HASH(0x9ad2410))
[12080] dbg: spf: message was delivered entirely via trusted relays, not
required
[12080] dbg: plugin: registering glue method for check_for_spf_softfail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x9ad2410))
[12080] dbg: rules: ran eval rule NO_RELAYS ======> got hit
[12080] dbg: plugin: registering glue method for check_for_spf_pass
(Mail::SpamAssassin::Plugin::SPF=HASH(0x9ad2410))
[12080] dbg: plugin: registering glue method for
check_for_spf_helo_softfail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x9ad2410))
[12080] dbg: plugin: registering glue method for
check_for_def_spf_whitelist_from
(Mail::SpamAssassin::Plugin::SPF=HASH(0x9ad2410))
[12080] dbg: spf: cannot get Envelope-From, cannot use SPF
[12080] dbg: spf: def_spf_whitelist_from: could not find useable
envelope sender
[12080] dbg: plugin: registering glue method for check_for_spf_fail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x9ad2410))
[12080] dbg: rules: ran eval rule __UNUSABLE_MSGID ======> got hit
[12080] dbg: plugin: registering glue method for
check_subject_in_whitelist
(Mail::SpamAssassin::Plugin::WhiteListSubject=HASH(0x9b4ef0c))
[12080] dbg: plugin: registering glue method for
check_for_spf_whitelist_from
(Mail::SpamAssassin::Plugin::SPF=HASH(0x9ad2410))
[12080] dbg: spf: spf_whitelist_from: could not find useable envelope sender
[12080] dbg: rules: running body-text per-line regexp tests; score so
far=0.96
[12080] dbg: rules: ran body rule __NONEMPTY_BODY ======> got hit: "I"
[12080] dbg: uri: running uri tests; score so far=0.96
[12080] dbg: rules: running raw-body-text per-line regexp tests; score
so far=0.96
[12080] dbg: rules: running full-text regexp tests; score so far=0.96
[12080] dbg: plugin: registering glue method for check_pyzor
(Mail::SpamAssassin::Plugin::Pyzor=HASH(0x9b27420))
[12080] dbg: util: current PATH is: /sbin:/bin:/usr/sbin:/usr/bin
[12080] dbg: pyzor: pyzor is not available: no pyzor executable found
[12080] dbg: pyzor: no pyzor found, disabling Pyzor
[12080] dbg: plugin:
Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x9aeacb8) implements 'check_tick'
[12080] dbg: check: running tests for priority: 500
[12080] dbg: plugin:
Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x9aeacb8) implements
'check_post_dnsbl'
[12080] dbg: rules: running meta tests; score so far=0.96
[12080] dbg: rules: running header regexp tests; score so far=2.906
[12080] dbg: rules: running body-text per-line regexp tests; score so
far=2.906
[12080] dbg: uri: running uri tests; score so far=2.906
[12080] dbg: rules: running raw-body-text per-line regexp tests; score
so far=2.906
[12080] dbg: rules: running full-text regexp tests; score so far=2.906
[12080] dbg: check: running tests for priority: 1000
[12080] dbg: rules: running meta tests; score so far=2.906
[12080] dbg: rules: running header regexp tests; score so far=2.906
[12080] dbg: plugin: registering glue method for
check_from_in_auto_whitelist
(Mail::SpamAssassin::Plugin::AWL=HASH(0x9ba164c))
[12080] dbg: locker: safe_lock: created
/var/spool/MailScanner/spamassassin/auto-whitelist.mutex
[12080] dbg: locker: safe_lock: trying to get lock on
/var/spool/MailScanner/spamassassin/auto-whitelist with 30 timeout
[12080] dbg: locker: safe_lock: link to
/var/spool/MailScanner/spamassassin/auto-whitelist.mutex: link ok
[12080] dbg: auto-whitelist: tie-ing to DB file of type DB_File R/W in
/var/spool/MailScanner/spamassassin/auto-whitelist
[12080] dbg: auto-whitelist: db-based
ignore at compiling.spamassassin.taint.org|ip=none scores 0/0
[12080] dbg: auto-whitelist: AWL active, pre-score: 2.906, autolearn
score: 2.906, mean: undef, IP: undef
[12080] dbg: auto-whitelist: DB addr list: untie-ing and unlocking
[12080] dbg: auto-whitelist: DB addr list: file locked, breaking lock
[12080] dbg: locker: safe_unlock: unlocked
/var/spool/MailScanner/spamassassin/auto-whitelist.mutex
[12080] dbg: auto-whitelist: post auto-whitelist score: 2.906
[12080] dbg: rules: running body-text per-line regexp tests; score so
far=2.906
[12080] dbg: uri: running uri tests; score so far=2.906
[12080] dbg: rules: running raw-body-text per-line regexp tests; score
so far=2.906
[12080] dbg: rules: running full-text regexp tests; score so far=2.906
[12080] dbg: check: is spam? score=2.906 required=5
[12080] dbg: check:
tests=MISSING_SUBJECT,NO_REAL_NAME,NO_RECEIVED,NO_RELAYS,TO_CC_NONE
[12080] dbg: check:
subtests=__HAS_MSGID,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__NONEMPTY_BODY,__SANE_MSGID,__SARE_WHITELIST_FLAG,__UNUSABLE_MSGID,__ZMISOBER_P_MSGID
[12080] dbg: bayes: untie-ing
[12080] dbg: bayes: untie-ing db_toks
[12080] dbg: bayes: untie-ing db_seen
max message size is '90000'
Ignore errors about failing to find EOCD signature
format error: can't find EOCD signature
 at /usr/sbin/MailScanner line 820
Reference to nonexisb¤1D×¦ÌÛ~p in regex; marked by <-- HERE in
m/Ïè>Mxjmî¦B\6 <-- HERE
wÔ¿ÃQÎú®¿ÀÝÊÄ©#êÜûùðè¨Dã-rhö¹Ò×\.òH!öçdDUùªIWWåí¥ìU\[eB4þèTéómÒ«Îhó
iË©¸=Íú|4¤£ÛRke3êÓGjÃ\.²3\^bi/N¯ÎÎ/Þ\Ò/åøì©÷~D«åVüïÔÍ·áþ\]üÿrp
þ\?îuû/Ó\^:/ at /usr/lib/MailScanner/MailScanner/Message.pm line 3304,
<GEN84> line 2.

All messages that cause this crash seem to be spam from what I can see
... never happened before ...

I'm running MS 4.56.7-2, SA 3.1.7 ... any idea?