MS started crashing ...

[Ugo Bellavance]

Garry Glendown wrote:
> Ugo Bellavance wrote:
>> Garry Glendown wrote:
>>> Today, MS started piling up messages - checking the system, I noticed
>>> continuous zombie-MS, running it with --debug/--debug-sa, I found that
>>> MS keeps crashing, probably caused by a message ... how can I find what
>>> is causing this?
>>>
>>> Here's the last couple lines, the "format error" lines repeated
>>> something like 50 times ...
>>>
>>> format error: can't find EOCD signature
>>>  at /usr/sbin/MailScanner line 820
>>> format error: can't find EOCD signature
>>>  at /usr/sbin/MailScanner line 820
>>> Reference to nonexistent group in regex; marked by <-- HERE in
>>> m/�è>Mx�jm�B�\6 <-- HERE
>>> wԿ�Q�����ĩ�#��������D�-r�h���\.���H!��d��D�U�IWW������U\[eB4��T��mҫ�h�b�1D×����~i˩�=��|4����Rke3��Gj�\.�3\^��bi/N���/�\�/����~D��V���ͷ���\]��rp�\?�u�/�\^:/
>>>
>>> at /usr/lib/MailScanner/MailScanner/Message.pm line 3304, <GEN250>
>>> line 2.
>>>
>>> WTF?
>> Check in the logs first to see if there is one message that keeps on
>> coming over and over again.
>>
>> Another idea would be to stop your MTA then let MailScanner run for a
>> while and see what remains in the incoming queue.  If you can't tell,
>> move all queue files to another directory and re-move them one by one.
>>
>> Ugo
>>
> 
> 
> Had that idea, too ... I've located multiple spam messages that cause
> this ... here's the mail.log:
> 
> 
> Nov 16 19:41:19 mr-01 MailScanner[11412]: MailScanner E-Mail Virus
> Scanner version 4.56.7 starting...

<snip>

> max message size is '90000'
> Ignore errors about failing to find EOCD signature
> format error: can't find EOCD signature
>  at /usr/sbin/MailScanner line 820
> Reference to nonexisb¤1DצÌÛ~p in regex; marked by <-- HERE in
> m/Ïè>Mxjmî¦B\6 <-- HERE
> wÔ¿ÃQÎú®¿ÀÝÊÄ©#êÜûùðè¨Dã-rhö¹Ò×\.òH!öçdDUùªIWWåí¥ìU\[eB4þèTéómÒ«Îhó
> iË©¸=Íú|4¤£ÛRke3êÓGjÃ\.²3\^bi/N¯ÎÎ/Þ\Ò/åøì©÷~D«åVüïÔÍ·áþ\]üÿrp
> þ\?îuû/Ó\^:/ at /usr/lib/MailScanner/MailScanner/Message.pm line 3304,
> <GEN84> line 2.
> 
> 
> 
> All messages that cause this crash seem to be spam from what I can see
> ... never happened before ...
> 
> I'm running MS 4.56.7-2, SA 3.1.7 ... any idea?

Upgrade, then check.  The stable version is 4.56.8.1.