antivirus timeout = Denial of Service

[Andrew MacLachlan]

I would have thought that store, notify might be a better option than
deliver... (which looks to be the case here...)

- Are you using Mailwatch? - Have a look to see if the message has the
attachment still!

-Andy

-----Original Message-----
From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Nerijus
Baliunas
Sent: 12 June 2007 14:17
To: mailscanner at lists.mailscanner.info
Subject: antivirus timeout = Denial of Service

Hello,

I got a message form MailScanner to postmaster with Subject Virus
Detected:
    Sender: xxx at example.com
IP Address: 216.82....
 Recipient: xxx at example.lt
   Subject: Lenny order
 MessageID: 3EFAE8044D.484E7
Quarantine: 
    Report: Denial of Service attack in message!

I looked in the maillog and found this:

Jun 12 13:50:14 mail MailScanner[1744]: Commercial scanner clamav timed
out!
Jun 12 13:50:14 mail MailScanner[1744]: clamav: Failed to complete,
timed out
Jun 12 13:50:14 mail MailScanner[1744]: Virus Scanning: Denial Of
Service attack is in message 3EFAE8044D.484E7

Does it mean the message has been dealt as infected by virus and was
deleted?
I will move to clamd, but is it possible to allow the messages to be
delivered when
antivirus timeouts?

Regards,
Nerijus
-- 
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 

--
This message was scanned by ESVA and is believed to be clean.
Click here to report this message as spam. 
http://mail-gw.global-domination.org/cgi-bin/learn-msg.cgi?id=438D82821F
.EA212





--
This message was scanned by ESVA and is believed to be clean.