MailScanner: Message attempted to kill MailScanner

[Julian Field]

Yes, just install the latest version available on the website.

On 22/01/2010 16:17, Garrod M. Alwood wrote:
> You need to get an update, I had the same problem
>
> Garrod Alwood
> Open Source Consultant
> 9047384988
> Garrod.alwood at lorodoes.com <mailto:Garrod.alwood at lorodoes.com>
> Sent from my iPod
>
> On Jan 22, 2010, at 11:14 AM, "Lyndon Labuschagne" 
> <lyndonl at mexcom.co.za <mailto:lyndonl at mexcom.co.za>> wrote:
>
>> Hello All
>>
>> I hope you can shed some light on the below issue
>>
>> This is a new install of MailScanner 4.79.5
>> FreeBSD 8.0 amd64
>> postfix-2.6.5,1
>> p5-Mail-SpamAssassin-3.2.5_4
>> clamav-0.95.3
>>
>> All the effected mails seem to have attachments, mail sizes vary most 
>> are over 200kb but some are only 80kb
>> most seem to be word docs both .doc and .docx
>> I have turned off OLE scans to see if that was a part of the problem
>>
>> ClamAVmodule Maximum File Size = 5000000 # (5 Mbytes)
>>
>> Max Spam Check Size = 40k
>> Max SpamAssassin Size = 40k
>> Max Custom Spam Scanner Size = 40k
>>
>>
>>
>> the Server is a Xeon 2Ghz quad core 4 GB RAM
>> it averages about 95% idle with about 2.5GB free RAM although when 
>> clamscan is running it might drop down to about 80% idle
>>
>> I can turn on the debug option but its not every mail that has this 
>> issue its probably 1 out of every 100 to 150 messages. so it might 
>> take some time to trigger the problem
>>
>> the below message was 333.6kb
>>
>> From MailWatch interface:
>>
>> Subject: /removed to protect the innocent/
>> MIME-Version: 1.0
>> Content-Type: multipart/mixed;
>>      boundary="----_=_NextPart_001_01CA9B73.4F7F8242"
>> Date: Fri, 22 Jan 2010 16:58:08 +0200
>> Message-ID: 
>> <B8ADB5A39790EF41901A5F105DB2CB8DB43CCD at server.Hi-tech.local 
>> <mailto:B8ADB5A39790EF41901A5F105DB2CB8DB43CCD at server.Hi-tech.local>>
>> Content-class: urn:content-classes:message
>> X-MimeOLE: Produced By Microsoft Exchange V6.5
>> X-MS-Has-Attach:
>> X-MS-TNEF-Correlator:
>> Thread-Topic: removed to protect the innocent
>> Thread-Index: AcgMB3G2oM864RICTwyR1vhZ6+t5JwAAI2GAPhemM7A=
>> X-Priority: 1
>> Priority: Urgent
>> Importance: high
>>
>> From maillog
>>
>> Jan 22 16:54:42 mailav02 postfix/cleanup[12659]: EC4A71761FFF: 
>> message-id=<B8ADB5A39790EF41901A5F105DB2CB8DB43CCD at server.Hi-tech.local 
>> <mailto:B8ADB5A39790EF41901A5F105DB2CB8DB43CCD at server.Hi-tech.local>>
>> Jan 22 17:00:26 mailav02 MailScanner[14816]: Making attempt 2 at 
>> processing message EC4A71761FFF.00000
>> Jan 22 17:05:25 mailav02 MailScanner[14819]: Making attempt 3 at 
>> processing message EC4A71761FFF.00000
>> Jan 22 17:10:25 mailav02 MailScanner[14900]: Making attempt 4 at 
>> processing message EC4A71761FFF.00000
>> Jan 22 17:12:47 mailav02 MailScanner[15034]: Making attempt 5 at 
>> processing message EC4A71761FFF.00000
>> Jan 22 17:18:32 mailav02 MailScanner[14985]: Making attempt 6 at 
>> processing message EC4A71761FFF.00000
>> Jan 22 17:18:33 mailav02 MailScanner[15120]: Warning: skipping 
>> message EC4A71761FFF.00000 as it has been attempted too many times
>> Jan 22 17:18:33 mailav02 MailScanner[15120]: Quarantined message 
>> EC4A71761FFF.00000 as it caused MailScanner to crash several times
>> Jan 22 17:18:33 mailav02 MailScanner[15120]: Saved entire message to 
>> /var/spool/MailScanner/quarantine/20100122/EC4A71761FFF.00000
>> Jan 22 17:18:33 mailav02 MailScanner[15120]: Logging message 
>> EC4A71761FFF.00000 to SQL
>>
>> Regards,
>>
>> Lyndon
>>
>>
>>
>> -- 
>> This message has been scanned for viruses and dangerous content by the
>> *Mexcom MailScanner*, and appears to be clean.
>> Should you wish to secure your mail, call sales @ 011-801-4000, 
>> alternatively visit
>> http://www.mexcom.co.za or mail sales at mexcom.co.za 
>> <mailto:sales at mexcom.co.za>
>> <ATT00001..txt>

Jules

-- 
Julian Field MEng CITP CEng
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

Need help customising MailScanner?
Contact me!
Need help fixing or optimising your systems?
Contact me!
Need help getting you started solving new requirements from your boss?
Contact me!

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
Follow me at twitter.com/JulesFM and twitter.com/MailScanner


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.