MailScanner: Could not analyze message

[Julian Field]

You can get it if you have Raw Queue Files switched on, straight from 
the quarantine.

On 21/05/2010 14:44, Gary Faith wrote:
> I can get the message in the spam quarantine folder but how do I get 
> the raw message?  Do I need to shutdown MailScanner and only have 
> sendmail running until after they say it was sent or is there some 
> other way to get it?
> Gary
>
> >>> Julian Field <MailScanner at ecs.soton.ac.uk> 5/21/2010 5:33 AM >>>
> Can you send me a URL of a sample message (raw queue files preferred) so
> that I can try this out for you please?
>
> Jules.
>
> On 19/05/2010 21:12, Gary Faith wrote:
> > I have some e-mail being sent by one individual to MailScanner 
> running ver 4.79.11 and the messages are getting tagged as {Dangerous 
> Content?}.  I am running MailScanner with clamav&  sanesecurity 
> signatures, scamnailer, razor, pyzor&  dcc.  Mailwatch reports that it 
> isn't a virus it is "Other Infection":
> >
> > Anti-Virus/Dangerous Content Protection
> > Virus: N
> > Blocked File: N
> > Other Infection: Y
> > Report:MailScanner: Could not analyze message
> >
> > The message has contains this:
> >
> > Warning: This message has had one or more attachments removed
> > Warning: (the entire message).
> > Warning: Please read the "XXX-Attachment-Warning.txt" attachment(s) 
> for more information.
> >
> > This is a message from the MailScanner E-Mail Virus Protection Service
> > ----------------------------------------------------------------------
> > The original e-mail message contained potentially dangerous content,
> > which has been removed for your safety.
> >
> > At Wed May 19 15:36:22 2010 the content filters said:
> >     MailScanner: Could not analyze message
> >
> > The sender uses Maximizer to generate the e-mail with a PDF 
> attachment.  I had the sender use Maximizer and send only the message 
> without the attachment and it comes in fine.  I had them send only the 
> attachment via Outlook and it comes in fine.  It seems the problem is 
> with Mazimizer but I am not sure why.
> >
> > I can send the quarantined message or whatever is needed to 
> determine the problem off list.
> >
> > I need help in tracking down where the problem is and getting it fixed.
> >
> > Thanks,
> >
> > Gary Faith
> >
> >
> >
>
> Jules
>
> -- 
> Julian Field MEng CITP CEng
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>
> Need help customising MailScanner?
> Contact me!
> Need help fixing or optimising your systems?
> Contact me!
> Need help getting you started solving new requirements from your boss?
> Contact me!
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> Follow me at twitter.com/JulesFM and twitter.com/MailScanner
>
>
> -- 
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> -- 
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!

Jules

-- 
Julian Field MEng CITP CEng
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

Need help customising MailScanner?
Contact me!
Need help fixing or optimising your systems?
Contact me!
Need help getting you started solving new requirements from your boss?
Contact me!

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
Follow me at twitter.com/JulesFM and twitter.com/MailScanner


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.