MailScanner: Message attempted to kill MailScanner

Mon Aug 6 12:53:03 UTC 2018

AV scan is off , something else cause the issue.

Dobril Dobrilov
IT Manager
dobril at stanga.net

43, Cherni Vrah Blvd. | 1407 Sofia - Bulgaria
Phone: +359 2 81 960 69 Fax: +359 2 81 960 70
Mobile: +359 878 749 387

We shape Digital www.stanga.net

We re-invent Video www.bsbvision.com

We build Apps www.shanga.co

We support Start-Ups www.mysbar.net

-----Original Message-----
From: MailScanner
[mailto:mailscanner-bounces+dobril=stanga.net at lists.mailscanner.info] On
Behalf Of L.P.H. van Belle via MailScanner
Sent: Monday, August 6, 2018 3:45 PM
To: MailScanner Discussion <mailscanner at lists.mailscanner.info>
Cc: L.P.H. van Belle <belle at bazuin.nl>
Subject: RE: MailScanner: Message attempted to kill MailScanner

Are you using Yara rules or other clamav unoffical databases.
Remove these, restart clamav and try again. 

You might have a bad clamav database file. 

Greetz, 

Louis

> -----Oorspronkelijk bericht-----
> Van: MailScanner
> [mailto:mailscanner-bounces+belle=bazuin.nl at lists.mailscanner.
> info] Namens Antony Stone
> Verzonden: maandag 6 augustus 2018 14:23
> Aan: MailScanner Discussion
> Onderwerp: Re: MailScanner: Message attempted to kill MailScanner
> 
> On Monday 06 August 2018 at 14:13:03, DobriL Dobrilov wrote:
> 
> > Until now the Mail Server was with old postfix and
> MailScanner 4.79. I
> > migrated to new server with MailScanner 5.0.7. MS config is same as 
> > before.
> 
> Maybe someone with more knowledge than of any configuration 
> differences ebtween those version can comment on just keeping the same 
> configuration file...
> 
> > From webmail I can send messages out of my domain without problems.
> 
> So, what *does* cause the problem?
> 
> Your original email said "All emails sent from my webmail to same 
> domain cannot be processes by mailscanner."
> 
> > Msg from webmail
> > Received: from mail.stanga.net (localhost [IPv6:::1])
> >      by mail.stanga.net (Postfix) with ESMTPA id 8990B62C7F
> >      for <dobril at stanga.net>; Mon, 6 Aug 2018 14:33:37 +0300 (EEST)
> > DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;
> d=stanga.net; s=mail;
> >      t=1533555217; bh=mZ+uaN6Z/8N6WGVqk2wnIiNbWhm5wweetthyGV+rcTs=;
> >      h=Date:From:To:Subject;
> >      
> b=ex87f2OAPGbMz0sU6XWbhYCD03Et+mEjtKr925BfRPT5HgYLDlL8HqB+ZrCXHJwYF
> >       
> YeklCaEhAz5eGuRaDcJThrwidzLyqdC8pAErnLbc49SmF0HIafTMMmnqxkhRqYefqz
> >       EKNjrsrHGMMqNKqMUApcumMBXGt8zKEXw/S9HlrE=
> > MIME-Version: 1.0
> > Content-Type: multipart/alternative; 
> > boundary="=_75de8e069c6b4423276ecc8efe3eaa14"
> > Date: Mon, 06 Aug 2018 14:33:37 +0300
> > From: Dobril Dobrilov <dobril at stanga.net>
> > To: dobril at stanga.net
> > Subject: Test2
> > Organization: StangaOne1
> > Message-ID: <e836f2d9d2be88a49da5da675eba919e at stanga.net>
> > X-Sender: dobril at stanga.net
> > User-Agent: Roundcube Webmail/1.3.7
> > 
> > Msg from Mail Client
> > Received: from DL (unknown [192.168.0.222])
> >      (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384
> (256/256 bits))
> >      (No client certificate requested)
> >      by mail.stanga.net (Postfix) with ESMTPSA id CB1BD62C84
> >      for <dobril at stanga.net>; Mon, 6 Aug 2018 15:11:28 +0300 (EEST)
> > DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;
> d=stanga.net; s=mail;
> >      t=1533557488; bh=PuTju5S6EPeO7sbRMZ/5jISvR+vw7+9AwwsxuKLvTZ8=;
> >      h=From:To:Subject:Date;
> >      
> b=IcMCXoZ3cdkehwkEMYfCytEDcgduiWi8Bats1ypadvf6hD/Mq/I0s7k6Lc3lBzJpN
> >       
> FNopdMhbJ7HQ1irLN8fyHRvMPFzyCAE3rPZjIDm1Olf23G4E510mYtRvE1A/i1Dt0a
> >       rHJVnjxltdYZ6+aaENwzE/oXaaO1XSW1zaSciN6k=
> > From: "DobriL Dobrilov" <dobril at stanga.net>
> > To: "'DobriL Dobrilov'" <dobril at stanga.net>
> > Subject: Test
> > Date: Mon, 6 Aug 2018 15:11:34 +0300
> > Message-ID: <00f901d42d7e$9e87dbe0$db9793a0$@stanga.net>
> > MIME-Version: 1.0
> > Content-Type: multipart/mixed;
> >      boundary="----=_NextPart_000_00FA_01D42D97.C3D513E0"
> > X-Mailer: Microsoft Outlook 16.0
> > Thread-Index: AdQtfptmFdgLS/d8QKixvWPS7nKlOQ==
> > Content-Language: bg
> > X-MS-TNEF-Correlator: 
> 000000005234E38E73D4914094E5D7D34B79F6A564F78F00
> 
> Is one of the above emails an example which causes the problem and the 
> other an example which does not cause the problem (if so, which one is 
> which)?
> 
> Or are both the above emails examples which do not cause the problem 
> (in which case please send us the headers from one which does cause 
> the problem)?
> 
> 
> Regards,
> 
> 
> Antony.
> 
> > -----Original Message-----
> > From: MailScanner
> > 
> [mailto:mailscanner-bounces+dobril=stanga.net at lists.mailscanne
> r.info] On
> > Behalf Of Antony Stone Sent: Monday, August 6, 2018 3:01 PM
> > To: MailScanner Discussion <mailscanner at lists.mailscanner.info>
> > Subject: Re: MailScanner: Message attempted to kill MailScanner
> > 
> > On Monday 06 August 2018 at 13:55:36, DobriL Dobrilov wrote:
> > > Some other ideas, because unfortunately this Live system 
> and It's very
> > > critical ?
> > 
> > When did the problem start happening?
> > 
> > What changed on the MS server around that time?
> > 
> > Can you show us full headers of an example email from 
> webmail (which MS
> > can't process) and another one to and from the same 
> addresses, but not
> > from webmail (which MS processes okay)?
> > 
> > Antony
> 
> -- 
> Neurotics build castles in the sky;
> Psychotics live in them;
> Psychiatrists collect the rent.
> 
> 
>                                                    Please 
> reply to the list;
>                                                          
> please *don't* CC me.
> 
> 
> -- 
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> 

-- 
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner