All Emails tagged as {VIRUS}

[Polleke]

Ola,

II just raised the timeout in MailScanner.conf::

#Virus Scanner Timeout = 300
Virus Scanner Timeout = 600

And it works again...


ps. You can ignore the Clamav outdated message... 



-- 
Polleke 
Original Message
From:	Sebastiano Dante Alighieri 	
To:	mailscanner at lists.mailscanner.info 	
Subject:	All Emails tagged as {VIRUS}	
Date:	6-4-2019 01:03:43	

Hi,  


In the past couple of days my email is all coming in with the subject line tagged as {VIRUS}. This is true for all mail, but of course there's no virus involved.


Mailscanner v5.0.7
ClamAV v0.100.0


ClamAV update process started at Fri Apr  5 18:41:07 2019
> 
> 
> 
> WARNING: Your ClamAV installation is OUTDATED!
> 
> 
> 
> WARNING: Local version: 0.100.0 Recommended version: 0.101.2
> 
> 
> 
> DON'T PANIC! Read <https://www.clamav..net/documents/upgrading-clamav>https://www.clamav.net/documents/upgrading-clamav
> 
> 
> 
> main.cvd is up to date (version: 58, sigs: 4566249, f-level: 60, builder: sigmgr)
> 
> 
> 
> daily.cld is up to date (version: 25410, sigs: 1552552, f-level: 63, builder: raynman)
> 
> 
> 
> bytecode.cld is up to date (version: 328, sigs: 94, f-level: 63, builder: neo)
> 
> 
> 


A review of /var/log/maillog suggests that there's a problem with ClamAV

Apr  5 18:31:22 myhost MailScanner[7448]: Virus and Content Scanning: Starting
> 
> 
> Apr  5 18:34:23 myhost MailScanner[7448]: AV engine clamav timed out
> 
> 
> Apr  5 18:34:23 myhost MailScanner[7448]: clamav: Failed to complete, timed out
> 
> 
> Apr  5 18:34:23 myhost MailScanner[7448]: Virus Scanning: Denial Of Service attack detected!
> 
> 


I've tried to observe what is happening on the system, while mail is being scanned and what i can surmise is that clamscan is timing-out (uses 100% CPU)





any pointers would be greatly appreciated. I have not been able to find anything online..


I'll try upgrading to the latest and greatest MailScanner in the mean time.


thanks
Salighie





-- 
This message has been scanned for viruses and 
dangerous content by <http://www.mailscanner.info/>MailScanner, and is 
believed to be clean. œ‘h 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20190406/f400b63e/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 5ca86ca6.png
Type: image/png
Size: 7529 bytes
Desc: not available
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20190406/f400b63e/attachment-0001.png>