Message attempted to kill MailScanner

Marek Górny marek.gorny at bolix.pl
Fri Apr 17 14:32:40 UTC 2020


Hello,
I updated MailScanner from 5.2.2 to 5.3.1 on OpenSUSE 15.2 (ClamAV 0.100.3 and F-Secure)
I noticed some messages like this (I know there was similar case on 5.1.3)
Can you help me how to investigate this:

Our virus detector failed to completely analyse a message you sent:-
Any parts of the message that could not be analysed will not have been delivered.
If you are using Microsoft Outlook, we strongly recommend you change your outgoing message format from "Rich Text" to "HTML" or "Plain Text".
1) Click on the "Tools" menu and choose "Options..."
2) Go to the "Mail Format" tab
3) For message format, select "HTML" or "Plain text"
4) Click OK

The virus detector said this about the message:
Report: Report: MailScanner: Message attempted to kill MailScanner

My config doesn't complain:
# MailScanner --lint
Trying to setlogsock(unix)

Reading configuration file /etc/MailScanner/MailScanner.conf
Reading configuration file /etc/MailScanner/conf.d/README
Read 1503 hostnames from the phishing whitelist
Read 7061 hostnames from the phishing blacklists
Config: calling custom init function MailWatchLogging
MailWatch: Started MailWatch SQL Logging child

Checking version numbers...
Version number in MailScanner.conf (5.3.1) is correct.

Your envelope_sender_header in spamassassin.conf is correct.
MailScanner setting GID to  (51)
MailScanner setting UID to  (51)

Checking for SpamAssassin errors (if you use it)...
Using SpamAssassin results cache
Connected to SpamAssassin cache database
SpamAssassin reported no errors.
Connected to Processing Attempts Database
Created Processing Attempts Database successfully
There are 0 messages in the Processing Attempts Database
Using locktype = posix
MailScanner.conf says "Virus Scanners = f-secure clamd"
Found these virus scanners installed: f-secure, clamd
===========================================================================
Virus and Content Scanning: Starting
Virus Scanning: F-Secure found virus EICAR_Test_File
./1/eicar.com.virus: Infected: EICAR_Test_File [FSE]
Virus Scanning: F-Secure found virus Malware.Eicar-Test-Signature
./1/eicar.com.virus: Infected: Malware.Eicar-Test-Signature [Aquarius]
Virus Scanning: F-Secure found 1 infections
Clamd::ERROR:: Can't open file or directory ERROR :: ./1/neicar.com.virus
Clamd::INFECTED::Win.Test.EICAR_HDB-1 :: ./1/
Virus Scanning: Clamd found 2 infections
Infected message 1 came from 10.1.1.1
Virus Scanning: Found 3 viruses
===========================================================================


Best Regards
Marek Górny


[Bolix]

[BO_Lokalizacja]        [RODO] <https://bolix.pl/pl/page/14>    [Teraz_Polska] <https://bolix.pl/pl/open-file/1098>
[Facebook]<https://www.facebook.com/bolixsa>

UWAGA: Niniejsza korespondencja przeznaczona jest wyłącznie dla osoby lub podmiotu, do którego jest zaadresowana i może zawierać treści chronione przepisami prawa. Wgląd w treść wiadomości otrzymanej omyłkowo, dalsze jej przekazywanie, rozpowszechnianie lub innego rodzaju wykorzystanie, bądź podjęcie jakichkolwiek działań w oparciu o zawarte w niej informacje przez osobę lub podmiot nie będący adresatem, jest niedozwolone. Odbiorca korespondencji, który otrzymał ją omyłkowo, proszony jest o zawiadomienie nadawcy i usunięcie tego materiału z komputera.

ATTENTION:  The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, Or taking of any action in reliance upon, this information by person or entity other than the intended recipient is not permitted. If you received this in error, please contact the sender and delete the material from any computer.

[Las] Proszę pomyśl o środowisku przed wydrukowaniem tego maila. Please Consider the Environment before printing this Email
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20200417/b2b5f25e/attachment.html>


More information about the MailScanner mailing list