jim, iīve the messages but i just substracted them from the <a href="http://mqueu.in">mqueu.in</a>. Sizes goes from 400Kb to 7Mb. Aparently they are compressed PPT Power Point Presentations. how can i open that mail if i have the qfk3HFIQcc008169 and
<a href="file:///C:/Documents%20and%20Settings/ecasarero/Escritorio/mails/dfk3HFIQcc008169">dfk3HFIQcc008169</a> . In the bacht that failed there was 1 email only, i chaged parameters so mailscanner takes 1 by 1 so i found this 4 problematic mails.
<br><br>regards. <br><br><div><span class="gmail_quote">2006/4/18, Jim Holland <<a href="mailto:mailscanner@mango.zw">mailscanner@mango.zw</a>>:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Hi Martin<br><br>On Tue, 18 Apr 2006, Martin Hepworth wrote:<br><br>> I'd look at why the clamavmodule is timing out - does clamscan work OK<br>> from the command line????<br><br>On my system I am not running clamavmodule - just plain clamav. The error
<br>message below was on the system being run by Eduardo Casarero.<br><br>> RH 7.1 is really really old<br><br>Soon to be upgraded to Debian Sarge :-)<br><br>> so it could be problems with either clamAV or the perl module not
<br>> working with 7.1.<br><br>> What happens if you change from the module to the normal clamav scanner<br>> in MailScanner.conf?<br><br>See above.<br><br>> > -----Original Message-----<br>> > From:
<a href="mailto:mailscanner-bounces@lists.mailscanner.info">mailscanner-bounces@lists.mailscanner.info</a> [mailto:<a href="mailto:mailscanner-">mailscanner-</a><br>> > <a href="mailto:bounces@lists.mailscanner.info">
bounces@lists.mailscanner.info</a>] On Behalf Of Jim Holland<br>> > Sent: 17 April 2006 22:41<br>> > To: MailScanner discussion<br>> > Subject: Re: mail scanner stuck<br>> ><br>> > On Mon, 17 Apr 2006, Eduardo Casarero wrote:
<br>> ><br>> > > Date: Mon, 17 Apr 2006 17:33:54 -0300<br>> > > From: Eduardo Casarero <<a href="mailto:ecasarero@gmail.com">ecasarero@gmail.com</a>><br>> > > Reply-To: MailScanner discussion <
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a>><br>> > > To: MailScanner discussion <<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info
</a>><br>> > > Subject: Re: mail scanner stuck<br>> > ><br>> > > hi, after doing some investigation i found the following:<br>> > > with 4 particular emails:<br>> ><br>> > > in /var/log/maillog:
<br>> ><br>> > Apr 17 16:54:22 avas2 MailScanner[4150]: Virus and Content Scanning:<br>> > Starting<br>> > Apr 17 16:59:23 avas2 MailScanner[4150]: Commercial scanner clamavmodule<br>> > timed out!
<br>> > Apr 17 16:59:23 avas2 MailScanner[4150]: Virus Scanning: Denial Of Service<br>> > attack detected!<br>> > --------------------------------------------------------------------------<br>> > ---
<br>> > > After this last log message the mail scanner rescan of the same email<br>> > > looping. This was logged with 1 child runnig (just for debuggin, in<br>> > > normal operation runs 6 childs)
<br>> ><br>> > . . .<br>> ><br>> > > After this i really donīt know what to do. Cause Clamav is the only AV<br>> > > on the system and MScanner has a Timeout for AV of 300 segs an clamav
<br>> > takes<br>> > > only 37.24 seg. so MScanner cant see that clamav finished or something<br>> > > is missing.<br>> ><br>> > . . .<br>> ><br>> > This seems to be very similar to the problem I wrote about earlier this
<br>> > evening in:<br>> ><br>> > Subject: Solved? Re: Still stuck in queue, version 4.52.2<br>> ><br>> > I would be very interested to know:<br>> ><br>> > The size of the message
<br>> ><br>> > What files it contained<br>> ><br>> > Whether the files were compressed, and if so<br>> > what was the uncompressed file size<br>> ><br>> > How many messages were in the batch that failed?
<br>> ><br>> > Clearly if the message is one of say 30 in a batch then it is going to be<br>> > easier for ClamAV to time out on the batch than if there was only one in<br>> > the batch. My understanding is that the timeout setting applies to the
<br>> > whole batch and not to a single message.<br>> ><br>> > As indicated in my message, I have changed the default for:<br>> ><br>> > Virus Scanner Timeout =<br>> ><br>> > in
MailScanner.conf from 300 to 600 seconds to try to avoid this kind of<br>> > problem.<br>> ><br>> > Regards<br>> ><br>> > Jim Holland<br>> > System Administrator<br>> > MANGO - Zimbabwe's non-profit e-mail service
<br>> ><br>> > --<br>> > MailScanner mailing list<br>> > <a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>> > <a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner">
http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>> ><br>> > Before posting, read <a href="http://wiki.mailscanner.info/posting">http://wiki.mailscanner.info/posting</a><br>> ><br>> > Support MailScanner development - buy the book off the website!
<br>><br>><br>> **********************************************************************<br>><br>> This email and any files transmitted with it are confidential and<br>> intended solely for the use of the individual or entity to whom they
<br>> are addressed. If you have received this email in error please notify<br>> the system manager.<br>><br>> This footnote confirms that this email message has been swept<br>> for the presence of computer viruses and is believed to be clean.
<br>><br>> **********************************************************************<br>><br>><br><br>Regards<br><br>Jim Holland<br>System Administrator<br>MANGO - Zimbabwe's non-profit e-mail service<br><br>--<br>
MailScanner mailing list<br><a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br><a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner">http://lists.mailscanner.info/mailman/listinfo/mailscanner
</a><br><br>Before posting, read <a href="http://wiki.mailscanner.info/posting">http://wiki.mailscanner.info/posting</a><br><br>Support MailScanner development - buy the book off the website!<br></blockquote></div><br>