I am confused :-S. I followed your instructions, i was able to see the email and the attach, so i send a new mail with the attaches to a "test" box with Mscanner and nothing happened, just scanned and delivered. verrryyy xtrange. then i tryed the same with the box that stucked with the same files. and magically they passed. So i just donīt know what to do. im going to put the q and f on the
<a href="http://mqueu.in">mqueu.in</a> a see whats happens. tell you later.<br><br>Regards.<br><br><br><div><span class="gmail_quote">2006/4/18, Jim Holland <<a href="mailto:mailscanner@mango.zw" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
mailscanner@mango.zw
</a>>:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">On Tue, 18 Apr 2006, Eduardo Casarero wrote:<br><br>> jim, iīve the messages but i just substracted them from the
<a href="http://mqueu.in" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">mqueu.in</a>.<br>> Sizes goes from 400Kb to 7Mb. Aparently they are compressed PPT Power<br>> Point Presentations. how can i open that mail if i have the
<br>> qfk3HFIQcc008169 and dfk3HFIQcc008169 In the bacht that failed there was
<br>> 1 email only, i chaged parameters so mailscanner takes 1 by 1 so i found<br>> this 4 problematic mails.<br><br>If you are happy to just release the message, then stop MailScanner (if<br>you want to avoid possible error messages), move both of the above files
<br>into /var/spool/mqueue, and then restart MailScanner.<br><br>If you want to scan the message manually, then as far as I know you have<br>to convert the above back into a single message file. I do that the hard<br>way:
<br><br> cat qfk3HFIQcc008169 dfk3HFIQcc008169 > msg.tmp<br> edit the headers in msg.tmp:<br> Delete all lines up to but not including the first Received: line<br> Delete all H?? entries at the beginning of lines
<br> Delete the . on the line at the end of the headers.<br><br>You can then scan the message.<br><br>Your comment about the files being compressed PPT Power Point Presentations<br>is also very interesting, as PPT files were also amongst the problem
<br>messages that I came across.<br><br>> 2006/4/18, Jim Holland <<a href="mailto:mailscanner@mango.zw" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">mailscanner@mango.zw</a>>:<br>> >
<br>> > Hi Martin<br>> ><br>> > On Tue, 18 Apr 2006, Martin Hepworth wrote:
<br>> ><br>> > > I'd look at why the clamavmodule is timing out - does clamscan work OK<br>> > > from the command line????<br>> ><br>> > On my system I am not running clamavmodule - just plain clamav. The error
<br>> > message below was on the system being run by Eduardo Casarero.<br>> ><br>> > > RH 7.1 is really really old<br>> ><br>> > Soon to be upgraded to Debian Sarge :-)<br>> ><br>> > > so it could be problems with either clamAV or the perl module not
<br>> > > working with 7.1.<br>> ><br>> > > What happens if you change from the module to the normal clamav scanner<br>> > > in MailScanner.conf?<br>> ><br>> > See above.<br>> >
<br>> > > > -----Original Message-----<br>> > > > From: <a href="mailto:mailscanner-bounces@lists.mailscanner.info" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">mailscanner-bounces@lists.mailscanner.info
</a> [mailto:<a href="mailto:mailscanner-" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
mailscanner-</a><br>> > > > <a href="mailto:bounces@lists.mailscanner.info" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">bounces@lists.mailscanner.info</a>] On Behalf Of Jim Holland<br>
> > > > Sent: 17 April 2006 22:41<br>> > > > To: MailScanner discussion
<br>> > > > Subject: Re: mail scanner stuck<br>> > > ><br>> > > > On Mon, 17 Apr 2006, Eduardo Casarero wrote:<br>> > > ><br>> > > > > Date: Mon, 17 Apr 2006 17:33:54 -0300
<br>> > > > > From: Eduardo Casarero <<a href="mailto:ecasarero@gmail.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">ecasarero@gmail.com</a>><br>> > > > > Reply-To: MailScanner discussion <
<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
mailscanner@lists.mailscanner.info</a><br>> > ><br>> > > > > To: MailScanner discussion <<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
mailscanner@lists.mailscanner.info</a>><br>> > > > > Subject: Re: mail scanner stuck
<br>> > > > ><br>> > > > > hi, after doing some investigation i found the following:<br>> > > > > with 4 particular emails:<br>> > > ><br>> > > > > in /var/log/maillog:
<br>> > > ><br>> > > > Apr 17 16:54:22 avas2 MailScanner[4150]: Virus and Content Scanning:<br>> > > > Starting<br>> > > > Apr 17 16:59:23 avas2 MailScanner[4150]: Commercial scanner
<br>> > clamavmodule<br>> > > > timed out!<br>> > > > Apr 17 16:59:23 avas2 MailScanner[4150]: Virus Scanning: Denial Of<br>> > Service<br>> > > > attack detected!<br>> > > >
<br>> > --------------------------------------------------------------------------<br>> > > > ---<br>> > > > > After this last log message the mail scanner rescan of the same<br>> > email
<br>> > > > > looping. This was logged with 1 child runnig (just for debuggin, in<br>> > > > > normal operation runs 6 childs)<br>> > > ><br>> > > > . . .<br>> > > >
<br>> > > > > After this i really donīt know what to do. Cause Clamav is the only<br>> > AV<br>> > > > > on the system and MScanner has a Timeout for AV of 300 segs an<br>> > clamav
<br>> > > > takes<br>> > > > > only 37.24 seg. so MScanner cant see that clamav finished or<br>> > something<br>> > > > > is missing.<br>> > > ><br>> > > > . . .
<br>> > > ><br>> > > > This seems to be very similar to the problem I wrote about earlier<br>> > this<br>> > > > evening in:<br>> > > ><br>> > > > Subject: Solved? Re: Still stuck in queue, version
4.52.2<br>> > > ><br>> > > > I would be very interested to know:<br>> > > ><br>> > > > The size of the message<br>> > > ><br>> > > > What files it contained
<br>> > > ><br>> > > > Whether the files were compressed, and if so<br>> > > > what was the uncompressed file size<br>> > > ><br>> > > > How many messages were in the batch that failed?
<br>> > > ><br>> > > > Clearly if the message is one of say 30 in a batch then it is going to<br>> > be<br>> > > > easier for ClamAV to time out on the batch than if there was only one
<br>> > in<br>> > > > the batch. My understanding is that the timeout setting applies to<br>> > the<br>> > > > whole batch and not to a single message.<br>> > > ><br>> > > > As indicated in my message, I have changed the default for:
<br>> > > ><br>> > > > Virus Scanner Timeout =<br>> > > ><br>> > > > in MailScanner.conf from 300 to 600 seconds to try to avoid this kind<br>> > of<br>> > > > problem.
<br>> > > ><br>> > > > Regards<br>> > > ><br>> > > > Jim Holland<br>> > > > System Administrator<br>> > > > MANGO - Zimbabwe's non-profit e-mail service
<br>> > > ><br>> > > > --<br>> > > > MailScanner mailing list<br>> > > > <a href="mailto:mailscanner@lists.mailscanner.info" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
mailscanner@lists.mailscanner.info</a><br>> > > >
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>> > > >
<br>> > > > Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
http://wiki.mailscanner.info/posting</a><br>> > > ><br>> > > > Support MailScanner development - buy the book off the website!<br>> > ><br>> > ><br>> > > **********************************************************************
<br>> > ><br>> > > This email and any files transmitted with it are confidential and<br>> > > intended solely for the use of the individual or entity to whom they<br>> > > are addressed. If you have received this email in error please notify
<br>> > > the system manager.<br>> > ><br>> > > This footnote confirms that this email message has been swept<br>> > > for the presence of computer viruses and is believed to be clean.
<br>
> > ><br>> > > **********************************************************************<br>> > ><br>> > ><br>> ><br>> > Regards<br>> ><br>> > Jim Holland<br>> > System Administrator
<br>> > MANGO - Zimbabwe's non-profit e-mail service<br>> ><br>> > --<br>> > MailScanner mailing list<br>> > <a href="mailto:mailscanner@lists.mailscanner.info" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
mailscanner@lists.mailscanner.info
</a><br>> > <a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a>
<br>> ><br>> > Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
http://wiki.mailscanner.info/posting</a><br>> ><br>> > Support MailScanner development - buy the book off the website!<br>> ><br>><br><br>Regards<br><br>Jim Holland<br>System Administrator<br>MANGO - Zimbabwe's non-profit e-mail service
<br><br>--<br>MailScanner mailing list<br><a href="mailto:mailscanner@lists.mailscanner.info" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">mailscanner@lists.mailscanner.info</a><br><a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
http://lists.mailscanner.info/mailman/listinfo/mailscanner
</a><br><br>Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://wiki.mailscanner.info/posting</a><br><br>Support MailScanner development - buy the book off the website!
<br></blockquote></div><br>