what version of MailScanner, clamav and the libraries (mailscanner -v)<br><br clear="all">-- <br>Martin Hepworth<br>Oxford, UK<br>
<br><br><div class="gmail_quote">On 14 March 2011 15:16, Alvaro Marin <span dir="ltr"><<a href="mailto:alvaro@hostalia.com">alvaro@hostalia.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Hi again,<br>
<br>
just another thing, running MailScanner with --debug, died with these message:<br>
<br>
Can't call method "CombineReports" on unblessed reference at /opt/MailScanner/lib/MailScanner/MessageBatch.pm line 736.<br>
<br>
Regards,<br>
<br>
<br>
El 14/03/11 15:53, Alvaro Marin escribió:<div><div></div><div class="h5"><br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Hello,<br>
<br>
two days ago, we started to receive messages with a zip attachment.<br>
Those messages were killing MailScanner processes so the queue started<br>
to grow up.<br>
ClamAV wasy detecting those messages with the "rogue.hdb" signatures of<br>
Sanesecurity:<br>
<br>
Mar 12 00:01:28 192.168.66.215 clamd[7666]:<br>
/var/spool/MailScanner/incoming/17861/0630461AA4F.A1245/nFedEx.zip:<br>
Sanesecurity.Rogue.0hr.0311v23576 .UNOFFICIAL FOUND<br>
Mar 12 00:01:28 192.168.66.215 clamd[7666]:<br>
/var/spool/MailScanner/incoming/17861/0630461AA4F.A1245.message:<br>
Sanesecurity.Rogue.0hr.0311v23576 .UNOFFICIAL FOUND<br>
<br>
As you see, the name of the virus has a " " at the end. Logs show this<br>
strange line:<br>
<br>
Mar 12 00:01:48 192.168.66.215 MailScanner[17877]: Found spam-virus in<br>
<br>
I changed the rogue.hdb signature file and removed the space at the end<br>
of the line and then the messages were processed fine and the queue was<br>
processed.<br>
<br>
Now I see that the signature is correct, without that space, but for<br>
example there are other examples:<br>
<br>
$ wget <a href="http://ftp.swin.edu.au/sanesecurity/rogue.hdb" target="_blank">http://ftp.swin.edu.au/sanesecurity/rogue.hdb</a> --no-verbose<br>
2011-03-14 15:43:56 URL:<a href="http://ftp.swin.edu.au/sanesecurity/rogue.hdb" target="_blank">http://ftp.swin.edu.au/sanesecurity/rogue.hdb</a><br>
[119235/119235] -> "rogue.hdb" [1]<br>
$ grep " $" rogue.hdb<br>
424d531f5dcb364c5b29bdcb5962c8f9:37376:Sanesecurity.Rogue.0hr.08239110<br>
9ffc6994a66be0d8667550a0e9ed80ea:36864:Sanesecurity.Rogue.0hr.0903v13268<br>
3018e99857f31a59e0777396ae634a8f:29568:Sanesecurity.Rogue.0hr.0311n19694<br>
<br>
(those signatures have a space at the end of the line).<br>
<br>
I'll notify to the signature's creator to correct this, but why<br>
MailScanner dies when the signature has an space? Can be fixed to check it?<br>
<br>
Thanks!<br>
<br>
Regards,<br>
<br>
</blockquote>
<br>
<br>
-- <br>
Alvaro Marín Illera<br>
Hostalia Internet<br>
<a href="http://www.hostalia.com" target="_blank">www.hostalia.com</a><br>
<br>
-- <br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website! </div></div></blockquote></div><br>