<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.Stylwiadomocie-mail17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="PL" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hello,<o:p></o:p></p>
<p class="MsoNormal">I updated MailScanner from 5.2.2 to 5.3.1 on OpenSUSE 15.2 (ClamAV 0.100.3 and F-Secure)<o:p></o:p></p>
<p class="MsoNormal">I noticed some messages like this (I know there was similar case on 5.1.3)<o:p></o:p></p>
<p class="MsoNormal">Can you help me how to investigate this:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Our virus detector failed to completely analyse a message you sent:-<o:p></o:p></p>
<p class="MsoNormal">Any parts of the message that could not be analysed will not have been delivered.<o:p></o:p></p>
<p class="MsoNormal">If you are using Microsoft Outlook, we strongly recommend you change your outgoing message format from "Rich Text" to "HTML" or "Plain Text".<o:p></o:p></p>
<p class="MsoNormal">1) Click on the "Tools" menu and choose "Options..."<o:p></o:p></p>
<p class="MsoNormal">2) Go to the "Mail Format" tab<o:p></o:p></p>
<p class="MsoNormal">3) For message format, select "HTML" or "Plain text"<o:p></o:p></p>
<p class="MsoNormal">4) Click OK<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The virus detector said this about the message:<o:p></o:p></p>
<p class="MsoNormal">Report: Report: MailScanner: Message attempted to kill MailScanner<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">My config doesn't complain:<o:p></o:p></p>
<p class="MsoNormal"># MailScanner --lint<o:p></o:p></p>
<p class="MsoNormal">Trying to setlogsock(unix)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Reading configuration file /etc/MailScanner/MailScanner.conf<o:p></o:p></p>
<p class="MsoNormal">Reading configuration file /etc/MailScanner/conf.d/README<o:p></o:p></p>
<p class="MsoNormal">Read 1503 hostnames from the phishing whitelist<o:p></o:p></p>
<p class="MsoNormal">Read 7061 hostnames from the phishing blacklists<o:p></o:p></p>
<p class="MsoNormal">Config: calling custom init function MailWatchLogging<o:p></o:p></p>
<p class="MsoNormal">MailWatch: Started MailWatch SQL Logging child<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Checking version numbers...<o:p></o:p></p>
<p class="MsoNormal">Version number in MailScanner.conf (5.3.1) is correct.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Your envelope_sender_header in spamassassin.conf is correct.<o:p></o:p></p>
<p class="MsoNormal">MailScanner setting GID to (51)<o:p></o:p></p>
<p class="MsoNormal">MailScanner setting UID to (51)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Checking for SpamAssassin errors (if you use it)...<o:p></o:p></p>
<p class="MsoNormal">Using SpamAssassin results cache<o:p></o:p></p>
<p class="MsoNormal">Connected to SpamAssassin cache database<o:p></o:p></p>
<p class="MsoNormal">SpamAssassin reported no errors.<o:p></o:p></p>
<p class="MsoNormal">Connected to Processing Attempts Database<o:p></o:p></p>
<p class="MsoNormal">Created Processing Attempts Database successfully<o:p></o:p></p>
<p class="MsoNormal">There are 0 messages in the Processing Attempts Database<o:p></o:p></p>
<p class="MsoNormal">Using locktype = posix<o:p></o:p></p>
<p class="MsoNormal">MailScanner.conf says "Virus Scanners = f-secure clamd"<o:p></o:p></p>
<p class="MsoNormal">Found these virus scanners installed: f-secure, clamd<o:p></o:p></p>
<p class="MsoNormal">===========================================================================<o:p></o:p></p>
<p class="MsoNormal">Virus and Content Scanning: Starting<o:p></o:p></p>
<p class="MsoNormal">Virus Scanning: F-Secure found virus EICAR_Test_File<o:p></o:p></p>
<p class="MsoNormal">./1/eicar.com.virus: Infected: EICAR_Test_File [FSE]<o:p></o:p></p>
<p class="MsoNormal">Virus Scanning: F-Secure found virus Malware.Eicar-Test-Signature<o:p></o:p></p>
<p class="MsoNormal">./1/eicar.com.virus: Infected: Malware.Eicar-Test-Signature [Aquarius]<o:p></o:p></p>
<p class="MsoNormal">Virus Scanning: F-Secure found 1 infections<o:p></o:p></p>
<p class="MsoNormal">Clamd::ERROR:: Can't open file or directory ERROR :: ./1/neicar.com.virus<o:p></o:p></p>
<p class="MsoNormal">Clamd::INFECTED::Win.Test.EICAR_HDB-1 :: ./1/<o:p></o:p></p>
<p class="MsoNormal">Virus Scanning: Clamd found 2 infections<o:p></o:p></p>
<p class="MsoNormal">Infected message 1 came from 10.1.1.1<o:p></o:p></p>
<p class="MsoNormal">Virus Scanning: Found 3 viruses<o:p></o:p></p>
<p class="MsoNormal">===========================================================================<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Best Regards<o:p></o:p></p>
<p class="MsoNormal">Marek Górny<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<basefont size="2">
<p><img src="https://bolix.pl/uploads/misc/logo.gif" alt="Bolix" width="92" height="23" longdesc="logo.JPG"></p>
<table width="45%" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td width="16%" rowspan="2"><img src="https://bolix.pl/uploads/misc/BOX_Lokalizacja.jpg" alt="BO_Lokalizacja" width="226" height="241"></td>
<td width="16%"><a href="https://bolix.pl/pl/page/14" title="Ochrona danych osobowych"><img src="https://bolix.pl/uploads/misc/BOX_Ochrona_Danych.jpg" alt="RODO" width="226" height="156"></a></td>
<td width="68%" rowspan="2"><a href="https://bolix.pl/pl/open-file/1098" title="Teraz Polska"><img src="https://bolix.pl/uploads/misc/BOX_Teraz_Polska.jpg" alt="Teraz_Polska" width="226" height="241"></a></td>
</tr>
<tr>
<td><a href="https://www.facebook.com/bolixsa" title="Facebook"><img src="https://bolix.pl/uploads/misc/BOX_Facebook.jpg" alt="Facebook" width="226" height="84"></a></td>
</tr>
</tbody>
</table>
<p><font face="Calibri"><font size="-2"><strong>UWAGA: </strong>Niniejsza korespondencja przeznaczona jest wyłącznie dla osoby lub podmiotu, do którego jest zaadresowana i może zawierać treści chronione przepisami prawa. Wgląd w treść wiadomości otrzymanej
omyłkowo, dalsze jej przekazywanie, rozpowszechnianie lub innego rodzaju wykorzystanie, bądź podjęcie jakichkolwiek działań w oparciu o zawarte w niej informacje przez osobę lub podmiot nie będący adresatem, jest niedozwolone. Odbiorca korespondencji, który
otrzymał ją omyłkowo, proszony jest o zawiadomienie nadawcy i usunięcie tego materiału z komputera.<strong><br>
<br>
ATTENTION: </strong>The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, Or taking of any action in
reliance upon, this information by person or entity other than the intended recipient is not permitted. If you received this in error, please contact the sender and delete the material from any computer.
</font></font><font size="-1"><br>
</font></p>
<p><font color="#009933" size="-1" face="Calibri"><img src="https://bolix.pl/uploads/misc/1327933481_55480700.jpg" alt="Las" width="24" height="27" longdesc="las.GIF"> Proszę pomyśl o środowisku przed wydrukowaniem tego maila. Please Consider the Environment
before printing this Email</font></p>
</body>
</html>