set AttachmentLog and ScanLog to the highest level

post the complete log for a passed mail (post detected)

Thomas





Von:    "K Post" <nntp.p...@gmail.com>
An:     "ASSP development mailing list" <assp-test@lists.sourceforge.net>
Datum:  09.01.2019 18:33
Betreff:        Re: [Assp-test] ClamAV catching spam, but still delivered



I've been running AFC 4.88 for a while now.  I will update to 4.89, but it 
doesn't sound like that's it.

I just did a search on "ClamAV: scanned" and see a ton of these lines in 
today's log appearing after delivery.  I believe I'm only seeing the logs 
when clamav actually catches something after the fact.  Could it NEVER be 
scanning the stream itself?  Is there a setting that I have wrong?  What 
should I check?

Any other ideas as to why the clam scan seems to fairly regularly be 
either skipped or fails during the delivery process?  Could ASSP somehow 
detect this problem before delivery, scan the file instead of the stream, 
and then decide to deliver or not?  

Spam's annoying, but if some slips through because of this, I don't really 
care.  It's the fear of a detectable true virus being sent through because 
ClamAV sometimes isn't working on the stream that's scaring me.

thanks
Ken


On Wed, Jan 9, 2019 at 11:06 AM Thomas Eckardt <thomas.ecka...@thockar.com
> wrote:
any of your settings or a bug prevents ASSP_AFC from scanning the mail 

>ClamAV: scanned 2805 bytes in file 
messages/okmail/Spam_Subject--3092281.txt 

This is a security (post)scan forced by 'ClamAVLogScan'. Stored files are 
scanned, if not already done while processing the mail. 

notice: a security BUG was fixed in ASSP_AFC 4.88 and 4.89 ---- some MIME 
types were not correctly detected while processing the mail, but if files 
were scanned - seems you use an outdated ASSP_AFC 

Thomas





Von:        "K Post" <nntp.p...@gmail.com> 
An:        "ASSP development mailing list" <
assp-test@lists.sourceforge.net> 
Datum:        09.01.2019 16:45 
Betreff:        [Assp-test] ClamAV catching spam, but still delivered 



Hi Thomas, 
Back in July 2018, I started a thread where ClamAV was catching spam, but 
only AFTER delivery.  You suggested that the ASSP_AFC plugin wasn't 
scanning the MIME headers and then fixed that in AFC 4.83. 

I just received a report of spam that still came through, despite ClamAV 
catching it.  In reviewing the log, I see a low scoring message being 
delivered and then 1 second later ClamAV via AFC showing a hit. 

It's a normal sounding email, so I understand why bayesian / HMM wouldn't 
catch it.  I'm glad that clamav did, but it's pointless if the scan is 
after the delivery right? 

The last time I brought this up, you initially said that I have a setting 
that prevents ClamAV from running until after delivery.  Can you tell me 
what that setting is? 
Thanks 

log: 

Jan-08-19 03:02:54 17771-28711 37.xx.xx.xx.xx <thespam...@spam.xx> to: 
our.u...@ourcharity.org [scoring] DKIM domain-check skipped - spam.xx does 
not support DKIM 
Jan-08-19 03:02:54 17771-28711 37.xx.xx.xx.xx <thespam...@spam.xx> to: 
our.u...@ourcharity.org [scoring] SPF: softfail ip=37.xx.xx.xx.xx 
mailfrom=thespam...@spam.xx helo=randomhost.com 
Jan-08-19 03:02:54 17771-28711 37.xx.xx.xx.xx <thespam...@spam.xx> to: 
our.u...@ourcharity.org Message-Score: added 5 (spfsValencePB) for SPF 
softfail, total score for this message is now 5 
Jan-08-19 03:02:54 17771-28711 37.xx.xx.xx.xx <thespam...@spam.xx> to: 
our.u...@ourcharity.org checking MX/A for spam.xx , otherspam.xx 
Jan-08-19 03:02:55 17771-28711 37.xx.xx.xx.xx <thespam...@spam.xx> to: 
our.u...@ourcharity.org spam.xx - MX 'mx1.compromised.net' - got IP 
(18.xx.xx.xx) 
Jan-08-19 03:02:55 17771-28711 37.xx.xx.xx.xx <thespam...@spam.xx> to: 
our.u...@ourcharity.org otherspam.xx - MX 'mx2.mail.otherspam.xx' - got IP 
(14.xx.xx.xx) 
Jan-08-19 03:02:55 17771-28711 37.xx.xx.xx.xx <thespam...@spam.xx> to: 
our.u...@ourcharity.org MX found: spam.xx (Mail From: , From) -> 
mx1.compromised.net 
Jan-08-19 03:02:55 17771-28711 37.xx.xx.xx.xx <thespam...@spam.xx> to: 
our.u...@ourcharity.org A record found for MX: spam.xx (Mail From: , From) 
-> 18.xx.xx.xx 
Jan-08-19 03:02:55 17771-28711 37.xx.xx.xx.xx <thespam...@spam.xx> to: 
our.u...@ourcharity.org MX found: otherspam.xx (Reply-To) -> 
mx2.mail.otherspam.xx 
Jan-08-19 03:02:55 17771-28711 37.xx.xx.xx.xx <thespam...@spam.xx> to: 
our.u...@ourcharity.org A record found for MX: otherspam.xx (Reply-To) -> 
14.xx.xx.xx 
Jan-08-19 03:02:55 17771-28711 37.xx.xx.xx.xx <thespam...@spam.xx> to: 
our.u...@ourcharity.org [scoring] found valid PTR hosted-by-xx.com 
Jan-08-19 03:02:55 17771-28711 37.xx.xx.xx.xx <thespam...@spam.xx> to: 
our.u...@ourcharity.org HMM-Check has given less than 6 results - using 
monitoring mode only 
Jan-08-19 03:02:55 17771-28711 37.xx.xx.xx.xx <thespam...@spam.xx> to: 
our.u...@ourcharity.org HMM Check [monitoring] - Prob: 1.00000 - 
Confidence: 0.00028 => doubtful.spam - answer/query relation: 0% of 137 
Jan-08-19 03:02:55 17771-28711 37.xx.xx.xx.xx <thespam...@spam.xx> to: 
our.u...@ourcharity.org Bayesian Check [scoring] - Prob: 1.00000 - 
Confidence: 0.00000 => doubtful.spam - answer/query relation: 100% of 138 
Jan-08-19 03:02:55 17771-28711 37.xx.xx.xx.xx <thespam...@spam.xx> to: 
our.u...@ourcharity.org Message-Score: added 25 for Bayesian Probability: 
1.00000, total score for this message is now 30   WE'RE AT 30 
Jan-08-19 03:02:55 17771-28711 37.xx.xx.xx.xx <thespam...@spam.xx> to: 
our.u...@ourcharity.org [Plugin] calling plugin ASSP_AFC   AFC CALLED 
Jan-08-19 03:02:55 17771-28711 [MessageOK] 37.xx.xx.xx.xx 
<thespam...@spam.xx> to: our.u...@ourcharity.org message ok [ Subject] -> 
messages/okmail/Spam_Subject--3092281.txt 
Jan-08-19 03:02:56 17771-28711 37.xx.xx.xx.xx <thespam...@spam.xx> to: 
our.u...@ourcharity.org info: PB-IP-Score for '37.xx.xx.xx.xx' is 5, added 
5 in this session 
Jan-08-19 03:02:56 17771-28711 37.xx.xx.xx.xx <thespam...@spam.xx> to: 
our.u...@ourcharity.org finished message - received DATA size: 1.87 kByte 
- sent DATA size: 2.97 kByte 
Jan-08-19 03:02:56 17771-28711 37.xx.xx.xx.xx <thespam...@spam.xx> to: 
our.u...@ourcharity.org disconnected: session:11EAAF22 37.xx.xx.xx.xx - 
processing time 5 seconds DELIVERED 
Jan-08-19 03:02:56 17771-28711 37.xx.xx.xx.xx <thespam...@spam.xx> to: 
our.u...@ourcharity.org ClamAV: scanned 2805 bytes in file 
messages/okmail/Spam_Subject--3092281.txt - FOUND 
winnow.spam.ts.xmailer.2.UNOFFICIAL   Spam (Virus) found 1 second after 
AFC called 
Jan-08-19 03:02:56 17771-28711 37.xx.xx.xx.xx <thespam...@spam.xx> to: 
our.u...@ourcharity.org deleting spamming safelisted tuplet: 
(37.48.120.0,spam.xx) age: 3s 
Jan-08-19 03:02:56 17771-28711 37.xx.xx.xx.xx <thespam...@spam.xx> to: 
our.u...@ourcharity.org Message-Score: added 50 (vdValencePB) for virus 
detected: 'winnow.spam.ts.xmailer.2.UNOFFICIAL', total score for this 
message is now 80  ADDED 50, but only after delivery 

_______________________________________________
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test




DISCLAIMER:
*******************************************************
This email and any files transmitted with it may be confidential, legally 
privileged and protected in law and are intended solely for the use of the 

individual to whom it is addressed.
This email was multiple times scanned for viruses. There should be no 
known virus in this email!
*******************************************************

_______________________________________________
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test
_______________________________________________
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test




DISCLAIMER:
*******************************************************
This email and any files transmitted with it may be confidential, legally 
privileged and protected in law and are intended solely for the use of the 

individual to whom it is addressed.
This email was multiple times scanned for viruses. There should be no 
known virus in this email!
*******************************************************

_______________________________________________
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test

Reply via email to