On 11/05/2013 11:36 AM, Nicholas Chua wrote: > @40000000527939db275e357c simscan: runned_scanners is attach: 1.4.0 > @40000000527939db275e4cec simscan: found 1.4.0 > @40000000527939db275e4cec simscan: calling clamdscan > @40000000527939db27fcf61c simscan: clamdscan: > /var/qmail/simscan/1383676369.658461.8827/msg.1383676369.658461.8827: > TROJ_GEN.F0D1H00K413.UNOFFICIAL FOUND > @40000000527939db2874e53c simscan: clamdscan: > /var/qmail/simscan/1383676369.658461.8827/Order history page.pdf1.exe: > TROJ_GEN.F0D1H00K413.UNOFFICIAL FOUND > @40000000527939db2879bb84 simscan: clamdscan: > @40000000527939db2879bf6c simscan: clamdscan: ----------- SCAN SUMMARY > ----------- > @40000000527939db2879dac4 simscan: clamdscan: Infected files: 2 > @40000000527939db2879ee4c simscan: clamdscan: Time: 0.017 sec (0 m 0 s) > @40000000527939db287a53dc simscan: cdb looking up version clamav > @40000000527939db287ab584 simscan: runned_scanners is attach: 1.4.0 > clamav: 0.98/m:55/d:17959 > @40000000527939db287ab96c simscan: found 0.98/m:55/d:17959 > @40000000527939db287ad8ac simscan: clamdscan detected a virus > @40000000527939db287b1b14 simscan:[8826]:VIRUS > DROPPED:0.0208s:TROJ_GEN.F0D1H00K413.UNOFFICIAL:165.21.6.27:[email protected]:[email protected] > @40000000527939db287b3e3c simscan: exit error code: 0
Please include context around log messages. It's hard to see what happened with only a sampling of messages. In my smtp log, a virus rejection looks like this: 09-09 06:05:15 simscan:[16687]:VIRUS:0.6551s:Heuristics.Phishing.Email.SpoofedDomain:66.231.82.216:bounce-528268_html-1279213273-32461012-770-...@bounce.email.angieslist.com ... 09-09 06:05:15 qmail-smtpd: qq hard reject (Your email was rejected because it contains the Heuristics.Phishing.Email.SpoofedDomain virus): MAILFROM:<bounce-528268_html-1279213273-32461012-770-...@bounce.email.angieslist.com> ... 09-09 06:05:15 spamdyke[16686]: DENIED_OTHER from: bounce-528268_html-1279213273-32461012-770-...@bounce.email.angieslist.com to: ... origin_ip: 66.231.82.216 origin_rdns: mta.email.angieslist.com auth: (unknown) encryption: (none) reason: 554_Your_email_was_rejected_because_it_contains_the_Heuristics.Phishing.Email.SpoofedDomain_virus I'm trying to help you determine if these viruses were rejected or not. I can't tell from what you've posted. I'm a little surprised that your simscan is returning code 0 when it finds a virus. I would have guessed it would return a non-zero value in this case. Perhaps that's why your server isn't rejecting these messages. BTW, which versions of QMT packages are you running? # rpm -qa | grep toaster | sort On a side note, if you don't have spamdyke installed, I highly recommend doing so. The load on your server will be substantially reduced when you do. -- -Eric 'shubes' --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
