What does this mean? MailScanner: Could not analyze message

Discussion:

Brian Parish

2006-01-13 03:27:44 UTC

[ The following text is in the "iso-8859-1" character set. ]
[ Your display is set for the "US-ASCII" character set. ]
[ Some characters may be displayed incorrectly. ]

Today with no changes in configuration, senders to accounts hosted here
started getting messages like this:

---------------------

X-Univex Systems Pty Ltd-MailScanner: generated

Our virus detector failed to completely analyse a message you sent:-
To: ***@univexsystems.com
Subject: The Application for Network Technician
Date: Tue Nov 30 07:08:13 2004
Any parts of the message that could not be analysed will not have been
delivered.

If you are using Microsoft Outlook, we strongly recommend you change your
outgoing message format from "Rich Text" to "HTML" or "Plain Text".

1) Click on the "Tools" menu and choose "Options..."
2) Got to the "Mail Format" tab
3) For message format, select "HTML" or "Plain text"
4) Click OK

The virus detector said this about the message:
Report: MailScanner: Could not analyze message

--
MailScanner
Email Virus Scanner
www.mailscanner.info
MailScanner thanks transtec Computers for their support

---------------------

What gives? Any pointers on what to look at?

TIA
Brian

------------------------ MailScanner list ------------------------
To unsubscribe, email ***@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

Brian Parish

2006-01-13 03:27:45 UTC

Permalink

[ The following text is in the "iso-8859-1" character set. ]
[ Your display is set for the "US-ASCII" character set. ]
[ Some characters may be displayed incorrectly. ]

Post by Brian Parish
Today with no changes in configuration, senders to accounts hosted here
---------------------
X-Univex Systems Pty Ltd-MailScanner: generated
Our virus detector failed to completely analyse a message you sent:-
Subject: The Application for Network Technician
Date: Tue Nov 30 07:08:13 2004
Any parts of the message that could not be analysed will not have been
delivered.
If you are using Microsoft Outlook, we strongly recommend you change your
outgoing message format from "Rich Text" to "HTML" or "Plain Text".
1) Click on the "Tools" menu and choose "Options..."
2) Got to the "Mail Format" tab
3) For message format, select "HTML" or "Plain text"
4) Click OK
Report: MailScanner: Could not analyze message
--
MailScanner
Email Virus Scanner
www.mailscanner.info
MailScanner thanks transtec Computers for their support
---------------------

Looking further at this, I see

Cannot parse /var/spool/MailScanner/incoming/19497/5FA2B6715.header and ,
Can't locate object method "init" via package "MIME::Decoder::QuotedPrint"
at /usr/lib/perl5/vendor_perl/5.8.3/MIME/Decoder.pm line 173.

messages in the log as well as:

Compilation failed in require
at /usr/lib/perl5/vendor_perl/5.8.3/MIME/Decoder.pm line 171.

then lots of postfix messages warning of corrupt messages.

Looks like something has gone horribly wrong with my MailScanner install, but
without any known changes to the system. I see similar messages reported in
another thread: "Sudden problem..."

Julian supplied a Message.pm file in response to this. Should I install this
as well? I am concerned about all these corrupt messages.

thanks again in advance
Brian

------------------------ MailScanner list ------------------------
To unsubscribe, email ***@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

Brian Parish

2006-01-13 03:27:45 UTC

Permalink

[ The following text is in the "iso-8859-1" character set. ]
[ Your display is set for the "US-ASCII" character set. ]
[ Some characters may be displayed incorrectly. ]

Post by Brian Parish

Sorry to keep talking to myself, but as I look more at this new info emerges.
In the absence of any othe ideas, I restarted MailScanner. This appears to
have resolved the issue - at least for the moment. No more messages in the
log and so far no bounces reported. Still hunting for a cause though.

thanks again
Brian

------------------------ MailScanner list ------------------------
To unsubscribe, email ***@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

Martin Hepworth

2006-01-13 03:27:45 UTC

Permalink

Brian

what version of MailScanner and what version of the perl modules

"MailScanner -v" will give you the info..

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

Post by Brian Parish

Sorry to keep talking to myself, but as I look more at this new info emerges.
In the absence of any othe ideas, I restarted MailScanner. This appears to
have resolved the issue - at least for the moment. No more messages in the
log and so far no bounces reported. Still hunting for a cause though.
thanks again
Brian
------------------------ MailScanner list ------------------------
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email ***@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

Patel, Anjana

2006-01-13 03:27:45 UTC

Permalink

Post by Brian Parish

Post by Brian Parish
Looking further at this, I see
Cannot parse /var/spool/MailScanner/incoming/19497/5FA2B6715.header

and

Post by Brian Parish
,

Post by Brian Parish
Can't locate object method "init" via package

"MIME::Decoder::QuotedPrint"

Post by Brian Parish
at /usr/lib/perl5/vendor_perl/5.8.3/MIME/Decoder.pm line 173.

I got similar messages in my logs after I installed the latest Perl
modules (using CPAN) on a RedHat 9 system in preparation for upgrading
mailscanner to the latest stable. Forcing a reinstall of MIME::Base64
and MIME::Tools solved the problem. I suspect that there may be a
specific order in which these modules need to be installed.

Anjana

------------------------ MailScanner list ------------------------ To
unsubscribe, email ***@jiscmail.ac.uk with the words: 'leave
mailscanner' in the body of the email. Before posting, read the MAQ
(http://www.mailscanner.biz/maq/) and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email ***@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

Brian Parish

2006-01-13 03:27:45 UTC

Permalink

[ The following text is in the "iso-8859-1" character set. ]
[ Your display is set for the "US-ASCII" character set. ]
[ Some characters may be displayed incorrectly. ]

Hmmm. Maybe this symptomatic of another problem?

# MailScanner -v
Cannot open config file -v, No such file or directory
at /usr/lib/MailScanner/MailScanner/Config.pm line 575.
[***@server root]# rpm -qa | grep mailsc
mailscanner-4.31.6-1

Probably time I upgraded, but I am still at a loss to know why this started
without any changes and why restarting MailScanner seems to have fixed it.

cheers
Brian

Post by Martin Hepworth
Brian
what version of MailScanner and what version of the perl modules
"MailScanner -v" will give you the info..
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

Post by Brian Parish

Post by Brian Parish
Today with no changes in configuration, senders to accounts hosted here
---------------------
X-Univex Systems Pty Ltd-MailScanner: generated
Our virus detector failed to completely analyse a message you sent:-
Subject: The Application for Network Technician
Date: Tue Nov 30 07:08:13 2004
Any parts of the message that could not be analysed will not have been
delivered.
If you are using Microsoft Outlook, we strongly recommend you change
your outgoing message format from "Rich Text" to "HTML" or "Plain
Text".
1) Click on the "Tools" menu and choose "Options..."
2) Got to the "Mail Format" tab
3) For message format, select "HTML" or "Plain text"
4) Click OK
Report: MailScanner: Could not analyze message
--
MailScanner
Email Virus Scanner
www.mailscanner.info
MailScanner thanks transtec Computers for their support
---------------------

Sorry to keep talking to myself, but as I look more at this new info
emerges. In the absence of any othe ideas, I restarted MailScanner. This
appears to have resolved the issue - at least for the moment. No more
messages in the log and so far no bounces reported. Still hunting for a
cause though.
thanks again
Brian
------------------------ MailScanner list ------------------------
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
Support MailScanner development - buy the book off the website!

**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.
This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.
**********************************************************************
------------------------ MailScanner list ------------------------
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email ***@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

Martin Hepworth

2006-01-13 03:27:45 UTC

Permalink

Brian

nope, the -v flag first appeared in 4.32.....

the sudden problem was to an issue with 4.35-11 and recipient
notifications....

Might be worth making sure you are running the latest versions of
MIME::base64 etc...

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

Post by Brian Parish
Hmmm. Maybe this symptomatic of another problem?
# MailScanner -v
Cannot open config file -v, No such file or directory
at /usr/lib/MailScanner/MailScanner/Config.pm line 575.
mailscanner-4.31.6-1
Probably time I upgraded, but I am still at a loss to know why this started
without any changes and why restarting MailScanner seems to have fixed it.
cheers
Brian

Post by Brian Parish

Post by Brian Parish
Today with no changes in configuration, senders to accounts hosted here
---------------------
X-Univex Systems Pty Ltd-MailScanner: generated
Our virus detector failed to completely analyse a message you sent:-
Subject: The Application for Network Technician
Date: Tue Nov 30 07:08:13 2004
Any parts of the message that could not be analysed will not have been
delivered.
If you are using Microsoft Outlook, we strongly recommend you change
your outgoing message format from "Rich Text" to "HTML" or "Plain
Text".
1) Click on the "Tools" menu and choose "Options..."
2) Got to the "Mail Format" tab
3) For message format, select "HTML" or "Plain text"
4) Click OK
Report: MailScanner: Could not analyze message
--
MailScanner
Email Virus Scanner
www.mailscanner.info
MailScanner thanks transtec Computers for their support
---------------------

Looking further at this, I see
http://news.bbc.co.uk/
Cannot parse /var/spool/MailScanner/incoming/19497/5FA2B6715.header and ,
Can't locate object method "init" via package
"MIME::Decoder::QuotedPrint" at
/usr/lib/perl5/vendor_perl/5.8.3/MIME/Decoder.pm line 173.
Compilation failed in require
at /usr/lib/perl5/vendor_perl/5.8.3/MIME/Decoder.pm line 171.
then lots of postfix messages warning of corrupt messages.
Looks like something has gone horribly wrong with my MailScanner install,
but without any known changes to the system. I see similar messages
reported in another thread: "Sudden problem..."
Julian supplied a Message.pm file in response to this. Should I install
this as well? I am concerned about all these corrupt messages.
thanks again in advance
Brian

Sorry to keep talking to myself, but as I look more at this new info
emerges. In the absence of any othe ideas, I restarted MailScanner. This
appears to have resolved the issue - at least for the moment. No more
messages in the log and so far no bounces reported. Still hunting for a
cause though.
thanks again
Brian
------------------------ MailScanner list ------------------------
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
Support MailScanner development - buy the book off the website!

**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.
This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.
**********************************************************************
------------------------ MailScanner list ------------------------
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
Support MailScanner development - buy the book off the website!

Julian Field

2006-01-13 03:27:45 UTC

Permalink

[ The following text is in the "ISO-8859-1" character set. ]
[ Your display is set for the "US-ASCII" character set. ]
[ Some characters may be displayed incorrectly. ]

To start with, remove the spaces from your %org-name%. As it clearly
says in MailScanner.conf, you are NOT allowed spaces in this.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email ***@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!