Hi Jordi, I faced the same problem as yours but haven't test sending an email with virus.
I am using Red Hat Linux 9, qmail-scanner 1.16 and clamav. Below is what I received when I sent an email and I did'nt get the attachment:- Content-Type: multipart/mixed; This is a multi-part message in MIME format. --=====000_Dragon303642860140_===== Content-Type: text/plain; Content-Transfer-Encoding: 7bit Hello, rootlinux, 2003-06-30 --=====000_Dragon303642860140_===== Content-Type: application/octet-stream; Content-Transfer-Encoding: base64 Content-Disposition: attachment; UEsDBBQAAAAIAIRevi6gXMwSyggAAJoNAAAGAAAAc24udHh0jVffcxypEX5Xlf6HydPlqq6dBChA 95QCAngIMXAEZh430tpWbGtdknyO89fnG91dHlOxy67dYYDu/n50r788LqePH5dvly/L5cvz8vz+ /HjG/6fn5eF8vltu7+jD+dvT8nxZLm/f3t+el399XrDn6/3D3eXrE779sLxe3l6+PNxh1/3T8u7x jL1P98+/nvLu9PN5+XRePl5Od0/L6eW187fl9zgDH5bLw/nplxdfL1+eznffL18vH853v8PXd5eX cD4dF+Pf8nR+vD99/Pcr3Pr718dlDx++/2H5B4L+enq+ff8S/tf354cjl+8ej6NfbngJ5faEw39N 7vT4WzQ49PPl85fPv8T19Pzl7dtXy5sPp2/L02V5/R1ufvj4bfmTeFl+fyTy/nSL6JbLz+fHhf3x j0fIqN/tLfJ/xinPyyfsvX1/uXxcbi+fPn95Pj8i2qO4L9U8vWx4OKEex5GfT09PXy+Pd0d1P17e 3T98/2p5/fYl6pei310evkNOl8cPR8mfLp/OR9bvfjjeeFjO9Ol0//Go7en5RwCBLe/OD38+XqNf avXq9p//ePVwfv5h+W/iv5394/XV9dVPl7fPX/H0x2Xe/829mT8tW1nsm1aORRsY34insQpyc/RA fdaQiasbE66vRPHRksw1e7KO8URp3Q2nvYzgrq/csKOQc30zJHTTmoZmztEmViOvr5iPbZItNjJa d6Yq9ShiJcdxxfVVNMx4yrZPRswZq8gNXxUZdzP19dW6Dm5oV6zsVLkuAUEpbamylG6w3IRPNCsL jXiMMVCpeRoKIjR+fZW02nYSUW6NVrHWRDknJinLtM3rqz3uRVBk3lfyWXFLMYnMKKSoUZjoXem0 hdY26lqrQNVp14nZVe1Yll7uJGcpkYY4lnlWyMKJbTXXV0Nqp5CSPkqhjUCAyldPYvV6Q+T7rlcS vqZKho/d4dWpK+3rLuP1Fa8GB9qsV048aL/Tyqc6Ppsj78i0WBGtZYq0SQlVs240YmlT7fpKWYtS RN7FRrV3FYltcSu0dzYq7pabGoR3OJAeWnbyuthJ2408QgtqV5aUSFyTcllq0nw1ERE4g7KY1Q+J jBNQR4590D5KxEtGarBF7zElKmXvG8XpxoqF1gxNGSzosINkkZLNMpLVfggaUYdCSWsPSISpKdAu ag6AQeidkpfFgEwi9+urTZgUSQahUEhrbCR/MIHWaKMFFZUouHtsKKrdzIzUUwyOzGhRXV9Jp2Yl bVT0QOQx+FXTii+gdmYJNQelQIc5LTLeQhSdSnPFAhjXcPhqWZW0DTsTdasTFjyoTANKApnEtOCl K0IU6iIESylbENmHstZDwvS//hwvHH/H/U/3bw7hl/bmt2dmq5VRVptUZGdolrpzVhLfTB+oaBUu UyqzcOpy7IBODu1oCjYBdux8eopt15OqLRkUcxmUTTlMhopOCdVnPqABZhpE2goPAD7fGGSl1Axg fEg5UlV8TJo5V+jB+MNYehKwg53vcpBwUQSSY5WWSt4tStb8Cs76kYunGrP32F0tHOzGTESeLECi NrZWcODcIbbc1km6aF4P12LWHhX1Dhlnftztcgaj43H4rvcK1Q8J3os1QKr7kBzA18xhS7Y47B49 zQY8YlrBhaIauBVrur7K69YgC9kSTM2Mmel4sJNbYTYAW0DFxC2Hbqv0bFKbcgryMUcwSewbqqad sIB8z9mR8gxa3OESMDWWByCxZbMc9BhgsSoMoYmbtYDkgysH7diG4kjbwGLhGs+k4AzQn+7VQRyl N03VBHeYmoJZNAH3RFHbejximoG5ssaEJJszxMXNcTiqBuNndSZPpurBqTCDz3HrTB4CW5F341on 8sUqSUXZHd6rNQfejOcgScAgIMlQu0W9NrSWOZoDYm3uu0ILKQK1q95UCnFmGJWsN/3oFEoChiTR Cri2sHQJ8yw0t3aodzeeA4xVNuhIw83JMSsTwUEPSFRuQClyP+HZue2SmnEBnFE3E84R2AoLXp1C j5BrPgg5M6pmb3TE3VVwOG2yXcEBDHyQRMgG1hahbuCdk47kuutAOsqGi3bv0PV6sDDUGFOGJlbp NNI77FG05hEsVwmNhCshK1XoUMEaDNwOxg1CBlUP34EYpCHDohKka+OdxlBADyav3dEh00TkoYIC Xg/YSwkAgJD1itBKSApeoyFRCruTL45vE7Ve4mHmfQRGo2x+JW/1pinvPRpaa/G4O3c/GNnhYMQi VDPQXws6j9yNQlmC0Ohrk2/Oo+n7iYbAh+kUxc0NVMIQAnrSKhPHbo7Qat7cgFbYBFvqflgpPDlh n/cFxWF8wme2HsHzGjhEO9ymEO0ICXkbkJjyXHd0isQNyMS2TShAMjBjxKwKpBSyXWEeXSRJqDgz aAUD/qRilxyJZSb+L8d84/29/cuvdvmH8te//3Q83VdVHMkkVhjKzI2RbHbfKcpdqyNoA3dcY948 sTnUSi1r4Nr2m4GgVQKRoBludtiY7Jhd2gZjE740CGSWGh3pvuGMzeYK2J2Bd9aaD4rnrtFnvW4o GK/ABoYYWKeOZUDNYKRoiyofRMkaBMtB4ApTeAJYmhWrKSVMRqiChHOpkWGt1tUOsMrI+8EdzAsU h2KOooFaiLW6HYboAvwGngqK9Fwm0Kh5hbmkmw2Rx2xR+w2DXzoGKswPfotorfs6nT9oZlokyM44 2OIOS3Y8gpG2vRDFjh1NYwvaBswaG+iZ5Ab4eNIVd2tvYAyR21WSBr4w5pBLoWZ7wfLQncP2V3YY Yi1h0JCjtGMM7VAfehGaeAkauerkfIeZDTwRrEdAYor1R+SuY87E3IfJNKh4CJxvIOlsXaJDZFE2 tOfeMQZpuA9cJyR90OxwKDYiJloMqV1gDNVroNRhqMfwe3CmnU8vv4WWx/PT8/FT5OXnE341fDo/ PL969eo/UEsBAhQAFAAAAAgAhF6+LqBczBLKCAAAmg0AAAYAAAAAAAAAAQAgAAAAAAAAAHNuLnR4 dFBLBQYAAAAAAQABADQAAADuCAAAAAA= --=====000_Dragon303642860140_=====-- Content-Length: 0 Regards, rootlinux --- Jordi <[EMAIL PROTECTED]> wrote: > Hi all, > > I have a RH9 with qmail installed and working. I > installed qmail-scanner 1.16 and sophos antivirus, > all seems to work, except that any message is > stopped. > Im working with virtual domains...maybe here is the > problem... > Any idea?? > > This is one example of the qmail-quee.log generated > by test_installation script: > > 30/06/2003 10:21:49:2655: +++ starting debugging for > process 2655 by uid=0 at 30/06/2003 10:21:49 > 30/06/2003 10:21:49:2655: setting UID to EUID so > subprocesses can access files generated by this > script > 30/06/2003 10:21:49:2655: program name is > qmail-scanner-queue.pl, version 1.16 > 30/06/2003 10:21:49:2655: incoming pipe connection > from via local process 2655 > 30/06/2003 10:21:49:2655: w_c: mkdir > /var/spool/qmailscan/linux.es10569613094262655 > 30/06/2003 10:21:49:2655: w_c: start dumping > incoming msg into > /var/spool/qmailscan/working/tmp/linux.es10569613094262655 > [1056961309.19$ > 30/06/2003 10:21:49:2655: w_c: illegal breakage > found in header name - potential virus > 30/06/2003 10:21:49:2655: w_c: illegal breakage > found in header name - potential virus > 30/06/2003 10:21:49:2655: w_c: illegal breakage > found in header name - potential virus > 30/06/2003 10:21:49:2655: w_c: illegal breakage > found in header name - potential virus > 30/06/2003 10:21:49:2655: w_c: illegal breakage > found in header name - potential virus > 30/06/2003 10:21:49:2655: w_c: illegal breakage > found in header name - potential virus > 30/06/2003 10:21:49:2655: w_c: illegal breakage > found in header name - potential virus > 30/06/2003 10:21:49:2655: w_c: illegal breakage > found in header name - potential virus > 30/06/2003 10:21:49:2655: w_c: illegal breakage > found in header name - potential virus > 30/06/2003 10:21:49:2655: w_c: illegal breakage > found in header name - potential virus > 30/06/2003 10:21:49:2655: w_c: rename new msg from > /var/spool/qmailscan/working/tmp/linux.es10569613094262655 > to /var/spool/qmailscan/wo$ > 30/06/2003 10:21:49:2655: d_m: starting > /usr/local/bin/reformime > -x/var/spool/qmailscan/linux.es10569613094262655/ > </var/spool/qmailsca$ > 30/06/2003 10:21:49:2655: d_m: finished > /usr/local/bin/reformime > -x/var/spool/qmailscan/linux.es10569613094262655/ > [1056961309.23068] > 30/06/2003 10:21:49:2655: d_m: Checking all > attachments to see if they're MS-TNEF > 30/06/2003 10:21:49:2655: d_m: is > /var/spool/qmailscan/linux.es10569613094262655/Eicar.com > is a TNEF file?: 256 [1056961309.24348] > 30/06/2003 10:21:49:2655: d_m: Manually unpack any > zip files as some virus scanners don't do zip under > Unix! > 30/06/2003 10:21:49:2655: d_m: unpacking message > took 0.041842 seconds > 30/06/2003 10:21:49:2655: unsetting QMAILQUEUE env > var > 30/06/2003 10:21:49:2655: g_e_h: return-path is "", > recips is [EMAIL PROTECTED] > 30/06/2003 10:21:49:2655: from=,subj=, > x-qmail-scanner-message-id= via local process 2655 > 30/06/2003 10:21:49:2655: ini_sc: start scanning > 30/06/2003 10:21:49:2655: p_s: starting scan of > directory > "/var/spool/qmailscan/linux.es10569613094262655"... > 30/06/2003 10:21:49:2655: p_s: '81:ILOVEYOU' = > 'Virus-subject' = 'Love Letter Virus/Trojan' > 30/06/2003 10:21:49:2655: p_s: type is a header! > 30/06/2003 10:21:49:2655: p_s: checking for objects > containing subject: ILOVEYOU > > . > > . > > . > 30/06/2003 10:21:49:2655: ini_sc: recursively scan > the directory > /var/spool/qmailscan/linux.es10569613094262655/ > 30/06/2003 10:21:49:2655: scanloop: starting scan of > directory > "/var/spool/qmailscan/linux.es10569613094262655"... > 30/06/2003 10:21:49:2655: sweep: starting scan of > directory > "/var/spool/qmailscan/linux.es10569613094262655"... > 30/06/2003 10:21:49:2655: run /usr/local/bin/sweep > -f -all -eec -sc -nc -ss -nb -archive > /var/spool/qmailscan/linux.es1056961309426265$ > 30/06/2003 10:21:49:2655: --output of sophos sweep > was: > -- > 30/06/2003 10:21:49:2655: sweep: finished scan of > dir > "/var/spool/qmailscan/linux.sirt.es10569613094262655" > in 2.658694 secs > 30/06/2003 10:21:49:2655: scanloop: finished scan of > "/var/spool/qmailscan/linux.sirt.es10569613094262655"... > 30/06/2003 10:21:49:2655: ini_sc: scanning message > took 2.674565 seconds > 30/06/2003 10:21:49:2655: q_r: fork off child into > /var/qmail/bin/qmail-queue... > 30/06/2003 10:21:49:2655: qmail-scanner[2655]: > Clear: 2.735976 935 <> [EMAIL PROTECTED] <> > <> <> > 30/06/2003 10:21:49:2655: cleanup: /bin/rm -rf > /var/spool/qmailscan/linux.es10569613094262655/ > /var/spool/qmailscan/working/new/linux.$ > 30/06/2003 10:21:52:2655: all finished. Total of > 2.825985 secs > > __________________________________ Do you Yahoo!? SBC Yahoo! DSL - Now only $29.95 per month! http://sbc.yahoo.com ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01 _______________________________________________ Qmail-scanner-general mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
