[Mimedefang] Emcoding/Decoding Problem?

[Chris Masters]

Hi All,

We have problems with some of our virus scanners
(particularly f-prot and Symantec CSS) but we don't
think it is the virus scanners themselves.

With the f-prot issue, f-prot causes a scan error and
the mail is tempfail'ed. F-prot processes accumulate
in the process list list taking up many CPU cycles.

With the SCSS issue, we've changed the Symantec filter
code to remove the problem attachment because there
are so many (Error: Unexpected response to AVSCAN or
AVSCANLOCAL command: 538 Malformed container file
found. - File not scanned).

Now, we've managed to get hold of a mail that caused
the f-prot problem and send it to ourselves. They
contain various parts and attachments - so it's not a
corrupt application/ms* problem (as we have also had).
We've also manually tested these parts/attachments and
they scan without error so we don't necessarily think
this is a virus scanner issue *always*.

Another important point is that the f-prot problem
always occurs between one particular domain and
another.

Another is that they appear as '8BITMIME' in the mail
queue (using mailq command).

So, we're thinking that this must be some kind of
client encoding(Notes)/MIMEDefang decoding issue. I've
attached the full headers of a mail between the two
domains that hopefully gives enough imformation about
the problem.

Can anyone suggest why this is happening?

Can anyone point us towards the next debugging step?

Could the CSS and f-prot issues be related?

Any help/advice on this would be appreciated.

Cheers, Chris


	
		
__________________________________
Do you Yahoo!?
Yahoo! Tax Center - File online by April 15th
http://taxes.yahoo.com/filing.html
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: f-prot-headers.txt
URL: <https://lists.mimedefang.org/pipermail/mimedefang_lists.mimedefang.org/attachments/20040415/ab7a9eab/attachment.txt>