[Mimedefang] Emcoding/Decoding Problem?

[Chris Masters]

Hi All,

We have problems with some of our virus scanners
(particularly f-prot and Symantec CSS) but we don't
think it is the virus scanners themselves.

With the f-prot issue, f-prot causes a scan error and
the mail is tempfail'ed. F-prot processes accumulate
in the process list list taking up many CPU cycles.

With the SCSS issue, we've changed the Symantec filter
code to remove the problem attachment because there
are so many (Error: Unexpected response to AVSCAN or
AVSCANLOCAL command: 538 Malformed container file
found. - File not scanned).

Now, we've managed to get hold of a mail that caused
the f-prot problem and send it to ourselves. They
contain various parts and attachments - so it's not a
corrupt application/ms* problem (as we have also had).
We've also manually tested these parts/attachments and
they scan without error so we don't necessarily think
this is a virus scanner issue *always*.

Another important point is that the f-prot problem
always occurs between one particular domain and
another.

Another is that they appear as '8BITMIME' in the mail
queue (using mailq command).

So, we're thinking that this must be some kind of
client encoding(Notes)/MIMEDefang decoding issue. I've
attached the full headers of a mail between the two
domains that hopefully gives enough imformation about
the problem.

Can anyone suggest why this is happening?

Can anyone point us towards the next debugging step?

Could the CSS and f-prot issues be related?

Any help/advice on this would be appreciated.

Cheers, Chris


	
		
__________________________________
Do you Yahoo!?
Yahoo! Tax Center - File online by April 15th
http://taxes.yahoo.com/filing.html
-------------- next part --------------
Microsoft Mail Internet Headers Version 2.0
Received: from end-server.net ([xx.xx.xx.xx]) by mail-server.net with Microsoft SMTPSVC(6.0.3790.0);
	 Wed, 14 Apr 2004 09:56:25 +0100
Received: from mail-server.com (mail.com [xx.xx.xx.xx])
        by end-server.net with ESMTP id i3CKKEod007034
        for <user at domain.com>; Mon, 12 Apr 2004 20:20:14 GMT
pgSenderHost: start-server.com [xx.xx.xx.xx]
Received: from start-server.com (start-server.com [xx.xx.xx.xx])
	by etsn1007.eu.pg.com (8.8.8/Switch-3.1.0) with ESMTP id i3CKKB79011517
	for <user at domain.com>; Mon, 12 Apr 2004 22:20:12 +0200 (MEST)
To: user1 at domain.com
Cc: user2 at domain.com, user2 at domain.com, user3 at domain.com, user at domain.com
Subject: Statement in backgournders
MIME-Version: 1.0
X-Mailer: Lotus Notes Release 5.0.10  March 22, 2002
From: user at ext-domain.com
Message-ID: <OF9B8AC628.C57C0115-ON85256E74.006F7820-85256E74.006FB486 at domain.com>
Date: Mon, 12 Apr 2004 16:20:07 -0400
X-MIMETrack: Serialize by Router on MAIL_SERVER.COM/XXX(Release 5.0.3 (Intl)|21
 March 2000) at 04/12/2004 04:20:13 PM
Content-Type: multipart/mixed; boundary="=_mixed 006FB44885256E74_="
Return-Path: user at ext-domain.com
X-OriginalArrivalTime: 14 Apr 2004 08:56:25.0135 (UTC) FILETIME=[5DBDDBF0:01C421FE]

--=_mixed 006FB44885256E74_=
Content-Type: multipart/related; boundary="=_related 006FB44885256E74_="

--=_related 006FB44885256E74_=
Content-Type: multipart/alternative; boundary="=_alternative 006FB44885256E74_="

--=_alternative 006FB44885256E74_=
Content-Type: text/plain; charset="us-ascii"

--=_alternative 006FB44885256E74_=
Content-Type: text/html; charset="us-ascii"


--=_alternative 006FB44885256E74_=--
--=_related 006FB44885256E74_=
Content-Type: image/gif
Content-ID: <_1_14BC00004FE0006FB44885256E74>
Content-Transfer-Encoding: base64

--=_related 006FB44885256E74_=
Content-Type: image/gif
Content-ID: <_1_0AAC00005C68006FB44885256E74>
Content-Transfer-Encoding: base64

--=_related 006FB44885256E74_=
Content-Type: image/gif
Content-ID: <_1_10B000005CD0006FB44885256E74>
Content-Transfer-Encoding: base64


--=_related 006FB44885256E74_=--
--=_mixed 006FB44885256E74_=
Content-Type: text/html; name="att1.htm"
Content-Disposition: attachment; filename="att1.htm"
Content-Transfer-Encoding: quoted-printable

--=_mixed 006FB44885256E74_=
Content-Type: image/gif; name="image001.gif"
Content-Disposition: attachment; filename="image001.gif"
Content-Transfer-Encoding: base64


--=_mixed 006FB44885256E74_=--