- 论坛徽章:
- 0
|
qmailscanner 1。2 ,什么都认为是病毒,全部退信。欢迎讨论
Wed, 19 May 2004 16:59:47 +0800:19203: +++ starting debugging for process 19203 by uid=0 at Wed, 19 May 2004 16:59:47 +0800
Wed, 19 May 2004 16:59:47 +0800:19203: setting UID to EUID so subprocesses can access files generated by this script
Wed, 19 May 2004 16:59:47 +0800:19203: program name is qmail-scanner-queue.pl, version 1.21
Wed, 19 May 2004 16:59:47 +0800:19203: incoming SMTP connection from via SMTP from 192.168.0.145
Wed, 19 May 2004 16:59:47 +0800:19203: w_c: mkdir /var/spool/qmailscan/tmp/mailserver108495718747019203
Wed, 19 May 2004 16:59:47 +0800:19203: w_c: start dumping incoming msg into /var/spool/qmailscan/working/tmp/mailserver108495718747019203 [1084957187.59966]
Wed, 19 May 2004 16:59:47 +0800:19203: w_c: disallowed breakage found in header name ( by 0 with SMTP; 19 May 2004 08:59:47 -0000
) - potential virus
Wed, 19 May 2004 16:59:47 +0800:19203: w_c: rename new msg from /var/spool/qmailscan/working/tmp/mailserver108495718747019203 to /var/spool/qmailscan/working/new/mailserver108495718747019203 [1084957187.68547]
Wed, 19 May 2004 16:59:47 +0800:19203: d_m: starting /usr/local/bin/reformime -x/var/spool/qmailscan/tmp/mailserver108495718747019203/ </var/spool/qmailscan/working/new/mailserver108495718747019203 [1084957187.68608]
Wed, 19 May 2004 16:59:47 +0800:19203: d_m: finished /usr/local/bin/reformime -x/var/spool/qmailscan/tmp/mailserver108495718747019203/ [1084957187.69629]
Wed, 19 May 2004 16:59:47 +0800:19203: d_m: Checking all attachments to see if they're MS-TNEF
Wed, 19 May 2004 16:59:47 +0800:19203: d_m: is /var/spool/qmailscan/tmp/mailserver108495718747019203/1084957187.19205-0.mailserver is a TNEF file?: 256 [1084957187.70143]
Wed, 19 May 2004 16:59:47 +0800:19203: d_m: unpacking message took 0.015678 seconds
Wed, 19 May 2004 16:59:47 +0800:19203: unsetting QMAILQUEUE env var
Wed, 19 May 2004 16:59:47 +0800:19203: g_e_h: return-path is "liubin@proc.com.cn", recips is "halu@proc.com.cn"
Wed, 19 May 2004 16:59:47 +0800:19203: from=,subj=, x-qmail-scanner-message-id=<108495718766119203@mailserver>; via SMTP from 192.168.0.145
Wed, 19 May 2004 16:59:47 +0800:19203: This is a PLAIN text message (because it's either not mime, or is text/plain), skip virus scanners - but not SA
Wed, 19 May 2004 16:59:47 +0800:19203: ini_sc: start scanning
Wed, 19 May 2004 16:59:47 +0800:19203: ini_sc: recursively scan the directory /var/spool/qmailscan/tmp/mailserver108495718747019203/
Wed, 19 May 2004 16:59:47 +0800:19203: scanloop: starting scan of directory "/var/spool/qmailscan/tmp/mailserver108495718747019203"...
Wed, 19 May 2004 16:59:47 +0800:19203: scanloop: finished scan of "/var/spool/qmailscan/tmp/mailserver108495718747019203"...
Wed, 19 May 2004 16:59:47 +0800:19203: ini_sc: scanning message took 0.000231 seconds
Wed, 19 May 2004 16:59:47 +0800:19203: unsetting TCPREMOTEIP env var
Wed, 19 May 2004 16:59:47 +0800:19203: e_v_r: quarantine msg to /var/spool/qmailscan/quarantine/new/mailserver108495718747019203
Wed, 19 May 2004 16:59:47 +0800:19203: e_s: sending policy quarantine report via: /var/qmail/bin/qmail-inject to psender address (liubin@proc.com.cn)
Wed, 19 May 2004 16:59:47 +0800:19203: e_s: sending policy quarantine report via: /var/qmail/bin/qmail-inject to admin address (virusadmin@proc.com.cn)
Wed, 19 May 2004 16:59:47 +0800:19203: w_v_r: writing quarantine log report of: Wed, 19 May 2004 16:59:47 +0800 liubin@proc.com.cn halu@proc.com.cn Disallowed breakage found in header name - potential virus
Wed, 19 May 2004 16:59:47 +0800:19203: e_v_r: email_quarantine_report took 0.053107 seconds to execute
Wed, 19 May 2004 16:59:47 +0800:19203: cleanup: /bin/rm -rf /var/spool/qmailscan/tmp/mailserver108495718747019203/ /var/spool/qmailscan/working/new/mailserver108495718747019203
19/05/2004 16:59:47:19203: all finished. Total of 0.164012 secs |
|