我的QMAIL服务怎么不能过滤病毒邮件了呀

andywyz

想了一想，要是真的不是clamav的关系，那用clamdscan命令查/var/spool/qmailscan/quarantine/new/sooormail.localdomain108952081947912173这个病毒邮件怎么会查不到病毒呢？大哥你说应该能查到还有查不到呀？

gugong

你发送到我的另一个试一试：

postmaster AT szgalaxy.com.cn

gugong

[quote]原帖由 "andywyz"]想了一想，要是真的不是clamav的关系，那用clamdscan命令查/var/spool/qmailscan/quarantine/new/sooormail.localdomain108952081947912173这个病毒邮件怎么会查不到病毒呢？大哥你说应该能查到还有查不到呀？[/quote 发表：



没测试过阿，你加个参数试一试：

--mbox

andywyz

哦，查到了！谢谢，但在邮件过滤的时候为什么不行呢？那现在应该可以确定不是clamscan的问题的(顺便问一下，改中毒提醒邮件的内容是改哪个文件呀！？)

gugong

安装 qmail-scanner 时，可以看到选项阿。

不如重装 qmail-scanner 吧。

andywyz

哎，重装还是不行呀，下面是qmail-queue.log的一段日志，请帮我看一下，好象有什么错误，比如Wed, 14 Jul 2004 14:51:07 CST:2901: --output of clamscan was:
LibClamAV Error: readdb(): Malformed pattern line 802这行是什么意思呀：哎领导天天收到病毒，被骂死了
Wed, 14 Jul 2004 14:51:05 CST:2901: +++ starting debugging for process 2901 by uid=0
Wed, 14 Jul 2004 14:51:05 CST:2901: setting UID to EUID so subprocesses can access files generated by this script
Wed, 14 Jul 2004 14:51:05 CST:2901: program name is qmail-scanner-queue.pl, version 1.22
Wed, 14 Jul 2004 14:51:05 CST:2901: incoming SMTP connection from via SMTP from 61.153.207.123
Wed, 14 Jul 2004 14:51:05 CST:2901: w_c: mkdir /var/spool/qmailscan/tmp/asdmail.localdomain10897878654792901
Wed, 14 Jul 2004 14:51:05 CST:2901: w_c: primary Content-Type of multipart/mixed found
Wed, 14 Jul 2004 14:51:06 CST:2901: w_c: rename new msg from /var/spool/qmailscan/working/tmp/asdmail.localdomain10897878654792901
to /var/spool/qmailscan/working/new/asdmail.localdomain10897878654792901 [1089787866.94416]
Wed, 14 Jul 2004 14:51:06 CST:2901: d_m: starting /usr/local/bin/reformime  -x/var/spool/qmailscan/tmp/asdmail.localdomain10897878
654792901/ </var/spool/qmailscan/working/new/asdmail.localdomain10897878654792901 [1089787866.94444]
Wed, 14 Jul 2004 14:51:07 CST:2901: d_m: finished /usr/local/bin/reformime  -x/var/spool/qmailscan/tmp/asdmail.localdomain10897878
654792901/ [1089787867.15444]
Wed, 14 Jul 2004 14:51:07 CST:2901: d_m: Check for zip files...
Wed, 14 Jul 2004 14:51:07 CST:2901: d_m: unpacking message took 0.210323 seconds
Wed, 14 Jul 2004 14:51:07 CST:2901: unsetting QMAILQUEUE env var
Wed, 14 Jul 2004 14:51:07 CST:2901: g_e_h: return-path is "leiaj@asd.net", recips is "piqm@asd.net"
Wed, 14 Jul 2004 14:51:07 CST:2901: from="leiaj" <leiaj@asd.net>;,subj=, x-qmail-scanner-message-id=<10897878656722901@asdmail.lo
caldomain>; via SMTP from 61.153.207.123
Wed, 14 Jul 2004 14:51:07 CST:2901: ini_sc: start scanning
Wed, 14 Jul 2004 14:51:07 CST:2901: ini_sc: recursively scan the directory /var/spool/qmailscan/tmp/asdmail.localdomain10897878654
792901/
Wed, 14 Jul 2004 14:51:07 CST:2901: scanloop: starting scan of directory "/var/spool/qmailscan/tmp/asdmail.localdomain108978786547
92901"...
Wed, 14 Jul 2004 14:51:07 CST:2901: scanloop: scanner=clamscan_scanner,plain_text_msg=0
Wed, 14 Jul 2004 14:51:07 CST:2901: clamscan: starting scan of directory "/var/spool/qmailscan/tmp/asdmail.localdomain108978786547
92901"...
Wed, 14 Jul 2004 14:51:07 CST:2901: run /usr/local/bin/clamscan -r --mbox -m --unzip --unrar --unzoo --lha --disable-summary --max-r
ecursion=10 --max-space=1000000  /var/spool/qmailscan/tmp/asdmail.localdomain10897878654792901 2>;&1
Wed, 14 Jul 2004 14:51:07 CST:2901: --output of clamscan was:
LibClamAV Error: readdb(): Malformed pattern line 802 (file /var/spool/qmailscan/tmp/asdmail.localdomain10897878654792901/clamav-4
a6aac5207c165b7/viruses.db2).
LibClamAV Error: cli_calloc(): Can't allocate memory (8 bytes).
--
Wed, 14 Jul 2004 14:51:07 CST:2901: clamscan: finished scan of dir "/var/spool/qmailscan/tmp/asdmail.localdomain10897878654792901"
in 0.340437 secs
Wed, 14 Jul 2004 14:51:07 CST:2901: scanloop: finished scan of "/var/spool/qmailscan/tmp/asdmail.localdomain10897878654792901"...
Wed, 14 Jul 2004 14:51:07 CST:2901: p_s: starting scan of directory "/var/spool/qmailscan/tmp/asdmail.localdomain10897878654792901
"...
Wed, 14 Jul 2004 14:51:07 CST:2901: p_s:  '81:ILOVEYOU' = 'Virus-subject' = 'Love Letter Virus/Trojan'
Wed, 14 Jul 2004 14:51:07 CST:2901: p_s:  type is a header!
Wed, 14 Jul 2004 14:51:07 CST:2901: p_s:  checking for objects containing subject: ILOVEYOU
Wed, 14 Jul 2004 14:51:07 CST:2901: p_s:  '82:message/partial.*' = 'Virus-content-type' = 'Message/partial MIME attachments blocked
by policy'
Wed, 14 Jul 2004 14:51:07 CST:2901: p_s:  type is a header!
Wed, 14 Jul 2004 14:51:07 CST:2901: p_s:  checking for objects containing content-type: message/partial.*
Wed, 14 Jul 2004 14:51:07 CST:2901: p_s:  '85:.{100,}' = 'Virus-date' = 'MIME Header Buffer Overflow'
Wed, 14 Jul 2004 14:51:07 CST:2901: p_s:  type is a header!
Wed, 14 Jul 2004 14:51:07 CST:2901: p_s:  checking for objects containing date: .{100,}
Wed, 14 Jul 2004 14:51:07 CST:2901: p_s:  '86:.{100,}' = 'Virus-mime-version' = 'MIME Header Buffer Overflow '
Wed, 14 Jul 2004 14:51:07 CST:2901: p_s:  type is a header!
Wed, 14 Jul 2004 14:51:07 CST:2901: p_s:  checking for objects containing mime-version: .{100,}
Wed, 14 Jul 2004 14:51:07 CST:2901: p_s:  '87:.{100,}' = 'Virus-resent-date' = 'MIME Header Buffer Overflow'
Wed, 14 Jul 2004 14:51:07 CST:2901: p_s:  type is a header!

austinfay

应该说的信件头的格式不对，前面也说明了，估计是病毒，但由于不合法的信件头所以才没报告吧

andywyz

哦，是呀，怎么会说信头不对呢？现在是所有的邮件都这样的呀，一部分的病毒过滤不掉一部分它只说可能是病毒被隔离了，嗯会有什么原因出来这个错误呢，邮件服务器根本没有改过呀，就是在7月5日下午突然不行了！

znavy

原帖由 "gugong" 发表：



没测试过阿，你加个参数试一试：

--mbox

加到哪里，请指教，我怎么设定就是不行。
邮件头中又有
by uid 89 with qmail-scanner-1.22
(clamscan: 0.74. spamassassin: 2.63.  Clear:RC:1(127.0.0.1):SA:0(0.0/5.0）
这个提示。

gugong

LibClamAV Error: cli_calloc(): Can't allocate memory (8 bytes).