Hi All, I am having a weird problem where amavis is loosing the from address. Here is a short sample from my syslog.
Jun 21 11:00:14 porky amavis[6658]: Checking: /usr/../var/lib/amavis/amavis-XXFackUr: from=<[EMAIL PROTECTED]>, to=<[EMAIL PROTECTED]> Jun 21 11:00:15 porky amavis[6658]: infected (I-Worm.Klez.h), from=<?@tazdevil.cnl.com.au>, to=<[EMAIL PROTECTED]>, quarantine virus-20020621-110015-6658 See how the from address changed from [EMAIL PROTECTED] to ?@tazdevil.cnl.com.au (tazdevil being the PC that sent the mail). Is anyone else successfully using the amavis-exim package? (Complete syslog entry is below for those interested) Andrew Tait System Administrator Country NetLink Pty, Ltd E-Mail: [EMAIL PROTECTED] WWW: http://www.cnl.com.au 30 Bank St Cobram, VIC 3644, Australia Ph: +61 (03) 58 711 000 Fax: +61 (03) 58 711 874 "It's the smell! If there is such a thing." Agent Smith - The Matrix Jun 21 11:00:14 porky amavis[6658]: /usr/../var/lib/amavis/amavis-XXFackUr: from=<[EMAIL PROTECTED]>, to=<[EMAIL PROTECTED]> Jun 21 11:00:14 porky amavis[6658]: Checking: /usr/../var/lib/amavis/amavis-XXFackUr: from=<[EMAIL PROTECTED]>, to=<[EMAIL PROTECTED]> Jun 21 11:00:14 porky amavis[6658]: Extracting mime components Jun 21 11:00:14 porky amavis[6658]: decode_parts: part-00001, part-00002 Jun 21 11:00:14 porky amavis[6658]: Level: 1, parts: 2 Jun 21 11:00:14 porky amavis[6658]: Archive nesting depth: 0 Jun 21 11:00:14 porky amavis[6658]: File-type of part-00001: PCX image data, version 2.5 Jun 21 11:00:14 porky amavis[6658]: part-00001 is atomic Jun 21 11:00:14 porky amavis[6658]: File-type of part-00002: MS-DOS executable (EXE), OS/2 or MS Windows Jun 21 11:00:14 porky amavis[6658]: Check whether part-00002 is a self-extracting archive Jun 21 11:00:14 porky amavis[6658]: unrar 't' returned status 1 (signal 0), command: /usr/share/amavis/unrar Jun 21 11:00:14 porky amavis[6658]: Expanding RAR archive part-00002 Jun 21 11:00:14 porky amavis[6658]: part-00002 is executable Jun 21 11:00:14 porky amavis[6658]: Level: 2, parts: 2 Jun 21 11:00:14 porky amavis[6658]: Archive nesting depth: 1 Jun 21 11:00:14 porky amavis[6658]: Using /opt/AVP/kavscanner Jun 21 11:00:15 porky amavis[6658]: +-------------------------------------------------------+^M | Kaspersky Anti-Virus for Linux |^M | Copyright(C) Kaspersky Lab. 1998-2002 |^M | Version 4.0.1.0 |^M | |^M +-------------------------------------------------------+^M Registration info: ^M Key name Ser. number Price pos. Exp. date Trial 0003C4DB.key 011e-0003fb-0003c4db Kaspersky Anti-Vi... 17.6.2003 No ^M ^MAntiviral databases have been loaded. Known records: 55668. I cannot open report file /var/log/kavscan.rpt. Current object:^I/usr/../var/lib/amavis/amavis-XXFackUr/parts You will not be able to read the information about /dev/hda2 device. ^M/var/lib/amavis/amavis-XXFackUr/parts/part-00002 infected: I-Worm.Klez.h File /var/lib/amavis/amavis-XXFackUr/parts/part-00002 Infected by virus: I-Worm.Klez.h Actions Jun 21 11:00:15 porky amavis[6658]: infected (I-Worm.Klez.h), from=<?@tazdevil.cnl.com.au>, to=<[EMAIL PROTECTED]>, quarantine virus-20020621-110015-6658 Jun 21 11:00:15 porky amavis[6658]: mail_via_pipe: <postmaster> -> <[EMAIL PROTECTED]> Jun 21 11:00:15 porky amavis[6658]: mail_via_pipe: <postmaster> -> <[EMAIL PROTECTED]> Jun 21 11:00:15 porky amavis[6658]: mail checking ended: DISCARD -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]