Hello,
I have the same type problem as Mauro Marcon : > From: Mauro Marcon <[EMAIL PROTECTED]> > Re: Some limitation? > 2004-05-27 01:25 > May 27 10:08:18 gsmMAIL MailScanner[12641]: Using locktype = flock > May 27 10:08:21 gsmMAIL MailScanner[12654]: MailScanner E-Mail Virus > Scanner version 4.29.7 starting...
And I can reproduce it with a specific spam...
The Spam :
> Received: (qmail 6940 invoked by uid 503); 30 May 2004 10:20:42 -0000
> Received: from unknown (HELO ts32-a66.Moscow.dial.rol.ru) (195.239.1.66)
> by vanoise.decaen.net with SMTP; 30 May 2004 10:20:42 -0000
> Received: from 254.104.51.148 by 195.239.1.66 Sun, 30 May 2004 12:11:30 +0100
> Message-ID: <[EMAIL PROTECTED]>
> From: " Landry" <[EMAIL PROTECTED]>
> Reply-To: " Landry" <[EMAIL PROTECTED]>
> To: [EMAIL PROTECTED]
> Subject: hi
> Date: Sun, 30 May 2004 14:17:30 +0300
> X-Mailer:
> -:
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> boundary="--272740491438473184"
> [ Priority: Normal > ]
>
> ----272740491438473184
> Content-Type: text/html;
> Content-Encoding: NUM
>
> </x-html>
> <p align="center">
> <font color="FFFFFF">
>
>
>
>
> <font color="000000">
> <br>
> Hey, my name is Jennie and I'm new to this online dating thing.
> I've checked out your profile you put up and it's interesting. =P I just
> want to get to know you a little better if you don't mind, come check my
> profile out at:
> <br><br>
> <b>www.LOLJEN.com/jen.html</b>
> <br><br>
> I also got a videocam so we can make it interesting, anyways I hope you get
> back to me soon!
> <br><br>
> bye :)
> <br>
> <br>
> <font color="FFFFFF">
> nobyyapksdpyqrvzqpblcddevp<br>
> uidsbtsocokwxxvoqyroucuwtsmds<br>
> tplnkxesnkeapjotqmyplkkrwu<br>
> moqnrrdehbtmuogshkhftptibce<br>
> zkqmpdpudfmwdgnbqsdj<br>
> ugfiqqzgvsswlgijndvjsldjk<br>
> drmqzmzxlgcascfpahielukyyumfxs<br>
> xqllorjecajiztskhlinovgfohap<br>
> uyioghkmkkifmwnosbznlavmrkt<br>
> snjqlcvgomclwtwbattvw<br>
> oszvimsqhjuzktxxrozcd<br>
> fhiggncnxtgoyjeasppho<br>
> mthcsccbgxlevzlmksspn<br>
> wsjrnwwovegbmdwxojwq<br>
> qlyfcapftjtrbdxrzemfbfvuwmz<br>
> </x-html>2
>
> ----272740491438473184--
The strace log :
stat64("/var/qmail/queue.in/mess/4/205463", {st_mode=S_IFREG|0644, st_size=2045, ...})
= 0
read(59, "[EMAIL PROTECTED]"..., 4096) = 56
read(59, "", 4096) = 0
read(58, "Received: (qmail 6940 invoked by"..., 4096) = 2045
stat64("/usr/sbin/Carp/Heavy.pmc", 0xbfffe5e0) = -1 ENOENT (No such file or directory)
open("/usr/sbin/Carp/Heavy.pm", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or
directory)
stat64("/usr/sbin/MailScanner/Carp/Heavy.pmc", 0xbfffe5e0) = -1 ENOTDIR (Not a
directory)
open("/usr/sbin/MailScanner/Carp/Heavy.pm", O_RDONLY|O_LARGEFILE) = -1 ENOTDIR (Not a
directory)
stat64("/usr/lib/MailScanner/5.8.3/i386-linux-thread-multi/Carp/Heavy.pmc",
0xbfffe5e0) = -1 ENOENT (No such file or directory)
open("/usr/lib/MailScanner/5.8.3/i386-linux-thread-multi/Carp/Heavy.pm",
O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory)
stat64("/usr/lib/MailScanner/5.8.3/Carp/Heavy.pmc", 0xbfffe5e0) = -1 ENOENT (No such
file or directory)
open("/usr/lib/MailScanner/5.8.3/Carp/Heavy.pm", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No
such file or directory)
stat64("/usr/lib/MailScanner/i386-linux-thread-multi/Carp/Heavy.pmc", 0xbfffe5e0) = -1
ENOENT (No such file or directory)
open("/usr/lib/MailScanner/i386-linux-thread-multi/Carp/Heavy.pm",
O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory)
stat64("/usr/lib/MailScanner/5.8.2/Carp/Heavy.pmc", 0xbfffe5e0) = -1 ENOENT (No such
file or directory)
open("/usr/lib/MailScanner/5.8.2/Carp/Heavy.pm", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No
such file or directory)
stat64("/usr/lib/MailScanner/5.8.1/Carp/Heavy.pmc", 0xbfffe5e0) = -1 ENOENT (No such
file or directory)
open("/usr/lib/MailScanner/5.8.1/Carp/Heavy.pm", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No
such file or directory)
stat64("/usr/lib/MailScanner/5.8.0/Carp/Heavy.pmc", 0xbfffe5e0) = -1 ENOENT (No such
file or directory)
open("/usr/lib/MailScanner/5.8.0/Carp/Heavy.pm", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No
such file or directory)
stat64("/usr/lib/MailScanner/Carp/Heavy.pmc", 0xbfffe5e0) = -1 ENOENT (No such file or
directory)
open("/usr/lib/MailScanner/Carp/Heavy.pm", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such
file or directory)
stat64("/usr/lib/perl5/5.8.3/i386-linux-thread-multi/Carp/Heavy.pmc", 0xbfffe5e0) = -1
ENOENT (No such file or directory)
open("/usr/lib/perl5/5.8.3/i386-linux-thread-multi/Carp/Heavy.pm",
O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory)
stat64("/usr/lib/perl5/5.8.3/Carp/Heavy.pmc", 0xbfffe5e0) = -1 ENOENT (No such file or
directory)
open("/usr/lib/perl5/5.8.3/Carp/Heavy.pm", O_RDONLY|O_LARGEFILE) = 60
ioctl(60, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfffe3ec) = -1 ENOTTY (Inappropriate ioctl
for device)
_llseek(60, 0, [0], SEEK_CUR) = 0
read(60, "# Carp::Heavy uses some variable"..., 4096) = 4096
read(60, ";\n my $caller = caller($i);\n "..., 4096) = 1822
brk(0) = 0xb138000
brk(0xb159000) = 0xb159000
read(60, "", 4096) = 0
close(60) = 0
write(2, "Bad RFC822 field name \'\'\n at /us"..., 86) = 86
_llseek(58, 529, [529], SEEK_SET) = 0
_llseek(58, 0, [529], SEEK_CUR) = 0
close(58) = 0
close(59) = 0
close(46) = 0
close(47) = 0
close(16) = 0
close(17) = 0
close(10) = 0
close(11) = 0
close(6) = 0
close(7) = 0
close(48) = 0
close(49) = 0
close(38) = 0
close(39) = 0
close(20) = 0
close(21) = 0
close(32) = 0
close(33) = 0
close(56) = 0
close(57) = 0
close(42) = 0
close(43) = 0
close(14) = 0
close(15) = 0
close(28) = 0
close(29) = 0
close(26) = 0
close(27) = 0
close(52) = 0
close(53) = 0
close(8) = 0
close(9) = 0
close(44) = 0
close(45) = 0
close(50) = 0
close(51) = 0
close(34) = 0
close(35) = 0
close(22) = 0
close(23) = 0
close(30) = 0
close(31) = 0
close(24) = 0
close(25) = 0
close(18) = 0
close(19) = 0
close(36) = 0
close(37) = 0
close(54) = 0
close(55) = 0
close(40) = 0
close(41) = 0
close(12) = 0
close(13) = 0
munmap(0x40852000, 266240) = 0
close(4) = 0
close(5) = 0
close(3) = 0
exit_group(255) = ?Is there anything to do in order to avoid this problem ?
Thanks.
------------------------------------------------------- This SF.Net email is sponsored by the new InstallShield X.
From Windows to Linux, servers to mobile, InstallShield X is the one
installation-authoring solution that does it all. Learn more and evaluate today! http://www.installshield.com/Dev2Dev/0504 _______________________________________________ Opencomputing-openprotect mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/opencomputing-openprotect
