hMailserver fails to delete virusmails after upgrade

Use this forum if you have installed hMailServer and want to ask a question related to a production release of hMailServer. Before posting, please read the troubleshooting guide. A large part of all reported issues are already described in detail here.
Post Reply
large
New user
New user
Posts: 27
Joined: 2004-12-31 12:47
Contact:

hMailserver fails to delete virusmails after upgrade

Post by large » 2005-06-28 16:35

As the title says: "hMailserver fails to delete virusmails after upgrade"

I've just updated the ClamWin to version 0.86.1 and after that I've got several virusmail gone trough the system. I though maybe that the hMailserver also needed to be updated, so now that is the latest stable version also.
My default setup for handling viruses has been to delete the infected mail, and it still works, but sometimes (guess when the server has some workload) it let some through.

With the debug-loglevel on I can see that the deletefile() is called, but no error given, but the mail is still there. My best guess is that ClamWin locks the file longer than the old version did.

Has anybody encountered this kind of error lately?
Lars Werner
http://lars.werner.no
Check out my tools:
http://lars.werner.no/unpacker/ - 100% automated extraction tool
http://lars.werner.no/sizeme/ - Maximize the output on a given media (like CD/DVD ect)

User avatar
martin
Developer
Developer
Posts: 6834
Joined: 2003-11-21 01:09
Location: Sweden
Contact:

Post by martin » 2005-06-28 17:29

Do this:
1) Turn on Debug logging in hMailAdmin.
2) Send an email containing the EICAR test virus through the server.
3) Paste the log here.
The log will show what command line hMailServer executed and what return value ClamWin gave.

large
New user
New user
Posts: 27
Joined: 2004-12-31 12:47
Contact:

Post by large » 2005-06-28 17:39

As I said it works sometimes, and I just tested it with the http://www.aleph-tec.com/eicar/index.php service.

I also logged the events earlier and they are not different. But I've just taken the server down, running a cleanup/defrag on it. I'll see if the problem still exists after boot. Might needed a reboot after installing ClamWin/hMS :)

EDIT: I've just rebooted it, and the error did not accure. I got 3 emails one that is clean, and 2 with a integrated zip in mimeformat (or something). http://werner.no/hMail.log (showing from I got replies from this forum to the end of delivery :))
Lars Werner
http://lars.werner.no
Check out my tools:
http://lars.werner.no/unpacker/ - 100% automated extraction tool
http://lars.werner.no/sizeme/ - Maximize the output on a given media (like CD/DVD ect)

cgountanis
Normal user
Normal user
Posts: 105
Joined: 2005-07-01 00:54
Location: USA

Post by cgountanis » 2005-07-01 04:43

How did you fix? I can send emails through as com and they get deleted. When I include a zip and com they both get by. Also if I just send zip with virus in it it gets by.

large
New user
New user
Posts: 27
Joined: 2004-12-31 12:47
Contact:

Post by large » 2005-07-01 11:29

cgountanis: It seems that sometimes a virus gets through. But I don't have the debug logging on (to much junk, database logging is the best I would say, possible to filter more easy!)

My best guess is that the new ClamWin locks the file, so when hMailserver wants to run a delete file it would give him the 32 error that GetLastError() that is: "The process cannot access the file because it is being used by another process. " It is definity not hMailserver's fault since it failed just after I updated to the latest version of ClamWin. But maybe the hMailserver should remove the mail from the database and run a "cleanup" routine to remove files that don't have an entry in the database.
Lars Werner
http://lars.werner.no
Check out my tools:
http://lars.werner.no/unpacker/ - 100% automated extraction tool
http://lars.werner.no/sizeme/ - Maximize the output on a given media (like CD/DVD ect)

cgountanis
Normal user
Normal user
Posts: 105
Joined: 2005-07-01 00:54
Location: USA

Post by cgountanis » 2005-07-02 21:27


cgountanis
Normal user
Normal user
Posts: 105
Joined: 2005-07-01 00:54
Location: USA

Post by cgountanis » 2005-07-15 08:21

wait

when i do manual scan it works

C:\clamav-devel\bin>clamdscan "C:\Program Files\hMailServer\Data\sdfsdfsdf.com\
gountanis\15\{15E255AC-19DB-4C3F-86FC-CEA23D189829}.eml"
C:\Program Files\hMailServer\Data\sdfsdfsdf.com\csdfsdfsdf\15\{15E255AC-19DB-4C
F-86FC-CEA23D189829}.eml: Eicar-Test-Signature FOUND

----------- SCAN SUMMARY -----------
Infected files: 1
Time: 0.076 sec (0 m 0 s)

C:\clamav-devel\bin>

when i do in hmail as clam or external i get returned 2

User avatar
martin
Developer
Developer
Posts: 6834
Joined: 2003-11-21 01:09
Location: Sweden
Contact:

Post by martin » 2005-07-15 08:28

cgountanis:
Please use one thread per problem. If you post the same problem to several threads, it's very confusing as well as irretating.

cgountanis
Normal user
Normal user
Posts: 105
Joined: 2005-07-01 00:54
Location: USA

Post by cgountanis » 2005-07-15 08:30

feel free to delete and add to documentation when solution is found. i will do my best :)

large
New user
New user
Posts: 27
Joined: 2004-12-31 12:47
Contact:

Post by large » 2005-07-15 08:57

martin wrote:cgountanis:
Please use one thread per problem. If you post the same problem to several threads, it's very confusing as well as irretating.
Hey Martin, since you're administrator & moderator of the forum then you have the power to close a thread. By using that feature with a link to the thread you wants replies in, you'll get a good searchable forum with just one thread each :)
Lars Werner
http://lars.werner.no
Check out my tools:
http://lars.werner.no/unpacker/ - 100% automated extraction tool
http://lars.werner.no/sizeme/ - Maximize the output on a given media (like CD/DVD ect)

User avatar
martin
Developer
Developer
Posts: 6834
Joined: 2003-11-21 01:09
Location: Sweden
Contact:

Post by martin » 2005-07-15 09:26

Good idéa. I'll do that next time.. :)

cgountanis
Normal user
Normal user
Posts: 105
Joined: 2005-07-01 00:54
Location: USA

Post by cgountanis » 2005-07-15 11:25


Post Reply