Page 1 of 1

hMailserver fails to delete virusmails after upgrade

Posted: 2005-06-28 16:35
by large
As the title says: "hMailserver fails to delete virusmails after upgrade"

I've just updated the ClamWin to version 0.86.1 and after that I've got several virusmail gone trough the system. I though maybe that the hMailserver also needed to be updated, so now that is the latest stable version also.
My default setup for handling viruses has been to delete the infected mail, and it still works, but sometimes (guess when the server has some workload) it let some through.

With the debug-loglevel on I can see that the deletefile() is called, but no error given, but the mail is still there. My best guess is that ClamWin locks the file longer than the old version did.

Has anybody encountered this kind of error lately?

Posted: 2005-06-28 17:29
by martin
Do this:
1) Turn on Debug logging in hMailAdmin.
2) Send an email containing the EICAR test virus through the server.
3) Paste the log here.
The log will show what command line hMailServer executed and what return value ClamWin gave.

Posted: 2005-06-28 17:39
by large
As I said it works sometimes, and I just tested it with the service.

I also logged the events earlier and they are not different. But I've just taken the server down, running a cleanup/defrag on it. I'll see if the problem still exists after boot. Might needed a reboot after installing ClamWin/hMS :)

EDIT: I've just rebooted it, and the error did not accure. I got 3 emails one that is clean, and 2 with a integrated zip in mimeformat (or something). (showing from I got replies from this forum to the end of delivery :))

Posted: 2005-07-01 04:43
by cgountanis
How did you fix? I can send emails through as com and they get deleted. When I include a zip and com they both get by. Also if I just send zip with virus in it it gets by.

Posted: 2005-07-01 11:29
by large
cgountanis: It seems that sometimes a virus gets through. But I don't have the debug logging on (to much junk, database logging is the best I would say, possible to filter more easy!)

My best guess is that the new ClamWin locks the file, so when hMailserver wants to run a delete file it would give him the 32 error that GetLastError() that is: "The process cannot access the file because it is being used by another process. " It is definity not hMailserver's fault since it failed just after I updated to the latest version of ClamWin. But maybe the hMailserver should remove the mail from the database and run a "cleanup" routine to remove files that don't have an entry in the database.

Posted: 2005-07-02 21:27
by cgountanis

Posted: 2005-07-15 08:21
by cgountanis

when i do manual scan it works

C:\clamav-devel\bin>clamdscan "C:\Program Files\hMailServer\Data\\
C:\Program Files\hMailServer\Data\\csdfsdfsdf\15\{15E255AC-19DB-4C
F-86FC-CEA23D189829}.eml: Eicar-Test-Signature FOUND

----------- SCAN SUMMARY -----------
Infected files: 1
Time: 0.076 sec (0 m 0 s)


when i do in hmail as clam or external i get returned 2

Posted: 2005-07-15 08:28
by martin
Please use one thread per problem. If you post the same problem to several threads, it's very confusing as well as irretating.

Posted: 2005-07-15 08:30
by cgountanis
feel free to delete and add to documentation when solution is found. i will do my best :)

Posted: 2005-07-15 08:57
by large
martin wrote:cgountanis:
Please use one thread per problem. If you post the same problem to several threads, it's very confusing as well as irretating.
Hey Martin, since you're administrator & moderator of the forum then you have the power to close a thread. By using that feature with a link to the thread you wants replies in, you'll get a good searchable forum with just one thread each :)

Posted: 2005-07-15 09:26
by martin
Good idéa. I'll do that next time.. :)

Posted: 2005-07-15 11:25
by cgountanis