[AMaViS-user] tough problem: virus_scan FAILED: / W32.Sober.F

[Alexander A. <ale...@os...>]

A few weeks ago I noticed a bunch of mails in the deferred queue. I took
a look at the messages and it seems to me that only those infected with
the W32.Sober.F virus neither can be discarded nor delivered correctly.
The mailq command shoes the following:

 2E9521468E    59262 Wed Apr 14 12:46:09  Feh...@im...
(host localhost[127.0.0.1] said: 451 4.5.0 Error in processing,
id=23517-09, virus_scan FAILED: ALL VIRUS SCANNERS FAILED:  (in reply to
end of DATA command))
                                         mbo...@po...

Here is an excerpt from my Postfix / Amavisd-new Logfile:

Apr 15 00:26:19 postman amavis[24267]: (23517-09) do_executable/do_unzip
failed, ignoring: IO error: reading data :

All other messages are either delivered correctly to the user's mailbox
or get discarded because of a virus infection. My relay is based on
Debian GNU/Linux "Woody" and runs the following software since late
2003:

postfix 2.0.16-0.woody.1
amavisd-new 20030616p5-1
gzip 1.3.2-3woody1
bzip2 1.0.2-1
lha 1.14i-2
unarj 2.43-3
unrar 2.71-1
zoo 2.10-9
spamassassin 2.60-1
spamc 2.60-1
razor 2.220-3
dccd 1.1.44-1
fsav 4.50-2111
perl 5.6.1-8.7
perl-base 5.6.1-8.7
perl-modules 5.6.1-8.7


1) Why can certain messages not be processed?

2) How can I block messages with certain attachments before they are
passed on to the anti-virus scanner? I do not want to do
mime_body_checks in Postfix. Can I change the sequence how messages are
processed by amavisd-new?

TIA,
Alexander

PS: Please see my conf at http://test.osiris.at/amavisd.conf