Jump to content
Sign in to follow this  
swingspacers

[WARNING: A/V UNSCANNABLE]?

Recommended Posts

What is telling you that spamcop is placing that message in the subject? Have you stopped picking up the Hotmail and seen the subject not there and then pop it and the subject was changed?

Spamcop never modifies the subject of any message. Since the same popgate configuration is used for all the popgate retreivals, that should also show up on the others like my Yahoo account, which it is not.

I would assume the subject change is coming from somewhere else.

Share this post


Link to post
Share on other sites

The messages sit in the trash can in my Hotmail account after SpamCop has POPped them from the inbox. There the subject line does not have the warning:

X-Message-Status: n
X-SID-PRA: DietWarning!3 <Cross[at]7uIVrb41sUip.net>
X-SID-Result: TempError
X-Message-Info: QgKjWZqp6sQeshtoIKNXOU6daDnp5bGxOou9ooTSwQw=
Received: from mc1-f15.hotmail.com ([64.4.50.22]) by imc3-s32.hotmail.com with Microsoft SMTPSVC(6.0.3790.211);
  Thu, 24 Feb 2005 23:40:29 -0800
Received: from 64-247-198-173.chaska.net ([64.247.198.173]) by mc1-f15.hotmail.com with Microsoft SMTPSVC(6.0.3790.211);
  Thu, 24 Feb 2005 23:40:27 -0800
To: <MUNGED>
From: "DietWarning!3" <Cross[at]7uIVrb41sUip.net>
Subject: This Product Will Cause You To Lose weight!
Date: Thu, 24 Feb 2005 23:39:22 -0800
Received: from via.mxsmtp.biz ([61.118.221.107]) by mx1.Tl7uHu2Fdb3.net  with Microsoft SMTPSVC(5.5.1877.687.68);
  Fri, 25 Feb 2005 12:32:22 +0500 +0100
Return-Path: <Ingrid[at]2q4J3Y5057b0.net>
Message-ID: <071e32a97a2t$sw63gg76$7108a2c1[at]Ingrid>
MIME-Version: 1.0
Content-Type: multipart/mixed;
	boundary="----=_Special_333_2320138_12E12345519A5.2938746C290"
X-OriginalArrivalTime: 24 Feb 2005 12:12:21.0101 (UTC) FILETIME=[C31D2791:02Z24B9Q]

Also notice how the subject line has been moved up from its usual location. It has been placed right below an X-IronPort-AV: header among the mailgate received lines. This is clear and convincing evidence that this was done at SpamCop/IronPort.

Popgate for my Yahoo account works fine without these warnings. Maybe there is something about these spams that causes the SpamCop virus scanner to choke?

I know that SpamCop is not supposed to modify the subject of any message. SpamCop is clearly exhibiting totally undocumented behavior here. The word "unscannable" is not mentioned at all on www.spamcop.net and has been mentioned only once on forum.spamcop.net in a completely different context. However, if you google the WWW for "[WARNING: A/V UNSCANNABLE]" you will see that SpamCop has done this at least once before, in August 2004.

Share this post


Link to post
Share on other sites

Thank you for that comparison. I have sent a short request off to jefft to see what is going on. I do see the X-IronPort-AV: line in only a small percentage of my non-spam messages (41/6676 total messages) and only since May 2004. Most of those are my yahoo.com address (popgate) but some are forwards or direct to spamcop address messages as well.

Being Friday night, we may not get an answer until next week, however.

Share this post


Link to post
Share on other sites

I've gotten 18 of them in the past week, but chose not to comment on them until now. Over half of them were popped by fetchmail on mailgate from my spammiest POP account (that I'm thinking of dumping), and the rest were pulled magically by popgate through fetchmail on mailgate from various of my MSN Hotmail accounts.

Share this post


Link to post
Share on other sites

I just got a reply from JT on this matter and am going to take his words as permission to post his reply here.

It's the AV scanner that is scanning Popgate mail that is inserting that

header. I wasn't aware that it was doing it, but the scanner must be

failing for these specific messages. If someone wants to redirect one of

these unscannable messages to me, I'll take a look at it with the AV people.

Jeff

I would suggest someone contact him at support<at>spamcop.net. Thank you.

Share this post


Link to post
Share on other sites

I will when I can - sorry, but I can't reach my copies at present.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×