swingspacers Posted February 25, 2005 Share Posted February 25, 2005 SpamCop has started inserting [WARNING: A/V UNSCANNABLE] into the subject lines of email that it pulls from Hotmail via Popgate. What is that supposed to mean? Is that an error at SpamCop, or is this information supposed to be useful for me? Here is an example: http://www.spamcop.net/sc?id=z736162772z93...4b58f42b5f0b19z Link to comment Share on other sites More sharing options...
StevenUnderwood Posted February 26, 2005 Share Posted February 26, 2005 What is telling you that spamcop is placing that message in the subject? Have you stopped picking up the Hotmail and seen the subject not there and then pop it and the subject was changed? Spamcop never modifies the subject of any message. Since the same popgate configuration is used for all the popgate retreivals, that should also show up on the others like my Yahoo account, which it is not. I would assume the subject change is coming from somewhere else. Link to comment Share on other sites More sharing options...
swingspacers Posted February 26, 2005 Author Share Posted February 26, 2005 The messages sit in the trash can in my Hotmail account after SpamCop has POPped them from the inbox. There the subject line does not have the warning: X-Message-Status: n X-SID-PRA: DietWarning!3 <Cross[at]7uIVrb41sUip.net> X-SID-Result: TempError X-Message-Info: QgKjWZqp6sQeshtoIKNXOU6daDnp5bGxOou9ooTSwQw= Received: from mc1-f15.hotmail.com ([64.4.50.22]) by imc3-s32.hotmail.com with Microsoft SMTPSVC(6.0.3790.211); Thu, 24 Feb 2005 23:40:29 -0800 Received: from 64-247-198-173.chaska.net ([64.247.198.173]) by mc1-f15.hotmail.com with Microsoft SMTPSVC(6.0.3790.211); Thu, 24 Feb 2005 23:40:27 -0800 To: <MUNGED> From: "DietWarning!3" <Cross[at]7uIVrb41sUip.net> Subject: This Product Will Cause You To Lose weight! Date: Thu, 24 Feb 2005 23:39:22 -0800 Received: from via.mxsmtp.biz ([61.118.221.107]) by mx1.Tl7uHu2Fdb3.net with Microsoft SMTPSVC(5.5.1877.687.68); Fri, 25 Feb 2005 12:32:22 +0500 +0100 Return-Path: <Ingrid[at]2q4J3Y5057b0.net> Message-ID: <071e32a97a2t$sw63gg76$7108a2c1[at]Ingrid> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Special_333_2320138_12E12345519A5.2938746C290" X-OriginalArrivalTime: 24 Feb 2005 12:12:21.0101 (UTC) FILETIME=[C31D2791:02Z24B9Q] Also notice how the subject line has been moved up from its usual location. It has been placed right below an X-IronPort-AV: header among the mailgate received lines. This is clear and convincing evidence that this was done at SpamCop/IronPort. Popgate for my Yahoo account works fine without these warnings. Maybe there is something about these spams that causes the SpamCop virus scanner to choke? I know that SpamCop is not supposed to modify the subject of any message. SpamCop is clearly exhibiting totally undocumented behavior here. The word "unscannable" is not mentioned at all on www.spamcop.net and has been mentioned only once on forum.spamcop.net in a completely different context. However, if you google the WWW for "[WARNING: A/V UNSCANNABLE]" you will see that SpamCop has done this at least once before, in August 2004. Link to comment Share on other sites More sharing options...
StevenUnderwood Posted February 26, 2005 Share Posted February 26, 2005 Thank you for that comparison. I have sent a short request off to jefft to see what is going on. I do see the X-IronPort-AV: line in only a small percentage of my non-spam messages (41/6676 total messages) and only since May 2004. Most of those are my yahoo.com address (popgate) but some are forwards or direct to spamcop address messages as well. Being Friday night, we may not get an answer until next week, however. Link to comment Share on other sites More sharing options...
Jeff G. Posted February 27, 2005 Share Posted February 27, 2005 I've gotten 18 of them in the past week, but chose not to comment on them until now. Over half of them were popped by fetchmail on mailgate from my spammiest POP account (that I'm thinking of dumping), and the rest were pulled magically by popgate through fetchmail on mailgate from various of my MSN Hotmail accounts. Link to comment Share on other sites More sharing options...
StevenUnderwood Posted February 28, 2005 Share Posted February 28, 2005 I just got a reply from JT on this matter and am going to take his words as permission to post his reply here. It's the AV scanner that is scanning Popgate mail that is inserting that header. I wasn't aware that it was doing it, but the scanner must be failing for these specific messages. If someone wants to redirect one of these unscannable messages to me, I'll take a look at it with the AV people. Jeff I would suggest someone contact him at support<at>spamcop.net. Thank you. Link to comment Share on other sites More sharing options...
Jeff G. Posted February 28, 2005 Share Posted February 28, 2005 I will when I can - sorry, but I can't reach my copies at present. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.