Escan/english/MailScan-Troubleshooting

From eScan Wiki

Revision as of 06:22, 29 October 2010; view current revision
←Older revision | Newer revision→

· eScan · MailScan · Technologies

· Technical Info · Security Awareness · User Guides

MailScan - Troubleshooting

Index

Back to Mailscan Page

In Mailscan for Exchange (installed in Gateway mode) - Raspop logs does not get created in the Windows 2008 (64bit-OS)
It is observed Mails exceeding the mail size restriction gets accumulated in the Spoolout folder of the Mailscan.How do I stop emails (exceeding the size limit)being accepted by Mailscan when there is already a size restriction defined in the Mailserver?
How can I stop emails, scanned by Mailscan, from being deleted due to the SURBL / RBL checks. These emails should automatically be quarantined instead of being deleted?
How can I stop emails from being quarantined due to HTML SRC=CID... and for Non-Verified Sender-Single URL. I have Mailscan for SMTP?
Can I stop a blacklisted ip from doing RCPT command. I have Mailscan for SMTP?
How can I enable content scanning on Subject with " [ " (i.e. with square bracket)?
I have Exchange 2007 ( Hub Transport ) on SBS 2008 64 bit Server. After installing MailScan for Exchange, Exchange 2007 is not accepting an email it is asking for Authentication. I have changed the Exchange port from 25 to 26.
I have MailScan for Exchange 6.1a installed on my client's (ABCD) SBS 2008 machine along with Exchange 2007. I am trying to get the mail to flow, but it is not working (internal emails are however as well as outbound). We are using RASPOP to check the firm's POP3 accounts and then are trying to have those emails forwarded to Exchange for local delivery to the users.I changed all receive connectors to port 26 as MailScan listens on 25 (in Exchange). All users on the SBS have an SMTP address @abcd.org. I have the "forward to" addresses setup to send to the users @abcd.org. I tested one account downloading through RASPOP. The test email downloaded, but was never delivered. Message tracking on Exchange has no knowledge of the email. The SMTP and ROUTE logs for MailScan both say "successful" near the message, but there's no user log for the POP transaction as there normally is? When I go to input "forward to" addresses in RASPOP, the program wants to append a @abcd.local automatically to the end of the address I am entering. However, the emails are being sent from outside users to @abcd.org addresses. Does this mean anything to you? Do I need to add the external domain somewhere in MailScan and/or Exchange 2007? Am I missing a connector? Any advice?
The mails released from the quaratine do not reach the recipients.
"An unhandled win32 exception occured in Mailscan.exe [3708]....." This message is observed in Mailscan
Mailscan for Spearmail Installed & configured correctly but still mails are not passing through mailscan.
Why emails to a particular email-id (eg. abc@localdomain.com) are getting quarantined by Mailscan. How do I exclude that email address from content check?

In Mailscan for Exchange (installed in Gateway mode)-Raspop logs does not get created in the Windows 2008 (64bit-OS)

Answer:

A. Download the Raspop.zip. (Click here to download the Raspop.zip)

B. Extract the Raspop.exe from Raspop.zip to the C:\ drive

Then follow the below mentioned steps:

a. Goto the Command prompt. Start>>Run>>Cmd.

b. Goto C:\Program file(x86)\mailscan folder.

c. Type the command

 killproc raspop.exe and press Enter.

d. Rename the file raspop.exe to raspop.old

e. Copy the new raspop.exe from the C:\ drive to the C:\Program file(x86)\mailscan folder.

f. Then restart the machine and check the log files after downloading the mails by raspop.

( Raspop.exe version: 4.0.1.9 )

It is observed Mails exceeding the mail size restriction gets accumulated in the Spoolout folder of the Mailscan.How do I stop emails (exceeding the size limit)being accepted by Mailscan when there is already a size restriction defined in the Mailserver?

Answer:

To stop emails being accepted by Mailscan as per the size restriction defined in the Mailserver, follow the below steps:

a. Open the mailscan.ini in \program files\mailscan folder,

b. Set the value for Max_Size_To_Spoolout to the maximum allowed size in bytes

For eg if the max mail size restriction is 20MB then the value is set to
Max_Size_To_Spoolout=20480000

Back to Top

How can I stop emails, scanned by Mailscan, from being deleted due to the SURBL / RBL checks. These emails should automatically be quarantined instead of being deleted?

Answer:

To stop emails being deleted due to SURBL / RBL listing, follow the below steps:

a. Open the mailscan.ini in \program files\mailscan folder,

b. set the value for

Deleteflags=0 (this will quarantine the emails found in the SURBL/RBL listing).

While
Deleteflags=2 (this will delete the emails found in the SURBL/RBL listing).
Back to Top

How can I stop emails from being quarantined due to HTML SRC=CID... and for Non-Verified Sender-Single URL. I have Mailscan for SMTP?

Answer:

To stop emails from being quarantined due to HTML SRC=CID... and for Non-Verified Sender-Single URL, follow the below steps:

a.. Open Mailscan.ini from \Program Files\Mailscan folder (Mailscan installed directory),

b. Locate the below entries and change the value as given below:

ConsiderCIDasSrcString=0

ConsiderAttWithCIDasSpam=0

ScoreForNonVerifiedSender=5

ScoreForNonVerifiedSenderSingleURL=5

c. Then restart the Mailscan for SMTP service.
Back to Top

Can I stop a blacklisted ip address from doing RCPT command. I have Mailscan for SMTP?

Answer:
Yes. To stop blacklisted ip address from doing RCPT command when using Mailscan for SMTP, follow the below steps:

a. Start the Windows registry

Click here to refer "How to start the windows registry editor?"

HKEY_LOCAL_MACHINE\SOFTWARE\Microworld\MailScan for SMTP\SmtpServer1

Check for the entry and make the value as given below,

DropConnectionImmediatelyOnRuleFailure=1

c. Restart the Mailscan for SMTP Service.
Back to Top

How can I enable content scanning on Subject with " [ " (i.e. with square bracket)?

Answer:

To enable content scanning on Subject with " [ " (i.e. with square bracket), follow the below steps:

a. Open Mailscan.ini

b. Under [General] Section

c. Add the below mentioned entries

ReservedSubjectEnabled=1

ReservedSubject=[Javascript,[delphe,[general,[visual,[tech,[md-beta

d. Save the Mailscan.ini file and restart the Mailscan service.
Back to Top

I have Exchange 2007 ( Hub Transport ) on SBS 2008 64 bit Server. After installing MailScan for Exchange, Exchange 2007 is not accepting an email it is asking for Authentication. I have changed the Exchange port from 25 to 26.

Answer:

a. You will have to give rights of Anonymous users to Default Recipient connectors.

b. Disable Anti-spam features of Exchange 2007.

This should resolve the problem.
Back to Top

I have MailScan for Exchange 6.1a installed on my client's (ABCD) SBS 2008 machine along with Exchange 2007. I am trying to get the mail to flow, but it is not working (internal emails are however as well as outbound). We are using RASPOP to check the firm's POP3 accounts and then are trying to have those emails forwarded to Exchange for local delivery to the users.I changed all receive connectors to port 26 as MailScan listens on 25 (in Exchange). All users on the SBS have an SMTP address @abcd.org. I have the "forward to" addresses setup to send to the users @abcd.org. I tested one account downloading through RASPOP. The test email downloaded, but was never delivered. Message tracking on Exchange has no knowledge of the email. The SMTP and ROUTE logs for MailScan both say "successful" near the message, but there's no user log for the POP transaction as there normally is? When I go to input "forward to" addresses in RASPOP, the program wants to append a @abcd.local automatically to the end of the address I am entering. However, the emails are being sent from outside users to @abcd.org addresses. Does this mean anything to you? Do I need to add the external domain somewhere in MailScan and/or Exchange 2007? Am I missing a connector? Any advice?

Answer:

This could be due to incorrect domain defined in the list of local domain table of the Mailscan.

Follow the below steps:

a) Logon to the Mailscan for Exchange WebConsole

b) Go to SMTP Administrator >> Gateway Configuration

c) Add abcd.org in the List of Local Domains and configure the IP address and the SMTP port number and save the settings.

d) Then select the abcd.org in the List of Local Domains and click on the Make Primary button. Now abcd.org will be the Primary Domain.

e) Delete abcd.local from the List of Local Domains.

Back to Top

The mails released from the quaratine do not reach the recipients.

Answer:
This issue has been resolved and will be available in our next release of Hotfix above version 1.0.0.411.

Click here for Hotfix download links
Back to Top

"An unhandled win32 exception occured in Mailscan.exe [3708]....." This message is observed in Mailscan.

Answer:
This issue has been resolved and will be available in our next release of Hotfix above version 1.0.0.411.

Click here for Hotfix download links
Back to Top

Mailscan for Spearmail Installed & configured correctly but still mails are not passing through mailscan.

Answer:
Spearmail's new version uses 'spearmail.exe' as its application file. We need to include the filename 'spearmail.exe' in C:\program files\mailscan\include.dat file.
Back to Top

Why emails to a particular email-id (eg. abc@localdomain.com) are getting quarantined by Mailscan. How do I exclude that email address from content check?

Answer:
If you get the emails to be quarantined due to content for a particular email account and the emails are genuine, we can add that email address in a white list to bypass the content check for that particular email address.

To do so please follow the below mentioned procedure:

a. Open Mailscan Administrator by Right-Clicking on mailscan icon from taskbar and then click on Scan Control

b. Now add the particular email address in Do not scan emails to user section.

c. Save the settings by clicking on Save button.

This will not do the content check for the emails that are sent to abc@localdomain.com from any email address.

Note: Do not check the option Delete mails from following users. Because this option will delete all the emails which will come to that particular email address.
Back to Top