SYMPTOMSEmail messages addressed to mailboxes protected by Parallels Premium Antivirus bounce back with the following diagnostic:
Antivirus filter report:
--- Antivirus report ---
127.0.0.1  drweb.tmp.0Ugml7 - archive MAIL
127.0.0.1  drweb.tmp.0Ugml7/[text:plain] - Ok
127.0.0.1  drweb.tmp.0Ugml7/test.zip - archive ZIP
127.0.0.1  >drweb.tmp.0Ugml7/test.zip/test.txt - Ok
127.0.0.1  >drweb.tmp.0Ugml7/test.zip/ - read error!
The following records are logged in the log file "/usr/local/psa/var/log/maillog":
Dec 16 14:22:26 plesk103lin qmail-queue: scan: the message(drweb.tmp.0Ugml7) sent by email@example.com to firstname.lastname@example.org daemon return
error (read error, after scanning/curing composite object is clean) - possible problem with daemon or file
Dec 16 14:22:26 plesk103lin qmail-queue-handlers: handlers_stderr: STOP
Dec 16 14:22:26 plesk103lin qmail-queue-handlers: call_handlers: STOP during call '/usr/local/psa/handlers/info/20-drweb-KDgERz/executable' handler
Dec 16 14:22:26 plesk103lin qmail-queue-handlers: call_handlers: stop call handlers from dir '/email@example.com'
CAUSEAn incorrect Parallels Premium Antivirus update was made available on December 15th, 2011. It results in an internal error while examining messages that contain an archive as an attachment. The default configuration of the Parallels Premium Antivirus is to either hold a message in quarantine or reject it if an internal error occurs during its examination.
- Parallels Plesk Panel 10.4.4 MU#8
- Parallels Plesk Panel 9.5.4 MU#16
- Parallels Plesk Panel 8.6.0 MU#8
If you're using Plesk v8.6.0 or if the Micro-Update installation is not successful, you can follow these steps to update Dr.Web databases manually:
- Download: http://update.drweb.com/unix/500/update.drl
- Put it to: /var/drweb/bases
Update Dr.Web databases:
# sudo –u drweb /opt/drweb/update.pl
Note: Plesk versions prior to v8.6.0 ship Dr.Web 4.33, which is now EOL and is no longer being updated. Update to Plesk v8.6.0 or a later version to receive Dr.Web 5.x support.