Re: [qmailtoaster] qq soft reject errors on high load

Fri, 01 Sep 2017 22:08:51 -0700 

eric

1) is their any resolution for this issue ?

2) if i run the script it throws error as such
.
/limits.sh: line 23: `return-limits': not a valid identifier

#!/bin/bash
if [ "$#" -ne "1" ]; then
   echo ""
   echo -e "\033[01;32mLimit checker\033[00m"
   echo -e "\033[01;37mUsage:\033[01;33m $0 process_name\033[00m"
   echo ""
   exit 0
fi

return-limits(){
   for process in $@; do
      process_pids=`ps -C $process -o pid --no-headers | cut -d " " -f 2`

      if [ -z $@ ]; then
         echo "[no $process running]"
      else
         for pid in $process_pids; do
            echo "[$process #$pid -- limits]"
            cat /proc/$pid/limits
      done
      fi
   done
}
return-limits $1

rajesh



----- Original Message -----
From: Eric Broch [mailto:[email protected]]
To: [email protected]
Sent: Fri, 1 Sep 2017 17:28:40 -0600
Subject:

I sent myself a large file so that I could examine simscan with the
below script (limits.sh). Here's the output:

[root@pet105 simscan-1.4.0]# ./limits simscan
[simscan #31535 -- limits]
Limit                     Soft Limit           
Hard Limit           Units
Max cpu time              unlimited unlimited           
 seconds
Max file size             unlimited unlimited            
bytes
Max data size             unlimited unlimited            
bytes
Max stack size 10485760 unlimited            bytes
Max core file size        0 unlimited            bytes
Max resident set          unlimited unlimited            
bytes
Max processes 1024 31121                processes
Max open files            1024 4096                 
files
Max locked memory         65536 65536                
bytes
Max address space         unlimited unlimited            
bytes
Max file locks            unlimited unlimited            
locks
Max pending signals       31121 31121                
signals
Max msgqueue size         819200 819200               
bytes
Max nice priority         0                    0
Max realtime priority     0                    0
Max realtime timeout      unlimited unlimited            us

Notice the 'Max processes' and 'Max stack size', this could very well be
the issue for our simscan failures.

Eric

On 9/1/2017 5:20 PM, Eric Broch wrote:
>
> This looks like a decent script:
>
> <limits.sh>
> #!/bin/bash
> if [ "$#" -ne "1" ]; then
> echo ""
> echo -e "\033[01;32mLimit checker\033[00m"
> echo -e "\033[01;37mUsage:\033[01;33m $0 process_name\033[00m"
> echo ""
> exit 0
> fi
>
> return-limits(){
> for process in $@; do
>       process_pids=`ps -C $process -o pid --no-headers | cut -d " " -f 2`
>
> if [ -z $@ ]; then
> echo "[no $process running]"
> else
> for pid in $process_pids; do
> echo "[$process #$pid -- limits]"
>             cat /proc/$pid/limits
>       done
>       fi
>    done
> }
>
> return-limits $1
> </limits.sh>
>
> Example:
> # ./limits.sh tcpserver
> or
> # ./limits.sh simscan
>
> Eric
>
>
> On 9/1/2017 2:51 PM, Rajesh M wrote:
>> eric
>>
>> how do i check the number of user processes being consumed and by which user
>>
>> rajesh
>>
>> ----- Original Message -----
>> From: Eric Broch [mailto:[email protected]]
>> To:[email protected]
>> Sent: Fri, 1 Sep 2017 14:25:36 -0600
>> Subject:
>>
>> Number of user processes.
>>
>>
>> On 9/1/2017 1:57 PM, Rajesh M wrote:
>>> eric
>>>
>>> what is RLIMIT ? is it related to memory ?
>>>
>>> rajesh
>>>
>>> ----- Original Message -----
>>> From: Eric Broch [mailto:[email protected]]
>>> To:[email protected]
>>> Sent: Fri, 1 Sep 2017 13:25:49 -0600
>>> Subject:
>>>
>>> Here's a section of code in simscan.c that controls the number of processes.
>>>
>>> #ifdef HAS_ULIMIT_NPROC
>>>      /* Set ulimits to prevent hangs if it forks too many processes 
>>> */
>>>      getrlimit(RLIMIT_NPROC, &limits);
>>>      limits.rlim_cur = 1024;
>>>      setrlimit(RLIMIT_NPROC, &limits);
>>> #endif
>>>
>>> The RLIMIT is set to 1024.
>>>
>>> I think this may be the issue and would explain why there would be
>>> forking issues with qmail-queue, ripmime, and others. This is in place
>>> to prevent hangs...could be a good thing.
>>>
>>>
>>> On 9/1/2017 1:04 PM, Remo Mattei wrote:
>>>> interesting...
>>>>
>>>> mine was an easy fix by changing the owner and permissions so
>>>> underline has some other triggering to the kernel and how it reads
>>>> those layers.
>>>>
>>>> On 9/1/17 11:18 AM, Eric Broch wrote:
>>>>> 1)  Problem forking
>>>>>
>>>>> vfork() is used to execute qmail-queue
>>>>>
>>>>> The error 'simscan: error forking qmail-queue' will happen for either
>>>>> of the following reasons:
>>>>>
>>>>> a) [EAGAIN]
>>>>>       The system-wide limit on the total number of processes under
>>>>>       execution would be exceeded, or the system-imposed limit on the
>>>>>       total number of processes under execution by a single user would
>>>>>       be exceeded.
>>>>> b) [ENOMEM]
>>>>>       There is insufficient swap space for the new process.
>>>>>
>>>>>
>>>>> On 9/1/2017 11:53 AM, Eric Broch wrote:
>>>>>> Are there any errors in /var/log/messages that correspond?
>>>>>>
>>>>>>
>>>>>> On 9/1/2017 11:39 AM, Jeff Koch wrote:
>>>>>>> Eric / Remo / Rajesh - we reported this same problem a number of
>>>>>>> months ago and thought we had fixed it. But alas, it's still with
>>>>>>> us. The good news is that we haven't had any customer complaints.
>>>>>>> I'll be very interested if it can be resolved.
>>>>>>>
>>>>>>> Jeff Koch
>>>>>>>
>>>>>>>
>>>>>>> On 9/1/2017 12:01 PM, Eric Broch wrote:
>>>>>>>> I'm not sure what's going on here. Is this a relatively new
>>>>>>>> phenomenon?
>>>>>>>>
>>>>>>>> I wonder if it's a memory, or even a disk speed, issue since it
>>>>>>>> only happens at peak hours?
>>>>>>>>
>>>>>>>> I think I'll appy Johannes Weberhofer's patch and put it out there
>>>>>>>> for you...and cross or fingers.
>>>>>>>>
>>>>>>>>
>>>>>>>> On 9/1/2017 6:28 AM, Rajesh M wrote:
>>>>>>>>> remo / eric
>>>>>>>>>
>>>>>>>>> i have still not being able to resolve the qq soft reject error.
>>>>>>>>>
>>>>>>>>> these are my findings
>>>>>>>>>
>>>>>>>>> 1) the errors i see are "error forking qmail-queue" and "ripmime 
>>>>>>>>> error" which causes the qq soft reject.
>>>>>>>>>
>>>>>>>>> 2) the max concurrent connections in the logs is around 35.
>>>>>>>>>
>>>>>>>>> 3)  These errors come up during peak working hours when the server is 
>>>>>>>>> under a  load of 4 - 8, and they increase the load even more to over 
>>>>>>>>> 10-15.
>>>>>>>>>
>>>>>>>>> 4) i came across this link (not sure if this is related)
>>>>>>>>> https://github.com/qmail/simscan/blob/master/simscan.c
>>>>>>>>>
>>>>>>>>> 5) i can share with you my live smtp logs with simscan debug.
>>>>>>>>>
>>>>>>>>> have extracted some lines below
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> Error forking qmail-queue
>>>>>>>>>
>>>>>>>>> @4000000059a8fa7b0a2ed1b4 tcpserver: status: 31/200
>>>>>>>>> @4000000059a8fa7b13162584 simscan: cdb looking up version spam
>>>>>>>>> @4000000059a8fa7b13166bd4 simscan: runned_scanners is  attach: 1.4.0 
>>>>>>>>> clamav: 0.98.6/m: spam: 3.3.2
>>>>>>>>> @4000000059a8fa7b13166fbc simscan: found 3.3.2
>>>>>>>>> @4000000059a8fa7b13168efc simscan:[10757]:CLEAN 
>>>>>>>>> (5.00/30.00):9.7712s:-Possible Spam- RE_ REQUIRE BOOKING // 1X20  //
>>>>>>>>> ICD TKD 
>>>>>>>>> TOBANDARABASS:103.241.181.228:[email protected]:[email protected]
>>>>>>>>> @4000000059a8fa7b1316cd7c simscan: done, execing qmail-queue
>>>>>>>>> @4000000059a8fa7b1316fc5c simscan: error forking qmail-queue
>>>>>>>>> @4000000059a8fa7b13199854 simscan: exit error code: 71
>>>>>>>>> @4000000059a8fa7b131c4004 qmail-smtpd: qq soft reject (mail server 
>>>>>>>>> temporarily rejected message (#4.3.0)): MAILFROM:<[email protected]>
>>>>>>>>> RCPTTO:[email protected]
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> Error in ripmime
>>>>>>>>>
>>>>>>>>> @4000000059a8fa98045a4bc4 simscan: pelookup: domain is 
>>>>>>>>> aissamaritime.in
>>>>>>>>> @4000000059a8fa98045a4bc4 simscan: cdb looking up aissamaritime.in
>>>>>>>>> @4000000059a8fa98045a4fac simscan: pelookup: local part is 
>>>>>>>>> shailesh_k_bom
>>>>>>>>> @4000000059a8fa98045a4fac simscan: lpart: local part is **
>>>>>>>>> @4000000059a8fa98045a5394 simscan: cdb 
>>>>>>>>> [email protected]
>>>>>>>>> @4000000059a8fa98045a5394 simscan: ripmime error
>>>>>>>>> @4000000059a8fa98045a6334 simscan: exit error code: 71
>>>>>>>>> @4000000059a8fa98045a95fc qmail-smtpd: qq soft reject (mail server 
>>>>>>>>> temporarily rejected message (#4.3.0)):
>>>>>>>>> MAILFROM:<[email protected]>   RCPTTO:[email protected]
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> Wierd error logs
>>>>>>>>>
>>>>>>>>> @4000000059a9032f3aa79a24 simscan: clamdscan: ----------- SCAN 
>>>>>>>>> SUMMARY -----------
>>>>>>>>> @4000000059a9032f3aa7b964 simscan: clamdscan: 
>>>>>>>>> /var/qmail/simscan/1504248613.321653.5221: OK
>>>>>>>>> @4000000059a9032f3aa86d14 simscan: clamdscan:
>>>>>>>>> @4000000059a9032f3aa870fc simscan: clamdscan: ---simscan: cdb looking 
>>>>>>>>> up version clamav
>>>>>>>>> @4000000059a9032f3aa8a3c4 -------- SCAN simscan: clamdscan: 
>>>>>>>>> SIUnMfMeAcRtYe d- -fsimscan: runned_scanners is  attach: 1.4.0 
>>>>>>>>> clamav: 0.98.6/m:
>>>>>>>>> @4000000059a9032f3aa8c304 -isimscan: found 0.98.6/m:
>>>>>>>>> @4000000059a9032f3aa8c6ec -l-e-s-:- -0
>>>>>>>>> @4000000059a9032f3aa8f1e4 --simscan: normal clamdscan return code: 0
>>>>>>>>> @4000000059a9032f3aa8f1e4
>>>>>>>>> @4000000059a9032f3aa8f5cc simscan: clamdscan: Infected fsimscan: 
>>>>>>>>> clamdscan: iTliemes::  00
>>>>>>>>> @4000000059a9032f3aa93834 .simscan: clamdscan: 1T1i8m es:e c0 .1(002  
>>>>>>>>> ms e0simscan: calling spamc
>>>>>>>>> @4000000059a9032f3aa96ee4 c  s(0)simscan: calling /usr/bin/spamc 
>>>>>>>>> simscan: clamdscan:
>>>>>>>>> @4000000059a9032f3aa999dc  spamcm
>>>>>>>>> @4000000059a9032f3aa999dc 0 s)
>>>>>>>>> @4000000059a9032f3aa9ad64 /var/qmail/simscan/1simscan: check_spam had 
>>>>>>>>> an error ret: -1
>>>>>>>>> @4000000059a9032f3aa9e02c 504248613.307311.5215: OK
>>>>>>>>> @4000000059a9032f3aaaa37c simscan: clamdscan:
>>>>>>>>> @4000000059a9032f3aaaa764 simscan: clamdscan: ----------- SCAN 
>>>>>>>>> SUMMARY -----------
>>>>>>>>> @4000000059a9032f3aab3fbc simscan: clamdscan: Infected files: 0
>>>>>>>>> @4000000059a9032f3aaba164 simscan: clamdscan: Time: 0.135 sec (0 m 0 
>>>>>>>>> s)
>>>>>>>>> @4000000059a9032f3aac39bc simscan: clamdscan: 
>>>>>>>>> /var/qmail/simscan/15simscan: exit error code: 71
>>>>>>>>> @4000000059a9032f3aaca334 04248613.308469.5216: OK
>>>>>>>>> @4000000059a9032f3aacddcc simscan: clamdscan:
>>>>>>>>> @4000000059a9032f3aace984 simscan: clamdscan: ----------- SCAN 
>>>>>>>>> SUMMARY -----------
>>>>>>>>> @4000000059a9
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> ################
>>>>>>>>>
>>>>>>>>> @4000000059a9032f3aa86d14 simscan: clamdscan:
>>>>>>>>> @4000000059a9032f3aa870fc simscan: clamdscan: ---simscan: cdb looking 
>>>>>>>>> up version clamav
>>>>>>>>> @4000000059a9032f3aa8a3c4 -------- SCAN simscan: clamdscan: 
>>>>>>>>> SIUnMfMeAcRtYe d- -fsimscan: runned_scanners is  attach: 1.4.0 
>>>>>>>>> clamav: 0.98.6/m:
>>>>>>>>> @4000000059a9032f3aa8c304 -isimscan: found 0.98.6/m:
>>>>>>>>> @4000000059a9032f3aa8c6ec -l-e-s-:- -0
>>>>>>>>> @4000000059a9032f3aa8f1e4 --simscan: normal clamdscan return code: 0
>>>>>>>>> @4000000059a9032f3aa8f1e4
>>>>>>>>> @4000000059a9032f3aa8f5cc simscan: clamdscan: Infected fsimscan: 
>>>>>>>>> clamdscan: iTliemes::  00
>>>>>>>>> @4000000059a9032f3aa93834 .simscan: clamdscan: 1T1i8m es:e c0 .1(002  
>>>>>>>>> ms e0simscan: calling spamc
>>>>>>>>> @4000000059a9032f3aa96ee4 c  s(0)simscan: calling /usr/bin/spamc 
>>>>>>>>> simscan: clamdscan:
>>>>>>>>> @4000000059a9032f3aa999dc  spamcm
>>>>>>>>> @4000000059a9032f3aa999dc 0 s)
>>>>>>>>> @4000000059a9032f3aa9ad64 /var/qmail/simscan/1simscan: check_spam had 
>>>>>>>>> an error ret: -1
>>>>>>>>> @4000000059a9032f3aa9e02c 504248613.307311.5215: OK
>>>>>>>>> @4000000059a9032f3aaaa37c simscan: clamdscan:
>>>>>>>>> @4000000059a9032f3aaaa764 simscan: clamdscan: ----------- SCAN 
>>>>>>>>> SUMMARY -----------
>>>>>>>>> @4000000059a9032f3aab3fbc simscan: clamdscan: Infected files: 0
>>>>>>>>> @4000000059a9032f3aaba164 simscan: clamdscan: Time: 0.135 sec (0 m 0 
>>>>>>>>> s)
>>>>>>>>> @4000000059a9032f3aac39bc simscan: clamdscan: 
>>>>>>>>> /var/qmail/simscan/15simscan: exit error code: 71
>>>>>>>>> @4000000059a9032f3aaca334 04248613.308469.5216: OK
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> thanks,
>>>>>>>>> rajesh
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> ----- Original Message -----
>>>>>>>>> From: Remo Mattei [mailto:[email protected]]
>>>>>>>>> To:[email protected]
>>>>>>>>> Sent: Thu, 31 Aug 2017 07:58:22 -0700
>>>>>>>>> Subject:
>>>>>>>>>
>>>>>>>>> No it reads it everytime.
>>>>>>>>>
>>>>>>>>> Yes permissions are good
>>>>>>>>>
>>>>>>>>> Remo
>>>>>>>>>
>>>>>>>>> On 8/31/17 7:48 AM, Rajesh M wrote:
>>>>>>>>>> thank for sharing your experience remo,
>>>>>>>>>>
>>>>>>>>>> so would the following be correct ?
>>>>>>>>>>
>>>>>>>>>> chmod 2750  simscan
>>>>>>>>>> chown clamav.clamav simscan
>>>>>>>>>>
>>>>>>>>>> do i need to stop qmail while applying this ?
>>>>>>>>>>
>>>>>>>>>> rajesh
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> ----- Original Message -----
>>>>>>>>>> From: Remo Mattei [mailto:[email protected]]
>>>>>>>>>> To:[email protected],[email protected]
>>>>>>>>>> Sent: Thu, 31 Aug 2017 07:23:20 -0700
>>>>>>>>>> Subject:
>>>>>>>>>>
>>>>>>>>>> I had the same issue with qq.
>>>>>>>>>>
>>>>>>>>>> I changed the permissions and all good. I also raised the value of 
>>>>>>>>>> the
>>>>>>>>>> softlimits exec /usr/bin/softlimit -m 1040000000
>>>>>>>>>>
>>>>>>>>>> and my permissions are drwxr-s--- 
>>>>>>>>>>   2 clamav clamav 4096 Aug 31 07:19
>>>>>>>>>> simscan
>>>>>>>>>>
>>>>>>>>>> So hopefully this helps.
>>>>>>>>>>
>>>>>>>>>> Remo
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> On 8/31/17 6:51 AM, Rajesh M wrote:
>>>>>>>>>>> eric
>>>>>>>>>>>
>>>>>>>>>>> on my qmailtoaster server (centos 6 64 bit)  there are several 
>>>>>>>>>>> domains --- high traffic
>>>>>>>>>>>
>>>>>>>>>>> about 80 percent of them are routed via the sophos antispam filter 
>>>>>>>>>>> and then passed on to the mailserver with spamassassin/clam 
>>>>>>>>>>> disabled by adding the ip of the sophos server to the tcp.smtp file 
>>>>>>>>>>> to exclude the line /var/qmail/bin/simscan
>>>>>>>>>>>
>>>>>>>>>>> the balance 20 are directly reaching the mailserver ie mx pointed 
>>>>>>>>>>> to mailserver instead of sophos server and are scanned with clam / 
>>>>>>>>>>> spamassassin.
>>>>>>>>>>>
>>>>>>>>>>> today i turned on the spamassassin / clam for the above 80 percent 
>>>>>>>>>>> domains too and this started throwing qq reject errors on  a large 
>>>>>>>>>>> scale but randomly.
>>>>>>>>>>>
>>>>>>>>>>> spamassassin child-processes was set to 20 to handle the load
>>>>>>>>>>>
>>>>>>>>>>> i checked the log files for the last 30 days till yesterday and 
>>>>>>>>>>> found that the same qq reject errors were present but very rarely 
>>>>>>>>>>> ie 3 to 4 times on a single day (occasional high load ??)
>>>>>>>>>>> so it seems that this error comes up only when the load on the 
>>>>>>>>>>> server is high, all take place when there are attachments.
>>>>>>>>>>>
>>>>>>>>>>> reading the thread you sent me, i am not sure whether it applies to 
>>>>>>>>>>> my case but i can try out.
>>>>>>>>>>>
>>>>>>>>>>> #############
>>>>>>>>>>> drwxr-x---  2 clamav root     6 May  6 17:57 simscan/
>>>>>>>>>>>
>>>>>>>>>>> changing this to the following fixed the problem:
>>>>>>>>>>> drwxr-s---  2 clamav clamav     6 May  6 17:57 simscan/
>>>>>>>>>>> ###########
>>>>>>>>>>>
>>>>>>>>>>> should i just
>>>>>>>>>>> chown clamav.clamav simscan
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> thanks
>>>>>>>>>>> rajesh
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> ----- Original Message -----
>>>>>>>>>>> From: Eric Broch [mailto:[email protected]]
>>>>>>>>>>> To:[email protected]
>>>>>>>>>>> Sent: Thu, 31 Aug 2017 06:42:08 -0600
>>>>>>>>>>> Subject:
>>>>>>>>>>>
>>>>>>>>>>> Have a look here, Rajesh, I'm not sure if it will help:
>>>>>>>>>>>
>>>>>>>>>>> https://www.mail-archive.com/[email protected]/msg40456.html
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> On 8/31/2017 4:51 AM, Rajesh M wrote:
>>>>>>>>>>>> hi
>>>>>>>>>>>>
>>>>>>>>>>>> centos 6 64 bit
>>>>>>>>>>>> SpamAssassin version 3.3.2
>>>>>>>>>>>> ClamAV 0.98.6/23745/Thu Aug 31 14:07:08 2017
>>>>>>>>>>>>
>>>>>>>>>>>> we have a sophos antispam firewall which receives our emails and 
>>>>>>>>>>>> then routes them to our mail server (qmailtoaster, dovecot, 
>>>>>>>>>>>> spamassassin, clam)
>>>>>>>>>>>>
>>>>>>>>>>>> in the mail server we had stopped spamassassin
>>>>>>>>>>>>
>>>>>>>>>>>> however due to some custom requirements by our clients we enabled 
>>>>>>>>>>>> the same
>>>>>>>>>>>>
>>>>>>>>>>>> however we get the following error when the load on the server is 
>>>>>>>>>>>> high on a random basis.
>>>>>>>>>>>>
>>>>>>>>>>>> 2017-08-31 14:48:05.753994500 simscan: calling spamc
>>>>>>>>>>>> 2017-08-31 14:48:05.754001500 simscan: calling /usr/bin/spamc  
>>>>>>>>>>>> spamc
>>>>>>>>>>>> 2017-08-31 14:48:05.754010500 simscan: check_spam had an error 
>>>>>>>>>>>> ret: -1
>>>>>>>>>>>> 2017-08-31 14:48:05.754101500 simscan: exit error code: 71
>>>>>>>>>>>> 2017-08-31 14:48:05.754220500 qmail-smtpd: qq soft reject (mail 
>>>>>>>>>>>> server temporarily rejected message (#4.3.0)): 
>>>>>>>>>>>> MAILFROM:<sunil.saharan@@yyyy.com>   RCPTTO:[email protected]
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>> 2017-08-31 14:48:05.956137500 simscan: ripmime error
>>>>>>>>>>>> qmail-smtpd: qq soft reject (mail server temporarily rejected 
>>>>>>>>>>>> message
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>> if i disable simscan in tcp.smtp then errors do not take place.
>>>>>>>>>>>>
>>>>>>>>>>>> i enabled simscan debug and this is the result.
>>>>>>>>>>>>
>>>>>>>>>>>> 2017-08-31 14:48:05.956144500 qmail-smtpd: qq soft reject (mail 
>>>>>>>>>>>> server temporarily rejected message (#4.3.0)): 
>>>>>>>>>>>> MAILFROM:<[email protected]>   RCPTTO:[email protected]
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>> clam=yes,spam=yes,spam_hits=30,spam_passthru=yes,attach=.ace:.arc:.arj:.b64:.bat:.bhx:.cab:.chm:.com:.cpl:.dll:.exe:.gz:.hqx:.hta:.inf:.ins:.iso:.isp:.jse:.lib:.lnk:.lzh:.mim:.msp:.mst:.pif:.reg:.scf:.scr:.sct:.shb:.shs:.sys:.taz:.tgz:.tz:.url:.uu:.uue:.vb:.vbe:.vbs:.wsc:.wsf:.wsh:.xxe:.docm:.z:.jar
>>>>>>>>>>>> 2017-08-31 14:48:05.746592500 simscan: pelookup clam = yes
>>>>>>>>>>>> 2017-08-31 14:48:05.746593500 simscan: pelookup spam = yes
>>>>>>>>>>>> 2017-08-31 14:48:05.746593500 simscan: pelookup spam_hits = 30
>>>>>>>>>>>> 2017-08-31 14:48:05.746595500 simscan: Per Domain Hits set to : 
>>>>>>>>>>>> 30.000000
>>>>>>>>>>>> 2017-08-31 14:48:05.746595500 simscan: pelookup spam_passthru = yes
>>>>>>>>>>>> 2017-08-31 14:48:05.746596500 simscan: unimplemented flag 
>>>>>>>>>>>> spam_passthru = yes
>>>>>>>>>>>> 2017-08-31 14:48:05.746596500 simscan: pelookup attach = 
>>>>>>>>>>>> .ace:.arc:.arj:.b64:.bat:.bhx:.cab:.chm:.com:.cpl:.dll:.exe:.gz:.hqx:.hta:.inf:.ins:.iso:.isp:.jse:.lib:.lnk:.lzh:.mim:.msp:.mst:.pif:.reg:.scf:.scr:.sct:.shb:.shs:.sys:.taz:.tgz:.tz:.url:.uu:.uue:.vb:.vbe:.vbs:.wsc:.wsf:.wsh:.xxe:.docm:.z:.jar
>>>>>>>>>>>> 2017-08-31 14:48:05.746599500 simscan: attachment flag attach = 
>>>>>>>>>>>> .ace:.arc:.arj:.b64:.bat:.bhx:.cab:.chm:.com:.cpl:.dll:.exe:.gz:.hqx:.hta:.inf:.ins:.iso:.isp:.jse:.lib:.lnk:.lzh:.mim:.msp:.mst:.pif:.reg:.scf:.scr:.sct:.shb:.shs:.sys:.taz:.tgz:.tz:.url:.uu:.uue:.vb:.vbe:.vbs:.wsc:.wsf:.wsh:.xxe:.docm:.z:.jar
>>>>>>>>>>>> 2017-08-31 14:48:05.746602500 simscan: add_attach called with 
>>>>>>>>>>>> .ace:.arc:.arj:.b64:.bat:.bhx:.cab:.chm:.com:.cpl:.dll:.exe:.gz:.hqx:.hta:.inf:.ins:.iso:.isp:.jse:.lib:.lnk:.lzh:.mim:.msp:.mst:.pif:.reg:.scf:.scr:.sct:.shb:.shs:.sys:.taz:.tgz:.tz:.url:.uu:.uue:.vb:.vbe:.vbs:.wsc:.wsf:.wsh:.xxe:.docm:.z:.jar
>>>>>>>>>>>> 2017-08-31 14:48:05.746606500 simscan: .ace is attachment number 0
>>>>>>>>>>>> 2017-08-31 14:48:05.746607500 simscan: .arc is attachment number 1
>>>>>>>>>>>> 2017-08-31 14:48:05.746607500 simscan: .arj is attachment number 2
>>>>>>>>>>>> 2017-08-31 14:48:05.746607500 simscan: .b64 is attachment number 3
>>>>>>>>>>>> 2017-08-31 14:48:05.746610500 simscan: .bat is attachment number 4
>>>>>>>>>>>> 2017-08-31 14:48:05.746610500 simscan: .bhx is attachment number 5
>>>>>>>>>>>> 2017-08-31 14:48:05.746610500 simscan: .cab is attachment number 6
>>>>>>>>>>>> 2017-08-31 14:48:05.746611500 simscan: .chm is attachment number 7
>>>>>>>>>>>> 2017-08-31 14:48:05.746611500 simscan: .com is attachment number 8
>>>>>>>>>>>> 2017-08-31 14:48:05.746611500 simscan: .cpl is attachment number 9
>>>>>>>>>>>> 2017-08-31 14:48:05.746611500 simscan: .dll is attachment number 10
>>>>>>>>>>>> 2017-08-31 14:48:05.746612500 simscan: .exe is attachment number 11
>>>>>>>>>>>> 2017-08-31 14:48:05.746614500 simscan: .gz is attachment number 12
>>>>>>>>>>>> 2017-08-31 14:48:05.746614500 simscan: .hqx is attachment number 13
>>>>>>>>>>>> 2017-08-31 14:48:05.746614500 simscan: .hta is attachment number 14
>>>>>>>>>>>> 2017-08-31 14:48:05.746615500 simscan: .inf is attachment number 15
>>>>>>>>>>>> 2017-08-31 14:48:05.746615500 simscan: .ins is attachment number 16
>>>>>>>>>>>> 2017-08-31 14:48:05.746615500 simscan: .iso is attachment number 17
>>>>>>>>>>>> 2017-08-31 14:48:05.746616500 simscan: .isp is attachment number 18
>>>>>>>>>>>> 2017-08-31 14:48:05.746616500 simscan: .jse is attachment number 19
>>>>>>>>>>>> 2017-08-31 14:48:05.746618500 simscan: .lib is attachment number 20
>>>>>>>>>>>> 2017-08-31 14:48:05.746618500 simscan: .lnk is attachment number 21
>>>>>>>>>>>> 2017-08-31 14:48:05.746619500 simscan: .lzh is attachment number 22
>>>>>>>>>>>> 2017-08-31 14:48:05.746622500 simscan: .mim is attachment number 23
>>>>>>>>>>>> 2017-08-31 14:48:05.746622500 simscan: .msp is attachment number 24
>>>>>>>>>>>> 2017-08-31 14:48:05.746623500 simscan: .mst is attachment number 25
>>>>>>>>>>>> 2017-08-31 14:48:05.746623500 simscan: .pif is attachment number 26
>>>>>>>>>>>> 2017-08-31 14:48:05.746623500 simscan: .reg is attachment number 27
>>>>>>>>>>>> 2017-08-31 14:48:05.746624500 simscan: .scf is attachment number 28
>>>>>>>>>>>> 2017-08-31 14:48:05.746624500 simscan: .scr is attachment number 29
>>>>>>>>>>>> 2017-08-31 14:48:05.746624500 simscan: .sct is attachment number 30
>>>>>>>>>>>> 2017-08-31 14:48:05.746630500 simscan: .shb is attachment number 31
>>>>>>>>>>>> 2017-08-31 14:48:05.746630500 simscan: .shs is attachment number 32
>>>>>>>>>>>> 2017-08-31 14:48:05.746631500 simscan: .sys is attachment number 33
>>>>>>>>>>>> 2017-08-31 14:48:05.746631500 simscan: .taz is attachment number 34
>>>>>>>>>>>> 2017-08-31 14:48:05.746631500 simscan: .tgz is attachment number 35
>>>>>>>>>>>> 2017-08-31 14:48:05.746632500 simscan: .tz is attachment number 36
>>>>>>>>>>>> 2017-08-31 14:48:05.746632500 simscan: .url is attachment number 37
>>>>>>>>>>>> 2017-08-31 14:48:05.746632500 simscan: .uu is attachment number 38
>>>>>>>>>>>> 2017-08-31 14:48:05.746635500 simscan: .uue is attachment number 39
>>>>>>>>>>>> 2017-08-31 14:48:05.746635500 simscan: .vb is attachment number 40
>>>>>>>>>>>> 2017-08-31 14:48:05.746635500 simscan: .vbe is attachment number 41
>>>>>>>>>>>> 2017-08-31 14:48:05.746636500 simscan: .vbs is attachment number 42
>>>>>>>>>>>> 2017-08-31 14:48:05.746636500 simscan: .wsc is attachment number 43
>>>>>>>>>>>> 2017-08-31 14:48:05.746636500 simscan: .wsf is attachment number 44
>>>>>>>>>>>> 2017-08-31 14:48:05.746637500 simscan: .wsh is attachment number 45
>>>>>>>>>>>> 2017-08-31 14:48:05.746637500 simscan: .xxe is attachment number 46
>>>>>>>>>>>> 2017-08-31 14:48:05.746639500 simscan: .docm is attachment number 
>>>>>>>>>>>> 47
>>>>>>>>>>>> 2017-08-31 14:48:05.746639500 simscan: .z is attachment number 48
>>>>>>>>>>>> 2017-08-31 14:48:05.746640500 simscan: .jar is attachment number 49
>>>>>>>>>>>> 2017-08-31 14:48:05.746643500 simscan: pelookup: local part is cs2
>>>>>>>>>>>> 2017-08-31 14:48:05.746643500 simscan: lpart: local part is **
>>>>>>>>>>>> 2017-08-31 14:48:05.746644500 simscan: cdb [email protected]
>>>>>>>>>>>> 2017-08-31 14:48:05.747114500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .ace
>>>>>>>>>>>> 2017-08-31 14:48:05.747123500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .arc
>>>>>>>>>>>> 2017-08-31 14:48:05.747124500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .arj
>>>>>>>>>>>> 2017-08-31 14:48:05.747124500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .b64
>>>>>>>>>>>> 2017-08-31 14:48:05.747125500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .bat
>>>>>>>>>>>> 2017-08-31 14:48:05.747126500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .bhx
>>>>>>>>>>>> 2017-08-31 14:48:05.747132500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .cab
>>>>>>>>>>>> 2017-08-31 14:48:05.747133500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .chm
>>>>>>>>>>>> 2017-08-31 14:48:05.747134500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .com
>>>>>>>>>>>> 2017-08-31 14:48:05.747134500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .cpl
>>>>>>>>>>>> 2017-08-31 14:48:05.747135500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .dll
>>>>>>>>>>>> 2017-08-31 14:48:05.747135500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .exe
>>>>>>>>>>>> 2017-08-31 14:48:05.747136500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .gz
>>>>>>>>>>>> 2017-08-31 14:48:05.747140500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .hqx
>>>>>>>>>>>> 2017-08-31 14:48:05.747146500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .hta
>>>>>>>>>>>> 2017-08-31 14:48:05.747147500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .inf
>>>>>>>>>>>> 2017-08-31 14:48:05.747147500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .ins
>>>>>>>>>>>> 2017-08-31 14:48:05.747148500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .iso
>>>>>>>>>>>> 2017-08-31 14:48:05.747149500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .isp
>>>>>>>>>>>> 2017-08-31 14:48:05.747149500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .jse
>>>>>>>>>>>> 2017-08-31 14:48:05.747150500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .lib
>>>>>>>>>>>> 2017-08-31 14:48:05.747162500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .lnk
>>>>>>>>>>>> 2017-08-31 14:48:05.747162500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .lzh
>>>>>>>>>>>> 2017-08-31 14:48:05.747163500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .mim
>>>>>>>>>>>> 2017-08-31 14:48:05.747164500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .msp
>>>>>>>>>>>> 2017-08-31 14:48:05.747164500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .mst
>>>>>>>>>>>> 2017-08-31 14:48:05.747171500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .pif
>>>>>>>>>>>> 2017-08-31 14:48:05.747171500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .reg
>>>>>>>>>>>> 2017-08-31 14:48:05.747172500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .scf
>>>>>>>>>>>> 2017-08-31 14:48:05.747173500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .scr
>>>>>>>>>>>> 2017-08-31 14:48:05.747173500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .sct
>>>>>>>>>>>> 2017-08-31 14:48:05.747174500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .shb
>>>>>>>>>>>> 2017-08-31 14:48:05.747175500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .shs
>>>>>>>>>>>> 2017-08-31 14:48:05.747189500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .sys
>>>>>>>>>>>> 2017-08-31 14:48:05.747189500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .taz
>>>>>>>>>>>> 2017-08-31 14:48:05.747190500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .tgz
>>>>>>>>>>>> 2017-08-31 14:48:05.747191500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .tz
>>>>>>>>>>>> 2017-08-31 14:48:05.747191500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .url
>>>>>>>>>>>> 2017-08-31 14:48:05.747192500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .uu
>>>>>>>>>>>> 2017-08-31 14:48:05.747195500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .uue
>>>>>>>>>>>> 2017-08-31 14:48:05.747196500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .vb
>>>>>>>>>>>> 2017-08-31 14:48:05.747197500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .vbe
>>>>>>>>>>>> 2017-08-31 14:48:05.747197500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .vbs
>>>>>>>>>>>> 2017-08-31 14:48:05.747198500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .wsc
>>>>>>>>>>>> 2017-08-31 14:48:05.747198500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .wsf
>>>>>>>>>>>> 2017-08-31 14:48:05.747202500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .wsh
>>>>>>>>>>>> 2017-08-31 14:48:05.747208500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .xxe
>>>>>>>>>>>> 2017-08-31 14:48:05.747209500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .docm
>>>>>>>>>>>> 2017-08-31 14:48:05.747209500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .z
>>>>>>>>>>>> 2017-08-31 14:48:05.747210500 simscan: checking attachment 
>>>>>>>>>>>> textfile2 against .jar
>>>>>>>>>>>> 2017-08-31 14:48:05.747210500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .ace
>>>>>>>>>>>> 2017-08-31 14:48:05.747211500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .arc
>>>>>>>>>>>> 2017-08-31 14:48:05.747215500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .arj
>>>>>>>>>>>> 2017-08-31 14:48:05.747215500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .b64
>>>>>>>>>>>> 2017-08-31 14:48:05.747216500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .bat
>>>>>>>>>>>> 2017-08-31 14:48:05.747217500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .bhx
>>>>>>>>>>>> 2017-08-31 14:48:05.747218500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .cab
>>>>>>>>>>>> 2017-08-31 14:48:05.747221500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .chm
>>>>>>>>>>>> 2017-08-31 14:48:05.747222500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .com
>>>>>>>>>>>> 2017-08-31 14:48:05.747223500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .cpl
>>>>>>>>>>>> 2017-08-31 14:48:05.747224500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .dll
>>>>>>>>>>>> 2017-08-31 14:48:05.747224500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .exe
>>>>>>>>>>>> 2017-08-31 14:48:05.747230500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .gz
>>>>>>>>>>>> 2017-08-31 14:48:05.747231500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .hqx
>>>>>>>>>>>> 2017-08-31 14:48:05.747231500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .hta
>>>>>>>>>>>> 2017-08-31 14:48:05.747232500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .inf
>>>>>>>>>>>> 2017-08-31 14:48:05.747233500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .ins
>>>>>>>>>>>> 2017-08-31 14:48:05.747237500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .iso
>>>>>>>>>>>> 2017-08-31 14:48:05.747238500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .isp
>>>>>>>>>>>> 2017-08-31 14:48:05.747238500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .jse
>>>>>>>>>>>> 2017-08-31 14:48:05.747239500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .lib
>>>>>>>>>>>> 2017-08-31 14:48:05.747240500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .lnk
>>>>>>>>>>>> 2017-08-31 14:48:05.747243500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .lzh
>>>>>>>>>>>> 2017-08-31 14:48:05.747244500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .mim
>>>>>>>>>>>> 2017-08-31 14:48:05.747245500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .msp
>>>>>>>>>>>> 2017-08-31 14:48:05.747246500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .mst
>>>>>>>>>>>> 2017-08-31 14:48:05.747246500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .pif
>>>>>>>>>>>> 2017-08-31 14:48:05.747257500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .reg
>>>>>>>>>>>> 2017-08-31 14:48:05.747258500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .scf
>>>>>>>>>>>> 2017-08-31 14:48:05.747259500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .scr
>>>>>>>>>>>> 2017-08-31 14:48:05.747260500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .sct
>>>>>>>>>>>> 2017-08-31 14:48:05.747260500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .shb
>>>>>>>>>>>> 2017-08-31 14:48:05.747264500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .shs
>>>>>>>>>>>> 2017-08-31 14:48:05.747265500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .sys
>>>>>>>>>>>> 2017-08-31 14:48:05.747266500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .taz
>>>>>>>>>>>> 2017-08-31 14:48:05.747266500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .tgz
>>>>>>>>>>>> 2017-08-31 14:48:05.747267500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .tz
>>>>>>>>>>>> 2017-08-31 14:48:05.747271500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .url
>>>>>>>>>>>> 2017-08-31 14:48:05.747271500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .uu
>>>>>>>>>>>> 2017-08-31 14:48:05.747272500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .uue
>>>>>>>>>>>> 2017-08-31 14:48:05.747273500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .vb
>>>>>>>>>>>> 2017-08-31 14:48:05.747279500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .vbe
>>>>>>>>>>>> 2017-08-31 14:48:05.747280500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .vbs
>>>>>>>>>>>> 2017-08-31 14:48:05.747280500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .wsc
>>>>>>>>>>>> 2017-08-31 14:48:05.747281500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .wsf
>>>>>>>>>>>> 2017-08-31 14:48:05.747282500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .wsh
>>>>>>>>>>>> 2017-08-31 14:48:05.747285500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .xxe
>>>>>>>>>>>> 2017-08-31 14:48:05.747286500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .docm
>>>>>>>>>>>> 2017-08-31 14:48:05.747287500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .z
>>>>>>>>>>>> 2017-08-31 14:48:05.747288500 simscan: checking attachment 
>>>>>>>>>>>> msg.1504171085.205836.36767 against .jar
>>>>>>>>>>>> 2017-08-31 14:48:05.747289500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .ace
>>>>>>>>>>>> 2017-08-31 14:48:05.747292500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .arc
>>>>>>>>>>>> 2017-08-31 14:48:05.747293500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .arj
>>>>>>>>>>>> 2017-08-31 14:48:05.747294500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .b64
>>>>>>>>>>>> 2017-08-31 14:48:05.747294500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .bat
>>>>>>>>>>>> 2017-08-31 14:48:05.747295500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .bhx
>>>>>>>>>>>> 2017-08-31 14:48:05.747296500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .cab
>>>>>>>>>>>> 2017-08-31 14:48:05.747299500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .chm
>>>>>>>>>>>> 2017-08-31 14:48:05.747305500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .com
>>>>>>>>>>>> 2017-08-31 14:48:05.747305500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .cpl
>>>>>>>>>>>> 2017-08-31 14:48:05.747306500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .dll
>>>>>>>>>>>> 2017-08-31 14:48:05.747307500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .exe
>>>>>>>>>>>> 2017-08-31 14:48:05.747307500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .gz
>>>>>>>>>>>> 2017-08-31 14:48:05.747308500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .hqx
>>>>>>>>>>>> 2017-08-31 14:48:05.747311500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .hta
>>>>>>>>>>>> 2017-08-31 14:48:05.747312500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .inf
>>>>>>>>>>>> 2017-08-31 14:48:05.747312500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .ins
>>>>>>>>>>>> 2017-08-31 14:48:05.747313500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .iso
>>>>>>>>>>>> 2017-08-31 14:48:05.747314500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .isp
>>>>>>>>>>>> 2017-08-31 14:48:05.747314500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .jse
>>>>>>>>>>>> 2017-08-31 14:48:05.747318500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .lib
>>>>>>>>>>>> 2017-08-31 14:48:05.747318500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .lnk
>>>>>>>>>>>> 2017-08-31 14:48:05.747319500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .lzh
>>>>>>>>>>>> 2017-08-31 14:48:05.747320500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .mim
>>>>>>>>>>>> 2017-08-31 14:48:05.747320500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .msp
>>>>>>>>>>>> 2017-08-31 14:48:05.747321500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .mst
>>>>>>>>>>>> 2017-08-31 14:48:05.747328500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .pif
>>>>>>>>>>>> 2017-08-31 14:48:05.747329500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .reg
>>>>>>>>>>>> 2017-08-31 14:48:05.747335500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .scf
>>>>>>>>>>>> 2017-08-31 14:48:05.747336500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .scr
>>>>>>>>>>>> 2017-08-31 14:48:05.747336500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .sct
>>>>>>>>>>>> 2017-08-31 14:48:05.747337500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .shb
>>>>>>>>>>>> 2017-08-31 14:48:05.747338500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .shs
>>>>>>>>>>>> 2017-08-31 14:48:05.747338500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .sys
>>>>>>>>>>>> 2017-08-31 14:48:05.747342500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .taz
>>>>>>>>>>>> 2017-08-31 14:48:05.747342500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .tgz
>>>>>>>>>>>> 2017-08-31 14:48:05.747343500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .tz
>>>>>>>>>>>> 2017-08-31 14:48:05.747344500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .url
>>>>>>>>>>>> 2017-08-31 14:48:05.747344500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .uu
>>>>>>>>>>>> 2017-08-31 14:48:05.747345500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .uue
>>>>>>>>>>>> 2017-08-31 14:48:05.747349500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .vb
>>>>>>>>>>>> 2017-08-31 14:48:05.747349500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .vbe
>>>>>>>>>>>> 2017-08-31 14:48:05.747350500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .vbs
>>>>>>>>>>>> 2017-08-31 14:48:05.747350500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .wsc
>>>>>>>>>>>> 2017-08-31 14:48:05.747351500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .wsf
>>>>>>>>>>>> 2017-08-31 14:48:05.747352500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .wsh
>>>>>>>>>>>> 2017-08-31 14:48:05.747355500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .xxe
>>>>>>>>>>>> 2017-08-31 14:48:05.747361500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .docm
>>>>>>>>>>>> 2017-08-31 14:48:05.747362500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .z
>>>>>>>>>>>> 2017-08-31 14:48:05.747363500 simscan: checking attachment 
>>>>>>>>>>>> textfile0 against .jar
>>>>>>>>>>>> 2017-08-31 14:48:05.747363500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .ace
>>>>>>>>>>>> 2017-08-31 14:48:05.747364500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .arc
>>>>>>>>>>>> 2017-08-31 14:48:05.747365500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .arj
>>>>>>>>>>>> 2017-08-31 14:48:05.747368500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .b64
>>>>>>>>>>>> 2017-08-31 14:48:05.747369500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .bat
>>>>>>>>>>>> 2017-08-31 14:48:05.747370500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .bhx
>>>>>>>>>>>> 2017-08-31 14:48:05.747371500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .cab
>>>>>>>>>>>> 2017-08-31 14:48:05.747372500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .chm
>>>>>>>>>>>> 2017-08-31 14:48:05.747375500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .com
>>>>>>>>>>>> 2017-08-31 14:48:05.747376500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .cpl
>>>>>>>>>>>> 2017-08-31 14:48:05.747376500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .dll
>>>>>>>>>>>> 2017-08-31 14:48:05.747377500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .exe
>>>>>>>>>>>> 2017-08-31 14:48:05.747378500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .gz
>>>>>>>>>>>> 2017-08-31 14:48:05.747384500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .hqx
>>>>>>>>>>>> 2017-08-31 14:48:05.747385500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .hta
>>>>>>>>>>>> 2017-08-31 14:48:05.747385500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .inf
>>>>>>>>>>>> 2017-08-31 14:48:05.747386500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .ins
>>>>>>>>>>>> 2017-08-31 14:48:05.747387500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .iso
>>>>>>>>>>>> 2017-08-31 14:48:05.747391500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .isp
>>>>>>>>>>>> 2017-08-31 14:48:05.747392500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .jse
>>>>>>>>>>>> 2017-08-31 14:48:05.747392500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .lib
>>>>>>>>>>>> 2017-08-31 14:48:05.747393500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .lnk
>>>>>>>>>>>> 2017-08-31 14:48:05.747394500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .lzh
>>>>>>>>>>>> 2017-08-31 14:48:05.747402500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .mim
>>>>>>>>>>>> 2017-08-31 14:48:05.747403500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .msp
>>>>>>>>>>>> 2017-08-31 14:48:05.747403500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .mst
>>>>>>>>>>>> 2017-08-31 14:48:05.747404500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .pif
>>>>>>>>>>>> 2017-08-31 14:48:05.747410500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .reg
>>>>>>>>>>>> 2017-08-31 14:48:05.747411500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .scf
>>>>>>>>>>>> 2017-08-31 14:48:05.747412500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .scr
>>>>>>>>>>>> 2017-08-31 14:48:05.747412500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .sct
>>>>>>>>>>>> 2017-08-31 14:48:05.747413500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .shb
>>>>>>>>>>>> 2017-08-31 14:48:05.747417500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .shs
>>>>>>>>>>>> 2017-08-31 14:48:05.747418500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .sys
>>>>>>>>>>>> 2017-08-31 14:48:05.747418500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .taz
>>>>>>>>>>>> 2017-08-31 14:48:05.747419500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .tgz
>>>>>>>>>>>> 2017-08-31 14:48:05.747420500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .tz
>>>>>>>>>>>> 2017-08-31 14:48:05.747424500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .url
>>>>>>>>>>>> 2017-08-31 14:48:05.747425500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .uu
>>>>>>>>>>>> 2017-08-31 14:48:05.747426500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .uue
>>>>>>>>>>>> 2017-08-31 14:48:05.747426500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .vb
>>>>>>>>>>>> 2017-08-31 14:48:05.747432500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .vbe
>>>>>>>>>>>> 2017-08-31 14:48:05.747433500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .vbs
>>>>>>>>>>>> 2017-08-31 14:48:05.747434500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .wsc
>>>>>>>>>>>> 2017-08-31 14:48:05.747435500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .wsf
>>>>>>>>>>>> 2017-08-31 14:48:05.747435500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .wsh
>>>>>>>>>>>> 2017-08-31 14:48:05.747439500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .xxe
>>>>>>>>>>>> 2017-08-31 14:48:05.747440500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .docm
>>>>>>>>>>>> 2017-08-31 14:48:05.747441500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .z
>>>>>>>>>>>> 2017-08-31 14:48:05.747442500 simscan: checking attachment 
>>>>>>>>>>>> addr.1504171085.205836.36767 against .jar
>>>>>>>>>>>> 2017-08-31 14:48:05.747442500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .ace
>>>>>>>>>>>> 2017-08-31 14:48:05.747446500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .arc
>>>>>>>>>>>> 2017-08-31 14:48:05.747446500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .arj
>>>>>>>>>>>> 2017-08-31 14:48:05.747447500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .b64
>>>>>>>>>>>> 2017-08-31 14:48:05.747447500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .bat
>>>>>>>>>>>> 2017-08-31 14:48:05.747448500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .bhx
>>>>>>>>>>>> 2017-08-31 14:48:05.747449500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .cab
>>>>>>>>>>>> 2017-08-31 14:48:05.747452500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .chm
>>>>>>>>>>>> 2017-08-31 14:48:05.747458500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .com
>>>>>>>>>>>> 2017-08-31 14:48:05.747459500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .cpl
>>>>>>>>>>>> 2017-08-31 14:48:05.747460500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .dll
>>>>>>>>>>>> 2017-08-31 14:48:05.747460500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .exe
>>>>>>>>>>>> 2017-08-31 14:48:05.747461500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .gz
>>>>>>>>>>>> 2017-08-31 14:48:05.747461500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .hqx
>>>>>>>>>>>> 2017-08-31 14:48:05.747465500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .hta
>>>>>>>>>>>> 2017-08-31 14:48:05.747466500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .inf
>>>>>>>>>>>> 2017-08-31 14:48:05.747467500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .ins
>>>>>>>>>>>> 2017-08-31 14:48:05.747467500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .iso
>>>>>>>>>>>> 2017-08-31 14:48:05.747468500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .isp
>>>>>>>>>>>> 2017-08-31 14:48:05.747469500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .jse
>>>>>>>>>>>> 2017-08-31 14:48:05.747477500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .lib
>>>>>>>>>>>> 2017-08-31 14:48:05.747477500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .lnk
>>>>>>>>>>>> 2017-08-31 14:48:05.747478500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .lzh
>>>>>>>>>>>> 2017-08-31 14:48:05.747478500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .mim
>>>>>>>>>>>> 2017-08-31 14:48:05.747478500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .msp
>>>>>>>>>>>> 2017-08-31 14:48:05.747479500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .mst
>>>>>>>>>>>> 2017-08-31 14:48:05.747481500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .pif
>>>>>>>>>>>> 2017-08-31 14:48:05.747482500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .reg
>>>>>>>>>>>> 2017-08-31 14:48:05.747485500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .scf
>>>>>>>>>>>> 2017-08-31 14:48:05.747486500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .scr
>>>>>>>>>>>> 2017-08-31 14:48:05.747486500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .sct
>>>>>>>>>>>> 2017-08-31 14:48:05.747487500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .shb
>>>>>>>>>>>> 2017-08-31 14:48:05.747487500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .shs
>>>>>>>>>>>> 2017-08-31 14:48:05.747487500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .sys
>>>>>>>>>>>> 2017-08-31 14:48:05.747489500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .taz
>>>>>>>>>>>> 2017-08-31 14:48:05.747490500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .tgz
>>>>>>>>>>>> 2017-08-31 14:48:05.747490500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .tz
>>>>>>>>>>>> 2017-08-31 14:48:05.747491500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .url
>>>>>>>>>>>> 2017-08-31 14:48:05.747491500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .uu
>>>>>>>>>>>> 2017-08-31 14:48:05.747491500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .uue
>>>>>>>>>>>> 2017-08-31 14:48:05.747493500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .vb
>>>>>>>>>>>> 2017-08-31 14:48:05.747494500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .vbe
>>>>>>>>>>>> 2017-08-31 14:48:05.747494500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .vbs
>>>>>>>>>>>> 2017-08-31 14:48:05.747495500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .wsc
>>>>>>>>>>>> 2017-08-31 14:48:05.747495500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .wsf
>>>>>>>>>>>> 2017-08-31 14:48:05.747495500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .wsh
>>>>>>>>>>>> 2017-08-31 14:48:05.747497500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .xxe
>>>>>>>>>>>> 2017-08-31 14:48:05.747501500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .docm
>>>>>>>>>>>> 2017-08-31 14:48:05.747502500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .z
>>>>>>>>>>>> 2017-08-31 14:48:05.747502500 simscan: checking attachment 
>>>>>>>>>>>> textfile1 against .jar
>>>>>>>>>>>> 2017-08-31 14:48:05.747502500 simscan: cdb looking up version 
>>>>>>>>>>>> attach
>>>>>>>>>>>> 2017-08-31 14:48:05.747503500 simscan: runned_scanners is  attach: 
>>>>>>>>>>>> 1.4.0
>>>>>>>>>>>> 2017-08-31 14:48:05.747503500 simscan: found 1.4.0
>>>>>>>>>>>> 2017-08-31 14:48:05.747503500 simscan: calling clamdscan
>>>>>>>>>>>> 2017-08-31 14:48:05.753721500 simscan: clamdscan: 
>>>>>>>>>>>> /var/qmail/simscan/1504171085.205836.36767: OK
>>>>>>>>>>>> 2017-08-31 14:48:05.753754500 simscan: clamdscan:
>>>>>>>>>>>> 2017-08-31 14:48:05.753754500 simscan: clamdscan: ----------- SCAN 
>>>>>>>>>>>> SUMMARY -----------
>>>>>>>>>>>> 2017-08-31 14:48:05.753768500 simscan: clamdscan: Infected files: 0
>>>>>>>>>>>> 2017-08-31 14:48:05.753771500 simscan: clamdscan: Time: 0.004 sec 
>>>>>>>>>>>> (0 m 0 s)
>>>>>>>>>>>> 2017-08-31 14:48:05.753957500 simscan: cdb looking up version 
>>>>>>>>>>>> clamav
>>>>>>>>>>>> 2017-08-31 14:48:05.753968500 simscan: runned_scanners is  attach: 
>>>>>>>>>>>> 1.4.0 clamav: 0.98.6/m:
>>>>>>>>>>>> 2017-08-31 14:48:05.753969500 simscan: found 0.98.6/m:
>>>>>>>>>>>> 2017-08-31 14:48:05.753974500 simscan: normal clamdscan return 
>>>>>>>>>>>> code: 0
>>>>>>>>>>>> 2017-08-31 14:48:05.753994500 simscan: calling spamc
>>>>>>>>>>>> 2017-08-31 14:48:05.754001500 simscan: calling /usr/bin/spamc  
>>>>>>>>>>>> spamc
>>>>>>>>>>>> 2017-08-31 14:48:05.754010500 simscan: check_spam had an error 
>>>>>>>>>>>> ret: -1
>>>>>>>>>>>> 2017-08-31 14:48:05.754101500 simscan: exit error code: 71
>>>>>>>>>>>> 2017-08-31 14:48:05.754220500 qmail-smtpd: qq soft reject (mail 
>>>>>>>>>>>> server temporarily rejected message (#4.3.0)): 
>>>>>>>>>>>> MAILFROM:<sunil.saharan@@yyyy.com>   RCPTTO:[email protected]
>>>>>>>>>>>> 2017-08-31 14:48:05.755317500 tcpserver: end 36645 status 0
>>>>>>>>>>>>
>>>>>>>>>>>> ##################
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>> 2017-08-31 14:48:05.956040500 simscan: cdb 
>>>>>>>>>>>> [email protected]
>>>>>>>>>>>> 2017-08-31 14:48:05.956041500 simscan: pelookup: 
>>>>>>>>>>>> [email protected]
>>>>>>>>>>>> 2017-08-31 14:48:05.956042500 simscan: pelookup: domain is 
>>>>>>>>>>>> radiant-india.net
>>>>>>>>>>>> 2017-08-31 14:48:05.956042500 simscan: cdb looking up 
>>>>>>>>>>>> radiant-india.net
>>>>>>>>>>>> 2017-08-31 14:48:05.956043500 simscan: cdb for radiant-india.net 
>>>>>>>>>>>> found 
>>>>>>>>>>>> clam=yes,spam=yes,spam_hits=30,spam_passthru=yes,attach=.ace:.arc:.arj:.b64:.bat:.bhx:.cab:.chm:.com:.cpl:.dll:.exe:.gz:.hqx:.hta:.inf:.ins:.iso:.isp:.jse:.lib:.lnk:.lzh:.mim:.msp:.mst:.pif:.reg:.scf:.scr:.sct:.shb:.shs:.sys:.taz:.tgz:.tz:.url:.uu:.uue:.vb:.vbe:.vbs:.wsc:.wsf:.wsh:.xxe:.docm:.z:.jar
>>>>>>>>>>>> 2017-08-31 14:48:05.956049500 simscan: pelookup clam = yes
>>>>>>>>>>>> 2017-08-31 14:48:05.956049500 simscan: pelookup spam = yes
>>>>>>>>>>>> 2017-08-31 14:48:05.956050500 simscan: pelookup spam_hits = 30
>>>>>>>>>>>> 2017-08-31 14:48:05.956053500 simscan: Per Domain Hits set to : 
>>>>>>>>>>>> 30.000000
>>>>>>>>>>>> 2017-08-31 14:48:05.956053500 simscan: pelookup spam_passthru = yes
>>>>>>>>>>>> 2017-08-31 14:48:05.956059500 simscan: unimplemented flag 
>>>>>>>>>>>> spam_passthru = yes
>>>>>>>>>>>> 2017-08-31 14:48:05.956060500 simscan: pelookup attach = 
>>>>>>>>>>>> .ace:.arc:.arj:.b64:.bat:.bhx:.cab:.chm:.com:.cpl:.dll:.exe:.gz:.hqx:.hta:.inf:.ins:.iso:.isp:.jse:.lib:.lnk:.lzh:.mim:.msp:.mst:.pif:.reg:.scf:.scr:.sct:.shb:.shs:.sys:.taz:.tgz:.tz:.url:.uu:.uue:.vb:.vbe:.vbs:.wsc:.wsf:.wsh:.xxe:.docm:.z:.jar
>>>>>>>>>>>> 2017-08-31 14:48:05.956062500 simscan: attachment flag attach = 
>>>>>>>>>>>> .ace:.arc:.arj:.b64:.bat:.bhx:.cab:.chm:.com:.cpl:.dll:.exe:.gz:.hqx:.hta:.inf:.ins:.iso:.isp:.jse:.lib:.lnk:.lzh:.mim:.msp:.mst:.pif:.reg:.scf:.scr:.sct:.shb:.shs:.sys:.taz:.tgz:.tz:.url:.uu:.uue:.vb:.vbe:.vbs:.wsc:.wsf:.wsh:.xxe:.docm:.z:.jar
>>>>>>>>>>>> 2017-08-31 14:48:05.956074500 simscan: add_attach called with 
>>>>>>>>>>>> .ace:.arc:.arj:.b64:.bat:.bhx:.cab:.chm:.com:.cpl:.dll:.exe:.gz:.hqx:.hta:.inf:.ins:.iso:.isp:.jse:.lib:.lnk:.lzh:.mim:.msp:.mst:.pif:.reg:.scf:.scr:.sct:.shb:.shs:.sys:.taz:.tgz:.tz:.url:.uu:.uue:.vb:.vbe:.vbs:.wsc:.wsf:.wsh:.xxe:.docm:.z:.jar
>>>>>>>>>>>> 2017-08-31 14:48:05.956079500 simscan: .ace is attachment number 0
>>>>>>>>>>>> 2017-08-31 14:48:05.956080500 simscan: .arc is attachment number 1
>>>>>>>>>>>> 2017-08-31 14:48:05.956081500 simscan: .arj is attachment number 2
>>>>>>>>>>>> 2017-08-31 14:48:05.956081500 simscan: .b64 is attachment number 3
>>>>>>>>>>>> 2017-08-31 14:48:05.956087500 simscan: .bat is attachment number 4
>>>>>>>>>>>> 2017-08-31 14:48:05.956087500 simscan: .bhx is attachment number 5
>>>>>>>>>>>> 2017-08-31 14:48:05.956088500 simscan: .cab is attachment number 6
>>>>>>>>>>>> 2017-08-31 14:48:05.956088500 simscan: .chm is attachment number 7
>>>>>>>>>>>> 2017-08-31 14:48:05.956089500 simscan: .com is attachment number 8
>>>>>>>>>>>> 2017-08-31 14:48:05.956089500 simscan: .cpl is attachment number 9
>>>>>>>>>>>> 2017-08-31 14:48:05.956090500 simscan: .dll is attachment number 10
>>>>>>>>>>>> 2017-08-31 14:48:05.956090500 simscan: .exe is attachment number 11
>>>>>>>>>>>> 2017-08-31 14:48:05.956094500 simscan: .gz is attachment number 12
>>>>>>>>>>>> 2017-08-31 14:48:05.956094500 simscan: .hqx is attachment number 13
>>>>>>>>>>>> 2017-08-31 14:48:05.956095500 simscan: .hta is attachment number 14
>>>>>>>>>>>> 2017-08-31 14:48:05.956095500 simscan: .inf is attachment number 15
>>>>>>>>>>>> 2017-08-31 14:48:05.956096500 simscan: .ins is attachment number 16
>>>>>>>>>>>> 2017-08-31 14:48:05.956096500 simscan: .iso is attachment number 17
>>>>>>>>>>>> 2017-08-31 14:48:05.956097500 simscan: .isp is attachment number 18
>>>>>>>>>>>> 2017-08-31 14:48:05.956097500 simscan: .jse is attachment number 19
>>>>>>>>>>>> 2017-08-31 14:48:05.956106500 simscan: .lib is attachment number 20
>>>>>>>>>>>> 2017-08-31 14:48:05.956106500 simscan: .lnk is attachment number 21
>>>>>>>>>>>> 2017-08-31 14:48:05.956107500 simscan: .lzh is attachment number 22
>>>>>>>>>>>> 2017-08-31 14:48:05.956107500 simscan: .mim is attachment number 23
>>>>>>>>>>>> 2017-08-31 14:48:05.956108500 simscan: .msp is attachment number 24
>>>>>>>>>>>> 2017-08-31 14:48:05.956108500 simscan: .mst is attachment number 25
>>>>>>>>>>>> 2017-08-31 14:48:05.956109500 simscan: .pif is attachment number 26
>>>>>>>>>>>> 2017-08-31 14:48:05.956109500 simscan: .reg is attachment number 27
>>>>>>>>>>>> 2017-08-31 14:48:05.956113500 simscan: .scf is attachment number 28
>>>>>>>>>>>> 2017-08-31 14:48:05.956113500 simscan: .scr is attachment number 29
>>>>>>>>>>>> 2017-08-31 14:48:05.956114500 simscan: .sct is attachment number 30
>>>>>>>>>>>> 2017-08-31 14:48:05.956120500 simscan: .shb is attachment number 31
>>>>>>>>>>>> 2017-08-31 14:48:05.956121500 simscan: .shs is attachment number 32
>>>>>>>>>>>> 2017-08-31 14:48:05.956121500 simscan: .sys is attachment number 33
>>>>>>>>>>>> 2017-08-31 14:48:05.956122500 simscan: .taz is attachment number 34
>>>>>>>>>>>> 2017-08-31 14:48:05.956122500 simscan: .tgz is attachment number 35
>>>>>>>>>>>> 2017-08-31 14:48:05.956123500 simscan: .tz is attachment number 36
>>>>>>>>>>>> 2017-08-31 14:48:05.956123500 simscan: .url is attachment number 37
>>>>>>>>>>>> 2017-08-31 14:48:05.956124500 simscan: .uu is attachment number 38
>>>>>>>>>>>> 2017-08-31 14:48:05.956127500 simscan: .uue is attachment number 39
>>>>>>>>>>>> 2017-08-31 14:48:05.956128500 simscan: .vb is attachment number 40
>>>>>>>>>>>> 2017-08-31 14:48:05.956128500 simscan: .vbe is attachment number 41
>>>>>>>>>>>> 2017-08-31 14:48:05.956129500 simscan: .vbs is attachment number 42
>>>>>>>>>>>> 2017-08-31 14:48:05.956129500 simscan: .wsc is attachment number 43
>>>>>>>>>>>> 2017-08-31 14:48:05.956130500 simscan: .wsf is attachment number 44
>>>>>>>>>>>> 2017-08-31 14:48:05.956130500 simscan: .wsh is attachment number 45
>>>>>>>>>>>> 2017-08-31 14:48:05.956131500 simscan: .xxe is attachment number 46
>>>>>>>>>>>> 2017-08-31 14:48:05.956134500 simscan: .docm is attachment number 
>>>>>>>>>>>> 47
>>>>>>>>>>>> 2017-08-31 14:48:05.956134500 simscan: .z is attachment number 48
>>>>>>>>>>>> 2017-08-31 14:48:05.956135500 simscan: .jar is attachment number 49
>>>>>>>>>>>> 2017-08-31 14:48:05.956136500 simscan: pelookup: local part is 
>>>>>>>>>>>> inv1mum
>>>>>>>>>>>> 2017-08-31 14:48:05.956136500 simscan: lpart: local part is **
>>>>>>>>>>>> 2017-08-31 14:48:05.956137500 simscan: cdb 
>>>>>>>>>>>> [email protected]
>>>>>>>>>>>> 2017-08-31 14:48:05.956137500 simscan: ripmime error
>>>>>>>>>>>> 2017-08-31 14:48:05.956138500 simscan: exit error code: 71
>>>>>>>>>>>> 2017-08-31 14:48:05.956144500 qmail-smtpd: qq soft reject (mail 
>>>>>>>>>>>> server temporarily rejected message (#4.3.0)): 
>>>>>>>>>>>> MAILFROM:<[email protected]>   RCPTTO:[email protected]
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>> thanks
>>>>>>>>>>>> rajesh
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>> ---------------------------------------------------------------------
>>>>>>>>>>>> To 
>>>>>>>>>>>> unsubscribe,e-mail:[email protected]
>>>>>>>>>>>> For additional 
>>>>>>>>>>>> commands,e-mail:[email protected]
>>>>>>>>>>> ---------------------------------------------------------------------
>>>>>>>>>>> To unsubscribe,e-mail:[email protected]
>>>>>>>>>>> For additional 
>>>>>>>>>>> commands,e-mail:[email protected]
>>>>>>>>>> ---------------------------------------------------------------------
>>>>>>>>>> To unsubscribe,e-mail:[email protected]
>>>>>>>>>> For additional 
>>>>>>>>>> commands,e-mail:[email protected]
>>>>>>>>> ---------------------------------------------------------------------
>>>>>>>>> To unsubscribe,e-mail:[email protected]
>>>>>>>>> For additional commands,e-mail:[email protected]
>>>>>>>> --
>>>>>>>> Eric Broch
>>>>>>>> White Horse Technical Consulting (WHTC)
>>>>>> --
>>>>>> Eric Broch
>>>>>> White Horse Technical Consulting (WHTC)
>>>>> --
>>>>> Eric Broch
>>>>> White Horse Technical Consulting (WHTC)
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail:[email protected]
>>> For additional commands, e-mail:[email protected]
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail:[email protected]
>> For additional commands, e-mail:[email protected]
>
> --
> Eric Broch
> White Horse Technical Consulting (WHTC)

--
Eric Broch
White Horse Technical Consulting (WHTC)



---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to