It does not appear that the message makes it to clamd or spamd.
On Apr 4, 2007, at 6:33 PM, Alexey Amerik wrote:
2007-04-04 18:26:44.830410500 CHKUSER accepted sender: from
<[EMAIL PROTECTED]::> remote <wx-out-0506.google.com:unknown:
66.249.82.227> rcpt <> : sender accepted
2007-04-04 18:26:45.087796500 CHKUSER accepted rcpt: from
<[EMAIL PROTECTED]::> remote <wx-out-0506.google.com:unknown:
66.249.82.227> rcpt <[EMAIL PROTECTED]> : found existing
recipient
2007-04-04 18:26:45.155187500 simscan: cdb looking up
2007-04-04 18:26:45.155290500 simscan: cdb for found
clam=yes,spam=yes,spam_passthru=yes,attach=.vbs:.lnk:.scr:.wsh:.hta:.p
if
2007-04-04 18:26:45.155343500 simscan: pelookup clam = yes
2007-04-04 18:26:45.155365500 simscan: pelookup spam = yes
2007-04-04 18:26:45.155383500 simscan: pelookup spam_passthru = yes
2007-04-04 18:26:45.155406500 simscan: spampassthru = yes/1
2007-04-04 18:26:45.155423500 simscan: pelookup attach
= .vbs:.lnk:.scr:.wsh:.hta:.pif
2007-04-04 18:26:45.155441500 simscan: attachment flag attach
= .vbs:.lnk:.scr:.wsh:.hta:.pif
2007-04-04 18:26:45.155468500 simscan: .vbs is attachment number 0
2007-04-04 18:26:45.155486500 simscan: .lnk is attachment number 1
2007-04-04 18:26:45.155503500 simscan: .scr is attachment number 2
2007-04-04 18:26:45.155521500 simscan: .wsh is attachment number 3
2007-04-04 18:26:45.155538500 simscan: .hta is attachment number 4
2007-04-04 18:26:45.155555500 simscan: .pif is attachment number 5
2007-04-04 18:26:45.155590500 simscan: starting: work dir: /var/
qmail/simscan/1175725605.155567.6415
thats the last message I see in smtpd/current log,
turning to pid list, I see this clamav 6415 0.0 0.0 1696
444 ? S 18:26 0:00 /var/qmail/bin/simscan
total other simscan pid's:
clamav 31820 0.0 0.0 1696 444 ? S 18:04 0:00 /var/
qmail/bin/simscan
clamav 32614 0.0 0.0 1696 444 ? S 18:08 0:00 /var/
qmail/bin/simscan
clamav 501 0.0 0.0 1696 444 ? S 18:09 0:00 /var/
qmail/bin/simscan
clamav 708 0.0 0.0 1696 444 ? S 18:09 0:00 /var/
qmail/bin/simscan
clamav 1469 0.0 0.0 1696 444 ? S 18:12 0:00 /var/
qmail/bin/simscan
clamav 4938 0.0 0.0 1696 444 ? S 18:22 0:00 /var/
qmail/bin/simscan
clamav 6415 0.0 0.0 1696 444 ? S 18:26 0:00 /var/
qmail/bin/simscan
clamav 7000 0.0 0.0 1696 444 ? S 18:28 0:00 /var/
qmail/bin/simscan
clamav 7352 0.0 0.0 1696 444 ? S 18:29 0:00 /var/
qmail/bin/simscan
