['Dr. Web Security Space ', 'drweb-ctl', 'checkmail {}',qr/^Reject/m,, qr/^(?:infected with:\s+(.+)/m ],
Have a look at [1]. - Both your patterns anchor at beginning of line. - A clean mail would not match "Reject" anywhere, but you defined it for the "clean" pattern. [1] https://gitlab.com/amavis/amavis/-/blob/master/lib/Amavis/AV.pm#L960-997
