this is simscan log in detail...
from [EMAIL PROTECTED] sent email to [EMAIL PROTECTED] (same domain) with extension .pif,
the server/simcan still accept that message but sometimes from outside.
i'm still figure it why.
@4000000043cf6cb603d8eaac simscan: cdb looking up
@4000000043cf6cb603da714c simscan: cdb for found clam=yes,spam=yes,spam_passthru=yes,attach=.vbs:.lnk:.scr:.wsh:.hta:.pif:.com:.exe:.dll:.wma:.mov:.avi:.mpeg:.mp3:.wma:.mpa:.mpe:.qt:.ra:.ram:.mim:.mpg:.pIf:.HQX:.hqx:.BHX
@4000000043cf6cb603dabb84 simscan: pelookup clam = yes
@4000000043cf6cb603dac73c simscan: pelookup spam = yes
@4000000043cf6cb603dacf0c simscan: pelookup spam_passthru = yes
@4000000043cf6cb603db155c simscan: spampassthru = yes/1
@4000000043cf6cb603db2114 simscan: pelookup attach = .vbs:.lnk:.scr:.wsh:.hta:.pif:.com:.exe:.dll:.wma:.mov:.avi:.mpeg:.mp3:.wma:.mpa:.mpe:.qt:.ra:.ram:.mim:.mpg:.pIf:.HQX:.hqx:.BHX
@4000000043cf6cb603db30b4 simscan: attachment flag attach = .vbs:.lnk:.scr:.wsh:.hta:.pif:.com:.exe:.dll:.wma:.mov:.avi:.mpeg:.mp3:.wma:.mpa:.mpe:.qt:.ra:.ram:.mim:.mpg:.pIf:.HQX:.hqx:.BHX
@4000000043cf6cb603dc26cc simscan: .vbs is attachment number 0
@4000000043cf6cb603dc3284 simscan: .lnk is attachment number 1
@4000000043cf6cb603dc3a54 simscan: .scr is attachment number 2
@4000000043cf6cb603dc4224 simscan: .wsh is attachment number 3
@4000000043cf6cb603dc49f4 simscan: .hta is attachment number 4
@4000000043cf6cb603dc51c4 simscan: .pif is attachment number 5
@4000000043cf6cb603dc5994 simscan: .com is attachment number 6
@4000000043cf6cb603dc6164 simscan: .exe is attachment number 7
@4000000043cf6cb603dc6934 simscan: .dll is attachment number 8
@4000000043cf6cb603dc942c simscan: .wma is attachment number 9
@4000000043cf6cb603dc9bfc simscan: .mov is attachment number 10
@4000000043cf6cb603dca3cc simscan: .avi is attachment number 11
@4000000043cf6cb603dcab9c simscan: .mpeg is attachment number 12
@4000000043cf6cb603dcb36c simscan: .mp3 is attachment number 13
@4000000043cf6cb603dcbb3c simscan: .wma is attachment number 14
@4000000043cf6cb603dcc30c simscan: .mpa is attachment number 15
@4000000043cf6cb603dccadc simscan: .mpe is attachment number 16
@4000000043cf6cb603dcf1ec simscan: .qt is attachment number 17
@4000000043cf6cb603dcf9bc simscan: .ra is attachment number 18
@4000000043cf6cb603dd018c simscan: .ram is attachment number 19
@4000000043cf6cb603dd0d44 simscan: .mim is attachment number 20
@4000000043cf6cb603dd18fc simscan: .mpg is attachment number 21
@4000000043cf6cb603dd577c simscan: .pIf is attachment number 22
@4000000043cf6cb603dd5f4c simscan: .HQX is attachment number 23
@4000000043cf6cb603dd671c simscan: .hqx is attachment number 24
@4000000043cf6cb603dd6eec simscan: .BHX is attachment number 25
@4000000043cf6cb603dd76bc simscan: starting: work dir: /var/qmail/simscan/1137667244.64766.1824
@4000000043cf6cb613e2724c tcpserver: end 1823 status 256
@4000000043cf6cb613e2d00c simscan: pelookup: called with
@4000000043cf6cb613e2dbc4 simscan: WARN: no domain part found!
@4000000043cf6cb613e2e394 simscan: pelookup: local part is
@4000000043cf6cb613e32214 simscan: cdb looking up @
@4000000043cf6cb613e39744 tcpserver: status: 0/20
@4000000043cf6cb613f5d33c simscan: cdb looking up version attach
@4000000043cf6cb613f67364 simscan: calling clamdscan
@4000000043cf6cb61433d254 simscan: cdb looking up version clamav
@4000000043cf6cb614344b6c simscan: normal clamdscan return code: 0
@4000000043cf6cb61434f364 simscan: calling spamc
@4000000043cf6cb6143531e4 simscan: calling /usr/bin/spamc spamc
@4000000043cf6cb91c44bf6c tcpserver: status: 1/20
@4000000043cf6cb91c44cb24 tcpserver: pid 1835 from xx.xx.xx.xx
@4000000043cf6cb91c44d2f4 tcpserver: ok 1835 0:xx.xx.xx.xx:25 :xx.xx.xx.xx::41648
@4000000043cf6cb91c7f8e1c CHKUSER accepted rcpt: from < [EMAIL PROTECTED]::> remote <mx.domain.com:unknown:xx.xx.xx.xx> rcpt <[EMAIL PROTECTED]> : found existing recipient
@4000000043cf6cb91e24c23c tcpserver: end 1835 status 0
@4000000043cf6cb91e24cdf4 tcpserver: status: 0/20
@4000000043cf6cbc1eb6443c simscan: cdb looking up version spam
@4000000043cf6cbc1eb7654c simscan: done, execing qmail-queue
@4000000043cf6cbc1eff2c4c simscan: qmail-queue exited 54
@4000000043cf6cb603da714c simscan: cdb for found clam=yes,spam=yes,spam_passthru=yes,attach=.vbs:.lnk:.scr:.wsh:.hta:.pif:.com:.exe:.dll:.wma:.mov:.avi:.mpeg:.mp3:.wma:.mpa:.mpe:.qt:.ra:.ram:.mim:.mpg:.pIf:.HQX:.hqx:.BHX
@4000000043cf6cb603dabb84 simscan: pelookup clam = yes
@4000000043cf6cb603dac73c simscan: pelookup spam = yes
@4000000043cf6cb603dacf0c simscan: pelookup spam_passthru = yes
@4000000043cf6cb603db155c simscan: spampassthru = yes/1
@4000000043cf6cb603db2114 simscan: pelookup attach = .vbs:.lnk:.scr:.wsh:.hta:.pif:.com:.exe:.dll:.wma:.mov:.avi:.mpeg:.mp3:.wma:.mpa:.mpe:.qt:.ra:.ram:.mim:.mpg:.pIf:.HQX:.hqx:.BHX
@4000000043cf6cb603db30b4 simscan: attachment flag attach = .vbs:.lnk:.scr:.wsh:.hta:.pif:.com:.exe:.dll:.wma:.mov:.avi:.mpeg:.mp3:.wma:.mpa:.mpe:.qt:.ra:.ram:.mim:.mpg:.pIf:.HQX:.hqx:.BHX
@4000000043cf6cb603dc26cc simscan: .vbs is attachment number 0
@4000000043cf6cb603dc3284 simscan: .lnk is attachment number 1
@4000000043cf6cb603dc3a54 simscan: .scr is attachment number 2
@4000000043cf6cb603dc4224 simscan: .wsh is attachment number 3
@4000000043cf6cb603dc49f4 simscan: .hta is attachment number 4
@4000000043cf6cb603dc51c4 simscan: .pif is attachment number 5
@4000000043cf6cb603dc5994 simscan: .com is attachment number 6
@4000000043cf6cb603dc6164 simscan: .exe is attachment number 7
@4000000043cf6cb603dc6934 simscan: .dll is attachment number 8
@4000000043cf6cb603dc942c simscan: .wma is attachment number 9
@4000000043cf6cb603dc9bfc simscan: .mov is attachment number 10
@4000000043cf6cb603dca3cc simscan: .avi is attachment number 11
@4000000043cf6cb603dcab9c simscan: .mpeg is attachment number 12
@4000000043cf6cb603dcb36c simscan: .mp3 is attachment number 13
@4000000043cf6cb603dcbb3c simscan: .wma is attachment number 14
@4000000043cf6cb603dcc30c simscan: .mpa is attachment number 15
@4000000043cf6cb603dccadc simscan: .mpe is attachment number 16
@4000000043cf6cb603dcf1ec simscan: .qt is attachment number 17
@4000000043cf6cb603dcf9bc simscan: .ra is attachment number 18
@4000000043cf6cb603dd018c simscan: .ram is attachment number 19
@4000000043cf6cb603dd0d44 simscan: .mim is attachment number 20
@4000000043cf6cb603dd18fc simscan: .mpg is attachment number 21
@4000000043cf6cb603dd577c simscan: .pIf is attachment number 22
@4000000043cf6cb603dd5f4c simscan: .HQX is attachment number 23
@4000000043cf6cb603dd671c simscan: .hqx is attachment number 24
@4000000043cf6cb603dd6eec simscan: .BHX is attachment number 25
@4000000043cf6cb603dd76bc simscan: starting: work dir: /var/qmail/simscan/1137667244.64766.1824
@4000000043cf6cb613e2724c tcpserver: end 1823 status 256
@4000000043cf6cb613e2d00c simscan: pelookup: called with
@4000000043cf6cb613e2dbc4 simscan: WARN: no domain part found!
@4000000043cf6cb613e2e394 simscan: pelookup: local part is
@4000000043cf6cb613e32214 simscan: cdb looking up @
@4000000043cf6cb613e39744 tcpserver: status: 0/20
@4000000043cf6cb613f5d33c simscan: cdb looking up version attach
@4000000043cf6cb613f67364 simscan: calling clamdscan
@4000000043cf6cb61433d254 simscan: cdb looking up version clamav
@4000000043cf6cb614344b6c simscan: normal clamdscan return code: 0
@4000000043cf6cb61434f364 simscan: calling spamc
@4000000043cf6cb6143531e4 simscan: calling /usr/bin/spamc spamc
@4000000043cf6cb91c44bf6c tcpserver: status: 1/20
@4000000043cf6cb91c44cb24 tcpserver: pid 1835 from xx.xx.xx.xx
@4000000043cf6cb91c44d2f4 tcpserver: ok 1835 0:xx.xx.xx.xx:25 :xx.xx.xx.xx::41648
@4000000043cf6cb91c7f8e1c CHKUSER accepted rcpt: from < [EMAIL PROTECTED]::> remote <mx.domain.com:unknown:xx.xx.xx.xx> rcpt <[EMAIL PROTECTED]> : found existing recipient
@4000000043cf6cb91e24c23c tcpserver: end 1835 status 0
@4000000043cf6cb91e24cdf4 tcpserver: status: 0/20
@4000000043cf6cbc1eb6443c simscan: cdb looking up version spam
@4000000043cf6cbc1eb7654c simscan: done, execing qmail-queue
@4000000043cf6cbc1eff2c4c simscan: qmail-queue exited 54
regards,
aimmix
