Вот нормально работает:
2019-Sep-30 13:55:14 [AS-2388] Debug: Vaderetro API: serial 1, protocol info=helo: "mail.xxxx.ru" inet: "zzz.zzz.zzz.zzz.106:36806" mailfrom: "valex@xxxx.ru" rcptto: "valex@nnnn.ru"
2019-Sep-30 13:55:14 [AS-2388] Debug: Vaderetro API: serial 1, score=0, spam_state=0, details=gggruggvucftvghtrhhoucdtuddrgedufedrgedvucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecufffthgfgueenuceurghilhhouhhtmecufedttdenucenucfjughrpefvhffukffffgggtgesmhdtreertdefjeenucfhrhhomheptehlvgigucggvgguuhhtihhnuceovhgrlhgvgiesthgurdgvthhrrdhruheqnecukfhppedujeeirdduudekrddvuddtrddutdeipdelhedrkeefrddukeelrdehtdenucfrrghrrghmpehhvghlohepmhgrihhlrdhtugdrvghtrhdrrhhupdhinhgvthepudejiedruddukedrvddutddruddtieemfeeikedtiedpmhgrihhlfhhrohhmpehvrghlvgigsehtugdrvghtrhdrrhhupdhrtghpthhtohepvhgrlhgvgiesrhihrgiirghnghhovhdrrhhunecuvehluhhsthgvrhfuihiivgeptd, version=Vade Retro 01.413.42 AS+AV+AP+RT Profile: DRWEB; Bailout: 300
2019-Sep-30 13:55:14 [NC-2438] Debug: Local client 0xf: INIT 3 as Job 0x1fb
2019-Sep-30 13:55:14 [NC-2438] Debug: Weight local: 297308954562 1 0 0 0 0 0
2019-Sep-30 13:55:14 [NC-2438] Debug: LocalJob 0x1f7: File "/var/opt/drweb.com/tmp/com.drweb.ncheck/f8fd-eba2-6f5f-cdd0"
2019-Sep-30 13:55:14 [NC-2438] Debug: Job 0x1fb: Use job: LocalJob 0x1f7
2019-Sep-30 13:55:14 [NC-2438] Debug: LocalJob 0x1f7: Scan
2019-Sep-30 13:55:14 [SE-2474] F-10926: Debug: Regular scan: run
2019-Sep-30 13:55:14 [SE-2474] F-10926: Debug: Shell: using system IO
2019-Sep-30 13:55:14 [SE-2474] F-10926: Info: Scan "/var/opt/drweb.com/tmp/com.drweb.ncheck/f8fd-eba2-6f5f-cdd0"
2019-Sep-30 13:55:14 [SE-2474] F-10926: Debug: Regular scan: reporting
2019-Sep-30 13:55:14 [SE-2474] F-10926: Debug: Engine fork: scan finished
2019-Sep-30 13:55:14 [NC-2438] Debug: LocalJob 0x1f7: Scan report received
2019-Sep-30 13:55:14 [NC-2438] Debug: LocalJob 0x1f7: Unlock after scanning
2019-Sep-30 13:55:14 [NC-2438] Debug: Job 0x1fb: Reset
2019-Sep-30 13:55:14 [NC-2438] Debug: LocalJob 0x1f7: Destroyed
2019-Sep-30 13:55:14 [NC-2438] Debug: Job 0x1fb: Destroyed
2019-Sep-30 13:55:14 [NC-2438] Debug: Local client 0xf: INIT 3 as Job 0x1fc
2019-Sep-30 13:55:14 [NC-2438] Debug: Weight local: 297308957828 1 0 0 0 1 0
2019-Sep-30 13:55:14 [NC-2438] Debug: LocalJob 0x1f8: File "/var/opt/drweb.com/tmp/com.drweb.ncheck/3873-d627-e09d-10e4"
2019-Sep-30 13:55:14 [NC-2438] Debug: Job 0x1fc: Use job: LocalJob 0x1f8
2019-Sep-30 13:55:14 [NC-2438] Debug: LocalJob 0x1f8: Scan
2019-Sep-30 13:55:14 [SE-2474] F-10926: Debug: Regular scan: run
2019-Sep-30 13:55:14 [SE-2474] F-10926: Debug: Shell: using system IO
2019-Sep-30 13:55:14 [SE-2474] F-10926: Info: Scan "/var/opt/drweb.com/tmp/com.drweb.ncheck/3873-d627-e09d-10e4"
2019-Sep-30 13:55:14 [SE-2474] F-10926: Debug: DrWebCallDwShieldEx: command is not implemented: 16
2019-Sep-30 13:55:14 [SE-2474] F-10926: Debug: Regular scan: reporting
2019-Sep-30 13:55:14 [SE-2474] F-10926: Debug: Engine fork: scan finished
2019-Sep-30 13:55:14 [NC-2438] Debug: LocalJob 0x1f8: Scan report received
2019-Sep-30 13:55:14 [NC-2438] Debug: LocalJob 0x1f8: Unlock after scanning
2019-Sep-30 13:55:14 [NC-2438] Debug: Job 0x1fc: Reset
2019-Sep-30 13:55:14 [NC-2438] Debug: LocalJob 0x1f8: Destroyed
2019-Sep-30 13:55:14 [NC-2438] Debug: Job 0x1fc: Destroyed
2019-Sep-30 13:55:14 [MD-1681] Notice: Milter client cd1a-1e35-d3a5: Lua: Trojan.SpyBot.699 found in Акт понедельник.001
2019-Sep-30 13:55:14 [1058] Debug: Net incident: origin: APP_MAILD origin_pid: 1681 mail_incident { socket { address: "zzz.zzz.zzz.zzz.106" port: 36806 } mail_from: "valex@xxxx.ru" rcpt_to: "valex@nnnn.ru" viruses { scan_report { object: "/var/opt/drweb.com/tmp/com.drweb.ncheck/3873-d627-e09d-10e4" size: 55877 archive { type: SE_ARCHIVE name: "RAR" } heuristic_analysis: true core_fingerprint: "\353f\245\254\324\020Z\266\302\351\006\035\244p\354\257" item { object: "\320\220\320\272\321\202 \320\277\320\276\320\275\320\265\320\264\320\265\320\273\321\214\320\275\320\270\320\272.exe" size: 123904 virus { type: SE_KNOWN_VIRUS name: "Trojan.SpyBot.699" } } item { object: "QO" size: 78 } user_time: 0.032212 system_time: 0.001774 } } message_id: "<f88a6efe-c268-8d1d-02bc-5cdf65702f45@xxxx.ru>" action: REPACKED }
А вот уже не ловит:
2019-Sep-30 16:40:24 [AS-2388] Debug: Vaderetro API: serial 12, protocol info=helo: "mail.xxxx.ru" inet: "zzz.zzz.zzz.zzz.106:52824" mailfrom: "valex@xxxx.ru" rcptto: "valex@nnnn.ru"
2019-Sep-30 16:40:24 [AS-2388] Debug: Vaderetro API: serial 12, score=0, spam_state=0, details=gggruggvucftvghtrhhoucdtuddrgedufedrgedvucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecufffthgfgueenuceurghilhhouhhtmecufedttdenucenucfjughrpefvhffukffffgggtgesmhdtreertdefjeenucfhrhhomheptehlvgigucggvgguuhhtihhnuceovhgrlhgvgiesthgurdgvthhrrdhruheqnecukfhppedujeeirdduudekrddvuddtrddutdeipdelhedrkeefrddukeelrdehtdenucfrrghrrghmpehhvghlohepmhgrihhlrdhtugdrvghtrhdrrhhupdhinhgvthepudejiedruddukedrvddutddruddtieemhedvkedvgedpmhgrihhlfhhrohhmpehvrghlvgigsehtugdrvghtrhdrrhhupdhrtghpthhtohepvhgrlhgvgiesrhihrgiirghnghhovhdrrhhunecuvehluhhsthgvrhfuihiivgeptd, version=Vade Retro 01.413.42 AS+AV+AP+RT Profile: DRWEB; Bailout: 300
2019-Sep-30 16:40:24 [NC-2438] Debug: Local client 0x36: INIT 31 as Job 0xea0
2019-Sep-30 16:40:24 [NC-2438] Debug: Job 0xea0: Reset
2019-Sep-30 16:40:24 [NC-2438] Debug: Job 0xea0: Destroyed
2019-Sep-30 16:40:24 [NC-2438] Debug: Local client 0x36: INIT 31 as Job 0xea1
2019-Sep-30 16:40:24 [NC-2438] Debug: Job 0xea1: Reset
2019-Sep-30 16:40:24 [NC-2438] Debug: Job 0xea1: Destroyed