Jun 20 13:33:27 44188 postfix/smtpd[30424]: connect from h2579676.stratoserver.net[81.169.220.129]
Jun 20 13:33:27 44188 postfix/smtpd[30424]: 3EA7CBDC2434: client=h2579676.stratoserver.net[81.169.220.129]
Jun 20 13:33:27 44188 postfix/cleanup[30428]: 3EA7CBDC2434: message-id=<c53244614f13bc01dfd108101faf4958@t-online.de>
Jun 20 13:33:27 44188 /usr/lib/plesk-9.0/psa-pc-remote[2102]: handlers_stderr: SKIP
Jun 20 13:33:27 44188 /usr/lib/plesk-9.0/psa-pc-remote[2102]: SKIP during call 'check-quota' handler
Jun 20 13:33:27 44188 qmail-queue[30430]: scan: the message(drweb.tmp.FH5CtH) sent by tim.lerchner@t-online.de to info@wthannover.de has been stored in archive /var/spool/drweb/infected/drweb.quarantine.d2mbSK
Jun 20 13:33:27 44188 plesk sendmail[30433]: Unable to get sender domain by sender mailname
Jun 20 13:33:27 44188 plesk sendmail[30433]: handlers_stderr: SKIP
Jun 20 13:33:27 44188 plesk sendmail[30433]: SKIP during call 'check-quota' handler
Jun 20 13:33:27 44188 plesk sendmail[30433]: Unable to get sender domain by sender mailname
Jun 20 13:33:27 44188 postfix/pickup[30137]: CE48DBDC41D9: uid=106 from=<DrWEB-DAEMON>
Jun 20 13:33:27 44188 postfix/cleanup[30438]: CE48DBDC41D9: message-id=<20160620113327.CE48DBDC41D9@node01.hwserv.de>
Jun 20 13:33:27 44188 postfix/qmgr[23226]: CE48DBDC41D9: from=<DrWEB-DAEMON@node01.hwserv.de>, size=2190, nrcpt=1 (queue active)
Jun 20 13:33:27 44188 plesk sendmail[30441]: handlers_stderr: SKIP
Jun 20 13:33:27 44188 plesk sendmail[30441]: SKIP during call 'check-quota' handler
Jun 20 13:33:27 44188 postfix/pickup[30137]: D6925BDC41DC: uid=106 from=<DrWEB-DAEMON>
Jun 20 13:33:27 44188 postfix/cleanup[30438]: D6925BDC41DC: message-id=<20160620113327.D6925BDC41DC@node01.hwserv.de>
Jun 20 13:33:27 44188 postfix/qmgr[23226]: D6925BDC41DC: from=<DrWEB-DAEMON@node01.hwserv.de>, size=2177, nrcpt=1 (queue active)
Jun 20 13:33:27 44188 postfix-local[30448]: postfix-local: from=DrWEB-DAEMON@node01.hwserv.de, to=info@wthannover.de, dirname=/var/qmail/mailnames
Jun 20 13:33:27 44188 spamd[18169]: spamd: connection from localhost [127.0.0.1] at port 34253
Jun 20 13:33:27 44188 spamd[18169]: spamd: using default config for info@wthannover.de: /var/qmail/mailnames/wthannover.de/info/.spamassassin/user_prefs
Jun 20 13:33:27 44188 spamd[18169]: spamd: processing message <20160620113327.D6925BDC41DC@node01.hwserv.de> for info@wthannover.de:30
Jun 20 13:33:27 44188 plesk sendmail[30450]: handlers_stderr: SKIP
Jun 20 13:33:27 44188 plesk sendmail[30450]: SKIP during call 'check-quota' handler
Jun 20 13:33:27 44188 postfix/cleanup[30438]: E104CBDC41E5: message-id=<20160620113327.CE48DBDC41D9@node01.hwserv.de>
Jun 20 13:33:27 44188 postfix/qmgr[23226]: E104CBDC41E5: from=<DrWEB-DAEMON@node01.hwserv.de>, size=2337, nrcpt=1 (queue active)
Jun 20 13:33:27 44188 postfix/local[30440]: CE48DBDC41D9: to=<postmaster@localhost.localdomain>, orig_to=<postmaster>, relay=local, delay=0.1, delays=0.03/0.04/0/0.03, dsn=2.0.0, status=sent (forwarded as E104CBDC41E5)
Jun 20 13:33:27 44188 postfix/qmgr[23226]: CE48DBDC41D9: removed
Jun 20 13:33:27 44188 postfix/pickup[30137]: E2C76BDC41D9: uid=106 from=<DrWEB-DAEMON>
Jun 20 13:33:27 44188 qmail-queue[30430]: scan: the message(drweb.tmp.FH5CtH) sent by tim.lerchner@t-online.de to info@wthannover.de infected with JS.DownLoader.1225
Jun 20 13:33:27 44188 /usr/lib/plesk-9.0/psa-pc-remote[2102]: handlers_stderr: STOP
Jun 20 13:33:27 44188 /usr/lib/plesk-9.0/psa-pc-remote[2102]: STOP during call 'drweb' handler
Jun 20 13:33:27 44188 postfix/cleanup[30438]: E2C76BDC41D9: message-id=<20160620113327.E2C76BDC41D9@node01.hwserv.de>
Jun 20 13:33:27 44188 postfix/cleanup[30428]: 3EA7CBDC2434: milter-discard: END-OF-MESSAGE from h2579676.stratoserver.net[81.169.220.129]: milter triggers DISCARD action; from=<tim.lerchner@t-online.de> to=<info@wthannover.de> proto=SMTP helo=<h2579676.domain>
Jun 20 13:33:27 44188 postfix/qmgr[23226]: E2C76BDC41D9: from=<DrWEB-DAEMON@node01.hwserv.de>, size=2324, nrcpt=1 (queue active)
Jun 20 13:33:27 44188 postfix-local[30459]: postfix-local: from=DrWEB-DAEMON@node01.hwserv.de, to=wehmeyer@hi-works.de, dirname=/var/qmail/mailnames
Jun 20 13:33:27 44188 postfix/smtpd[30424]: disconnect from h2579676.stratoserver.net[81.169.220.129]
Jun 20 13:33:27 44188 postfix/smtp[30458]: E2C76BDC41D9: host mx03.t-online.de[194.25.134.73] refused to talk to me: 554 IP=62.141.44.188 - A problem occurred. (Ask your postmaster for help or to contact tosa@rx.t-online.de to clarify.) (BL)
Jun 20 13:33:27 44188 postfix/smtp[30458]: E2C76BDC41D9: host mx00.t-online.de[194.25.134.8] refused to talk to me: 554 IP=62.141.44.188 - A problem occurred. (Ask your postmaster for help or to contact tosa@rx.t-online.de to clarify.) (BL)
Jun 20 13:33:28 44188 postfix/smtp[30458]: E2C76BDC41D9: host mx01.t-online.de[194.25.134.72] refused to talk to me: 554 IP=62.141.44.188 - A problem occurred. (Ask your postmaster for help or to contact tosa@rx.t-online.de to clarify.) (BL)
Jun 20 13:33:28 44188 postfix/smtp[30458]: E2C76BDC41D9: to=<tim.lerchner@t-online.de>, relay=mx02.t-online.de[194.25.134.9]:25, delay=0.13, delays=0.01/0.01/0.11/0, dsn=4.0.0, status=deferred (host mx02.t-online.de[194.25.134.9] refused to talk to me: 554 IP=62.141.44.188 - A problem occurred. (Ask your postmaster for help or to contact tosa@rx.t-online.de to clarify.) (BL))
Jun 20 13:33:28 44188 spamd[18169]: spamd: clean message (-1.9/7.0) for info@wthannover.de:30 in 0.5 seconds, 2224 bytes.
Jun 20 13:33:28 44188 spamd[18169]: spamd: result: . -1 - BAYES_00,NO_RELAYS scantime=0.5,size=2224,user=info@wthannover.de,uid=30,required_score=7.0,rhost=localhost,raddr=127.0.0.1,rport=34253,mid=<20160620113327.D6925BDC41DC@node01.hwserv.de>,bayes=0.000000,autolearn=ham
Jun 20 13:33:28 44188 dovecot: service=lda, user=info@wthannover.de, ip=[]. msgid=<20160620113327.D6925BDC41DC@node01.hwserv.de>: saved mail to INBOX
Jun 20 13:33:28 44188 plesk sendmail[30467]: handlers_stderr: SKIP
Jun 20 13:33:28 44188 plesk sendmail[30467]: SKIP during call 'check-quota' handler
Jun 20 13:33:28 44188 spamd[19368]: prefork: child states: B
Jun 20 13:33:28 44188 spamd[19368]: prefork: server reached --max-children setting, consider raising it
Jun 20 13:33:28 44188 postfix/pickup[30137]: 637DBBDC41E2: uid=30 from=<DrWEB-DAEMON@node01.hwserv.de>
Jun 20 13:33:28 44188 spamd[18169]: spamd: connection from localhost [127.0.0.1] at port 34260
Jun 20 13:33:28 44188 postfix/cleanup[30438]: 637DBBDC41E2: message-id=<20160620113327.D6925BDC41DC@node01.hwserv.de>
Jun 20 13:33:28 44188 spamd[18169]: spamd: using default config for wehmeyer@hi-works.de: /var/qmail/mailnames/hi-works.de/wehmeyer/.spamassassin/user_prefs
Jun 20 13:33:28 44188 postfix/qmgr[23226]: 637DBBDC41E2: from=<DrWEB-DAEMON@node01.hwserv.de>, size=2561, nrcpt=1 (queue active)
Jun 20 13:33:28 44188 spamd[18169]: spamd: processing message <20160620113327.CE48DBDC41D9@node01.hwserv.de> for wehmeyer@hi-works.de:30
Jun 20 13:33:28 44188 postfix-local[30474]: postfix-local: from=DrWEB-DAEMON@node01.hwserv.de, to=julia@wthannover.de, dirname=/var/qmail/mailnames
Jun 20 13:33:28 44188 plesk sendmail[30475]: handlers_stderr: SKIP
Jun 20 13:33:28 44188 plesk sendmail[30475]: SKIP during call 'check-quota' handler
Jun 20 13:33:28 44188 postfix/pickup[30137]: 6F578BDC41E8: uid=30 from=<DrWEB-DAEMON@node01.hwserv.de>
Jun 20 13:33:28 44188 postfix/cleanup[30428]: 6F578BDC41E8: message-id=<20160620113327.D6925BDC41DC@node01.hwserv.de>
Jun 20 13:33:28 44188 postfix/qmgr[23226]: 6F578BDC41E8: from=<DrWEB-DAEMON@node01.hwserv.de>, size=2561, nrcpt=1 (queue active)
Jun 20 13:33:28 44188 postfix/pipe[30447]: D6925BDC41DC: to=<info@wthannover.de>, relay=plesk_virtual, delay=0.59, delays=0.01/0.01/0/0.58, dsn=2.0.0, status=sent (delivered via plesk_virtual service)
Jun 20 13:33:28 44188 postfix/qmgr[23226]: D6925BDC41DC: removed
Jun 20 13:33:28 44188 postfix-local[30483]: postfix-local: from=DrWEB-DAEMON@node01.hwserv.de, to=matthias@wthannover.de, dirname=/var/qmail/mailnames
Jun 20 13:33:28 44188 spamd[18169]: spamd: clean message (-0.4/7.0) for wehmeyer@hi-works.de:30 in 0.2 seconds, 2375 bytes.
Jun 20 13:33:28 44188 spamd[18169]: spamd: result: . 0 - BAYES_00,NO_RELAYS,SUBJ_ALL_CAPS scantime=0.2,size=2375,user=wehmeyer@hi-works.de,uid=30,required_score=7.0,rhost=localhost,raddr=127.0.0.1,rport=34260,mid=<20160620113327.CE48DBDC41D9@node01.hwserv.de>,bayes=0.000000,autolearn=no
Jun 20 13:33:28 44188 dovecot: service=lda, user=wehmeyer@hi-works.de, ip=[]. msgid=<20160620113327.CE48DBDC41D9@node01.hwserv.de>: saved mail to INBOX
Jun 20 13:33:28 44188 postfix/pipe[30457]: E104CBDC41E5: to=<wehmeyer@hi-works.de>, orig_to=<postmaster>, relay=plesk_virtual, delay=0.69, delays=0.01/0.01/0/0.68, dsn=2.0.0, status=sent (delivered via plesk_virtual service)
Jun 20 13:33:28 44188 postfix/qmgr[23226]: E104CBDC41E5: removed
Jun 20 13:33:28 44188 spamd[19368]: prefork: child states: B
Jun 20 13:33:28 44188 spamd[19368]: prefork: server reached --max-children setting, consider raising it
Jun 20 13:33:28 44188 spamd[18169]: spamd: connection from localhost [127.0.0.1] at port 34267
Jun 20 13:33:28 44188 spamd[18169]: spamd: using default config for julia@wthannover.de: /var/qmail/mailnames/wthannover.de/julia/.spamassassin/user_prefs
Jun 20 13:33:28 44188 spamd[18169]: spamd: processing message <20160620113327.D6925BDC41DC@node01.hwserv.de> for julia@wthannover.de:30
Jun 20 13:33:28 44188 spamd[18169]: spamd: clean message (-0.0/7.0) for julia@wthannover.de:30 in 0.2 seconds, 2601 bytes.
Jun 20 13:33:28 44188 spamd[18169]: spamd: result: . 0 - NO_RELAYS scantime=0.2,size=2601,user=julia@wthannover.de,uid=30,required_score=7.0,rhost=localhost,raddr=127.0.0.1,rport=34267,mid=<20160620113327.D6925BDC41DC@node01.hwserv.de>,autolearn=ham
Jun 20 13:33:28 44188 dovecot: service=lda, user=julia@wthannover.de, ip=[]. msgid=<20160620113327.D6925BDC41DC@node01.hwserv.de>: saved mail to INBOX
Jun 20 13:33:28 44188 postfix/pipe[30473]: 637DBBDC41E2: to=<julia@wthannover.de>, relay=plesk_virtual, delay=0.42, delays=0.01/0.01/0/0.39, dsn=2.0.0, status=sent (delivered via plesk_virtual service)
Jun 20 13:33:28 44188 postfix/qmgr[23226]: 637DBBDC41E2: removed
Jun 20 13:33:28 44188 spamd[19368]: prefork: child states: B
Jun 20 13:33:28 44188 spamd[19368]: prefork: server reached --max-children setting, consider raising it
Jun 20 13:33:28 44188 spamd[18169]: spamd: connection from localhost [127.0.0.1] at port 34268
Jun 20 13:33:28 44188 spamd[18169]: spamd: using default config for matthias@wthannover.de: /var/qmail/mailnames/wthannover.de/matthias/.spamassassin/user_prefs
Jun 20 13:33:28 44188 spamd[18169]: spamd: processing message <20160620113327.D6925BDC41DC@node01.hwserv.de> for matthias@wthannover.de:30
Jun 20 13:33:28 44188 spamd[18169]: spamd: clean message (-0.0/7.0) for matthias@wthannover.de:30 in 0.2 seconds, 2607 bytes.
Jun 20 13:33:28 44188 spamd[18169]: spamd: result: . 0 - NO_RELAYS scantime=0.2,size=2607,user=matthias@wthannover.de,uid=30,required_score=7.0,rhost=localhost,raddr=127.0.0.1,rport=34268,mid=<20160620113327.D6925BDC41DC@node01.hwserv.de>,autolearn=ham
Jun 20 13:33:29 44188 dovecot: service=lda, user=matthias@wthannover.de, ip=[]. msgid=<20160620113327.D6925BDC41DC@node01.hwserv.de>: saved mail to INBOX
Jun 20 13:33:29 44188 postfix/pipe[30447]: 6F578BDC41E8: to=<matthias@wthannover.de>, relay=plesk_virtual, delay=0.56, delays=0.01/0/0/0.54, dsn=2.0.0, status=sent (delivered via plesk_virtual service)
Jun 20 13:33:29 44188 postfix/qmgr[23226]: 6F578BDC41E8: removed
Jun 20 13:33:29 44188 spamd[19368]: prefork: child states: I