Mailscanner seems not scanning forwarding mails

[Gustavo Flamerich]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

We have problems with mailscannes because some emails that arrives to
our box and are forwarded to another address seems to be infected and
mailscanner doesn't stop them.
Our mailscanner is config to scan every message for virus, so don't
undersatand why a message received is not scanned even is not for a pop
account, just an alias to forward to a address outside our box.
Here is a record from our exim_mainlog were we notice the problem, some
other ISP blocked us because they found the virus.

2005-07-04 06:10:52 1DpNtu-00014d-3I ** address1@#####.net
<address2@######.com> R=lookuphost T=remote_smtp: SMTP error from remote
mailer after end of data: host relay.#####.net [##.##.###.###]: 554
5.7.1 virus HTML.Phishing.Bank-1 detected by ClamAV - http://www.clamav.net
root at delta [/var/log]# grep "1DpNtu-00014d-3I" exim_mainlog
address1 is outside our box, address2 is a forwarding address, doesn't
have a pop account.

We are using mailscanner with clamav, the same antivirus that blocked
the message at the ISP. Also looked at the virus database and found the
HTML.Phishing.Bank-1 as virus, so we understand that clamav actually
found on that email a visrus, not a phishing.
We are running exim-4.44-0, mailscanner version 4.42.9, ClamAV 0.86.1
with clamavmodule on a Cpanel RH 9 server.
Thanks


-- 
Gustavo Flamerich
MODULOS EMPRESARIOS
Soluciones Profesionales de Alojamiento Web
www.modulosempresarios.net
email: gflamerich at modulosempresarios.net

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!