INFECTED:: Phishing.Heuristics.Email.SpoofedDomain:: ....

[Quentin Campbell]

Gareth

If that is the problem is does not account for why I only see it on 2
out of 8 otherwise identical MX hosts, all running with the same version
of MS, ClamAV-Module, ndb files in /usr/local/share/clamav, etc.

I will install the latest BETA version of MS on one of the 2 machines
and see what happens.

Thanks

Quentin

>-----Original Message-----
>From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-
>bounces at lists.mailscanner.info] On Behalf Of Gareth
>Sent: 31 October 2007 09:23
>To: MailScanner discussion
>Subject: RE: INFECTED:: Phishing.Heuristics.Email.SpoofedDomain:: ....
>
>Its caused by a new feature in clamav with an incorrect default
setting.
>You need to either update MailScanner to include the new scanning
option
>or switch to clamd.
>
>On Wed, 2007-10-31 at 08:22, Quentin Campbell wrote:
>> I am running eight mail gateways with MailScanner-4.62.9-2 using
>'clamavmodule' (Mail-ClamAV-0.20 & ClamAV 0.91.2).
>>
>> However only seeing "INFECTED::
>Phishing.Heuristics.Email.SpoofedDomain::" on two of them and many of
>these look like false positives.
>>
>> Cannot see why only two systems doing this as all eight gateways are
>equal preference MX hosts for our domains and share the same type of
>mail traffic.
>>
>> Any pointers to where else I might look would be appreciated.
>>
>> Thanks
>>
>> Quentin
>> ---
>> PHONE: +44 191 222 8209    Information Systems and Services (ISS),
>>                            Newcastle University,
>>                            Newcastle upon Tyne,
>> FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
>>
----------------------------------------------------------------------
>--
>
>--
>MailScanner mailing list
>mailscanner at lists.mailscanner.info
>http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
>Before posting, read http://wiki.mailscanner.info/posting
>
>Support MailScanner development - buy the book off the website!