Sophos & ClamAV + Sanesecurity

[ThB]

I'm running MailScanner and SA, ClamAV + sanesecurity signatures but also Sophos SAVI as a comercial virus scanner. Lately I reconfigured MS to recognize sanesecurity hits as spam. In my configuration viruses should be replaced by a warning message but still be delivered, so the users know they got a message.

>From time to time there are messages which seem to be detected by Sophos as virus and by ClamAV as spam because of sanesecurity signatures. Such messages have the SpamVirus header but an empty SpamCheck header and no SpamScore. Such messages also are tagged as "Found to be infected" but the body part is not replaced.

X-MailScanner: Found to be infected
X-MailScanner-SpamVirus-Report: Sanesecurity.Junk.19516.UNOFFICIAL
X-MailScanner-SpamCheck:

This now is neither the correct "virus" nor "spam" behaviour as configured.
My request: do either the correct virus processing or the correct spam processing.


MailScanner 4.79.4
SpamAssassin 3.2.5
ClamAV 0.95.3
Sophos 4.48.0

thanks and merry xmas
Thomas