From clamav-win32-bounces@lists.clamav.net Wed Jun 4 15:53:47 2008 Return-Path: X-Original-To: list@tad.clamav.net Delivered-To: list@tad.clamav.net X-Virus-Scanned: Debian amavisd-new at tad.clamav.net Received: from tad.clamav.net ([127.0.0.1]) by localhost (tad.clamav.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ekJEafTjssIl; Wed, 4 Jun 2008 15:53:46 +0200 (CEST) Received: from tad.clamav.net (localhost.localdomain [127.0.0.1]) by tad.clamav.net (Postfix) with ESMTP id 2D1E516C1B6; Wed, 4 Jun 2008 15:53:46 +0200 (CEST) X-Original-To: clamav-win32@tad.clamav.net Delivered-To: clamav-win32@tad.clamav.net X-Virus-Scanned: Debian amavisd-new at tad.clamav.net Received: from tad.clamav.net ([127.0.0.1]) by localhost (tad.clamav.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9IRRgXEA-S3D for ; Wed, 4 Jun 2008 15:53:42 +0200 (CEST) Received: from esperanto.be (unknown [195.144.83.8]) by tad.clamav.net (Postfix) with ESMTP id E0AB716C0AE for ; Wed, 4 Jun 2008 15:53:41 +0200 (CEST) Received: from [127.0.0.1] ( [10.1.1.10]) by esperanto.be with ESMTP (Mailtraq/2.12.1.2362) id ESPR80D767B9 for clamav-win32@lists.clamav.net; Wed, 04 Jun 2008 15:53:31 +0200 Message-ID: <48469E5B.70300@spamcop.net> Date: Wed, 04 Jun 2008 15:53:31 +0200 From: "esperanto@spamcop.net" Organization: Vlaamse Esperantobond v.z.w. User-Agent: Thunderbird 2.0.0.14 (Windows/20080421) MIME-Version: 1.0 To: clamav-win32@lists.clamav.net References: <200805290712.DAA12415@eclipse.cise.ufl.edu> In-Reply-To: <200805290712.DAA12415@eclipse.cise.ufl.edu> X-Antivirus: avast! (VPS 080604-1, 06/04/2008), Outbound message X-FEL-Filtrilo: Rezulto=-500; maks=100; min=-250; skanis=50 X-Antivirus-Status: Clean Subject: [clamav-win32] Phishing caught on outbound mail but not on inbound X-BeenThere: clamav-win32@lists.clamav.net X-Mailman-Version: 2.1.9 Precedence: list Reply-To: clamav-win32@lists.clamav.net List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: clamav-win32-bounces@lists.clamav.net Errors-To: clamav-win32-bounces@lists.clamav.net I've noticed many times in the last few days, that an arriving phishing attempt is not caught by ClamAV. But when I forward that same phishing attempt as an attachment to another e-mail-address only a few minutes later, ClamAV blocks it, e.g. with the message 550 contains virus -- (Phishing.Heuristics.Email.SpoofedDomain FOUND) I can accept that ClamAV blocks my forwarding, but why wasn't the mail blocked at arrival? _______________________________________________ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-win32