On 3/7/2013 2:07 AM, Linus Haake wrote: > Dear List, > > > > We’re running two very identical servers (Centos 5 / 6) as inbound > MTA. Both have > > > > - The same clamd.conf and Clamav release > > - The same signature files > > - Same version of amavisd-new conf > > > > installed. > > > > Since some weaks ago, I’ve recognized that Phishing detection works > on both servers, but only one puts the detected file into Quarantine. > > > > I was searching for hours comparing the config files, reloading > fresh signature db’s but cannot find the reason for it. > > Clamd.log shows > > > > /Mon Mar 4 20:17:30 2013 -> > /var/spool/amavis/tmp/amavis-20130304T201610-01721/parts/p003: > Heuristics.Phishing.Email.SpoofedDomain FOUND/ > > > > but the message just passes as SPAM. > > > > Does anybody has a idea what the reason for this behavior could be? > > > > Thanks! > > >
The usual suspect is different setting of @virus_name_to_spam_score_maps -- Noel Jones
