All my users' headline alerts from NYTIMES.com got blocked for: status=VIRUS:Phishing.Heuristics.Email.SpoofedDomain
... this filter also catching true positives, so we'd like to keep it. In the man pages for clamd and clamsmtpd, I can't find any doc on whitelisting, although clamsmtpd console logs "empty" for 3 lists at start up. thanks Len _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
