At 10:42 PM +0300 9/23/09, Jari Fredriksson wrote:
> On Wed, Sep 23, 2009 at 08:11:41PM +0300, Jari
Fredriksson wrote:
Ehm, were you scoring SaneSecurity hits like one is
supposed to, or just plain rejecting with them? Sounds
like the latter.
I don't run ClamAV via SpamAssassin. I have it called by
amavisd-new, which does what it does: quarantine.
May I suggest you google for amavisd-new feature called
"virus_name_to_spam_score_maps". You will find many
examples on how to do it properly.
Googled. Seemed to be SaneSecurity specific stuff. Is it?
No it tell you how to score any clamav detection whish is recommended
if you are using the default heuristics and phish detections which do
generate FPs.
I do not use Sanesecurity currently. The quarantine gets only virii
by stock ClamAV rules.
So? ClamAV by default implements heuristics and tries to detect phish
all of which can cause a certain percentage of FPs.
Tom
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml
