Bas Zoetekouw wrote: > Hmm, is there any way to detect automatically, whether a message is a > real virus or a phishing spam? Currently, all virusses I get go > directly to /dev/null
The virus name ClamAV returns will contain the string 'Phishing.' (actually most likely always 'HTML.Phishing.') such as in 'HTML.Phishing.Bank-54' and 'HTML.Phishing.Pay-1'.
"Viruses" such as 'Trojan.URLspoof.gen.2' would also be of interest to us since they are generally eBay spoofs.
Daryl
