From: "Loren Wilton" <[EMAIL PROTECTED]>
so SA does not trap it, should i be looking at a procmail rule to dump the emails.Not a bad idea. If for some reason you really want to keep them around but detect them, sare_specific or one of the similar files should catch these.
I forget what I did here to catch them. They don't get through the huge bundle of rules I run. They generally score fairly high. It MIGHT be that I put in a rule to detect the clamav markup and use it. {^_^}