Török Edwin wrote: > On 2009-04-30 02:03, MrC wrote: >> I submitted what I considered to be a FP on >> >> Phishing.Heuristics.Email.SpoofedDomain >> >> Submission-ID: 7705854 >> > > That submission id is another sample you submitted on April 17th that > matches Email.Phishing.DblDom-59, > and it doesn't have anything about sears or harrahs-marketing inside it. > > >> Sender: Me >> Submission notes: not a false positive >> Added: No >> >> which was not considered a FP. > > It is in fact a message from this mailing list that discusses signatures, > and shows what a particular signature decodes to, no wonder it gets > matched by the signature it is discussing, thus it is not a false positive. >
That is why I recommend people on this list exclude it from testing. We cannot discuss these issues without including at some point sharing content we know is likely to be rejected by the tool we're discussing. It is counter-productive for one's site policy to inhibit through automation legitimate discussions about that very automation. dp _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
