Hi, >>> running clamscan --debug against the file. >>> http://www.tdcanadatrust.com/tdvisa/agreements appears >>> several times in the body of the message but links to >>> http://ems1.aeroplan.com/a/l.x?t=icholbpbeophbeocnlmimpbc&; >>> M=1&L=2&v=4. >> >> Ah, thanks. I should have known that. >> >> In this case it wasn't intended to be malicious, but I'm surprised >> more legitimate mail isn't tagged for doing this. > > The heuristics engine is only used for selected financial institution domains > (currently 263) listed in > daily.pdb as H:<domain>
It looks like I only have daily.cld. Can you explain what you mean here? Thanks again, Alex _______________________________________________ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/support/ml
