[Mimedefang] Sober virus highlights problem

[Jonathan Maliepaard]

Hi All

The outbreak of the "German Spam" sober virus out break has highlighted
a problem in our methodology for handling SPAM. We have been using CanIt
with the SPAM trap. In order to keep the trap as empty as possible we
have been agressively whitelisting domains of well know local
orginisations. This has worked well so far, until last week when Germans
emails with spoofed from addresses meant that lots of the mails just
came through tagged as "whitelisted domain".

I understand that if a domain is whitelisted then the system will not
check the mail for spam at all. Is there a way that even if a domain is
whitelisted that a custom rule can be checked first (like the subject
lines from the sober virus)?

And as another question should Clam not be discarding these emails as
they are clearly virus related? Clam seems to discard phishing emails.

Thanks

Jon.