I have discovered that when an infected mail is found by clamav it is once again being scanned by trophie/sophie/sophos.
Now its my understanding from the code that a positive hit from one virus scanner is enough to have the mail canned, so in that case performing a second scan is a total waste of time if the first scan was positive.
I attach a patch with overcomes this by simply checking the existing FoundVirus variable before doing a second virus scan.
While running in debug, no second trophie scan is being perfomed after a positive clamAV scan, when testing with the eicar test virus.
Logged In: YES
user_id=1201957
Originator: NO
Added to current CVS