Virus Warnings

[Randal, Phil]

It seems to me that you need to put in appropriate rules to whitelist mails
from Mailscanner on 127.0.0.1 rather than fiddle with the spamassassin
rulesets.

That's what I've done, anyhow.

Phil
----
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK

> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Jeff Earickson
> Sent: 07 April 2004 17:59
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: Virus Warnings
>
> Hi,
> I implemented this ruleset this morning (I use MS 4.29.7),
> and quickly found that it tags and discards the MailScanner
> notices to the system administrator too.  These are very
> important to me, because I use procmail to trap them so I can
> do a daily count of viruses (and other things like forms
> tags) killed, and where they come from.
>
> Specifically, I had to change the scores (to 0.1) on
> VIRUS_WARNING15, VIRUS_WARNING28, VIRUS_WARNING300, and
> remove the reference to MailScanner on VIRUS_WARNING62.  I
> was also offended by the remark "MailScanner is a real PITA"
> at rule 250.  Maybe the authors have wised up since that
> comment was added.
>
> But, after tweaking, this ruleset is doing the trick for me.
>
> Jeff Earickson
> Colby College
>
> On Wed, 7 Apr 2004, Randal, Phil wrote:
>
> > Date: Wed, 7 Apr 2004 17:13:10 +0100
> > From: "Randal, Phil" <prandal at HEREFORDSHIRE.GOV.UK>
> > Reply-To: MailScanner mailing list <MAILSCANNER at JISCMAIL.AC.UK>
> > To: MAILSCANNER at JISCMAIL.AC.UK
> > Subject: Re: Virus Warnings
> >
> > Roger Jochem asked:
> >
> > > Is there any way I can block some of the hundreds of
> virus warnings
> > > my users receive per day for "sending" virus like netsky?
> > >
> > > Because netsky and so much other viruses use fake from
> address, this
> > > messages are all false. How could I block some of these with
> > > MailScanner?
> > >
> > > (I'm tired of explaying to every user that he is not
> infected and is
> > > not sending .scr files to some e-mail adress he never saw
> before...)
> > >
> > > Regards
> > >
> > > Roger Jochem
> >
> > Add http://www.timj.co.uk/linux/bogus-virus-warnings.cf to your
> > /etc/mail/spamassassin directory.
> >
> > It makes them high-scoring spam, so it doesn't get delivered (if
> > you're set up that way).
> >
> > Phil
> >
> > ----
> > Phil Randal
> > Network Engineer
> > Herefordshire Council
> > Hereford, UK
> >
>