Sophos & ClamAV + Sanesecurity

[Richard Mealing]

Have you put the scores in your spam.assassin.prefs.conf file?

Such as this for example - 

header SPAMVIRUSJurlblAuto
X-WHATEVERYOURORGNAMEIS-MailScanner-SpamVirus-Report =~
/Sanesecurity.Jurlbl.Auto/i
score SPAMVIRUSJurlblAuto 3.0

It should then score it.

I did send an email around with my configuration, these are spam viruses
so need to be tagged with some sort of score.

I can resend it if this is what you need?

Rich

-----Original Message-----
From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Mike
Wallace
Sent: 23 December 2009 16:16
To: MailScanner discussion
Subject: Re: Sophos & ClamAV + Sanesecurity

I am seeing a similar problem except I don't run Sophos or sanesecurity
signatures. I don't know when this started as in a previously version of
MailScanner and ClamAv (don't know which ones) this didn't happen.

What I occasionally see is that clamav 0.95.3 finds an infection but the
message never gets spam checked. Logs shows that once the infection is
found, the message gets re-queued and delivered. It looks like it never
gets spam checked.

I my configuration I need to strip all viruses and "Mark Infected
Messages".

Anyone have any ideas? 

Mike Wallace
mike at mlrw.com



On Dec 23, 2009, at 3:48 AM, ThB wrote:

> 
> I'm running MailScanner and SA, ClamAV + sanesecurity signatures but
also Sophos SAVI as a comercial virus scanner. Lately I reconfigured MS
to recognize sanesecurity hits as spam. In my configuration viruses
should be replaced by a warning message but still be delivered, so the
users know they got a message.
> 
>> From time to time there are messages which seem to be detected by
Sophos as virus and by ClamAV as spam because of sanesecurity
signatures. Such messages have the SpamVirus header but an empty
SpamCheck header and no SpamScore. Such messages also are tagged as
"Found to be infected" but the body part is not replaced.
> 
> X-MailScanner: Found to be infected
> X-MailScanner-SpamVirus-Report: Sanesecurity.Junk.19516.UNOFFICIAL
> X-MailScanner-SpamCheck:
> 
> This now is neither the correct "virus" nor "spam" behaviour as
configured.
> My request: do either the correct virus processing or the correct spam
processing.
> 
> 
> MailScanner 4.79.4
> SpamAssassin 3.2.5
> ClamAV 0.95.3
> Sophos 4.48.0
> 
> thanks and merry xmas
> Thomas
> -- 
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website! 
> 
> 
> This message has been scanned for viruses and dangerous content by
MailScanner, and is believed to be clean.
> 

-- 
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!