Sophos & ClamAV + Sanesecurity

Richard Mealing richard at
Wed Dec 23 16:37:27 GMT 2009

Have you put the scores in your spam.assassin.prefs.conf file?

Such as this for example - 

header SPAMVIRUSJurlblAuto
X-WHATEVERYOURORGNAMEIS-MailScanner-SpamVirus-Report =~
score SPAMVIRUSJurlblAuto 3.0

It should then score it.

I did send an email around with my configuration, these are spam viruses
so need to be tagged with some sort of score.

I can resend it if this is what you need?


-----Original Message-----
From: mailscanner-bounces at
[mailto:mailscanner-bounces at] On Behalf Of Mike
Sent: 23 December 2009 16:16
To: MailScanner discussion
Subject: Re: Sophos & ClamAV + Sanesecurity

I am seeing a similar problem except I don't run Sophos or sanesecurity
signatures. I don't know when this started as in a previously version of
MailScanner and ClamAv (don't know which ones) this didn't happen.

What I occasionally see is that clamav 0.95.3 finds an infection but the
message never gets spam checked. Logs shows that once the infection is
found, the message gets re-queued and delivered. It looks like it never
gets spam checked.

I my configuration I need to strip all viruses and "Mark Infected

Anyone have any ideas? 

Mike Wallace
mike at

On Dec 23, 2009, at 3:48 AM, ThB wrote:

> I'm running MailScanner and SA, ClamAV + sanesecurity signatures but
also Sophos SAVI as a comercial virus scanner. Lately I reconfigured MS
to recognize sanesecurity hits as spam. In my configuration viruses
should be replaced by a warning message but still be delivered, so the
users know they got a message.
>> From time to time there are messages which seem to be detected by
Sophos as virus and by ClamAV as spam because of sanesecurity
signatures. Such messages have the SpamVirus header but an empty
SpamCheck header and no SpamScore. Such messages also are tagged as
"Found to be infected" but the body part is not replaced.
> X-MailScanner: Found to be infected
> X-MailScanner-SpamVirus-Report: Sanesecurity.Junk.19516.UNOFFICIAL
> X-MailScanner-SpamCheck:
> This now is neither the correct "virus" nor "spam" behaviour as
> My request: do either the correct virus processing or the correct spam
> MailScanner 4.79.4
> SpamAssassin 3.2.5
> ClamAV 0.95.3
> Sophos 4.48.0
> thanks and merry xmas
> Thomas
> -- 
> MailScanner mailing list
> mailscanner at
> Before posting, read
> Support MailScanner development - buy the book off the website! 
> This message has been scanned for viruses and dangerous content by
MailScanner, and is believed to be clean.

MailScanner mailing list
mailscanner at

Before posting, read

Support MailScanner development - buy the book off the website! 

More information about the MailScanner mailing list