Need help with rule set

[Mark Nienberg]

Mark Sapiro wrote:
>
> The underlying issue is that with SaneSecurity ClamAV signatures, lots
> of spam gets processed as a virus and thus gets a virus notice rather
> than a spam or high spam action, and this postmaster address gets a
> lot of spam, the notices for which drown out the others.
>
>   
I agree this is a nuisance.  I deal with it by filtering mail with 
subject "Virus Detected" into a separate folder at the local mail 
delivery agent level.  True, the folder will receive real virus 
notifications as well as SaneSecurity detections, but that doesn't 
bother me too much.  A cronjob cleans items older than 10 days out of 
the folder so it doesn't grow too large.  If I haven't read it by then 
it probably isn't important.

Mark Nienberg