Need help with rule set
MailScanner at ecs.soton.ac.uk
Thu Jul 30 11:01:59 IST 2009
I wasn't thinking of anything quite so complicated as that.
Maybe a single score for all defined spam reports from the virus scanners?
I would rather keep it simple so people can actually use it, than have
something very clever and complex that no-one ever quite understands or
can work out how to use (apart from the 0.1% who are wizards).
On 30/07/2009 10:30, --[ UxBoD ]-- wrote:
> Here is the scoremap you would use in Amavis aswell :-
> @virus_name_to_spam_score_maps =
> (new_RE( # the order matters!
> [ qr'^Phishing\.' => 0 ],
> [ qr'^(Email|HTML)\.Phishing\.(?!.*Sanesecurity)' => 0 ],
> [ qr'^Sanesecurity\.(Malware|Rogue|Trojan)\.' => undef ],# keep as infected
> [ qr'^Sanesecurity(\.[^., ]*)*\.' => 0 ],
> [ qr'^Sanesecurity_PhishBar_' => 0 ],
> [ qr'^Email\.Spam\.Bounce(\.[^., ]*)*\.Sanesecurity\.' => 0 ],
> [ qr'^(MSRBL-Images\b|MSRBL-SPAM\.)' => 0 ],
> [ qr'^VX\.Honeypot-SecuriteInfo\.com\.Joke' => 0 ],
> [ qr'^VX\.not-virus_(Hoax|Joke)\..*-SecuriteInfo\.com(\.|\z)' => 0 ],
> [ qr'^Email\.Spam.*-SecuriteInfo\.com(\.|\z)' => 0 ],
> [ qr'-SecuriteInfo\.com(\.|\z)' => undef ], # keep as infected
> [ qr'^MBL_' => undef ], # keep as infected
> Best Regards,
Julian Field MEng CITP CEng
Buy the MailScanner book at www.MailScanner.info/store
Need help customising MailScanner?
Need help fixing or optimising your systems?
Need help getting you started solving new requirements from your boss?
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
Follow me at twitter.com/JulesFM and twitter.com/MailScanner
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
More information about the MailScanner