Sanesecurity

[Alvaro Marín]

Hi,

On 21/04/10 14:13, Ludgero Parreira wrote:
> Hi,
>
> I'm getting spam even when clamd triggers a sanesecurity rule:
>
> X--MailScanner-From: rachitic at mmorpguides.com
> X--MailScanner-SpamScore: 6
> X--MailScanner-SpamCheck: not spam, SpamAssassin (score=6.977, required
> 7, BAYES_99 4.00, RCVD_IN_PBL 2.00, RCVD_IN_SORBS_DUL 0.88, RDNS_NONE 0.10)
> X--MailScanner-SpamVirus-Report:
> Sanesecurity.Junk.22048.UNOFFICIALSanesecurity.Junk.22048.UNOFFICIAL
> X--MailScanner: Found to be clean
>
> This email should have been removed ?
> I'm missing something ?

If you have on MailScanner.conf something like "UNOFFICIAL" defined on:

Virus Names Which Are Spam

all viruses from Sanesecurity will be treated as "spam viruses" so you 
need a SA rule to assign points to them. If you want to treat them as 
real viruses, remove that "UNOFFICIAL" string.

http://www.mailscanner.info/ChangeLog

3 New feature to allow detection of "spam-viruses" which are items of spam
   that are reported by your virus scanner. You can set 2 new configuration
   options:
   Spam-Virus Header = X-%org-name%-MailScanner-SpamVirus-Report:
   Virus Names Which Are Spam = Sane*UNOFFICIAL HTML/*
   The names of the "spam-viruses" found are those viruses reported by your
   virus scanners which match any of the strings given in "Virus Names Which
   Are Spam". These "spam-virus" names are added to the header set by
   "Spam-Virus Header". You can then write a SpamAssassin rule in
   spam.assassin.prefs.conf which gives a score for the presence or contents
   of this header. I supply an example rule which adds a score of 3 if the
   header exists. Feel free to re-write and extend that rule! It will 
not work
   unless you customise it. You could even write a "SpamAssassin Rule 
Action"

Regards,

-- 
Alvaro Marín Illera
Hostalia Internet
www.hostalia.com