Spam-Virus scoring not working any more for me

[Mark Sapiro]

On Sept 22 at 7:00 PM, Michael Mansour wrote:
> 
> --- On Thu, 23/9/10, Mark Sapiro <mark at msapiro.net> wrote:
> 
> I haven't changed the %org-name% no. 
> 
> I do have a different setting for this though:


This is not relevant in your case. it only matters if you have the
default or similar setting for Spam-Virus Header which includes %org-name%.


> Another question, I use MailWatch, should the X-MailScanner-blah headers be present when viewing the message headers in MailWatch?
> 
> I don't see them in MailWatch, but when I release the message from MailWatch to my Inbox and view full headers, I see the MailScanner lines no problems.


I have never used MailWatch. I can't answer that.


>> If the above does not solve the problem, please post
>> exactly what you
>> have in Mailscanner.conf for "Spam-Virus Header" and "Virus
>> Names Which
>> Are Spam". In particular, does your "Virus Names Which Are
>> Spam"
>> pattern(s) match the virus name?
> 
> My settings are:
> 
> Spam-Virus Header = X-NPGX-MailScanner-SpamVirus-Report:
> 
> Virus Names Which Are Spam = Sane*UNOFFICIAL HTML/* MBL*UNOFFICIAL *SecuriteInfo*UNOFFICIAL INetMsg.SpamDomain*UNOFFICIAL NPGX.DomainAddr*UNOFFICIAL NPGX.EmailAddr.*UNOFFICIAL winnow*UNOFFICIAL
> 
> Yes, all the above do match the virus names presented when the clamd scanner finds the signature in the 3rd party DB.


OK.

What's in your logs? Do you have messages like

Sep 22 06:56:27 sbh16 MailScanner[10759]: Clamd::INFECTED::
Sanesecurity.Junk.12181.UNOFFICIAL :: ./835336900BC.A01F3/
Sep 22 06:56:27 sbh16 MailScanner[10759]: Found spam-virus
Sanesecurity.Junk.12181.UNOFFICIAL in 835336900BC.A01F3

In particular, do you have the Found spam-virus message?

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan