Spam-Virus scoring not working any more for me

[Mark Sapiro]

On 11:59 AM, James Gray wrote:
> 
> 
> Even though I'm not on the latest MS version (4.80.1) I'm not seeing any effect on the message scoring with the unofficial signatures in CLamAV too.  Here's an example from this morning:
> 
> MailScanner.conf:
> Spam-Virus Header = X-%org-name%-MailScanner-SpamVirus-Report:
> 
> SpamAssassin rule:
> header MS_FOUND_SPAMVIRUS       exists:X-MyOrg-MailScanner-SpamVirus-Report
> describe MS_FOUND_SPAMVIRUS     ClamAV found a Spam Virus via MailScanner
> score MS_FOUND_SPAMVIRUS        5.899
> 
> Relevant message headers:
> X-MyOrg-MailScanner-SpamVirus-Report: Sanesecurity.Junk.32803.UNOFFICIAL
> X-MyOrg-MailScanner-SpamCheck: spam, SpamAssassin (not cached,
> 	score=30.564, required 5, autolearn=spam, BAYES_99 3.85,
> 	BODY_GAPPY_TEXT 1.92, HTML_MESSAGE 0.00, NO_RELAYS -0.00,
> 	RAZOR2_CF_RANGE_51_100 0.50, RAZOR2_CF_RANGE_E8_51_100 1.89,
> 	RAZOR2_CHECK 0.92, SUBJ_OBFU_REPLICA 5.11, SUBJ_SPAMWORD 0.20,
> 	SUBJ_SWISS_WATCH 2.11, SUBJ_WATCH 0.91, T_SURBL_MULTI1 0.01,
> 	T_SURBL_MULTI2 0.01, T_SURBL_MULTI3 0.01, T_SURBL_MULTI4 0.01,
> 	T_URIBL_BLACK_OVERLAP 0.01, URIBL_AB_SURBL 4.50, URIBL_BLACK 1.73,
> 	URIBL_DBL_SPAM 1.70, URIBL_JP_SURBL 1.25, URIBL_OB_SURBL 0.12,
> 	URIBL_SBL 1.62, URIBL_SC_SURBL 0.57, URIBL_WS_SURBL 1.61)
[...]


This is not the same issue that Michael Mansour has.

In your case, this is strictly a spamassassin issue. The
"X-MyOrg-MailScanner-SpamVirus-Report:" header is in the message and you
have the spamassassin rule

header MS_FOUND_SPAMVIRUS       exists:X-MyOrg-MailScanner-SpamVirus-Report

yet the rule doesn't trigger. Assuming "MyOrg" is the same string in
both cases, spamassassin is not seeing your rule. Where is it?

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan