[FastNet PRO Probable Spam] Sanesecurity help

[Stephen Cox]

I found the problem.

At the bottom of spam.assassin.prefs.conf the entry "header
MS_FOUND_SPAMVIRUS exists:X-MailScanner-SpamVirus-Report" did not match the
header I attached. I changed it to "header MS_FOUND_SPAMVIRUS
exists:X-mycompanyname-MailScanner-SpamVirus-Report"

On Mon, Feb 14, 2011 at 12:04 PM, Richard Mealing <richard at fastnet.co.uk>wrote:

> Hi Stephen,
>
>
>
> Have you added this?
>
>
>
> Virus Names Which Are Spam = Sane*UNOFFICIAL HTML/* ScamNailer.Phish*
> winnow.malware* winnow.botnet.ff.trojans* winnow.botnets* Email.Phishing*
> CRDF.*
>
>
>
> Depending on what you are using…
>
>
>
> Then you need to add the rules into spamassassin, like –
>
>
>
> #Sanesecurity Signature (jurlbl.ndb)
>
> header SPAMVIRUSJurlblAuto X-YOURORGNAME-MailScanner-SpamVirus-Report =~
> /Sanesecurity.Jurlbl.Auto/i
>
> score SPAMVIRUSJurlblAuto 4.0
>
>
>
> I can send them all if you like.
>
>
>
> Richard
>
>
>
> *From:* mailscanner-bounces at lists.mailscanner.info [mailto:
> mailscanner-bounces at lists.mailscanner.info] *On Behalf Of *Stephen Cox
> *Sent:* 14 February 2011 09:52
> *To:* MailScanner discussion
> *Subject:* [FastNet PRO Probable Spam] Sanesecurity help
>
>
>
> I recently added Sanesecurity signatures to my clamd, the problem is that
> infected files just go through MailScanner.
>
>
>
> The message has an header entry of "...SpamVirus-Report:
> Sanesecurity.TestSig_Type4_Hdr.2.UNOFFICIAL", but it still delivers.
>
>
>
> MailScanner version is 4.79.11.
>
>
>
> What am I missing?
>
>
> --
> Stephen Cox
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
>


-- 
Stephen Cox
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110214/7226d9e3/attachment.html