<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-GB link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal>Hi everyone,<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>I have been adding rulesets into SA with the following in
the “Virus Names Which Are Spam” - Sane*UNOFFICIAL HTML/*
ScamNailer.Phish* winnow.malware* winnow.botnet.ff.trojans* winnow.botnets*<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>It’s working great for me, so I thought I would share
this with you all if you are interested – <o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>The scores have been changed a few times but as I say, this
works great for me. All you should need to do is replace the ORGNAME.<o:p></o:p></p>
<p class=MsoNormal>I’ve also added the ScamVirus at the bottom (and
above) as I’m just downloading it periodically into the clam directory.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>#Sanesecurity Signature (jurlbl.ndb)<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSJurlblAuto
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.Jurlbl.Auto/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSJurlblAuto 3.0<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>#SaneSecurity Signature (phish.ndb)<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSDoc X-ORGNAME-MailScanner-SpamVirus-Report
=~ /Sanesecurity.Doc/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSDoc 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSFake X-ORGNAME-MailScanner-SpamVirus-Report
=~ /Sanesecurity.Fake/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSFake 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSPhishingAuction
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.Phishing.Auction./i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSPhishingAuction 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSPhishingAzon
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.Phishing.Azon/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSPhishingAzon 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSPhishingBank
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.Phishing.Bank/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSPhishingBank 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSPhishingCard
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.Phishing.Card/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSPhishingCard 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSPhishingCur
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.Phishing.Cur/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSPhishingCur 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSPhishingDca
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.Phishing.Dca/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSPhishingDca 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSPhishingFake
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.Phishing.Fake/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSPhishingFake 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSPhishingGiftCard
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.Phishing.GiftCard/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSPhishingGiftCard 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSPhishingHex
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.Phishing.Hex/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSPhishingHex 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSPhishingIvt
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.Phishing.Ivt/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSPhishingIvt 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSPhishingJsc
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.Phishing.Jsc/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSPhishingJsc 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSPhishingNam
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.Phishing.Nam/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSPhishingNam 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSPhishingOnf
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.Phishing.Onf/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSPhishingOnf 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSPhishingPay
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.Phishing.Pay/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSPhishingPay 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSPhishingRdi
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.Phishing.Rdi/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSPhishingRdi 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSPhishingRock
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.Phishing.Rock/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSPhishingRock 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSPhishingRockGen
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.Phishing.RockGen/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSPhishingRockGen 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSPhishingShop
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.Phishing.Shop/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSPhishingShop 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSPhishingSlw
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.Phishing.Slw/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSPhishingSlw 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSPhishingUrl
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.Phishing.Url/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSPhishingUrl 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSPhishingWrd
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.Phishing.Wrd/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSPhishingWrd 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSPhishingTestSig
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.PhishingTestSig/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSPhishingTestSig 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSTestSig_Type3_Bdy
X-ORGNAME-MailScanner-SpamVirus-Report =~ /TestSig_Type3_Bdy/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSTestSig_Type3_Bdy 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSTestSig_Type4_Bdy
X-ORGNAME-MailScanner-SpamVirus-Report =~ /TestSig_Type4_Bdy/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSTestSig_Type4_Bdy 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSTestSig_Type4_Hdr
X-ORGNAME-MailScanner-SpamVirus-Report =~ /TestSig_Type4_Hdr/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSTestSig_Type4_Hdr 3.0<o:p></o:p></p>
<p class=MsoNormal>#SaneSecurity Signature (scam.ndb)<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSSpam X-ORGNAME-MailScanner-SpamVirus-Report
=~ /Sanesecurity.Spam/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSSpam 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSCred X-ORGNAME-MailScanner-SpamVirus-Report
=~ /Sanesecurity.Cred/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSCred 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSDipl X-ORGNAME-MailScanner-SpamVirus-Report
=~ /Sanesecurity.Dipl/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSDipl 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSHdr X-ORGNAME-MailScanner-SpamVirus-Report
=~ /Sanesecurity.Hdr/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSHdr 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSImg X-ORGNAME-MailScanner-SpamVirus-Report
=~ /Sanesecurity.Img/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSImg 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSJob X-ORGNAME-MailScanner-SpamVirus-Report
=~ /Sanesecurity.Job/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSJob 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSLoan X-ORGNAME-MailScanner-SpamVirus-Report
=~ /Sanesecurity.Loan/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSLoan 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSPorn X-ORGNAME-MailScanner-SpamVirus-Report
=~ /Sanesecurity.Porn/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSPorn 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSImgo X-ORGNAME-MailScanner-SpamVirus-Report
=~ /Sanesecurity.Imgo/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSImgo 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSScam4 X-ORGNAME-MailScanner-SpamVirus-Report
=~ /Sanesecurity.Scam4/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSScam4 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSScamL X-ORGNAME-MailScanner-SpamVirus-Report
=~ /Sanesecurity.ScamL/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSScamL 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSStk X-ORGNAME-MailScanner-SpamVirus-Report
=~ /Sanesecurity.Stk/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSStk 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSTestSig
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.TestSig/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSTestSig 3.0<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>#SaneSecurity Signature (junk.ndb)<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSJunk X-ORGNAME-MailScanner-SpamVirus-Report
=~ /Sanesecurity.Junk/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSJunk 3.0<o:p></o:p></p>
<p class=MsoNormal>#SaneSecurity Signature (rogue.hdb)<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSRogue X-ORGNAME-MailScanner-SpamVirus-Report
=~ /Sanesecurity.Rogue/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSRogue 4.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSTrogan
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.Trojan/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSTrogan 4.0<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>#SaneSecurity Signature (lott.ndb)<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSLott X-ORGNAME-MailScanner-SpamVirus-Report
=~ /Sanesecurity.Lott/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSLott 3.0<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>#SaneSecurity Signature (spear.ndb)<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSSpear X-ORGNAME-MailScanner-SpamVirus-Report
=~ /Sanesecurity.Spear/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSSpear 3.0<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>#SaneSecurity Signature (spamimg.hdb)<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSSpamImg
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.SpamImg/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSSpamImg 3.0<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>#SaneSecurity Signature (spam.ldb)<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSSpamldg
X-ORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.Spam.ldb/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSSpamldg 3.0<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>#SaneSecurity Signature (winnow_malware.hdb)<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSwinmalware
X-ORGNAME-MailScanner-SpamVirus-Report =~ /winnow.malware/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSwinmalware 2.0<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>#SaneSecurity Signature (winnow_malware_links.ndb)<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSwinmalwarelink
X-ORGNAME-MailScanner-SpamVirus-Report =~ /winnow.botnet.ff.trojans/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSwinmalwarelink 3.0<o:p></o:p></p>
<p class=MsoNormal>header SPAMVIRUSwinmalwarelinkbot
X-ORGNAME-MailScanner-SpamVirus-Report =~ /winnow.botnets/i<o:p></o:p></p>
<p class=MsoNormal>score SPAMVIRUSwinmalwarelinkbot 3.0<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>#ScamNailer Config! New...<o:p></o:p></p>
<p class=MsoNormal>header SCAMNAILER X-ORGNAME-MailScanner-SpamVirus-Report =~
/ScamNailer.Phish/i<o:p></o:p></p>
<p class=MsoNormal>score SCAMNAILER 2.0<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Thanks,<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><span lang=EN-US>Rich</span><span lang=EN-US
style='font-size:8.0pt;color:#999999'><o:p></o:p></span></p>
<p class=MsoNormal><o:p> </o:p></p>
</div>
</body>
</html>