I found the problem.<div><br></div><div>At the bottom of spam.assassin.prefs.conf the entry "header MS_FOUND_SPAMVIRUS exists:X-MailScanner-SpamVirus-Report" did not match the header I attached. I changed it to "header MS_FOUND_SPAMVIRUS exists:X-mycompanyname-MailScanner-SpamVirus-Report"<br>
<br><div class="gmail_quote">On Mon, Feb 14, 2011 at 12:04 PM, Richard Mealing <span dir="ltr"><<a href="mailto:richard@fastnet.co.uk">richard@fastnet.co.uk</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div lang="EN-GB" link="blue" vlink="purple"><div><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">Hi Stephen,</span></p><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"> </span></p><p class="MsoNormal">
<span style="font-size:11.0pt;color:#1F497D">Have you added this? </span></p><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"> </span></p><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">Virus Names Which Are Spam = Sane*UNOFFICIAL HTML/* ScamNailer.Phish* winnow.malware* winnow.botnet.ff.trojans* winnow.botnets* Email.Phishing* CRDF.*</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"> </span></p><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">Depending on what you are using…</span></p><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">Then you need to add the rules into spamassassin, like – </span></p><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"> </span></p><p class="MsoNormal">
<span style="font-size:11.0pt;color:#1F497D">#Sanesecurity Signature (jurlbl.ndb)</span></p><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">header SPAMVIRUSJurlblAuto X-YOURORGNAME-MailScanner-SpamVirus-Report =~ /Sanesecurity.Jurlbl.Auto/i</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">score SPAMVIRUSJurlblAuto 4.0</span></p><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"> </span></p><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">I can send them all if you like.</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"> </span></p><p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;color:#1F497D">Richard</span></p><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"> </span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt">From:</span></b><span lang="EN-US" style="font-size:10.0pt"> <a href="mailto:mailscanner-bounces@lists.mailscanner.info" target="_blank">mailscanner-bounces@lists.mailscanner.info</a> [mailto:<a href="mailto:mailscanner-bounces@lists.mailscanner.info" target="_blank">mailscanner-bounces@lists.mailscanner.info</a>] <b>On Behalf Of </b>Stephen Cox<br>
<b>Sent:</b> 14 February 2011 09:52<br><b>To:</b> MailScanner discussion<br><b>Subject:</b> [FastNet PRO Probable Spam] Sanesecurity help</span></p><div><div></div><div class="h5"><p class="MsoNormal"> </p><p class="MsoNormal">
I recently added Sanesecurity signatures to my clamd, the problem is that infected files just go through MailScanner.</p><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">The message has an header entry of "...SpamVirus-Report: Sanesecurity.TestSig_Type4_Hdr.2.UNOFFICIAL", but it still delivers.</p>
</div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">MailScanner version is 4.79.11.</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">What am I missing?</p></div><div><p class="MsoNormal" style="margin-bottom:12.0pt">
<br>-- <br>Stephen Cox</p></div></div></div></div></div><br>--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
<br></blockquote></div><br><br clear="all"><br>-- <br>Stephen Cox<br><br>
</div>