<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7654.12">
<TITLE>RE: Rechnung offline Spam</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">From what I have read</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">,</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> when writing custom rules these lines should be added to the /etc/mail/spamassassin/local.cf file.</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> Below is an example of one of my custom rules to subtract 2.0 from the spam score for messages coming through our mail encryption service.</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> You may want to consider "ALL" instead of just "Subject" in your test line</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> for broader coverage</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> but I believe that your syntax is correct.</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT FACE="Courier New">#</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Courier New">#Subtract 2.0 from Spam Score for any ZIX processed message</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Courier New">header ZIX_MESSAGE ALL =~ /zixvpm/</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Courier New">score ZIX_MESSAGE -2.0 -2.0 -2.0 -2.0</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Courier New">describe ZIX_MESSAGE Lower Score of ZIX Me</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT FACE="Courier New">s</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT FACE="Courier New">sages</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Courier New">#</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">See also:</FONT></SPAN><SPAN LANG="en-us"> </SPAN><A HREF="http://wiki.apache.org/spamassassin/WritingRules"><SPAN LANG="en-us"><U><FONT COLOR="#0000FF" FACE="Calibri">http://wiki.apache.org/spamassassin/WritingRules</FONT></U></SPAN><SPAN LANG="en-us"></SPAN></A><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">Bryan S. Laurila</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Senior Network Support Analyst</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Dickinson County Healthcare System</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">-----Original Message-----<BR>
From: mailscanner-bounces@lists.mailscanner.info [<A HREF="mailto:mailscanner-bounces@lists.mailscanner.info">mailto:mailscanner-bounces@lists.mailscanner.info</A>] On Behalf Of Johan Hendriks<BR>
Sent: Wednesday, June 11, 2014 8:42 AM<BR>
To: MailScanner List (mailscanner@lists.mailscanner.info)<BR>
Subject: Rechnung offline Spam</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Hello all.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">I am trying to stop some spam but it seems MailScanner just lets them pass...</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">It is about mail with the following Subject.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">RechnungOnline Monat Juni 2014 (Buchungskonto: 4660367728)</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">So i made a custum.cf file with the following</FONT></SPAN></P>
<BR>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">header TELECOM_SUBJECT Subject =~ /RechnungOnline/i</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">score TELECOM_SUBJECT 5.1</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">describe TELECOM_SUBJECT Telekom spam</FONT></SPAN></P>
<BR>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Is my rule not ok, and is it looking for a subject ONLY with RechnungOnline ??</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Secondly the mail contains a Trojan and that also is getting through?</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Could someone please help me.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">regards</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Johan</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">--</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">MailScanner mailing list</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><A HREF="mailto:mailscanner@lists.mailscanner.info"><SPAN LANG="en-us"><FONT FACE="Calibri">mailscanner@lists.mailscanner.info</FONT></SPAN><SPAN LANG="en-us"></SPAN></A><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><A HREF="http://lists.mailscanner.info/mailman/listinfo/mailscanner"><SPAN LANG="en-us"><FONT FACE="Calibri">http://lists.mailscanner.info/mailman/listinfo/mailscanner</FONT></SPAN><SPAN LANG="en-us"></SPAN></A><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Before posting, read</FONT></SPAN><SPAN LANG="en-us"> </SPAN><A HREF="http://wiki.mailscanner.info/posting"><SPAN LANG="en-us"><FONT FACE="Calibri">http://wiki.mailscanner.info/posting</FONT></SPAN><SPAN LANG="en-us"></SPAN></A><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Support MailScanner development - buy the book off the website! </FONT></SPAN></P>
</BODY>
</HTML>
<BR>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >
<head>
<title>Untitled Page</title>
</head>
<body style="font-size: 12pt">
<strong><span style="font-size: 9pt">
Confidentiality Notice: </span></strong>
<br />
<br />
<span style="font-size: 8pt">
<span>
This e-mail communication and any attachments may contain confidential and privileged information for the use of the designated recipients named above. If you are not the intended recipient, you are hereby notified that you have received this communication in error and that any review, disclosure, dissemination, distribution or copying of it or its contents is prohibited. As required by federal and state laws, you need to hold this information as privileged and confidential.
<br />
<br />
This message may contain Protected Health Information (PHI). PHI is personal and sensitive information related to a person's health care. It is being emailed to you after appropriate authorization from the patient or under circumstances that do not require patient authorization. You, the recipient, are obligated to maintain it in a safe, secure and confidential manner. Re-disclosure without additional patient consent or as permitted by law is prohibited. Unauthorized re-disclosure or failure to maintain confidentiality could subject you to penalties described in federal and state law.
<br />
<br />
If you are not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any disclosure, copying or distribution of this information is <strong>Strictly Prohibited</strong>.
If you have received this communication in error, please notify the sender and destroy all copies of this communication and any attachments.</span>
<br />
<br />
<span style="font-size: 7pt">
Dickinson County Healthcare System, 1721 S. Stephenson Ave. Iron Mountain, MI 49801, www.dchs.org </span>
</span>
</body>
</html>