> There is a SpamAssassin plugin which checks messages with
> ClamAV, which adds the following header to emails


> What I would like to do would be to score the ClamAV
> detection differently depending on whether it was


Your problem is that the ClamAV plugin doesn't add a header as=20
metadata to the message, so there is no header to check in rules.

Fortunately, you only have to add one single line to the plugin=20
in order to add the header. This is the line I've added here:

$permsgstatus->{msg}->put_metadata('ClamAV-Result',$header);

It's added directly before the line
and makes it possible to use the header "ClamAV-Result" in rules=20
(and to get it from the mail object, wich is what I do).

For your rules to work as is you'd want to add it as:

$permsgstatus->{msg}->put_metadata('X-Spam-Virus',$header);

Add the line directly above the line:

return $isspam;

Regards
/Jonas

OliverScott wrote:
> There is a SpamAssassin plugin which checks messages with ClamAV, which=

adds
> the following header to emails it processes:
>=20
> X-Spam-Virus: Yes ($VirusName)
>=20
> http://wiki.apache.org/spamassassin/ClamAVPlugin
>=20
> By default you can set a score in its clamav.cf file:
>=20
> score CLAMAV 10
>=20
> I am currently testing a 3rd party set of ClamAV definitions from a web=

site
> called www.sanesecurity.co.uk which look to be very effective against s=

ome
> phishing and image spam emails. When it fires on an email the headers t=

he
> ClamAV plugin adds are as follows:
>=20
> X-Spam-Virus: Yes ($Name.Sanesecurity)
>=20
> What I would like to do would be to score the ClamAV detection differen=

tly
> depending on whether it was detected by the ClamAV default signatures
> (virus) or the Sanesecurity signatures (spam). I have tried adding the
> following to local.cf but it doesn't seem to be working:
>=20
> header __MY_CLAMAV X-Spam-Virus =3D~ /Yes/i
> header __MY_CLAMAV_SANE X-Spam-Virus =3D~ /Yes.{1,50}Sanesecurity/i
> meta MY_CLAMAV (__MY_CLAMAV && !__MY_CLAMAV_SANE)
> meta MY_CLAMAV_SANE (__MY_CLAMAV && __MY_CLAMAV_SANE)
> score MY_CLAMAV 10
> score MY_CLAMAV_SANE 5
>=20
> Any suggestions?


--=20
Jonas Eckerman, FSDB & Frukttr=E4det
http://whatever.frukt.org/
http://www.fsdb.org/
http://www.frukt.org/