In SA 3.1.8, I am trying to use the clamav plugin from
http://wiki.apache.org/spamassassin/ClamAVPlugin

spamassassin -t -D output includes
dbg: ClamAV: Detected virus: Email.Stk.Gen596.Sanesecurity.07071900.pdf

It adds a header
X-Spam-Virus: Yes (Email.Stk.Gen596.Sanesecurity.07071900.pdf)
allright, but additional rules to check for sanesecurity "virus" names
are not matched.

Rules:

header __MY_CLAMAV X-Spam-Virus =~ /Yes/i
header __MY_CLAMAV_SANE X-Spam-Virus =~ /Yes.{1,50}Sanesecurity/i
meta MY_CLAMAV_SANE (__MY_CLAMAV && __MY_CLAMAV_SANE)
score MY_CLAMAV_SANE 5

Any suggestions what is going wrong?

Regards,

wolfgang