[BlueOnyx:14176] Re: Solarspeed AV-SPAM V5

[Colin Jack]

Hi Michael,

>Yeah, maybe there is another rule with that name already. Could be a
>rule that's among the batch of dynamically downloaded rules.
>
>Change the three instances of ZIP_ATTACHED in the config file to
>something else. Like ZIP_ATTACHED_XXX, save the changes, restart
>SpamAssassin and try again.

Unfortunately not:

X-Spam-Status: Yes, score=11.6 required=6.0
tests=AWL,UNPARSEABLE_RELAY,\n\tZIP_ATTACHED_2 autolearn=spam version=3.3.2


Got a score of 20.0 on there but 11.6 total.

#-----------------------------------------------------
loadplugin Mail::SpamAssassin::Plugin::MIMEHeader

mimeheader ZIP_ATTACHED_2 Content-Type =~ /zip/i
describe ZIP_ATTACHED_2 email contains a zip file attachment
score ZIP_ATTACHED_2 20.0

mimeheader EXE_ATTACHED_2 Content-Type =~ /exe/i
describe EXE_ATTACHED_2 email contains an exe file attachment
score EXE_ATTACHED_2 20.0

uri	 DANGEROUS_URL_2 /\.(exe|zip|scr|pif|cmd|bat|vbs|wsh)$/i
describe DANGEROUS_URL_2        URL contains executable content
score    DANGEROUS_URL_2        20.0
#-----------------------------------------------------




Regards

Colin