On 3/7/2013 2:36 PM, Linus Haake wrote: > -----Ursprüngliche Nachricht----- > Von: amavis-users [mailto:[email protected]] > Im Auftrag von Noel Jones > Gesendet: Donnerstag, 7. März 2013 13:16 > An: [email protected] > Betreff: Re: Heuristics.Phishing.Email.SpoofedDomain detected but not > quarantined > > On 3/7/2013 2:07 AM, Linus Haake wrote: >> Dear List, >> >> >> >> We're running two very identical servers (Centos 5 / 6) as inbound >> MTA. Both have >> >> >> >> - The same clamd.conf and Clamav release >> >> - The same signature files >> >> - Same version of amavisd-new conf >> >> >> >> installed. >> >> >> >> Since some weaks ago, I've recognized that Phishing detection works on >> both servers, but only one puts the detected file into Quarantine. >> >> >> >> I was searching for hours comparing the config files, reloading fresh >> signature db's but cannot find the reason for it. >> >> Clamd.log shows >> >> >> >> /Mon Mar 4 20:17:30 2013 -> >> /var/spool/amavis/tmp/amavis-20130304T201610-01721/parts/p003: >> Heuristics.Phishing.Email.SpoofedDomain FOUND/ >> >> >> >> but the message just passes as SPAM. >> >> >> >> Does anybody has a idea what the reason for this behavior could be? >> >> >> >> Thanks! >> >> >> > > > > The usual suspect is different setting of @virus_name_to_spam_score_maps > > > -- Noel Jones > > > Thanks Noel, > > Good hint - there wasn't anything mentioned at all on any server. I've added > > @virus_name_to_spam_score_maps = > (new_RE( # the order matters! > [ qr'^Phishing\.' => 4.1 ], > [ qr'^(Email|HTML|Sanesecurity)\.(Phishing|Spear|(Spam|Scam)[a-z0-9]?)\.'i > => 4.1 ], > [ qr'^Sanesecurity\.(Malware|Trojan)\.' => undef ], > [ qr'^Sanesecurity\.(Test|Rogue|Casino)' => undef ], > [ qr'^Sanesecurity\.(Hdr|Img|ImgO|Junk|Doc)\.'x => 6.1 ], > [ qr'^Sanesecurity\.(Lott|Fake|SpamImg|Job|Stk)\.'x => 6.1 ], > [ qr'^Sanesecurity\.(Loan|Porn|Bou|Dipl|Cred)\.'x => 6.1 ], > [ qr'^(MSRBL-Images/)' => 2.1 ], > [ qr'^(MSRBL-SPAM\.)' => 5.1 ], > [ qr'^MBL_' => undef ], # keep as infected > )); > > as an example config on both relay. The related paypal fake message is now > being reported as a virus from the server. > > None the less, from the pasted config I don't understand why it is recognized > as a virus - since Phishing is not mentioned as "undef" and the report says > > p006: Heuristics.Phishing.Email.SpoofedDomain FOUND > p003: Heuristics.Phishing.Email.SpoofedDomain FOUND > > >
Anything not matched by the list is considered a virus. The sample 'undef' entries are either to protect names from being unintentionally matched by later (further down the list) entries, or are placeholders/examples for the user to replace with a score. -- Noel Jones
