Hi,
Today a lot of my users have been receiving a email with a dynamic Word attachment which contains a macro. I've tweaked the score I had for (Heuristics\.)?OLE2\.ContainsMacros from 4 to 10 in virus_name_to_spam_score_maps which is blocking the messages for now. @virus_name_to_spam_score_maps = ( new_RE ( ... [ qr'^(Heuristics\.)?OLE2\.ContainsMacros' => 10.0 ], ... ) ); However I know from past experience that when I ramp up this score I get complains from end users they they've not received a email "they always used to get". I''m sure we all agree that sending or receiving emails with macros enabled attachments is a no no, but unfortunately in the real work daft things happen. During further research I found this http://lists.amavis.org/pipermail/amavis-users/2011-October/000934.html which has allowed me to utilise Amavis / ClamAVs detection of the macro in SpamAssassion header __SCS_AV_MACRO X-Amavis-AV-Status =~ m{\bAV:(Heuristics\.)?OLE2\.ContainsMacros}i What I was wondering is there a way I can pass Amavis AM.PENPAL status to spamassassin? The long term goal being a meta rule in spamassassin which checks if you're a PENPAL and a Macro sender then knock a few points off (or more likely if you're a Macro sender and not a PENPAL then add a load of points on!) Any thoughts gratefully received. Regards Steve This email is from Spectrum Computer Solutions Limited (Company Number 04591631), a company registered in England and Wales with its registered office at 331 Ansty Road, Wyken, Coventry, CV2 3FN. DISCLAIMER This email is for the use of the intended recipient(s) only. If you have received this email in error, please notify the sender immediately and then delete it. If you are not the intended recipient, you must not keep, use, disclose, copy or distribute this email without the authors prior permission. We have taken precautions to minimise the risk of transmitting software viruses, but we advise you to carry out your own virus checks on any attachment to this message. We cannot accept liability for any loss or damage caused by software viruses. The information contained in this communication may be confidential and may be subject to the attorney-client privilege. If you are the intended recipient and you do not wish to receive similar electronic messages from us in future then please respond to the sender to this effect.
