On 3/3/2010 8:22 AM, twofers wrote: > I have 52 of these sitting in my inbox this morning when I came in to > work. this is just the beginning. I get literally hundreds of these a > day and Spamassassin does not even check them. > > Thats hundreds of these every day for weeks and weeks and weeks on end. > > -W >
Interesting, while catching viruses is explicitly out-of-scope for SA (these are FakeAV virus messages), we should at least figure out why it is not being checked by SA. There are two general causes here: Is the message (with attachments) particularly large? By default spamc will skip scanning any message over 500k. (you can, of course, change this with the -s parameter, but be cautious, really large messages can cause a lot of load when scanned). Since this is a virus, there's likely an attachment, and it may be large enough. The only other cause would be if the message was never passed to SpamAssassin in the first place. How have you integrated SA? Is there any bypass mechanism there?
