> header L_AV_Unofficial X-Amavis-AV-Status =~ > m{\bAV:Sanesecurity.TestSig_Type4_Hdr.2.UNOFFICIAL\b} > Which seems to be scoring 4 just fine: > X-Spam-Status: ... tests=[.. L_AV_Unofficial=4
Indeed. > The weird part is this: > > X-Spam-Status: ... > tests=[AV:Sanesecurity.TestSig_Type4_Hdr.2.UNOFFICIAL=0.1 > > You seem to have a very strangely named test > "AV:Sanesecurity.TestSig_Type4_Hdr.2.UNOFFICIAL" with a score of 0.1, which > isn't defined anywhere in the example you gave. The AV:Snesecurity... hit is inserted directly by amavisd, based on your @virus_name_to_spam_score_map setting. It is common to have such amavisd rules to score low and then have a SpamAssassin rule on the same or similar AV pattern for a higher score, the way you have it. This way other SpamAssassin mechanisms like Bayes, AWL, autolearning can take benefit of it. Mark