> header L_AV_Unofficial  X-Amavis-AV-Status =~
>   m{\bAV:Sanesecurity.TestSig_Type4_Hdr.2.UNOFFICIAL\b}
> Which seems to be scoring 4 just fine:
> X-Spam-Status: ... tests=[.. L_AV_Unofficial=4

Indeed.
 
> The weird part is this:
> 
> X-Spam-Status: ...
> tests=[AV:Sanesecurity.TestSig_Type4_Hdr.2.UNOFFICIAL=0.1
> 
> You seem to have a very strangely named test
> "AV:Sanesecurity.TestSig_Type4_Hdr.2.UNOFFICIAL" with a score of 0.1, which
> isn't defined anywhere in the example you gave.

The AV:Snesecurity... hit is inserted directly by amavisd,
based on your @virus_name_to_spam_score_map setting.

It is common to have such amavisd rules to score low and then
have a SpamAssassin rule on the same or similar AV pattern for a
higher score, the way you have it. This way other SpamAssassin
mechanisms like Bayes, AWL, autolearning can take benefit of it.

  Mark

Reply via email to