Atomicorp

A client is no longer receiving legitimate lottery mails from a certain domain, because rules from Sanesecurity.Lott are intercepting them. For SpamAssassin I know you can whitelist domains, etc., but is there any way to disable ClamAV rules, either for a specific domain or globally?

If not I guess we'll just need to remove the /var/clamav/lott.ndb file, stop /usr/bin/clamav_updater.sh from fetching Sanesecurity.Lott updates and restart clamd.

I see on http://www.sanesecurity.com/contactus.htm it's possible to report false positives to Sanesecurity, but we'll first need to get our hands on a copy of those e-mails then.

For now I have removed /var/clamav/lott.ndb and disabled the lott.ndb update in clamav_updater.sh.

and how to add a better check? cause i still have some spam in our mailboxes...(clamav and spamassassin, out of the plesk licence)

If this in relation to improving spam detection, its better to start a new topic than to hijack an existing one.

In reference to disabling specific rules, it absolutely can be done, we figured out how and then promptly forgot all about it. If I recall there was a database file you could create in /var/clamav to do it

scott wrote:In reference to disabling specific rules, it absolutely can be done, we figured out how and then promptly forgot all about it. If I recall there was a database file you could create in /var/clamav to do it

If you suddenly remember again, I'd like to know. Maybe stick it on the wiki.

Yeah, mike figured it out, not me. And hes on vacation...