Sanesecurity and SA

[Phil Daws]

Hello,

does anybody have a work ruleset for SA and Sanesecurity clam signatures.  For some weird reason these are not working :(

################################################################################
# SaneSecurity & MSRBL Signatures
################################################################################
header CLAM_SS_AUCTION     X-Amavis-AV-Status =~ /Sanesecurity\.Auction/
header CLAM_SS_BLURL       X-Amavis-AV-Status =~ /Sanesecurity\.Blurl/
header CLAM_SS_CASINO      X-Amavis-AV-Status =~ /Sanesecurity\.Casino/
header CLAM_SS_CRED        X-Amavis-AV-Status =~ /Sanesecurity\.Cred/
header CLAM_SS_DIPL        X-Amavis-AV-Status =~ /Sanesecurity\.Dipl/
header CLAM_SS_DOC         X-Amavis-AV-Status =~ /Sanesecurity\.Doc/
header CLAM_SS_HDR         X-Amavis-AV-Status =~ /Sanesecurity\.Hdr/
header CLAM_SS_IMG         X-Amavis-AV-Status =~ /Sanesecurity\.Img/
header CLAM_SS_JOB         X-Amavis-AV-Status =~ /Sanesecurity\.Job/
header CLAM_SS_JUNK        X-Amavis-AV-Status =~ /Sanesecurity\.Junk/
header CLAM_SS_JURLBL      X-Amavis-AV-Status =~ /Sanesecurity\.Jurlbl/
header CLAM_SS_LOAN        X-Amavis-AV-Status =~ /Sanesecurity\.Loan/
header CLAM_SS_MALWARE     X-Amavis-AV-Status =~ /Sanesecurity\.Malware/
header CLAM_SS_PHISHING    X-Amavis-AV-Status =~ /Sanesecurity\.Phishing/
header CLAM_SS_PORN        X-Amavis-AV-Status =~ /Sanesecurity\.Porn/
header CLAM_SS_ROGUE       X-Amavis-AV-Status =~ /Sanesecurity\.Rogue/
header CLAM_SS_ROGUE       X-Amavis-AV-Status =~ /Sanesecurity\.Trojan/
header CLAM_SS_SCAM        X-Amavis-AV-Status =~ /Sanesecurity\.Scam/
header CLAM_SS_SPAM        X-Amavis-AV-Status =~ /Sanesecurity\.Spam/
header CLAM_SS_SPEAR       X-Amavis-AV-Status =~ /Sanesecurity\.Spear/
header CLAM_SS_STK         X-Amavis-AV-Status =~ /Sanesecurity\.Stk/
header CLAM_SS_TEST        X-Amavis-AV-Status =~ /Sanesecurity\.TestSig/
header CLAM_SS             X-Amavis-AV-Status =~ /Sanesecurity/
header CLAM_MSRBL          X-Amavis-AV-Status =~ /MSRBL/
header CLAM_MBL            X-Amavis-AV-Status =~ /MBL/
header CLAM_SECURITEINFO   X-Amavis-AV-Status =~ /SecuriteInfo/
header CLAM_WINNOW         X-Amavis-AV-Status =~ /winnow/
header CLAM_INETMSG        X-Amavis-AV-Status =~ /INetMsg/
header CLAM_SAFEBROWSING   X-Amavis-AV-Status =~ /Safebrowsing/
header CLAM_SCAMNAILER     X-Amavis-AV-Status =~ /ScamNailer/
header CLAM_OTHERS         X-Amavis-AV-Status =~ /Email|HTML|JS.Redirect/
header CLAM_DOPPELSTERN    X-Amavis-AV-Status =~ /Doppelstern/
header CLAM_CRDF_BACKDOOR  X-Amavis-AV-Status =~ /CRDF.Backdoor/
header CLAM_CRDF_TROJAN    X-Amavis-AV-Status =~ /CRDF.Gen.Trojan|CRDF.Trojan/

Thanks, Phil