Are you aware of: The assault on our users continues. It might be worth the squeeze to alert your Firefox users to this scam. Brian Fake Anti-Virus Poses As Microsoft Update Jayesh Limaye, Jun 10, 2011 1656 hrs IST

Question

It can be seen of late, that fake anti-virus attacks have become more professional, and can actually convince more innocent people than ever before, to fall into this trap. In this case, a huge amount of attention has been paid to copy the graphics and website elements of the original site to fool people into believing that the bogus site is in fact, the original. They have also taken advantage of the timing of the monthly update patch released by Microsoft, known as Patch Tuesday, to get more users into installing this malicious software.
Graham Cluley, Senior Technology Consultant at Sophos, said, "Users need to be more vigilant than ever before as bogus security alerts pop-up in their browsers. Fake anti-virus attacks are big business for cybercriminals and they are investing time and effort into making them as convincing as possible. Malicious hackers are using smart social engineering tricks more and more often, and the risk is that users will be scared by a phony warning into handing over money to fix problems that never existed in the first place".
The next time you see Microsoft update notification while using Firefox, steer clear of this wolf in sheep's clothing.

Answer 1

You are welcome. I'm glad you got it back up.
(1) You say you did the symbolic link. I will assume this is set correctly; it's very important that it is.
(2) I don't know what you mean by "Been feeding the [email protected] for several weeks now, 700 emails each day at least." After the initial training period, SpamAssassin doesn't learn from mail it has already processed correctly. At this point, you only need to teach SpamAssassin when it is wrong. [email protected] should only be getting spam that is being passed as clean. Likewise, [email protected] should only be getting legitimate mail that is being flagged as junk. You are redirecting mail to both [email protected] and [email protected] ... right? SpamAssassin needs both.
(3) Next, as I said before, you need to implement those "Frontline spam defense for Mac OS X Server." Once you have that done and issue "postfix reload" you can look at your SMTP log in Server Admin and watch as Postfix blocks one piece of junk mail after another. It's kind of cool.
(4) Add some SARE rules:
Visit http://www.rulesemporium.com/rules.htm and download the following rules:
70sareadult.cf
70saregenlsubj0.cf
70sareheader0.cf
70sarehtml0.cf
70sareobfu0.cf
70sareoem.cf
70sarespoof.cf
70sarestocks.cf
70sareunsub.cf
72sare_redirectpost
Visit http://www.rulesemporium.com/other-rules.htm and download the following rules:
backhair.cf
bogus-virus-warnings.cf
chickenpox.cf
weeds.cf
Copy these rules to /etc/mail/spamassassin/
Then stop and restart mail services.
There are other things you can do, and you'll find differing opinions about such things. In general, I think implementing the "Frontline spam defense for Mac OS X Server" and adding the SARE rules will help a lot. Good luck!