Here are settings for sare_html0
SARE_HTML0=1103; # Index of sare_html0 data into the arrays is 1103
CF_URLS[1103]="http://www.rulesemporium.com/rules/70_sare_html0.cf"
CF_FILES[1103]="70_sare_html0.cf";
CF_NAMES[1103]="SARE html0 Ruleset for SpamAssassin";
PARSE_NEW_VER_SCRIPTS[1103]="${PERL} -ne 'print ifi /^\s*#.*(vers?|version|rev|revision)[:\.\s]*[0-9]/i;' | sort | ${TAIL}";
# CF_MUNGE_SCRIPTS[1103]="nothing for this ruleset.";

Here are settings for single sare_header0 files
SARE_HEADER0=1130;
CF_URLS[1130]="http://www.rulesemporium.com/rules/70_sare_header0.cf"
CF_FILES[1130]="70_sare_header0.cf";
CF_NAMES[1130]="SARE HEADER Ruleset 0 for SpamAssassin";
PARSE_NEW_VER_SCRIPTS[1130]="${PERL} -ne 'print if /^\s*#.*(version|rev|revision)[:\.\s]*[0-9]/i ;' | sort | tail -1";
# CF_MUNGE_SCRIPTS[1130]="nothing for this ruleset.";

Here are settings for single sare_uri0 files
SARE_uri0=1122;
CF_URLS[1122]="http://www.rulesemporium.com/rules/70_sare_uri0.cf";
CF_FILES[1122]="70_sare_uri0.cf";
CF_NAMES[1122]="SARE uri Ruleset 0 for SpamAssassin";
PARSE_NEW_VER_SCRIPTS[1122]="${PERL} -ne 'print if /^\s*#.*(version|rev|revision)[:\.\s]*[0-9]/i ;' | sort | tail -1";
# CF_MUNGE_SCRIPTS[1122]="nothing for this ruleset.";
...
...

Run /etc/mail/rulesdujour/my_rules_du_jour periodically. Please read the SARE download policy at http://rulesemporium.com/rules.htm.

* Configure server-wide Spamassassin

pico /etc/mail/spamassassin/local.cf

Add this:

report_safe 0
required_score 12

# The default score for BAYES and SURBL is too low compare to my reject threshold(see section5) at 15
score BAYES_99 6.00

# Check here for the detail of the URIBL data sources
# http://answers.google.com/answers/threadview?id=422251
score URIBL_SBL 4.50
score URIBL_AB_SURBL 6.50
score URIBL_OB_SURBL 4.50
score URIBL_SC_SURBL 6.00
score URIBL_WS_SURBL 4.50
score URIBL_PH_SURBL 6.00

# Enable server-wide Vipul's Razor in Spamassassin
# Remove razor_config line if you want to disable Vipul's Razor
razor_config /var/spool/mqueue/.razor/razor-agent.conf

# Enable server-wide DCC in Spamassassin
# Remove dcc_home line if you want to disable DCC
dcc_home /var/dcc

For SpamAssassin version 3.10:

pico /etc/mail/spamassassin/v310.pre

To enable Razor and DCC, you have to uncomment the loadplugin line for the Razor and DCC.

# DCC is disabled here because it is not open source. See the DCC
# license for more details.
#
loadplugin Mail::SpamAssassin::Plugin::DCC

# Razor2 is disabled here because it is not available for unlimited free
# use. It is currently free for personal use, subject to capacity
# constraints. See the Cloudmark SpamNet Service Policy for more details.
#
loadplugin Mail::SpamAssassin::Plugin::Razor2

Suppress some of useless warnings.

2005-05-03 03:46:54 no IP address found for host ptil-26-132-del.primus-india.net (during SMTP connection from (comcast.net) [203.196.132.26])
2005-05-03 03:45:43 unexpected disconnection while reading SMTP command from 168-226-70-177.speedy.com.ar [168.226.70.177]

Login into WHM / Exim Configuration Editor, switch to Advanced Mode. In the first textarea as shown in this picture:

Add this:

log_selector = -host_lookup_failed -lost_incoming_connection
# For debugging purpose add +subject and +argument.
# It will show the subject of email and the folder of the script invoking sendmail.
#
# 200c-04-22 00:50:19 cwd=/home/username/public_html/spamsource 3 args: /usr/sbin/sendmail -t -i
#
# You will find spammer on your server easier.
# log_selector = +subject +arguments -host_lookup_failed -lost_incoming_connection

Login into WHM / Exim Configuration Editor, switch to Advanced Mode. In the first textarea as shown in this picture:

Add this:

av_scanner = clamd:/var/clamd

Scroll down to the begin acl section as shown in this picture.

In the middle textarea, scroll to the bottom of the box and under check_message ACL change from

#!!# ACL that is used after the DATA command
check_message:
require verify = header_sender
accept

To

#!!# ACL that is used after the DATA command
check_message:
require verify = header_sender

# Reject messages with serious MIME container errors

deny message = This message contains malformed MIME ($demime_reason).
demime = *
condition = ${if >{$demime_errorlevel}{2}{1}{0}}

# Reject messages attach attach a file with a CLSID in the name
# which causes Windows to hide the file extension.

deny message = Hiding of file extensions(CLSID hidden) is not allowed.
regex = ^(?i)Content-Disposition::(.*?)filename=\\s*"+((\{[a-hA-H0-9-]{25,}\})|((.*?)\\s{10,}(.*?)))"+\$

# Reject messages attach illegal extension files

deny message = We do not accept ".$found_extension" attachments here. If you meant to send this file then please package it up as a zip file and resend it.
# You might need to remove some of these extensions if you want to allow your user get these files
demime = ade:adp:bas:bat:chm:cmd:com:cpl:crt:eml:exe:hlp:hta:inf:ins:isp:jse:lnk:mdb:mde:msc:msi:msp:pcd:pif:reg:scr:sct:shs:url:vbs:vbe:wsf:wsh:wsc

# Reject email contains Virus

deny message = This message contains a virus or other harmful content ($malware_name)
demime = *
malware = */defer_ok

# Add X-Scanned Header

warn message = X-Antivirus-Scanner: Clean mail though you should still use an Antivirus

accept

Create whitelists

mkdir /usr/local/cpanel/base/eximacl
cd /usr/local/cpanel/base/eximacl
touch rv_virus_receiver_domain_whitelist
echo '# Virus receiver Domain Name Whitelist' rv_virus_receiver_domain_whitelist
echo '# Although it is a domain list, you need to put in the address format' rv_virus_receiver_domain_whitelist
echo '# *@example.com'
rv_virus_sender_address_whitelist
echo '# Format: email address in lowercase listed line by line, asterisk is allowed' rv_virus_sender_address_whitelist
echo '# *@example.com' rv_virus_sender_address_whitelist

touch rv_filetype_receiver_domain_whitelist
echo '# File Type Scanning receiver Domain Name Whitelist' rv_filetype_receiver_domain_whitelist
echo '# Although it is a domain list, you need to put in the address format' rv_filetype_receiver_domain_whitelist
echo '# *@example.com'
rv_filetype_sender_address_whitelist
echo '# Format: email address in lowercase listed line by line, asterisk is allowed' rv_filetype_sender_address_whitelist
echo '# *@example.com' rv_filetype_sender_address_whitelist

Login into WHM / Exim Configuration Editor, switch to Advanced Mode. In the first textarea as shown in this picture:

Add these lines.

av_scanner = clamd:/var/clamd

Scroll down to the begin acl section as shown in this picture.

In the middle textarea, scroll to the bottom of the box and under check_message ACL change from

#!!# ACL that is used after the DATA command
check_message:
require verify = header_sender
accept

To

#!!# ACL that is used after the DATA command
check_message:
require verify = header_sender

# Reject messages with serious MIME container errors

deny message = This message contains malformed MIME ($demime_reason).
demime = *
condition = ${if >{$demime_errorlevel}{2}{1}{0}}

# Reject messages attach illegal extension files

deny message = We do not accept ".$found_extension" attachments here. If you meant to send this file then please package it up as a zip file and resend it.
# You might need to remove some of these extensions if you want to allow your user get these files
demime = bat:cmd:com:cpl:pif:reg:scr

# Reject messages attach attach a file with a CLSID in the name
# which causes Windows to hide the file extension.

deny message = Hiding of file extensions(CLSID hidden) is not allowed.
regex = ^(?i)Content-Disposition::(.*?)filename=\\s*"+((\{[a-hA-H0-9-]{25,}\})|((.*?)\\s{10,}(.*?)))"+\$

# Add a warning header if email contains illegal extension files but acccept the message

warn message = X-Antivirus-Filetype: Infected - $found_extension
# You might need to remove some of these extensions if you want to allow your user get these files
demime = ade:adp:bas:bat:chm:cmd:com:cpl:crt:eml:exe:hlp:hta:inf:ins:isp:jse:lnk:mdb:mde:msc:msi:msp:pcd:pif:reg:scr:sct:shs:url:vbs:vbe:wsf:wsh:wsc

# Add a warning header if email contains Virus but acccept the message

warn message = X-Antivirus-Scanner: Infected - $malware_name
demime = *
malware = */defer_ok

accept

Scroll down to the bottom of the page and save the new configuration.

Login into WHM / Exim Configuration Editor, under options section change the system filter file to the new one preventing cPanel overwrite you file.

In my case I use /usr/local/cpanel/base/eximacl/antivirusandspam.exim as my Exim system filter file.

SSH to the server as root and edit exim system filter.

cp /etc/antivirus.exim /usr/local/cpanel/base/eximacl/antivirusandspam.exim
pico /usr/local/cpanel/base/eximacl/antivirusandspam.exim

Remove this:

---

# Attempt to catch embedded VBS attachments
# in emails. These were used as the basis for
# the ILOVEYOU virus and its variants - many many varients
# Quoted filename - [body_quoted_fn_match]
if $message_body matches "(?:Content-(?:Type:(?>\\\\s*)[\\\\w-]+/[\\\\w-]+|Disposition:(?>\\\\s*)attachment);(?>\\\\s*)(?:file)?name=|begin(?>\\\\s+)[0-7]{3,4}(?>\\\\s+))(\"[^\"]+\\\\.(?:ad[ep]|ba[st]|chm|cmd|com|cpl|crt|eml|exe|hlp|hta|in[fs]|isp|jse?|lnk|md[be]|ms[cipt]|pcd|pif|reg|scr|sct|shs|url|vb[se]|ws[fhc])\")[\\\\s;]"
then
fail text "This message has been rejected because it has\n\
a potentially executable attachment $1\n\
This form of attachment has been used by\n\
recent viruses or other malware.\n\
If you meant to send this file then please\n\
package it up as a zip file and resend it."
seen finish
endif
# same again using unquoted filename [body_unquoted_fn_match]
if $message_body matches "(?:Content-(?:Type:(?>\\\\s*)[\\\\w-]+/[\\\\w-]+|Disposition:(?>\\\\s*)attachment);(?>\\\\s*)(?:file)?name=|begin(?>\\\\s+)[0-7]{3,4}(?>\\\\s+))(\\\\S+\\\\.(?:ad[ep]|ba[st]|chm|cmd|com|cpl|crt|eml|exe|hlp|hta|in[fs]|isp|jse?|lnk|md[be]|ms[cipt]|pcd|pif|reg|scr|sct|shs|url|vb[se]|ws[fhc]))[\\\\s;]"
then
fail text "This message has been rejected because it has\n\
a potentially executable attachment $1\n\
This form of attachment has been used by\n\
recent viruses or other malware.\n\
If you meant to send this file then please\n\
package it up as a zip file and resend it."
seen finish
endif

---

# Let email get through user inbox if it matches the whitelist rules for Virus Scanning
# Otherwise discard the email

if
$h_X-Antivirus-Scanner: matches "Infected - (.*)"
and ("${lookup{${lc:$sender_address}}lsearch*@{/usr/local/cpanel/base/eximacl/rv_virus_sender_address_whitelist}{1}{fail}}" is "fail")
# A message may have many recipients, so many local parts and domains, but
# the system filter is run only once. If the domains are different, all domains MUST listed in the whitelist,
# otherwise email will be rejected.
and foranyaddress ${lc:$recipients}("${lookup{${thisaddress}}lsearch*@{/usr/local/cpanel/base/eximacl/rv_virus_receiver_domain_whitelist}{1}{fail}}" is "fail")
then
seen
# If you want to bounce message, comment 2 lines below and uncomment the line begin with fail.
logfile /var/log/exim_mainlog
logwrite "$tod_log $message_id F=${lc:$sender_address} [$sender_host_address] discarded: This message contains a virus or other harmful content ($1)"
# Bounce it, but the sender is often forged, in which case the bounce will either bounce
# and end up frozen in your queue, or go to some innocent bystander.
# Highly NOT recommend.
# fail text "This message contains a virus or other harmful content ($1)"
finish
endif