[prev in list] [next in list] [prev in thread] [next in thread] 

List:       spamassassin-users
Subject:    RE: here's a weird one [ or rule can't match ]
From:       Chris Santerre <csanterre () MerchantsOverseas ! com>
Date:       2004-04-29 16:14:52
Message-ID: 620A4FF9B83DD511B69900062939D037ABF901 () internal ! merchantsoverseas ! com
[Download RAW message or body]

I've written something similar, because despite reading all the docs, and
trying all the tricks , NAV for Exchange will still not stop sending these.
I've tried everything they mention. EVERYTHING. Finally just wrote a rule to
spamtrap it. Works great :) 

But based off of header, so it doesn't catch all. I'll give yours a shot
with FULL. 

--Chris

>-----Original Message-----
>From: Fred [mailto:spamassassin@freddyt.com]
>Sent: Thursday, April 29, 2004 11:58 AM
>To: Mark Merchant; spamassassin-users@incubator.apache.org
>Subject: Re: here's a weird one [ or rule can't match ]
>
>
>Try changing your rawbody rule to a "full" rule and see if that helps.
>
>Frederic Tarasevicius
>Internet Information Services, Inc.
>http://www.i-is.com/
>810-794-4400
>mailto:info@i-is.com
>
>
>
>Mark Merchant wrote:
>> <i'm sending this again w/ the sample spam removed>
>> 
>> here's a problem i haven't seen before, hopefully someone can help
>> me.
>> 
>> we have an upstream virus scanner that deletes executable attachments
>> before they get to SA, then an SA rule scores those messages higher.
>> ( our users are often confused by the "attachment deleted" tag so we
>> artificially score them higher so they go into their spam box. )
>> 
>> yesterday one slipped past, and i can't figure out why. i have tried
>> the rule w/ rawbody & full, alas to no avail.
>> 
>> any insights?
>> 
>> 
>> here is the rule ( from /etc/email/spamassassin/local.cf )
>> ====
>> # e-mail that has a deleted attachment(virus)
>> rawbody DISP_DELETED_ATTACHMENT_RULE /DELETED0\.TXT/i
>> score DISP_DELETED_ATTACHMENT_RULE 5.0
>> describe DISP_DELETED_ATTACHMENT_RULE dispatch rule to catch deleted
>> attachments from the snipers
>
[prev in list] [next in list] [prev in thread] [next in thread]