I am using the copyto function to route a copy of any message that fails
the sniffer test to my email box.
If the message is a false positive I then insert the false positive
message into another email and send it off to the folks at sniffer.
What we found today is that for some reason headers are being inserted
into the false positive attached message from Outlook? Also, it is
inserting several other headers like altering the message id.
Example of headers in message before forwarding it out as attached
message
Received: from sender0012.lodo.exactis.com [64.208.135.32] by
mail1.gannett-tv.com with ESMTP
(SMTPD32-7.12) id A91A577000EA; Fri, 21 Mar 2003 13:25:30 -0500
Received: by sender0012.lodo.exactis.com
(queueup version 6.2: Copyright 2000 Experian, Inc. All rights
reserved.)
with stdio id KARE11_AAAJL29299; Fri, 21 Mar 2003 11:23:50 MST
Date: Fri, 21 Mar 2003 18:17:12 UT
From: "Tribune Alerts"
<[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Reply-To: "Tribune Alerts"
<[EMAIL PROTECTED]>
Errors-To:
[EMAIL PROTECTED]
Message-Id: <[EMAIL PROTECTED]>
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=ISO-8859-1
MIME-Version: 1.0
Subject: [POTENTIAL SPAM]'Shock and awe'
X-Mailer: Experian ContactMail Build v1.89 (Using MIME::Lite v2.117 )
X-RBL-Warning: OSSRC: Experian GBX-REQ000000006714-1 Spammed
[EMAIL PROTECTED] Was: 64.208.135.177 from
bog0007.lodo.exactis.com (bog0007.lodo.exactis.com [64.208.135.177]) by
relays.osirusoft.com
X-Declude-Sender:
[EMAIL PROTECTED]
[64.208.135.32]
X-Declude-Spoolname: D591a577000eadda1.SMD
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 348193479
Example of headers When they receive it and view the attached message
Reply-To: "Tribune Alerts"
<[EMAIL PROTECTED]>
From: "Tribune Alerts"
<[EMAIL PROTECTED]>
To: "Daly, Mark" <[EMAIL PROTECTED]>
Subject: [POTENTIAL SPAM]'Shock and awe'
Date: Fri, 21 Mar 2003 13:17:12 -0500
Message-ID:
<[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_016D_01C2EFD4.31C710F0"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.2627
X-Declude-Sender:
[EMAIL PROTECTED]
[64.208.135.32]
X-Declude-Spoolname: D591a577000eadda1.SMD
X-RCPT-TO: <[EMAIL PROTECTED]>
X-UIDL: 348193479
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-RBL-Warning: OSSRC: Experian GBX-REQ000000006714-1 Spammed
[EMAIL PROTECTED] Was: 64.208.135.177 from
bog0007.lodo.exactis.com (bog0007.lodo.exactis.com
[64.208.135.177]) by relays.osirusoft.com
Importance: Normal
Why would Outlook be altering an attached message?
Darrell
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
