RE: [Declude.JunkMail] BASE64 violating mailers

[John Tolmachoff \(Lists\)]

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165   That is the line.   However, that is an older version. Or is that OE in IE 6.0? That line does appear when using OE in IE 6.0. However, OE inserts a line above that to where it should look like this:   X-Mailer: Microsoft Outlook Express 6.00.2800.1158 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165   Are you sure that is the full headers?   Also, why is it showing a line calling an Exchange event sink?   It is possible that the sender purposely or otherwise caused it to become encoded.   John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble Sent: Wednesday, September 24, 2003 8:46 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] BASE64 violating mailers   I just found an(other) example of legit E-mail using base64 encoding for text segments.  I would like to create an anti-filter for this (along with OWA for Exchange violations), however I'm having trouble identifying what piece of software or other identifying characteristic appears in the following message headers can be positively linked to this behavior: From <--SNIP--> Tue Sep 23 11:58:28 2003 Received: from --SNIP-- [--SNIP--] by --SNIP-- with ESMTP   (SMTPD32-7.13) id AD962BE019C; Tue, 23 Sep 2003 11:58:14 -0400 X-Exclaimer-OnMessagePostCategorize-{71daf94f-e3fe-4bbf-865a-6309cc88575e}: C:\Program Files\eXclaimer\eXclaimer.dll - 2.0.4.67 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Content-Transfer-Encoding: 7bit Content-Class: urn:content-classes:message Subject: What a Sight! Importance: normal Priority: normal MIME-Version: 1.0 Content-Type: multipart/mixed;     boundary="----_=_NextPart_001_01C381EB.7EA73E73" Date: Tue, 23 Sep 2003 11:58:13 -0400 Message-ID: <[EMAIL PROTECTED]> X-MS-Has-Attach: yes X-MS-TNEF-Correlator: Thread-Topic: What a Sight! thread-index: AcOB6lcQHs7kFedSQxyWKNoHWv8qcAAANutg From: "--SNIP--" <--SNIP--> To: "--SNIP--" <--SNIP--> In the message body, the text was displayed as both HTML and base64 encoded.  This appears to have been sent through an E-mail client, either PC-based or Web mail.  The only thing out of the ordinary is the note left by a program called eXclaimer which is used to tag outgoing E-mail with a disclaimer footer, and can also be used to archive outgoing E-mail (installed on Exchange Server).  Is it possible that this was sent by Outlook/Outlook Express and then redundantly base64 encoded by eXclaimer at the server?  If not, does anyone know what might have produced this behavior? Thanks, Matt