I am getting TONS of this crap on my server. All kinds of different messages, all with the little "MPCM" blurb at the top. I set up two filters in my Wordfilter test to catch it:
BODY 10 CONTAINS mpcmffa.com BODY 10 CONTAINS MPCM
Are there any spaces/tabs after "MPCM" on that line? Does the line end properly (if it is the last line in the file, and you use Notepad, can the cursor go to the line below it)?
If you view the source of the E-mail, are there any HTML comments (v1.75 or later is needed do filter E-mail with anti-filter HTML comments)?
So at a very minimum, this message should have a weight of 9.
I have a WEIGHT5 test:
WEIGHT5 weightrange x x 5 9
So this message should be triggering this test, but it is not.
What I would recommend is adding "[%WEIGHT%]" to the line in your global.cfg file that lists the spam tests that the E-mail failed, so you can see the weight. Right now, all we know is it is either less than 4 or greater than 9. :) Note that some of the tests default to a negative weight if E-mail does *not* fail them (such as IPNOTINMX and NOLEGITCONTENT).
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
