Check out my GIBBERISH filter for a bunch of counterbalances that are used to detect base64 and UNICODE attachments or other things that use base64 encoding, and disable the filter when found.

Alternatively, when you have short words, follow them by a space. Base64 encoding doesn't utilize spaces. If you really care about these words, also list them with periods and commas, but don't list something this short without something following it unless you score it very low and have no problems. Words that are longer than 5 characters should rarely on base64.

I have a filter that looks for MIME types and credits a few points for certain kinds (not JPEG's, but applications for instance). It's only there just in case and because I've yet to see any issues since spammers don't attach applications.

Matt



DLAnalyzer Support wrote:

Dan,
One problem I have is that when Declude Junkmail processes a message that has attachments it process the attachment how it was encoded typically base 64 (of couse assuming it is under the limit of what declude scans).
When you have a filter with a small word like "c u m" or "s e x" it tends to be easily triggered in the base64 encoding.
I asked this question a while back if there was an easy way to detect attachments to possibly apply a little reverse weight, but never really got anything back concrete.
Darrell
Dan Geiser writes:


Scan attachments?  Since when does Declude JunkMail scan attachments?
Dan
[EMAIL PROTECTED]
----- Original Message ----- From: "Gene Head " <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, January 05, 2004 1:34 PM
Subject: [Declude.JunkMail] attachments

Is there any way to not scan attachments?
Most of my false positives are all emails with spreadsheets, word docs...

as attachments.



Thanks Gene --- [This E-mail was scanned for viruses by Declude Virus

(http://www.declude.com)]



--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. ----------------------------------------------------------------------- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan


-----------------------------------------------------------------------
Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.




------------------------------------------------
Check Out DLAnalyzer a comprehensive reporting tool for
Declude Junkmail Logs - http://www.dlanalyzer.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



-- =================================================== Matthew S. Bramble President and Technical Coordinator iGaia Incorporated, Operator of NYcars.com --------------------------------------------------- Office Phone: (518) 862-9042 Cellular: (518) 229-3375 Fax: (518) 862-9044 E-mail: [EMAIL PROTECTED] or [EMAIL PROTECTED] ===================================================


--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Reply via email to