So if a word IS found in a base64 attachment, what do I need to do to put so the badworld test will not kick in? Thanks
----- Original Message ----- From: "Matthew Bramble" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, January 05, 2004 5:48 PM Subject: Re: [Declude.JunkMail] attachments > Check out my GIBBERISH filter for a bunch of counterbalances that are > used to detect base64 and UNICODE attachments or other things that use > base64 encoding, and disable the filter when found. > > Alternatively, when you have short words, follow them by a space. > Base64 encoding doesn't utilize spaces. If you really care about these > words, also list them with periods and commas, but don't list something > this short without something following it unless you score it very low > and have no problems. Words that are longer than 5 characters should > rarely on base64. > > I have a filter that looks for MIME types and credits a few points for > certain kinds (not JPEG's, but applications for instance). It's only > there just in case and because I've yet to see any issues since spammers > don't attach applications. > > Matt > > > > DLAnalyzer Support wrote: > > > Dan, > > One problem I have is that when Declude Junkmail processes a message > > that has attachments it process the attachment how it was encoded > > typically base 64 (of couse assuming it is under the limit of what > > declude scans). > > When you have a filter with a small word like "c u m" or "s e x" it > > tends to be easily triggered in the base64 encoding. > > I asked this question a while back if there was an easy way to detect > > attachments to possibly apply a little reverse weight, but never > > really got anything back concrete. > > Darrell > > Dan Geiser writes: > > > >> Scan attachments? Since when does Declude JunkMail scan attachments? > >> Dan > >> [EMAIL PROTECTED] > >> ----- Original Message ----- From: "Gene Head " <[EMAIL PROTECTED]> > >> To: <[EMAIL PROTECTED]> > >> Sent: Monday, January 05, 2004 1:34 PM > >> Subject: [Declude.JunkMail] attachments > >> > >>> Is there any way to not scan attachments? > >>> Most of my false positives are all emails with spreadsheets, word > >>> docs... > >> > >> as attachments. > >> > >>> > >>> Thanks > >>> Gene > >>> --- > >>> [This E-mail was scanned for viruses by Declude Virus > >> > >> (http://www.declude.com)] > >> > >>> > >>> --- > >>> This E-mail came from the Declude.JunkMail mailing list. To > >>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >>> type "unsubscribe Declude.JunkMail". The archives can be found > >>> at http://www.mail-archive.com. > >>> ----------------------------------------------------------------------- > >>> Sign up for virus-free and spam-free e-mail with Nexus Technology Group > >>> http://www.nexustechgroup.com/mailscan > >>> > >> > >> ----------------------------------------------------------------------- > >> Sign up for virus-free and spam-free e-mail with Nexus Technology > >> Group http://www.nexustechgroup.com/mailscan > >> --- > >> [This E-mail was scanned for viruses by Declude Virus > >> (http://www.declude.com)] > >> --- > >> This E-mail came from the Declude.JunkMail mailing list. To > >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >> type "unsubscribe Declude.JunkMail". The archives can be found > >> at http://www.mail-archive.com. > > > > > > > > > > ------------------------------------------------ > > Check Out DLAnalyzer a comprehensive reporting tool for > > Declude Junkmail Logs - http://www.dlanalyzer.com > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > > > -- > =================================================== > Matthew S. Bramble > President and Technical Coordinator > iGaia Incorporated, Operator of NYcars.com > --------------------------------------------------- > Office Phone: (518) 862-9042 > Cellular: (518) 229-3375 > Fax: (518) 862-9044 > E-mail: [EMAIL PROTECTED] or [EMAIL PROTECTED] > =================================================== > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
