That is correct, declude virus processes before junkmail
I did look at quite a few zip viruses and didnt see any of them using the Content-Type: application/x-zip-compressed in the mime info
Rick Davidson National Systems Manager North American Title Group
-
----- Original Message ----- From: "Mark E. Smith" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, October 27, 2004 1:03 PM
Subject: RE: [Declude.JunkMail] Best Practices for handing legit email flagged as spam?
Rick, I was looking at your filter -- great idea. One question (which falls under the processing order)
If you have: BODY STOPALLTESTS CONTAINS Content-Type: application/x-zip-compressed
I think Declude Virus will still grab this correct?
Mark
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Davidson Sent: Tuesday, October 26, 2004 10:49 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Best Practices for handing legit email flagged as spam?
>1 in 500,000? That's fantastic. I think that qualifies for the >anti-spam guru of the week award!
heh, that is no exageration either, it is mainly due to spending alot of time in looking at false positives and finding ways to prevent them. For example use filtering to look for legit mail, the attached filter file runs before all other filters, it contains things that I found in false positives. This file is my number one false positive eliminator, my second method is test the hell out of any significant changes first. I do have the luxury of having to only filter for one company and I can be fairly restrictive....
I will see if I can get my configs somewhere for download, I am willing to share my work because I hate spam and spammers so much... man do i hate them.
Rick Davidson National Systems Manager North American Title Group -
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
