Okay, upon further review, and if I'm reading things right, it looks like MessageSniffer is *not* getting a false postive (logs shows "clean") but Declude is penalizing by applying the weight as though the test was failed. I sent an example to [EMAIL PROTECTED] earlier today. It looks like maybe Declude is scoring ipnotinmx and nolegitcontent as a positive weight instead of as a counterbalance.
In that case, you should check the test definition line in the global.cfg file -- the weight should appear as the 5th entry. For example:
SNIFFER external nonzero "C:\IMail\Declude\Sniffer\snfrv2r2.exe xnk05x5vmipeaof7" 7 0
If there is another piece of data there before the weight, it may cause Declude to add the weight to E-mails that do not fail Message Sniffer.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.
---- This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
