Umm, Wouldn't the 0 9 setting put a Positive weight on a good clean email?
shouldn't it be like
SNIFFER external nonzero "c:\sniffer\win32\licenseid.exe authcode" 7 -7
which would put a Positive 7 on a nonzero return, and a -7 on a Zero Return ?
Also, when posting your global.cfg file, I would recommend DELETING your LicenseID
and Authentication Code for Shiffer.
----- Original Message ----- From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, December 13, 2004 4:48 PM
Subject: RE: [Declude.JunkMail] Upgraded Declude Thurs night -- since then getting false positives on MessageSniffer
I have commented out sniffer, ipnotinmx and nolegitcontent as those are my suspects... Everything else is how the configuration was when I became aware I had problems.
#IPNOTINMX ipnotinmx x x 0 -3 #NOLEGITCONTENT nolegitcontent x x 0 -5 #SNIFFER external nonzero "C:\IMail\Declude\Sniffer\wuckd6ww.exe y5abucz7zhoqeg0o" 0 9
These are all set up properly.
Are you seeing "SNIFFER" in the X-Spam-Tests-Failed: header when you think that the E-mail didn't fail Message Sniffer but apparently did? If not, what makes you think that the E-mail is failing the Message Sniffer test?
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.
----
This outgoing message is guaranteed to be authentic by Message Level users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This email has been scanned for possible viruses by Declude Antivirus. For more information on Declude Antivirus, Visit www.declude.com
--- This email has been scanned for possible viruses by Declude Antivirus. For more information on Declude Antivirus, Visit www.declude.com
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
