Can you post the line in your global.cfg file FILTER-NIGERIAN-SCAM I am guessing you may have an extra 10 point being added there that should not be. Lets have a look.
Thanks David www.declude.com -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Goran Jovanovic Sent: Friday, February 25, 2005 11:20 AM To: [email protected] Subject: RE: [Declude.JunkMail] Body filter adding extra 10 points David, 4 e-mails with the same text failed. This is what came back to me as part of the SpamAttach.eml file. Do you need anything else? Subject: RE: Governance Working Group Call To: [EMAIL PROTECTED], [EMAIL PROTECTED] From: [EMAIL PROTECTED] Date: 16 Feb 2005 at 17:25:07 Tests Failed: IPNOTINMX [0], REVDNS [4], SIZE-S [0], FILTER-NIGERIAN-SCAM [12], FILTER-PORN [12] Weight: 23 Spool File: Dc8371a990086d99d.SMD To view the E-mail, just click the attachment. Headers: Received: from xxx.xxx.ca [xxx.xxx.xxx.xx] by mail1.gonetworks.net with ESMTP (SMTPD32-8.13) id A8381A990086; Wed, 16 Feb 2005 17:24:56 -0500 Received: by TQSEMAIL with Internet Mail Service (5.5.2657.72) id <XVPK2RLX>; Wed, 16 Feb 2005 17:28:57 -0500 Message-ID: <[EMAIL PROTECTED]> From: "Michel J. Carter" <[EMAIL PROTECTED]> To: 'Douglas Barrett' <[EMAIL PROTECTED]>, + another dozen TOs Cc: to 2 CC Subject: RE: Governance Working Group Call Date: Wed, 16 Feb 2005 17:28:46 -0500 X-MS-TNEF-Correlator: <[EMAIL PROTECTED]> MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: multipart/mixed; boundary="----_=_NextPart_000_01C51476.DB426E2C" Goran Jovanovic The LAN Shoppe > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of David Barker > Sent: Friday, February 25, 2005 10:59 AM > To: [email protected] > Subject: RE: [Declude.JunkMail] Body filter adding extra 10 points > > Goran, > > 1. Do you have a copy of the actual email header ? > 2. Is this Qbca31d68008ed51d the only test that failed ? > > David B > www.declude.com > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Goran Jovanovic > Sent: Friday, February 25, 2005 10:44 AM > To: [email protected] > Subject: [Declude.JunkMail] Body filter adding extra 10 points > > Hi, > > I am seeing very strange behaviour with one of my body filters. > > These are the only three entries with STRICTLY CONFIDENTIAL: > > BODY 2 CONTAINS STRICTLY CONFIDENTIAL > BODY 20 CONTAINS STRICTLY CONFIDENTIAL & URGENT > BODY 20 CONTAINS STRICTLY CONFIDENTIAL BUSINESS > PROPOSAL > > >From the Declude Log: > > 02/16/2005 16:36:04 Qbca31d68008ed51d Triggered BODY CONTAINS filter > FILTER-NIGERIAN-SCAM on STRICTLY CONFIDENTIAL [weight->12; strictly > confidential to you a]. > > And the actual message text which is a plain text message: > > I would appreciate your keeping the fact of this meeting strictly > confidential to you alone. > > So the question is how did an extra 10 points get added to this? > > Declude 1.82 on IMail. > > Thanx > > > Goran Jovanovic > The LAN Shoppe > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, > just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe > Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > > > __________ NOD32 1.1007 (20050223) Information __________ > > This message was checked by NOD32 antivirus system. > http://www.nod32.com > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. __________ NOD32 1.1007 (20050223) Information __________ This message was checked by NOD32 antivirus system. http://www.nod32.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
