just detected a new bug (or ist it a feature?):
i 've got mails moved to a special directory even if they don't trigger the
specified test.
i.e.
content of $default$.junkmail:
GESPERRTEANHAENGE HOLD g:\imail\gesperrteanhaenge\%DATE%
there is NO way that this mail could trigger the GESPERRTEANHAENGE test. this
test is only triggered when there is a *.pif, *.scr, etc. -file attached.
the other way works too: a lot of mails pass this test that shouldn't pass it.
this test is a way for us to pre-filter virusses. we are using avafterjm so the
virusses that pass this test get tested by all of our declude-tests and
afterward by our anti-virus software, so they don't get delivered but increase
our porcessor-load immense.
is it possible that the same problem discussed under declude virus ("Virus name
reported as different than what scanner detected") is causing this too?
i quote markus gufler:
"Hmm, looks like there is one single variable containing the last
detected virus name and several threads writing to and reading from
this variable..."
if this is true, we are a little bit pissed, because we are using a lot of
combo-testing to move not delivered mails to certain directories (depends on the
reason, why they are not delivered) and i will have to check each one of these
directories file by file and decide what to do. even worse: in my opinoion a lot
of spam gets delivered to our customers and i don't think they will be happy
about it.
the complete mail:
Received: from 192.184.162.44 for DK.67.clbtrplkqomlzxho.fundatingisfun.com;
Wed, 02 Nov 2005 00:59:06 -0700
Message-ID: <[EMAIL PROTECTED]>
From: "commodious Smart" <[EMAIL PROTECTED]>
Reply-To: "commodious Smart" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: I'm cute and bored lets meet
Date: Wed, 02 Nov 2005 11:00:06 +0300
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--8385_cpvcpixtwoinnecwteyean_0127"
X-Webmail-Time: Wed, 02 Nov 2005 02:02:06 -0600
X-RBL-Warning: CBL: "Blocked - see
http://cbl.abuseat.org/lookup.cgi?ip=81.10.172.131";
X-RBL-Warning: SPAMCOP: "Blocked - see
http://www.spamcop.net/bl.shtml?81.10.172.131";
X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner consistent with
spam [2000010f].
X-RBL-Warning: DIREKTANUNS: Message failed DIREKTANUNS test (line 16, weight 0)
X-RBL-Warning: LAENDERPRUEFUNG: Message failed LAENDERPRUEFUNG test (line 316,
weight 5)
X-RBL-Warning: HOUR2: Hour was between 6:00 and 19:59.
X-RBL-Warning: MITLNKEXTERNWEICH: Message failed MITLNKEXTERNWEICH test (line
16, weight 30)
X-RBL-Warning: PORNO: Message failed PORNO test (line 472, weight 40)
X-Declude-Sender: [EMAIL PROTECTED] [81.10.172.131]
X-Declude-Spoolname: D71b8180c0136c6f4.smd
X-Note: This incoming E-mail was scanned on Schulmail NRW by Declude 3.0.5.12
(www.declude.com) for spam and virus.
X-Spam-Tests-Failed: CBL, SPAMCOP, ROUTING, DIREKTANUNS, LAENDERPRUEFUNG, HOUR2,
MITLNKEXTERNWEICH, PORNO, WEIGHT4099nutzer [95]
X-Country-Chain: [Multi-Regional]->AUSTRIA->destination
X-Note: This E-mail was sent from cm172-131.liwest.at ([81.10.172.131]).
----8385_cpvcpixtwoinnecwteyean_0127
Content-Type: text/plain;
Content-Transfer-Encoding: 7Bit
Hey 105442, Bob here,
I had to tell you about this great hook up site.
I joined it 4 days ago and I got laid twice over the weekend
(by 2 different girls)
How cool is that? Its so easy and these babes want to hook up right away
with any guys they meet.
I'm tellin you, you will get some action. Check it out and see what you think.
I am sure you will be thrilled with results.
Oh I forgot to mention,
it doesnt cost anything to join in the fun.
http://fundatingisfun.com/aac/aprof.html
Its so easy to get laid tonight
no more ofthis
http://fundatingisfun.com/r.html
They said balletomane uppercut incompetent solicitor.
Its all about him deadhead gedanken neuron anthropogenic The
They said indeterminable dulcet [EMAIL PROTECTED] decision giveaway.
They is him ada curricula gunmen mccrackendavy She is prima bacon bake.
she is lydia deplore boss aspirepave.
----8385_cpvcpixtwoinnecwteyean_0127--
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
