My email is virus-cleansed by Trend Micro Interscan Viruswall, which is configured to send me the cleansed carcass (see below). About 50% of my WORM_SOBIG.A carcasses are identified by razor2 as spam. I don't know if it's because of non-human-aided spamtraps that just razor-report all their input, or because many humans interpret email like this as spam (I don't). I don't know what to do about it, so I guess this is just FYI. I currently revoke them when I see them, though that's kind of thankless.
I'm using '>>>' as a low-tech quoting mechanism below so this doesn't get razored itself. -------------------------------------------------------------------------------- The EMAIL: >>>Return-Path: [EMAIL PROTECTED] >>>Delivery-Date: Fri Jan 24 03:08:04 2003 >>>Received: from gate.cs.rochester.edu (gate.cs.rochester.edu [192.5.53.207]) by >slate.cs.rochester.edu (8.9.1b+Sun/001) with ESMTP id DAA13114 for <Bukys>; Fri, 24 >Jan 2003 03:08:03 -0500 (EST) >>>From: [EMAIL PROTECTED] >>>Received: from antivirus1.its.rochester.edu (antivirus1.its.rochester.edu >[128.151.57.50]) by gate.cs.rochester.edu (8.9.1b+Sun/Y) with ESMTP id DAA27695 for ><[EMAIL PROTECTED]>; Fri, 24 Jan 2003 03:08:03 -0500 (EST) >>>Received: from antivirus1.its.rochester.edu (localhost [127.0.0.1]) >>> by antivirus1.its.rochester.edu (8.12.4/8.12.4) with ESMTP id h0O882Aa018287 >>> for <[EMAIL PROTECTED]>; Fri, 24 Jan 2003 03:08:02 -0500 (EST) >>>Received: from JBRA100 ([62.206.31.10]) >>> by antivirus1.its.rochester.edu (8.12.4/8.12.4) with SMTP id h0O87vxn018271 >>> for <[EMAIL PROTECTED]>; Fri, 24 Jan 2003 03:07:57 -0500 (EST) >>>Message-Id: <[EMAIL PROTECTED]> >>>To: <[EMAIL PROTECTED]> >>>Subject: Re: Sample >>>Date: Fri, 24 Jan 2003 9:13:59 +0100 >>>Importance: Normal >>>X-Mailer: Microsoft Outlook Express 6.00.2600.0000 >>>X-MSMail-Priority: Normal >>>X-Priority: 3 (Normal) >>>MIME-Version: 1.0 >>>Content-Type: multipart/mixed; >>> boundary="CSmtpMsgPart123X456_000_002325C8" >>>Content-Length: 849 >>> >>> >>>This is a multipart message in MIME format >>> >>>--CSmtpMsgPart123X456_000_002325C8 >>>Content-Type: text/plain; charset=us-ascii >>>Content-Transfer-Encoding: 7bit >>> >>>------------------ Virus Warning Message >>> >>>Found virus WORM_SOBIG.A in file Movie_0074.mpeg.pif >>>The uncleanable file Movie_0074.mpeg.pif is moved to /etc/iscan/virus/virCYA_abqkC. >>> >>>--------------------------------------------------------- >>> >>>--CSmtpMsgPart123X456_000_002325C8 >>>Content-Type: text/plain; >>> charset="iso-8859-1" >>>Content-Transfer-Encoding: 7bit >>> >>>Attached file: >>>--CSmtpMsgPart123X456_000_002325C8 >>>Content-Type: text/plain; charset=us-ascii >>>Content-Transfer-Encoding: 7bit >>> >>> >>>------------------ Virus Warning Message >>> >>>Movie_0074.mpeg.pif is removed from here because it contains a virus. >>> >>>--------------------------------------------------------- >>>--CSmtpMsgPart123X456_000_002325C8-- -------------------------------------------------------------------------------- The razor-check -d output: >>> Razor-Log: Computed razorhome from env: /u/bukys/.razor >>> Razor-Log: Found razorhome: /u/bukys/.razor >>> Razor-Log: read_file: 15 items read from /u/bukys/.razor/razor-agent.conf >>>Jan 24 09:30:31.860230 check[10841]: [ 1] [bootup] Logging initiated >LogDebugLevel=9 to stdout >>>Jan 24 09:30:31.861102 check[10841]: [ 5] computed razorhome=/u/bukys/.razor, >conf=/u/bukys/.razor/razor-agent.conf, ident=/u/bukys/.razor/identity-lbukys >>>Jan 24 09:30:31.861173 check[10841]: [ 2] Razor-Agents v2.20 starting razor-check >-d 12 >>>Jan 24 09:30:31.864671 check[10841]: [ 9] uname -a: Linux cycle1.cs.rochester.edu >2.4.9-34smp #1 SMP Sat Jun 1 06:15:25 EDT 2002 i686 unknown >>>Jan 24 09:30:31.865157 check[10841]: [ 8] reading straight RFC822 mail from 12 >>>Jan 24 09:30:31.865422 check[10841]: [ 6] read 1 mail >>>Jan 24 09:30:31.865626 check[10841]: [ 8] Client supported_engines: 1 2 3 4 >>>Jan 24 09:30:31.866400 check[10841]: [ 8] prep_mail done: mail 1 headers=1291, >mime0=350, mime1=128, mime2=283 >>>Jan 24 09:30:31.866854 check[10841]: [ 6] skipping whitelist file (empty?): >/u/bukys/.razor/razor-whitelist >>>Jan 24 09:30:31.867251 check[10841]: [ 5] read_file: 1 items read from >/u/bukys/.razor/servers.discovery.lst >>>Jan 24 09:30:31.867604 check[10841]: [ 5] read_file: 3 items read from >/u/bukys/.razor/servers.nomination.lst >>>Jan 24 09:30:31.867940 check[10841]: [ 5] read_file: 2 items read from >/u/bukys/.razor/servers.catalogue.lst >>>Jan 24 09:30:31.868203 check[10841]: [ 9] Assigning defaults to >conceit.cloudmark.com >>>Jan 24 09:30:31.868323 check[10841]: [ 9] Assigning defaults to hubris.cloudmark.com >>>Jan 24 09:30:31.868441 check[10841]: [ 9] Assigning defaults to joy.cloudmark.com >>>Jan 24 09:30:31.868563 check[10841]: [ 9] Assigning defaults to truth.cloudmark.com >>>Jan 24 09:30:31.868681 check[10841]: [ 9] Assigning defaults to shock.cloudmark.com >>>Jan 24 09:30:31.869612 check[10841]: [ 5] read_file: 11 items read from >/u/bukys/.razor/server.truth.cloudmark.com.conf >>>Jan 24 09:30:31.870133 check[10841]: [ 5] read_file: 12 items read from >/u/bukys/.razor/server.hubris.cloudmark.com.conf >>>Jan 24 09:30:31.870772 check[10841]: [ 5] read_file: 12 items read from >/u/bukys/.razor/server.fire.cloudmark.com.conf >>>Jan 24 09:30:31.871268 check[10841]: [ 5] read_file: 12 items read from >/u/bukys/.razor/server.honor.cloudmark.com.conf >>>Jan 24 09:30:31.871772 check[10841]: [ 5] read_file: 12 items read from >/u/bukys/.razor/server.conceit.cloudmark.com.conf >>>Jan 24 09:30:31.872235 check[10841]: [ 5] read_file: 12 items read from >/u/bukys/.razor/server.shock.cloudmark.com.conf >>>Jan 24 09:30:31.872723 check[10841]: [ 5] read_file: 12 items read from >/u/bukys/.razor/server.joy.cloudmark.com.conf >>>Jan 24 09:30:31.873353 check[10841]: [ 5] 152106 seconds before closest server >discovery >>>Jan 24 09:30:31.873510 check[10841]: [ 6] truth.cloudmark.com is a Catalogue Server >srl 61; computed min_cf=1, Server se: 0A >>>Jan 24 09:30:31.873650 check[10841]: [ 8] Computed supported_engines: 2 4 >>>Jan 24 09:30:31.873750 check[10841]: [ 8] Using next closest server >truth.cloudmark.com:2703, cached info srl 61 >>>Jan 24 09:30:31.873843 check[10841]: [ 8] mail 1 Subject: Re: Sample >>>Jan 24 09:30:31.874776 check[10841]: [ 6] preproc: mail 1.0 went from 350 bytes to >238 >>>Jan 24 09:30:31.874887 check[10841]: [ 6] preproc: mail 1.1 went from 128 bytes to >14 >>>Jan 24 09:30:31.875002 check[10841]: [ 6] preproc: mail 1.2 went from 283 bytes to >172 >>>Jan 24 09:30:31.875062 check[10841]: [ 6] computing sigs for mail 1.0, len 238 >>>Jan 24 09:30:31.876495 check[10841]: [ 6] computing sigs for mail 1.1, len 14 >>>Jan 24 09:30:31.877633 check[10841]: [ 6] computing sigs for mail 1.2, len 172 >>>Jan 24 09:30:31.878873 check[10841]: [ 5] Connecting to truth.cloudmark.com ... >>>Jan 24 09:30:32.471415 check[10841]: [ 8] Connection established >>>Jan 24 09:30:32.471558 check[10841]: [ 4] truth.cloudmark.com >> 29 server >greeting: sn=C&srl=61&ep4=7542-10&a=l >>>Jan 24 09:30:32.471821 check[10841]: [ 6] truth.cloudmark.com is a Catalogue Server >srl 61; computed min_cf=1, Server se: 0A >>>Jan 24 09:30:32.471959 check[10841]: [ 8] Computed supported_engines: 2 4 >>>Jan 24 09:30:32.472071 check[10841]: [ 8] mail 1.0 e2 sig: >XssLhO17z65CIYaiI1QYFta9JM8A >>>Jan 24 09:30:32.472156 check[10841]: [ 8] mail 1.0 e4 sig: >XssLhO17z65CIYaiI1QYFta9JM8A >>>Jan 24 09:30:32.472231 check[10841]: [ 8] mail 1.1 e2 sig: >iCKqyMZgGV5Nfigd9SQymTbcERYA >>>Jan 24 09:30:32.472294 check[10841]: [ 8] mail 1.1 e4 sig: >iCKqyMZgGV5Nfigd9SQymTbcERYA >>>Jan 24 09:30:32.472367 check[10841]: [ 8] mail 1.2 e2 sig: >riMLtkpnFW9qh7z7bBrd4alJA7oA >>>Jan 24 09:30:32.472431 check[10841]: [ 8] mail 1.2 e4 sig: >riMLtkpnFW9qh7z7bBrd4alJA7oA >>>Jan 24 09:30:32.472658 check[10841]: [ 8] preparing 6 queries >>>Jan 24 09:30:32.472957 check[10841]: [ 8] sending 1 batches >>>Jan 24 09:30:32.473122 check[10841]: [ 4] truth.cloudmark.com << 280 >>>Jan 24 09:30:32.473170 check[10841]: [ 6] -a=c&e=2&s=XssLhO17z65CIYaiI1QYFta9JM8A >>>a=c&e=4&ep4=7542-10&s=XssLhO17z65CIYaiI1QYFta9JM8A >>>a=c&e=2&s=iCKqyMZgGV5Nfigd9SQymTbcERYA >>>a=c&e=4&ep4=7542-10&s=iCKqyMZgGV5Nfigd9SQymTbcERYA >>>a=c&e=2&s=riMLtkpnFW9qh7z7bBrd4alJA7oA >>>a=c&e=4&ep4=7542-10&s=riMLtkpnFW9qh7z7bBrd4alJA7oA >>>. >>>Jan 24 09:30:32.759490 check[10841]: [ 4] truth.cloudmark.com >> 60 >>>Jan 24 09:30:32.759539 check[10841]: [ 6] response to sent.1 >>>-p=0 >>>p=0 >>>cf=100&p=1 >>>cf=100&p=1 >>>cf=10&p=1 >>>cf=10&p=1 >>>. >>>Jan 24 09:30:32.760017 check[10841]: [ 6] mail 1.0 e=2 >sig=XssLhO17z65CIYaiI1QYFta9JM8A: sig not found. >>>Jan 24 09:30:32.760076 check[10841]: [ 6] mail 1.0 e=4 >sig=XssLhO17z65CIYaiI1QYFta9JM8A: sig not found. >>>Jan 24 09:30:32.760151 check[10841]: [ 6] mail 1.1 e=2 >sig=iCKqyMZgGV5Nfigd9SQymTbcERYA: Is spam: cf 100 >= min_cf 1 >>>Jan 24 09:30:32.760209 check[10841]: [ 6] mail 1.1 e=4 >sig=iCKqyMZgGV5Nfigd9SQymTbcERYA: Is spam: cf 100 >= min_cf 1 >>>Jan 24 09:30:32.760273 check[10841]: [ 6] mail 1.2 e=2 >sig=riMLtkpnFW9qh7z7bBrd4alJA7oA: Is spam: cf 10 >= min_cf 1 >>>Jan 24 09:30:32.760330 check[10841]: [ 6] mail 1.2 e=4 >sig=riMLtkpnFW9qh7z7bBrd4alJA7oA: Is spam: cf 10 >= min_cf 1 >>>Jan 24 09:30:32.760430 check[10841]: [ 7] method 4: mail 1.0: no-contention part, >spam=0 >>>Jan 24 09:30:32.760481 check[10841]: [ 7] method 4: mail 1.1: no-contention part, >spam=2 >>>Jan 24 09:30:32.760530 check[10841]: [ 7] method 4: mail 1.2: no-contention part, >spam=2 >>>Jan 24 09:30:32.760577 check[10841]: [ 7] method 4: mail 1: a non-contention part >was spam, mail spam >>>Jan 24 09:30:32.760624 check[10841]: [ 3] mail 1 is known spam. >>>Jan 24 09:30:32.760685 check[10841]: [ 5] disconnecting from server >truth.cloudmark.com >>>Jan 24 09:30:32.760788 check[10841]: [ 4] truth.cloudmark.com << 5 >>>Jan 24 09:30:32.760830 check[10841]: [ 6] a=q >>>Jan 24 09:30:32.760984 check[10841]: [ 8] razor-check finished successfully. -------------------------------------------------------------------------------- ------------------------------------------------------- This SF.NET email is sponsored by: SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See! http://www.vasoftware.com _______________________________________________ Razor-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/razor-users
