[Razor-users] RE: False positive : help !!

[Vipul Ved Prakash]

Title: RE: False positive : help !!

I have contested the particular fingerprint that was causing this FP.  Is this fixed now?

cheers,
vipul


-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]
Sent: Fri 5/5/2006 3:37 AM
To: Vipul Ved Prakash; [EMAIL PROTECTED]
Cc: razor-users@lists.sourceforge.net
Subject: False positive : help !!

I found out that messages (sent by EUDORA) sent with attachments and empty body are deteced as SPAM.
Problem is in this email section:

Content-Type: text/plain; charset="us-ascii"$
$
$
--=====================_1146775995==_$


If Razor sees two $ characters it detects msg as SPAM.


razor-check -H -home=/etc/razor < emailSPAM

prep_mail: orig=1959999
bad mime body [len=1958862], not doing \n--boundary, fixed tho.
boundary:  0=====================_1146775995==_
split_mime: no blank lines
split_mime: returning total_len=82; hdrs=, body=46
boundary:  0=====================_1146775995==_
split_mime: valid_mime_hdr [len=191], but no nested mime
Content-Type: application/pdf; name="WP_WIF~1.PDF";
 x-mac-type="42494E41"; x-mac-creator="6D646F73"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="WP_WIF~1.PDF"
split_mime: returning total=1958550; hdrs=225, body=1958324
boundary:  0=====================_1146775995==_
split_mime: valid_mime_hdr [len=44], but no nested mime
Content-Type: text/plain; charset="us-ascii"
split_mime: returning total=218; hdrs=80, body=137
Saweeet!!! Boundary (3): =====================_1146775995==_
**** prep_mail done: headers=1094
**** mail 0 [82] X-Razor2-Agent: Razor-Agents v2.81

Cont
**** mail 1 [61697] X-Razor2-Origlen-Body: 1958324
X-Razor2-
**** mail 2 [218] X-Razor2-Agent: Razor-Agents v2.81
Conte

1.0 e4: kpfzORiXw3bPO930rN6GYbZPH0cA, ep4: 7542-10
1.1 e4: xw95Hb9VAppvLzv3Y8hSkR_WEYgA, ep4: 7542-10
1.2 e4: _T9aLm0RCb3vV344_b_WzrnLRxMA, ep4: 7542-10

This is a part of razor-check -d -home=/etc/razor < emailSPAM

mail 1 Subject: documento su reti wireless molto interessante
May 05 07:12:07.366020 check[8669]: [15] log2file: wrote message len=82 to file: /tmp/razor.8669.1.0.before_preproc.as_reported
May 05 07:12:07.366485 check[8669]: [15] log2file: wrote message len=44 to file: /tmp/razor.8669.1.0.after_preproc
May 05 07:12:07.366740 check[8669]: [ 6] preproc: mail 1.0 went from 82 bytes to 44
May 05 07:12:07.632939 check[8669]: [15] log2file: wrote message len=61697 to file: /tmp/razor.8669.1.1.before_preproc.as_rep
HASH - HASH(0x884c0a4),5 keys
    ep4 => 7542-10
    headers => SCALAR - SCALAR(0x8a3df3c)
        [length=1094] From [EMAIL PROTECTED]  Thu May  4 12:58:35 200
    id => 1
    orig_mail => SCALAR - SCALAR(0x902eddc)
        [length=1959999] From [EMAIL PROTECTED]  Thu May  4 12:58:35 200
    p => ARRAY - ARRAY(0x88487a0),3 items
        HASH - HASH(0x8d4ce18),5 keys
            body => SCALAR - SCALAR(0x88474fc)
                [length=82] X-Razor2-Agent: Razor-Agents v2.81
            cleaned => SCALAR - SCALAR(0x8c2ff4c)
                Content-Type: text/plain; charset="us-ascii"
            cleaned_vr8 => SCALAR - SCALAR(0x8c2ff7c)
                Content-Type: text/plain; charset="us-ascii"
            e4 => kpfzORiXw3bPO930rN6GYbZPH0cA
            id => 1.0
adding a resp to mail 1.0
May 05 11:13:25.152501 check[10010]: [12] adding a resp to mail 1.1
May 05 11:13:25.152643 check[10010]: [12] adding a resp to mail 1.2
May 05 11:13:25.152987 check[10010]: [ 6] mail 1.0 e=4 sig=kpfzORiXw3bPO930rN6GYbZPH0cA: Is spam: cf 100 >= min_cf 21
May 05 11:13:25.153186 check[10010]: [ 6] mail 1.1 e=4 sig=xw95Hb9VAppvLzv3Y8hSkR_WEYgA: sig not found.


May 05 11:13:25.153356 check[10010]: [ 6] mail 1.2 e=4 sig=_T9aLm0RCb3vV344_b_WzrnLRxMA: sig not found.
May 05 11:13:25.153553 check[10010]: [ 7] method 4: mail 1.0: no-contention part, spam=1
May 05 11:13:25.153695 check[10010]: [ 7] method 4: mail 1.1: no-contention part, spam=0
May 05 11:13:25.153824 check[10010]: [ 7] method 4: mail 1.2: no-contention part, spam=0
May 05 11:13:25.153984 check[10010]: [ 7] method 4: mail 1: a non-contention part was spam, mail spam
May 05 11:13:25.154118 check[10010]: [ 3] mail 1 is known spam.
May 05 11:13:25.154265 check[10010]: [ 5] disconnecting from server shock.cloudmark.com
May 05 11:13:25.154403 check[10010]: [16] entered _send
May 05 11:13:25.154673 check[10010]: [ 4] shock.cloudmark.com << 5
May 05 11:13:25.154816 check[10010]: [ 6] a=q
May 05 11:13:25.155728 check[10010]: [ 8] razor-check finished successfully.


Can you help me please ?


Tiscali ADSL 4 Mega Flat

Naviga senza limiti a 19,95 Euro al mese con 4 Megabps di velocita'. Attiva subito: hai 2 MESI di canone adsl GRATIS!

In piu', se sei raggiunto dalla rete Tiscali, telefoni senza pagare il canone Telecom.

Scopri subito come risparmiare!

http://abbonati.tiscali.it/prodotti/adsl/tc/4flat/