[Declude.JunkMail] Missing text with a filter BADHEADERS error

2003-09-15 Thread Matthew Bramble
Scott,

Is there a limit to how far down a file the text filters will search?  
I've come across a few examples where a text filter of:

   BODY  0   CONTAINS   base64

...didn't hit when it was actually in the message as text.  In the most 
recent example, this was 72,486 characters into the E-mail (including 
the headers).  If recollection serves me right, the other messages were 
also very long, though I could be mistaken.  If length isn't the issue, 
do you have any other suggestions as to why this happened?

Also, is there a fix available for the BADHEADERS 840a error?  I get 
a decent number of these every day, and they're often false positives 
(as was discussed before).  The message that I'm referencing failed 
because of both the text filter not hitting and that BADHEADERS issue 
(not RFC compliant, but supported functionality from popular mail clients).

Thanks,

Matt

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Missing text with a filter BADHEADERS error

2003-09-15 Thread R. Scott Perry

Is there a limit to how far down a file the text filters will search?
Yes -- it will only check the first 32K of the E-mail.

Also, is there a fix available for the BADHEADERS 840a error?  I get a 
decent number of these every day, and they're often false positives (as 
was discussed before).  The message that I'm referencing failed because of 
both the text filter not hitting and that BADHEADERS issue (not RFC 
compliant, but supported functionality from popular mail clients).
That's something that we are currently investigating.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Missing text with a filter BADHEADERS error

2003-09-15 Thread Matthew Bramble
Thanks for the answers.  I would imagine that it makes a lot of sense to 
limit it at 32 K.  The root of my issue then becomes Microsoft Word's 
unbelievably bloated code.  If they can't construct a simple E-mail 
without 500% overhead in their tagging, I can see why Linux people laugh 
about Window's performance.  That message had 13,058 displayable 
characters with spaces without attachments,  but it contained 83,023 
characters with spaces counting the formatting code (the previous quoted 
number didn't have spaces included).  That made a 13 K message 84 K.  Geeze!

Matt



R. Scott Perry wrote:


Is there a limit to how far down a file the text filters will search?


Yes -- it will only check the first 32K of the E-mail.

Also, is there a fix available for the BADHEADERS 840a error?  I 
get a decent number of these every day, and they're often false 
positives (as was discussed before).  The message that I'm 
referencing failed because of both the text filter not hitting and 
that BADHEADERS issue (not RFC compliant, but supported functionality 
from popular mail clients).


That's something that we are currently investigating.

   -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.