[AMaViS-user] RATWARE_ZERO_TZ

2005-12-20 Thread MJ
Hi, I am running postfix 2.2.4 on Solaris 8 with amavisd-new.2.3.2, SpamAssassin 3.1.0 and Clamav 0.8.7.1 as an AV/AS gateway to my main email system. Some messages specially from hotmail.com are getting very high scores, specially RATWARE_ZERO_TZ, can some one tell me what is RATWARE_ZERO_TZ and

RE: [AMaViS-user] RATWARE_ZERO_TZ

2005-12-20 Thread Michael Scheidell
Need DATE headers. RATWARE_ZERO_TZ may refer to a timezone lookup or check, so, need ALL date headers as well. --- This SF.net email is sponsored by: Splunk Inc. Do you grep through log files for problems? Stop! Download the new AJAX search

Re: [AMaViS-user] RATWARE_ZERO_TZ

2005-12-20 Thread Mark Martinec
MJ, Some messages specially from hotmail.com are getting very high scores, specially RATWARE_ZERO_TZ, can some one tell me what is RATWARE_ZERO_TZ grep the SA rules for RATWARE_ZERO_TZ: 20_ratware.cf: # This ratware always uses a + TZ in the Date header, and has a multiplicity # of

RE: [AMaViS-user] RATWARE_ZERO_TZ

2005-12-20 Thread MJ
Thanks Michael, here is another example with full header Received: from hotmail.com (bay20-f13.bay20.hotmail.com [64.4.54.102]) by mailgate2.cyberia.net.sa (Postfix) with ESMTP id A33A71F07EF for [EMAIL PROTECTED]; Tue, 20 Dec 2005 17:44:05 +0300 (GMT) Received: from mail pickup