My system catches your example quite well
Content analysis details: (25.3 points, 6.6 required)
pts rule name description
---- ---------------------- ------------------------------------------------
--
5.0 FB_SUPER_VIAGRA BODY: /S[ue]p[eu]r.{1,5}Via.{0,1}g?ra/i
0.3 SAVE_UP_TO BODY: Save Up To
1.8 OBFU_VIAGRA BODY: Obfuscated 'VIAGRA' in body
1.8 OBFU_XANAX BODY: Obfuscated 'XANAX' in body
2.2 SARE_SUPERVIAGRA BODY: mentions drug which is often subject of
spam
1.8 OBFU_VALIUM BODY: Obfuscated 'VALIUM' in body
2.0 BLANK_LINES_70_80 BODY: Message body has 70-80% blank lines
1.1 MIME_BASE64_TEXT RAW: Message text disguised using base64
encoding
0.2 MIME_BASE64_NO_NAME RAW: base64 attachment does not have a file name
0.3 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date
2.5 DRUGS_ERECTILE Refers to an erectile drug
2.0 DRUGS_ANXIETY Refers to an anxiety control drug
2.0 LW_RATWARE3 Spammer sign in headers
2.3 DRUGS_ANXIETY_EREC Refers to both an erectile and an anxiety drug
Many of the rules in my results are already in the pre-released 3.0.0
version.
It might be worth your time to install some of the SARE rulesets until 3.0.0
is final. The problem is the time gap between releasing 2.63 and 3.0.0. A
lot has changed in this time and the current *release* version does not
reflect the change in spam. If you installed 3.0.0 you will see an
improvement on all sides, however it's still under active development and
not due out for another month or so.
Find additional rulesets here: http://www.rulesemporium.com/
P.S. SpamAssassin does decode base64, it just didn't have any rules to
catch these at the time 2.63 was released. 3.0.0 has the entire antidrug
set and that gave this message an additional 6.8 all by itself.
HTH
----- Original Message -----
From: "Patrick Steiner" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, June 10, 2004 5:13 PM
Subject: Why SA find no words like viag*** in base64 coded Mails
> I have a big problem with base64 endcoded spam mails. no check of words
> like
> viag***
