(Fwd) subject not modified (sometimes)

[mikea]

On Thu, Apr 29, 2004 at 02:05:43PM -0300, Mariano Absatz wrote:
> Hi... it seems the list ate my message... it seems it was too long (or too
> spamish) with all the spam message attached.
>
> Now I uploaded everything to http://baby.com.ar/MailScanner/msg-20040429/ so
> you can see it and the message is lighter.
>
> Please, read on.
>
> ------- Forwarded message follows -------
> From:           Mariano Absatz <mailscanner at lists.com.ar>
> To:             MailScanner mailing list <MAILSCANNER at JISCMAIL.AC.UK>
> Subject:        subject not modified (sometimes)
> Date:           Thu, 29 Apr 2004 11:38:27 -0300
>
> Hi,
>
> I'm using MailScanner 4.29.7 + SpamAssassin 2.63 + ZMailer 2.99.56 with
> linux (redhat 6.1).
>
> It is working nicely, but sometimes, and only sometimes, it refuses to
> modify the subject.
>
> That is, the message is correctly identified as spam by SpamAssassin, the
> X-*-MailScanner*: headers are added, but the subject is NOT prepended with
> the {spam} string.
>
> The settings _DO_ set this string for all messages, no rulesets here.
>
> This happens in a very small percentage of messages, but I don't know why.
>
> I suspected of strange MIME encodings in the subject:
> =?windows-1252?Q?Ten=E9s_DVD?_Entonces_arm=E1_tu_propia_colecci=F3n!!!?=
>
> but it's not only that, 'cause I saw this happening in messages whose
> subject is not MIME encoded...
>
> An example of this is at
> http://baby.com.ar/MailScanner/msg-20040429/message1.msg
> and the corresponding log is
> http://baby.com.ar/MailScanner/msg-20040429/message1.log
>
> The other 4 messages (I don't have the corresponding logs) are hi-scoring
> spam that didn't get their subject modified.
>
> They're not MIME encoded BUT I just noticed all of them have To: (and
> eventually Cc:) header(s) that don't have actual addresses in them.
>
> To:     MAIL3
>
> To:     unlisted-recipients:; (no To-header on input)
> Cc:     113
>
> To:     unlisted-recipients:; (no To-header on input)
> Cc:     \ok112.OK, \ok113.OK, \ok114.OK, \ok115.OK, \ok116.OK, \ok117.OK,
> \ok118.OK, \ok119.OK, \ok120.OK, \ok121.OK, \ok122.OK, \ok123.OK
>
> Might this be two different problems?

I find that I'm having just about exactly the same problem(s), dating
from just about the same time:

On a FreeBSD 4.7system running MailScanner-4.25-13 and SpamAssassin
version 2.50 (yes, I know, seriously old), a small fraction of the
mail winds up with a SpamAssassin score at or over the threshold, but
MailScanner doesn't prepend the {Probable-Spam} pr {Possible-Spam}
markers I use. Except for that small fraction, everything else seems
to be caught properly -- I _think_. I do have users reporting the
occasional virus or worm getting into their mailboxes, and I don't
have a good explanation for that yet.

It _was_ working just fine for the longest time.

Running a batch of mail through MS with debug turned on for MS and SA
both doesn't show anything obviously wrong with the processing for the
mail that isn't handled right. I'll post examples, config files, and
anything else requested, on my website if anyone wants anything more
than Mariano has on his. His description matches my problem awfully
closely.

I'm planning to upgrade the weekend of 12 June; would have done this
weekend, but have to drive to a wedding 600 miles away this weekend.
"Life is what happens to you while you're busy making other plans."

--
Mike Andrews
mikea at mikea.ath.cx
Tired old sysadmin

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html