attachment spam action

[Jim Davis]

On Wed, 26 Oct 2005, Julian Field wrote:

> If you can get to the raw message source, see if the start of the spam
> message looks like this:
>
>  > --======15897==59866======
>  > Content-Type: message/rfc822
>  > Content-Disposition: attachment
>  > Content-Transfer-Encoding: binary
>
> I just inserted the > to stop your mail client getting confused. If it
> does look like that, then for some reason your mail client is screwing
> it up. What mail program are you using?

I'm using pine (4.58) on Solaris 9 and Thunderbird 1.0.7 on Fedora Core 4.

Here's one I traced through the system:

Oct 26 14:50:39 hackberry MailScanner[43434]: Message 9ABDAD40826.E9E0C
from 192.12.69.5 (susanna_n.burris at image.dk) to hackberry.cs.arizona.edu
is spam, SpamAssassin (score=29.02, required 5, autolearn=spam, BAYES_99
3.50, FORGED_RCVD_HELO 0.14, FUZZY_MILLION 3.60, INVESTMENT_ADVICE 3.70,
RATWARE_GECKO_BUILD 1.69, RATWARE_MOZ_MALFORMED 1.85,
RAZOR2_CF_RANGE_51_100 0.50, RAZOR2_CF_RANGE_E4_51_100 1.50, RAZOR2_CHECK
0.50, RCVD_IN_BL_SPAMCOP_NET 1.56, RCVD_IN_DSBL 2.60, RCVD_IN_NJABL_DUL
1.95, RCVD_IN_SORBS_DUL 2.05, RCVD_IN_XBL 3.90)
Oct 26 14:50:39 hackberry MailScanner[43434]: Spam Actions: message
9ABDAD40826.E9E0C actions are attachment,deliver,header

Procmail delivers it,