Mailscanner does not identify attachment in mail

[Anthony Peacock]

Hi,


Koopmann, Jan-Peter wrote:
> On Friday, May 05, 2006 10:53 AM Anthony Peacock wrote:
> 
>> We would really need to see which SA rules hit.  (Sorry if you
>> provided that in an earlier post, I didn't keep a copy). 
> 
> 5.00	BAYES_99	Bayesian spam probability is 99 to 100%
> 0.34	FB_SINGLE_0WORD	 
> 1.01	FB_SINGLE_1WORD	 
> 1.39	FB_WORD2_END_DOLLAR	 
> 0.59	FB_WORD_01DOLLAR2	 
> 1.25	FH_RELAY_NODNS	 
> 1.10	FM_MULTI_ODD2	 
> 0.70	FM_MULTI_ODD3	 
> 0.70	FM_MULTI_ODD4	 
> 0.90	FM_MULTI_ODD5	 
> 3.20	FM_N0N0_WORDS	 
> 0.55	HELO_MISMATCH_COM	 
> 0.96	NO_REAL_NAME	From: does not include a real name
> 2.10	OBSCURED_EMAIL	Message seems to contain rot13ed address
> 0.99	RELAY_IS_203	 
> 2.00	SARE_RAND_6	 
> 0.42	SARE_RMML_Stock9	 
> 5.00	SARE_URI_EQUALS	 
> 2.00	SPF_FAIL	SPF: sender does not match SPF record (fail)
> 2.80	UNWANTED_LANGUAGE_BODY	Message written in an undesired language
> 0.37	UPPERCASE_50_75	message body is 50-75% uppercase
> 1.37	USERPASS	URL contains username and (optional) password
> 0.21	X_AUTH_WARN_FAKED	X-Authentication-Warning header looks faked
> 
>> I doubt whether it is the fact that it is a UUencoded post is the
>> only factor. 
> 
> Not the only factor I agree. But BAYES_99, SARE_*, UNWANTED_LANGUAGE_BODY,
> UPPERCASE etc. surely are due to uuencoded text since that is the only thing
> in the body.

Yup!  I agree that SA is scoring the UU code.  What version of SA do you 
have installed.

I would suggest that you post this question to the SpamAssassin-users 
mailing list.  If you can place the full (inc headers) email in a 
downloadable location, it will help people run it against their installs.

-- 
Anthony Peacock
CHIME, Royal Free & University College Medical School
WWW:    http://www.chime.ucl.ac.uk/~rmhiajp/
"The most exciting phrase to hear in science, the one that heralds new 
discoveries, is not 'Eureka!' but 'That's funny....'" -- Isaac Asimov