Bug with HTML messages?

Martin Hepworth maxsec at gmail.com
Thu Jul 29 20:51:16 IST 2010


Denis

make sure MS "Run as User" can see all the rules etc.

I presume you're testing  the SA scores with the same user as MS is running
as.

Martin

2010/7/29 Denis Beauchemin <Denis.Beauchemin at usherbrooke.ca>

>
>
> Le 2010-07-29 14:57, Alex Broens a écrit :
>
>  On 2010-07-29 20:07, Denis Beauchemin wrote:
>>
>>>  Oops, I switched those 2:
>>>
>>>  SA scoring with HTML-only email: (not cached, score=12.639, requis 4.5,
>>>> autolearn=spam, DEAR_SOMETHING 1.60, DRUGS_ERECTILE 0.28,
>>>> DRUGS_ERECTILE_OBFU 1.23, DRUG_ED_CAPS 0.32, HTML_MESSAGE 0.00, KAM_VIAGRA1
>>>> 3.00, KAM_VIAGRA5 3.10, KAM_VIAGRA6 3.10)
>>>>
>>>> SA scoring with HTML+TXT email: (not cached, score=7.181, requis 4.5,
>>>> DCC_CHECK 2.17, HTML_MESSAGE 0.00, HTML_TAG_BALANCE_HEAD 1.33,
>>>> MIME_HTML_ONLY 1.46, TVD_SPACE_RATIO 2.22)
>>>>
>>>>
>>> SA scoring with HTML+TXT email: (not cached, score=12.639, requis 4.5,
>>> autolearn=spam, DEAR_SOMETHING 1.60, DRUGS_ERECTILE 0.28,
>>> DRUGS_ERECTILE_OBFU 1.23, DRUG_ED_CAPS 0.32, HTML_MESSAGE 0.00, KAM_VIAGRA1
>>> 3.00, KAM_VIAGRA5 3.10, KAM_VIAGRA6 3.10)
>>>
>>> SA scoring with HTML-only email: (not cached, score=7.181, requis 4.5,
>>> DCC_CHECK 2.17, HTML_MESSAGE 0.00, HTML_TAG_BALANCE_HEAD 1.33,
>>> MIME_HTML_ONLY 1.46, TVD_SPACE_RATIO 2.22)
>>>
>>>
>> you are not feeding it consistent content.
>> where is the problem?
>>
>> get a real spam wich was tagged as spam and dumped in your quaratine.
>> feed that to spamassassin (without MS), is the result consistent?
>>
>> if not, its usually due to MS's msg chunk settings
>>
>>
>>
> Alex,
>
> When I feed the emails to SA they get scored much higher than through MS.
>
> My point is that an HTML-only email with quite common spam words are not
> being scored, while an HTML+TXT email with the same spam words get scored.
>  This looks quite suspicious to me.
>
>
> Denis
>
> --
> Denis Beauchemin, analyste
> Université de Sherbrooke, S.T.I.
> T: 819.821.8000x62252 F: 819.821.8045
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>



-- 
Martin Hepworth
Oxford, UK
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20100729/ab2f0ab9/attachment.html


More information about the MailScanner mailing list