<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2655.35">
<TITLE>RE: Advice on Using sa-learn</TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=2>or simply drag and drop the message into a new email.</FONT>
</P>
<P><FONT SIZE=2>There is also Actions->Resend This Message in Outlook 2000 anyways, which I believe does not modify the message, although you need to set the From to be able to do it.</FONT></P>
<P><FONT SIZE=2>Look for bayes_ignore_header in spam.assassin.prefs.conf.</FONT>
</P>
<P><FONT SIZE=2>If you can get a user to copy and paste the message with full headers in an Outlook client you deserve a medal.</FONT>
</P>
<P><FONT SIZE=2>-----Original Message-----</FONT>
<BR><FONT SIZE=2>From: InvictaNet Customer Support [<A HREF="mailto:support@INVICTANET.CO.UK">mailto:support@INVICTANET.CO.UK</A>]</FONT>
<BR><FONT SIZE=2>Sent: Wednesday, October 15, 2003 10:50 AM</FONT>
<BR><FONT SIZE=2>To: MAILSCANNER@JISCMAIL.AC.UK</FONT>
<BR><FONT SIZE=2>Subject: FW: Advice on Using sa-learn</FONT>
</P>
<BR>
<P><FONT SIZE=2>In Outlook 2000 you create a new message, then click Insert, Item.</FONT>
<BR><FONT SIZE=2>In OE6. Message, Forward as Attachment</FONT>
</P>
<P><FONT SIZE=2>Martyn Routley</FONT>
<BR><FONT SIZE=2>-----------------------------------------------------------------</FONT>
<BR><FONT SIZE=2>InvictaWiz - The Internet in Plain English, Guaranteed</FONT>
<BR><FONT SIZE=2><A HREF="http://www.invictawiz.com" TARGET="_blank">http://www.invictawiz.com</A></FONT>
<BR><FONT SIZE=2>martyn@invictawiz.com</FONT>
<BR><FONT SIZE=2>phone: 08707 440180</FONT>
<BR><FONT SIZE=2>fax: 08707 440181</FONT>
<BR><FONT SIZE=2>Ask us about our online Antivirus and Junk mail scanning service.</FONT>
<BR><FONT SIZE=2>Ask us how you could save money on your telephone bill.</FONT>
<BR><FONT SIZE=2>-----------------------------------------------------------------</FONT>
</P>
<P><FONT SIZE=2>-----Original Message-----</FONT>
<BR><FONT SIZE=2>From: MailScanner mailing list [<A HREF="mailto:MAILSCANNER@JISCMAIL.AC.UK">mailto:MAILSCANNER@JISCMAIL.AC.UK</A>]On</FONT>
<BR><FONT SIZE=2>Behalf Of Errol Neal</FONT>
<BR><FONT SIZE=2>Sent: 15 October 2003 15:04</FONT>
<BR><FONT SIZE=2>To: MAILSCANNER@JISCMAIL.AC.UK</FONT>
<BR><FONT SIZE=2>Subject: Advice on Using sa-learn</FONT>
</P>
<BR>
<P><FONT SIZE=2>Hi folks,</FONT>
</P>
<P><FONT SIZE=2>A week or two ago, I posted a question about properly getting messages into</FONT>
<BR><FONT SIZE=2>sa-learn.</FONT>
<BR><FONT SIZE=2>I didn't get any answers and I was hoping for some advice from somebody on</FONT>
<BR><FONT SIZE=2>this topic.</FONT>
<BR><FONT SIZE=2>I've searched the archives, but didn't come up with a clear cut way to</FONT>
<BR><FONT SIZE=2>proceed forward on</FONT>
<BR><FONT SIZE=2>this. Could someone give me some suggestions based upon what they are doing</FONT>
<BR><FONT SIZE=2>and their</FONT>
<BR><FONT SIZE=2>results?</FONT>
</P>
<P><FONT SIZE=2>I am trying to create a standard method for our clients to report SPAM to</FONT>
<BR><FONT SIZE=2>us that makes it thorough</FONT>
<BR><FONT SIZE=2>the scanners for some reason. This would involve clients somehow</FONT>
<BR><FONT SIZE=2>redirecting the sample to</FONT>
<BR><FONT SIZE=2>a special e-mail account. The e-mail account would be reviewed daily to</FONT>
<BR><FONT SIZE=2>make verify each sample.</FONT>
<BR><FONT SIZE=2>A cron job on our mailscanner would execute a perl script that would log</FONT>
<BR><FONT SIZE=2>into the pop3 server and</FONT>
<BR><FONT SIZE=2>download the messages into a mbox file and feed those messages into</FONT>
<BR><FONT SIZE=2>sa-learn. My questions</FONT>
<BR><FONT SIZE=2>revolve around the best ways to get those samples to that special e-mail</FONT>
<BR><FONT SIZE=2>account. I understand that for</FONT>
<BR><FONT SIZE=2>obvious reasons, forwarding messages do not work; they mangle the message</FONT>
<BR><FONT SIZE=2>headers. However, what</FONT>
<BR><FONT SIZE=2>about re-directing the message? It modifies the messages headers somewhat.</FONT>
<BR><FONT SIZE=2>Also, these messages,</FONT>
<BR><FONT SIZE=2>since they have been scanned already by mailscanner have additional headers</FONT>
<BR><FONT SIZE=2>added to them. Should</FONT>
<BR><FONT SIZE=2>I configure mailscanner to ignore those message headers when it's using the</FONT>
<BR><FONT SIZE=2>bayes database?</FONT>
<BR><FONT SIZE=2>I saw on the list some speaking about having users send the original</FONT>
<BR><FONT SIZE=2>message as an attachment.</FONT>
<BR><FONT SIZE=2>I don't know of any MuA that does this (at least the most popular windows</FONT>
<BR><FONT SIZE=2>ones). The users would have</FONT>
<BR><FONT SIZE=2>to do something more manual like copying and pasting the message source</FONT>
<BR><FONT SIZE=2>including full headers into</FONT>
<BR><FONT SIZE=2>a text file and attaching it to an e-mail. Is that pretty much what</FONT>
<BR><FONT SIZE=2>everyone is doing?</FONT>
</P>
<BR>
<P><FONT SIZE=2>Best Regards,</FONT>
</P>
<P><FONT SIZE=2>Errol Neal</FONT>
</P>
<BR>
<P><FONT SIZE=2>----------------------------------------------------------------------------</FONT>
<BR><FONT SIZE=2>-</FONT>
<BR><FONT SIZE=2>This message has been scanned for viruses and</FONT>
<BR><FONT SIZE=2>dangerous content by the <A HREF="http://www.anti84787.com" TARGET="_blank">http://www.anti84787.com</A></FONT>
<BR><FONT SIZE=2>MailScanner, and is believed to be clean.</FONT>
<BR><FONT SIZE=2>----------------------------------------------------------------------------</FONT>
<BR><FONT SIZE=2>-</FONT>
</P>
<BR>
<BR>
<BR>
<P><FONT SIZE=2>----------------------------------------------------------------------------</FONT>
<BR><FONT SIZE=2>-</FONT>
<BR><FONT SIZE=2>This message has been scanned for viruses and</FONT>
<BR><FONT SIZE=2>dangerous content by the <A HREF="http://www.anti84787.com" TARGET="_blank">http://www.anti84787.com</A></FONT>
<BR><FONT SIZE=2>MailScanner, and is believed to be clean.</FONT>
<BR><FONT SIZE=2>----------------------------------------------------------------------------</FONT>
<BR><FONT SIZE=2>-</FONT>
</P>
</BODY>
</HTML>