<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body>
Nathan Johanson wrote:<br>
<blockquote
cite="midCC6008BDBF458A4DB8456380C1BAB3800BA712@server1.in.tcpnetworks.com"
type="cite">
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">At 06:47 PM 2/26/2004, Michael St. Laurent wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Excellent. Okay, what about spam messages that have lost
</pre>
</blockquote>
<pre wrap="">their headers
</pre>
<blockquote type="cite">
<pre wrap="">becuase the user forwarded it to me (Outlook strips the
</pre>
</blockquote>
<pre wrap="">headers when you do
</pre>
<blockquote type="cite">
<pre wrap="">that). Will it still benefit from looking at just the body
</pre>
</blockquote>
<pre wrap="">of the message?
No.. SA requires a complete email to be trained, and it
learns from both
the headers and the body at the same time.
If you can get them to forward you the message as an attachment with
headers, or use some kind of redirect feature that keeps the
headers intact
you should be OK.. But plain forwards don't work.
</pre>
</blockquote>
<pre wrap=""><!---->
Isn't there a script or perl module floating around that will unpack
this attached message? If so, can someone please post the location?
</pre>
</blockquote>
The one I use is here <a class="moz-txt-link-freetext" href="http://jousset.org/sa-wrapper.pl">http://jousset.org/sa-wrapper.pl</a> but I'm on
Postfix and use this style of set up detailed here
<a class="moz-txt-link-freetext" href="http://jousset.org/pub/sa-postfix.en.html">http://jousset.org/pub/sa-postfix.en.html</a> I'm sure it's possible to
tweak the ideas for other MTA's just remember if you set a ham address
up not to make it guessable or better still not directly publicly
accessible, otherwise you will have 50000 spam mails queuing for your
'ham' box!<br>
<blockquote
cite="midCC6008BDBF458A4DB8456380C1BAB3800BA712@server1.in.tcpnetworks.com"
type="cite">
<pre wrap="">Nathan
</pre>
</blockquote>
<br>
Drew<br>
</body>
<br />--
<br />In line with our <a href="http://www.themarshalls.co.uk/policy">policy</a>, this message has been scanned for
<br />viruses and dangerous content by
<a href="http://www.mailscanner.info/">MailScanner</a>, and is
<br />believed to be clean.
</html>