Mailing List Archive: Legitimate mail from Microsoft Office Outlook 2003

Legitimate mail from Microsoft Office Outlook 2003

Feb 19, 2004, 1:21 PM

Post #1 of 8 (1530 views)

I have legitamate messages from my boss' mail client
getting marked as SPAM. I have seen others reference
simialr problems but no solutions were posted. I
upgraded to the lates version of SA ($VERSION =
"2.63") and he still gets tagged. I have attached an
example text fomr of one of his messages.

In a second message he sent me which was marked "high
priority" I found these headers:

X-Spam-Status: Yes, hits=9.2 tagged_above=3.5
required=6.3 tests=BUGGY_CGI,
FORGED_MUA_OUTLOOK, MAILTO_TO_SPAM_ADDR,
MISSING_OUTLOOK_NAME, X_PRIORITY_HIGH

I don't understand what BUGGY_CGI is. All I saw were a
few e-mail addresses and a URL to our website. No CGI
or code of any kind.

I know the main issue is that he recently upgraded his
Outlook to Outlook 2003.

__________________________________
Do you Yahoo!?
Yahoo! Mail SpamGuard - Read only the mail you want.
http://antispam.yahoo.com/tools

Re: Legitimate mail from Microsoft Office Outlook 2003 [ In reply to ]

ryan.moore at perigee

Feb 19, 2004, 2:04 PM

Post #2 of 8 (1537 views)

Permalink

Scanning that same message I only got 0.5 points:

X-Spam-Status: No, hits=0.5 required=5.0 tests=BAYES_50,DNS_FROM_RFCI_DSN,
HTML_70_80,HTML_MESSAGE autolearn=no version=2.61
X-Spam-Report:
* 0.1 HTML_MESSAGE BODY: HTML included in message
* 0.0 BAYES_50 BODY: Bayesian spam probability is 50 to 56%
* [score: 0.5003]
* 0.1 HTML_70_80 BODY: Message is 70% to 80% HTML
* 0.3 DNS_FROM_RFCI_DSN RBL: From: sender listed in
dsn.rfc-ignorant.org

But I am also still using 2.61.

Ryan Moore
----------
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net

Ezsra McDonald wrote:
> I have legitamate messages from my boss' mail client
> getting marked as SPAM. I have seen others reference
> simialr problems but no solutions were posted. I
> upgraded to the lates version of SA ($VERSION =
> "2.63") and he still gets tagged. I have attached an
> example text fomr of one of his messages.
>
> In a second message he sent me which was marked "high
> priority" I found these headers:
>
> X-Spam-Status: Yes, hits=9.2 tagged_above=3.5
> required=6.3 tests=BUGGY_CGI,
> FORGED_MUA_OUTLOOK, MAILTO_TO_SPAM_ADDR,
> MISSING_OUTLOOK_NAME, X_PRIORITY_HIGH
>
>
> I don't understand what BUGGY_CGI is. All I saw were a
> few e-mail addresses and a URL to our website. No CGI
> or code of any kind.
>
> I know the main issue is that he recently upgraded his
> Outlook to Outlook 2003.
>
>
>
>
> __________________________________
> Do you Yahoo!?
> Yahoo! Mail SpamGuard - Read only the mail you want.
> http://antispam.yahoo.com/tools
>
>
> ------------------------------------------------------------------------
>
>>>From Richard@myhost.com Thu Feb 19 12:53:34 2004
> Return-Path: <Richard@myhost.com>
> Received: from heracles ([unix socket]) by heracles (Cyrus v2.1.9) with
> LMTP; Thu, 19 Feb 2004 12:53:34 -0600
> X-Sieve: CMU Sieve 2.2
> Return-Path: <Richard@myhost.com>
> Received: from smtp-gateway.myhost.com (thanatos.myhost.com [172.25.14.167]) by
> smtp2.myhost.com (Postfix) with ESMTP id C0081D83F9 for <Phillip@myhost.com>; Thu,
> 19 Feb 2004 12:53:31 -0600 (CST)
> Received: from localhost (localhost [127.0.0.1]) by smtp-gateway.myhost.com
> (One4All) with ESMTP id A11724A22 for <Phillip@myhost.com>; Thu, 19 Feb
> 2004 12:53:19 -0600 (CST)
> Received: from smtp-gateway.myhost.com ([127.0.0.1]) by localhost (thanatos
> [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 29237-06 for
> <Phillip@myhost.com>; Thu, 19 Feb 2004 12:53:15 -0600 (CST)
> Received: from DD2CQJ11 (poseidon.myhost.com [172.25.14.218]) by
> smtp-gateway.myhost.com (One4All) with ESMTP id C5DC74A1C for
> <Phillip@myhost.com>; Thu, 19 Feb 2004 12:53:09 -0600 (CST)
> From: "Richard Logan" <Richard@myhost.com>
> To: "'Phillip Van Dyke'" <Phillip@myhost.com>
> Subject: TEST
> Date: Thu, 19 Feb 2004 12:52:41 -0600
> MIME-Version: 1.0
> Content-Type: multipart/alternative; boundary="----=_NextPart_000_0081_01C3F6E7.432C2270"
> X-Mailer: Microsoft Office Outlook, Build 11.0.5510
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
> Thread-Index: AcP3GY11umIIBRO+SV6deiIc1a+KQg==
> Message-Id: <20040219185309.C5DC74A1C@smtp-gateway.myhost.com>
> X-Virus-Scanned: by amavisd-new at myhost.com
> X-Spam-Status: No, hits=4.7 tagged_above=3.5 required=6.3
> tests=FORGED_MUA_OUTLOOK, HTML_70_80, HTML_MESSAGE, HTML_SHOUTING3,
> MAILTO_LINK, MISSING_OUTLOOK_NAME
> X-Spam-Level: *****
> X-Evolution-Source: imap://Phillip@pop.myhost.com/
>
> This is a multi-part message in MIME format.
>
> ------=_NextPart_000_0081_01C3F6E7.432C2270
> Content-Type: text/plain; charset="us-ascii"
> Content-Transfer-Encoding: 8bit
>
> TEST
>
>
>
> ***********************
> Richard Logan
>
> General Manager
>
> One4All - a service of the Steel and Pipe Sales, Inc.
>
> www.One4All.org
>
>
> 223.296.5275 (Phone)
>
> 492-914-5803 (Cell)
>
> 223.296.5563 (Fax)
> Richard@myhost.com (email)
>
> ***********************
>
>
>
>
> ------=_NextPart_000_0081_01C3F6E7.432C2270
> Content-Type: text/html; charset="us-ascii"
> Content-Transfer-Encoding: 8bit
>
> <html>
>
> <head>
> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
> <meta name=Generator content="Microsoft Word 11 (filtered)">
>
> <style>
> 
> </style>
>
> </head>
>
> <body lang=EN-US link=blue vlink=purple>
>
> <div class=Section1>
>
> font-family:Arial'>TEST
>
> font-family:Arial'> 
>
> 10.0pt'>*********************** 
> style='font-weight:bold'>Richard Logan
>
> style='font-size:7.5pt;font-weight:bold'>General Manager
>
> 10.0pt'>One4All -  10.0pt'>a service of the Steel and Pipe Sales, Inc.
>
> <div>
>
> 10.0pt'><a href="http://www.One4All.org">www.One4All.org</a> 
>
> 10.0pt'> 
> 223.296.5275 (Phone)
>
> 10.0pt'>492-914-5803 (Cell)
>
> </div>
>
> 10.0pt'>223.296.5563 (Fax) 
> <a href="mailto:Richard@myhost.com">Richard@myhost.com</a> (email)
>
> 10.0pt'>*********************** 
>
> 12.0pt'> 
>
> </div>
>
> </body>
>
> </html>
>
> ------=_NextPart_000_0081_01C3F6E7.432C2270--
>
>

Re: Legitimate mail from Microsoft Office Outlook 2003 [ In reply to ]

ezsra_mcdonald at yahoo

Feb 19, 2004, 2:12 PM

Post #3 of 8 (1537 views)

Permalink

Yes, well this example was below my 6.3 threshold but
if he replies to some messages or forwards some the
score goes up and the messages gets labeled as SPAM.
If it weren't for the wrongly identified markers like
FORGED_MUA_OUTLOOK and MISSING_OUTLOOK_NAME the rating
would be lower.
--ezsra

--- Ryan Moore <ryan.moore@perigee.net> wrote:
> Scanning that same message I only got 0.5 points:
>
> X-Spam-Status: No, hits=0.5 required=5.0
> tests=BAYES_50,DNS_FROM_RFCI_DSN,
> HTML_70_80,HTML_MESSAGE autolearn=no
> version=2.61
> X-Spam-Report:
> * 0.1 HTML_MESSAGE BODY: HTML included in message
> * 0.0 BAYES_50 BODY: Bayesian spam probability is
> 50 to 56%
> * [score: 0.5003]
> * 0.1 HTML_70_80 BODY: Message is 70% to 80% HTML
> * 0.3 DNS_FROM_RFCI_DSN RBL: From: sender listed
> in
> dsn.rfc-ignorant.org
>
> But I am also still using 2.61.
>
> Ryan Moore
> ----------
> Perigee.net Corporation
> 704-849-8355 (sales)
> 704-849-8017 (tech)
> www.perigee.net
>
>
>
> Ezsra McDonald wrote:
> > I have legitamate messages from my boss' mail
> client
> > getting marked as SPAM. I have seen others
> reference
> > simialr problems but no solutions were posted. I
> > upgraded to the lates version of SA ($VERSION =
> > "2.63") and he still gets tagged. I have attached
> an
> > example text fomr of one of his messages.
> >
> > In a second message he sent me which was marked
> "high
> > priority" I found these headers:
> >
> > X-Spam-Status: Yes, hits=9.2 tagged_above=3.5
> > required=6.3 tests=BUGGY_CGI,
> > FORGED_MUA_OUTLOOK, MAILTO_TO_SPAM_ADDR,
> > MISSING_OUTLOOK_NAME, X_PRIORITY_HIGH
> >
> >
> > I don't understand what BUGGY_CGI is. All I saw
> were a
> > few e-mail addresses and a URL to our website. No
> CGI
> > or code of any kind.
> >
> > I know the main issue is that he recently upgraded
> his
> > Outlook to Outlook 2003.
> >
> >
> >
> >
> > __________________________________
> > Do you Yahoo!?
> > Yahoo! Mail SpamGuard - Read only the mail you
> want.
> > http://antispam.yahoo.com/tools
> >
> >
> >
>
------------------------------------------------------------------------
> >
> >>From Richard@myhost.com Thu Feb 19 12:53:34 2004
> > Return-Path: <Richard@myhost.com>
> > Received: from heracles ([unix socket]) by
> heracles (Cyrus v2.1.9) with
> > LMTP; Thu, 19 Feb 2004 12:53:34 -0600
> > X-Sieve: CMU Sieve 2.2
> > Return-Path: <Richard@myhost.com>
> > Received: from smtp-gateway.myhost.com
> (thanatos.myhost.com [172.25.14.167]) by
> > smtp2.myhost.com (Postfix) with ESMTP id
> C0081D83F9 for <Phillip@myhost.com>; Thu,
> > 19 Feb 2004 12:53:31 -0600 (CST)
> > Received: from localhost (localhost [127.0.0.1])
> by smtp-gateway.myhost.com
> > (One4All) with ESMTP id A11724A22 for
> <Phillip@myhost.com>; Thu, 19 Feb
> > 2004 12:53:19 -0600 (CST)
> > Received: from smtp-gateway.myhost.com
> ([127.0.0.1]) by localhost (thanatos
> > [127.0.0.1]) (amavisd-new, port 10024) with ESMTP
> id 29237-06 for
> > <Phillip@myhost.com>; Thu, 19 Feb 2004 12:53:15
> -0600 (CST)
> > Received: from DD2CQJ11 (poseidon.myhost.com
> [172.25.14.218]) by
> > smtp-gateway.myhost.com (One4All) with ESMTP id
> C5DC74A1C for
> > <Phillip@myhost.com>; Thu, 19 Feb 2004 12:53:09
> -0600 (CST)
> > From: "Richard Logan" <Richard@myhost.com>
> > To: "'Phillip Van Dyke'" <Phillip@myhost.com>
> > Subject: TEST
> > Date: Thu, 19 Feb 2004 12:52:41 -0600
> > MIME-Version: 1.0
> > Content-Type: multipart/alternative;
> boundary="----=_NextPart_000_0081_01C3F6E7.432C2270"
> > X-Mailer: Microsoft Office Outlook, Build
> 11.0.5510
> > X-MimeOLE: Produced By Microsoft MimeOLE
> V6.00.2800.1165
> > Thread-Index: AcP3GY11umIIBRO+SV6deiIc1a+KQg==
> > Message-Id:
> <20040219185309.C5DC74A1C@smtp-gateway.myhost.com>
> > X-Virus-Scanned: by amavisd-new at myhost.com
> > X-Spam-Status: No, hits=4.7 tagged_above=3.5
> required=6.3
> > tests=FORGED_MUA_OUTLOOK, HTML_70_80,
> HTML_MESSAGE, HTML_SHOUTING3,
> > MAILTO_LINK, MISSING_OUTLOOK_NAME
> > X-Spam-Level: *****
> > X-Evolution-Source: imap://Phillip@pop.myhost.com/
> >
> > This is a multi-part message in MIME format.
> >
> > ------=_NextPart_000_0081_01C3F6E7.432C2270
> > Content-Type: text/plain; charset="us-ascii"
> > Content-Transfer-Encoding: 8bit
> >
> > TEST
> >
> >
> >
> > ***********************
> > Richard Logan
> >
> > General Manager
> >
> > One4All - a service of the Steel and Pipe Sales,
> Inc.
> >
> > www.One4All.org
> >
> >
> > 223.296.5275 (Phone)
> >
> > 492-914-5803 (Cell)
> >
> > 223.296.5563 (Fax)
> > Richard@myhost.com (email)
> >
> > ***********************
> >
> >
> >
> >
> > ------=_NextPart_000_0081_01C3F6E7.432C2270
> > Content-Type: text/html; charset="us-ascii"
> > Content-Transfer-Encoding: 8bit
> >
> > <html>
> >
> > <head>
> > <META HTTP-EQUIV="Content-Type"
> CONTENT="text/html; charset=us-ascii">
> > <meta name=Generator content="Microsoft Word 11
> (filtered)">
> >
> > <style>
> > 
> > </style>
> >
> > </head>
> >
> > <body lang=EN-US link=blue vlink=purple>
> >
> > <div class=Section1>
> >
> > style='font-size:10.0pt;
>
=== message truncated ===

__________________________________
Do you Yahoo!?
Yahoo! Mail SpamGuard - Read only the mail you want.
http://antispam.yahoo.com/tools

Re: Legitimate mail from Microsoft Office Outlook 2003 [ In reply to ]

Ezsra_McDonald at yahoo

Feb 20, 2004, 11:02 AM

Post #4 of 8 (1524 views)

Permalink

Greetings,
Why do you suppose that your 2.61, an older version, passed the
following tests and the newer version I am using did not?

FORGED_MUA_OUTLOOK
HTML_SHOUTING3
MAILTO_LINK
MISSING_OUTLOOK_NAME

My SpamAssassin has not been tweaked in any way. This is right out of
the box.

Is there a fix that I can put in my local.cf file?

--Ezsra

On Thu, 2004-02-19 at 15:04, Ryan Moore wrote:
> Scanning that same message I only got 0.5 points:
>
> X-Spam-Status: No, hits=0.5 required=5.0 tests=BAYES_50,DNS_FROM_RFCI_DSN,
> HTML_70_80,HTML_MESSAGE autolearn=no version=2.61
> X-Spam-Report:
> * 0.1 HTML_MESSAGE BODY: HTML included in message
> * 0.0 BAYES_50 BODY: Bayesian spam probability is 50 to 56%
> * [score: 0.5003]
> * 0.1 HTML_70_80 BODY: Message is 70% to 80% HTML
> * 0.3 DNS_FROM_RFCI_DSN RBL: From: sender listed in
> dsn.rfc-ignorant.org
>
> But I am also still using 2.61.
>
> Ryan Moore
> ----------
> Perigee.net Corporation
> 704-849-8355 (sales)
> 704-849-8017 (tech)
> www.perigee.net
>
>
>
> Ezsra McDonald wrote:
> > I have legitamate messages from my boss' mail client
> > getting marked as SPAM. I have seen others reference
> > simialr problems but no solutions were posted. I
> > upgraded to the lates version of SA ($VERSION =
> > "2.63") and he still gets tagged. I have attached an
> > example text fomr of one of his messages.
> >
> > In a second message he sent me which was marked "high
> > priority" I found these headers:
> >
> > X-Spam-Status: Yes, hits=9.2 tagged_above=3.5
> > required=6.3 tests=BUGGY_CGI,
> > FORGED_MUA_OUTLOOK, MAILTO_TO_SPAM_ADDR,
> > MISSING_OUTLOOK_NAME, X_PRIORITY_HIGH
> >
> >
> > I don't understand what BUGGY_CGI is. All I saw were a
> > few e-mail addresses and a URL to our website. No CGI
> > or code of any kind.
> >
> > I know the main issue is that he recently upgraded his
> > Outlook to Outlook 2003.
> >
> >
> >
> >
> > __________________________________
> > Do you Yahoo!?
> > Yahoo! Mail SpamGuard - Read only the mail you want.
> > http://antispam.yahoo.com/tools
> >
> >
> > ------------------------------------------------------------------------
> >
> >>From Richard@myhost.com Thu Feb 19 12:53:34 2004
> > Return-Path: <Richard@myhost.com>
> > Received: from heracles ([unix socket]) by heracles (Cyrus v2.1.9) with
> > LMTP; Thu, 19 Feb 2004 12:53:34 -0600
> > X-Sieve: CMU Sieve 2.2
> > Return-Path: <Richard@myhost.com>
> > Received: from smtp-gateway.myhost.com (thanatos.myhost.com [172.25.14.167]) by
> > smtp2.myhost.com (Postfix) with ESMTP id C0081D83F9 for <Phillip@myhost.com>; Thu,
> > 19 Feb 2004 12:53:31 -0600 (CST)
> > Received: from localhost (localhost [127.0.0.1]) by smtp-gateway.myhost.com
> > (One4All) with ESMTP id A11724A22 for <Phillip@myhost.com>; Thu, 19 Feb
> > 2004 12:53:19 -0600 (CST)
> > Received: from smtp-gateway.myhost.com ([127.0.0.1]) by localhost (thanatos
> > [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 29237-06 for
> > <Phillip@myhost.com>; Thu, 19 Feb 2004 12:53:15 -0600 (CST)
> > Received: from DD2CQJ11 (poseidon.myhost.com [172.25.14.218]) by
> > smtp-gateway.myhost.com (One4All) with ESMTP id C5DC74A1C for
> > <Phillip@myhost.com>; Thu, 19 Feb 2004 12:53:09 -0600 (CST)
> > From: "Richard Logan" <Richard@myhost.com>
> > To: "'Phillip Van Dyke'" <Phillip@myhost.com>
> > Subject: TEST
> > Date: Thu, 19 Feb 2004 12:52:41 -0600
> > MIME-Version: 1.0
> > Content-Type: multipart/alternative; boundary="----=_NextPart_000_0081_01C3F6E7.432C2270"
> > X-Mailer: Microsoft Office Outlook, Build 11.0.5510
> > X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
> > Thread-Index: AcP3GY11umIIBRO+SV6deiIc1a+KQg==
> > Message-Id: <20040219185309.C5DC74A1C@smtp-gateway.myhost.com>
> > X-Virus-Scanned: by amavisd-new at myhost.com
> > X-Spam-Status: No, hits=4.7 tagged_above=3.5 required=6.3
> > tests=FORGED_MUA_OUTLOOK, HTML_70_80, HTML_MESSAGE, HTML_SHOUTING3,
> > MAILTO_LINK, MISSING_OUTLOOK_NAME
> > X-Spam-Level: *****
> > X-Evolution-Source: imap://Phillip@pop.myhost.com/
> >
> > This is a multi-part message in MIME format.
> >
> > ------=_NextPart_000_0081_01C3F6E7.432C2270
> > Content-Type: text/plain; charset="us-ascii"
> > Content-Transfer-Encoding: 8bit
> >
> > TEST
> >
> >
> >
> > ***********************
> > Richard Logan
> >
> > General Manager
> >
> > One4All - a service of the Steel and Pipe Sales, Inc.
> >
> > www.One4All.org
> >
> >
> > 223.296.5275 (Phone)
> >
> > 492-914-5803 (Cell)
> >
> > 223.296.5563 (Fax)
> > Richard@myhost.com (email)
> >
> > ***********************
> >
> >
> >
> >
> > ------=_NextPart_000_0081_01C3F6E7.432C2270
> > Content-Type: text/html; charset="us-ascii"
> > Content-Transfer-Encoding: 8bit
> >
> > <html>
> >
> > <head>
> > <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
> > <meta name=Generator content="Microsoft Word 11 (filtered)">
> >
> > <style>
> > 
> > </style>
> >
> > </head>
> >
> > <body lang=EN-US link=blue vlink=purple>
> >
> > <div class=Section1>
> >
> > > font-family:Arial'>TEST
> >
> > > font-family:Arial'> 
> >
> > > 10.0pt'>*********************** 
> > > style='font-weight:bold'>Richard Logan
> >
> > > style='font-size:7.5pt;font-weight:bold'>General Manager
> >
> > > 10.0pt'>One4All -  > 10.0pt'>a service of the Steel and Pipe Sales, Inc.
> >
> > <div>
> >
> > > 10.0pt'><a href="http://www.One4All.org">www.One4All.org</a> 
> >
> > > 10.0pt'> 
> > 223.296.5275 (Phone)
> >
> > > 10.0pt'>492-914-5803 (Cell)
> >
> > </div>
> >
> > > 10.0pt'>223.296.5563 (Fax) 
> > <a href="mailto:Richard@myhost.com">Richard@myhost.com</a> (email)
> >
> > > 10.0pt'>*********************** 
> >
> > > 12.0pt'> 
> >
> > </div>
> >
> > </body>
> >
> > </html>
> >
> > ------=_NextPart_000_0081_01C3F6E7.432C2270--
> >
> >

Re: Legitimate mail from Microsoft Office Outlook 2003 [ In reply to ]

ryan.moore at perigee

Feb 20, 2004, 11:30 AM

Post #5 of 8 (1528 views)

Permalink

Not sure, I just upgraded my test box (my desktop) to SA 2.63 and the
results were the same. You don't have any old lingering rules laying
around from previous versions do you?

Ryan Moore
----------
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net

Ezsra McDonald wrote:
> Greetings,
> Why do you suppose that your 2.61, an older version, passed the
> following tests and the newer version I am using did not?
>
> FORGED_MUA_OUTLOOK
> HTML_SHOUTING3
> MAILTO_LINK
> MISSING_OUTLOOK_NAME
>
> My SpamAssassin has not been tweaked in any way. This is right out of
> the box.
>
> Is there a fix that I can put in my local.cf file?
>
> --Ezsra
>
>
> On Thu, 2004-02-19 at 15:04, Ryan Moore wrote:
>
>>Scanning that same message I only got 0.5 points:
>>
>>X-Spam-Status: No, hits=0.5 required=5.0 tests=BAYES_50,DNS_FROM_RFCI_DSN,
>> HTML_70_80,HTML_MESSAGE autolearn=no version=2.61
>>X-Spam-Report:
>> * 0.1 HTML_MESSAGE BODY: HTML included in message
>> * 0.0 BAYES_50 BODY: Bayesian spam probability is 50 to 56%
>> * [score: 0.5003]
>> * 0.1 HTML_70_80 BODY: Message is 70% to 80% HTML
>> * 0.3 DNS_FROM_RFCI_DSN RBL: From: sender listed in
>> dsn.rfc-ignorant.org
>>
>>But I am also still using 2.61.
>>
>>Ryan Moore
>>----------
>>Perigee.net Corporation
>>704-849-8355 (sales)
>>704-849-8017 (tech)
>>www.perigee.net
>>
>>
>>
>>Ezsra McDonald wrote:
>>
>>>I have legitamate messages from my boss' mail client
>>>getting marked as SPAM. I have seen others reference
>>>simialr problems but no solutions were posted. I
>>>upgraded to the lates version of SA ($VERSION =
>>>"2.63") and he still gets tagged. I have attached an
>>>example text fomr of one of his messages.
>>>
>>>In a second message he sent me which was marked "high
>>>priority" I found these headers:
>>>
>>>X-Spam-Status: Yes, hits=9.2 tagged_above=3.5
>>>required=6.3 tests=BUGGY_CGI,
>>>FORGED_MUA_OUTLOOK, MAILTO_TO_SPAM_ADDR,
>>>MISSING_OUTLOOK_NAME, X_PRIORITY_HIGH
>>>
>>>
>>>I don't understand what BUGGY_CGI is. All I saw were a
>>>few e-mail addresses and a URL to our website. No CGI
>>>or code of any kind.
>>>
>>>I know the main issue is that he recently upgraded his
>>>Outlook to Outlook 2003.
>>>
>>>
>>>
>>>
>>>__________________________________
>>>Do you Yahoo!?
>>>Yahoo! Mail SpamGuard - Read only the mail you want.
>>>http://antispam.yahoo.com/tools
>>>
>>>
>>>------------------------------------------------------------------------
>>>
>>>>>From Richard@myhost.com Thu Feb 19 12:53:34 2004
>>>Return-Path: <Richard@myhost.com>
>>>Received: from heracles ([unix socket]) by heracles (Cyrus v2.1.9) with
>>> LMTP; Thu, 19 Feb 2004 12:53:34 -0600
>>>X-Sieve: CMU Sieve 2.2
>>>Return-Path: <Richard@myhost.com>
>>>Received: from smtp-gateway.myhost.com (thanatos.myhost.com [172.25.14.167]) by
>>> smtp2.myhost.com (Postfix) with ESMTP id C0081D83F9 for <Phillip@myhost.com>; Thu,
>>> 19 Feb 2004 12:53:31 -0600 (CST)
>>>Received: from localhost (localhost [127.0.0.1]) by smtp-gateway.myhost.com
>>> (One4All) with ESMTP id A11724A22 for <Phillip@myhost.com>; Thu, 19 Feb
>>> 2004 12:53:19 -0600 (CST)
>>>Received: from smtp-gateway.myhost.com ([127.0.0.1]) by localhost (thanatos
>>> [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 29237-06 for
>>> <Phillip@myhost.com>; Thu, 19 Feb 2004 12:53:15 -0600 (CST)
>>>Received: from DD2CQJ11 (poseidon.myhost.com [172.25.14.218]) by
>>> smtp-gateway.myhost.com (One4All) with ESMTP id C5DC74A1C for
>>> <Phillip@myhost.com>; Thu, 19 Feb 2004 12:53:09 -0600 (CST)
>>>From: "Richard Logan" <Richard@myhost.com>
>>>To: "'Phillip Van Dyke'" <Phillip@myhost.com>
>>>Subject: TEST
>>>Date: Thu, 19 Feb 2004 12:52:41 -0600
>>>MIME-Version: 1.0
>>>Content-Type: multipart/alternative; boundary="----=_NextPart_000_0081_01C3F6E7.432C2270"
>>>X-Mailer: Microsoft Office Outlook, Build 11.0.5510
>>>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
>>>Thread-Index: AcP3GY11umIIBRO+SV6deiIc1a+KQg==
>>>Message-Id: <20040219185309.C5DC74A1C@smtp-gateway.myhost.com>
>>>X-Virus-Scanned: by amavisd-new at myhost.com
>>>X-Spam-Status: No, hits=4.7 tagged_above=3.5 required=6.3
>>> tests=FORGED_MUA_OUTLOOK, HTML_70_80, HTML_MESSAGE, HTML_SHOUTING3,
>>> MAILTO_LINK, MISSING_OUTLOOK_NAME
>>>X-Spam-Level: *****
>>>X-Evolution-Source: imap://Phillip@pop.myhost.com/
>>>
>>>This is a multi-part message in MIME format.
>>>
>>>------=_NextPart_000_0081_01C3F6E7.432C2270
>>>Content-Type: text/plain; charset="us-ascii"
>>>Content-Transfer-Encoding: 8bit
>>>
>>>TEST
>>>
>>>
>>>
>>>***********************
>>>Richard Logan
>>>
>>>General Manager
>>>
>>>One4All - a service of the Steel and Pipe Sales, Inc.
>>>
>>>www.One4All.org
>>>
>>>
>>>223.296.5275 (Phone)
>>>
>>>492-914-5803 (Cell)
>>>
>>>223.296.5563 (Fax)
>>>Richard@myhost.com (email)
>>>
>>>***********************
>>>
>>>
>>>
>>>
>>>------=_NextPart_000_0081_01C3F6E7.432C2270
>>>Content-Type: text/html; charset="us-ascii"
>>>Content-Transfer-Encoding: 8bit
>>>
>>><html>
>>>
>>><head>
>>><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
>>><meta name=Generator content="Microsoft Word 11 (filtered)">
>>>
>>><style>
>>>
>>></style>
>>>
>>></head>
>>>
>>><body lang=EN-US link=blue vlink=purple>
>>>
>>><div class=Section1>
>>>
>>>>>font-family:Arial'>TEST
>>>
>>>>>font-family:Arial'> 
>>>
>>>>>10.0pt'>*********************** 
>>>>> style='font-weight:bold'>Richard Logan
>>>
>>>>>style='font-size:7.5pt;font-weight:bold'>General Manager
>>>
>>>>>10.0pt'>One4All - >>10.0pt'>a service of the Steel and Pipe Sales, Inc.
>>>
>>><div>
>>>
>>>>>10.0pt'><a href="http://www.One4All.org">www.One4All.org</a> 
>>>
>>>>>10.0pt'> 
>>>223.296.5275 (Phone)
>>>
>>>>>10.0pt'>492-914-5803 (Cell)
>>>
>>></div>
>>>
>>>>>10.0pt'>223.296.5563 (Fax) 
>>><a href="mailto:Richard@myhost.com">Richard@myhost.com</a> (email)
>>>
>>>>>10.0pt'>*********************** 
>>>
>>>>>12.0pt'> 
>>>
>>></div>
>>>
>>></body>
>>>
>>></html>
>>>
>>>------=_NextPart_000_0081_01C3F6E7.432C2270--
>>>
>>>
>
>
>

Re: Legitimate mail from Microsoft Office Outlook 2003 [ In reply to ]

Ezsra_McDonald at yahoo

Feb 20, 2004, 12:37 PM

Post #6 of 8 (1525 views)

Permalink

When you say the results were the same do you mean you had the same
results as I did or the same a as you did before?

Would you mind sending me a tar file of your rules? I checked my system
and the rules are located in /usr/local/share/spamassassin and have
yesterdays date. This is the date I upgraded.

These are the rules I have in /etc/mail/spamassassin/local.cf:

# WHITE-LISTED SENDERS (the good guys):

#whitelist_from *.good-domain.net # This domain is safe
#whitelist_from *@goodguys.com # These guys are ok
#whitelist_from dudley.duright@mounties.ca # He never spams us

# WHITELIST HAS BEEN REMOVED FOR SECURITY REASONS

# WHITE-LISTED RECEIVERS:
# (Let ALL mail through to these recipients - no scanning for SPAM):

# BLACK-LISTED SENDERS (the bad guys):

#blacklist_from offers@*.*
#blacklist_from offerz@*.*
#blacklist_from *@badguys.com # nasty outlaws
#blacklist_from *@casino-fun.* # we don't want any of this
stuff...

# BLACKLIST HAS BEEN REMOVED FOR SECURITY REASONS

# SCORE CHANGES (Don't mess with these unless you KNOW what
# you are doing!

#score FORGED_HOTMAIL_RECD 5.50
#score WEB_BUGS 1.50

# ---------------------------------------
# I added these this morning 2004/02/20
score FORGED_MUA_OUTLOOK 0.5
score MISSING_OUTLOOK_NAME 0.1
score BUGGY_CGI 0.5
# ---------------------------------------
#

#rewrite_subject 0
#report_safe 1

On Fri, 2004-02-20 at 12:30, Ryan Moore wrote:
> Not sure, I just upgraded my test box (my desktop) to SA 2.63 and the
> results were the same. You don't have any old lingering rules laying
> around from previous versions do you?
>
> Ryan Moore
> ----------
> Perigee.net Corporation
> 704-849-8355 (sales)
> 704-849-8017 (tech)
> www.perigee.net
>
>
>
> Ezsra McDonald wrote:
> > Greetings,
> > Why do you suppose that your 2.61, an older version, passed the
> > following tests and the newer version I am using did not?
> >
> > FORGED_MUA_OUTLOOK
> > HTML_SHOUTING3
> > MAILTO_LINK
> > MISSING_OUTLOOK_NAME
> >
> > My SpamAssassin has not been tweaked in any way. This is right out of
> > the box.
> >
> > Is there a fix that I can put in my local.cf file?
> >
> > --Ezsra
> >
> >
> > On Thu, 2004-02-19 at 15:04, Ryan Moore wrote:
> >
> >>Scanning that same message I only got 0.5 points:
> >>
> >>X-Spam-Status: No, hits=0.5 required=5.0 tests=BAYES_50,DNS_FROM_RFCI_DSN,
> >> HTML_70_80,HTML_MESSAGE autolearn=no version=2.61
> >>X-Spam-Report:
> >> * 0.1 HTML_MESSAGE BODY: HTML included in message
> >> * 0.0 BAYES_50 BODY: Bayesian spam probability is 50 to 56%
> >> * [score: 0.5003]
> >> * 0.1 HTML_70_80 BODY: Message is 70% to 80% HTML
> >> * 0.3 DNS_FROM_RFCI_DSN RBL: From: sender listed in
> >> dsn.rfc-ignorant.org
> >>
> >>But I am also still using 2.61.
> >>
> >>Ryan Moore
> >>----------
> >>Perigee.net Corporation
> >>704-849-8355 (sales)
> >>704-849-8017 (tech)
> >>www.perigee.net
> >>
> >>
> >>
> >>Ezsra McDonald wrote:
> >>
> >>>I have legitamate messages from my boss' mail client
> >>>getting marked as SPAM. I have seen others reference
> >>>simialr problems but no solutions were posted. I
> >>>upgraded to the lates version of SA ($VERSION =
> >>>"2.63") and he still gets tagged. I have attached an
> >>>example text fomr of one of his messages.
> >>>
> >>>In a second message he sent me which was marked "high
> >>>priority" I found these headers:
> >>>
> >>>X-Spam-Status: Yes, hits=9.2 tagged_above=3.5
> >>>required=6.3 tests=BUGGY_CGI,
> >>>FORGED_MUA_OUTLOOK, MAILTO_TO_SPAM_ADDR,
> >>>MISSING_OUTLOOK_NAME, X_PRIORITY_HIGH
> >>>
> >>>
> >>>I don't understand what BUGGY_CGI is. All I saw were a
> >>>few e-mail addresses and a URL to our website. No CGI
> >>>or code of any kind.
> >>>
> >>>I know the main issue is that he recently upgraded his
> >>>Outlook to Outlook 2003.
> >>>
> >>>
> >>>
> >>>
> >>>__________________________________
> >>>Do you Yahoo!?
> >>>Yahoo! Mail SpamGuard - Read only the mail you want.
> >>>http://antispam.yahoo.com/tools
> >>>
> >>>
> >>>------------------------------------------------------------------------
> >>>
> >>>>From Richard@myhost.com Thu Feb 19 12:53:34 2004
> >>>Return-Path: <Richard@myhost.com>
> >>>Received: from heracles ([unix socket]) by heracles (Cyrus v2.1.9) with
> >>> LMTP; Thu, 19 Feb 2004 12:53:34 -0600
> >>>X-Sieve: CMU Sieve 2.2
> >>>Return-Path: <Richard@myhost.com>
> >>>Received: from smtp-gateway.myhost.com (thanatos.myhost.com [172.25.14.167]) by
> >>> smtp2.myhost.com (Postfix) with ESMTP id C0081D83F9 for <Phillip@myhost.com>; Thu,
> >>> 19 Feb 2004 12:53:31 -0600 (CST)
> >>>Received: from localhost (localhost [127.0.0.1]) by smtp-gateway.myhost.com
> >>> (One4All) with ESMTP id A11724A22 for <Phillip@myhost.com>; Thu, 19 Feb
> >>> 2004 12:53:19 -0600 (CST)
> >>>Received: from smtp-gateway.myhost.com ([127.0.0.1]) by localhost (thanatos
> >>> [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 29237-06 for
> >>> <Phillip@myhost.com>; Thu, 19 Feb 2004 12:53:15 -0600 (CST)
> >>>Received: from DD2CQJ11 (poseidon.myhost.com [172.25.14.218]) by
> >>> smtp-gateway.myhost.com (One4All) with ESMTP id C5DC74A1C for
> >>> <Phillip@myhost.com>; Thu, 19 Feb 2004 12:53:09 -0600 (CST)
> >>>From: "Richard Logan" <Richard@myhost.com>
> >>>To: "'Phillip Van Dyke'" <Phillip@myhost.com>
> >>>Subject: TEST
> >>>Date: Thu, 19 Feb 2004 12:52:41 -0600
> >>>MIME-Version: 1.0
> >>>Content-Type: multipart/alternative; boundary="----=_NextPart_000_0081_01C3F6E7.432C2270"
> >>>X-Mailer: Microsoft Office Outlook, Build 11.0.5510
> >>>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
> >>>Thread-Index: AcP3GY11umIIBRO+SV6deiIc1a+KQg==
> >>>Message-Id: <20040219185309.C5DC74A1C@smtp-gateway.myhost.com>
> >>>X-Virus-Scanned: by amavisd-new at myhost.com
> >>>X-Spam-Status: No, hits=4.7 tagged_above=3.5 required=6.3
> >>> tests=FORGED_MUA_OUTLOOK, HTML_70_80, HTML_MESSAGE, HTML_SHOUTING3,
> >>> MAILTO_LINK, MISSING_OUTLOOK_NAME
> >>>X-Spam-Level: *****
> >>>X-Evolution-Source: imap://Phillip@pop.myhost.com/
> >>>
> >>>This is a multi-part message in MIME format.
> >>>
> >>>------=_NextPart_000_0081_01C3F6E7.432C2270
> >>>Content-Type: text/plain; charset="us-ascii"
> >>>Content-Transfer-Encoding: 8bit
> >>>
> >>>TEST
> >>>
> >>>
> >>>
> >>>***********************
> >>>Richard Logan
> >>>
> >>>General Manager
> >>>
> >>>One4All - a service of the Steel and Pipe Sales, Inc.
> >>>
> >>>www.One4All.org
> >>>
> >>>
> >>>223.296.5275 (Phone)
> >>>
> >>>492-914-5803 (Cell)
> >>>
> >>>223.296.5563 (Fax)
> >>>Richard@myhost.com (email)
> >>>
> >>>***********************
> >>>
> >>>
> >>>
> >>>
> >>>------=_NextPart_000_0081_01C3F6E7.432C2270
> >>>Content-Type: text/html; charset="us-ascii"
> >>>Content-Transfer-Encoding: 8bit
> >>>
> >>><html>
> >>>
> >>><head>
> >>><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
> >>><meta name=Generator content="Microsoft Word 11 (filtered)">
> >>>
> >>><style>
> >>>
> >>></style>
> >>>
> >>></head>
> >>>
> >>><body lang=EN-US link=blue vlink=purple>
> >>>
> >>><div class=Section1>
> >>>
> >>> >>>font-family:Arial'>TEST
> >>>
> >>> >>>font-family:Arial'> 
> >>>
> >>> >>>10.0pt'>*********************** 
> >>> >>> style='font-weight:bold'>Richard Logan
> >>>
> >>> >>>style='font-size:7.5pt;font-weight:bold'>General Manager
> >>>
> >>> >>>10.0pt'>One4All -  >>>10.0pt'>a service of the Steel and Pipe Sales, Inc.
> >>>
> >>><div>
> >>>
> >>> >>>10.0pt'><a href="http://www.One4All.org">www.One4All.org</a> 
> >>>
> >>> >>>10.0pt'> 
> >>>223.296.5275 (Phone)
> >>>
> >>> >>>10.0pt'>492-914-5803 (Cell)
> >>>
> >>></div>
> >>>
> >>> >>>10.0pt'>223.296.5563 (Fax) 
> >>><a href="mailto:Richard@myhost.com">Richard@myhost.com</a> (email)
> >>>
> >>> >>>10.0pt'>*********************** 
> >>>
> >>> >>>12.0pt'> 
> >>>
> >>></div>
> >>>
> >>></body>
> >>>
> >>></html>
> >>>
> >>>------=_NextPart_000_0081_01C3F6E7.432C2270--
> >>>
> >>>
> >
> >
> >

Re: Legitimate mail from Microsoft Office Outlook 2003 [ In reply to ]

ryan.moore at perigee

Feb 20, 2004, 1:24 PM

Post #7 of 8 (1530 views)

Permalink

Meant to say that the results were the same as my previous run, in that
I got the same score and hits pretty much:

X-Spam-Report:
* -1.5 BAYES_01 BODY: Bayesian spam probability is 1 to 10%
* [score: 0.0873]
* 0.1 HTML_MESSAGE BODY: HTML included in message
* 0.1 HTML_70_80 BODY: Message is 70% to 80% HTML
* 0.3 DNS_FROM_RFCI_DSN RBL: From: sender listed in
dsn.rfc-ignorant.org

You might also check /usr/share/spamassassin, as I thought that is the
default site rules directory, though it might be different on various
platforms.

Ryan Moore
----------
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net

Ezsra McDonald wrote:
> When you say the results were the same do you mean you had the same
> results as I did or the same a as you did before?
>
> Would you mind sending me a tar file of your rules? I checked my system
> and the rules are located in /usr/local/share/spamassassin and have
> yesterdays date. This is the date I upgraded.
>
> These are the rules I have in /etc/mail/spamassassin/local.cf:
>
> # WHITE-LISTED SENDERS (the good guys):
>
> #whitelist_from *.good-domain.net # This domain is safe
> #whitelist_from *@goodguys.com # These guys are ok
> #whitelist_from dudley.duright@mounties.ca # He never spams us
>
> # WHITELIST HAS BEEN REMOVED FOR SECURITY REASONS
>
> # WHITE-LISTED RECEIVERS:
> # (Let ALL mail through to these recipients - no scanning for SPAM):
>
>
> # BLACK-LISTED SENDERS (the bad guys):
>
> #blacklist_from offers@*.*
> #blacklist_from offerz@*.*
> #blacklist_from *@badguys.com # nasty outlaws
> #blacklist_from *@casino-fun.* # we don't want any of this
> stuff...
>
> # BLACKLIST HAS BEEN REMOVED FOR SECURITY REASONS
>
> # SCORE CHANGES (Don't mess with these unless you KNOW what
> # you are doing!
>
> #score FORGED_HOTMAIL_RECD 5.50
> #score WEB_BUGS 1.50
>
> # ---------------------------------------
> # I added these this morning 2004/02/20
> score FORGED_MUA_OUTLOOK 0.5
> score MISSING_OUTLOOK_NAME 0.1
> score BUGGY_CGI 0.5
> # ---------------------------------------
> #
>
> #rewrite_subject 0
> #report_safe 1
>
>
> On Fri, 2004-02-20 at 12:30, Ryan Moore wrote:
>
>>Not sure, I just upgraded my test box (my desktop) to SA 2.63 and the
>>results were the same. You don't have any old lingering rules laying
>>around from previous versions do you?
>>
>>Ryan Moore
>>----------
>>Perigee.net Corporation
>>704-849-8355 (sales)
>>704-849-8017 (tech)
>>www.perigee.net
>>
>>
>>
>>Ezsra McDonald wrote:
>>
>>>Greetings,
>>>Why do you suppose that your 2.61, an older version, passed the
>>>following tests and the newer version I am using did not?
>>>
>>>FORGED_MUA_OUTLOOK
>>>HTML_SHOUTING3
>>>MAILTO_LINK
>>>MISSING_OUTLOOK_NAME
>>>
>>>My SpamAssassin has not been tweaked in any way. This is right out of
>>>the box.
>>>
>>>Is there a fix that I can put in my local.cf file?
>>>
>>>--Ezsra
>>>
>>>
>>>On Thu, 2004-02-19 at 15:04, Ryan Moore wrote:
>>>
>>>
>>>>Scanning that same message I only got 0.5 points:
>>>>
>>>>X-Spam-Status: No, hits=0.5 required=5.0 tests=BAYES_50,DNS_FROM_RFCI_DSN,
>>>> HTML_70_80,HTML_MESSAGE autolearn=no version=2.61
>>>>X-Spam-Report:
>>>> * 0.1 HTML_MESSAGE BODY: HTML included in message
>>>> * 0.0 BAYES_50 BODY: Bayesian spam probability is 50 to 56%
>>>> * [score: 0.5003]
>>>> * 0.1 HTML_70_80 BODY: Message is 70% to 80% HTML
>>>> * 0.3 DNS_FROM_RFCI_DSN RBL: From: sender listed in
>>>> dsn.rfc-ignorant.org
>>>>
>>>>But I am also still using 2.61.
>>>>
>>>>Ryan Moore
>>>>----------
>>>>Perigee.net Corporation
>>>>704-849-8355 (sales)
>>>>704-849-8017 (tech)
>>>>www.perigee.net
>>>>
>>>>
>>>>
>>>>Ezsra McDonald wrote:
>>>>
>>>>
>>>>>I have legitamate messages from my boss' mail client
>>>>>getting marked as SPAM. I have seen others reference
>>>>>simialr problems but no solutions were posted. I
>>>>>upgraded to the lates version of SA ($VERSION =
>>>>>"2.63") and he still gets tagged. I have attached an
>>>>>example text fomr of one of his messages.
>>>>>
>>>>>In a second message he sent me which was marked "high
>>>>>priority" I found these headers:
>>>>>
>>>>>X-Spam-Status: Yes, hits=9.2 tagged_above=3.5
>>>>>required=6.3 tests=BUGGY_CGI,
>>>>>FORGED_MUA_OUTLOOK, MAILTO_TO_SPAM_ADDR,
>>>>>MISSING_OUTLOOK_NAME, X_PRIORITY_HIGH
>>>>>
>>>>>
>>>>>I don't understand what BUGGY_CGI is. All I saw were a
>>>>>few e-mail addresses and a URL to our website. No CGI
>>>>>or code of any kind.
>>>>>
>>>>>I know the main issue is that he recently upgraded his
>>>>>Outlook to Outlook 2003.
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>__________________________________
>>>>>Do you Yahoo!?
>>>>>Yahoo! Mail SpamGuard - Read only the mail you want.
>>>>>http://antispam.yahoo.com/tools
>>>>>
>>>>>
>>>>>------------------------------------------------------------------------
>>>>>
>>>>>>>From Richard@myhost.com Thu Feb 19 12:53:34 2004
>>>>>Return-Path: <Richard@myhost.com>
>>>>>Received: from heracles ([unix socket]) by heracles (Cyrus v2.1.9) with
>>>>> LMTP; Thu, 19 Feb 2004 12:53:34 -0600
>>>>>X-Sieve: CMU Sieve 2.2
>>>>>Return-Path: <Richard@myhost.com>
>>>>>Received: from smtp-gateway.myhost.com (thanatos.myhost.com [172.25.14.167]) by
>>>>> smtp2.myhost.com (Postfix) with ESMTP id C0081D83F9 for <Phillip@myhost.com>; Thu,
>>>>> 19 Feb 2004 12:53:31 -0600 (CST)
>>>>>Received: from localhost (localhost [127.0.0.1]) by smtp-gateway.myhost.com
>>>>> (One4All) with ESMTP id A11724A22 for <Phillip@myhost.com>; Thu, 19 Feb
>>>>> 2004 12:53:19 -0600 (CST)
>>>>>Received: from smtp-gateway.myhost.com ([127.0.0.1]) by localhost (thanatos
>>>>> [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 29237-06 for
>>>>> <Phillip@myhost.com>; Thu, 19 Feb 2004 12:53:15 -0600 (CST)
>>>>>Received: from DD2CQJ11 (poseidon.myhost.com [172.25.14.218]) by
>>>>> smtp-gateway.myhost.com (One4All) with ESMTP id C5DC74A1C for
>>>>> <Phillip@myhost.com>; Thu, 19 Feb 2004 12:53:09 -0600 (CST)
>>>>>From: "Richard Logan" <Richard@myhost.com>
>>>>>To: "'Phillip Van Dyke'" <Phillip@myhost.com>
>>>>>Subject: TEST
>>>>>Date: Thu, 19 Feb 2004 12:52:41 -0600
>>>>>MIME-Version: 1.0
>>>>>Content-Type: multipart/alternative; boundary="----=_NextPart_000_0081_01C3F6E7.432C2270"
>>>>>X-Mailer: Microsoft Office Outlook, Build 11.0.5510
>>>>>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
>>>>>Thread-Index: AcP3GY11umIIBRO+SV6deiIc1a+KQg==
>>>>>Message-Id: <20040219185309.C5DC74A1C@smtp-gateway.myhost.com>
>>>>>X-Virus-Scanned: by amavisd-new at myhost.com
>>>>>X-Spam-Status: No, hits=4.7 tagged_above=3.5 required=6.3
>>>>> tests=FORGED_MUA_OUTLOOK, HTML_70_80, HTML_MESSAGE, HTML_SHOUTING3,
>>>>> MAILTO_LINK, MISSING_OUTLOOK_NAME
>>>>>X-Spam-Level: *****
>>>>>X-Evolution-Source: imap://Phillip@pop.myhost.com/
>>>>>
>>>>>This is a multi-part message in MIME format.
>>>>>
>>>>>------=_NextPart_000_0081_01C3F6E7.432C2270
>>>>>Content-Type: text/plain; charset="us-ascii"
>>>>>Content-Transfer-Encoding: 8bit
>>>>>
>>>>>TEST
>>>>>
>>>>>
>>>>>
>>>>>***********************
>>>>>Richard Logan
>>>>>
>>>>>General Manager
>>>>>
>>>>>One4All - a service of the Steel and Pipe Sales, Inc.
>>>>>
>>>>>www.One4All.org
>>>>>
>>>>>
>>>>>223.296.5275 (Phone)
>>>>>
>>>>>492-914-5803 (Cell)
>>>>>
>>>>>223.296.5563 (Fax)
>>>>>Richard@myhost.com (email)
>>>>>
>>>>>***********************
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>------=_NextPart_000_0081_01C3F6E7.432C2270
>>>>>Content-Type: text/html; charset="us-ascii"
>>>>>Content-Transfer-Encoding: 8bit
>>>>>
>>>>><html>
>>>>>
>>>>><head>
>>>>><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
>>>>><meta name=Generator content="Microsoft Word 11 (filtered)">
>>>>>
>>>>><style>
>>>>>
>>>>></style>
>>>>>
>>>>></head>
>>>>>
>>>>><body lang=EN-US link=blue vlink=purple>
>>>>>
>>>>><div class=Section1>
>>>>>
>>>>>>>>>font-family:Arial'>TEST
>>>>>
>>>>>>>>>font-family:Arial'> 
>>>>>
>>>>>>>>>10.0pt'>*********************** 
>>>>>>>>>style='font-weight:bold'>Richard Logan
>>>>>
>>>>>>>>>style='font-size:7.5pt;font-weight:bold'>General Manager
>>>>>
>>>>>>>>>10.0pt'>One4All - >>>>10.0pt'>a service of the Steel and Pipe Sales, Inc.
>>>>>
>>>>><div>
>>>>>
>>>>>>>>>10.0pt'><a href="http://www.One4All.org">www.One4All.org</a> 
>>>>>
>>>>>>>>>10.0pt'> 
>>>>>223.296.5275 (Phone)
>>>>>
>>>>>>>>>10.0pt'>492-914-5803 (Cell)
>>>>>
>>>>></div>
>>>>>
>>>>>>>>>10.0pt'>223.296.5563 (Fax) 
>>>>><a href="mailto:Richard@myhost.com">Richard@myhost.com</a> (email)
>>>>>
>>>>>>>>>10.0pt'>*********************** 
>>>>>
>>>>>>>>>12.0pt'> 
>>>>>
>>>>></div>
>>>>>
>>>>></body>
>>>>>
>>>>></html>
>>>>>
>>>>>------=_NextPart_000_0081_01C3F6E7.432C2270--
>>>>>
>>>>>
>>>
>>>
>>>
>
>

Re: Legitimate mail from Microsoft Office Outlook 2003 [ In reply to ]

ezsra_mcdonald at yahoo

Feb 20, 2004, 1:38 PM

Post #8 of 8 (1520 views)

Permalink

Thanks,

but no :-( this is the only location where the files
exist. I did some searches with the 'find' command and
the rule files only showed up in this one location.

I don't know.....Could amavis have something to do
with this?

I am out of ideas. If you care to share your rule
files I would still like to run some diffs on them.

Thanks again,
--Ezsra

--- Ryan Moore <ryan.moore@perigee.net> wrote:
> Meant to say that the results were the same as my
> previous run, in that
> I got the same score and hits pretty much:
>
> X-Spam-Report:
> * -1.5 BAYES_01 BODY: Bayesian spam
> probability is 1 to 10%
> * [score: 0.0873]
> * 0.1 HTML_MESSAGE BODY: HTML included in
> message
> * 0.1 HTML_70_80 BODY: Message is 70% to
> 80% HTML
> * 0.3 DNS_FROM_RFCI_DSN RBL: From: sender
> listed in
> dsn.rfc-ignorant.org
>
>
> You might also check /usr/share/spamassassin, as I
> thought that is the
> default site rules directory, though it might be
> different on various
> platforms.
>
> Ryan Moore
> ----------
> Perigee.net Corporation
> 704-849-8355 (sales)
> 704-849-8017 (tech)
> www.perigee.net
>
>
>
> Ezsra McDonald wrote:
> > When you say the results were the same do you mean
> you had the same
> > results as I did or the same a as you did before?
> >
> > Would you mind sending me a tar file of your
> rules? I checked my system
> > and the rules are located in
> /usr/local/share/spamassassin and have
> > yesterdays date. This is the date I upgraded.
> >
> > These are the rules I have in
> /etc/mail/spamassassin/local.cf:
> >
> > # WHITE-LISTED SENDERS (the good guys):
> >
> > #whitelist_from *.good-domain.net #
> This domain is safe
> > #whitelist_from *@goodguys.com #
> These guys are ok
> > #whitelist_from dudley.duright@mounties.ca #
> He never spams us
> >
> > # WHITELIST HAS BEEN REMOVED FOR SECURITY REASONS
> >
> > # WHITE-LISTED RECEIVERS:
> > # (Let ALL mail through to these recipients - no
> scanning for SPAM):
> >
> >
> > # BLACK-LISTED SENDERS (the bad guys):
> >
> > #blacklist_from offers@*.*
> > #blacklist_from offerz@*.*
> > #blacklist_from *@badguys.com # nasty
> outlaws
> > #blacklist_from *@casino-fun.* # we don't
> want any of this
> > stuff...
> >
> > # BLACKLIST HAS BEEN REMOVED FOR SECURITY REASONS
> >
> > # SCORE CHANGES (Don't mess with these unless you
> KNOW what
> > # you are doing!
> >
> > #score FORGED_HOTMAIL_RECD 5.50
> > #score WEB_BUGS 1.50
> >
> > # ---------------------------------------
> > # I added these this morning 2004/02/20
> > score FORGED_MUA_OUTLOOK 0.5
> > score MISSING_OUTLOOK_NAME 0.1
> > score BUGGY_CGI 0.5
> > # ---------------------------------------
> > #
> >
> > #rewrite_subject 0
> > #report_safe 1
> >
> >
> > On Fri, 2004-02-20 at 12:30, Ryan Moore wrote:
> >
> >>Not sure, I just upgraded my test box (my desktop)
> to SA 2.63 and the
> >>results were the same. You don't have any old
> lingering rules laying
> >>around from previous versions do you?
> >>
> >>Ryan Moore
> >>----------
> >>Perigee.net Corporation
> >>704-849-8355 (sales)
> >>704-849-8017 (tech)
> >>www.perigee.net
> >>
> >>
> >>
> >>Ezsra McDonald wrote:
> >>
> >>>Greetings,
> >>>Why do you suppose that your 2.61, an older
> version, passed the
> >>>following tests and the newer version I am using
> did not?
> >>>
> >>>FORGED_MUA_OUTLOOK
> >>>HTML_SHOUTING3
> >>>MAILTO_LINK
> >>>MISSING_OUTLOOK_NAME
> >>>
> >>>My SpamAssassin has not been tweaked in any way.
> This is right out of
> >>>the box.
> >>>
> >>>Is there a fix that I can put in my local.cf
> file?
> >>>
> >>>--Ezsra
> >>>
> >>>
> >>>On Thu, 2004-02-19 at 15:04, Ryan Moore wrote:
> >>>
> >>>
> >>>>Scanning that same message I only got 0.5
> points:
> >>>>
> >>>>X-Spam-Status: No, hits=0.5 required=5.0
> tests=BAYES_50,DNS_FROM_RFCI_DSN,
> >>>> HTML_70_80,HTML_MESSAGE autolearn=no
> version=2.61
> >>>>X-Spam-Report:
> >>>> * 0.1 HTML_MESSAGE BODY: HTML included in
> message
> >>>> * 0.0 BAYES_50 BODY: Bayesian spam probability
> is 50 to 56%
> >>>> * [score: 0.5003]
> >>>> * 0.1 HTML_70_80 BODY: Message is 70% to 80%
> HTML
> >>>> * 0.3 DNS_FROM_RFCI_DSN RBL: From: sender
> listed in
> >>>> dsn.rfc-ignorant.org
> >>>>
> >>>>But I am also still using 2.61.
> >>>>
> >>>>Ryan Moore
> >>>>----------
> >>>>Perigee.net Corporation
> >>>>704-849-8355 (sales)
> >>>>704-849-8017 (tech)
> >>>>www.perigee.net
> >>>>
> >>>>
> >>>>
> >>>>Ezsra McDonald wrote:
> >>>>
> >>>>
> >>>>>I have legitamate messages from my boss' mail
> client
> >>>>>getting marked as SPAM. I have seen others
> reference
> >>>>>simialr problems but no solutions were posted.
> I
> >>>>>upgraded to the lates version of SA ($VERSION =
> >>>>>"2.63") and he still gets tagged. I have
> attached an
> >>>>>example text fomr of one of his messages.
> >>>>>
> >>>>>In a second message he sent me which was marked
> "high
> >>>>>priority" I found these headers:
> >>>>>
> >>>>>X-Spam-Status: Yes, hits=9.2 tagged_above=3.5
> >>>>>required=6.3 tests=BUGGY_CGI,
> >>>>>FORGED_MUA_OUTLOOK, MAILTO_TO_SPAM_ADDR,
> >>>>>MISSING_OUTLOOK_NAME, X_PRIORITY_HIGH
> >>>>>
> >>>>>
> >>>>>I don't understand what BUGGY_CGI is. All I saw
> were a
> >>>>>few e-mail addresses and a URL to our website.
> No CGI
> >>>>>or code of any kind.
> >>>>>
> >>>>>I know the main issue is that he recently
> upgraded his
> >>>>>Outlook to Outlook 2003.
> >>>>>
> >>>>>
>
=== message truncated ===

__________________________________
Do you Yahoo!?
Yahoo! Mail SpamGuard - Read only the mail you want.
http://antispam.yahoo.com/tools

Mailing List Archive

Mailing List Archive

Attached Files: