--
Am 2004-07-27 08:52:50, schrieb Peter Bowyer:

>OK, nothing special, but what SA rule triggers to detect the virus?

OK, I was looking in some of the Messages...

____ ( 'stdin' ) _____________________________________________________
/
| Content analysis details: (5.5 points, 4.0 required)
|
| pts rule name description
| ---- ----------------------
--------------------------------------------------
| 2.3 BAYES_70 BODY: Bayesian spam probability is 70 to 80%
| [score: 0.7700]
| 0.7 DATE_IN_PAST_06_12 Date: is 6 to 12 hours before Received: date
| 2.6 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
|
|
|
| Content analysis details: (4.0 points, 4.0 required)
|
| pts rule name description
| ---- ----------------------
--------------------------------------------------
| -0.9 BAYES_30 BODY: Bayesian spam probability is 30 to 40%
| [score: 0.3952]
| 1.6 MIME_BASE64_ILLEGAL RAW: base64 attachment uses illegal characters
| 2.6 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
| 0.8 AWL AWL: Auto-whitelist adjustment
|
|
|
| Content analysis details: (9.5 points, 4.0 required)
|
| pts rule name description
| ---- ----------------------
--------------------------------------------------
| 5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
| [score: 0.9999]
| 1.6 MIME_BASE64_ILLEGAL RAW: base64 attachment uses illegal characters
| 0.0 UPPERCASE_25_50 message body is 25-50% uppercase
| 2.6 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
|
|
|
| Content analysis details: (4.7 points, 4.0 required)
|
| pts rule name description
| ---- ----------------------
--------------------------------------------------
| 2.1 BAYES_90 BODY: Bayesian spam probability is 90 to 99%
| [score: 0.9567]
| 2.6 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
|
|
|
| Content analysis details: (5.0 points, 4.0 required)
|
| pts rule name description
| ---- ----------------------
--------------------------------------------------
| 0.2 NO_REAL_NAME From: does not include a real name
| -0.0 BAYES_40 BODY: Bayesian spam probability is 40 to 44%
| [score: 0.4229]
| 1.6 MIME_BASE64_ILLEGAL RAW: base64 attachment uses illegal characters
| 0.7 MSGID_FROM_MTA_HEADER Message-Id was added by a relay
| 2.6 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
\______________________________________________________________________

So all Messages are coming with a forged Outlook Header...

>Peter

I hope this help you...

Greetings
Michelle

--
Linux-User #280138 with the Linux Counter, http://counter.li.org/
Michelle Konzack Apt. 917 ICQ #328449886
50, rue de Soultz MSM LinuxMichi
0033/3/88452356 67100 Strasbourg/France IRC #Debian (irc.icq.com)
--
Content-Description: Digital signature

[ signature.pgp of type application/pgp-signature deleted ]
--

--

## List details at http://www.exim.org/mailman/listinfo/exim-users Exim details
at http://www.exim.org/ ##