On 2 Nov 2006 as I do recall, Jeremy C B Nicoll wrote: > In article <ecd97a7f4e.Dave@xxxxxxxxxxxxxxxxxxxxxxxxx>, > Dave Barnett <as10@xxxxxxxxxxxxxxxxx> wrote: > > > The log shows: > > "Message 2 deferred on rule 127: > > Defer Date: = *-0800* > > And X-MimeOLE: = Produced By Microsoft MimeOLE V6.00.2800.1106 > > I hope you're not going to delete stuff based just on an 8 hour time > difference and use of a specific version of mailing software? > I'm already deleting them based (by observation) on that same version and by minimum size - I'm rather assuming they're all coming from a single infected machine, unless it's a weakness in that specific Microsoft release that means lots of viruses have got hold of it. So far I've had 85 spams and no false positives; that's an awful lot of spam I'd have otherwise had to delete manually. All very short messages coming from that specific MimeOLE source have been spam. -- Harriet Bazley == Loyaulte me lie == Help blackout London at sunset on Nov 4th: http://www.workface-limited.co.uk/html/powercut.html