[antispam-f] Re: Rule with And action

  • From: Harriet Bazley <lists@xxxxxxxxxxxxxxxxxxxxxxxxxxx>
  • To: antispam@xxxxxxxxxxxxx
  • Date: Thu, 02 Nov 2006 23:30:40 GMT

On 2 Nov 2006 as I do recall,
          Jeremy C B Nicoll wrote:

> In article <ecd97a7f4e.Dave@xxxxxxxxxxxxxxxxxxxxxxxxx>,
>    Dave Barnett <as10@xxxxxxxxxxxxxxxxx> wrote:
> 
> > The log shows:
> > "Message 2 deferred on rule 127:
> > Defer Date: = *-0800*
> > And X-MimeOLE: = Produced By Microsoft MimeOLE V6.00.2800.1106
> 
> I hope you're not going to delete stuff based just on an 8 hour time
> difference and use of a specific version of mailing software?
> 
I'm already deleting them based (by observation) on that same version
and by minimum size - I'm rather assuming they're all coming from a
single infected machine, unless it's a weakness in that specific
Microsoft release that means lots of viruses have got hold of it.
So far I've had 85 spams and no false positives; that's an awful lot of
spam I'd have otherwise had to delete manually.   All very short
messages coming from that specific MimeOLE source have been spam.

-- 
Harriet Bazley                     ==  Loyaulte me lie ==

Help blackout London at sunset on Nov 4th:
http://www.workface-limited.co.uk/html/powercut.html

Other related posts: