Re: encoded spam that got thru

2006-03-13 Thread Loren Wilton
FM_NO_FROM_OR_TO=,FM_NO_TO=,MISSING_SUBJECT=,NO_RECEIVED=,TO_CC_NONE= Something seems a little odd here. On my system those rules would add up to quite a few points, and they don't seem to add up to anything for you. Loren

Re: encoded spam that got thru

2006-03-13 Thread Eric W. Bates
Jeremy Fairbrass wrote: > Hi Eric, > The text there is encoded with base64, which is decoded into the "proper" > text by the mail client. SpamAssassin will also decode it before running its > rules against it, for "body" or "rawbody" rules, which means SpamAssassin > will be able to filter it ou

Re: encoded spam that got thru

2006-03-13 Thread Steve Thomas
> Without being able to decode that block of stuff myself and thus see what > it says It's a stock spam for some oil company. Decoding anything base64 encoded is pretty easy if you have perl installed somewhere: cut #!/usr/bin/perl use MIME::Base64; print decode_base64(""); cut

Re: encoded spam that got thru

2006-03-13 Thread Jeremy Fairbrass
Hi Eric, The text there is encoded with base64, which is decoded into the "proper" text by the mail client. SpamAssassin will also decode it before running its rules against it, for "body" or "rawbody" rules, which means SpamAssassin will be able to filter it out whether the text was encoded wit

encoded spam that got thru

2006-03-13 Thread Eric W. Bates
I don't even understand how the following message works (let alone how to block it). It simply has a chunk of what looks like encoded binary; and yet, thunderbird renders it as a stock announcement (as I write this, I wonder whether the good readers of this list are likely to the ascii block, or t