[SAtalk] BASE64_ENC_TEXT skipping rules???

[Chris Santerre]

OK, I've had some problems tagging this repetitive spam. I'm using SA 2.43 (quiet you!) :)   I'm getting excellent results! But this one has got me goofy. It simply skips some of my rules!! I'm not sure why. In the header you can see it hits MY_DSL which is a header rule. But I have a specific rawbody rule for "Stop Mailings here" and a rawbody rule for a Q without a U. This spam somehow skips about 7 more rules that should hit!   I remember a thread about this last week, but didn't pay enough attention to it :(   Why would body rules be skipped?   Chris       Received: from utoronto.ca (adsl-156-95-249.asm.bellsouth.net [66.156.95.249])  by myserver.com (8.12.5/8.12.5) with SMTP id h5MMtGFe031838  for <[EMAIL PROTECTED]>; Sun, 22 Jun 2003 18:55:18 -0400 Message-ID: <[EMAIL PROTECTED]> From: "Dwayne Bright" <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: *****SPAM***** What is your name? Date: Sun, 22 Jun 2003 15:36:17 +0000 MIME-Version: 1.0 Content-Type: multipart/alternative;  boundary="----=_NextPart_000_0F7E_39A32FCC.4A01866D" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-Spam-Status: Yes, hits=5.6 required=5.0  tests=BASE64_ENC_TEXT,MIME_HTML_NO_CHARSET,MY_DSL,        SPAM_PHRASE_01_02  version=2.43 X-Spam-Flag: YES X-Spam-Level: ***** X-Spam-Checker-Version: SpamAssassin 2.43 (1.115.2.20-2002-10-15-exp) X-Spam-Report:   5.60 hits, 5 required;   *  3.0 -- Contains likely dsl address in header   *  0.5 -- BODY: Spam phrases score is 01 to 02 (low)             [score: 1]   *  1.4 -- RAW: Message text disguised using base-64 encoding   *  0.7 -- RAW: Message text in HTML without specified charset   This is a multi-part message in MIME format.   ------=_NextPart_000_0F7E_39A32FCC.4A01866D Content-Type: text/plain Content-Transfer-Encoding: 8bit   ------=_NextPart_000_0F7E_39A32FCC.4A01866D Content-Type: text/html Content-Transfer-Encoding: base64   ------=_NextPart_000_0F7E_39A32FCC.4A01866D-- 6qo45a13mqekf1ghf71f1h2vb Stop Mailings Here wjjfxz2a3w ji0yzn7k83gz