Jacob Hoppe wrote:
> Hello,
>
> I am running sa for Outlook which states in the email that the sa is
> v2.3. Is the output at the top of this email message correct? I
> thought its supposed to test for other items...Please let me know what
> you think...It seems the points that are accumulated are all good items??
It looks like your version of SA is screwed up completely. It seems to be a
mixture of code and rules from different versions of SA. You're using recent SA
rules from 3.1.0 with 4-year old code from 2.31. Very bad news.
I would suggest nuking the whole SA install and starting over. I don't know how
you got such a weird mixture, but you want to make sure it's purged from your
system.
Looking at the headers, you can tell the code being used is 2.31, which is
absolutely ancient. This version of the SA code was was released in June 2002.
There have been 23 new versions of the SA code since then!
__NONEMPTY_BODY is a sub-rule that was not introduced until SA 3.1.0, and uses
the double-underscore naming convention that is not at all supported by versions
of SA older than 2.40.
The lack of support for __ named rules for meta checks is the big crux of your
problem. These rules should not show up in the hit list at all, and should have
no score associated. However, SA 2.31 doesn't understand this, so gives them all
a default score of 1.0.
>
>>From [EMAIL PROTECTED] Tue May 2 10:14:36 2006
> X-Mailer: QUALCOMM Windows Eudora Version 6.2.1.2
> Date: Tue, 02 May 2006 10:14:30 -0500
> To: [EMAIL PROTECTED]
> From: Spam Assassin <[EMAIL PROTECTED]>
> Subject: *****SPAM***** Emailing: Building Operating Management April
> Newsletter.htm
> X-Spam-Status: Yes, hits=12.0 required=5.0
> tests=__MSGID_OK_DIGITS,__MIME_VERSION,__HAS_X_MAILER,__HAS_RCVD,
> __HAS_SUBJECT,__CTYPE_HAS_BOUNDARY,__MSGID_OK_HEX,__CT,
> __EUDORA_MUA,__ANY_QUALCOMM_MUA,__MSGID_OK_HOST,
> __NONEMPTY_BODY
> version=2.31
> X-Spam-Flag: YES
> X-Spam-Level: ************
> X-Spam-Checker-Version: SpamAssassin 2.31 (devel $Id: SpamAssassin.pm,v
> 1.94.2.2 2002/06/20 17:20:29 hughescr Exp $)
> X-Spam-Prev-Content-Type: multipart/mixed;
> boundary="=====================_544067031==_"
>
>
> SPAM: Spam detection software, running on the system "_HOSTNAME_", has
> SPAM: identified this incoming email as possible spam. The original
> message
> SPAM: has been attached to this so you can view it (if it isn't spam) or
> label
> SPAM: similar future email. If you have any questions, see
> SPAM: _CONTACTADDRESS_ for details.
> SPAM:
> SPAM: Content preview: _PREVIEW_
> SPAM:
> SPAM: Content analysis details: (_SCORE_ points, 5 required)
> SPAM:
> SPAM: " pts rule name description"
> SPAM: ---- ----------------------
> --------------------------------------------------
> SPAM: __MSGID_OK_DIGITS (1.0 points) Message-ID =~ /\d{10}/
> SPAM: __MIME_VERSION (1.0 points) Found a MIME-Version header
> SPAM: __HAS_X_MAILER (1.0 points) Found a X-Mailer header
> SPAM: __HAS_RCVD (1.0 points) Found a Received header
> SPAM: __HAS_SUBJECT (1.0 points) Found a Subject header
> SPAM: __CTYPE_HAS_BOUNDARY (1.0 points) Content-Type =~ /boundary/i
> SPAM: __MSGID_OK_HEX (1.0 points) Message-ID =~ /\b[a-f\d]{8}\b/
> SPAM: __CT (1.0 points) Found a Content-Type header
> SPAM: __EUDORA_MUA (1.0 points) X-Mailer =~ /^QUALCOMM Windows
> Eudora (?:Pro |Light )?Version [3456]\./
> SPAM: __ANY_QUALCOMM_MUA (1.0 points) X-Mailer =~ /\bQUALCOMM\b/
> SPAM: __MSGID_OK_HOST (1.0 points) Message-ID =~
> /\@(?:\D{2,}|(?:\d{1,3}\.){3}\d{1,3})>/
> SPAM: __NONEMPTY_BODY (1.0 points) BODY: /\S/
> SPAM:
>
>
> --=====================_544067031==_
> Content-Type: text/plain; charset="us-ascii"; format=flowed
>
>
>
> --=====================_544067031==_
> Content-Type: text/html; charset="us-ascii"
>
>
> Jacob Hoppe
> Information Technology Department
> Trade Press Publishing Corporation
> Phone: 414.228.7701 x436
>
>
