> Any pointers on this: "real solution is to find what's causing > the rule to fire and fix the Outlook setup so it doesn't trigger > it"?. Thanks.
How about posting the message headers. The last three rules that fired (MSID_DOLLARS, RATWARE_MS_HASH, and RATWARE_OUTLOOK_NONAME) all indicate a problem with the message ID format in combination with another header. If you have something in your path removing headers from messages, that'll cause this. SA relies on the headers being preserved to get an accurate assessment of what's going on. Cleaning them out before calling SA is just asking for trouble. Bret
