[Mimedefang] Filtering new Mirosoft virus email ...

[VonEssen, John]

I am curious about something... Most of these emails could be caught
based on the SpamAssassin tests. But SA doesn't run on these Swen emails
because they are ~160Kb. My SA only runs on messages smaller than 100Kb


Lets say I have a piece of email and it is SPAM (content/headers = 5Kb).
In this email I also attach a 120Kb .pif file.

Now MD drops the .pif attachment, but SA still doesn't filter it because
it still thinks the email is 125Kb - but its not - the 120Kb attachment
has been dropped. Technically the email is only 5Kb now. So SA only
needs to filter in reality a 5Kb email.

Why can't MD behave like this?

If an attachment has been dropped, then the size of that attachment
should no longer count towards the email size when SA gets to it.

-John

-----Original Message-----
From: Sevo Stille [mailto:sevo at radiox.de] 
Sent: Wednesday, September 24, 2003 8:16 AM
To: mimedefang at lists.roaringpenguin.com
Subject: Re: [Mimedefang] Filtering new Mirosoft virus email ...

Justin Hennessy wrote:

> eg I want to filter any emails that have a subject of this: 
>         
>        Fwd: Current Net Security Patch
> 
> Hope someone can help with this.

I posted a solution for that problem two or three days ago - please 
check the archive!

Sevo

-- 
Sevo Stille
sevo at radiox.de

_______________________________________________
MIMEDefang mailing list
MIMEDefang at lists.roaringpenguin.com
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang