[Spambayes] email evades Spambayes

[Michael Kimball]

Tony Meyer wrote:
> [Apologies for the delay - last couple of days have been extra busy with
> 'real' work]

:)

> 
> 
>>Here are three emails, one that wasn't processed by SpamBayes and the 
>>one received before and the one received after. 
> 
> 
> I figured out a way that a message could get past SpamBayes without being
> touched - if it didn't have the blank line that *must* be in all messages
> between the headers & body (even if there are no headers or no body, the
> blank line is still required).  In that case, SpamBayes would pass it
> through, thinking it was an error response.  I've fixed this in CVS now, but
> I suspect maybe it's to blame here.
> 
> (This is assuming that all the ones that slip through are this type that
> have no separator).

It seems all the ones that slip through have no content or subject line, 
but it seems the various ways to view the message ("View Source", "View 
| Headers | All") 'process the info a bit, so I don't know if there is a 
blank line or not.

> 
> Does your setup go server-AVG-spambayes-client, or
> server-spambayes-AVG-client?  If it's the latter, this would explain it, and
> explain why the "Review" page doesn't have AVG headers.  If the former, then
> because AVG adds the 'checked' message to incoming mail, I would have
> thought it would then be ok.  I'm not positive, though.

It is the former.  But wouldn't your discovery still apply here?  AVG 
reviews it, appends it's footer, and passes it on.  SpamBayes doesn't 
see the blank line, assumes its an error and doesn't process it, so 
there is no record of it in the 'Review' page, and no SpamBayes headers?

Oh. Ummm.  AVG appends the footer but doesn't add the 'X-Antivirus: AVG 
for E-mail 7.0.289 [265.4.3]' header.  Maybe AVG also figures it is an 
error, but doesn't do this test until after it has added the footer?  I 
finally found my AVG logfile and tried ( :) )to review it,but it is 
Sindarin to me.  I'll be going on the AVG forum later to see if there is 
anyone there who can point me to a manual describing the various 
entries.  I did see there were some CAPA entries.

> 
> 
>>Is there 
>>someway to paste the actual emails into a post like this?
> 
> 
> I'm not familiar enough with the mailer to know, sorry - but that is good
> enough.
> 
> How often do you get messages like this?  If it's quite often, then I can
> send you a patched sb_server and see if this does stop it.

It is starting to get quite regular now, probably at least one a day. 
And my wife also gets some (same setup).  I'd like to hold off on the 
patch for a couple of days to see if I can get some info on the AVG log. 
  There are a couple of lines in it that look as if I may have some 
faulty settings (but of course they aren't clearly saying that, or 
identifyingg the settings :)  )

> 
> =Tony.Meyer

I looked at the most recent in 'View Source'(pasted below) and when I 
pressed the 'down-arrow' from the Content-Type line it jumped to the 
line with the two dashes (starting the AVG footer).  Maybe there is no 
blank line, even though it looks as if there are three of them.



 From - Thu Dec 02 23:50:15 2004
X-Account-Key: account1
X-UIDL: UID928-1100919104
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <JZWYDVIX at go.com>
Delivered-To: 337-michael at kimballpottery.com
Received: (qmail 17899 invoked from network); 3 Dec 2004 01:12:20 -0000
Received: from user-0c93cfd.cable.mindspring.com (24.145.177.237)
   by admin.webinmotion.ca with SMTP; 3 Dec 2004 01:12:20 -0000
X-Message-Info: G[2
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii



-- 
No virus found in this incoming message.
Checked by AVG Anti-Virus.
Version: 7.0.289 / Virus Database: 265.4.4 - Release Date: 11/30/2004



-- 
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.289 / Virus Database: 265.4.4 - Release Date: 11/30/2004