[Spambayes] email evades Spambayes

Thu Dec 2 15:40:50 CET 2004

Here are three emails, one that wasn't processed by SpamBayes and the 
one received before and the one received after.  Just in case the sneaky 
one is being processed by Spambayes as part of the content of the 
earlier one (passed to SpamBayes by AVG before SB has finished the 
earlier one).  The time I say it is received is what shows in the 'Date' 
column of my email client: Thunderbird, and that would have to be the 
time received by mail.kimballpottery.com, since I didn't 'Get' this 
batch until after 8:00 AM today.  I notice none of the date and 
timestamps in the headers correspond exactly.  So I may actually be 
looking at the wrong ones.  I really don't know in which order they are 
processed by AVG, or by SpamBayes.

I have cut and pasted the 'View Source' of these, and I notice it is NOT 
identical to the 'Show all headers' view of the email itself.  Is there 
someway to paste the actual emails into a post like this?  'Forward' 
doesn't do it, since I can only forward one email at a time.

The AVG footer for incoming mail shows in all three, but the sneaky one 
doesn't have an "X-Antivirus: AVG for E-mail 7.0.289 [265.4.4]" header. 
  Could AVG be passing it off before it has written it's own header? Or 
is there some way to 'lock' the headers so AVG can't write a new header? 
  ???And I see in the SpamBayes 'Review Messages' that not all the 
headers are reproduced there either???  The 'X-Antivirus: AVG for 
E-mail...' doesn't show up there.  What's that about?

I don't see anything in the spambayes logs other than lots and lots of 
'placing', 'Flushing', 'adding' and 'storing'

This is the 'sneaky one.  It shows as received at 5:20

 From - Thu Dec 02 08:23:45 2004
X-Account-Key: account1
X-UIDL: UID871-1100919104
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bknvbktjebkg at awemail.com>
Delivered-To: 337-michael at kimballpottery.com
Received: (qmail 26580 invoked from network); 2 Dec 2004 10:25:03 -0000
Received: from unknown (HELO 206.47.128.155) (218.149.114.139)
   by admin.webinmotion.ca with SMTP; 2 Dec 2004 10:25:02 -0000
X-Message-Info: DHWKX+frq92+vcn+B+97/210673500056414
Received: (qmail 72107 invoked by uid 3); Thu, 02 Dec 2004 05:21:32 -0500
Date: Thu, 02 Dec 2004 09:20:32 -0100
Received: from courtesan.bknvbktjebkg at awemail.com ([144.60.0.218]) by 
yihm54-vi43.bknvbktjebkg at awemail.com with Microsoft SMTPSVC(5.0.0[4
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii

-- 
No virus found in this incoming message.
Checked by AVG Anti-Virus.
Version: 7.0.289 / Virus Database: 265.4.4 - Release Date: 11/30/2004

The next one, received at 5:51

 From - Thu Dec 02 08:23:39 2004
X-Account-Key: account1
X-UIDL: UID862-1100919104
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <adarv at silver-wolf.com>
Delivered-To: 337-michael at kimballpottery.com
Received: (qmail 15545 invoked from network); 2 Dec 2004 07:00:46 -0000
Received: from adsl-69-106-199-107.dsl.irvnca.pacbell.net (HELO 
silver-wolf.com) (69.106.199.107)
   by admin.webinmotion.ca with SMTP; 2 Dec 2004 07:00:46 -0000
Message-ID: <dac701c4d84c$20977f10$3b5268e6 at adarv>
Reply-To: "forex invest" <adarv at silver-wolf.com>
From: "forex invest" <adarv at silver-wolf.com>
To: "user" <michael at kimballpottery.com>
Subject: New Overseas Business Opportunity
Date: Thu, 02 Dec 2004 08:51:34 -0200
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4922.1500
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4922.1500
X-Spambayes-Classification: unsure
X-Spambayes-Spam-Probability: 0.88
X-Spambayes-Evidence: '*H*': 0.04; '*S*': 0.80; 'report:': 0.09; 
'banks,': 0.16;
	'movements': 0.16; 'web': 0.25; 'address:': 0.26; 'used': 0.27; 'how': 
0.30;
	'bottom': 0.32; 'free': 0.37; 'from': 0.38; 'find': 0.40; 'out': 0.62;
	'world': 0.65; 'profits': 0.65; 'secrets': 0.71; 'our': 0.71;
	'url:index': 0.74; 'to:addr:kimballpottery.com': 0.78;
	'to:addr:michael': 0.79; 'world.': 0.79; 'investment': 0.80;
	'profit': 0.84; 'euro': 0.84; 'from:addr:silver-wolf.com': 0.84;
	'url:prime': 0.84; 'header:Received:2': 0.86; 'subject:Business': 0.93;
	'economic': 0.97
X-Spambayes-MailId: 1101993819
X-Antivirus: AVG for E-mail 7.0.289 [265.4.4]
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=us-ascii

(I stripped out the content.  MK)

-- 
No virus found in this incoming message.
Checked by AVG Anti-Virus.
Version: 7.0.289 / Virus Database: 265.4.4 - Release Date: 11/30/2004

And the one received before the sneaky one, received at 5:02

 From - Thu Dec 02 08:23:44 2004
X-Account-Key: account1
X-UIDL: UID870-1100919104
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <www-amaya-request at w3.org>
Delivered-To: 337-michael at kimballpottery.com
Received: (qmail 22290 invoked from network); 2 Dec 2004 10:03:26 -0000
Received: from frink.w3.org (128.30.52.16)
   by mail.webinmotion.ca with RC4-SHA encrypted SMTP; 2 Dec 2004 
10:03:26 -0000
Received: from lists by frink.w3.org with local (Exim 4.34)
	id 1CZnnk-0006eN-Pe
	for www-amaya-dist at listhub.w3.org; Thu, 02 Dec 2004 10:03:04 +0000
Received: from bart.w3.org ([128.30.52.40])
	by frink.w3.org with esmtp (Exim 4.34)
	id 1CZnnk-0006dj-Ck
	for www-amaya at listhub.w3.org; Thu, 02 Dec 2004 10:03:04 +0000
Received: from uucp.udac.net ([193.44.79.50])
	by bart.w3.org with esmtp (Exim 4.34)
	id 1CZnnk-0005X4-15
	for www-amaya at w3.org; Thu, 02 Dec 2004 10:03:04 +0000
Received: (from uucp at localhost)
	by uucp.udac.net (8.11.6/8.11.6) with UUCP id iB2A31O00667
	for www-amaya at w3.org; Thu, 2 Dec 2004 11:03:01 +0100
Received: from dumburk.home.udac.net (dumburk.udac.se [193.44.77.203])
	by popcorn.udac.se (8.9.3/8.9.2) with ESMTP id LAA03016
	for <www-amaya at w3.org>; Thu, 2 Dec 2004 11:00:27 +0100
Message-Id: <6.1.2.0.0.20041202110050.02f6e0f0 at popcorn.udac.se>
X-Sender: ricke at popmail.udac.net
X-Mailer: QUALCOMM Windows Eudora Version 6.1.2.0
Date: Thu, 02 Dec 2004 11:02:39 +0100
To: www-amaya at w3.org
From: Lars Bruzelius <Lars.Bruzelius at home.udac.net>
Received-SPF: none (bart.w3.org: domain of Lars.Bruzelius at home.udac.net 
does not designate permitted sender hosts)
X-Original-To: www-amaya at w3.org
Subject: Leading minus sign in table cell
X-Archived-At: 
http://www.w3.org/mid/6.1.2.0.0.20041202110050.02f6e0f0@popcorn.udac.se
Resent-From: www-amaya at w3.org
X-Mailing-List: <www-amaya at w3.org> archive/latest/7562
X-Loop: www-amaya at w3.org
Sender: www-amaya-request at w3.org
Resent-Sender: www-amaya-request at w3.org
Precedence: list
List-Id: <www-amaya.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:www-amaya-request at w3.org?subject=unsubscribe>
Resent-Message-Id: <E1CZnnk-0006eN-Pe at frink.w3.org>
Resent-Date: Thu, 02 Dec 2004 10:03:04 +0000
X-Spambayes-Classification: ham
X-Spambayes-Spam-Probability: 0.00
X-Spambayes-Evidence: '*H*': 1.00; '*S*': 0.00; 'amaya': 0.05;
	'subject:table': 0.05; 'telephone:': 0.09; 'sender:addr:w3.org': 0.12;
	'sender:addr:www-amaya-request': 0.12; 'to:addr:w3.org': 0.12;
	'to:addr:www-amaya': 0.12; '+46': 0.16; '174,': 0.16; '516600': 0.16;
	'678054': 0.16; 'bruzelius': 0.16; 'cell.': 0.16;
	'email addr:udac.se': 0.16; 'email name:lars.bruzelius': 0.16;
	'from:addr:lars.bruzelius': 0.16; 'from:name:lars bruzelius': 0.16;
	'lars': 0.16; 'message-id:@popcorn.udac.se': 0.16; 'se-751': 0.16;
	'sweden.': 0.16; 'systeam': 0.16; 'telefax:': 0.16; 'udac': 0.16;
	'uppsala,': 0.16; 'url:udac': 0.16; 'table': 0.16; 'code': 0.20;
	'seem': 0.20; 'possible': 0.25; 'header:Received:7': 0.26;
	'charset:iso-8859-1': 0.30; 'selected': 0.30; 'does': 0.34; 'from': 0.38;
	'box': 0.39; 'alphabet': 0.84; 'leading': 0.98
X-Spambayes-MailId: 1101993824-2
X-Antivirus: AVG for E-mail 7.0.289 [265.4.4]
Mime-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=iso-8859-1; format=flowed

(I stripped out the content.  MK)

-- 
No virus found in this incoming message.
Checked by AVG Anti-Virus.
Version: 7.0.289 / Virus Database: 265.4.4 - Release Date: 11/30/2004

-- 
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.289 / Virus Database: 265.4.4 - Release Date: 11/30/2004