FW: You have successfully updated your password

["Ronald I. Nutter" <ro...@georgetowncollege.edu>]

 I am trying to figure out what happened here.  This one got through and
shouldnt have.  I saved the message out of Outlook as a text
file and ran spamassassin in test mode.  It scored enough to have been
blocked and wasnt.  It scored a 5.0 and I am running sa 2.64 at default 
scoring level so 5.0 should have gotten the message blocked.
 
Suggestions ?
 
Ron

--------------------------------------------------------------------
Ron Nutter                          ron_nutter@georgetowncollege.edu
Network Infrastructure & Security Manager
Information Technology Services                        (502)863-7002
Georgetown College                                    
Georgetown, KY                                            40324-1696
--------------------------------------------------------------------


  _____  

From: register@georgetowncollege.edu
[mailto:register@georgetowncollege.edu] 
Sent: Tuesday, September 20, 2005 2:31 AM
To:  Network User
Subject: You have successfully updated your password



Dear user  Network User, 

You have successfully updated the password of your Georgetowncollege
account.

If you did not authorize this change or if you need assistance with your
account, please contact Georgetowncollege customer service at:
register@georgetowncollege.edu

Thank you for using Georgetowncollege! 
The Georgetowncollege Support Team 






+++ Attachment: No Virus (Clean) 
+++ Georgetowncollege Antivirus - www.georgetowncollege.edu 

Re: FW: You have successfully updated your password

[Matt Kettler <mk...@EVI-INC.COM>]

Ronald I. Nutter wrote:
>  I am trying to figure out what happened here.  This one got through and
> shouldnt have.  I saved the message out of Outlook as a text
> file and ran spamassassin in test mode.  It scored enough to have been
> blocked and wasnt.  It scored a 5.0 and I am running sa 2.64 at default
> scoring level so 5.0 should have gotten the message blocked.
>  
> Suggestions ?

In general it's not valid to run the same message through SA at two different
points in time and expect the same results if you use either bayes or any
network tests (RBLs, razor, DCC, etc).


It's VERY likely for RBL contents to change in a matter of 15 minutes, so this
is the usual cause of "why did it get through the first time, when now it scores
high enough". Check the list of hits it got the first time around, and if any
RBLs got hit the second time that missed the first time, there's your answer.


Other possible causes:

Running the command-line SA as a different user than mail gets scanned as will
result in a different bayes database being used.

Perhaps changes introduced by outlook after it got scanned increased the score.


Regardless, the message itself looks like a virus-generated message, something
SA generally doesn't try to catch.