HELP bv lottery spam

[John Fleming <jo...@wa9als.com>]

Would someone shed some light on why this message wasn't scanned/tagged and 
some info about the headers?

1.  I don't remember ever seeing the "wait" headers that appear at the top 
of this message - what are they?  I did notice a delay in receiving this 
message as if receiving a large file.  However, it appears to be a 
plain-text msg with an attached txt file with a bunch of email addys.

2.  The worst part of this is that the usual headers indicating a scan by MY 
SpamAssassin ARE NOT THERE AT ALL!  My server is Luke.wa9als.com, and at the 
end you see my normal headers from clamav.  However, just above that, the 
clamav-milter and X-Spam lines were added by my ISP (starband).

My other emails this morning DO HAVE the usual headers from MY SA, thus 
indicating that SA is in fact running as usual.  Why would this one spammy 
email escape scanning?  Thanks!  - John

X-EMS: wait 10s
X-EMS: wait 20s
X-EMS: wait 30s
X-EMS: wait 40s
X-EMS: wait 50s
X-EMS: wait 60s
X-EMS: wait 70s
X-EMS: wait 80s
X-EMS: wait 90s
X-EMS: wait 100s
Return-Path: <lo...@netcsape.com>
X-Original-To: john@wa9als.com
Delivered-To: john@wa9als.com
Received: from localhost (localhost.localdomain [127.0.0.1])
 by wa9als.com (Postfix) with ESMTP id 4734733E679
 for <jo...@wa9als.com>; Wed, 13 Jul 2005 05:11:29 -0500 (EST)
Received: from pop.starband.net [148.78.247.66]
 by localhost with POP3 (fetchmail-6.2.5)
 for john@wa9als.com (single-drop); Wed, 13 Jul 2005 05:11:29 -0500 (EST)
Received: from hercules.email.starband.net ([unix socket])
 by hercules (Cyrus v2.2.1-BETA) with LMTP; Wed, 13 Jul 2005 10:04:12 +0000
X-Sieve: CMU Sieve 2.2
Received: from cassiopeia.email.starband.net ([10.78.249.22])
 by hercules.email.starband.net (8.12.11/8.12.11) with ESMTP id 
j6DA4Cr2030399
 for <wa...@starband.net>; Wed, 13 Jul 2005 06:04:12 -0400
Received: from netcsape975.com (bib69.tbm.tudelft.nl [130.161.217.82])
 by cassiopeia.email.starband.net (8.12.11/8.12.11) with SMTP id 
j6DA3h8l032495
 for <wa...@starband.net>; Wed, 13 Jul 2005 06:03:44 -0400
Message-Id: <20...@cassiopeia.email.starband.net>
From: Lotto bv <lo...@netcsape.com>
To: wa9als@starband.net
Reply-To: lotto_bv@hotmail.com
Subject: AWARD NOTIFICATION;FINAL NOTICE
Date: Wed, 13 Jul 2005 12:05:01 +0200
MIME-Version: 1.0
Content-Type: multipart/mixed; 
boundary="fbdfff19-c01f-44ef-821e-ba9f11455aa0"
X-Virus-Scanned: ClamAV 0.80/967/Mon Jul  4 17:36:05 2005
 clamav-milter version 0.80j
 on cassiopeia
X-Spam-Status: No, hits=3.4 tagged_above=0 required=5
X-Spam-Level: ***
X-Spam-Report: 
FORGED_RCVD_HELO,MIME_BOUND_MANY_HEX,SARE_SUB_WINNING_NOT,SUBJ_ALL_CAPS
X-Spam-Flag: NO
X-Virus-Status: No
X-Virus-Checker-Version: Luke wa9als.com running clamassassin 1.2.1 with 
ClamAV 0.86.1/977/Tue Jul 12 17:53:40 2005 signatures 33.977
Status:
X-Antivirus: AVG for E-mail 7.0.336 [267.8.13]

Re: HELP bv lottery spam

[John Fleming <jo...@wa9als.com>]

----- Original Message ----- 
From: "Loren Wilton" <lw...@earthlink.net>
To: <us...@spamassassin.apache.org>
Sent: Wednesday, July 13, 2005 6:32 AM
Subject: Re: HELP bv lottery spam


> Norton AV makes wait headers similar (but not identical) to what you see
> when it is scanning outbound mail for a virus, as I recall.  I suspect 
> this
> is something similar, but I don't recognize the header.
>
> Do you have user rules enabled?  If so, check your syslog for an insecure
> dependency warning from SA when this message was processed.  Somehow if 
> you
> get one of those it is guaranteed that SA won't scan the message, at least
> using procmail.

No user rules, just site-wide.  I am using procmail.  I only have the single 
example at this time, so I'm not going to worry about it much yet.  Thanks 
for the thoughts.  John

Re: HELP bv lottery spam

[Loren Wilton <lw...@earthlink.net>]

Norton AV makes wait headers similar (but not identical) to what you see
when it is scanning outbound mail for a virus, as I recall.  I suspect this
is something similar, but I don't recognize the header.

Do you have user rules enabled?  If so, check your syslog for an insecure
dependency warning from SA when this message was processed.  Somehow if you
get one of those it is guaranteed that SA won't scan the message, at least
using procmail.

        Loren