ratware.cf False Positive

[Tim Donahue <td...@haynes-group.com>]

After talking to several people that have gotten false postitives when
trying to send us email, it seems that there may be a problem with
RATWR7a_MESSID.  I think that this rule may be triggering on mail sent
by Outlook Express, though I could not tell you what version or what set
of patches have been applied to these computers. 

Has anyone noticed the same thing or is this just my imagination?

Tim Donahue

Re: ratware.cf False Positive

[camis <ca...@mweb.co.za>]

> After talking to several people that have gotten false postitives when
> trying to send us email, it seems that there may be a problem with
> RATWR7a_MESSID.  I think that this rule may be triggering on mail sent
> by Outlook Express, though I could not tell you what version or what set
> of patches have been applied to these computers. 
> 
> Has anyone noticed the same thing or is this just my imagination?

Confirmed, this does trigger RATWR7a_MESSID when using Outlook express.

Cami

Re: ratware.cf False Positive

[Ralph Seichter <ma...@seichter.de>]

Robert Menschel wrote:

 > My corpus check this last weekend shows #counts RATWR7a_MESSID
 > 11589s/2008h of 115925 corpus (94616s/21309h) 05/01/04 and suggests a
 > score of 0.278. The 4/30/04 version I use has an even more
 > conservative internal score of 0.252. What version are you using?

The header reads as follows:

   # SARE file
   # (05/07/04)
   # For notes, updates, licensing, and info see:
   # www.rulesemporeum.com

BTW, shouldn't that be "www.rulesemporium.com" (note the spelling)? As
for Thunderbird, I'm using V0.6 now, but I noticed the ratware ID
matches with TB 0.5. I don't think the ID is generated differently in
these two Thunderbird versions, though.

If I might add a suggestion: the release date information can be a tad
confusing for non-Americans. How about using 2004-05-07 instead (as
defined in ISO 8601)? Thanks.

 > I don't think it's fair to claim that any single rule with a score
 > under 0.3 "has a problem", since you'd need more than 16 such rules
 > to score a false positive.

I never claimed it was a problem, my mail was not filtered anyway. ;-)
I just wanted to let you know that there was some ID rule which got
triggered by Mozilla Thunderbird. As TB uses a very simple ID pattern,
this doesn't surprise me too much, and I'll keep on using ratware.cf.

-- 
Mit freundlichen Grüßen / Yours sincerely
Dipl. Inform. Ralph Seichter

HORUS-IT
Ahornweg 10
D-57635 Oberirsen
Tel +49 2686 987880
Fax +49 2686 987889
http://horus-it.de/

Re[2]: ratware.cf False Positive

[Robert Menschel <Ro...@Menschel.net>]

Hello Ralph, Tim,

Friday, May 7, 2004, 12:58:59 PM, you wrote:

RS> Tim Donahue wrote:

 >> After talking to several people that have gotten false postitives when
 >> trying to send us email, it seems that there may be a problem with
 >> RATWR7a_MESSID.

RS> Hmm... I do remember that lately some of the mail I sent using Mozilla
RS> Thunderbird got tagged as containing a ratware message ID, but I don't
RS> remember the name of tha rule that was triggered.

Certainly possible.  My corpus check this last weekend shows
#counts RATWR7a_MESSID  11589s/2008h of 115925 corpus (94616s/21309h) 05/01/04
and suggests a score of 0.278.
The 4/30/04 version I use has an even more conservative internal score of
0.252. 
What version are you using?

IOW yes, it hits lots of ham, but by itself shouldn't contribute all that
much to flagging a spam as false positive (though it will add to an
emails problem if it's a spammy ham).

I don't think it's fair to claim that any single rule with a score under
0.3 "has a problem", since you'd need more than 16 such rules to score a
false positive. Rather, the combination rule set has a problem, and we'd
need to know more about all the other rules that hit to be able to
identify where the best resolutions might lie.

Bob Menschel

Re: ratware.cf False Positive

[Ralph Seichter <ma...@seichter.de>]

Tim Donahue wrote:

 > After talking to several people that have gotten false postitives when
 > trying to send us email, it seems that there may be a problem with
 > RATWR7a_MESSID.

Hmm... I do remember that lately some of the mail I sent using Mozilla
Thunderbird got tagged as containing a ratware message ID, but I don't
remember the name of tha rule that was triggered.

-- 
Mit freundlichen Grüßen / Yours sincerely
Dipl. Inform. Ralph Seichter

HORUS-IT
Ahornweg 10
D-57635 Oberirsen
Tel +49 2686 987880
Fax +49 2686 987889
http://horus-it.de/