Re: Fw: Antigen Notification: Antigen found a message matching a filter)

[SM <sm...@resistor.net>]

At 21:20 09-09-2008, Lars Ebeling wrote:
>I am sorry for being such a bad person. I am using Outlook Express 
>as mailclient and was not aware of the HTML code. Why is it such a 
>big problem? However after looking around in the mailclients setup I 
>have changed it.

Other mailing list subscribers may be using mail clients that only 
supports plain text messages.  HTML formatted messages are larger in 
size.  HTML formatted messages might not rendered correctly when 
quoting a part to provide context.  Some mailing lists are available 
in a digest version.  Using such a format makes it difficult to read.

HTML formatted messages are ideally suited for phishing as the actual 
URLs can be obfuscated.  The only advantage of a HTML formatted 
message is that it looks pretty to the sender.

Coming back to the original question, the following line was in the 
email you sent to the mailing list:

<BR>[24097] dbg: config: read file
/extra/Mail-SpamAssassin-3.2.4/t/log/test_rules_c<BR>opy/20_porn.cf&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;

A server security product called Microsoft Antigen flagged it as spam 
as it contains the "porn" and sent a bounce message to the author of 
that message.

Regards,
-sm 

Re: Fw: Antigen Notification: Antigen found a message matching a filter)

[mouss <mo...@netoyen.net>]

Lars Ebeling wrote:
> So my mail was considered as Spam only and only because of it contained 
> "opy/20_porn.cf" of this M$ Antigen.
> 


or maybe also because it contained PORN_URL_MISC in the headers.

but whether it considered it spam is less problematic than bouncing it 
to you. bounces should be sent to the envelope sender, which is the list 
address. if it bounces to the From header address, then it's borked.

but it's more broken than that. It shouldn't bounce in the first place 
(spam generally uses forged addresses, so bouncing to the "sender" is 
bad unless you can guarantee that he really sent it). and even if it 
bounces, it should bounce to the envelope sender, which is the list 
address, and not to the From header address.

If you post the headers of the bounce (under outllok, you need to find 
the "options" option), we could find more infos.

Re: Fw: Antigen Notification: Antigen found a message matching a filter)

[Lars Ebeling <la...@leopg9.no-ip.org>]

So my mail was considered as Spam only and only because of it contained 
"opy/20_porn.cf" of this M$ Antigen.

Lars