Yeah, just checked on a few of these MIME items and the actual type isn't defined. For example, an Excel attachment just says application-octet-stream
-0- Content-Type: multipart/mixed;boundary="==IMail_v8.1==" Return-Path: [EMAIL PROTECTED] X-OriginalArrivalTime: 27 Oct 2004 18:29:21.0419 (UTC) FILETIME=[E09185B0:01C4BC52] --==IMail_v8.1== Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii --==IMail_v8.1== Content-Type: application/octet-stream; name="2004 Technology.xls" Content-Transfer-Encoding: base64 ================== > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Rick Davidson > Sent: Wednesday, October 27, 2004 1:33 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Best Practices for handing > legit email flagged as spam? > > That is correct, declude virus processes before junkmail > > I did look at quite a few zip viruses and didnt see any of > them using the > Content-Type: application/x-zip-compressed in the mime info > > Rick Davidson > National Systems Manager > North American Title Group > > - > ----- Original Message ----- > From: "Mark E. Smith" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Wednesday, October 27, 2004 1:03 PM > Subject: RE: [Declude.JunkMail] Best Practices for handing > legit email flagged as spam? > > > > Rick, > > I was looking at your filter -- great idea. > > One question (which falls under the processing order) > > > > If you have: > > BODY STOPALLTESTS CONTAINS Content-Type: > application/x-zip-compressed > > > > I think Declude Virus will still grab this correct? > > > > Mark > > > > > >> -----Original Message----- > >> From: [EMAIL PROTECTED] > >> [mailto:[EMAIL PROTECTED] On Behalf Of Rick > >> Davidson > >> Sent: Tuesday, October 26, 2004 10:49 AM > >> To: [EMAIL PROTECTED] > >> Subject: Re: [Declude.JunkMail] Best Practices for handing legit > >> email flagged as spam? > >> > >> >1 in 500,000? That's fantastic. I think that qualifies for the > >> >anti-spam guru of the week award! > >> > >> heh, that is no exageration either, it is mainly due to > spending alot > >> of time in looking at false positives and finding ways to prevent > >> them. For example use filtering to look for legit mail, > the attached > >> filter file runs before all other filters, it contains > things that I > >> found in false positives. This file is my number one false > positive > >> eliminator, my second method is test the hell out of any > significant > >> changes first. I do have the luxury of having to only > filter for one > >> company and I can be fairly restrictive.... > >> > >> I will see if I can get my configs somewhere for download, I am > >> willing to share my work because I hate spam and spammers > so much... > >> man do i hate them. > >> > >> Rick Davidson > >> National Systems Manager > >> North American Title Group > >> - > >> > > > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > > "unsubscribe Declude.JunkMail". The archives can be found at > > http://www.mail-archive.com. > > > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be > found at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
