anomy-list

two logs samples... in case of bug?

From: 130800@xyz.molar.is
Date: Wed 30 Jun 2004 - 03:05:16 GMT


Hi :

One of my users got a MS Word attachment chopped off today.

The same attachment came through fine when sent by another person.

Following is my (newbie) analysis of the situation:

The header of the bad message, is much shorter than the header of the good
one, and from my point of view, the key difference is in this little part:

BAD MESSAGE:
...
Content-class: urn:content-classes:message
Content-Type: multipart/mixed;
boundary="----_=_NextPart_001_01C45E12.5C2B2D72"
...
(this one has only one "NextPart" block)

GOOD MESSAGE:
...
MIME-Version: 1.0
Content-Type: multipart/mixed;
 boundary="----=_NextPart_000_0024_01C45EA8.C395AF20"

...then... after the spamassassin log, other 3 "NEXTPART" blocks..

Maybe the anomy engine does not like the "Content-class:
urn:content-classes:message" part?

Anyway, thanks in advance for your help if you think this is fixable.
No hurries though, since the user has got the file, but maybe helps for the
Anomy users, to fix this 'bug'?

Best regards,
Carlos

=============================================

This is a longer portion of the log of the GOOD MESSAGE:

================================
Subject: Fw: unclassified FW: notice for players
Date: Wed, 30 Jun 2004 13:47:20 -0800
MIME-Version: 1.0
Content-Type: multipart/mixed;
 boundary="----=_NextPart_000_0024_01C45EA8.C395AF20"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1409
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409
X-Sanitizer: This message has been sanitized!
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on neo
X-Spam-Level: *****
X-Spam-Status: No, hits=5.9 required=7.0 tests=BIZ_TLD,DATE_IN_FUTURE_12_24,
 EXCUSE_16,HTML_60_70,HTML_FONTCOLOR_BLUE,HTML_MESSAGE,
 MAILTO_TO_SPAM_ADDR,USER_4U2 autolearn=no version=2.63

This is a multi-part message in MIME format.

------=_NextPart_000_0024_01C45EA8.C395AF20
Content-Type: multipart/alternative;
 boundary="----=_NextPart_001_0025_01C45EA8.C395AF20"

------=_NextPart_001_0025_01C45EA8.C395AF20
Content-Type: text/plain;
 charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

------=_NextPart_001_0025_01C45EA8.C395AF20
Content-Type: text/html;
 charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

------=_NextPart_001_0025_01C45EA8.C395AF20--

------=_NextPart_000_0024_01C45EA8.C395AF20
Content-Type: application/msword;
 name="Pan Pac Club info.doc"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
 filename="Pan Pac Club info.doc"

------=_NextPart_000_0024_01C45EA8.C395AF20--

etc.. here, with body of message and attachment......

============================================================================
============

And this is part of the log for the BAD one:
============================================================
X-OriginalArrivalTime: 29 Jun 2004 19:50:43.0566 (UTC)
FILETIME=[5CFC08E0:01C45E12]
Content-class: urn:content-classes:message
Content-Type: multipart/mixed;
boundary="----_=_NextPart_001_01C45E12.5C2B2D72"
X-Sanitizer: (...SPAM ASSASSIN LOG HERE....)

This is a multi-part message in MIME format.

------_=_NextPart_001_01C45E12.5C2B2D72
Content-Type: multipart/alternative;
        boundary="----_=_NextPart_002_01C45E12.5C2B2D72"

------_=_NextPart_002_01C45E12.5C2B2D72
Content-Type: text/plain;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

then only text body of message follows



hosted by molar.is