On Wed, 2009-05-27 at 17:16 +0200, Ioannis Aslanidis wrote:

And this may be why:

• 3.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

Ugh. :/ I've been looking into a FP for that rule recently, though the issue I spotted is different from these headers. Hmm, and it actually doesn't trigger that rule for me.

Ah, that would be why. Ioannis, you're running an old version of SA. :) This is an old FP that's been fixed long ago. Please update your SA version 3.1.9 to the latest stable available 3.2.5 -- you'll find you don't need to lower your required_score threshold to 3.5 either.

guenther

-- char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4"; main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}