[Razor-users] a razored image? (false positive!)

[David R. <dr...@wo...>]

Hey folks.

Got a razor2 false positive this morning (the first I've seen!).

The message (cut from the mbox) is here:

http://wow.atlasta.net/~drais/caughtorder.txt

razor-check -d says:

Dec 19 16:48:42.825829 check[63830]: [ 7] method 4: mail
1.2: no-contention part, spam=1
Dec 19 16:48:42.826028 check[63830]: [ 7] method 4: mail 1: a
non-contention part was spam, mail spam
Dec 19 16:48:42.826254 check[63830]: [ 3] mail 1 is known spam.


I removed all of the message except for the attached image and recieved:

Dec 19 16:49:17.148327 check[63873]: [ 7] method 4: mail
1.0: no-contention part, spam=1
Dec 19 16:49:17.148528 check[63873]: [ 7] method 4: mail 1: a
non-contention part was spam, mail spam
Dec 19 16:49:17.148740 check[63873]: [ 3] mail 1 is known spam.


It looks like the image itself caused this message to trip razor?  I guess
an identical image has been in other reported messages?

Ouch.


...david



---
david raistrick
dr...@at...		http://www.expita.com/nomime.html