Fuz2 false positive

Rose, Bobby brose@med.wayne.edu
Fri Apr 11 16:52:56 UTC 2008


So the message body is just those generic 5 lines.  No wonder it's been
seen so many times.  In the case of Fuz2 and probably even Fuz1, if that
same message body is used all the time with minor changes such as
changing the uri to another page of the same site, then from dcc's point
of view it's the same message hash.
 

-----Original Message-----
From: dcc-admin@rhyolite.com [mailto:dcc-admin@rhyolite.com] On Behalf
Of www.isp2dial.com
Sent: Friday, April 11, 2008 12:21 PM
To: dcc@rhyolite.com
Subject: Fuz2 false positive

Hello,

I am testing DCC, via dccproc in spamassassin.

I was surprised by a hit with the following message, since only a few
people read that list.

Fuz2 looks like a false positive.

I don't want to whitelist every mailing list my users read.  If I had to
do that, I could not justify using DCC.  But if I can disable Fuz2, I
may consider that.  Is it possible?


X-DCC-dcc-servers.net-Metrics: daves 102; Body=3 Fuz1=3 Fuz2=many


>From www-data@vpsville.ca  Fri Apr 11 09:01:51 2008
>Return-Path: <www-data@vpsville.ca>
>Received: from vpsville.ca (mail.vpsville.ca [66.29.75.57])
>        by daves.isp2dial.com (Hard2Crack-0.001) with ESMTP id
m3BD1nqw008125
>        for <jak@isp2dial.com>; Fri, 11 Apr 2008 09:01:50 -0400
>Received: from vpsville.ca (unverified [66.29.75.57])
>        by vpsville.ca (SurgeMail 3.8k4) with ESMTP id 157674-1961819
>        for <jak@isp2dial.com>; Fri, 11 Apr 2008 09:01:49 -0400
>To: jak@isp2dial.com
>Subject: New reply to Re: disk space quotas by diliprajan
>From: admin@vpsville.ca
>Errors-To: admin@vpsville.ca
>X-Mailer: FUDforum v2.7.7
>Content-Type: text/plain; charset=ISO-8859-15
>Date: Fri, 11 Apr 2008 09:01:49 -0400
>Message-ID: <1207918909_1307@vpsville.ca>
>X-Virus-Scanned: ClamAV version 0.92.1, clamav-milter version 0.92.1 on

>daves.isp2dial.com
>X-Virus-Status: Clean
>
>
>To view unread replies go to 
>http://www.vpsville.ca/forum/index.php?t=rview&goto=37#msg_37
>
>If you do not wish to receive further notifications about replies in 
>this topic, please go here: 
>http://www.vpsville.ca/forum/index.php?t=rview&th=22&notify=1&opt=off


_______________________________________________
DCC mailing list      DCC@rhyolite.com
http://www.rhyolite.com/mailman/listinfo/dcc




More information about the DCC mailing list

Contact vjs@rhyolite.com by mail or use the form.